diff --git a/.cvsignore b/.cvsignore
index 5fc0d13..6361df5 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -216,3 +216,4 @@ serefpolicy-3.8.3.tgz
serefpolicy-3.8.4.tgz
serefpolicy-3.8.5.tgz
serefpolicy-3.8.6.tgz
+serefpolicy-3.8.7.tgz
diff --git a/modules-minimum.conf b/modules-minimum.conf
index e90c4e9..59f04a0 100644
--- a/modules-minimum.conf
+++ b/modules-minimum.conf
@@ -532,13 +532,6 @@ git = module
#
gpm = module
-# Layer: apps
-# Module: ethereal
-#
-# Ethereal packet capture tool.
-#
-ethereal = module
-
# Layer: services
# Module: fail2ban
#
@@ -1743,11 +1736,18 @@ vhostmd = module
wine = module
# Layer: apps
-# Module: telepathy_sofiasip
+# Module: wireshark
+#
+# wireshark executable
+#
+wireshark = module
+
+# Layer: apps
+# Module: telepathy
#
-# telepathy-sofiasip - Telepathy connection manager for SIP
+# telepathy - Policy for Telepathy framework
#
-telepathysofiasip = module
+telepathy = module
# Layer: admin
# Module: tzdata
diff --git a/modules-mls.conf b/modules-mls.conf
index 3fc955a..27eefa3 100644
--- a/modules-mls.conf
+++ b/modules-mls.conf
@@ -504,13 +504,6 @@ gpsd = module
#
gpm = module
-# Layer: apps
-# Module: ethereal
-#
-# Ethereal packet capture tool.
-#
-ethereal = module
-
# Layer: services
# Module: fail2ban
#
@@ -1566,6 +1559,13 @@ ulogd = module
#
wine = module
+# Layer: apps
+# Module: wireshark
+#
+# wireshark executable
+#
+wireshark = module
+
# Layer: admin
# Module: tzdata
#
@@ -1806,11 +1806,11 @@ portreserve = module
rpcbind = module
# Layer: apps
-# Module: telepathy_sofiasip
+# Module: telepathy
#
-# telepathy-sofiasip - Telepathy connection manager for SIP
+# telepathy - Policy for Telepathy framework
#
-telepathysofiasip = module
+telepathy = module
# Layer: apps
# Module: vmware
diff --git a/modules-targeted.conf b/modules-targeted.conf
index e90c4e9..59f04a0 100644
--- a/modules-targeted.conf
+++ b/modules-targeted.conf
@@ -532,13 +532,6 @@ git = module
#
gpm = module
-# Layer: apps
-# Module: ethereal
-#
-# Ethereal packet capture tool.
-#
-ethereal = module
-
# Layer: services
# Module: fail2ban
#
@@ -1743,11 +1736,18 @@ vhostmd = module
wine = module
# Layer: apps
-# Module: telepathy_sofiasip
+# Module: wireshark
+#
+# wireshark executable
+#
+wireshark = module
+
+# Layer: apps
+# Module: telepathy
#
-# telepathy-sofiasip - Telepathy connection manager for SIP
+# telepathy - Policy for Telepathy framework
#
-telepathysofiasip = module
+telepathy = module
# Layer: admin
# Module: tzdata
diff --git a/nsadiff b/nsadiff
index b9ccd80..bbe03f5 100755
--- a/nsadiff
+++ b/nsadiff
@@ -1 +1 @@
-diff --exclude-from=exclude -N -u -r nsaserefpolicy serefpolicy-3.8.6 > /tmp/diff
+diff --exclude-from=exclude -N -u -r nsaserefpolicy serefpolicy-3.8.7 > /tmp/diff
diff --git a/policy-F14.patch b/policy-F14.patch
index 7cf4b62..241cf07 100644
--- a/policy-F14.patch
+++ b/policy-F14.patch
@@ -1,6 +1,6 @@
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.8.6/Makefile
---- nsaserefpolicy/Makefile 2009-08-18 11:41:14.000000000 -0400
-+++ serefpolicy-3.8.6/Makefile 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.8.7/Makefile
+--- nsaserefpolicy/Makefile 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/Makefile 2010-07-14 14:08:02.000000000 -0400
@@ -244,7 +244,7 @@
appdir := $(contextpath)
user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts)
@@ -10,9 +10,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.8.6/M
net_contexts := $(builddir)net_contexts
all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/git_selinux.8 serefpolicy-3.8.6/man/man8/git_selinux.8
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/git_selinux.8 serefpolicy-3.8.7/man/man8/git_selinux.8
--- nsaserefpolicy/man/man8/git_selinux.8 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/man/man8/git_selinux.8 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/man/man8/git_selinux.8 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,109 @@
+.TH "git_selinux" "8" "27 May 2010" "domg472@gmail.com" "Git SELinux policy documentation"
+.de EX
@@ -123,9 +123,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/git_selinux.8 seref
+This manual page was written by Dominick Grift <domg472@gmail.com>.
+.SH "SEE ALSO"
+selinux(8), git(8), chcon(1), semodule(8), setsebool(8)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.8.6/policy/global_tunables
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.8.7/policy/global_tunables
--- nsaserefpolicy/policy/global_tunables 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.8.6/policy/global_tunables 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/global_tunables 2010-07-14 14:08:02.000000000 -0400
@@ -61,15 +61,6 @@
## <desc>
@@ -161,17 +161,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref
+## </desc>
+gen_tunable(mmap_low_allowed, false)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/accountsd.fc serefpolicy-3.8.6/policy/modules/admin/accountsd.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/accountsd.fc serefpolicy-3.8.7/policy/modules/admin/accountsd.fc
--- nsaserefpolicy/policy/modules/admin/accountsd.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/admin/accountsd.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/accountsd.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,4 @@
+
+/usr/libexec/accounts-daemon -- gen_context(system_u:object_r:accountsd_exec_t,s0)
+
+/var/lib/AccountsService(/.*)? gen_context(system_u:object_r:accountsd_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/accountsd.if serefpolicy-3.8.6/policy/modules/admin/accountsd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/accountsd.if serefpolicy-3.8.7/policy/modules/admin/accountsd.if
--- nsaserefpolicy/policy/modules/admin/accountsd.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/admin/accountsd.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/accountsd.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,164 @@
+## <summary>policy for accountsd</summary>
+
@@ -337,9 +337,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/account
+
+ accountsd_manage_var_lib($1)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/accountsd.te serefpolicy-3.8.6/policy/modules/admin/accountsd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/accountsd.te serefpolicy-3.8.7/policy/modules/admin/accountsd.te
--- nsaserefpolicy/policy/modules/admin/accountsd.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/admin/accountsd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/accountsd.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,62 @@
+policy_module(accountsd,1.0.0)
+
@@ -403,9 +403,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/account
+ xserver_manage_xdm_etc_files(accountsd_t)
+ xserver_dbus_chat_xdm(accountsd_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.8.6/policy/modules/admin/anaconda.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.8.7/policy/modules/admin/anaconda.te
--- nsaserefpolicy/policy/modules/admin/anaconda.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/anaconda.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/anaconda.te 2010-07-14 14:08:02.000000000 -0400
@@ -28,8 +28,10 @@
logging_send_syslog_msg(anaconda_t)
@@ -426,9 +426,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anacond
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/certwatch.te serefpolicy-3.8.6/policy/modules/admin/certwatch.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/certwatch.te serefpolicy-3.8.7/policy/modules/admin/certwatch.te
--- nsaserefpolicy/policy/modules/admin/certwatch.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/certwatch.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/certwatch.te 2010-07-14 16:38:41.000000000 -0400
@@ -35,7 +35,7 @@
miscfiles_read_localization(certwatch_t)
@@ -438,9 +438,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/certwat
optional_policy(`
apache_exec_modules(certwatch_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.8.6/policy/modules/admin/consoletype.te
+@@ -47,6 +47,7 @@
+ ')
+
+ optional_policy(`
++ pcscd_domtrans(certwatch_t)
+ pcscd_stream_connect(certwatch_t)
+ pcscd_read_pub_files(certwatch_t)
+ ')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.8.7/policy/modules/admin/consoletype.te
--- nsaserefpolicy/policy/modules/admin/consoletype.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/consoletype.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/consoletype.te 2010-07-14 14:08:02.000000000 -0400
@@ -85,6 +85,7 @@
hal_dontaudit_rw_pipes(consoletype_t)
hal_dontaudit_rw_dgram_sockets(consoletype_t)
@@ -449,9 +457,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-3.8.6/policy/modules/admin/dmesg.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-3.8.7/policy/modules/admin/dmesg.te
--- nsaserefpolicy/policy/modules/admin/dmesg.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/dmesg.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/dmesg.te 2010-07-14 14:08:02.000000000 -0400
@@ -50,6 +50,12 @@
userdom_use_user_terminals(dmesg_t)
@@ -465,33 +473,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.t
seutil_sigchld_newrole(dmesg_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstboot.te serefpolicy-3.8.6/policy/modules/admin/firstboot.te
---- nsaserefpolicy/policy/modules/admin/firstboot.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/firstboot.te 2010-07-12 09:05:35.000000000 -0400
-@@ -76,6 +76,7 @@
- miscfiles_read_localization(firstboot_t)
-
- modutils_domtrans_insmod(firstboot_t)
-+modutils_domtrans_depmod(firstboot_t)
- modutils_read_module_config(firstboot_t)
- modutils_read_module_deps(firstboot_t)
-
-@@ -120,6 +121,12 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstboot.te serefpolicy-3.8.7/policy/modules/admin/firstboot.te
+--- nsaserefpolicy/policy/modules/admin/firstboot.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/firstboot.te 2010-07-14 14:08:02.000000000 -0400
+@@ -121,6 +121,7 @@
')
optional_policy(`
+ gnome_admin_home_gconf_filetrans(firstboot_t, dir)
-+ gnome_manage_config(firstboot_t)
-+')
-+
-+optional_policy(`
-+ xserver_domtrans(firstboot_t)
- xserver_rw_shm(firstboot_t)
- xserver_unconfined(firstboot_t)
+ gnome_manage_config(firstboot_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.8.6/policy/modules/admin/logrotate.te
+
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.8.7/policy/modules/admin/logrotate.te
--- nsaserefpolicy/policy/modules/admin/logrotate.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/logrotate.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/logrotate.te 2010-07-14 14:08:02.000000000 -0400
@@ -119,6 +119,7 @@
userdom_use_user_terminals(logrotate_t)
userdom_list_user_home_dirs(logrotate_t)
@@ -509,9 +504,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.fc serefpolicy-3.8.6/policy/modules/admin/logwatch.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.fc serefpolicy-3.8.7/policy/modules/admin/logwatch.fc
--- nsaserefpolicy/policy/modules/admin/logwatch.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/logwatch.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/logwatch.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,7 +1,11 @@
/usr/sbin/logcheck -- gen_context(system_u:object_r:logwatch_exec_t,s0)
+/usr/sbin/epylog -- gen_context(system_u:object_r:logwatch_exec_t,s0)
@@ -524,9 +519,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc
/var/log/logcheck/.+ -- gen_context(system_u:object_r:logwatch_lock_t,s0)
+
+/var/run/epylog\.pid gen_context(system_u:object_r:logwatch_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.8.6/policy/modules/admin/logwatch.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.8.7/policy/modules/admin/logwatch.te
--- nsaserefpolicy/policy/modules/admin/logwatch.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/logwatch.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/logwatch.te 2010-07-14 14:08:02.000000000 -0400
@@ -19,6 +19,9 @@
type logwatch_tmp_t;
files_tmp_file(logwatch_tmp_t)
@@ -563,9 +558,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc
ifdef(`distro_redhat',`
files_search_all(logwatch_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te serefpolicy-3.8.6/policy/modules/admin/mrtg.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te serefpolicy-3.8.7/policy/modules/admin/mrtg.te
--- nsaserefpolicy/policy/modules/admin/mrtg.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/mrtg.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/mrtg.te 2010-07-14 14:08:02.000000000 -0400
@@ -115,6 +115,7 @@
userdom_use_user_terminals(mrtg_t)
userdom_dontaudit_read_user_home_content_files(mrtg_t)
@@ -574,15 +569,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te
netutils_domtrans_ping(mrtg_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool.fc serefpolicy-3.8.6/policy/modules/admin/ncftool.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool.fc serefpolicy-3.8.7/policy/modules/admin/ncftool.fc
--- nsaserefpolicy/policy/modules/admin/ncftool.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/admin/ncftool.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/ncftool.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,2 @@
+
+/usr/bin/ncftool -- gen_context(system_u:object_r:ncftool_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool.if serefpolicy-3.8.6/policy/modules/admin/ncftool.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool.if serefpolicy-3.8.7/policy/modules/admin/ncftool.if
--- nsaserefpolicy/policy/modules/admin/ncftool.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/admin/ncftool.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/ncftool.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,74 @@
+
+## <summary>policy for ncftool</summary>
@@ -658,9 +653,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool
+ allow $2 ncftool_t:process signal;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool.te serefpolicy-3.8.6/policy/modules/admin/ncftool.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool.te serefpolicy-3.8.7/policy/modules/admin/ncftool.te
--- nsaserefpolicy/policy/modules/admin/ncftool.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/admin/ncftool.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/ncftool.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,79 @@
+policy_module(ncftool, 1.0.0)
+
@@ -741,9 +736,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool
+optional_policy(`
+ dbus_system_bus_client(ncftool_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.8.6/policy/modules/admin/netutils.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.8.7/policy/modules/admin/netutils.te
--- nsaserefpolicy/policy/modules/admin/netutils.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/netutils.te 2010-07-12 16:42:27.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/netutils.te 2010-07-14 14:08:02.000000000 -0400
@@ -51,6 +51,8 @@
kernel_search_proc(netutils_t)
@@ -826,9 +821,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil
+ term_dontaudit_use_all_ttys(traceroute_t)
+ term_dontaudit_use_all_ptys(traceroute_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.8.6/policy/modules/admin/prelink.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.8.7/policy/modules/admin/prelink.te
--- nsaserefpolicy/policy/modules/admin/prelink.te 2010-06-21 08:21:16.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/prelink.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/prelink.te 2010-07-14 16:40:01.000000000 -0400
@@ -59,6 +59,7 @@
manage_files_pattern(prelink_t, prelink_var_lib_t, prelink_var_lib_t)
relabel_files_pattern(prelink_t, prelink_var_lib_t, prelink_var_lib_t)
@@ -837,7 +832,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink
# prelink misc objects that are not system
# libraries or entrypoints
-@@ -99,6 +100,8 @@
+@@ -73,6 +74,7 @@
+ corecmd_read_bin_symlinks(prelink_t)
+
+ dev_read_urand(prelink_t)
++dev_getattr_all_chr_files(prelink_t)
+
+ files_list_all(prelink_t)
+ files_getattr_all_files(prelink_t)
+@@ -99,6 +101,8 @@
miscfiles_read_localization(prelink_t)
userdom_use_user_terminals(prelink_t)
@@ -846,7 +849,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink
optional_policy(`
amanda_manage_lib(prelink_t)
-@@ -129,6 +132,7 @@
+@@ -129,6 +133,7 @@
read_files_pattern(prelink_cron_system_t, prelink_cache_t, prelink_cache_t)
allow prelink_cron_system_t prelink_cache_t:file unlink;
@@ -854,9 +857,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink
domtrans_pattern(prelink_cron_system_t, prelink_exec_t, prelink_t)
allow prelink_cron_system_t prelink_t:process noatsecure;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.8.6/policy/modules/admin/readahead.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.8.7/policy/modules/admin/readahead.te
--- nsaserefpolicy/policy/modules/admin/readahead.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/readahead.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/readahead.te 2010-07-14 14:08:02.000000000 -0400
@@ -51,6 +51,7 @@
files_list_non_security(readahead_t)
@@ -873,15 +876,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe
fs_dontaudit_search_ramfs(readahead_t)
fs_dontaudit_read_ramfs_pipes(readahead_t)
fs_dontaudit_read_ramfs_files(readahead_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.8.6/policy/modules/admin/rpm.fc
---- nsaserefpolicy/policy/modules/admin/rpm.fc 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/rpm.fc 2010-07-12 13:53:51.000000000 -0400
-@@ -1,17 +1,18 @@
-
- /bin/rpm -- gen_context(system_u:object_r:rpm_exec_t,s0)
- /usr/bin/rpm -- gen_context(system_u:object_r:rpm_exec_t,s0)
-+/usr/bin/debuginfo-install -- gen_context(system_u:object_r:debuginfo_exec_t,s0)
- /usr/bin/smart -- gen_context(system_u:object_r:rpm_exec_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.8.7/policy/modules/admin/rpm.fc
+--- nsaserefpolicy/policy/modules/admin/rpm.fc 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/rpm.fc 2010-07-14 14:08:02.000000000 -0400
+@@ -7,6 +7,7 @@
/usr/bin/yum -- gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -889,14 +887,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
/usr/libexec/yumDBUSBackend.py -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/sbin/yum-complete-transaction -- gen_context(system_u:object_r:rpm_exec_t,s0)
-
- /usr/sbin/system-install-packages -- gen_context(system_u:object_r:rpm_exec_t,s0)
- /usr/sbin/yum-updatesd -- gen_context(system_u:object_r:rpm_exec_t,s0)
--/usr/sbin/packagekitd -- gen_context(system_u:object_r:rpm_exec_t,s0)
-
- /usr/share/yumex/yumex-yum-backend -- gen_context(system_u:object_r:rpm_exec_t,s0)
- /usr/share/yumex/yum_childtask\.py -- gen_context(system_u:object_r:rpm_exec_t,s0)
-@@ -23,6 +24,9 @@
+@@ -25,6 +26,9 @@
/usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/sbin/up2date -- gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -906,47 +897,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
')
/var/cache/yum(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.8.6/policy/modules/admin/rpm.if
---- nsaserefpolicy/policy/modules/admin/rpm.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/rpm.if 2010-07-12 09:05:35.000000000 -0400
-@@ -13,11 +13,36 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.8.7/policy/modules/admin/rpm.if
+--- nsaserefpolicy/policy/modules/admin/rpm.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/rpm.if 2010-07-14 14:08:02.000000000 -0400
+@@ -13,11 +13,14 @@
interface(`rpm_domtrans',`
gen_require(`
type rpm_t, rpm_exec_t;
-+ type debuginfo_exec_t;
+ attribute rpm_transition_domain;
')
files_search_usr($1)
corecmd_search_bin($1)
domtrans_pattern($1, rpm_exec_t, rpm_t)
-+ domtrans_pattern($1, debuginfo_exec_t, rpm_t)
+ typeattribute $1 rpm_transition_domain;
-+')
-+
-+########################################
-+## <summary>
-+## Execute debuginfo_install programs in the rpm domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`rpm_domtrans_debuginfo',`
-+ gen_require(`
-+ type rpm_t;
-+ type debuginfo_exec_t;
-+ ')
-+
-+ files_search_usr($1)
-+ corecmd_search_bin($1)
-+ domtrans_pattern($1, debuginfo_exec_t, rpm_t)
++ rpm_debuginfo_domtrans($1)
')
########################################
-@@ -66,6 +91,11 @@
+@@ -87,6 +90,11 @@
rpm_domtrans($1)
role $2 types rpm_t;
role $2 types rpm_script_t;
@@ -958,7 +927,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
seutil_run_loadpolicy(rpm_script_t, $2)
seutil_run_semanage(rpm_script_t, $2)
seutil_run_setfiles(rpm_script_t, $2)
-@@ -164,6 +194,41 @@
+@@ -185,6 +193,41 @@
########################################
## <summary>
@@ -1000,7 +969,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
## Send and receive messages from
## rpm over dbus.
## </summary>
-@@ -317,7 +382,9 @@
+@@ -338,7 +381,9 @@
')
files_search_tmp($1)
@@ -1010,7 +979,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
')
#####################################
-@@ -357,7 +424,9 @@
+@@ -378,7 +423,9 @@
')
files_search_tmp($1)
@@ -1020,7 +989,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
')
########################################
-@@ -440,6 +509,7 @@
+@@ -461,6 +508,7 @@
allow $1 rpm_var_lib_t:dir list_dir_perms;
read_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
read_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
@@ -1028,14 +997,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
')
########################################
-@@ -556,3 +626,66 @@
+@@ -577,3 +625,66 @@
- files_pid_filetrans($1, rpm_var_run_t, file)
+ files_pid_filetrans($1, rpm_var_run_t, file)
')
+
+########################################
+## <summary>
-+## Allow application to transition to rpm_script domain.
++## Send a null signal to rpm.
+## </summary>
+## <param name="domain">
+## <summary>
@@ -1043,80 +1012,75 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
+## </summary>
+## </param>
+#
-+interface(`rpm_transition_script',`
++interface(`rpm_inherited_fifo',`
+ gen_require(`
-+ type rpm_script_t;
+ attribute rpm_transition_domain;
+ ')
+
-+ typeattribute $1 rpm_transition_domain;
-+ allow $1 rpm_script_t:process transition;
-+
-+ allow $1 rpm_script_t:fd use;
-+ allow rpm_script_t $1:fd use;
-+ allow rpm_script_t $1:fifo_file rw_fifo_file_perms;
-+ allow rpm_script_t $1:process sigchld;
++ allow $1 rpm_transition_domain:fifo_file rw_inherited_fifo_file_perms;
+')
+
++
+########################################
+## <summary>
-+## Send a null signal to rpm.
++## Make rpm_exec_t an entry point for
++## the specified domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
-+#
-+interface(`rpm_inherited_fifo',`
++#
++interface(`rpm_entry_type',`
+ gen_require(`
-+ attribute rpm_transition_domain;
++ type rpm_exec_t;
+ ')
+
-+ allow $1 rpm_transition_domain:fifo_file rw_inherited_fifo_file_perms;
++ domain_entry_file($1, rpm_exec_t)
+')
+
-+
+########################################
+## <summary>
-+## Make rpm_exec_t an entry point for
-+## the specified domain.
++## Allow application to transition to rpm_script domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
-+#
-+interface(`rpm_entry_type',`
++#
++interface(`rpm_transition_script',`
+ gen_require(`
-+ type rpm_exec_t;
++ type rpm_script_t;
++ attribute rpm_transition_domain;
+ ')
+
-+ domain_entry_file($1, rpm_exec_t)
++ typeattribute $1 rpm_transition_domain;
++ allow $1 rpm_script_t:process transition;
++
++ allow $1 rpm_script_t:fd use;
++ allow rpm_script_t $1:fd use;
++ allow rpm_script_t $1:fifo_file rw_fifo_file_perms;
++ allow rpm_script_t $1:process sigchld;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.8.6/policy/modules/admin/rpm.te
---- nsaserefpolicy/policy/modules/admin/rpm.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/rpm.te 2010-07-12 09:05:35.000000000 -0400
-@@ -1,5 +1,7 @@
- policy_module(rpm, 1.11.0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.8.7/policy/modules/admin/rpm.te
+--- nsaserefpolicy/policy/modules/admin/rpm.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/rpm.te 2010-07-14 14:08:02.000000000 -0400
+@@ -1,10 +1,11 @@
+ policy_module(rpm, 1.11.1)
+attribute rpm_transition_domain;
+
########################################
#
# Declarations
-@@ -14,6 +16,9 @@
- domain_interactive_fd(rpm_t)
- role system_r types rpm_t;
-
-+type debuginfo_exec_t;
-+domain_entry_file(rpm_t, debuginfo_exec_t)
-+
- type rpm_file_t;
- files_type(rpm_file_t)
+ #
+-
+ type debuginfo_exec_t;
+ domain_entry_file(rpm_t, debuginfo_exec_t)
-@@ -41,6 +46,7 @@
+@@ -44,6 +45,7 @@
domain_obj_id_change_exemption(rpm_script_t)
domain_system_change_exemption(rpm_script_t)
corecmd_shell_entry_type(rpm_script_t)
@@ -1124,7 +1088,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
domain_type(rpm_script_t)
domain_entry_file(rpm_t, rpm_script_exec_t)
domain_interactive_fd(rpm_script_t)
-@@ -74,6 +80,8 @@
+@@ -77,6 +79,8 @@
allow rpm_t self:sem create_sem_perms;
allow rpm_t self:msgq create_msgq_perms;
allow rpm_t self:msg { send receive };
@@ -1133,7 +1097,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
allow rpm_t rpm_log_t:file manage_file_perms;
logging_log_filetrans(rpm_t, rpm_log_t, file)
-@@ -81,6 +89,7 @@
+@@ -84,6 +88,7 @@
manage_dirs_pattern(rpm_t, rpm_tmp_t, rpm_tmp_t)
manage_files_pattern(rpm_t, rpm_tmp_t, rpm_tmp_t)
files_tmp_filetrans(rpm_t, rpm_tmp_t, { file dir })
@@ -1141,7 +1105,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
manage_dirs_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t)
manage_files_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t)
-@@ -88,6 +97,7 @@
+@@ -91,6 +96,7 @@
manage_fifo_files_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t)
manage_sock_files_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t)
fs_tmpfs_filetrans(rpm_t, rpm_tmpfs_t, { dir file lnk_file sock_file fifo_file })
@@ -1149,7 +1113,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
manage_dirs_pattern(rpm_t, rpm_var_cache_t, rpm_var_cache_t)
manage_files_pattern(rpm_t, rpm_var_cache_t, rpm_var_cache_t)
-@@ -103,6 +113,7 @@
+@@ -106,6 +112,7 @@
kernel_read_network_state(rpm_t)
kernel_read_system_state(rpm_t)
kernel_read_kernel_sysctls(rpm_t)
@@ -1157,7 +1121,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
corecmd_exec_all_executables(rpm_t)
-@@ -122,6 +133,8 @@
+@@ -125,6 +132,8 @@
dev_list_sysfs(rpm_t)
dev_list_usbfs(rpm_t)
dev_read_urand(rpm_t)
@@ -1166,18 +1130,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
fs_getattr_all_dirs(rpm_t)
fs_list_inotifyfs(rpm_t)
-@@ -201,6 +214,10 @@
+@@ -205,6 +214,7 @@
optional_policy(`
networkmanager_dbus_chat(rpm_t)
')
+
-+ optional_policy(`
-+ dbus_system_domain(rpm_t, debuginfo_exec_t)
-+ ')
')
optional_policy(`
-@@ -208,7 +225,7 @@
+@@ -212,7 +222,7 @@
')
optional_policy(`
@@ -1186,25 +1147,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
# yum-updatesd requires this
unconfined_dbus_chat(rpm_t)
unconfined_dbus_chat(rpm_script_t)
-@@ -219,8 +236,8 @@
- # rpm-script Local policy
- #
-
--allow rpm_script_t self:capability { chown dac_override dac_read_search fowner fsetid setgid setuid ipc_lock sys_chroot sys_nice mknod kill };
--allow rpm_script_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
-+allow rpm_script_t self:capability { chown dac_override dac_read_search fowner fsetid setgid setuid ipc_lock sys_admin sys_chroot sys_ptrace sys_rawio sys_nice mknod kill net_admin };
-+allow rpm_script_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execheap };
- allow rpm_script_t self:fd use;
- allow rpm_script_t self:fifo_file rw_fifo_file_perms;
- allow rpm_script_t self:unix_dgram_socket create_socket_perms;
-@@ -231,12 +248,15 @@
- allow rpm_script_t self:sem create_sem_perms;
- allow rpm_script_t self:msgq create_msgq_perms;
- allow rpm_script_t self:msg { send receive };
-+allow rpm_script_t self:netlink_kobject_uevent_socket create_socket_perms;
-
- allow rpm_script_t rpm_tmp_t:file read_file_perms;
-
+@@ -242,6 +252,8 @@
allow rpm_script_t rpm_script_tmp_t:dir mounton;
manage_dirs_pattern(rpm_script_t, rpm_script_tmp_t, rpm_script_tmp_t)
manage_files_pattern(rpm_script_t, rpm_script_tmp_t, rpm_script_tmp_t)
@@ -1213,7 +1156,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
files_tmp_filetrans(rpm_script_t, rpm_script_tmp_t, { file dir })
manage_dirs_pattern(rpm_script_t, rpm_script_tmpfs_t, rpm_script_tmpfs_t)
-@@ -249,6 +269,7 @@
+@@ -254,6 +266,7 @@
kernel_read_kernel_sysctls(rpm_script_t)
kernel_read_system_state(rpm_script_t)
kernel_read_network_state(rpm_script_t)
@@ -1221,11 +1164,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
kernel_read_software_raid_state(rpm_script_t)
dev_list_sysfs(rpm_script_t)
-@@ -293,8 +314,11 @@
- auth_use_nsswitch(rpm_script_t)
- # ideally we would not need this
- auth_manage_all_files_except_shadow(rpm_script_t)
-+auth_relabel_shadow(rpm_script_t)
+@@ -301,6 +314,8 @@
+ auth_relabel_shadow(rpm_script_t)
corecmd_exec_all_executables(rpm_script_t)
+can_exec(rpm_script_t, rpm_script_tmp_t)
@@ -1233,15 +1173,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
domain_read_all_domains_state(rpm_script_t)
domain_getattr_all_domains(rpm_script_t)
-@@ -306,6 +330,7 @@
- files_exec_etc_files(rpm_script_t)
- files_read_etc_runtime_files(rpm_script_t)
- files_exec_usr_files(rpm_script_t)
-+files_relabel_all_files(rpm_script_t)
-
- init_domtrans_script(rpm_script_t)
- init_telinit(rpm_script_t)
-@@ -324,12 +349,15 @@
+@@ -331,12 +346,15 @@
seutil_domtrans_loadpolicy(rpm_script_t)
seutil_domtrans_setfiles(rpm_script_t)
seutil_domtrans_semanage(rpm_script_t)
@@ -1257,18 +1189,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
')
')
-@@ -342,6 +370,10 @@
- ')
-
- optional_policy(`
-+ dbus_system_bus_client(rpm_script_t)
-+')
-+
-+optional_policy(`
- lvm_domtrans(rpm_script_t)
- ')
-
-@@ -355,8 +387,9 @@
+@@ -366,8 +384,9 @@
')
optional_policy(`
@@ -1279,9 +1200,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
optional_policy(`
java_domtrans_unconfined(rpm_script_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sectoolm.te serefpolicy-3.8.6/policy/modules/admin/sectoolm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sectoolm.te serefpolicy-3.8.7/policy/modules/admin/sectoolm.te
--- nsaserefpolicy/policy/modules/admin/sectoolm.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/sectoolm.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/sectoolm.te 2010-07-14 14:08:02.000000000 -0400
@@ -84,6 +84,7 @@
sysnet_domtrans_ifconfig(sectoolm_t)
@@ -1290,9 +1211,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sectool
optional_policy(`
mount_exec(sectoolm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewall.if serefpolicy-3.8.6/policy/modules/admin/shorewall.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewall.if serefpolicy-3.8.7/policy/modules/admin/shorewall.if
--- nsaserefpolicy/policy/modules/admin/shorewall.if 2010-03-18 10:35:11.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/shorewall.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/shorewall.if 2010-07-14 14:08:02.000000000 -0400
@@ -134,9 +134,10 @@
#
interface(`shorewall_admin',`
@@ -1322,9 +1243,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewa
files_search_tmp($1)
admin_pattern($1, shorewall_tmp_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewall.te serefpolicy-3.8.6/policy/modules/admin/shorewall.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewall.te serefpolicy-3.8.7/policy/modules/admin/shorewall.te
--- nsaserefpolicy/policy/modules/admin/shorewall.te 2010-06-21 08:21:16.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/shorewall.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/shorewall.te 2010-07-14 14:08:02.000000000 -0400
@@ -80,13 +80,14 @@
init_rw_utmp(shorewall_t)
@@ -1341,73 +1262,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewa
optional_policy(`
hostname_exec(shorewall_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shutdown.fc serefpolicy-3.8.6/policy/modules/admin/shutdown.fc
---- nsaserefpolicy/policy/modules/admin/shutdown.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/admin/shutdown.fc 2010-07-12 09:05:35.000000000 -0400
-@@ -0,0 +1,5 @@
-+/etc/nologin -- gen_context(system_u:object_r:shutdown_etc_t,s0)
-+
-+/sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
-+
-+/var/run/shutdown\.pid -- gen_context(system_u:object_r:shutdown_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shutdown.if serefpolicy-3.8.6/policy/modules/admin/shutdown.if
---- nsaserefpolicy/policy/modules/admin/shutdown.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/admin/shutdown.if 2010-07-12 09:05:35.000000000 -0400
-@@ -0,0 +1,136 @@
-+
-+## <summary>policy for shutdown</summary>
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run shutdown.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`shutdown_domtrans',`
-+ gen_require(`
-+ type shutdown_t, shutdown_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, shutdown_exec_t, shutdown_t)
-+
-+ ifdef(`hide_broken_symptoms', `
-+ dontaudit shutdown_t $1:socket_class_set { read write };
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shutdown.if serefpolicy-3.8.7/policy/modules/admin/shutdown.if
+--- nsaserefpolicy/policy/modules/admin/shutdown.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/shutdown.if 2010-07-14 14:08:02.000000000 -0400
+@@ -19,10 +19,11 @@
+
+ ifdef(`hide_broken_symptoms', `
+ dontaudit shutdown_t $1:socket_class_set { read write };
+- dontaudit shutdown_t $1:fifo_file { read write };
+ dontaudit shutdown_t $1:fifo_file rw_inherited_fifo_file_perms;
-+ ')
-+')
-+
-+
-+########################################
-+## <summary>
-+## Execute shutdown in the shutdown domain, and
-+## allow the specified role the shutdown domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access
-+## </summary>
-+## </param>
-+## <param name="role">
-+## <summary>
-+## The role to be allowed the shutdown domain.
-+## </summary>
-+## </param>
-+#
-+interface(`shutdown_run',`
-+ gen_require(`
-+ type shutdown_t;
-+ ')
-+
-+ shutdown_domtrans($1)
-+ role $2 types shutdown_t;
-+')
+ ')
+ ')
+
+
-+########################################
-+## <summary>
+ ########################################
+ ## <summary>
+ ## Execute shutdown in the shutdown domain, and
+@@ -50,6 +51,73 @@
+
+ ########################################
+ ## <summary>
+## Role access for shutdown
+## </summary>
+## <param name="role">
@@ -1475,101 +1349,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shutdow
+
+########################################
+## <summary>
-+## Get attributes of shutdown executable.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`shutdown_getattr_exec_files',`
-+ gen_require(`
-+ type shutdown_exec_t;
-+ ')
-+
-+ allow $1 shutdown_exec_t:file getattr;
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shutdown.te serefpolicy-3.8.6/policy/modules/admin/shutdown.te
---- nsaserefpolicy/policy/modules/admin/shutdown.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/admin/shutdown.te 2010-07-12 09:05:35.000000000 -0400
-@@ -0,0 +1,61 @@
-+policy_module(shutdown,1.0.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+type shutdown_t;
-+type shutdown_exec_t;
-+application_domain(shutdown_t, shutdown_exec_t)
-+role system_r types shutdown_t;
-+
-+type shutdown_etc_t;
-+files_config_file(shutdown_etc_t)
-+
-+type shutdown_var_run_t;
-+files_pid_file(shutdown_var_run_t)
-+
-+########################################
-+#
-+# shutdown local policy
-+#
-+
-+allow shutdown_t self:capability { dac_override kill setuid sys_tty_config };
-+allow shutdown_t self:process { fork signal signull };
-+
-+allow shutdown_t self:fifo_file manage_fifo_file_perms;
-+allow shutdown_t self:unix_stream_socket create_stream_socket_perms;
-+
-+manage_files_pattern(shutdown_t, shutdown_etc_t, shutdown_etc_t)
-+files_etc_filetrans(shutdown_t, shutdown_etc_t, file)
-+
-+manage_files_pattern(shutdown_t, shutdown_var_run_t, shutdown_var_run_t)
-+files_pid_filetrans(shutdown_t, shutdown_var_run_t, file)
-+
-+files_read_etc_files(shutdown_t)
-+files_read_generic_pids(shutdown_t)
-+
+ ## Get attributes of shutdown executable.
+ ## </summary>
+ ## <param name="domain">
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shutdown.te serefpolicy-3.8.7/policy/modules/admin/shutdown.te
+--- nsaserefpolicy/policy/modules/admin/shutdown.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/shutdown.te 2010-07-14 14:08:02.000000000 -0400
+@@ -36,6 +36,8 @@
+ files_read_etc_files(shutdown_t)
+ files_read_generic_pids(shutdown_t)
+
+mls_file_write_to_clearance(shutdown_t)
+
-+term_use_all_terms(shutdown_t)
-+
-+auth_use_nsswitch(shutdown_t)
-+auth_write_login_records(shutdown_t)
-+
-+init_dontaudit_write_utmp(shutdown_t)
-+init_read_utmp(shutdown_t)
-+init_telinit(shutdown_t)
-+
-+logging_send_audit_msgs(shutdown_t)
-+
-+miscfiles_read_localization(shutdown_t)
-+
-+optional_policy(`
-+ dbus_system_bus_client(shutdown_t)
-+ dbus_connect_system_bus(shutdown_t)
-+')
-+
-+optional_policy(`
-+ xserver_dontaudit_write_log(shutdown_t)
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.8.6/policy/modules/admin/sudo.if
---- nsaserefpolicy/policy/modules/admin/sudo.if 2010-06-21 08:21:16.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/sudo.if 2010-07-12 09:05:35.000000000 -0400
-@@ -73,6 +73,10 @@
- # Enter this derived domain from the user domain
- domtrans_pattern($3, sudo_exec_t, $1_sudo_t)
+ term_use_all_terms(shutdown_t)
-+ ifdef(`hide_broken_symptoms', `
-+ dontaudit $1_sudo_t $3:socket_class_set { read write };
-+ ')
-+
- # By default, revert to the calling domain when a shell is executed.
- corecmd_shell_domtrans($1_sudo_t, $3)
- corecmd_bin_domtrans($1_sudo_t, $3)
-@@ -134,11 +138,11 @@
+ auth_use_nsswitch(shutdown_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.8.7/policy/modules/admin/sudo.if
+--- nsaserefpolicy/policy/modules/admin/sudo.if 2010-06-21 08:21:16.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/sudo.if 2010-07-14 14:08:02.000000000 -0400
+@@ -134,12 +134,16 @@
userdom_manage_user_tmp_symlinks($1_sudo_t)
userdom_use_user_terminals($1_sudo_t)
# for some PAM modules and for cwd
@@ -1578,16 +1376,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
+ userdom_search_admin_dir($1_sudo_t)
+ userdom_manage_all_users_keys($1_sudo_t)
-- ifdef(`hide_broken_symptoms', `
-- dontaudit $1_sudo_t $3:socket_class_set { read write };
-- ')
-+ mta_role($2, $1_sudo_t)
+ ifdef(`hide_broken_symptoms', `
+ dontaudit $1_sudo_t $3:socket_class_set { read write };
+ ')
++ mta_role($2, $1_sudo_t)
++
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_files($1_sudo_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.8.6/policy/modules/admin/su.if
+ ')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.8.7/policy/modules/admin/su.if
--- nsaserefpolicy/policy/modules/admin/su.if 2010-06-21 08:21:16.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/su.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/su.if 2010-07-14 14:08:02.000000000 -0400
@@ -212,7 +212,7 @@
auth_domtrans_chk_passwd($1_su_t)
@@ -1605,9 +1405,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s
ifdef(`distro_redhat',`
# RHEL5 and possibly newer releases incl. Fedora
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.8.6/policy/modules/admin/tmpreaper.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.8.7/policy/modules/admin/tmpreaper.te
--- nsaserefpolicy/policy/modules/admin/tmpreaper.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/tmpreaper.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/tmpreaper.te 2010-07-14 14:08:02.000000000 -0400
@@ -25,8 +25,11 @@
files_read_etc_files(tmpreaper_t)
files_read_var_lib_files(tmpreaper_t)
@@ -1645,86 +1445,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreap
rpm_manage_cache(tmpreaper_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.8.6/policy/modules/admin/usermanage.if
---- nsaserefpolicy/policy/modules/admin/usermanage.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/usermanage.if 2010-07-12 09:05:35.000000000 -0400
-@@ -18,6 +18,10 @@
- files_search_usr($1)
- corecmd_search_bin($1)
- domtrans_pattern($1, chfn_exec_t, chfn_t)
-+
-+ifdef(`hide_broken_symptoms', `
-+ dontaudit chfn_t $1:socket_class_set { read write };
-+')
- ')
-
- ########################################
-@@ -63,6 +67,10 @@
- files_search_usr($1)
- corecmd_search_bin($1)
- domtrans_pattern($1, groupadd_exec_t, groupadd_t)
-+
-+ifdef(`hide_broken_symptoms', `
-+ dontaudit groupadd_t $1:socket_class_set { read write };
-+')
- ')
-
- ########################################
-@@ -113,6 +121,10 @@
- files_search_usr($1)
- corecmd_search_bin($1)
- domtrans_pattern($1, passwd_exec_t, passwd_t)
-+
-+ifdef(`hide_broken_symptoms', `
-+ dontaudit passwd_t $1:socket_class_set { read write };
-+')
- ')
-
- ########################################
-@@ -247,6 +259,9 @@
- files_search_usr($1)
- corecmd_search_bin($1)
- domtrans_pattern($1, useradd_exec_t, useradd_t)
-+ifdef(`hide_broken_symptoms', `
-+ dontaudit useradd_t $1:socket_class_set { read write };
-+')
- ')
-
- ########################################
-@@ -274,6 +289,11 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.8.7/policy/modules/admin/usermanage.if
+--- nsaserefpolicy/policy/modules/admin/usermanage.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/usermanage.if 2010-07-14 14:08:02.000000000 -0400
+@@ -290,6 +290,9 @@
usermanage_domtrans_useradd($1)
role $2 types useradd_t;
+ # Add/remove user home directories
+ userdom_manage_home_role($2, useradd_t)
+
-+ seutil_run_semanage(useradd_t, $2)
-+
- optional_policy(`
- nscd_run(useradd_t, $2)
- ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.8.6/policy/modules/admin/usermanage.te
---- nsaserefpolicy/policy/modules/admin/usermanage.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/usermanage.te 2010-07-12 09:05:35.000000000 -0400
-@@ -208,6 +208,7 @@
- files_manage_etc_files(groupadd_t)
- files_relabel_etc_files(groupadd_t)
- files_read_etc_runtime_files(groupadd_t)
-+files_read_usr_symlinks(groupadd_t)
-
- # Execute /usr/bin/{passwd, chfn, chsh} and /usr/sbin/{useradd, vipw}.
- corecmd_exec_bin(groupadd_t)
-@@ -255,7 +256,8 @@
- # Passwd local policy
- #
+ seutil_run_semanage(useradd_t, $2)
--allow passwd_t self:capability { chown dac_override fsetid setuid setgid sys_resource };
-+allow passwd_t self:capability { chown dac_override fsetid setuid setgid sys_nice sys_resource };
-+dontaudit passwd_t self:capability sys_tty_config;
- allow passwd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
- allow passwd_t self:process { setrlimit setfscreate };
- allow passwd_t self:fd use;
-@@ -293,6 +295,7 @@
+ optional_policy(`
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.8.7/policy/modules/admin/usermanage.te
+--- nsaserefpolicy/policy/modules/admin/usermanage.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/usermanage.te 2010-07-14 14:08:02.000000000 -0400
+@@ -295,6 +295,7 @@
term_use_all_ttys(passwd_t)
term_use_all_ptys(passwd_t)
@@ -1732,7 +1469,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
auth_domtrans_chk_passwd(passwd_t)
auth_manage_shadow(passwd_t)
-@@ -302,6 +305,9 @@
+@@ -304,6 +305,9 @@
# allow checking if a shell is executable
corecmd_check_exec_shell(passwd_t)
@@ -1742,7 +1479,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
domain_use_interactive_fds(passwd_t)
-@@ -332,6 +338,7 @@
+@@ -334,6 +338,7 @@
# user generally runs this from their home directory, so do not audit a search
# on user home dir
userdom_dontaudit_search_user_home_content(passwd_t)
@@ -1750,7 +1487,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
optional_policy(`
nscd_domtrans(passwd_t)
-@@ -426,7 +433,7 @@
+@@ -428,7 +433,7 @@
# Useradd local policy
#
@@ -1759,15 +1496,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
dontaudit useradd_t self:capability sys_tty_config;
allow useradd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow useradd_t self:process setfscreate;
-@@ -449,6 +456,7 @@
- corecmd_exec_bin(useradd_t)
-
- domain_use_interactive_fds(useradd_t)
-+domain_read_all_domains_state(useradd_t)
-
- files_manage_etc_files(useradd_t)
- files_search_var_lib(useradd_t)
-@@ -497,12 +505,8 @@
+@@ -500,12 +505,8 @@
userdom_use_unpriv_users_fds(useradd_t)
# Add/remove user home directories
@@ -1781,22 +1510,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
mta_manage_spool(useradd_t)
-@@ -526,6 +530,12 @@
- ')
-
- optional_policy(`
-+ tunable_policy(`samba_domain_controller',`
-+ samba_append_log(useradd_t)
-+ ')
-+')
-+
-+optional_policy(`
- puppet_rw_tmp(useradd_t)
- ')
-
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.8.6/policy/modules/admin/vbetool.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.8.7/policy/modules/admin/vbetool.te
--- nsaserefpolicy/policy/modules/admin/vbetool.te 2010-06-21 08:21:16.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/vbetool.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/vbetool.te 2010-07-14 14:08:02.000000000 -0400
@@ -24,7 +24,10 @@
dev_rw_xserver_misc(vbetool_t)
dev_rw_mtrr(vbetool_t)
@@ -1808,52 +1524,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool
mls_file_read_all_levels(vbetool_t)
mls_file_write_all_levels(vbetool_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.if serefpolicy-3.8.6/policy/modules/admin/vpn.if
---- nsaserefpolicy/policy/modules/admin/vpn.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/vpn.if 2010-07-12 09:05:35.000000000 -0400
-@@ -110,7 +110,7 @@
- ## </summary>
- ## </param>
- #
--interface(`vpnc_dbus_chat',`
-+interface(`vpn_dbus_chat',`
- gen_require(`
- type vpnc_t;
- class dbus send_msg;
-@@ -119,3 +119,21 @@
- allow $1 vpnc_t:dbus send_msg;
- allow vpnc_t $1:dbus send_msg;
- ')
-+
-+########################################
-+## <summary>
-+## Relabelfrom from vpnc socket.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`vpn_relabelfrom_tun_socket',`
-+ gen_require(`
-+ type boot_t;
-+ ')
-+
-+ allow $1 vpnc_t:tun_socket relabelfrom;
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.8.6/policy/modules/admin/vpn.te
---- nsaserefpolicy/policy/modules/admin/vpn.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/admin/vpn.te 2010-07-12 09:05:35.000000000 -0400
-@@ -30,7 +30,7 @@
- allow vpnc_t self:rawip_socket create_socket_perms;
- allow vpnc_t self:unix_dgram_socket create_socket_perms;
- allow vpnc_t self:unix_stream_socket create_socket_perms;
--allow vpnc_t self:tun_socket create_socket_perms;
-+allow vpnc_t self:tun_socket { create_socket_perms relabelfrom };
- # cjp: this needs to be fixed
- allow vpnc_t self:socket create_socket_perms;
-
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.8.7/policy/modules/admin/vpn.te
+--- nsaserefpolicy/policy/modules/admin/vpn.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/admin/vpn.te 2010-07-14 14:08:02.000000000 -0400
@@ -107,6 +107,7 @@
userdom_use_all_users_fds(vpnc_t)
@@ -1862,9 +1535,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te
optional_policy(`
dbus_system_bus_client(vpnc_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.te serefpolicy-3.8.6/policy/modules/apps/awstats.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.te serefpolicy-3.8.7/policy/modules/apps/awstats.te
--- nsaserefpolicy/policy/modules/apps/awstats.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/awstats.te 2010-07-12 15:49:38.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/awstats.te 2010-07-14 14:08:02.000000000 -0400
@@ -47,6 +47,7 @@
files_read_etc_files(awstats_t)
# e.g. /usr/share/awstats/lang/awstats-en.txt
@@ -1873,16 +1546,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.
fs_list_inotifyfs(awstats_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.fc serefpolicy-3.8.6/policy/modules/apps/chrome.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.fc serefpolicy-3.8.7/policy/modules/apps/chrome.fc
--- nsaserefpolicy/policy/modules/apps/chrome.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/chrome.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/chrome.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,3 @@
+ /opt/google/chrome/chrome-sandbox -- gen_context(system_u:object_r:chrome_sandbox_exec_t,s0)
+
+/usr/lib(64)?/chromium-browser/chrome-sandbox -- gen_context(system_u:object_r:chrome_sandbox_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.if serefpolicy-3.8.6/policy/modules/apps/chrome.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.if serefpolicy-3.8.7/policy/modules/apps/chrome.if
--- nsaserefpolicy/policy/modules/apps/chrome.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/chrome.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/chrome.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,90 @@
+
+## <summary>policy for chrome</summary>
@@ -1974,9 +1647,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.i
+ allow $2 chrome_sandbox_tmpfs_t:file rw_file_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.te serefpolicy-3.8.6/policy/modules/apps/chrome.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.te serefpolicy-3.8.7/policy/modules/apps/chrome.te
--- nsaserefpolicy/policy/modules/apps/chrome.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/chrome.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/chrome.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,86 @@
+policy_module(chrome,1.0.0)
+
@@ -2064,9 +1737,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.t
+ fs_dontaudit_append_cifs_files(chrome_sandbox_t)
+ fs_dontaudit_read_cifs_files(chrome_sandbox_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.8.6/policy/modules/apps/cpufreqselector.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.8.7/policy/modules/apps/cpufreqselector.te
--- nsaserefpolicy/policy/modules/apps/cpufreqselector.te 2010-06-21 10:50:00.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/cpufreqselector.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/cpufreqselector.te 2010-07-14 14:08:02.000000000 -0400
@@ -27,7 +27,7 @@
miscfiles_read_localization(cpufreqselector_t)
@@ -2076,9 +1749,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqs
optional_policy(`
dbus_system_domain(cpufreqselector_t, cpufreqselector_exec_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.fc serefpolicy-3.8.6/policy/modules/apps/execmem.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.fc serefpolicy-3.8.7/policy/modules/apps/execmem.fc
--- nsaserefpolicy/policy/modules/apps/execmem.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/execmem.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/execmem.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,47 @@
+
+/usr/bin/aticonfig -- gen_context(system_u:object_r:execmem_exec_t,s0)
@@ -2127,9 +1800,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.
+/opt/google/chrome/chrome -- gen_context(system_u:object_r:execmem_exec_t,s0)
+/opt/google/chrome/google-chrome -- gen_context(system_u:object_r:execmem_exec_t,s0)
+/opt/Komodo-Edit-5/lib/mozilla/komodo-bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.if serefpolicy-3.8.6/policy/modules/apps/execmem.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.if serefpolicy-3.8.7/policy/modules/apps/execmem.if
--- nsaserefpolicy/policy/modules/apps/execmem.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/execmem.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/execmem.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,110 @@
+## <summary>execmem domain</summary>
+
@@ -2241,9 +1914,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.
+
+ domtrans_pattern($1, execmem_exec_t, $2)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.te serefpolicy-3.8.6/policy/modules/apps/execmem.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.te serefpolicy-3.8.7/policy/modules/apps/execmem.te
--- nsaserefpolicy/policy/modules/apps/execmem.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/execmem.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/execmem.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,10 @@
+policy_module(execmem, 1.0.0)
+
@@ -2255,16 +1928,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.
+type execmem_exec_t alias unconfined_execmem_exec_t;
+application_executable_file(execmem_exec_t)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewallgui.fc serefpolicy-3.8.6/policy/modules/apps/firewallgui.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewallgui.fc serefpolicy-3.8.7/policy/modules/apps/firewallgui.fc
--- nsaserefpolicy/policy/modules/apps/firewallgui.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/firewallgui.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/firewallgui.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,3 @@
+
+/usr/share/system-config-firewall/system-config-firewall-mechanism.py -- gen_context(system_u:object_r:firewallgui_exec_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewallgui.if serefpolicy-3.8.6/policy/modules/apps/firewallgui.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewallgui.if serefpolicy-3.8.7/policy/modules/apps/firewallgui.if
--- nsaserefpolicy/policy/modules/apps/firewallgui.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/firewallgui.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/firewallgui.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,23 @@
+
+## <summary>policy for firewallgui</summary>
@@ -2289,10 +1962,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewall
+ allow $1 firewallgui_t:dbus send_msg;
+ allow firewallgui_t $1:dbus send_msg;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewallgui.te serefpolicy-3.8.6/policy/modules/apps/firewallgui.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewallgui.te serefpolicy-3.8.7/policy/modules/apps/firewallgui.te
--- nsaserefpolicy/policy/modules/apps/firewallgui.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/firewallgui.te 2010-07-12 09:05:35.000000000 -0400
-@@ -0,0 +1,65 @@
++++ serefpolicy-3.8.7/policy/modules/apps/firewallgui.te 2010-07-14 14:08:02.000000000 -0400
+@@ -0,0 +1,66 @@
+policy_module(firewallgui,1.0.0)
+
+########################################
@@ -2331,6 +2004,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewall
+kernel_read_network_state(firewallgui_t)
+kernel_rw_net_sysctls(firewallgui_t)
+kernel_rw_kernel_sysctl(firewallgui_t)
++kernel_rw_vm_sysctls(firewallgui_t)
+
+files_read_etc_files(firewallgui_t)
+files_read_usr_files(firewallgui_t)
@@ -2358,52 +2032,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewall
+ policykit_dbus_chat(firewallgui_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.fc serefpolicy-3.8.6/policy/modules/apps/gitosis.fc
---- nsaserefpolicy/policy/modules/apps/gitosis.fc 2009-09-09 09:23:16.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/gitosis.fc 2010-07-12 09:05:35.000000000 -0400
-@@ -1,3 +1,5 @@
- /usr/bin/gitosis-serve -- gen_context(system_u:object_r:gitosis_exec_t,s0)
-+/usr/bin/gl-auth-command -- gen_context(system_u:object_r:gitosis_exec_t,s0)
-
- /var/lib/gitosis(/.*)? gen_context(system_u:object_r:gitosis_var_lib_t,s0)
-+/var/lib/gitolite(/.*)? gen_context(system_u:object_r:gitosis_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.if serefpolicy-3.8.6/policy/modules/apps/gitosis.if
---- nsaserefpolicy/policy/modules/apps/gitosis.if 2010-03-23 10:55:15.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/gitosis.if 2010-07-12 09:05:35.000000000 -0400
-@@ -62,7 +62,7 @@
- files_search_var_lib($1)
- read_files_pattern($1, gitosis_var_lib_t, gitosis_var_lib_t)
- read_lnk_files_pattern($1, gitosis_var_lib_t, gitosis_var_lib_t)
-- list_dirs_pattern(%1, gitosis_var_lib_t, gitosis_var_lib_t)
-+ list_dirs_pattern($1, gitosis_var_lib_t, gitosis_var_lib_t)
- ')
-
- ######################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.te serefpolicy-3.8.6/policy/modules/apps/gitosis.te
---- nsaserefpolicy/policy/modules/apps/gitosis.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/gitosis.te 2010-07-12 09:05:35.000000000 -0400
-@@ -25,12 +25,17 @@
- manage_lnk_files_pattern(gitosis_t, gitosis_var_lib_t, gitosis_var_lib_t)
- manage_dirs_pattern(gitosis_t, gitosis_var_lib_t, gitosis_var_lib_t)
-
-+kernel_read_system_state(gitosis_t)
-+
- corecmd_exec_bin(gitosis_t)
- corecmd_exec_shell(gitosis_t)
-
--kernel_read_system_state(gitosis_t)
-+dev_read_urand(gitosis_t)
-
-+files_read_etc_files(gitosis_t)
- files_read_usr_files(gitosis_t)
- files_search_var_lib(gitosis_t)
-
- miscfiles_read_localization(gitosis_t)
-+
-+sysnet_read_config(gitosis_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.8.6/policy/modules/apps/gnome.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.8.7/policy/modules/apps/gnome.fc
--- nsaserefpolicy/policy/modules/apps/gnome.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/gnome.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/gnome.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,8 +1,28 @@
-HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:gnome_home_t,s0)
+HOME_DIR/\.cache(/.*)? gen_context(system_u:object_r:cache_home_t,s0)
@@ -2435,9 +2066,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc
+
+/usr/libexec/gnome-system-monitor-mechanism -- gen_context(system_u:object_r:gnomesystemmm_exec_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.8.6/policy/modules/apps/gnome.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.8.7/policy/modules/apps/gnome.if
--- nsaserefpolicy/policy/modules/apps/gnome.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/gnome.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/gnome.if 2010-07-14 14:53:47.000000000 -0400
@@ -74,6 +74,24 @@
########################################
@@ -2892,9 +2523,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
+ allow $1 gconfdefaultsm_t:dbus send_msg;
+ allow gconfdefaultsm_t $1:dbus send_msg;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.8.6/policy/modules/apps/gnome.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.8.7/policy/modules/apps/gnome.te
--- nsaserefpolicy/policy/modules/apps/gnome.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/gnome.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/gnome.te 2010-07-14 14:08:02.000000000 -0400
@@ -6,18 +6,33 @@
#
@@ -3045,31 +2676,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te
+ policykit_read_lib(gnomesystemmm_t)
+ policykit_read_reload(gnomesystemmm_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-3.8.6/policy/modules/apps/gpg.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-3.8.7/policy/modules/apps/gpg.fc
--- nsaserefpolicy/policy/modules/apps/gpg.fc 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/gpg.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/gpg.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,4 +1,5 @@
HOME_DIR/\.gnupg(/.+)? gen_context(system_u:object_r:gpg_secret_t,s0)
+/root/\.gnupg(/.+)? gen_context(system_u:object_r:gpg_secret_t,s0)
/usr/bin/gpg(2)? -- gen_context(system_u:object_r:gpg_exec_t,s0)
/usr/bin/gpg-agent -- gen_context(system_u:object_r:gpg_agent_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if serefpolicy-3.8.6/policy/modules/apps/gpg.if
---- nsaserefpolicy/policy/modules/apps/gpg.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/gpg.if 2010-07-12 09:05:35.000000000 -0400
-@@ -60,8 +60,10 @@
-
- ifdef(`hide_broken_symptoms',`
- #Leaked File Descriptors
-- dontaudit gpg_t $2:socket_class_set { read write };
-+ dontaudit gpg_t $2:socket_class_set { getattr read write };
- dontaudit gpg_t $2:fifo_file rw_fifo_file_perms;
-+ dontaudit gpg_agent_t $2:socket_class_set { getattr read write };
-+ dontaudit gpg_agent_t $2:fifo_file rw_fifo_file_perms;
- ')
- ')
-
-@@ -83,6 +85,43 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if serefpolicy-3.8.7/policy/modules/apps/gpg.if
+--- nsaserefpolicy/policy/modules/apps/gpg.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/gpg.if 2010-07-14 14:08:02.000000000 -0400
+@@ -85,6 +85,43 @@
domtrans_pattern($1, gpg_exec_t, gpg_t)
')
@@ -3113,9 +2732,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if s
########################################
## <summary>
## Send generic signals to user gpg processes.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.8.6/policy/modules/apps/gpg.te
---- nsaserefpolicy/policy/modules/apps/gpg.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/gpg.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.8.7/policy/modules/apps/gpg.te
+--- nsaserefpolicy/policy/modules/apps/gpg.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/gpg.te 2010-07-14 14:08:02.000000000 -0400
@@ -4,6 +4,7 @@
#
# Declarations
@@ -3201,63 +2820,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s
# rlimit: gpg-agent wants to prevent coredumps
allow gpg_agent_t self:process setrlimit;
-@@ -223,12 +240,17 @@
- manage_sock_files_pattern(gpg_agent_t, gpg_agent_tmp_t, gpg_agent_tmp_t)
- files_tmp_filetrans(gpg_agent_t, gpg_agent_tmp_t, { file sock_file dir })
+@@ -245,6 +262,7 @@
-+fs_dontaudit_list_inotifyfs(gpg_agent_t)
-+
- # allow gpg to connect to the gpg agent
- stream_connect_pattern(gpg_t, gpg_agent_tmp_t, gpg_agent_tmp_t, gpg_agent_t)
-
-+corecmd_read_bin_symlinks(gpg_agent_t)
- corecmd_search_bin(gpg_agent_t)
- corecmd_exec_shell(gpg_agent_t)
-
-+dev_read_urand(gpg_agent_t)
-+
- domain_use_interactive_fds(gpg_agent_t)
-
- miscfiles_read_localization(gpg_agent_t)
-@@ -237,6 +259,10 @@
- userdom_use_user_terminals(gpg_agent_t)
- # read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d )
- userdom_search_user_home_dirs(gpg_agent_t)
-+ifdef(`hide_broken_symptoms',`
-+ userdom_dontaudit_read_user_tmp_files(gpg_agent_t)
+ ifdef(`hide_broken_symptoms',`
+ userdom_dontaudit_read_user_tmp_files(gpg_agent_t)
+ userdom_dontaudit_write_user_tmp_files(gpg_agent_t)
-+')
-
- tunable_policy(`gpg_agent_env_file',`
- # write ~/.gpg-agent-info or a similar to the users home dir
-@@ -259,6 +285,10 @@
- fs_manage_cifs_symlinks(gpg_agent_t)
')
-+optional_policy(`
-+ mozilla_dontaudit_rw_user_home_files(gpg_agent_t)
-+')
-+
- ##############################
- #
- # Pinentry local policy
-@@ -285,6 +315,7 @@
- manage_files_pattern(gpg_pinentry_t, gpg_pinentry_tmpfs_t, gpg_pinentry_tmpfs_t)
- fs_tmpfs_filetrans(gpg_pinentry_t, gpg_pinentry_tmpfs_t, { file dir })
- fs_getattr_tmpfs(gpg_pinentry_t)
-+fs_dontaudit_list_inotifyfs(gpg_pinentry_t)
-
- # read /proc/meminfo
- kernel_read_system_state(gpg_pinentry_t)
-@@ -309,12 +340,17 @@
-
- logging_send_syslog_msg(gpg_pinentry_t)
-
-+auth_use_nsswitch(gpg_pinentry_t)
-+
- miscfiles_read_fonts(gpg_pinentry_t)
- miscfiles_read_localization(gpg_pinentry_t)
-
+ tunable_policy(`gpg_agent_env_file',`
+@@ -332,6 +350,9 @@
# for .Xauthority
userdom_read_user_home_content_files(gpg_pinentry_t)
userdom_read_user_tmpfs_files(gpg_pinentry_t)
@@ -3267,7 +2838,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s
tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(gpg_pinentry_t)
-@@ -330,11 +366,40 @@
+@@ -347,6 +368,12 @@
')
optional_policy(`
@@ -3278,11 +2849,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s
+
+optional_policy(`
pulseaudio_exec(gpg_pinentry_t)
-+ pulseaudio_rw_home_files(gpg_pinentry_t)
+ pulseaudio_rw_home_files(gpg_pinentry_t)
pulseaudio_setattr_home_dir(gpg_pinentry_t)
- pulseaudio_stream_connect(gpg_pinentry_t)
-+ pulseaudio_signull(gpg_pinentry_t)
- ')
+@@ -356,4 +383,25 @@
optional_policy(`
xserver_user_x_domain_template(gpg_pinentry, gpg_pinentry_t, gpg_pinentry_tmpfs_t)
@@ -3308,9 +2877,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s
+tunable_policy(`gpg_web_anon_write',`
+ miscfiles_manage_public_files(gpg_web_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.fc serefpolicy-3.8.6/policy/modules/apps/irc.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.fc serefpolicy-3.8.7/policy/modules/apps/irc.fc
--- nsaserefpolicy/policy/modules/apps/irc.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/irc.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/irc.fc 2010-07-14 14:08:02.000000000 -0400
@@ -2,10 +2,14 @@
# /home
#
@@ -3326,9 +2895,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.fc s
/usr/bin/ircII -- gen_context(system_u:object_r:irc_exec_t,s0)
+/usr/bin/irssi -- gen_context(system_u:object_r:irssi_exec_t,s0)
/usr/bin/tinyirc -- gen_context(system_u:object_r:irc_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.if serefpolicy-3.8.6/policy/modules/apps/irc.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.if serefpolicy-3.8.7/policy/modules/apps/irc.if
--- nsaserefpolicy/policy/modules/apps/irc.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/irc.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/irc.if 2010-07-14 14:08:02.000000000 -0400
@@ -18,9 +18,11 @@
interface(`irc_role',`
gen_require(`
@@ -3359,9 +2928,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.if s
+ relabel_files_pattern($2, irssi_home_t, irssi_home_t)
+ relabel_lnk_files_pattern($2, irssi_home_t, irssi_home_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.te serefpolicy-3.8.6/policy/modules/apps/irc.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.te serefpolicy-3.8.7/policy/modules/apps/irc.te
--- nsaserefpolicy/policy/modules/apps/irc.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/irc.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/irc.te 2010-07-14 14:08:02.000000000 -0400
@@ -24,6 +24,30 @@
########################################
@@ -3477,9 +3046,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.te s
+ nis_use_ypbind(irssi_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.8.6/policy/modules/apps/java.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.8.7/policy/modules/apps/java.fc
--- nsaserefpolicy/policy/modules/apps/java.fc 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/java.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/java.fc 2010-07-14 14:08:02.000000000 -0400
@@ -9,6 +9,7 @@
#
# /usr
@@ -3497,17 +3066,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc
ifdef(`distro_redhat',`
/usr/java/eclipse[^/]*/eclipse -- gen_context(system_u:object_r:java_exec_t,s0)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.8.6/policy/modules/apps/java.if
---- nsaserefpolicy/policy/modules/apps/java.if 2010-02-22 08:30:53.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/java.if 2010-07-12 09:05:35.000000000 -0400
-@@ -72,6 +72,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.8.7/policy/modules/apps/java.if
+--- nsaserefpolicy/policy/modules/apps/java.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/java.if 2010-07-14 14:08:02.000000000 -0400
+@@ -72,7 +72,8 @@
domain_interactive_fd($1_java_t)
+- userdom_manage_user_tmpfs_files($1_java_t)
+ userdom_unpriv_usertype($1, $1_java_t)
- userdom_manage_tmpfs_role($2, $1_java_t)
++ userdom_manage_tmpfs_role($2, $1_java_t)
allow $1_java_t self:process { ptrace signal getsched execmem execstack };
+
@@ -82,7 +83,7 @@
domtrans_pattern($3, java_exec_t, $1_java_t)
@@ -3525,10 +3096,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.8.6/policy/modules/apps/java.te
---- nsaserefpolicy/policy/modules/apps/java.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/java.te 2010-07-12 09:05:35.000000000 -0400
-@@ -152,6 +152,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.8.7/policy/modules/apps/java.te
+--- nsaserefpolicy/policy/modules/apps/java.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/java.te 2010-07-14 14:08:02.000000000 -0400
+@@ -82,6 +82,7 @@
+ dev_read_rand(java_t)
+ dev_dontaudit_append_rand(java_t)
+
++files_read_etc_files(java_t)
+ files_read_usr_files(java_t)
+ files_search_home(java_t)
+ files_search_var_lib(java_t)
+@@ -143,12 +144,15 @@
+ # execheap is needed for itanium/BEA jrocket
+ allow unconfined_java_t self:process { execstack execmem execheap };
+
++ init_dbus_chat_script(unconfined_java_t)
++
+ files_execmod_all_files(unconfined_java_t)
+
+ init_dbus_chat_script(unconfined_java_t)
unconfined_domain_noaudit(unconfined_java_t)
unconfined_dbus_chat(unconfined_java_t)
@@ -3536,21 +3123,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te
optional_policy(`
rpm_domtrans(unconfined_java_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.fc serefpolicy-3.8.6/policy/modules/apps/kdumpgui.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.fc serefpolicy-3.8.7/policy/modules/apps/kdumpgui.fc
--- nsaserefpolicy/policy/modules/apps/kdumpgui.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/kdumpgui.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/kdumpgui.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,2 @@
+
+/usr/share/system-config-kdump/system-config-kdump-backend.py -- gen_context(system_u:object_r:kdumpgui_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.if serefpolicy-3.8.6/policy/modules/apps/kdumpgui.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.if serefpolicy-3.8.7/policy/modules/apps/kdumpgui.if
--- nsaserefpolicy/policy/modules/apps/kdumpgui.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/kdumpgui.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/kdumpgui.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,2 @@
+## <summary>system-config-kdump policy</summary>
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.te serefpolicy-3.8.6/policy/modules/apps/kdumpgui.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.te serefpolicy-3.8.7/policy/modules/apps/kdumpgui.te
--- nsaserefpolicy/policy/modules/apps/kdumpgui.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/kdumpgui.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/kdumpgui.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,68 @@
+policy_module(kdumpgui,1.0.0)
+
@@ -3605,143 +3192,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui
+
+miscfiles_read_localization(kdumpgui_t)
+
-+init_dontaudit_read_all_script_files(kdumpgui_t)
-+
-+userdom_dontaudit_search_admin_dir(kdumpgui_t)
-+
-+optional_policy(`
-+ dev_rw_lvm_control(kdumpgui_t)
-+')
-+
-+optional_policy(`
-+ gnome_dontaudit_search_config(kdumpgui_t)
-+')
-+
-+optional_policy(`
-+ policykit_dbus_chat(kdumpgui_t)
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.fc serefpolicy-3.8.6/policy/modules/apps/livecd.fc
---- nsaserefpolicy/policy/modules/apps/livecd.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/livecd.fc 2010-07-12 09:05:35.000000000 -0400
-@@ -0,0 +1,2 @@
-+
-+/usr/bin/livecd-creator -- gen_context(system_u:object_r:livecd_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.if serefpolicy-3.8.6/policy/modules/apps/livecd.if
---- nsaserefpolicy/policy/modules/apps/livecd.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/livecd.if 2010-07-12 09:05:35.000000000 -0400
-@@ -0,0 +1,127 @@
-+
-+## <summary>policy for livecd</summary>
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run livecd.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`livecd_domtrans',`
-+ gen_require(`
-+ type livecd_t;
-+ type livecd_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, livecd_exec_t, livecd_t)
-+')
-+
-+########################################
-+## <summary>
-+## Execute livecd in the livecd domain, and
-+## allow the specified role the livecd domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access
-+## </summary>
-+## </param>
-+## <param name="role">
-+## <summary>
-+## The role to be allowed the livecd domain.
-+## </summary>
-+## </param>
-+#
-+interface(`livecd_run',`
-+ gen_require(`
-+ type livecd_t;
-+ ')
-+
-+ livecd_domtrans($1)
-+ role $2 types livecd_t;
-+
-+ seutil_run_setfiles_mac(livecd_t, $2)
-+
-+ optional_policy(`
-+ mount_run(livecd_t, $2)
-+ ')
-+')
-+
-+########################################
-+## <summary>
-+## Dontaudit read/write to a livecd leaks
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`livecd_dontaudit_leaks',`
-+ gen_require(`
-+ type livecd_t;
-+ ')
-+
-+ dontaudit $1 livecd_t:unix_dgram_socket { read write };
-+')
-+
-+########################################
-+## <summary>
-+## Read livecd temporary files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`livecd_read_tmp_files',`
-+ gen_require(`
-+ type livecd_tmp_t;
-+ ')
-+
-+ files_search_tmp($1)
-+ read_files_pattern($1, livecd_tmp_t, livecd_tmp_t)
-+')
-+
-+########################################
-+## <summary>
-+## Read and write livecd temporary files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`livecd_rw_tmp_files',`
-+ gen_require(`
-+ type livecd_tmp_t;
-+ ')
-+
-+ files_search_tmp($1)
-+ allow $1 livecd_tmp_t:file rw_file_perms;
++init_dontaudit_read_all_script_files(kdumpgui_t)
++
++userdom_dontaudit_search_admin_dir(kdumpgui_t)
++
++optional_policy(`
++ dev_rw_lvm_control(kdumpgui_t)
+')
+
-+########################################
-+## <summary>
-+## Allow read and write access to livecd semaphores.
++optional_policy(`
++ gnome_dontaudit_search_config(kdumpgui_t)
++')
++
++optional_policy(`
++ policykit_dbus_chat(kdumpgui_t)
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.if serefpolicy-3.8.7/policy/modules/apps/livecd.if
+--- nsaserefpolicy/policy/modules/apps/livecd.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/livecd.if 2010-07-14 14:08:02.000000000 -0400
+@@ -41,6 +41,8 @@
+
+ livecd_domtrans($1)
+ role $2 types livecd_t;
++
++ seutil_run_setfiles_mac(livecd_t, $2)
+
+ optional_policy(`
+ mount_run(livecd_t, $2)
+@@ -49,6 +51,24 @@
+
+ ########################################
+ ## <summary>
++## Dontaudit read/write to a livecd leaks
+## </summary>
+## <param name="domain">
+## <summary>
@@ -3749,79 +3231,69 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.i
+## </summary>
+## </param>
+#
-+interface(`livecd_rw_semaphores',`
++interface(`livecd_dontaudit_leaks',`
+ gen_require(`
+ type livecd_t;
+ ')
+
-+ allow $1 livecd_t:sem { unix_read unix_write associate read write };
++ dontaudit $1 livecd_t:unix_dgram_socket { read write };
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.te serefpolicy-3.8.6/policy/modules/apps/livecd.te
---- nsaserefpolicy/policy/modules/apps/livecd.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/livecd.te 2010-07-12 09:05:35.000000000 -0400
-@@ -0,0 +1,34 @@
-+policy_module(livecd, 1.0.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+type livecd_t;
-+type livecd_exec_t;
-+application_domain(livecd_t, livecd_exec_t)
-+role system_r types livecd_t;
-+
-+type livecd_tmp_t;
-+files_tmp_file(livecd_tmp_t)
-+
+########################################
-+#
-+# livecd local policy
-+#
-+dontaudit livecd_t self:capability2 mac_admin;
-+
++## <summary>
+ ## Read livecd temporary files.
+ ## </summary>
+ ## <param name="domain">
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.te serefpolicy-3.8.7/policy/modules/apps/livecd.te
+--- nsaserefpolicy/policy/modules/apps/livecd.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/livecd.te 2010-07-14 14:08:02.000000000 -0400
+@@ -20,6 +20,7 @@
+
+ dontaudit livecd_t self:capability2 mac_admin;
+
+unconfined_domain_noaudit(livecd_t)
-+domain_ptrace_all_domains(livecd_t)
-+
-+manage_dirs_pattern(livecd_t, livecd_tmp_t, livecd_tmp_t)
-+manage_files_pattern(livecd_t, livecd_tmp_t, livecd_tmp_t)
-+files_tmp_filetrans(livecd_t, livecd_tmp_t, { dir file })
-+
-+optional_policy(`
-+ hal_dbus_chat(livecd_t)
-+')
-+
-+seutil_domtrans_setfiles_mac(livecd_t)
+ domain_ptrace_all_domains(livecd_t)
+
+ manage_dirs_pattern(livecd_t, livecd_tmp_t, livecd_tmp_t)
+@@ -27,9 +28,6 @@
+ files_tmp_filetrans(livecd_t, livecd_tmp_t, { dir file })
+
+ optional_policy(`
+- unconfined_domain(livecd_t)
+-')
+-
+-optional_policy(`
+ hal_dbus_chat(livecd_t)
+ ')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.8.6/policy/modules/apps/mono.if
---- nsaserefpolicy/policy/modules/apps/mono.if 2010-02-22 08:30:53.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/mono.if 2010-07-12 09:05:35.000000000 -0400
-@@ -40,16 +40,19 @@
- domain_interactive_fd($1_mono_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.8.7/policy/modules/apps/mono.if
+--- nsaserefpolicy/policy/modules/apps/mono.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/mono.if 2010-07-14 14:08:02.000000000 -0400
+@@ -41,15 +41,18 @@
application_type($1_mono_t)
-+ userdom_unpriv_usertype($1, $1_mono_t)
- userdom_manage_tmpfs_role($2, $1_mono_t)
-
allow $1_mono_t self:process { ptrace signal getsched execheap execmem execstack };
-
allow $3 $1_mono_t:process { getattr ptrace noatsecure signal_perms };
++ userdom_unpriv_usertype($1, $1_mono_t)
++ userdom_manage_tmpfs_role($2, $1_mono_t)
++
domtrans_pattern($3, mono_exec_t, $1_mono_t)
fs_dontaudit_rw_tmpfs_files($1_mono_t)
corecmd_bin_domtrans($1_mono_t, $1_t)
-+ifdef(`hide_broken_symptoms', `
-+ dontaudit $1_t $1_mono_t:socket_class_set { read write };
-+')
+-
+- userdom_manage_user_tmpfs_files($1_mono_t)
++ ifdef(`hide_broken_symptoms', `
++ dontaudit $1_t $1_mono_t:socket_class_set { read write };
++ ')
optional_policy(`
xserver_role($1_r, $1_mono_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.fc serefpolicy-3.8.6/policy/modules/apps/mozilla.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.fc serefpolicy-3.8.7/policy/modules/apps/mozilla.fc
--- nsaserefpolicy/policy/modules/apps/mozilla.fc 2010-06-21 10:50:00.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/mozilla.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/mozilla.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,6 +1,7 @@
HOME_DIR/\.galeon(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
HOME_DIR/\.java(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
@@ -3830,9 +3302,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
HOME_DIR/\.netscape(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.8.6/policy/modules/apps/mozilla.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.8.7/policy/modules/apps/mozilla.if
--- nsaserefpolicy/policy/modules/apps/mozilla.if 2010-06-21 10:50:00.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/mozilla.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/mozilla.if 2010-07-14 14:08:02.000000000 -0400
@@ -48,6 +48,12 @@
mozilla_dbus_chat($2)
@@ -3855,10 +3327,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.8.6/policy/modules/apps/mozilla.te
---- nsaserefpolicy/policy/modules/apps/mozilla.te 2010-06-21 10:50:00.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/mozilla.te 2010-07-12 09:05:35.000000000 -0400
-@@ -90,6 +90,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.8.7/policy/modules/apps/mozilla.te
+--- nsaserefpolicy/policy/modules/apps/mozilla.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/mozilla.te 2010-07-14 14:08:02.000000000 -0400
+@@ -25,6 +25,7 @@
+ type mozilla_home_t;
+ typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t };
+ typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t };
++files_poly_member(mozilla_home_t)
+ userdom_user_home_content(mozilla_home_t)
+
+ type mozilla_tmpfs_t;
+@@ -89,6 +90,7 @@
corenet_raw_sendrecv_generic_node(mozilla_t)
corenet_tcp_sendrecv_http_port(mozilla_t)
corenet_tcp_sendrecv_http_cache_port(mozilla_t)
@@ -3866,7 +3346,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
corenet_tcp_sendrecv_ftp_port(mozilla_t)
corenet_tcp_sendrecv_ipp_port(mozilla_t)
corenet_tcp_connect_http_port(mozilla_t)
-@@ -239,6 +240,7 @@
+@@ -238,6 +240,7 @@
optional_policy(`
gnome_stream_connect_gconf(mozilla_t)
gnome_manage_config(mozilla_t)
@@ -3874,7 +3354,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
')
optional_policy(`
-@@ -259,6 +261,11 @@
+@@ -258,6 +261,11 @@
')
optional_policy(`
@@ -3886,9 +3366,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
pulseaudio_exec(mozilla_t)
pulseaudio_stream_connect(mozilla_t)
pulseaudio_manage_home_files(mozilla_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.if serefpolicy-3.8.6/policy/modules/apps/mplayer.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.if serefpolicy-3.8.7/policy/modules/apps/mplayer.if
--- nsaserefpolicy/policy/modules/apps/mplayer.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/mplayer.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/mplayer.if 2010-07-14 14:08:02.000000000 -0400
@@ -102,3 +102,39 @@
read_files_pattern($1, mplayer_home_t, mplayer_home_t)
userdom_search_user_home_dirs($1)
@@ -3929,10 +3409,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.
+ allow $2 mplayer_exec_t:file entrypoint;
+ domtrans_pattern($1, mplayer_exec_t, $2)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.te serefpolicy-3.8.6/policy/modules/apps/mplayer.te
---- nsaserefpolicy/policy/modules/apps/mplayer.te 2010-06-21 10:50:00.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/mplayer.te 2010-07-12 09:05:35.000000000 -0400
-@@ -160,6 +160,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.te serefpolicy-3.8.7/policy/modules/apps/mplayer.te
+--- nsaserefpolicy/policy/modules/apps/mplayer.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/mplayer.te 2010-07-14 14:08:02.000000000 -0400
+@@ -32,6 +32,7 @@
+ type mplayer_home_t;
+ typealias mplayer_home_t alias { user_mplayer_home_t staff_mplayer_home_t sysadm_mplayer_home_t };
+ typealias mplayer_home_t alias { auditadm_mplayer_home_t secadm_mplayer_home_t };
++files_poly_member(mplayer_home_t)
+ userdom_user_home_content(mplayer_home_t)
+
+ type mplayer_tmpfs_t;
+@@ -159,6 +160,7 @@
manage_files_pattern(mplayer_t, mplayer_home_t, mplayer_home_t)
manage_lnk_files_pattern(mplayer_t, mplayer_home_t, mplayer_home_t)
userdom_user_home_dir_filetrans(mplayer_t, mplayer_home_t, dir)
@@ -3940,7 +3428,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.
manage_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
manage_lnk_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
-@@ -223,6 +224,8 @@
+@@ -222,6 +224,8 @@
fs_search_auto_mountpoints(mplayer_t)
fs_list_inotifyfs(mplayer_t)
@@ -3949,7 +3437,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.
miscfiles_read_localization(mplayer_t)
miscfiles_read_fonts(mplayer_t)
-@@ -303,6 +306,10 @@
+@@ -302,6 +306,10 @@
')
optional_policy(`
@@ -3960,14 +3448,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.
nscd_socket_use(mplayer_t)
')
-@@ -310,3 +317,4 @@
- pulseaudio_exec(mplayer_t)
- pulseaudio_stream_connect(mplayer_t)
- ')
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.fc serefpolicy-3.8.6/policy/modules/apps/nsplugin.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.fc serefpolicy-3.8.7/policy/modules/apps/nsplugin.fc
--- nsaserefpolicy/policy/modules/apps/nsplugin.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/nsplugin.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/nsplugin.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,10 @@
+HOME_DIR/\.adobe(/.*)? gen_context(system_u:object_r:nsplugin_home_t,s0)
+HOME_DIR/\.macromedia(/.*)? gen_context(system_u:object_r:nsplugin_home_t,s0)
@@ -3979,9 +3462,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin
+/usr/lib(64)?/nspluginwrapper/npviewer.bin -- gen_context(system_u:object_r:nsplugin_exec_t,s0)
+/usr/lib(64)?/nspluginwrapper/plugin-config -- gen_context(system_u:object_r:nsplugin_config_exec_t,s0)
+/usr/lib(64)?/mozilla/plugins-wrapped(/.*)? gen_context(system_u:object_r:nsplugin_rw_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.if serefpolicy-3.8.6/policy/modules/apps/nsplugin.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.if serefpolicy-3.8.7/policy/modules/apps/nsplugin.if
--- nsaserefpolicy/policy/modules/apps/nsplugin.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/nsplugin.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/nsplugin.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,391 @@
+
+## <summary>policy for nsplugin</summary>
@@ -4374,9 +3857,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin
+ allow $2 nsplugin_exec_t:file entrypoint;
+ domtrans_pattern($1, nsplugin_exec_t, $2)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.8.6/policy/modules/apps/nsplugin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.8.7/policy/modules/apps/nsplugin.te
--- nsaserefpolicy/policy/modules/apps/nsplugin.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/nsplugin.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/nsplugin.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,299 @@
+policy_module(nsplugin, 1.0.0)
+
@@ -4677,17 +4160,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.fc serefpolicy-3.8.6/policy/modules/apps/openoffice.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.fc serefpolicy-3.8.7/policy/modules/apps/openoffice.fc
--- nsaserefpolicy/policy/modules/apps/openoffice.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/openoffice.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/openoffice.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,4 @@
+/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0)
+/usr/lib64/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0)
+/opt/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.if serefpolicy-3.8.6/policy/modules/apps/openoffice.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.if serefpolicy-3.8.7/policy/modules/apps/openoffice.if
--- nsaserefpolicy/policy/modules/apps/openoffice.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/openoffice.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/openoffice.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,129 @@
+## <summary>Openoffice</summary>
+
@@ -4818,9 +4301,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffi
+ allow $2 openoffice_exec_t:file entrypoint;
+ domtrans_pattern($1, openoffice_exec_t, $2)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.te serefpolicy-3.8.6/policy/modules/apps/openoffice.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.te serefpolicy-3.8.7/policy/modules/apps/openoffice.te
--- nsaserefpolicy/policy/modules/apps/openoffice.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/openoffice.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/openoffice.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,16 @@
+policy_module(openoffice, 1.0.0)
+
@@ -4838,115 +4321,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffi
+# Unconfined java local policy
+#
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/podsleuth.te serefpolicy-3.8.6/policy/modules/apps/podsleuth.te
---- nsaserefpolicy/policy/modules/apps/podsleuth.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/podsleuth.te 2010-07-12 09:05:35.000000000 -0400
-@@ -49,6 +49,7 @@
- fs_tmpfs_filetrans(podsleuth_t, podsleuth_tmpfs_t, { dir file lnk_file })
-
- kernel_read_system_state(podsleuth_t)
-+kernel_request_load_module(podsleuth_t)
-
- corecmd_exec_bin(podsleuth_t)
-
-@@ -65,12 +66,14 @@
- fs_search_dos(podsleuth_t)
- fs_getattr_tmpfs(podsleuth_t)
- fs_list_tmpfs(podsleuth_t)
-+fs_rw_removable_blk_files(podsleuth_t)
-
- miscfiles_read_localization(podsleuth_t)
-
- sysnet_dns_name_resolve(podsleuth_t)
-
- userdom_signal_unpriv_users(podsleuth_t)
-+userdom_read_user_tmpfs_files(podsleuth_t)
-
- optional_policy(`
- dbus_system_bus_client(podsleuth_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.8.6/policy/modules/apps/pulseaudio.if
---- nsaserefpolicy/policy/modules/apps/pulseaudio.if 2010-03-29 15:04:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/pulseaudio.if 2010-07-12 09:05:35.000000000 -0400
-@@ -104,6 +104,24 @@
- can_exec($1, pulseaudio_exec_t)
- ')
-
-+########################################
-+## <summary>
-+## dontaudit attempts to execute a pulseaudio in the current domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`pulseaudio_dontaudit_exec',`
-+ gen_require(`
-+ type pulseaudio_exec_t;
-+ ')
-+
-+ dontaudit $1 pulseaudio_exec_t:file execute;
-+')
-+
- #####################################
- ## <summary>
- ## Connect to pulseaudio over a unix domain
-@@ -186,6 +204,25 @@
-
- ########################################
- ## <summary>
-+## Read and write Pulse Audio files.
-+## </summary>
-+## <param name="user_domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`pulseaudio_rw_home_files',`
-+ gen_require(`
-+ type pulseaudio_home_t;
-+ ')
-+
-+ rw_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t)
-+ userdom_search_user_home_dirs($1)
-+')
-+
-+########################################
-+## <summary>
- ## Create, read, write, and delete pulseaudio
- ## home directory files.
- ## </summary>
-@@ -202,4 +239,24 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.8.7/policy/modules/apps/pulseaudio.if
+--- nsaserefpolicy/policy/modules/apps/pulseaudio.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/pulseaudio.if 2010-07-14 14:08:02.000000000 -0400
+@@ -35,6 +35,10 @@
+ allow pulseaudio_t $2:unix_stream_socket connectto;
+ allow $2 pulseaudio_t:unix_stream_socket connectto;
- userdom_search_user_home_dirs($1)
- manage_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t)
-+ read_lnk_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t)
-+')
-+
-+########################################
-+## <summary>
-+## Send signull signal to pulseaudio
-+## processes.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`pulseaudio_signull',`
-+ gen_require(`
-+ type pulseaudio_t;
-+ ')
++ userdom_manage_home_role($1, pulseaudio_t)
++ userdom_manage_tmp_role($1, pulseaudio_t)
++ userdom_manage_tmpfs_role($1, pulseaudio_t)
+
-+ allow $1 pulseaudio_t:process signull;
+ allow $2 pulseaudio_t:dbus send_msg;
+ allow pulseaudio_t $2:dbus { acquire_svc send_msg };
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.8.6/policy/modules/apps/pulseaudio.te
---- nsaserefpolicy/policy/modules/apps/pulseaudio.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/pulseaudio.te 2010-07-12 09:05:35.000000000 -0400
-@@ -40,9 +40,11 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.8.7/policy/modules/apps/pulseaudio.te
+--- nsaserefpolicy/policy/modules/apps/pulseaudio.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/pulseaudio.te 2010-07-14 14:08:02.000000000 -0400
+@@ -44,6 +44,7 @@
manage_dirs_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
manage_files_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
userdom_search_user_home_dirs(pulseaudio_t)
@@ -4954,11 +4346,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaud
manage_dirs_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t)
manage_files_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t)
-+manage_lnk_files_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t)
- files_var_lib_filetrans(pulseaudio_t, pulseaudio_var_lib_t, { dir file })
+@@ -94,11 +95,6 @@
+
+ miscfiles_read_localization(pulseaudio_t)
- manage_dirs_pattern(pulseaudio_t, pulseaudio_var_run_t, pulseaudio_var_run_t)
-@@ -121,12 +123,17 @@
+-# cjp: this seems excessive. need to confirm
+-userdom_manage_user_home_content_files(pulseaudio_t)
+-userdom_manage_user_tmp_files(pulseaudio_t)
+-userdom_manage_user_tmpfs_files(pulseaudio_t)
+-
+ optional_policy(`
+ bluetooth_stream_connect(pulseaudio_t)
+ ')
+@@ -131,6 +127,10 @@
')
optional_policy(`
@@ -4969,14 +4369,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaud
policykit_domtrans_auth(pulseaudio_t)
policykit_read_lib(pulseaudio_t)
policykit_read_reload(pulseaudio_t)
- ')
-
- optional_policy(`
-+ udev_read_state(pulseaudio_t)
- udev_read_db(pulseaudio_t)
- ')
-
-@@ -137,3 +144,7 @@
+@@ -148,3 +148,7 @@
xserver_read_xdm_pid(pulseaudio_t)
xserver_user_x_domain_template(pulseaudio, pulseaudio_t, pulseaudio_tmpfs_t)
')
@@ -4984,34 +4377,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaud
+optional_policy(`
+ sandbox_manage_tmpfs_files(pulseaudio_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.fc serefpolicy-3.8.6/policy/modules/apps/qemu.fc
---- nsaserefpolicy/policy/modules/apps/qemu.fc 2010-02-22 08:30:53.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/qemu.fc 2010-07-12 09:05:35.000000000 -0400
-@@ -1,2 +1,4 @@
--/usr/bin/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0)
-+/usr/bin/qemu -- gen_context(system_u:object_r:qemu_exec_t,s0)
-+/usr/bin/qemu-system-.* -- gen_context(system_u:object_r:qemu_exec_t,s0)
-+/usr/bin/qemu-kvm -- gen_context(system_u:object_r:qemu_exec_t,s0)
- /usr/libexec/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.if serefpolicy-3.8.6/policy/modules/apps/qemu.if
---- nsaserefpolicy/policy/modules/apps/qemu.if 2010-02-22 08:30:53.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/qemu.if 2010-07-12 09:05:35.000000000 -0400
-@@ -127,12 +127,14 @@
- template(`qemu_role',`
- gen_require(`
- type qemu_t, qemu_exec_t;
-+ type qemu_config_t, qemu_config_exec_t;
- ')
-
- role $1 types { qemu_t qemu_config_t };
-
- domtrans_pattern($2, qemu_exec_t, qemu_t)
- domtrans_pattern($2, qemu_config_exec_t, qemu_config_t)
-+ allow qemu_t $2:process signull;
- ')
-
- ########################################
-@@ -273,6 +275,67 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.if serefpolicy-3.8.7/policy/modules/apps/qemu.if
+--- nsaserefpolicy/policy/modules/apps/qemu.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/qemu.if 2010-07-14 14:08:02.000000000 -0400
+@@ -275,6 +275,67 @@
########################################
## <summary>
@@ -5079,7 +4448,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.if
## Manage qemu temporary dirs.
## </summary>
## <param name="domain">
-@@ -306,3 +369,24 @@
+@@ -308,3 +369,24 @@
manage_files_pattern($1, qemu_tmp_t, qemu_tmp_t)
')
@@ -5104,19 +4473,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.if
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.te serefpolicy-3.8.6/policy/modules/apps/qemu.te
---- nsaserefpolicy/policy/modules/apps/qemu.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/qemu.te 2010-07-12 09:05:35.000000000 -0400
-@@ -49,6 +49,8 @@
- #
- # qemu local policy
- #
-+storage_raw_write_removable_device(qemu_t)
-+storage_raw_read_removable_device(qemu_t)
-
- userdom_search_user_home_content(qemu_t)
- userdom_read_user_tmpfs_files(qemu_t)
-@@ -99,6 +101,10 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.te serefpolicy-3.8.7/policy/modules/apps/qemu.te
+--- nsaserefpolicy/policy/modules/apps/qemu.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/qemu.te 2010-07-14 14:08:02.000000000 -0400
+@@ -102,6 +102,10 @@
xen_rw_image_files(qemu_t)
')
@@ -5127,32 +4487,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.te
########################################
#
# Unconfined qemu local policy
-@@ -108,7 +114,10 @@
- type unconfined_qemu_t;
+@@ -112,6 +116,8 @@
typealias unconfined_qemu_t alias qemu_unconfined_t;
application_type(unconfined_qemu_t)
-- unconfined_domain_noaudit(unconfined_qemu_t)
-+ unconfined_domain(unconfined_qemu_t)
+ unconfined_domain(unconfined_qemu_t)
+ userdom_manage_tmpfs_role(unconfined_r, unconfined_qemu_t)
+ userdom_unpriv_usertype(unconfined, unconfined_qemu_t)
allow unconfined_qemu_t self:process { execstack execmem };
-+ allow unconfined_qemu_t qemu_exec_t:file execmod;
- ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.fc serefpolicy-3.8.6/policy/modules/apps/sambagui.fc
+ allow unconfined_qemu_t qemu_exec_t:file execmod;
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.fc serefpolicy-3.8.7/policy/modules/apps/sambagui.fc
--- nsaserefpolicy/policy/modules/apps/sambagui.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/sambagui.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/sambagui.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1 @@
+/usr/share/system-config-samba/system-config-samba-mechanism.py -- gen_context(system_u:object_r:sambagui_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.if serefpolicy-3.8.6/policy/modules/apps/sambagui.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.if serefpolicy-3.8.7/policy/modules/apps/sambagui.if
--- nsaserefpolicy/policy/modules/apps/sambagui.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/sambagui.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/sambagui.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,2 @@
+## <summary>system-config-samba policy</summary>
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.te serefpolicy-3.8.6/policy/modules/apps/sambagui.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.te serefpolicy-3.8.7/policy/modules/apps/sambagui.te
--- nsaserefpolicy/policy/modules/apps/sambagui.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/sambagui.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/sambagui.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,66 @@
+policy_module(sambagui,1.0.0)
+
@@ -5220,14 +4577,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui
+optional_policy(`
+ policykit_dbus_chat(sambagui_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.fc serefpolicy-3.8.6/policy/modules/apps/sandbox.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.fc serefpolicy-3.8.7/policy/modules/apps/sandbox.fc
--- nsaserefpolicy/policy/modules/apps/sandbox.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/sandbox.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/sandbox.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1 @@
+# No types are sandbox_exec_t
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.if serefpolicy-3.8.6/policy/modules/apps/sandbox.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.if serefpolicy-3.8.7/policy/modules/apps/sandbox.if
--- nsaserefpolicy/policy/modules/apps/sandbox.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/sandbox.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/sandbox.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,314 @@
+
+## <summary>policy for sandbox</summary>
@@ -5543,9 +4900,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.
+
+ allow $1 sandbox_file_type:dir list_dir_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.te serefpolicy-3.8.6/policy/modules/apps/sandbox.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.te serefpolicy-3.8.7/policy/modules/apps/sandbox.te
--- nsaserefpolicy/policy/modules/apps/sandbox.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/sandbox.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/sandbox.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,390 @@
+policy_module(sandbox,1.0.0)
+dbus_stub()
@@ -5937,9 +5294,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.
+ mozilla_dontaudit_rw_user_home_files(sandbox_x_domain)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.if serefpolicy-3.8.6/policy/modules/apps/seunshare.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.if serefpolicy-3.8.7/policy/modules/apps/seunshare.if
--- nsaserefpolicy/policy/modules/apps/seunshare.if 2009-12-04 09:43:33.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/seunshare.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/seunshare.if 2010-07-14 14:08:02.000000000 -0400
@@ -53,8 +53,14 @@
########################################
@@ -5991,9 +5348,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshar
+ dontaudit $1_seunshare_t $3:socket_class_set { read write };
+ ')
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.te serefpolicy-3.8.6/policy/modules/apps/seunshare.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.te serefpolicy-3.8.7/policy/modules/apps/seunshare.te
--- nsaserefpolicy/policy/modules/apps/seunshare.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/seunshare.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/seunshare.te 2010-07-14 14:08:02.000000000 -0400
@@ -5,40 +5,39 @@
# Declarations
#
@@ -6052,165 +5409,549 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshar
+ mozilla_dontaudit_manage_user_home_files(seunshare_domain)
')
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.8.6/policy/modules/apps/slocate.te
---- nsaserefpolicy/policy/modules/apps/slocate.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/slocate.te 2010-07-12 09:05:35.000000000 -0400
-@@ -29,6 +29,7 @@
- manage_files_pattern(locate_t, locate_var_lib_t, locate_var_lib_t)
-
- kernel_read_system_state(locate_t)
-+kernel_dontaudit_search_network_state(locate_t)
- kernel_dontaudit_search_sysctl(locate_t)
-
- corecmd_exec_bin(locate_t)
-@@ -47,8 +48,11 @@
- fs_getattr_all_files(locate_t)
- fs_getattr_all_pipes(locate_t)
- fs_getattr_all_symlinks(locate_t)
-+fs_getattr_all_blk_files(locate_t)
-+fs_getattr_all_chr_files(locate_t)
- fs_list_all(locate_t)
- fs_list_inotifyfs(locate_t)
-+fs_read_noxattr_fs_symlinks(locate_t)
-
- # getpwnam
- auth_use_nsswitch(locate_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/telepathysofiasip.fc serefpolicy-3.8.6/policy/modules/apps/telepathysofiasip.fc
---- nsaserefpolicy/policy/modules/apps/telepathysofiasip.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/telepathysofiasip.fc 2010-07-12 09:05:35.000000000 -0400
-@@ -0,0 +1,2 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/telepathy.fc serefpolicy-3.8.7/policy/modules/apps/telepathy.fc
+--- nsaserefpolicy/policy/modules/apps/telepathy.fc 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.8.7/policy/modules/apps/telepathy.fc 2010-07-14 14:08:02.000000000 -0400
+@@ -0,0 +1,14 @@
++HOME_DIR/\.mission-control(/.*)? gen_context(system_u:object_r:telepathy_mission_control_home_t, s0)
++HOME_DIR/\.cache/\.mc_connections -- gen_context(system_u:object_r:telepathy_mission_control_cache_home_t, s0)
++HOME_DIR/\.cache/telepathy/gabble(/.*)? gen_context(system_u:object_r:telepathy_gabble_cache_home_t, s0)
++
++/usr/libexec/mission-control-5 -- gen_context(system_u:object_r:telepathy_mission_control_exec_t, s0)
++
++/usr/libexec/telepathy-butterfly -- gen_context(system_u:object_r:telepathy_msn_exec_t, s0)
++/usr/libexec/telepathy-gabble -- gen_context(system_u:object_r:telepathy_gabble_exec_t, s0)
++/usr/libexec/telepathy-haze -- gen_context(system_u:object_r:telepathy_msn_exec_t, s0)
++/usr/libexec/telepathy-idle -- gen_context(system_u:object_r:telepathy_idle_exec_t, s0)
++/usr/libexec/telepathy-salut -- gen_context(system_u:object_r:telepathy_salut_exec_t, s0)
++/usr/libexec/telepathy-sofiasip -- gen_context(system_u:object_r:telepathy_sofiasip_exec_t, s0)
++/usr/libexec/telepathy-stream-engine -- gen_context(system_u:object_r:telepathy_stream_engine_exec_t, s0)
++/usr/libexec/telepathy-sunshine -- gen_context(system_u:object_r:telepathy_sunshine_exec_t, s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/telepathy.if serefpolicy-3.8.7/policy/modules/apps/telepathy.if
+--- nsaserefpolicy/policy/modules/apps/telepathy.if 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.8.7/policy/modules/apps/telepathy.if 2010-07-14 14:08:02.000000000 -0400
+@@ -0,0 +1,204 @@
++
++## <summary>Telepathy framework.</summary>
++
++#######################################
++## <summary>
++## Creates basic types for telepathy
++## domain
++## </summary>
++## <param name="prefix">
++## <summary>
++## Prefix for the domain.
++## </summary>
++## </param>
++#
++#
++template(`telepathy_domain_template',`
++
++ gen_require(`
++ attribute telepathy_domain;
++ attribute telepathy_executable;
++ ')
++
++ type telepathy_$1_t, telepathy_domain;
++ type telepathy_$1_exec_t, telepathy_executable;
++ application_domain(telepathy_$1_t, telepathy_$1_exec_t)
++ ubac_constrained(telepathy_$1_t)
++
++ type telepathy_$1_tmp_t;
++ files_tmp_file(telepathy_$1_tmp_t)
++ ubac_constrained(telepathy_$1_tmp_t)
++')
++
++#######################################
++## <summary>
++## Role access for telepathy domains
++### that executes via dbus-session
++## </summary>
++## <param name="user_role">
++## <summary>
++## The role associated with the user domain.
++## </summary>
++## </param>
++## <param name="user_domain">
++## <summary>
++## The type of the user domain.
++## </summary>
++## </param>
++#
++template(`telepathy_dbus_session_role', `
++ gen_require(`
++ attribute telepathy_domain;
++
++ type telepathy_gabble_t, telepathy_msn_t;
++ type telepathy_idle_t, telepathy_mission_control_t, telepathy_salut_t;
++ type telepathy_sofiasip_t, telepathy_stream_engine_t, telepathy_sunshine_t;
++
++ type telepathy_gabble_exec_t, telepathy_msn_exec_t;
++ type telepathy_idle_exec_t, telepathy_mission_control_exec_t, telepathy_salut_exec_t;
++ type telepathy_sofiasip_exec_t, telepathy_stream_engine_exec_t, telepathy_sunshine_exec_t;
++
++ ')
++
++ dbus_session_domain(telepathy_gabble_t, telepathy_gabble_exec_t)
++ dbus_session_domain(telepathy_idle_t, telepathy_idle_exec_t)
++ dbus_session_domain(telepathy_mission_control_t, telepathy_mission_control_exec_t)
++ dbus_session_domain(telepathy_msn_t, telepathy_msn_exec_t)
++ dbus_session_domain(telepathy_salut_t, telepathy_salut_exec_t)
++ dbus_session_domain(telepathy_sofiasip_t, telepathy_sofiasip_exec_t)
++ dbus_session_domain(telepathy_stream_engine_t, telepathy_stream_engine_exec_t)
++ dbus_session_domain(telepathy_sunshine_t, telepathy_sunshine_exec_t)
++
++ role $1 types telepathy_domain;
++
++ allow $2 telepathy_domain:process { ptrace signal_perms };
++ ps_process_pattern($2, telepathy_domain)
++
++ optional_policy(`
++ telepathy_dbus_chat($2)
++ ')
++
++ telepathy_gabble_stream_connect($2)
++ telepathy_msn_stream_connect($2)
++ telepathy_salut_stream_connect($2)
++')
+
-+/usr/libexec/telepathy-sofiasip -- gen_context(system_u:object_r:telepathysofiasip_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/telepathysofiasip.if serefpolicy-3.8.6/policy/modules/apps/telepathysofiasip.if
---- nsaserefpolicy/policy/modules/apps/telepathysofiasip.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/telepathysofiasip.if 2010-07-12 09:05:35.000000000 -0400
-@@ -0,0 +1,69 @@
++########################################
++## <summary>
++## Send DBus messages to and from
++## all Telepathy domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`telepathy_dbus_chat', `
++ gen_require(`
++ attribute telepathy_domain;
++ class dbus send_msg;
++ ')
+
-+## <summary>policy for telepathy-sofiasip</summary>
++ allow $1 telepathy_domain:dbus send_msg;
++ allow telepathy_domain $1:dbus send_msg;
++')
+
+########################################
+## <summary>
-+## Execute a domain transition to run telepathy-sofiasip.
++## Send DBus messages to and from
++## Telepathy Gabble.
+## </summary>
+## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`telepathy_gabble_dbus_chat', `
++ gen_require(`
++ type telepathy_gabble_t;
++ class dbus send_msg;
++ ')
++
++ allow $1 telepathy_gabble_t:dbus send_msg;
++ allow telepathy_gabble_t $1:dbus send_msg;
++')
++
++########################################
+## <summary>
-+## Domain allowed to transition.
++## Read and write Telepathy Butterfly
++## temporary files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`telepathy_butterfly_rw_tmp_files', `
++ gen_require(`
++ type telepathy_butterfly_tmp_t;
++ ')
++
++ allow $1 telepathy_butterfly_tmp_t:file rw_file_perms;
++ files_search_tmp($1)
++')
++
++########################################
++## <summary>
++## Stream connect to Telepathy Gabble
+## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
+## </param>
+#
-+interface(`telepathysofiasip_domtrans',`
++interface(`telepathy_gabble_stream_connect', `
+ gen_require(`
-+ type telepathysofiasip_t, telepathysofiasip_exec_t;
++ type telepathy_gabble_t, telepathy_gabble_tmp_t;
+ ')
+
-+ domtrans_pattern($1, telepathysofiasip_exec_t, telepathysofiasip_t)
++ stream_connect_pattern($1, telepathy_gabble_tmp_t, telepathy_gabble_tmp_t, telepathy_gabble_t)
++ files_search_tmp($1)
++')
++
++#######################################
++## <summary>
++## Stream connect to telepathy MSN managers
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`telepathy_msn_stream_connect', `
++ gen_require(`
++ type telepathy_msn_t, telepathy_msn_tmp_t;
++ ')
++
++ stream_connect_pattern($1, telepathy_msn_tmp_t, telepathy_msn_tmp_t, telepathy_msn_t)
++ files_search_tmp($1)
+')
+
++
+########################################
+## <summary>
-+## Send and receive messages from
-+## telepathy-sofiasip over dbus.
++## Stream connect to Telepathy Salut
+## </summary>
+## <param name="domain">
-+## <summary>
++## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
-+interface(`telepathysofiasip_dbus_chat',`
++interface(`telepathy_salut_stream_connect', `
+ gen_require(`
-+ type telepathysofiasip_t;
-+ class dbus send_msg;
++ type telepathy_salut_t, telepathy_salut_tmp_t;
+ ')
+
-+ allow $1 telepathysofiasip_t:dbus send_msg;
-+ allow telepathysofiasip_t $1:dbus send_msg;
++ stream_connect_pattern($1, telepathy_salut_tmp_t, telepathy_salut_tmp_t, telepathy_salut_t)
++ files_search_tmp($1)
+')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/telepathy.te serefpolicy-3.8.7/policy/modules/apps/telepathy.te
+--- nsaserefpolicy/policy/modules/apps/telepathy.te 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.8.7/policy/modules/apps/telepathy.te 2010-07-14 14:08:02.000000000 -0400
+@@ -0,0 +1,302 @@
++
++policy_module(telepathy, 1.0.0)
++
++########################################
++#
++# Declarations.
++#
++
++## <desc>
++## <p>
++## Allow the Telepathy connection managers
++## to connect to any generic TCP port.
++## </p>
++## </desc>
++gen_tunable(telepathy_tcp_connect_generic_network_ports, false)
++
++attribute telepathy_domain;
++attribute telepathy_executable;
++
++telepathy_domain_template(gabble)
++
++type telepathy_gabble_cache_home_t;
++userdom_user_home_content(telepathy_gabble_cache_home_t)
++
++telepathy_domain_template(idle)
++telepathy_domain_template(mission_control)
++
++type telepathy_mission_control_home_t;
++userdom_user_home_content(telepathy_mission_control_home_t)
++
++type telepathy_mission_control_cache_home_t;
++userdom_user_home_content(telepathy_mission_control_cache_home_t)
++
++telepathy_domain_template(msn)
++telepathy_domain_template(salut)
++telepathy_domain_template(sofiasip)
++telepathy_domain_template(stream_engine)
++telepathy_domain_template(sunshine)
+
+#######################################
-+## <summary>
-+## Role access for telepathy-sofiasip
-+## that executes via dbus-session
-+## </summary>
-+## <param name="role">
-+## <summary>
-+## Role allowed access
-+## </summary>
-+## </param>
-+## <param name="domain">
-+## <summary>
-+## User domain for the role
-+## </summary>
-+## </param>
+#
-+interface(`telepathysofiasip_role',`
-+ gen_require(`
-+ type telepathysofiasip_t;
-+ type telepathysofiasip_exec_t;
-+ ')
++# Telepathy Butterfly and Haze local policy.
++#
++
++allow telepathy_msn_t self:process setsched;
++allow telepathy_msn_t self:netlink_route_socket create_netlink_socket_perms;
++allow telepathy_msn_t self:unix_dgram_socket { write create connect };
++
++manage_dirs_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
++manage_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
++exec_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
++files_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file})
++
++corenet_sendrecv_http_client_packets(telepathy_msn_t)
++corenet_sendrecv_msnp_client_packets(telepathy_msn_t)
++corenet_tcp_connect_http_port(telepathy_msn_t)
++corenet_tcp_connect_msnp_port(telepathy_msn_t)
++
++corecmd_exec_bin(telepathy_msn_t)
++corecmd_exec_shell(telepathy_msn_t)
++corecmd_read_bin_symlinks(telepathy_msn_t)
+
-+ dbus_session_domain(telepathysofiasip_t, telepathysofiasip_exec_t)
-+ role $1 types telepathysofiasip_t;
++dev_read_urand(telepathy_msn_t)
+
-+ telepathysofiasip_dbus_chat($2)
++files_read_etc_files(telepathy_msn_t)
++files_read_usr_files(telepathy_msn_t)
++
++kernel_read_system_state(telepathy_msn_t)
++
++logging_send_syslog_msg(telepathy_msn_t)
++
++miscfiles_read_certs(telepathy_msn_t)
++
++sysnet_read_config(telepathy_msn_t)
++
++optional_policy(`
++ dbus_system_bus_client(telepathy_msn_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/telepathysofiasip.te serefpolicy-3.8.6/policy/modules/apps/telepathysofiasip.te
---- nsaserefpolicy/policy/modules/apps/telepathysofiasip.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/telepathysofiasip.te 2010-07-12 09:05:35.000000000 -0400
-@@ -0,0 +1,42 @@
-+policy_module(telepathysofiasip,1.0.0)
+
-+########################################
++optional_policy(`
++ gnome_read_gconf_home_files(telepathy_msn_t)
++')
++
++#######################################
+#
-+# Declarations
++# Telepathy Gabble local policy.
+#
+
-+type telepathysofiasip_t;
-+type telepathysofiasip_exec_t;
-+application_domain(telepathysofiasip_t, telepathysofiasip_exec_t)
++allow telepathy_gabble_t self:netlink_route_socket create_netlink_socket_perms;
++allow telepathy_gabble_t self:tcp_socket { listen accept };
++allow telepathy_gabble_t self:unix_dgram_socket { write read create getattr sendto };
+
-+########################################
++manage_dirs_pattern(telepathy_gabble_t, telepathy_gabble_tmp_t, telepathy_gabble_tmp_t)
++manage_sock_files_pattern(telepathy_gabble_t, telepathy_gabble_tmp_t, telepathy_gabble_tmp_t)
++files_tmp_filetrans(telepathy_gabble_t, telepathy_gabble_tmp_t, { dir sock_file })
++
++# ~/.cache/gabble/caps-cache.db-journal
++optional_policy(`
++ manage_dirs_pattern(telepathy_gabble_t, telepathy_gabble_cache_home_t, telepathy_gabble_cache_home_t)
++ manage_files_pattern(telepathy_gabble_t, telepathy_gabble_cache_home_t, telepathy_gabble_cache_home_t)
++ gnome_cache_filetrans(telepathy_gabble_t, telepathy_gabble_cache_home_t, { dir file })
++')
++
++corenet_sendrecv_commplex_client_packets(telepathy_gabble_t)
++corenet_sendrecv_http_client_packets(telepathy_gabble_t)
++corenet_sendrecv_jabber_client_client_packets(telepathy_gabble_t)
++corenet_sendrecv_vnc_client_packets(telepathy_gabble_t)
++
++corenet_tcp_connect_commplex_port(telepathy_gabble_t)
++corenet_tcp_connect_http_port(telepathy_gabble_t)
++corenet_tcp_connect_jabber_client_port(telepathy_gabble_t)
++corenet_tcp_connect_vnc_port(telepathy_gabble_t)
++
++dev_read_rand(telepathy_gabble_t)
++dev_read_urand(telepathy_gabble_t)
++
++files_read_etc_files(telepathy_gabble_t)
++
++miscfiles_read_certs(telepathy_gabble_t)
++
++sysnet_read_config(telepathy_gabble_t)
++
++optional_policy(`
++ dbus_system_bus_client(telepathy_gabble_t)
++')
++
++tunable_policy(`use_nfs_home_dirs', `
++ fs_manage_nfs_dirs(telepathy_gabble_t)
++ fs_manage_nfs_files(telepathy_gabble_t)
++')
++
++tunable_policy(`use_samba_home_dirs', `
++ fs_manage_cifs_dirs(telepathy_gabble_t)
++ fs_manage_cifs_files(telepathy_gabble_t)
++')
++
++#######################################
++#
++# Telepathy Idle local policy.
++#
++
++allow telepathy_idle_t self:netlink_route_socket create_netlink_socket_perms;
++
++corenet_sendrecv_ircd_client_packets(telepathy_idle_t)
++corenet_tcp_connect_ircd_port(telepathy_idle_t)
++
++files_read_etc_files(telepathy_idle_t)
++
++sysnet_read_config(telepathy_idle_t)
++
++#######################################
++#
++# Telepathy Mission-Control local policy.
++#
++
++manage_dirs_pattern(telepathy_mission_control_t, telepathy_mission_control_home_t, telepathy_mission_control_home_t)
++manage_files_pattern(telepathy_mission_control_t, telepathy_mission_control_home_t, telepathy_mission_control_home_t)
++userdom_user_home_dir_filetrans(telepathy_mission_control_t, telepathy_mission_control_home_t, { dir file })
++userdom_search_user_home_dirs(telepathy_mission_control_t)
++
++files_read_etc_files(telepathy_mission_control_t)
++files_read_usr_files(telepathy_mission_control_t)
++
++tunable_policy(`use_nfs_home_dirs', `
++ fs_manage_nfs_dirs(telepathy_mission_control_t)
++ fs_manage_nfs_files(telepathy_mission_control_t)
++')
++
++tunable_policy(`use_samba_home_dirs', `
++ fs_manage_cifs_dirs(telepathy_mission_control_t)
++ fs_manage_cifs_files(telepathy_mission_control_t)
++')
++
++# ~/.cache/.mc_connections.
++optional_policy(`
++ manage_files_pattern(telepathy_mission_control_t, telepathy_mission_control_cache_home_t, telepathy_mission_control_cache_home_t)
++ gnome_cache_filetrans(telepathy_mission_control_t, telepathy_mission_control_cache_home_t, file)
++')
++
++optional_policy(`
++ gnome_read_gconf_home_files(telepathy_mission_control_t)
++ gnome_setattr_cache_home_dir(telepathy_mission_control_t)
++')
++
++#######################################
++#
++# Telepathy Salut local policy.
++#
++
++allow telepathy_salut_t self:netlink_route_socket create_netlink_socket_perms;
++allow telepathy_salut_t self:tcp_socket { accept listen };
++
++manage_sock_files_pattern(telepathy_salut_t, telepathy_salut_tmp_t, telepathy_salut_tmp_t)
++files_tmp_filetrans(telepathy_salut_t, telepathy_salut_tmp_t, sock_file)
++
++corenet_sendrecv_presence_server_packets(telepathy_salut_t)
++corenet_tcp_bind_presence_port(telepathy_salut_t)
++corenet_tcp_connect_presence_port(telepathy_salut_t)
++
++dev_read_urand(telepathy_salut_t)
++
++files_read_etc_files(telepathy_salut_t)
++
++sysnet_read_config(telepathy_salut_t)
++
++optional_policy(`
++ dbus_system_bus_client(telepathy_salut_t)
++
++ optional_policy(`
++ avahi_dbus_chat(telepathy_salut_t)
++ ')
++')
++
++#######################################
++#
++# Telepathy Sofiasip local policy.
++#
++
++allow telepathy_sofiasip_t self:netlink_route_socket create_netlink_socket_perms;
++allow telepathy_sofiasip_t self:rawip_socket { create_socket_perms listen };
++allow telepathy_sofiasip_t self:tcp_socket { listen };
++
++corenet_sendrecv_sip_client_packets(telepathy_sofiasip_t)
++corenet_tcp_connect_sip_port(telepathy_sofiasip_t)
++
++dev_read_urand(telepathy_sofiasip_t)
++
++kernel_request_load_module(telepathy_sofiasip_t)
++
++sysnet_read_config(telepathy_sofiasip_t)
++
++#######################################
++#
++# Telepathy Sunshine local policy.
++#
++
++manage_files_pattern(telepathy_sunshine_t, telepathy_sunshine_tmp_t, telepathy_sunshine_tmp_t)
++exec_files_pattern(telepathy_sunshine_t, telepathy_sunshine_tmp_t, telepathy_sunshine_tmp_t)
++files_tmp_filetrans(telepathy_sunshine_t, telepathy_sunshine_tmp_t, file)
++
++corecmd_list_bin(telepathy_sunshine_t)
++
++dev_read_urand(telepathy_sunshine_t)
++
++files_read_etc_files(telepathy_sunshine_t)
++files_read_usr_files(telepathy_sunshine_t)
++
++kernel_read_system_state(telepathy_sunshine_t)
++
++optional_policy(`
++ xserver_read_xdm_pid(telepathy_sunshine_t)
++ xserver_stream_connect(telepathy_sunshine_t)
++')
++
++#######################################
+#
-+# telepathy-sofiasip local policy
++# telepathy domains common policy
+#
+
-+allow telepathysofiasip_t self:process signal;
++allow telepathy_domain self:process { getsched signal };
++allow telepathy_domain self:fifo_file rw_fifo_file_perms;
++allow telepathy_domain self:tcp_socket create_socket_perms;
++allow telepathy_domain self:udp_socket create_socket_perms;
++
++corenet_all_recvfrom_netlabel(telepathy_domain)
++corenet_all_recvfrom_unlabeled(telepathy_domain)
++corenet_raw_bind_generic_node(telepathy_domain)
++corenet_raw_sendrecv_generic_if(telepathy_domain)
++corenet_raw_sendrecv_generic_node(telepathy_domain)
++corenet_tcp_bind_generic_node(telepathy_domain)
++corenet_tcp_sendrecv_generic_if(telepathy_domain)
++corenet_tcp_sendrecv_generic_node(telepathy_domain)
++corenet_udp_bind_generic_node(telepathy_domain)
+
-+allow telepathysofiasip_t self:netlink_route_socket r_netlink_socket_perms;
-+allow telepathysofiasip_t self:tcp_socket create_stream_socket_perms;
-+allow telepathysofiasip_t self:udp_socket create_socket_perms;
-+allow telepathysofiasip_t self:rawip_socket { create_socket_perms listen };
++fs_search_auto_mountpoints(telepathy_domain)
+
-+kernel_request_load_module(telepathysofiasip_t)
++miscfiles_read_localization(telepathy_domain)
+
-+corenet_all_recvfrom_unlabeled(telepathysofiasip_t)
-+corenet_all_recvfrom_netlabel(telepathysofiasip_t)
-+corenet_tcp_sendrecv_generic_if(telepathysofiasip_t)
-+corenet_udp_sendrecv_generic_if(telepathysofiasip_t)
-+corenet_raw_sendrecv_generic_if(telepathysofiasip_t)
-+corenet_tcp_sendrecv_generic_node(telepathysofiasip_t)
-+corenet_udp_sendrecv_generic_node(telepathysofiasip_t)
-+corenet_raw_sendrecv_generic_node(telepathysofiasip_t)
-+corenet_tcp_sendrecv_all_ports(telepathysofiasip_t)
-+corenet_udp_sendrecv_all_ports(telepathysofiasip_t)
-+corenet_tcp_bind_generic_node(telepathysofiasip_t)
-+corenet_udp_bind_generic_node(telepathysofiasip_t)
-+corenet_raw_bind_generic_node(telepathysofiasip_t)
++# This interface does not facilitate files_search_tmp which appears to be a bug.
++userdom_stream_connect(telepathy_domain)
++userdom_use_user_terminals(telepathy_domain)
++
++tunable_policy(`telepathy_tcp_connect_generic_network_ports', `
++ corenet_tcp_connect_generic_port(telepathy_domain)
++ corenet_sendrecv_generic_client_packets(telepathy_domain)
++')
++
++optional_policy(`
++ automount_dontaudit_getattr_tmp_dirs(telepathy_domain)
++')
++
++optional_policy(`
++ nis_use_ypbind(telepathy_domain)
++')
+
-+dev_read_urand(telepathysofiasip_t)
++optional_policy(`
++ telepathy_dbus_chat(telepathy_domain)
++')
+
-+sysnet_read_config(telepathysofiasip_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.fc serefpolicy-3.8.6/policy/modules/apps/userhelper.fc
++optional_policy(`
++ xserver_rw_xdm_pipes(telepathy_domain)
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.fc serefpolicy-3.8.7/policy/modules/apps/userhelper.fc
--- nsaserefpolicy/policy/modules/apps/userhelper.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/userhelper.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/userhelper.fc 2010-07-14 14:08:02.000000000 -0400
@@ -7,3 +7,4 @@
# /usr
#
/usr/sbin/userhelper -- gen_context(system_u:object_r:userhelper_exec_t,s0)
+/usr/bin/consolehelper -- gen_context(system_u:object_r:consolehelper_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.8.6/policy/modules/apps/userhelper.if
---- nsaserefpolicy/policy/modules/apps/userhelper.if 2010-02-12 10:33:09.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/userhelper.if 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.8.7/policy/modules/apps/userhelper.if
+--- nsaserefpolicy/policy/modules/apps/userhelper.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/userhelper.if 2010-07-14 14:08:02.000000000 -0400
@@ -25,6 +25,7 @@
gen_require(`
attribute userhelper_type;
@@ -6219,7 +5960,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp
')
########################################
-@@ -260,3 +261,58 @@
+@@ -256,3 +257,58 @@
can_exec($1, userhelper_exec_t)
')
@@ -6278,9 +6019,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp
+ xserver_read_xdm_pid($1_consolehelper_t)
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.te serefpolicy-3.8.6/policy/modules/apps/userhelper.te
---- nsaserefpolicy/policy/modules/apps/userhelper.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/userhelper.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.te serefpolicy-3.8.7/policy/modules/apps/userhelper.te
+--- nsaserefpolicy/policy/modules/apps/userhelper.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/userhelper.te 2010-07-14 14:08:02.000000000 -0400
@@ -6,9 +6,51 @@
#
@@ -6333,93 +6074,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp
+optional_policy(`
+ xserver_stream_connect(consolehelper_domain)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.8.6/policy/modules/apps/vmware.fc
---- nsaserefpolicy/policy/modules/apps/vmware.fc 2009-09-09 09:23:16.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/vmware.fc 2010-07-12 09:05:35.000000000 -0400
-@@ -20,7 +20,7 @@
- /usr/bin/vmnet-sniffer -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
- /usr/bin/vmware-network -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
- /usr/bin/vmware-nmbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
--/usr/bin/vmware-ping -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
-+/usr/bin/vmware-ping -- gen_context(system_u:object_r:vmware_exec_t,s0)
- /usr/bin/vmware-smbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
- /usr/bin/vmware-smbpasswd -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
- /usr/bin/vmware-smbpasswd\.bin -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
-@@ -55,7 +55,7 @@
- /opt/vmware/(workstation|player)/bin/vmnet-netifup -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
- /opt/vmware/(workstation|player)/bin/vmnet-sniffer -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
- /opt/vmware/(workstation|player)/bin/vmware-nmbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
--/opt/vmware/(workstation|player)/bin/vmware-ping -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
-+/opt/vmware/(workstation|player)/bin/vmware-ping -- gen_context(system_u:object_r:vmware_exec_t,s0)
- /opt/vmware/(workstation|player)/bin/vmware-smbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
- /opt/vmware/(workstation|player)/bin/vmware-smbpasswd -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
- /opt/vmware/(workstation|player)/bin/vmware-smbpasswd\.bin -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.if serefpolicy-3.8.6/policy/modules/apps/vmware.if
---- nsaserefpolicy/policy/modules/apps/vmware.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/vmware.if 2010-07-12 09:05:35.000000000 -0400
-@@ -84,3 +84,22 @@
- logging_search_logs($1)
- append_files_pattern($1, vmware_log_t, vmware_log_t)
- ')
-+
-+########################################
-+## <summary>
-+## Execute vmware host executables
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`vmware_exec_host',`
-+ gen_require(`
-+ type vmware_host_exec_t;
-+ ')
-+
-+ can_exec($1, vmware_host_exec_t)
-+')
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.8.6/policy/modules/apps/vmware.te
---- nsaserefpolicy/policy/modules/apps/vmware.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/vmware.te 2010-07-12 09:05:35.000000000 -0400
-@@ -28,6 +28,10 @@
- type vmware_host_exec_t;
- init_daemon_domain(vmware_host_t, vmware_host_exec_t)
-
-+type vmware_host_tmp_t;
-+files_tmp_file(vmware_host_tmp_t)
-+ubac_constrained(vmware_host_tmp_t)
-+
- type vmware_host_pid_t alias vmware_var_run_t;
- files_pid_file(vmware_host_pid_t)
-
-@@ -78,6 +82,12 @@
-
- # cjp: the ro and rw files should be split up
- manage_files_pattern(vmware_host_t, vmware_sys_conf_t, vmware_sys_conf_t)
-+manage_lnk_files_pattern(vmware_host_t, vmware_sys_conf_t, vmware_sys_conf_t)
-+
-+manage_dirs_pattern(vmware_host_t, vmware_host_tmp_t, vmware_host_tmp_t)
-+manage_files_pattern(vmware_host_t, vmware_host_tmp_t, vmware_host_tmp_t)
-+manage_sock_files_pattern(vmware_host_t, vmware_host_tmp_t, vmware_host_tmp_t)
-+files_tmp_filetrans(vmware_host_t, vmware_host_tmp_t, { file dir })
-
- manage_files_pattern(vmware_host_t, vmware_var_run_t, vmware_var_run_t)
- manage_sock_files_pattern(vmware_host_t, vmware_var_run_t, vmware_var_run_t)
-@@ -86,8 +96,11 @@
- manage_files_pattern(vmware_host_t, vmware_log_t, vmware_log_t)
- logging_log_filetrans(vmware_host_t, vmware_log_t, { file dir })
-
-+can_exec(vmware_host_t, vmware_host_exec_t)
-+
- kernel_read_kernel_sysctls(vmware_host_t)
- kernel_read_system_state(vmware_host_t)
-+kernel_read_network_state(vmware_host_t)
-
- corenet_all_recvfrom_unlabeled(vmware_host_t)
- corenet_all_recvfrom_netlabel(vmware_host_t)
-@@ -113,6 +126,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.8.7/policy/modules/apps/vmware.te
+--- nsaserefpolicy/policy/modules/apps/vmware.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/vmware.te 2010-07-14 14:08:02.000000000 -0400
+@@ -126,6 +126,7 @@
dev_read_sysfs(vmware_host_t)
dev_read_urand(vmware_host_t)
dev_rw_vmware(vmware_host_t)
@@ -6427,9 +6085,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.t
domain_use_interactive_fds(vmware_host_t)
domain_dontaudit_read_all_domains_state(vmware_host_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.fc serefpolicy-3.8.6/policy/modules/apps/wine.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.fc serefpolicy-3.8.7/policy/modules/apps/wine.fc
--- nsaserefpolicy/policy/modules/apps/wine.fc 2010-02-22 08:30:53.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/wine.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/wine.fc 2010-07-14 14:08:02.000000000 -0400
@@ -2,6 +2,7 @@
/opt/cxoffice/bin/wine.* -- gen_context(system_u:object_r:wine_exec_t,s0)
@@ -6438,9 +6096,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.fc
/opt/google/picasa(/.*)?/bin/msiexec -- gen_context(system_u:object_r:wine_exec_t,s0)
/opt/google/picasa(/.*)?/bin/notepad -- gen_context(system_u:object_r:wine_exec_t,s0)
/opt/google/picasa(/.*)?/bin/progman -- gen_context(system_u:object_r:wine_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.8.6/policy/modules/apps/wine.if
---- nsaserefpolicy/policy/modules/apps/wine.if 2010-02-22 08:30:53.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/apps/wine.if 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.8.7/policy/modules/apps/wine.if
+--- nsaserefpolicy/policy/modules/apps/wine.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/wine.if 2010-07-14 14:08:02.000000000 -0400
@@ -35,6 +35,8 @@
role $1 types wine_t;
@@ -6450,9 +6108,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if
allow wine_t $2:fd use;
allow wine_t $2:process { sigchld signull };
allow wine_t $2:unix_stream_socket connectto;
-@@ -103,7 +105,14 @@
+@@ -101,9 +103,16 @@
+ corecmd_bin_domtrans($1_wine_t, $1_t)
+
userdom_unpriv_usertype($1, $1_wine_t)
- userdom_manage_tmpfs_role($2, $1_wine_t)
+- userdom_manage_user_tmpfs_files($1_wine_t)
++ userdom_manage_tmpfs_role($2, $1_wine_t)
- domain_mmap_low($1_wine_t)
+ domain_mmap_low_type($1_wine_t)
@@ -6466,11 +6127,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if
optional_policy(`
xserver_role($1_r, $1_wine_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.8.6/policy/modules/apps/wine.te
---- nsaserefpolicy/policy/modules/apps/wine.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/wine.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.8.7/policy/modules/apps/wine.te
+--- nsaserefpolicy/policy/modules/apps/wine.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/wine.te 2010-07-14 14:08:02.000000000 -0400
@@ -1,5 +1,13 @@
- policy_module(wine, 1.7.0)
+ policy_module(wine, 1.7.1)
+## <desc>
+## <p>
@@ -6511,59 +6172,43 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wm.if serefpolicy-3.8.6/policy/modules/apps/wm.if
---- nsaserefpolicy/policy/modules/apps/wm.if 2009-07-27 18:11:17.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/apps/wm.if 2010-07-12 09:05:35.000000000 -0400
-@@ -30,6 +30,7 @@
- template(`wm_role_template',`
- gen_require(`
- type wm_exec_t;
-+ class dbus send_msg;
- ')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wireshark.te serefpolicy-3.8.7/policy/modules/apps/wireshark.te
+--- nsaserefpolicy/policy/modules/apps/wireshark.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/wireshark.te 2010-07-14 14:08:02.000000000 -0400
+@@ -15,6 +15,7 @@
+ type wireshark_home_t;
+ typealias wireshark_home_t alias { user_wireshark_home_t staff_wireshark_home_t sysadm_wireshark_home_t };
+ typealias wireshark_home_t alias { auditadm_wireshark_home_t secadm_wireshark_home_t };
++files_poly_member(wireshark_home_t)
+ userdom_user_home_content(wireshark_home_t)
- type $1_wm_t;
-@@ -42,6 +43,12 @@
- allow $1_wm_t self:shm create_shm_perms;
+ type wireshark_tmp_t;
+@@ -70,6 +71,8 @@
+ kernel_read_system_state(wireshark_t)
+ kernel_read_sysctl(wireshark_t)
- allow $1_wm_t $3:unix_stream_socket connectto;
-+ allow $3 $1_wm_t:unix_stream_socket connectto;
-+ allow $3 $1_wm_t:process { signal sigchld };
-+ allow $1_wm_t $3:process { signull sigkill };
++corecmd_search_bin(wireshark_t)
+
-+ allow $1_wm_t $3:dbus send_msg;
-+ allow $3 $1_wm_t:dbus send_msg;
+ corenet_tcp_connect_generic_port(wireshark_t)
+ corenet_tcp_sendrecv_generic_if(wireshark_t)
- domtrans_pattern($3, wm_exec_t, $1_wm_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wm.if serefpolicy-3.8.7/policy/modules/apps/wm.if
+--- nsaserefpolicy/policy/modules/apps/wm.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/apps/wm.if 2010-07-14 14:08:02.000000000 -0400
+@@ -75,6 +75,10 @@
+ miscfiles_read_fonts($1_wm_t)
+ miscfiles_read_localization($1_wm_t)
-@@ -55,6 +62,8 @@
- files_read_etc_files($1_wm_t)
- files_read_usr_files($1_wm_t)
-
-+ fs_getattr_tmpfs($1_wm_t)
++ userdom_manage_home_role($2, $1_wm_t)
++ userdom_manage_tmpfs_role($2, $1_wm_t)
++ userdom_manage_tmp_role($2, $1_wm_t)
+
- mls_file_read_all_levels($1_wm_t)
- mls_file_write_all_levels($1_wm_t)
- mls_xwin_read_all_levels($1_wm_t)
-@@ -72,10 +81,16 @@
-
optional_policy(`
dbus_system_bus_client($1_wm_t)
-+ dbus_session_bus_client($1_wm_t)
-+ ')
-+
-+ optional_policy(`
-+ pulseaudio_stream_connect($1_wm_t)
- ')
-
- optional_policy(`
- xserver_role($2, $1_wm_t)
-+ xserver_manage_core_devices($1_wm_t)
- ')
- ')
-
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.8.6/policy/modules/kernel/corecommands.fc
+ dbus_session_bus_client($1_wm_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.8.7/policy/modules/kernel/corecommands.fc
--- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2010-06-08 10:35:48.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/corecommands.fc 2010-07-12 14:53:11.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/corecommands.fc 2010-07-14 14:08:02.000000000 -0400
@@ -9,8 +9,10 @@
/bin/bash2 -- gen_context(system_u:object_r:shell_exec_t,s0)
/bin/fish -- gen_context(system_u:object_r:shell_exec_t,s0)
@@ -6596,7 +6241,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
ifdef(`distro_gentoo',`
/opt/RealPlayer/realplay(\.bin)? gen_context(system_u:object_r:bin_t,s0)
/opt/RealPlayer/postint(/.*)? gen_context(system_u:object_r:bin_t,s0)
-@@ -228,6 +237,8 @@
+@@ -169,6 +178,7 @@
+ /usr/lib/fence(/.*)? gen_context(system_u:object_r:bin_t,s0)
+ /usr/lib/pgsql/test/regress/.*\.sh -- gen_context(system_u:object_r:bin_t,s0)
+ /usr/lib/qt.*/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
++/usr/lib(64)?/mediawiki/math/texvc.* gen_context(system_u:object_r:bin_t,s0)
+ /usr/lib(64)?/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:bin_t,s0)
+ /usr/lib(64)?/apt/methods.+ -- gen_context(system_u:object_r:bin_t,s0)
+ /usr/lib(64)?/ConsoleKit/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0)
+@@ -228,6 +238,8 @@
/usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/e16/misc(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/gedit-2/plugins/externaltools/tools(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -6605,7 +6258,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
/usr/share/gnucash/finance-quote-check -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/gnucash/finance-quote-helper -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/hal/device-manager/hal-device-manager -- gen_context(system_u:object_r:bin_t,s0)
-@@ -340,3 +351,22 @@
+@@ -314,6 +326,7 @@
+ /usr/share/texmf/web2c/mktexdir -- gen_context(system_u:object_r:bin_t,s0)
+ /usr/share/texmf/web2c/mktexnam -- gen_context(system_u:object_r:bin_t,s0)
+ /usr/share/texmf/web2c/mktexupd -- gen_context(system_u:object_r:bin_t,s0)
++/usr/share/texmf/texconfig/tcfmgr -- gen_context(system_u:object_r:bin_t,s0)
+ ')
+
+ ifdef(`distro_suse', `
+@@ -340,3 +353,22 @@
ifdef(`distro_suse',`
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
')
@@ -6628,9 +6289,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
+/usr/lib(64)?/rpm/rpmv -- gen_context(system_u:object_r:bin_t,s0)
+
+/usr/lib(64)?/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-3.8.6/policy/modules/kernel/corecommands.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-3.8.7/policy/modules/kernel/corecommands.if
--- nsaserefpolicy/policy/modules/kernel/corecommands.if 2010-03-05 17:14:56.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/kernel/corecommands.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/corecommands.if 2010-07-14 14:08:02.000000000 -0400
@@ -931,6 +931,7 @@
read_lnk_files_pattern($1, bin_t, bin_t)
@@ -6647,9 +6308,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
manage_files_pattern($1, bin_t, exec_type)
manage_lnk_files_pattern($1, bin_t, bin_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.fc serefpolicy-3.8.6/policy/modules/kernel/corenetwork.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.fc serefpolicy-3.8.7/policy/modules/kernel/corenetwork.fc
--- nsaserefpolicy/policy/modules/kernel/corenetwork.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/corenetwork.fc 2010-07-12 14:47:57.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/corenetwork.fc 2010-07-14 14:08:02.000000000 -0400
@@ -5,3 +5,6 @@
/dev/tap.* -c gen_context(system_u:object_r:tun_tap_device_t,s0)
@@ -6657,9 +6318,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
+
+/lib/udev/devices/ppp -c gen_context(system_u:object_r:ppp_device_t,s0)
+/lib/udev/devices/net/.* -c gen_context(system_u:object_r:tun_tap_device_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.8.6/policy/modules/kernel/corenetwork.te.in
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.8.7/policy/modules/kernel/corenetwork.te.in
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/corenetwork.te.in 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/corenetwork.te.in 2010-07-14 14:08:02.000000000 -0400
@@ -24,6 +24,7 @@
#
type tun_tap_device_t;
@@ -6668,6 +6329,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
########################################
#
+@@ -54,7 +55,7 @@
+ type reserved_port_t, port_type, reserved_port_type;
+
+ #
+-# hi_reserved_port_t is the type of INET port numbers between 600-1023.
++# hi_reserved_port_t is the type of INET port numbers between 512-1023.
+ #
+ type hi_reserved_port_t, port_type, reserved_port_type, rpc_port_type;
+
@@ -64,6 +65,7 @@
type server_packet_t, packet_type, server_packet_type;
@@ -6777,7 +6447,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
network_port(syslogd, udp,514,s0)
network_port(telnetd, tcp,23,s0)
network_port(tftp, udp,69,s0)
-@@ -204,13 +225,14 @@
+@@ -204,23 +225,24 @@
network_port(varnishd, tcp,6081,s0, tcp,6082,s0)
network_port(virt, tcp,16509,s0, udp,16509,s0, tcp,16514,s0, udp,16514,s0)
network_port(virt_migration, tcp,49152-49216,s0)
@@ -6794,9 +6464,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
network_port(zebra, tcp,2600-2604,s0, tcp,2606,s0, udp,2600-2604,s0, udp,2606,s0)
network_port(zope, tcp,8021,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.8.6/policy/modules/kernel/devices.fc
+ # Defaults for reserved ports. Earlier portcon entries take precedence;
+ # these entries just cover any remaining reserved ports not otherwise declared.
+
+-portcon tcp 600-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)
+-portcon udp 600-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)
+-portcon tcp 1-599 gen_context(system_u:object_r:reserved_port_t, s0)
+-portcon udp 1-599 gen_context(system_u:object_r:reserved_port_t, s0)
++portcon tcp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)
++portcon udp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)
++portcon tcp 1-511 gen_context(system_u:object_r:reserved_port_t, s0)
++portcon udp 1-511 gen_context(system_u:object_r:reserved_port_t, s0)
+
+ ########################################
+ #
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.m4 serefpolicy-3.8.7/policy/modules/kernel/corenetwork.te.m4
+--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.m4 2010-04-13 14:43:42.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/corenetwork.te.m4 2010-07-14 14:08:02.000000000 -0400
+@@ -80,7 +80,7 @@
+ # bindresvport in glibc starts searching for reserved ports at 600
+ define(`declare_ports',`dnl
+ ifelse(eval(range_start($3) < 1024),1,`typeattribute $1 reserved_port_type;
+-ifelse(eval(range_start($3) >= 600),1,`typeattribute $1 rpc_port_type;',`dnl')
++ifelse(eval(range_start($3) >= 512),1,`typeattribute $1 rpc_port_type;',`dnl')
+ ',`dnl')
+ portcon $2 $3 gen_context(system_u:object_r:$1,$4)
+ ifelse(`$5',`',`',`declare_ports($1,shiftn(4,$*))')dnl
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.8.7/policy/modules/kernel/devices.fc
--- nsaserefpolicy/policy/modules/kernel/devices.fc 2010-06-08 10:35:48.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/devices.fc 2010-07-12 14:40:50.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/devices.fc 2010-07-14 14:08:02.000000000 -0400
@@ -176,13 +176,12 @@
/etc/udev/devices -d gen_context(system_u:object_r:device_t,s0)
@@ -6822,9 +6518,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
+# /sys
+#
+/sys(/.*)? gen_context(system_u:object_r:sysfs_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.8.6/policy/modules/kernel/devices.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.8.7/policy/modules/kernel/devices.if
--- nsaserefpolicy/policy/modules/kernel/devices.if 2010-06-08 10:35:48.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/devices.if 2010-07-12 14:36:40.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/devices.if 2010-07-14 16:39:53.000000000 -0400
@@ -606,6 +606,24 @@
########################################
@@ -6957,9 +6653,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.8.6/policy/modules/kernel/devices.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.8.7/policy/modules/kernel/devices.te
--- nsaserefpolicy/policy/modules/kernel/devices.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/devices.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/devices.te 2010-07-14 14:08:02.000000000 -0400
@@ -100,6 +100,7 @@
#
type kvm_device_t;
@@ -6975,9 +6671,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
-allow devices_unconfined_type device_node:{ blk_file chr_file } *;
+allow devices_unconfined_type device_node:{ blk_file chr_file lnk_file } *;
allow devices_unconfined_type mtrr_device_t:file *;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.8.6/policy/modules/kernel/domain.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.8.7/policy/modules/kernel/domain.if
--- nsaserefpolicy/policy/modules/kernel/domain.if 2010-03-18 06:48:09.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/domain.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/domain.if 2010-07-14 14:08:02.000000000 -0400
@@ -611,7 +611,7 @@
########################################
@@ -7057,9 +6753,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
+
+ dontaudit $1 domain:socket_class_set { read write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.8.6/policy/modules/kernel/domain.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.8.7/policy/modules/kernel/domain.te
--- nsaserefpolicy/policy/modules/kernel/domain.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/domain.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/domain.te 2010-07-14 14:08:02.000000000 -0400
@@ -4,6 +4,21 @@
#
# Declarations
@@ -7225,9 +6921,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
+
+# broken kernel
+dontaudit can_change_object_identity can_change_object_identity:key link;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.8.6/policy/modules/kernel/files.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.8.7/policy/modules/kernel/files.fc
--- nsaserefpolicy/policy/modules/kernel/files.fc 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/files.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/files.fc 2010-07-14 14:08:02.000000000 -0400
@@ -18,6 +18,7 @@
/fsckoptions -- gen_context(system_u:object_r:etc_runtime_t,s0)
/halt -- gen_context(system_u:object_r:etc_runtime_t,s0)
@@ -7269,18 +6965,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
HOME_ROOT/\.journal <<none>>
HOME_ROOT/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
HOME_ROOT/lost\+found/.* <<none>>
-@@ -159,6 +168,10 @@
+@@ -159,6 +168,12 @@
/proc -d <<none>>
/proc/.* <<none>>
+ifdef(`distro_redhat',`
+/rhev -d gen_context(system_u:object_r:mnt_t,s0)
++/rhev(/[^/]*)? -d gen_context(system_u:object_r:mnt_t,s0)
++/rhev/[^/]*/.* <<none>>
+')
+
#
# /selinux
#
-@@ -172,12 +185,6 @@
+@@ -172,12 +187,6 @@
/srv/.* gen_context(system_u:object_r:var_t,s0)
#
@@ -7293,7 +6991,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
# /tmp
#
/tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
-@@ -217,7 +224,6 @@
+@@ -217,7 +226,6 @@
ifndef(`distro_redhat',`
/usr/local/src(/.*)? gen_context(system_u:object_r:src_t,s0)
@@ -7301,7 +6999,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
/usr/src(/.*)? gen_context(system_u:object_r:src_t,s0)
/usr/src/kernels/.+/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
')
-@@ -233,6 +239,8 @@
+@@ -233,6 +241,8 @@
/var/ftp/etc(/.*)? gen_context(system_u:object_r:etc_t,s0)
@@ -7310,15 +7008,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
/var/lib(/.*)? gen_context(system_u:object_r:var_lib_t,s0)
/var/lib/nfs/rpc_pipefs(/.*)? <<none>>
-@@ -258,3 +266,5 @@
+@@ -249,7 +259,7 @@
+ /var/spool(/.*)? gen_context(system_u:object_r:var_spool_t,s0)
+ /var/spool/postfix/etc(/.*)? gen_context(system_u:object_r:etc_t,s0)
+
+-/var/tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
++/var/tmp gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
+ /var/tmp/.* <<none>>
+ /var/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
+ /var/tmp/lost\+found/.* <<none>>
+@@ -258,3 +268,5 @@
ifdef(`distro_debian',`
/var/run/motd -- gen_context(system_u:object_r:etc_runtime_t,s0)
')
+/nsr(/.*)? gen_context(system_u:object_r:var_t,s0)
+/nsr/logs(/.*)? gen_context(system_u:object_r:var_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.8.6/policy/modules/kernel/files.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.8.7/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/files.if 2010-07-12 15:49:18.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/files.if 2010-07-14 14:08:02.000000000 -0400
@@ -1053,10 +1053,8 @@
relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 })
@@ -7807,9 +7514,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
+
+ allow $1 file_type:kernel_service create_files_as;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.8.6/policy/modules/kernel/files.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.8.7/policy/modules/kernel/files.te
--- nsaserefpolicy/policy/modules/kernel/files.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/files.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/files.te 2010-07-14 14:08:02.000000000 -0400
@@ -11,6 +11,7 @@
attribute mountpoint;
attribute pidfile;
@@ -7841,10 +7548,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
files_type(etc_runtime_t)
#Temporarily in policy until FC5 dissappears
typealias etc_runtime_t alias firstboot_rw_t;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.8.6/policy/modules/kernel/filesystem.if
---- nsaserefpolicy/policy/modules/kernel/filesystem.if 2010-06-08 10:35:48.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/filesystem.if 2010-07-12 09:05:35.000000000 -0400
-@@ -1207,7 +1207,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.8.7/policy/modules/kernel/filesystem.if
+--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/filesystem.if 2010-07-14 14:08:02.000000000 -0400
+@@ -1233,7 +1233,7 @@
type cifs_t;
')
@@ -7853,7 +7560,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
')
########################################
-@@ -1470,6 +1470,25 @@
+@@ -1496,6 +1496,25 @@
domain_auto_transition_pattern($1, cifs_t, $2)
')
@@ -7879,7 +7586,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
#######################################
## <summary>
## Create, read, write, and delete dirs
-@@ -1897,6 +1916,25 @@
+@@ -1923,6 +1942,25 @@
########################################
## <summary>
@@ -7905,7 +7612,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
## Read and write hugetlbfs files.
## </summary>
## <param name="domain">
-@@ -1965,6 +2003,7 @@
+@@ -1991,6 +2029,7 @@
')
allow $1 inotifyfs_t:dir list_dir_perms;
@@ -7913,7 +7620,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
')
########################################
-@@ -2361,6 +2400,25 @@
+@@ -2387,6 +2426,25 @@
########################################
## <summary>
@@ -7939,7 +7646,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
## Append files
## on a NFS filesystem.
## </summary>
-@@ -2415,7 +2473,7 @@
+@@ -2441,7 +2499,7 @@
type nfs_t;
')
@@ -7948,7 +7655,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
')
########################################
-@@ -2603,6 +2661,24 @@
+@@ -2629,6 +2687,24 @@
########################################
## <summary>
@@ -7956,82 +7663,37 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
+## </summary>
+## <param name="domain">
+## <summary>
-+## Domain not to audit.
-+## </summary>
-+## </param>
-+#
-+interface(`fs_dontaudit_write_removable_files',`
-+ gen_require(`
-+ type removable_t;
-+ ')
-+
-+ dontaudit $1 removable_t:file write_file_perms;
-+')
-+
-+########################################
-+## <summary>
- ## Read removable storage symbolic links.
- ## </summary>
- ## <param name="domain">
-@@ -2811,7 +2887,7 @@
- #########################################
- ## <summary>
- ## Create, read, write, and delete symbolic links
--## on a CIFS or SMB network filesystem.
-+## on a NFS network filesystem.
- ## </summary>
- ## <param name="domain">
- ## <summary>
-@@ -3936,6 +4012,24 @@
-
- ########################################
- ## <summary>
-+## dontaudit Read and write block nodes on tmpfs filesystems.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`fs_dontaudit_read_tmpfs_blk_dev',`
-+ gen_require(`
-+ type tmpfs_t;
-+ ')
-+
-+ dontaudit $1 tmpfs_t:blk_file read_blk_file_perms;
-+')
-+
-+########################################
-+## <summary>
- ## Relabel character nodes on tmpfs filesystems.
- ## </summary>
- ## <param name="domain">
-@@ -4498,6 +4592,44 @@
-
- ########################################
- ## <summary>
-+## Get the attributes of all blk files with
-+## a filesystem type.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
++## Domain not to audit.
+## </summary>
+## </param>
+#
-+interface(`fs_getattr_all_blk_files',`
++interface(`fs_dontaudit_write_removable_files',`
+ gen_require(`
-+ attribute filesystem_type;
++ type removable_t;
+ ')
+
-+ getattr_blk_files_pattern($1, filesystem_type, filesystem_type)
++ dontaudit $1 removable_t:file write_file_perms;
+')
+
+########################################
+## <summary>
-+## Get the attributes of all chr files with
-+## a filesystem type.
+ ## Read removable storage symbolic links.
+ ## </summary>
+ ## <param name="domain">
+@@ -2837,7 +2913,7 @@
+ #########################################
+ ## <summary>
+ ## Create, read, write, and delete symbolic links
+-## on a CIFS or SMB network filesystem.
++## on a NFS network filesystem.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -3962,6 +4038,24 @@
+
+ ########################################
+ ## <summary>
++## dontaudit Read and write block nodes on tmpfs filesystems.
+## </summary>
+## <param name="domain">
+## <summary>
@@ -8039,22 +7701,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
+## </summary>
+## </param>
+#
-+interface(`fs_getattr_all_chr_files',`
++interface(`fs_dontaudit_read_tmpfs_blk_dev',`
+ gen_require(`
-+ attribute filesystem_type;
++ type tmpfs_t;
+ ')
+
-+ getattr_chr_files_pattern($1, filesystem_type, filesystem_type)
++ dontaudit $1 tmpfs_t:blk_file read_blk_file_perms;
+')
+
+########################################
+## <summary>
- ## Do not audit attempts to get the attributes
- ## of all files with a filesystem type.
+ ## Relabel character nodes on tmpfs filesystems.
## </summary>
-@@ -4615,3 +4747,24 @@
- relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs)
- relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs)
+ ## <param name="domain">
+@@ -4654,3 +4748,24 @@
+
+ typeattribute $1 filesystem_unconfined_type;
')
+
+########################################
@@ -8077,9 +7739,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
+ dontaudit $1 filesystem_type:lnk_file { read };
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.8.6/policy/modules/kernel/filesystem.te
---- nsaserefpolicy/policy/modules/kernel/filesystem.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/filesystem.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.8.7/policy/modules/kernel/filesystem.te
+--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/filesystem.te 2010-07-14 14:08:02.000000000 -0400
@@ -52,6 +52,7 @@
fs_type(anon_inodefs_t)
files_mountpoint(anon_inodefs_t)
@@ -8121,9 +7783,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
files_mountpoint(removable_t)
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.8.6/policy/modules/kernel/kernel.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.8.7/policy/modules/kernel/kernel.if
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2010-06-08 10:35:48.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/kernel.if 2010-07-12 14:45:02.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/kernel.if 2010-07-14 14:08:02.000000000 -0400
@@ -1977,7 +1977,7 @@
')
@@ -8182,9 +7844,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
+ allow $1 kernel_t:unix_stream_socket connectto;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.8.6/policy/modules/kernel/kernel.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.8.7/policy/modules/kernel/kernel.te
--- nsaserefpolicy/policy/modules/kernel/kernel.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/kernel.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/kernel.te 2010-07-14 14:08:02.000000000 -0400
@@ -156,6 +156,7 @@
#
type unlabeled_t;
@@ -8244,9 +7906,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
########################################
#
# Unlabeled process local policy
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.8.6/policy/modules/kernel/selinux.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.8.7/policy/modules/kernel/selinux.if
--- nsaserefpolicy/policy/modules/kernel/selinux.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/selinux.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/selinux.if 2010-07-14 14:08:02.000000000 -0400
@@ -40,7 +40,7 @@
# because of this statement, any module which
@@ -8304,9 +7966,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu
+ fs_type($1)
+ mls_trusted_object($1)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.8.6/policy/modules/kernel/storage.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.8.7/policy/modules/kernel/storage.fc
--- nsaserefpolicy/policy/modules/kernel/storage.fc 2010-06-04 17:11:28.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/storage.fc 2010-07-12 14:46:51.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/storage.fc 2010-07-14 14:08:02.000000000 -0400
@@ -77,3 +77,6 @@
/dev/scramdisk/.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
@@ -8314,9 +7976,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag
+
+/lib/udev/devices/loop.* -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/lib/udev/devices/fuse -c gen_context(system_u:object_r:fuse_device_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.8.6/policy/modules/kernel/storage.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.8.7/policy/modules/kernel/storage.if
--- nsaserefpolicy/policy/modules/kernel/storage.if 2010-06-04 17:11:28.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/storage.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/storage.if 2010-07-14 14:08:02.000000000 -0400
@@ -101,6 +101,8 @@
dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file read_blk_file_perms;
@@ -8326,9 +7988,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag
typeattribute $1 fixed_disk_raw_read;
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.8.6/policy/modules/kernel/terminal.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.8.7/policy/modules/kernel/terminal.if
--- nsaserefpolicy/policy/modules/kernel/terminal.if 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/kernel/terminal.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/kernel/terminal.if 2010-07-14 14:08:02.000000000 -0400
@@ -292,9 +292,11 @@
interface(`term_dontaudit_use_console',`
gen_require(`
@@ -8369,9 +8031,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/auditadm.te serefpolicy-3.8.6/policy/modules/roles/auditadm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/auditadm.te serefpolicy-3.8.7/policy/modules/roles/auditadm.te
--- nsaserefpolicy/policy/modules/roles/auditadm.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/roles/auditadm.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/roles/auditadm.te 2010-07-14 14:08:02.000000000 -0400
@@ -28,10 +28,13 @@
logging_manage_audit_config(auditadm_t)
logging_run_auditctl(auditadm_t, auditadm_r)
@@ -8386,26 +8048,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/auditad
optional_policy(`
consoletype_exec(auditadm_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/guest.te serefpolicy-3.8.6/policy/modules/roles/guest.te
---- nsaserefpolicy/policy/modules/roles/guest.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/roles/guest.te 2010-07-12 09:05:35.000000000 -0400
-@@ -15,11 +15,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/guest.te serefpolicy-3.8.7/policy/modules/roles/guest.te
+--- nsaserefpolicy/policy/modules/roles/guest.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/roles/guest.te 2010-07-14 14:08:02.000000000 -0400
+@@ -14,4 +14,8 @@
+ # Local policy
#
- optional_policy(`
-- java_role_template(guest, guest_r, guest_t)
-+ apache_role(guest_r, guest_t)
- ')
-
--optional_policy(`
-- mono_role_template(guest, guest_r, guest_t)
--')
--
-#gen_user(guest_u,, guest_r, s0, s0)
++optional_policy(`
++ apache_role(guest_r, guest_t)
++')
++
+gen_user(guest_u, user, guest_r, s0, s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/secadm.te serefpolicy-3.8.6/policy/modules/roles/secadm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/secadm.te serefpolicy-3.8.7/policy/modules/roles/secadm.te
--- nsaserefpolicy/policy/modules/roles/secadm.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/roles/secadm.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/roles/secadm.te 2010-07-14 14:08:02.000000000 -0400
@@ -9,6 +9,8 @@
userdom_unpriv_user_template(secadm)
@@ -8415,9 +8073,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/secadm.
########################################
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.te serefpolicy-3.8.6/policy/modules/roles/staff.te
---- nsaserefpolicy/policy/modules/roles/staff.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/roles/staff.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.te serefpolicy-3.8.7/policy/modules/roles/staff.te
+--- nsaserefpolicy/policy/modules/roles/staff.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/roles/staff.te 2010-07-14 14:08:02.000000000 -0400
@@ -8,25 +8,55 @@
role staff_r;
@@ -8474,7 +8132,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.t
bluetooth_role(staff_r, staff_t)
')
-@@ -98,12 +128,18 @@
+@@ -94,12 +124,18 @@
oident_manage_user_content(staff_t)
oident_relabel_user_content(staff_t)
')
@@ -8493,7 +8151,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.t
pyzor_role(staff_r, staff_t)
')
-@@ -118,22 +154,27 @@
+@@ -114,22 +150,27 @@
optional_policy(`
screen_role_template(staff, staff_r, staff_t)
')
@@ -8521,11 +8179,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.t
optional_policy(`
sudo_role_template(staff, staff_r, staff_t)
-@@ -145,6 +186,11 @@
+@@ -141,6 +182,11 @@
')
optional_policy(`
-+ telepathysofiasip_role(staff_r, staff_t)
++ telepathy_dbus_session_role(staff_r, staff_t)
+')
+
+ifndef(`distro_redhat',`
@@ -8533,7 +8191,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.t
thunderbird_role(staff_r, staff_t)
')
-@@ -168,6 +214,78 @@
+@@ -164,6 +210,78 @@
wireshark_role(staff_r, staff_t)
')
@@ -8612,9 +8270,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.t
+optional_policy(`
+ userhelper_console_role_template(staff, staff_r, staff_usertype)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.te serefpolicy-3.8.6/policy/modules/roles/sysadm.te
---- nsaserefpolicy/policy/modules/roles/sysadm.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/roles/sysadm.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.te serefpolicy-3.8.7/policy/modules/roles/sysadm.te
+--- nsaserefpolicy/policy/modules/roles/sysadm.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/roles/sysadm.te 2010-07-14 14:08:29.000000000 -0400
@@ -27,17 +27,29 @@
corecmd_exec_shell(sysadm_t)
@@ -8723,8 +8381,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
')
optional_policy(`
-@@ -164,9 +191,11 @@
- ethereal_run_tethereal(sysadm_t, sysadm_r)
+@@ -159,9 +186,11 @@
+ dpkg_run(sysadm_t, sysadm_r)
')
+ifndef(`distro_redhat',`
@@ -8735,7 +8393,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
firstboot_run(sysadm_t, sysadm_r)
-@@ -176,6 +205,7 @@
+@@ -171,6 +200,7 @@
fstools_run(sysadm_t, sysadm_r)
')
@@ -8743,7 +8401,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
games_role(sysadm_r, sysadm_t)
')
-@@ -191,6 +221,7 @@
+@@ -186,6 +216,7 @@
optional_policy(`
gpg_role(sysadm_r, sysadm_t)
')
@@ -8751,7 +8409,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
hostname_run(sysadm_t, sysadm_r)
-@@ -204,6 +235,9 @@
+@@ -199,6 +230,9 @@
ipsec_stream_connect(sysadm_t)
# for lsof
ipsec_getattr_key_sockets(sysadm_t)
@@ -8761,7 +8419,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
')
optional_policy(`
-@@ -211,12 +245,18 @@
+@@ -206,12 +240,18 @@
')
optional_policy(`
@@ -8780,7 +8438,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
kudzu_run(sysadm_t, sysadm_r)
-@@ -226,9 +266,11 @@
+@@ -221,9 +261,11 @@
libs_run_ldconfig(sysadm_t, sysadm_r)
')
@@ -8792,7 +8450,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
logrotate_run(sysadm_t, sysadm_r)
-@@ -251,8 +293,10 @@
+@@ -246,8 +288,10 @@
optional_policy(`
mount_run(sysadm_t, sysadm_r)
@@ -8803,7 +8461,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
mozilla_role(sysadm_r, sysadm_t)
')
-@@ -260,6 +304,7 @@
+@@ -255,6 +299,7 @@
optional_policy(`
mplayer_role(sysadm_r, sysadm_t)
')
@@ -8811,7 +8469,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
mta_role(sysadm_r, sysadm_t)
-@@ -274,6 +319,10 @@
+@@ -269,6 +314,10 @@
')
optional_policy(`
@@ -8822,7 +8480,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
netutils_run(sysadm_t, sysadm_r)
netutils_run_ping(sysadm_t, sysadm_r)
netutils_run_traceroute(sysadm_t, sysadm_r)
-@@ -307,8 +356,14 @@
+@@ -302,8 +351,14 @@
')
optional_policy(`
@@ -8837,7 +8495,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
quota_run(sysadm_t, sysadm_r)
-@@ -318,9 +373,11 @@
+@@ -313,9 +368,11 @@
raid_domtrans_mdadm(sysadm_t)
')
@@ -8849,7 +8507,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
rpc_domtrans_nfsd(sysadm_t)
-@@ -330,9 +387,11 @@
+@@ -325,9 +382,11 @@
rpm_run(sysadm_t, sysadm_r)
')
@@ -8861,7 +8519,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
rsync_exec(sysadm_t)
-@@ -357,8 +416,14 @@
+@@ -352,8 +411,14 @@
')
optional_policy(`
@@ -8876,7 +8534,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
ssh_role_template(sysadm, sysadm_r, sysadm_t)
-@@ -381,9 +446,11 @@
+@@ -376,9 +441,11 @@
sysnet_run_dhcpc(sysadm_t, sysadm_r)
')
@@ -8888,7 +8546,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
tripwire_run_siggen(sysadm_t, sysadm_r)
-@@ -392,17 +459,21 @@
+@@ -387,17 +454,21 @@
tripwire_run_twprint(sysadm_t, sysadm_r)
')
@@ -8910,7 +8568,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
unconfined_domtrans(sysadm_t)
-@@ -416,9 +487,11 @@
+@@ -411,9 +482,11 @@
usbmodules_run(sysadm_t, sysadm_r)
')
@@ -8922,7 +8580,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
usermanage_run_admin_passwd(sysadm_t, sysadm_r)
-@@ -426,9 +499,15 @@
+@@ -421,9 +494,15 @@
usermanage_run_useradd(sysadm_t, sysadm_r)
')
@@ -8938,7 +8596,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
optional_policy(`
vpn_run(sysadm_t, sysadm_r)
-@@ -439,13 +518,30 @@
+@@ -434,13 +513,30 @@
')
optional_policy(`
@@ -8969,9 +8627,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.
+kernel_read_fs_sysctls(sysadm_t)
+modutils_read_module_deps(sysadm_t)
+miscfiles_read_hwdata(sysadm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.fc serefpolicy-3.8.6/policy/modules/roles/unconfineduser.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.fc serefpolicy-3.8.7/policy/modules/roles/unconfineduser.fc
--- nsaserefpolicy/policy/modules/roles/unconfineduser.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/roles/unconfineduser.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/roles/unconfineduser.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,8 @@
+# Add programs here which should not be confined by SELinux
+# e.g.:
@@ -8981,9 +8639,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfi
+
+/usr/sbin/xrdp -- gen_context(system_u:object_r:unconfined_exec_t,s0)
+/usr/sbin/xrdp-sesman -- gen_context(system_u:object_r:unconfined_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.if serefpolicy-3.8.6/policy/modules/roles/unconfineduser.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.if serefpolicy-3.8.7/policy/modules/roles/unconfineduser.if
--- nsaserefpolicy/policy/modules/roles/unconfineduser.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/roles/unconfineduser.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/roles/unconfineduser.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,667 @@
+## <summary>Unconfiend user role</summary>
+
@@ -9652,9 +9310,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfi
+
+ allow $1 unconfined_r;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.8.6/policy/modules/roles/unconfineduser.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.8.7/policy/modules/roles/unconfineduser.te
--- nsaserefpolicy/policy/modules/roles/unconfineduser.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/roles/unconfineduser.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/roles/unconfineduser.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,443 @@
+policy_module(unconfineduser, 1.0.0)
+
@@ -10099,9 +9757,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfi
+
+gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unprivuser.te serefpolicy-3.8.6/policy/modules/roles/unprivuser.te
---- nsaserefpolicy/policy/modules/roles/unprivuser.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/roles/unprivuser.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unprivuser.te serefpolicy-3.8.7/policy/modules/roles/unprivuser.te
+--- nsaserefpolicy/policy/modules/roles/unprivuser.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/roles/unprivuser.te 2010-07-14 14:08:02.000000000 -0400
@@ -12,10 +12,13 @@
userdom_unpriv_user_template(user)
@@ -10116,7 +9774,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unprivu
optional_policy(`
auth_role(user_r, user_t)
')
-@@ -108,11 +111,25 @@
+@@ -104,11 +107,25 @@
optional_policy(`
rssh_role(user_r, user_t)
')
@@ -10142,7 +9800,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unprivu
optional_policy(`
spamassassin_role(user_r, user_t)
')
-@@ -153,6 +170,12 @@
+@@ -149,6 +166,12 @@
wireshark_role(user_r, user_t)
')
@@ -10155,9 +9813,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unprivu
optional_policy(`
xserver_role(user_r, user_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/xguest.te serefpolicy-3.8.6/policy/modules/roles/xguest.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/xguest.te serefpolicy-3.8.7/policy/modules/roles/xguest.te
--- nsaserefpolicy/policy/modules/roles/xguest.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/roles/xguest.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/roles/xguest.te 2010-07-14 14:08:02.000000000 -0400
@@ -14,7 +14,7 @@
## <desc>
@@ -10216,29 +9874,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/xguest.
')
')
-@@ -80,19 +88,70 @@
+@@ -80,19 +88,74 @@
')
optional_policy(`
- java_role(xguest_r, xguest_t)
+ apache_role(xguest_r, xguest_t)
- ')
-
- optional_policy(`
-- mozilla_role(xguest_r, xguest_t)
-+ gnomeclock_dontaudit_dbus_chat(xguest_t)
+')
+
+optional_policy(`
-+ java_role_template(xguest, xguest_r, xguest_t)
++ gnomeclock_dontaudit_dbus_chat(xguest_t)
+')
+
+optional_policy(`
++ java_role_template(xguest, xguest_r, xguest_t)
+ ')
+
+ optional_policy(`
+- mozilla_role(xguest_r, xguest_t)
+ mono_role_template(xguest, xguest_r, xguest_t)
+')
+
+optional_policy(`
+ nsplugin_role(xguest_r, xguest_t)
++')
++
++optional_policy(`
++ telepathy_dbus_session_role(xguest_r, xguest_t)
')
optional_policy(`
@@ -10278,23 +9940,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/xguest.
+ corenet_tcp_connect_speech_port(xguest_usertype)
+ corenet_tcp_sendrecv_transproxy_port(xguest_usertype)
+ corenet_tcp_connect_transproxy_port(xguest_usertype)
- ')
- ')
-
--#gen_user(xguest_u,, xguest_r, s0, s0)
++ ')
++')
++
+optional_policy(`
+ gen_require(`
+ type mozilla_t;
-+ ')
+ ')
+
+ allow xguest_t mozilla_t:process transition;
+ role xguest_r types mozilla_t;
-+')
-+
+ ')
+
+-#gen_user(xguest_u,, xguest_r, s0, s0)
+gen_user(xguest_u, user, xguest_r, s0, s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.fc serefpolicy-3.8.6/policy/modules/services/abrt.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.fc serefpolicy-3.8.7/policy/modules/services/abrt.fc
--- nsaserefpolicy/policy/modules/services/abrt.fc 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/abrt.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/abrt.fc 2010-07-14 14:08:02.000000000 -0400
@@ -15,6 +15,7 @@
/var/run/abrt\.pid -- gen_context(system_u:object_r:abrt_var_run_t,s0)
@@ -10303,9 +9965,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt
/var/run/abrt(/.*)? gen_context(system_u:object_r:abrt_var_run_t,s0)
/var/spool/abrt(/.*)? gen_context(system_u:object_r:abrt_var_cache_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.if serefpolicy-3.8.6/policy/modules/services/abrt.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.if serefpolicy-3.8.7/policy/modules/services/abrt.if
--- nsaserefpolicy/policy/modules/services/abrt.if 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/abrt.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/abrt.if 2010-07-14 14:08:02.000000000 -0400
@@ -130,6 +130,10 @@
')
@@ -10379,9 +10041,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt
#####################################
## <summary>
## All of the rules required to administrate
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.te serefpolicy-3.8.6/policy/modules/services/abrt.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.te serefpolicy-3.8.7/policy/modules/services/abrt.te
--- nsaserefpolicy/policy/modules/services/abrt.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/abrt.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/abrt.te 2010-07-14 14:08:02.000000000 -0400
@@ -5,6 +5,14 @@
# Declarations
#
@@ -10423,7 +10085,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt
kernel_read_ring_buffer(abrt_t)
kernel_read_system_state(abrt_t)
-@@ -131,7 +140,7 @@
+@@ -121,6 +130,7 @@
+ files_read_kernel_modules(abrt_t)
+ files_dontaudit_list_default(abrt_t)
+ files_dontaudit_read_default_files(abrt_t)
++files_dontaudit_read_all_symlinks(abrt_t)
+
+ fs_list_inotifyfs(abrt_t)
+ fs_getattr_all_fs(abrt_t)
+@@ -131,7 +141,7 @@
fs_read_nfs_symlinks(abrt_t)
fs_search_all(abrt_t)
@@ -10432,7 +10102,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt
logging_read_generic_logs(abrt_t)
logging_send_syslog_msg(abrt_t)
-@@ -140,6 +149,11 @@
+@@ -140,6 +150,11 @@
miscfiles_read_localization(abrt_t)
userdom_dontaudit_read_user_home_content_files(abrt_t)
@@ -10444,7 +10114,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt
optional_policy(`
dbus_system_domain(abrt_t, abrt_exec_t)
-@@ -150,7 +164,12 @@
+@@ -150,7 +165,12 @@
')
optional_policy(`
@@ -10458,7 +10128,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt
policykit_domtrans_auth(abrt_t)
policykit_read_lib(abrt_t)
policykit_read_reload(abrt_t)
-@@ -178,6 +197,12 @@
+@@ -178,6 +198,12 @@
')
optional_policy(`
@@ -10471,7 +10141,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt
sssd_stream_connect(abrt_t)
')
-@@ -203,6 +228,7 @@
+@@ -203,6 +229,7 @@
domain_read_all_domains_state(abrt_helper_t)
files_read_etc_files(abrt_helper_t)
@@ -10479,7 +10149,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt
fs_list_inotifyfs(abrt_helper_t)
fs_getattr_all_fs(abrt_helper_t)
-@@ -217,11 +243,26 @@
+@@ -217,11 +244,26 @@
term_dontaudit_use_all_ptys(abrt_helper_t)
ifdef(`hide_broken_symptoms', `
@@ -10506,9 +10176,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt
+ allow abrt_t domain:file write;
+ allow abrt_t domain:process setrlimit;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.te serefpolicy-3.8.6/policy/modules/services/afs.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.te serefpolicy-3.8.7/policy/modules/services/afs.te
--- nsaserefpolicy/policy/modules/services/afs.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/afs.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/afs.te 2010-07-14 14:08:02.000000000 -0400
@@ -82,6 +82,10 @@
kernel_rw_afs_state(afs_t)
@@ -10520,9 +10190,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.
corenet_all_recvfrom_unlabeled(afs_t)
corenet_all_recvfrom_netlabel(afs_t)
corenet_tcp_sendrecv_generic_if(afs_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.fc serefpolicy-3.8.6/policy/modules/services/aiccu.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.fc serefpolicy-3.8.7/policy/modules/services/aiccu.fc
--- nsaserefpolicy/policy/modules/services/aiccu.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/aiccu.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/aiccu.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,6 @@
+/etc/aiccu.conf -- gen_context(system_u:object_r:aiccu_etc_t,s0)
+/etc/rc\.d/init\.d/aiccu -- gen_context(system_u:object_r:aiccu_initrc_exec_t,s0)
@@ -10530,9 +10200,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aicc
+/usr/sbin/aiccu -- gen_context(system_u:object_r:aiccu_exec_t,s0)
+
+/var/run/aiccu\.pid -- gen_context(system_u:object_r:aiccu_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.if serefpolicy-3.8.6/policy/modules/services/aiccu.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.if serefpolicy-3.8.7/policy/modules/services/aiccu.if
--- nsaserefpolicy/policy/modules/services/aiccu.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/aiccu.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/aiccu.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,118 @@
+## <summary>Automatic IPv6 Connectivity Client Utility.</summary>
+
@@ -10652,9 +10322,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aicc
+ admin_pattern($1, aiccu_var_run_t)
+ files_search_pids($1)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.te serefpolicy-3.8.6/policy/modules/services/aiccu.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.te serefpolicy-3.8.7/policy/modules/services/aiccu.te
--- nsaserefpolicy/policy/modules/services/aiccu.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/aiccu.te 2010-07-12 15:29:32.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/aiccu.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,72 @@
+policy_module(aiccu, 1.0.0)
+
@@ -10728,9 +10398,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aicc
+sysnet_domtrans_ifconfig(aiccu_t)
+sysnet_dns_name_resolve(aiccu_t)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aisexec.te serefpolicy-3.8.6/policy/modules/services/aisexec.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aisexec.te serefpolicy-3.8.7/policy/modules/services/aisexec.te
--- nsaserefpolicy/policy/modules/services/aisexec.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/aisexec.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/aisexec.te 2010-07-14 14:08:02.000000000 -0400
@@ -97,3 +97,6 @@
rhcs_rw_groupd_semaphores(aisexec_t)
rhcs_rw_groupd_shm(aisexec_t)
@@ -10738,9 +10408,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aise
+
+userdom_rw_semaphores(aisexec_t)
+userdom_rw_unpriv_user_shared_mem(aisexec_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.8.6/policy/modules/services/apache.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.8.7/policy/modules/services/apache.fc
--- nsaserefpolicy/policy/modules/services/apache.fc 2010-04-06 15:15:38.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/apache.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/apache.fc 2010-07-14 14:08:02.000000000 -0400
@@ -24,7 +24,6 @@
/usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0)
@@ -10791,9 +10461,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+/var/www/svn/hooks(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
+/var/www/svn/conf(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.8.6/policy/modules/services/apache.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.8.7/policy/modules/services/apache.if
--- nsaserefpolicy/policy/modules/services/apache.if 2010-04-06 15:15:38.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/apache.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/apache.if 2010-07-14 14:08:02.000000000 -0400
@@ -13,17 +13,13 @@
#
template(`apache_content_template',`
@@ -11203,9 +10873,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+ dontaudit $1 httpd_t:unix_dgram_socket { read write };
+ dontaudit $1 httpd_t:unix_stream_socket { read write };
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.8.6/policy/modules/services/apache.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.8.7/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/apache.te 2010-07-12 16:08:16.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/apache.te 2010-07-14 14:08:02.000000000 -0400
@@ -18,6 +18,8 @@
# Declarations
#
@@ -11760,9 +11430,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+typealias httpd_sys_script_t alias httpd_fastcgi_script_t;
+typealias httpd_var_run_t alias httpd_fastcgi_var_run_t;
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.8.6/policy/modules/services/apcupsd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.8.7/policy/modules/services/apcupsd.te
--- nsaserefpolicy/policy/modules/services/apcupsd.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/apcupsd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/apcupsd.te 2010-07-14 14:08:02.000000000 -0400
@@ -94,6 +94,10 @@
')
@@ -11774,9 +11444,28 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
mta_send_mail(apcupsd_t)
mta_system_content(apcupsd_tmp_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.te serefpolicy-3.8.6/policy/modules/services/arpwatch.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apm.te serefpolicy-3.8.7/policy/modules/services/apm.te
+--- nsaserefpolicy/policy/modules/services/apm.te 2010-06-18 13:07:19.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/apm.te 2010-07-14 16:43:57.000000000 -0400
+@@ -62,6 +62,7 @@
+ dontaudit apmd_t self:capability { setuid dac_override dac_read_search sys_ptrace sys_tty_config };
+ allow apmd_t self:process { signal_perms getsession };
+ allow apmd_t self:fifo_file rw_fifo_file_perms;
++allow apmd_t self:netlink_socket create_socket_perms;
+ allow apmd_t self:unix_dgram_socket create_socket_perms;
+ allow apmd_t self:unix_stream_socket create_stream_socket_perms;
+
+@@ -81,6 +82,7 @@
+ kernel_read_system_state(apmd_t)
+ kernel_write_proc_files(apmd_t)
+
++dev_read_input(apmd_t)
+ dev_read_realtime_clock(apmd_t)
+ dev_read_urand(apmd_t)
+ dev_rw_apm_bios(apmd_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.te serefpolicy-3.8.7/policy/modules/services/arpwatch.te
--- nsaserefpolicy/policy/modules/services/arpwatch.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/arpwatch.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/arpwatch.te 2010-07-14 14:08:02.000000000 -0400
@@ -63,6 +63,7 @@
corenet_udp_sendrecv_all_ports(arpwatch_t)
@@ -11785,9 +11474,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpw
dev_rw_generic_usb_dev(arpwatch_t)
fs_getattr_all_fs(arpwatch_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.te serefpolicy-3.8.6/policy/modules/services/asterisk.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.te serefpolicy-3.8.7/policy/modules/services/asterisk.te
--- nsaserefpolicy/policy/modules/services/asterisk.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/asterisk.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/asterisk.te 2010-07-14 14:08:02.000000000 -0400
@@ -99,6 +99,7 @@
corenet_tcp_bind_generic_node(asterisk_t)
corenet_udp_bind_generic_node(asterisk_t)
@@ -11815,9 +11504,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aste
postgresql_stream_connect(asterisk_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.8.6/policy/modules/services/automount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.8.7/policy/modules/services/automount.te
--- nsaserefpolicy/policy/modules/services/automount.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/automount.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/automount.te 2010-07-14 14:08:02.000000000 -0400
@@ -145,6 +145,7 @@
# Run mount in the mount_t domain.
@@ -11826,9 +11515,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto
mount_signal(automount_t)
userdom_dontaudit_use_unpriv_user_fds(automount_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.if serefpolicy-3.8.6/policy/modules/services/avahi.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.if serefpolicy-3.8.7/policy/modules/services/avahi.if
--- nsaserefpolicy/policy/modules/services/avahi.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/avahi.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/avahi.if 2010-07-14 14:08:02.000000000 -0400
@@ -90,6 +90,7 @@
class dbus send_msg;
')
@@ -11837,9 +11526,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah
allow $1 avahi_t:dbus send_msg;
allow avahi_t $1:dbus send_msg;
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.if serefpolicy-3.8.6/policy/modules/services/bind.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.if serefpolicy-3.8.7/policy/modules/services/bind.if
--- nsaserefpolicy/policy/modules/services/bind.if 2010-03-23 10:55:15.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/bind.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/bind.if 2010-07-14 14:08:02.000000000 -0400
@@ -359,9 +359,9 @@
interface(`bind_admin',`
gen_require(`
@@ -11862,9 +11551,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind
files_list_pids($1)
admin_pattern($1, named_var_run_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.te serefpolicy-3.8.6/policy/modules/services/bitlbee.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.te serefpolicy-3.8.7/policy/modules/services/bitlbee.te
--- nsaserefpolicy/policy/modules/services/bitlbee.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/bitlbee.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/bitlbee.te 2010-07-14 14:08:02.000000000 -0400
@@ -27,6 +27,7 @@
# Local policy
#
@@ -11884,9 +11573,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitl
miscfiles_read_localization(bitlbee_t)
sysnet_dns_name_resolve(bitlbee_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.if serefpolicy-3.8.6/policy/modules/services/bluetooth.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.if serefpolicy-3.8.7/policy/modules/services/bluetooth.if
--- nsaserefpolicy/policy/modules/services/bluetooth.if 2010-01-07 14:53:53.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/bluetooth.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/bluetooth.if 2010-07-14 14:08:02.000000000 -0400
@@ -117,6 +117,27 @@
########################################
@@ -11934,9 +11623,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue
files_list_var_lib($1)
admin_pattern($1, bluetooth_var_lib_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.fc serefpolicy-3.8.6/policy/modules/services/boinc.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.fc serefpolicy-3.8.7/policy/modules/services/boinc.fc
--- nsaserefpolicy/policy/modules/services/boinc.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/boinc.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/boinc.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,6 @@
+
+/etc/rc\.d/init\.d/boinc_client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0)
@@ -11944,9 +11633,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
+/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0)
+
+/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.if serefpolicy-3.8.6/policy/modules/services/boinc.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.if serefpolicy-3.8.7/policy/modules/services/boinc.if
--- nsaserefpolicy/policy/modules/services/boinc.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/boinc.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/boinc.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,151 @@
+
+## <summary>policy for boinc</summary>
@@ -12099,9 +11788,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
+ files_list_var_lib($1)
+ admin_pattern($1, boinc_var_lib_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.te serefpolicy-3.8.6/policy/modules/services/boinc.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.te serefpolicy-3.8.7/policy/modules/services/boinc.te
--- nsaserefpolicy/policy/modules/services/boinc.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/boinc.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/boinc.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,96 @@
+policy_module(boinc,1.0.0)
+
@@ -12199,17 +11888,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
+sysnet_dns_name_resolve(boinc_t)
+
+mta_send_mail(boinc_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.fc serefpolicy-3.8.6/policy/modules/services/bugzilla.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.fc serefpolicy-3.8.7/policy/modules/services/bugzilla.fc
--- nsaserefpolicy/policy/modules/services/bugzilla.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/bugzilla.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/bugzilla.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,4 @@
+
+/usr/share/bugzilla(/.*)? -d gen_context(system_u:object_r:httpd_bugzilla_content_t,s0)
+/usr/share/bugzilla(/.*)? -- gen_context(system_u:object_r:httpd_bugzilla_script_exec_t,s0)
+/var/lib/bugzilla(/.*)? gen_context(system_u:object_r:httpd_bugzilla_rw_content_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.if serefpolicy-3.8.6/policy/modules/services/bugzilla.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.if serefpolicy-3.8.7/policy/modules/services/bugzilla.if
--- nsaserefpolicy/policy/modules/services/bugzilla.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/bugzilla.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/bugzilla.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,39 @@
+## <summary>Bugzilla server</summary>
+
@@ -12250,9 +11939,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugz
+
+ dontaudit $1 httpd_bugzilla_script_t:unix_stream_socket { read write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.te serefpolicy-3.8.6/policy/modules/services/bugzilla.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.te serefpolicy-3.8.7/policy/modules/services/bugzilla.te
--- nsaserefpolicy/policy/modules/services/bugzilla.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/bugzilla.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/bugzilla.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,56 @@
+policy_module(bugzilla, 1.0)
+
@@ -12310,9 +11999,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugz
+ postgresql_stream_connect(httpd_bugzilla_script_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.fc serefpolicy-3.8.6/policy/modules/services/cachefilesd.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.fc serefpolicy-3.8.7/policy/modules/services/cachefilesd.fc
--- nsaserefpolicy/policy/modules/services/cachefilesd.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/cachefilesd.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cachefilesd.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,29 @@
+###############################################################################
+#
@@ -12343,9 +12032,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cach
+/var/cache/fscache(/.*)? gen_context(system_u:object_r:cachefiles_var_t,s0)
+
+/var/run/cachefilesd\.pid -- gen_context(system_u:object_r:cachefiles_var_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.if serefpolicy-3.8.6/policy/modules/services/cachefilesd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.if serefpolicy-3.8.7/policy/modules/services/cachefilesd.if
--- nsaserefpolicy/policy/modules/services/cachefilesd.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/cachefilesd.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cachefilesd.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,41 @@
+###############################################################################
+#
@@ -12388,9 +12077,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cach
+ allow cachefilesd_t $1:fifo_file rw_file_perms;
+ allow cachefilesd_t $1:process sigchld;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.te serefpolicy-3.8.6/policy/modules/services/cachefilesd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.te serefpolicy-3.8.7/policy/modules/services/cachefilesd.te
--- nsaserefpolicy/policy/modules/services/cachefilesd.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/cachefilesd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cachefilesd.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,147 @@
+###############################################################################
+#
@@ -12539,9 +12228,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cach
+fs_getattr_xattr_fs(cachefiles_kernel_t)
+
+dev_search_sysfs(cachefiles_kernel_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ccs.te serefpolicy-3.8.6/policy/modules/services/ccs.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ccs.te serefpolicy-3.8.7/policy/modules/services/ccs.te
--- nsaserefpolicy/policy/modules/services/ccs.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ccs.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ccs.te 2010-07-14 14:08:02.000000000 -0400
@@ -118,5 +118,10 @@
')
@@ -12553,9 +12242,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ccs.
+optional_policy(`
unconfined_use_fds(ccs_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmaster.if serefpolicy-3.8.6/policy/modules/services/certmaster.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmaster.if serefpolicy-3.8.7/policy/modules/services/certmaster.if
--- nsaserefpolicy/policy/modules/services/certmaster.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/certmaster.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/certmaster.if 2010-07-14 14:08:02.000000000 -0400
@@ -18,6 +18,25 @@
domtrans_pattern($1, certmaster_exec_t, certmaster_t)
')
@@ -12582,9 +12271,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cert
#######################################
## <summary>
## read certmaster logs.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.if serefpolicy-3.8.6/policy/modules/services/certmonger.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.if serefpolicy-3.8.7/policy/modules/services/certmonger.if
--- nsaserefpolicy/policy/modules/services/certmonger.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/certmonger.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/certmonger.if 2010-07-14 14:08:02.000000000 -0400
@@ -167,8 +167,8 @@
allow $2 system_r;
@@ -12596,9 +12285,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cert
- admin_pattern($1, cermonger_var_run_t)
+ admin_pattern($1, certmonger_var_run_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.te serefpolicy-3.8.6/policy/modules/services/certmonger.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.te serefpolicy-3.8.7/policy/modules/services/certmonger.te
--- nsaserefpolicy/policy/modules/services/certmonger.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/certmonger.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/certmonger.te 2010-07-14 14:08:02.000000000 -0400
@@ -68,5 +68,5 @@
')
@@ -12606,28 +12295,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cert
- unconfined_dbus_send(certmonger_t)
+ pcscd_stream_connect(certmonger_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cgroup.if serefpolicy-3.8.6/policy/modules/services/cgroup.if
---- nsaserefpolicy/policy/modules/services/cgroup.if 2010-06-08 10:35:48.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/cgroup.if 2010-07-12 09:05:35.000000000 -0400
-@@ -121,7 +121,6 @@
- gen_require(`
- type cgred_t, cgconfig_t, cgred_var_run_t;
- type cgconfig_etc_t, cgconfig_initrc_exec_t, cgred_initrc_exec_t;
-- type cgred_etc_t;
- ')
-
- allow $1 cgconfig_t:process { ptrace signal_perms getattr };
-@@ -131,7 +130,6 @@
- read_files_pattern($1, cgred_t, cgred_t)
-
- admin_pattern($1, cgconfig_etc_t)
-- admin_pattern($1, cgred_etc_t)
- files_search_etc($1)
-
- admin_pattern($1, cgred_var_run_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cgroup.te serefpolicy-3.8.6/policy/modules/services/cgroup.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cgroup.te serefpolicy-3.8.7/policy/modules/services/cgroup.te
--- nsaserefpolicy/policy/modules/services/cgroup.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/cgroup.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cgroup.te 2010-07-14 14:08:02.000000000 -0400
@@ -18,8 +18,8 @@
type cgrules_etc_t;
files_config_file(cgrules_etc_t)
@@ -12639,9 +12309,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cgro
init_daemon_domain(cgconfig_t, cgconfig_exec_t)
type cgconfig_initrc_exec_t;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chronyd.if serefpolicy-3.8.6/policy/modules/services/chronyd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chronyd.if serefpolicy-3.8.7/policy/modules/services/chronyd.if
--- nsaserefpolicy/policy/modules/services/chronyd.if 2010-03-29 15:04:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/chronyd.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/chronyd.if 2010-07-14 14:08:02.000000000 -0400
@@ -19,6 +19,24 @@
domtrans_pattern($1, chronyd_exec_t, chronyd_t)
')
@@ -12748,9 +12418,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chro
- admin_pattern($1, chronyd_tmp_t)
+ admin_pattern($1, chronyd_tmpfs_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chronyd.te serefpolicy-3.8.6/policy/modules/services/chronyd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chronyd.te serefpolicy-3.8.7/policy/modules/services/chronyd.te
--- nsaserefpolicy/policy/modules/services/chronyd.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/chronyd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/chronyd.te 2010-07-14 14:08:02.000000000 -0400
@@ -15,6 +15,9 @@
type chronyd_keys_t;
files_type(chronyd_keys_t)
@@ -12780,11 +12450,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chro
corenet_udp_bind_ntp_port(chronyd_t)
# bind to udp/323
corenet_udp_bind_chronyd_port(chronyd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.8.6/policy/modules/services/clamav.te
---- nsaserefpolicy/policy/modules/services/clamav.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/clamav.te 2010-07-12 09:05:35.000000000 -0400
-@@ -92,7 +92,7 @@
- manage_dirs_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.8.7/policy/modules/services/clamav.te
+--- nsaserefpolicy/policy/modules/services/clamav.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/clamav.te 2010-07-14 14:08:02.000000000 -0400
+@@ -89,9 +89,10 @@
+ logging_log_filetrans(clamd_t, clamd_var_log_t, { dir file })
+
+ # pid file
++manage_dirs_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)
manage_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
manage_sock_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
-files_pid_filetrans(clamd_t, clamd_var_run_t, { file dir })
@@ -12792,7 +12465,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam
kernel_dontaudit_list_proc(clamd_t)
kernel_read_sysctl(clamd_t)
-@@ -184,6 +184,7 @@
+@@ -189,6 +190,7 @@
corenet_tcp_sendrecv_all_ports(freshclam_t)
corenet_tcp_sendrecv_clamd_port(freshclam_t)
corenet_tcp_connect_http_port(freshclam_t)
@@ -12800,7 +12473,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam
corenet_sendrecv_http_client_packets(freshclam_t)
dev_read_rand(freshclam_t)
-@@ -202,6 +203,8 @@
+@@ -207,6 +209,8 @@
clamav_stream_connect(freshclam_t)
@@ -12809,20 +12482,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam
optional_policy(`
cron_system_entry(freshclam_t, freshclam_exec_t)
')
-@@ -257,8 +260,10 @@
-
- tunable_policy(`clamd_use_jit',`
- allow clamd_t self:process execmem;
-+ allow clamscan_t self:process execmem;
- ', `
- dontaudit clamd_t self:process execmem;
-+ dontaudit clamscan_t self:process execmem;
- ')
-
- optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmirrord.fc serefpolicy-3.8.6/policy/modules/services/cmirrord.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmirrord.fc serefpolicy-3.8.7/policy/modules/services/cmirrord.fc
--- nsaserefpolicy/policy/modules/services/cmirrord.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/cmirrord.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cmirrord.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,6 @@
+
+/etc/rc\.d/init\.d/cmirrord -- gen_context(system_u:object_r:cmirrord_initrc_exec_t,s0)
@@ -12830,9 +12492,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmir
+/usr/sbin/cmirrord -- gen_context(system_u:object_r:cmirrord_exec_t,s0)
+
+/var/run/cmirrord\.pid -- gen_context(system_u:object_r:cmirrord_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmirrord.if serefpolicy-3.8.6/policy/modules/services/cmirrord.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmirrord.if serefpolicy-3.8.7/policy/modules/services/cmirrord.if
--- nsaserefpolicy/policy/modules/services/cmirrord.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/cmirrord.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cmirrord.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,118 @@
+
+## <summary>policy for cmirrord</summary>
@@ -12952,9 +12614,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmir
+ admin_pattern($1, cmirrord_var_run_t)
+
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmirrord.te serefpolicy-3.8.6/policy/modules/services/cmirrord.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmirrord.te serefpolicy-3.8.7/policy/modules/services/cmirrord.te
--- nsaserefpolicy/policy/modules/services/cmirrord.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/cmirrord.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cmirrord.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,56 @@
+policy_module(cmirrord,1.0.0)
+
@@ -13012,9 +12674,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmir
+optional_policy(`
+ corosync_stream_connect(cmirrord_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobbler.fc serefpolicy-3.8.6/policy/modules/services/cobbler.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobbler.fc serefpolicy-3.8.7/policy/modules/services/cobbler.fc
--- nsaserefpolicy/policy/modules/services/cobbler.fc 2010-02-12 10:33:09.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/cobbler.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cobbler.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,7 +1,32 @@
-/etc/cobbler(/.*)? gen_context(system_u:object_r:cobbler_etc_t, s0)
-/etc/rc\.d/init\.d/cobblerd -- gen_context(system_u:object_r:cobblerd_initrc_exec_t, s0)
@@ -13053,9 +12715,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobb
-/var/lib/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t, s0)
-/var/log/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_log_t, s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobbler.if serefpolicy-3.8.6/policy/modules/services/cobbler.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobbler.if serefpolicy-3.8.7/policy/modules/services/cobbler.if
--- nsaserefpolicy/policy/modules/services/cobbler.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/cobbler.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cobbler.if 2010-07-14 14:08:02.000000000 -0400
@@ -1,14 +1,4 @@
## <summary>Cobbler installation server.</summary>
-## <desc>
@@ -13307,9 +12969,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobb
+ tftp_search_rw_content($1)
+ ')
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobbler.te serefpolicy-3.8.6/policy/modules/services/cobbler.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobbler.te serefpolicy-3.8.7/policy/modules/services/cobbler.te
--- nsaserefpolicy/policy/modules/services/cobbler.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/cobbler.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cobbler.te 2010-07-14 14:08:02.000000000 -0400
@@ -1,3 +1,4 @@
+
policy_module(cobbler, 1.1.0)
@@ -13558,9 +13220,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobb
+ # Something that runs in the cobberd_t domain tries to relabelfrom cobbler_content_t dir to httpd_sys_content_t.
+ dontaudit cobblerd_t httpdcontent:dir relabel_dir_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.8.6/policy/modules/services/consolekit.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.8.7/policy/modules/services/consolekit.te
--- nsaserefpolicy/policy/modules/services/consolekit.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/consolekit.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/consolekit.te 2010-07-14 14:08:02.000000000 -0400
@@ -15,6 +15,9 @@
type consolekit_var_run_t;
files_pid_file(consolekit_var_run_t)
@@ -13625,9 +13287,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons
+ unconfined_ptrace(consolekit_t)
unconfined_stream_connect(consolekit_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/corosync.fc serefpolicy-3.8.6/policy/modules/services/corosync.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/corosync.fc serefpolicy-3.8.7/policy/modules/services/corosync.fc
--- nsaserefpolicy/policy/modules/services/corosync.fc 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/corosync.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/corosync.fc 2010-07-14 14:08:02.000000000 -0400
@@ -3,6 +3,7 @@
/usr/sbin/corosync -- gen_context(system_u:object_r:corosync_exec_t,s0)
@@ -13636,9 +13298,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/coro
/var/lib/corosync(/.*)? gen_context(system_u:object_r:corosync_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/corosync.te serefpolicy-3.8.6/policy/modules/services/corosync.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/corosync.te serefpolicy-3.8.7/policy/modules/services/corosync.te
--- nsaserefpolicy/policy/modules/services/corosync.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/corosync.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/corosync.te 2010-07-14 14:08:02.000000000 -0400
@@ -5,6 +5,13 @@
# Declarations
#
@@ -13724,9 +13386,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/coro
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.8.6/policy/modules/services/cron.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.8.7/policy/modules/services/courier.te
+--- nsaserefpolicy/policy/modules/services/courier.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/courier.te 2010-07-14 14:08:02.000000000 -0400
+@@ -48,6 +48,7 @@
+ allow courier_authdaemon_t courier_tcpd_t:tcp_socket rw_stream_socket_perms;
+ allow courier_authdaemon_t courier_tcpd_t:unix_stream_socket rw_stream_socket_perms;
+ allow courier_authdaemon_t courier_tcpd_t:process sigchld;
++allow courier_authdaemon_t courier_tcpd_t:fd use;
+ allow courier_authdaemon_t courier_tcpd_t:tcp_socket rw_stream_socket_perms;
+ allow courier_authdaemon_t courier_tcpd_t:fifo_file rw_file_perms;
+
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.8.7/policy/modules/services/cron.fc
--- nsaserefpolicy/policy/modules/services/cron.fc 2009-09-16 09:09:20.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/cron.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cron.fc 2010-07-14 14:08:02.000000000 -0400
@@ -14,7 +14,7 @@
/var/run/anacron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0)
/var/run/atd\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0)
@@ -13744,9 +13417,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
+/var/lib/glpi/files(/.*)? gen_context(system_u:object_r:cron_var_lib_t,s0)
+
+/var/log/mcelog.* -- gen_context(system_u:object_r:cron_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.8.6/policy/modules/services/cron.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.8.7/policy/modules/services/cron.if
--- nsaserefpolicy/policy/modules/services/cron.if 2009-09-16 09:09:20.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/cron.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cron.if 2010-07-14 14:08:02.000000000 -0400
@@ -12,6 +12,10 @@
## </param>
#
@@ -13930,9 +13603,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
+
+ manage_files_pattern($1, system_cronjob_var_lib_t, system_cronjob_var_lib_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.8.6/policy/modules/services/cron.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.8.7/policy/modules/services/cron.te
--- nsaserefpolicy/policy/modules/services/cron.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/cron.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cron.te 2010-07-14 14:08:02.000000000 -0400
@@ -63,9 +63,12 @@
type crond_tmp_t;
@@ -14226,9 +13899,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
read_files_pattern(crond_t, user_cron_spool_t, user_cron_spool_t)
tunable_policy(`fcron_crond', `
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.8.6/policy/modules/services/cups.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.8.7/policy/modules/services/cups.fc
--- nsaserefpolicy/policy/modules/services/cups.fc 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/cups.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cups.fc 2010-07-14 14:08:02.000000000 -0400
@@ -71,3 +71,9 @@
/var/run/ptal-mlcd(/.*)? gen_context(system_u:object_r:ptal_var_run_t,s0)
/var/run/udev-configure-printer(/.*)? gen_context(system_u:object_r:cupsd_config_var_run_t,s0)
@@ -14239,9 +13912,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
+/usr/local/Printer/(.*/)?inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+
+/usr/local/linuxprinter/ppd(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.if serefpolicy-3.8.6/policy/modules/services/cups.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.if serefpolicy-3.8.7/policy/modules/services/cups.if
--- nsaserefpolicy/policy/modules/services/cups.if 2009-07-28 15:51:13.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/cups.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cups.if 2010-07-14 14:08:02.000000000 -0400
@@ -314,7 +314,7 @@
interface(`cups_admin',`
gen_require(`
@@ -14261,9 +13934,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
admin_pattern($1, cupsd_tmp_t)
files_list_tmp($1)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.8.6/policy/modules/services/cups.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.8.7/policy/modules/services/cups.te
--- nsaserefpolicy/policy/modules/services/cups.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/cups.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cups.te 2010-07-14 14:08:02.000000000 -0400
@@ -15,6 +15,7 @@
type cupsd_t;
type cupsd_exec_t;
@@ -14337,18 +14010,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
tunable_policy(`use_nfs_home_dirs',`
fs_search_auto_mountpoints(cups_pdf_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.8.6/policy/modules/services/cvs.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.8.7/policy/modules/services/cvs.te
--- nsaserefpolicy/policy/modules/services/cvs.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/cvs.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cvs.te 2010-07-14 14:08:02.000000000 -0400
@@ -112,4 +112,5 @@
read_files_pattern(httpd_cvs_script_t, cvs_data_t, cvs_data_t)
manage_dirs_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
manage_files_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
+ files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir })
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-3.8.6/policy/modules/services/cyrus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-3.8.7/policy/modules/services/cyrus.te
--- nsaserefpolicy/policy/modules/services/cyrus.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/cyrus.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/cyrus.te 2010-07-14 14:08:02.000000000 -0400
@@ -135,6 +135,7 @@
')
@@ -14357,9 +14030,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru
snmp_read_snmp_var_lib_files(cyrus_t)
snmp_dontaudit_write_snmp_var_lib_files(cyrus_t)
snmp_stream_connect(cyrus_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.8.6/policy/modules/services/dbus.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.8.7/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/dbus.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/dbus.if 2010-07-14 14:08:02.000000000 -0400
@@ -42,8 +42,10 @@
gen_require(`
class dbus { send_msg acquire_svc };
@@ -14442,9 +14115,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
ifdef(`hide_broken_symptoms', `
dontaudit $1 system_dbusd_t:netlink_selinux_socket { read write };
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.8.6/policy/modules/services/dbus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.8.7/policy/modules/services/dbus.te
--- nsaserefpolicy/policy/modules/services/dbus.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/dbus.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/dbus.te 2010-07-14 14:08:02.000000000 -0400
@@ -121,6 +121,7 @@
init_use_fds(system_dbusd_t)
@@ -14484,9 +14157,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
+ xserver_rw_xdm_pipes(session_bus_type)
+ xserver_append_xdm_home_files(session_bus_type)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/denyhosts.te serefpolicy-3.8.6/policy/modules/services/denyhosts.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/denyhosts.te serefpolicy-3.8.7/policy/modules/services/denyhosts.te
--- nsaserefpolicy/policy/modules/services/denyhosts.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/denyhosts.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/denyhosts.te 2010-07-14 14:08:02.000000000 -0400
@@ -25,7 +25,8 @@
#
# DenyHosts personal policy.
@@ -14505,7 +14178,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/deny
corenet_sendrecv_smtp_client_packets(denyhosts_t)
dev_read_urand(denyhosts_t)
-@@ -61,9 +63,11 @@
+@@ -61,12 +63,18 @@
# /var/log/secure
logging_read_generic_logs(denyhosts_t)
@@ -14517,9 +14190,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/deny
sysnet_manage_config(denyhosts_t)
sysnet_etc_filetrans_config(denyhosts_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.8.6/policy/modules/services/devicekit.te
+ optional_policy(`
+ cron_system_entry(denyhosts_t, denyhosts_exec_t)
+ ')
++
++optional_policy(`
++ gnome_dontaudit_search_config(denyhosts_t)
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.8.7/policy/modules/services/devicekit.te
--- nsaserefpolicy/policy/modules/services/devicekit.te 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/devicekit.te 2010-07-12 16:35:15.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/devicekit.te 2010-07-14 14:08:02.000000000 -0400
@@ -75,10 +75,12 @@
manage_files_pattern(devicekit_disk_t, devicekit_var_lib_t, devicekit_var_lib_t)
files_var_lib_filetrans(devicekit_disk_t, devicekit_var_lib_t, dir)
@@ -14566,9 +14246,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devi
allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
allow devicekit_power_t self:netlink_kobject_uevent_socket create_socket_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.8.6/policy/modules/services/dhcp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.8.7/policy/modules/services/dhcp.te
--- nsaserefpolicy/policy/modules/services/dhcp.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/dhcp.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/dhcp.te 2010-07-14 14:08:02.000000000 -0400
@@ -111,6 +111,11 @@
')
@@ -14581,9 +14261,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp
dbus_system_bus_client(dhcpd_t)
dbus_connect_system_bus(dhcpd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.8.6/policy/modules/services/dnsmasq.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-3.8.7/policy/modules/services/djbdns.te
+--- nsaserefpolicy/policy/modules/services/djbdns.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/djbdns.te 2010-07-14 14:08:02.000000000 -0400
+@@ -22,6 +22,8 @@
+ # Local policy for axfrdns component
+ #
+
++files_config_file(djbdns_axfrdns_conf_t)
++
+ daemontools_ipc_domain(djbdns_axfrdns_t)
+ daemontools_read_svc(djbdns_axfrdns_t)
+
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.8.7/policy/modules/services/dnsmasq.te
--- nsaserefpolicy/policy/modules/services/dnsmasq.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/dnsmasq.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/dnsmasq.te 2010-07-14 14:08:02.000000000 -0400
@@ -92,7 +92,11 @@
userdom_dontaudit_search_user_home_dirs(dnsmasq_t)
@@ -14597,9 +14289,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsm
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.8.6/policy/modules/services/dovecot.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.8.7/policy/modules/services/dovecot.fc
--- nsaserefpolicy/policy/modules/services/dovecot.fc 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/dovecot.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/dovecot.fc 2010-07-14 14:08:02.000000000 -0400
@@ -25,7 +25,7 @@
ifdef(`distro_redhat', `
/usr/libexec/dovecot/auth -- gen_context(system_u:object_r:dovecot_auth_exec_t,s0)
@@ -14609,9 +14301,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
/usr/libexec/dovecot/dovecot-auth -- gen_context(system_u:object_r:dovecot_auth_exec_t,s0)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.8.6/policy/modules/services/dovecot.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.8.7/policy/modules/services/dovecot.if
--- nsaserefpolicy/policy/modules/services/dovecot.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/dovecot.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/dovecot.if 2010-07-14 14:08:02.000000000 -0400
@@ -93,12 +93,14 @@
#
interface(`dovecot_admin',`
@@ -14653,9 +14345,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
files_list_pids($1)
admin_pattern($1, dovecot_var_run_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.8.6/policy/modules/services/dovecot.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.8.7/policy/modules/services/dovecot.te
--- nsaserefpolicy/policy/modules/services/dovecot.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/dovecot.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/dovecot.te 2010-07-14 14:08:02.000000000 -0400
@@ -58,7 +58,7 @@
allow dovecot_t self:capability { dac_override dac_read_search chown kill net_bind_service setgid setuid sys_chroot };
@@ -14681,7 +14373,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
postfix_search_spool(dovecot_auth_t)
')
-@@ -256,9 +258,15 @@
+@@ -256,16 +258,22 @@
allow dovecot_deliver_t dovecot_etc_t:file read_file_perms;
allow dovecot_deliver_t dovecot_var_run_t:dir list_dir_perms;
@@ -14697,15 +14389,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
files_read_etc_files(dovecot_deliver_t)
files_read_etc_runtime_files(dovecot_deliver_t)
+ auth_use_nsswitch(dovecot_deliver_t)
+
+ logging_send_syslog_msg(dovecot_deliver_t)
+-logging_search_logs(dovecot_auth_t)
++logging_search_logs(dovecot_deliver_t)
+
+ miscfiles_read_localization(dovecot_deliver_t)
+
@@ -302,4 +310,5 @@
optional_policy(`
mta_manage_spool(dovecot_deliver_t)
+ mta_read_queue(dovecot_deliver_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.fc serefpolicy-3.8.6/policy/modules/services/exim.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.fc serefpolicy-3.8.7/policy/modules/services/exim.fc
--- nsaserefpolicy/policy/modules/services/exim.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/exim.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/exim.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,3 +1,6 @@
+
+/etc/rc\.d/init\.d/exim -- gen_context(system_u:object_r:exim_initrc_exec_t,s0)
@@ -14713,9 +14413,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim
/usr/sbin/exim[0-9]? -- gen_context(system_u:object_r:exim_exec_t,s0)
/var/log/exim[0-9]?(/.*)? gen_context(system_u:object_r:exim_log_t,s0)
/var/run/exim[0-9]?\.pid -- gen_context(system_u:object_r:exim_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.if serefpolicy-3.8.6/policy/modules/services/exim.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.if serefpolicy-3.8.7/policy/modules/services/exim.if
--- nsaserefpolicy/policy/modules/services/exim.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/exim.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/exim.if 2010-07-14 14:08:02.000000000 -0400
@@ -20,6 +20,24 @@
########################################
@@ -14788,9 +14488,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim
+ files_search_pids($1)
+ admin_pattern($1, exim_var_run_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.8.6/policy/modules/services/exim.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.8.7/policy/modules/services/exim.te
--- nsaserefpolicy/policy/modules/services/exim.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/exim.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/exim.te 2010-07-14 14:08:02.000000000 -0400
@@ -35,6 +35,9 @@
application_executable_file(exim_exec_t)
mta_agent_executable(exim_exec_t)
@@ -14812,9 +14512,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim
tunable_policy(`exim_can_connect_db',`
mysql_stream_connect(exim_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.if serefpolicy-3.8.6/policy/modules/services/fail2ban.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.if serefpolicy-3.8.7/policy/modules/services/fail2ban.if
--- nsaserefpolicy/policy/modules/services/fail2ban.if 2010-03-18 06:48:09.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/fail2ban.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/fail2ban.if 2010-07-14 14:08:02.000000000 -0400
@@ -138,6 +138,26 @@
########################################
@@ -14842,18 +14542,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail
## All of the rules required to administrate
## an fail2ban environment
## </summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fprintd.te serefpolicy-3.8.6/policy/modules/services/fprintd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.te serefpolicy-3.8.7/policy/modules/services/fail2ban.te
+--- nsaserefpolicy/policy/modules/services/fail2ban.te 2010-06-18 13:07:19.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/fail2ban.te 2010-07-14 14:08:02.000000000 -0400
+@@ -94,5 +94,9 @@
+ ')
+
+ optional_policy(`
++ gnome_dontaudit_search_config(fail2ban_t)
++')
++
++optional_policy(`
+ iptables_domtrans(fail2ban_t)
+ ')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fprintd.te serefpolicy-3.8.7/policy/modules/services/fprintd.te
--- nsaserefpolicy/policy/modules/services/fprintd.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/fprintd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/fprintd.te 2010-07-14 14:08:02.000000000 -0400
@@ -54,4 +54,5 @@
policykit_read_lib(fprintd_t)
policykit_dbus_chat(fprintd_t)
policykit_domtrans_auth(fprintd_t)
+ policykit_dbus_chat_auth(fprintd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.8.6/policy/modules/services/ftp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.8.7/policy/modules/services/ftp.te
--- nsaserefpolicy/policy/modules/services/ftp.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ftp.te 2010-07-12 16:27:22.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ftp.te 2010-07-14 14:08:02.000000000 -0400
@@ -40,6 +40,13 @@
## <desc>
@@ -14991,9 +14704,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
')
tunable_policy(`sftpd_enable_homedirs && use_nfs_home_dirs',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.fc serefpolicy-3.8.6/policy/modules/services/git.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.fc serefpolicy-3.8.7/policy/modules/services/git.fc
--- nsaserefpolicy/policy/modules/services/git.fc 2010-04-05 14:44:26.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/git.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/git.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,3 +1,12 @@
+HOME_DIR/public_git(/.*)? gen_context(system_u:object_r:git_session_content_t, s0)
+HOME_DIR/\.gitconfig -- gen_context(system_u:object_r:git_session_content_t, s0)
@@ -15007,9 +14720,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.
/var/www/cgi-bin/cgit -- gen_context(system_u:object_r:httpd_git_script_exec_t,s0)
+/var/www/git(/.*)? gen_context(system_u:object_r:httpd_git_content_t,s0)
+/var/www/git/gitweb.cgi gen_context(system_u:object_r:httpd_git_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.if serefpolicy-3.8.6/policy/modules/services/git.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.if serefpolicy-3.8.7/policy/modules/services/git.if
--- nsaserefpolicy/policy/modules/services/git.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/git.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/git.if 2010-07-14 14:08:02.000000000 -0400
@@ -1 +1,525 @@
-## <summary>GIT revision control system</summary>
+## <summary>Fast Version Control System.</summary>
@@ -15537,9 +15250,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.
+ userdom_search_user_home_dirs($1)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.te serefpolicy-3.8.6/policy/modules/services/git.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.te serefpolicy-3.8.7/policy/modules/services/git.te
--- nsaserefpolicy/policy/modules/services/git.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/git.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/git.te 2010-07-14 14:08:02.000000000 -0400
@@ -1,8 +1,192 @@
-policy_module(git, 1.0)
+policy_module(git, 1.0.3)
@@ -15736,9 +15449,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.
+git_role_template(git_shell)
+gen_user(git_shell_u, user, git_shell_r, s0, s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.if serefpolicy-3.8.6/policy/modules/services/gnomeclock.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.if serefpolicy-3.8.7/policy/modules/services/gnomeclock.if
--- nsaserefpolicy/policy/modules/services/gnomeclock.if 2009-09-16 10:01:13.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/gnomeclock.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/gnomeclock.if 2010-07-14 14:08:02.000000000 -0400
@@ -63,3 +63,24 @@
allow $1 gnomeclock_t:dbus send_msg;
allow gnomeclock_t $1:dbus send_msg;
@@ -15764,9 +15477,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnom
+ dontaudit $1 gnomeclock_t:dbus send_msg;
+ dontaudit gnomeclock_t $1:dbus send_msg;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.te serefpolicy-3.8.6/policy/modules/services/gpsd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.te serefpolicy-3.8.7/policy/modules/services/gpsd.te
--- nsaserefpolicy/policy/modules/services/gpsd.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/gpsd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/gpsd.te 2010-07-14 14:08:02.000000000 -0400
@@ -56,6 +56,10 @@
miscfiles_read_localization(gpsd_t)
@@ -15778,9 +15491,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd
dbus_system_bus_client(gpsd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.8.6/policy/modules/services/hal.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.8.7/policy/modules/services/hal.if
--- nsaserefpolicy/policy/modules/services/hal.if 2010-02-12 10:33:09.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/hal.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/hal.if 2010-07-14 14:08:02.000000000 -0400
@@ -377,6 +377,26 @@
########################################
@@ -15808,9 +15521,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
## Read/Write hald PID files.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.8.6/policy/modules/services/hal.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.8.7/policy/modules/services/hal.te
--- nsaserefpolicy/policy/modules/services/hal.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/hal.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/hal.te 2010-07-14 14:08:02.000000000 -0400
@@ -54,6 +54,9 @@
type hald_var_lib_t;
files_type(hald_var_lib_t)
@@ -15905,20 +15618,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
########################################
#
# Local hald dccm policy
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hddtemp.te serefpolicy-3.8.6/policy/modules/services/hddtemp.te
---- nsaserefpolicy/policy/modules/services/hddtemp.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/hddtemp.te 2010-07-12 09:05:35.000000000 -0400
-@@ -26,6 +26,7 @@
- corenet_tcp_bind_all_nodes(hddtemp_t)
- corenet_tcp_bind_hddtemp_port(hddtemp_t)
-
-+files_read_etc_files(hddtemp_t)
- # read hddtemp db file
- files_read_usr_files(hddtemp_t)
-
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/icecast.te serefpolicy-3.8.6/policy/modules/services/icecast.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hddtemp.fc serefpolicy-3.8.7/policy/modules/services/hddtemp.fc
+--- nsaserefpolicy/policy/modules/services/hddtemp.fc 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/hddtemp.fc 2010-07-14 14:08:02.000000000 -0400
+@@ -1,5 +1,3 @@
+ /etc/rc\.d/init\.d/hddtemp -- gen_context(system_u:object_r:hddtemp_initrc_exec_t,s0)
+
+-/etc/sysconfig/hddtemp -- gen_context(system_u:object_r:hddtemp_etc_t,s0)
+-
+ /usr/sbin/hddtemp -- gen_context(system_u:object_r:hddtemp_exec_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/icecast.te serefpolicy-3.8.7/policy/modules/services/icecast.te
--- nsaserefpolicy/policy/modules/services/icecast.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/icecast.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/icecast.te 2010-07-14 14:08:02.000000000 -0400
@@ -37,6 +37,8 @@
manage_files_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t)
files_pid_filetrans(icecast_t, icecast_var_run_t, { file dir })
@@ -15938,9 +15649,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/icec
+optional_policy(`
rtkit_scheduled(icecast_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inn.te serefpolicy-3.8.6/policy/modules/services/inn.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inn.te serefpolicy-3.8.7/policy/modules/services/inn.te
--- nsaserefpolicy/policy/modules/services/inn.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/inn.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/inn.te 2010-07-14 14:08:02.000000000 -0400
@@ -105,6 +105,7 @@
userdom_dontaudit_use_unpriv_user_fds(innd_t)
@@ -15949,9 +15660,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inn.
mta_send_mail(innd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.8.6/policy/modules/services/kerberos.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.8.7/policy/modules/services/kerberos.te
--- nsaserefpolicy/policy/modules/services/kerberos.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/kerberos.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/kerberos.te 2010-07-14 14:08:02.000000000 -0400
@@ -126,10 +126,13 @@
corenet_tcp_bind_generic_node(kadmind_t)
corenet_udp_bind_generic_node(kadmind_t)
@@ -15976,18 +15687,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
manage_dirs_pattern(krb5kdc_t, krb5kdc_tmp_t, krb5kdc_tmp_t)
manage_files_pattern(krb5kdc_t, krb5kdc_tmp_t, krb5kdc_tmp_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.fc serefpolicy-3.8.6/policy/modules/services/ksmtuned.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.fc serefpolicy-3.8.7/policy/modules/services/ksmtuned.fc
--- nsaserefpolicy/policy/modules/services/ksmtuned.fc 2010-03-29 15:04:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ksmtuned.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ksmtuned.fc 2010-07-14 14:08:02.000000000 -0400
@@ -3,3 +3,5 @@
/usr/sbin/ksmtuned -- gen_context(system_u:object_r:ksmtuned_exec_t,s0)
/var/run/ksmtune\.pid -- gen_context(system_u:object_r:ksmtuned_var_run_t,s0)
+
+/var/log/ksmtuned.* gen_context(system_u:object_r:ksmtuned_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.if serefpolicy-3.8.6/policy/modules/services/ksmtuned.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.if serefpolicy-3.8.7/policy/modules/services/ksmtuned.if
--- nsaserefpolicy/policy/modules/services/ksmtuned.if 2010-03-29 15:04:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ksmtuned.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ksmtuned.if 2010-07-14 14:08:02.000000000 -0400
@@ -60,7 +60,7 @@
')
@@ -15997,9 +15708,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmt
files_list_pids($1)
admin_pattern($1, ksmtuned_var_run_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.te serefpolicy-3.8.6/policy/modules/services/ksmtuned.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.te serefpolicy-3.8.7/policy/modules/services/ksmtuned.te
--- nsaserefpolicy/policy/modules/services/ksmtuned.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ksmtuned.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ksmtuned.te 2010-07-14 14:08:02.000000000 -0400
@@ -9,6 +9,9 @@
type ksmtuned_exec_t;
init_daemon_domain(ksmtuned_t, ksmtuned_exec_t)
@@ -16037,9 +15748,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmt
+
miscfiles_read_localization(ksmtuned_t)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.fc serefpolicy-3.8.6/policy/modules/services/ldap.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.fc serefpolicy-3.8.7/policy/modules/services/ldap.fc
--- nsaserefpolicy/policy/modules/services/ldap.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ldap.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ldap.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,6 +1,8 @@
/etc/ldap/slapd\.conf -- gen_context(system_u:object_r:slapd_etc_t,s0)
@@ -16055,9 +15766,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap
/var/run/slapd\.args -- gen_context(system_u:object_r:slapd_var_run_t,s0)
/var/run/slapd\.pid -- gen_context(system_u:object_r:slapd_var_run_t,s0)
+#/var/run/slapd.* -s gen_context(system_u:object_r:slapd_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.if serefpolicy-3.8.6/policy/modules/services/ldap.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.if serefpolicy-3.8.7/policy/modules/services/ldap.if
--- nsaserefpolicy/policy/modules/services/ldap.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ldap.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ldap.if 2010-07-14 14:08:02.000000000 -0400
@@ -1,5 +1,43 @@
## <summary>OpenLDAP directory server</summary>
@@ -16159,9 +15870,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.te serefpolicy-3.8.6/policy/modules/services/ldap.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.te serefpolicy-3.8.7/policy/modules/services/ldap.te
--- nsaserefpolicy/policy/modules/services/ldap.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ldap.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ldap.te 2010-07-14 14:08:02.000000000 -0400
@@ -27,9 +27,15 @@
type slapd_replog_t;
files_type(slapd_replog_t)
@@ -16196,9 +15907,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap
manage_files_pattern(slapd_t, slapd_var_run_t, slapd_var_run_t)
manage_sock_files_pattern(slapd_t, slapd_var_run_t, slapd_var_run_t)
files_pid_filetrans(slapd_t, slapd_var_run_t, { file sock_file })
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lircd.te serefpolicy-3.8.6/policy/modules/services/lircd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lircd.te serefpolicy-3.8.7/policy/modules/services/lircd.te
--- nsaserefpolicy/policy/modules/services/lircd.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/lircd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/lircd.te 2010-07-14 14:08:02.000000000 -0400
@@ -24,6 +24,7 @@
#
@@ -16216,9 +15927,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lirc
dev_read_mouse(lircd_t)
dev_filetrans_lirc(lircd_t)
dev_rw_lirc(lircd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/memcached.if serefpolicy-3.8.6/policy/modules/services/memcached.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.te serefpolicy-3.8.7/policy/modules/services/lpd.te
+--- nsaserefpolicy/policy/modules/services/lpd.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/lpd.te 2010-07-14 14:08:02.000000000 -0400
+@@ -308,12 +308,14 @@
+ ')
+
+ tunable_policy(`use_nfs_home_dirs',`
++ files_list_home(lpr_t)
+ fs_list_auto_mountpoints(lpr_t)
+ fs_read_nfs_files(lpr_t)
+ fs_read_nfs_symlinks(lpr_t)
+ ')
+
+ tunable_policy(`use_samba_home_dirs',`
++ files_list_home(lpr_t)
+ fs_list_auto_mountpoints(lpr_t)
+ fs_read_cifs_files(lpr_t)
+ fs_read_cifs_symlinks(lpr_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/memcached.if serefpolicy-3.8.7/policy/modules/services/memcached.if
--- nsaserefpolicy/policy/modules/services/memcached.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/memcached.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/memcached.if 2010-07-14 14:08:02.000000000 -0400
@@ -59,6 +59,7 @@
gen_require(`
type memcached_t;
@@ -16227,9 +15956,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/memc
')
allow $1 memcached_t:process { ptrace signal_perms };
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/milter.if serefpolicy-3.8.6/policy/modules/services/milter.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/milter.if serefpolicy-3.8.7/policy/modules/services/milter.if
--- nsaserefpolicy/policy/modules/services/milter.if 2009-12-18 11:38:25.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/milter.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/milter.if 2010-07-14 14:08:02.000000000 -0400
@@ -37,6 +37,8 @@
files_read_etc_files($1_milter_t)
@@ -16264,9 +15993,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/milt
## Manage spamassassin milter state
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock.fc serefpolicy-3.8.6/policy/modules/services/mock.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock.fc serefpolicy-3.8.7/policy/modules/services/mock.fc
--- nsaserefpolicy/policy/modules/services/mock.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/mock.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/mock.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,6 @@
+
+/usr/sbin/mock -- gen_context(system_u:object_r:mock_exec_t,s0)
@@ -16274,9 +16003,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock
+/var/lib/mock(/.*)? gen_context(system_u:object_r:mock_var_lib_t,s0)
+
+/var/cache/mock(/.*)? gen_context(system_u:object_r:mock_cache_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock.if serefpolicy-3.8.6/policy/modules/services/mock.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock.if serefpolicy-3.8.7/policy/modules/services/mock.if
--- nsaserefpolicy/policy/modules/services/mock.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/mock.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/mock.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,238 @@
+
+## <summary>policy for mock</summary>
@@ -16516,9 +16245,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock
+ admin_pattern($1, mock_var_lib_t)
+
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock.te serefpolicy-3.8.6/policy/modules/services/mock.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock.te serefpolicy-3.8.7/policy/modules/services/mock.te
--- nsaserefpolicy/policy/modules/services/mock.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/mock.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/mock.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,98 @@
+policy_module(mock,1.0.0)
+
@@ -16618,9 +16347,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock
+optional_policy(`
+ apache_read_sys_content_rw_files(mock_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.te serefpolicy-3.8.6/policy/modules/services/modemmanager.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.te serefpolicy-3.8.7/policy/modules/services/modemmanager.te
--- nsaserefpolicy/policy/modules/services/modemmanager.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/modemmanager.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/modemmanager.te 2010-07-14 14:08:02.000000000 -0400
@@ -16,7 +16,8 @@
# ModemManager local policy
#
@@ -16649,9 +16378,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mode
+optional_policy(`
udev_read_db(modemmanager_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.fc serefpolicy-3.8.6/policy/modules/services/mpd.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.fc serefpolicy-3.8.7/policy/modules/services/mpd.fc
--- nsaserefpolicy/policy/modules/services/mpd.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/mpd.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/mpd.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,10 @@
+
+/etc/mpd\.conf -- gen_context(system_u:object_r:mpd_etc_t,s0)
@@ -16663,9 +16392,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.
+/var/lib/mpd(/.*)? gen_context(system_u:object_r:mpd_var_lib_t,s0)
+/var/lib/mpd/music(/.*)? gen_context(system_u:object_r:mpd_data_t,s0)
+/var/lib/mpd/playlists(/.*)? gen_context(system_u:object_r:mpd_data_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.if serefpolicy-3.8.6/policy/modules/services/mpd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.if serefpolicy-3.8.7/policy/modules/services/mpd.if
--- nsaserefpolicy/policy/modules/services/mpd.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/mpd.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/mpd.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,274 @@
+
+## <summary>policy for daemon for playing music</summary>
@@ -16941,9 +16670,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.
+ admin_pattern($1, mpd_log_t)
+
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.te serefpolicy-3.8.6/policy/modules/services/mpd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.te serefpolicy-3.8.7/policy/modules/services/mpd.te
--- nsaserefpolicy/policy/modules/services/mpd.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/mpd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/mpd.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,111 @@
+policy_module(mpd,1.0.0)
+
@@ -17056,9 +16785,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.
+optional_policy(`
+ udev_read_db(mpd_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.8.6/policy/modules/services/mta.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.8.7/policy/modules/services/mta.fc
--- nsaserefpolicy/policy/modules/services/mta.fc 2010-01-07 14:53:53.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/mta.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/mta.fc 2010-07-14 14:08:02.000000000 -0400
@@ -13,6 +13,8 @@
/usr/bin/esmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
@@ -17068,9 +16797,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
/usr/lib(64)?/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
/usr/lib/courier/bin/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.8.6/policy/modules/services/mta.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.8.7/policy/modules/services/mta.if
--- nsaserefpolicy/policy/modules/services/mta.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/mta.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/mta.if 2010-07-14 14:08:02.000000000 -0400
@@ -220,6 +220,25 @@
application_executable_file($1)
')
@@ -17140,9 +16869,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
read_lnk_files_pattern($1, mail_spool_t, mail_spool_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.8.6/policy/modules/services/mta.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.8.7/policy/modules/services/mta.te
--- nsaserefpolicy/policy/modules/services/mta.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/mta.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/mta.te 2010-07-14 14:08:02.000000000 -0400
@@ -21,7 +21,7 @@
files_config_file(etc_mail_t)
@@ -17234,10 +16963,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
read_files_pattern(mailserver_delivery, mail_forward_t, mail_forward_t)
read_files_pattern(mailserver_delivery, system_mail_tmp_t, system_mail_tmp_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.if serefpolicy-3.8.6/policy/modules/services/munin.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.if serefpolicy-3.8.7/policy/modules/services/munin.if
--- nsaserefpolicy/policy/modules/services/munin.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/munin.if 2010-07-12 09:05:35.000000000 -0400
-@@ -92,6 +92,24 @@
++++ serefpolicy-3.8.7/policy/modules/services/munin.if 2010-07-14 14:22:01.000000000 -0400
+@@ -36,6 +36,7 @@
+ # automatic transition rules from munin domain
+ # to specific munin plugin domain
+ domtrans_pattern(munin_t, $1_munin_plugin_exec_t, $1_munin_plugin_t)
++ allow munin_t $1_munin_plugin_t:process signal;
+
+ allow $1_munin_plugin_t munin_exec_t:file read_file_perms;
+ allow $1_munin_plugin_t munin_t:tcp_socket rw_socket_perms;
+@@ -92,6 +93,24 @@
files_search_etc($1)
')
@@ -17262,9 +16999,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni
#######################################
## <summary>
## Append to the munin log.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.te serefpolicy-3.8.6/policy/modules/services/munin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.te serefpolicy-3.8.7/policy/modules/services/munin.te
--- nsaserefpolicy/policy/modules/services/munin.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/munin.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/munin.te 2010-07-14 14:15:45.000000000 -0400
@@ -40,7 +40,7 @@
# Local policy
#
@@ -17290,7 +17027,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni
')
optional_policy(`
-@@ -195,6 +197,7 @@
+@@ -182,6 +184,7 @@
+ # local policy for disk plugins
+ #
+
++allow munin_disk_plugin_t self:capability { sys_admin sys_rawio };
+ allow disk_munin_plugin_t self:tcp_socket create_stream_socket_perms;
+
+ rw_files_pattern(disk_munin_plugin_t, munin_var_lib_t, munin_var_lib_t)
+@@ -195,10 +198,11 @@
fs_getattr_all_fs(disk_munin_plugin_t)
@@ -17298,7 +17043,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni
dev_read_sysfs(disk_munin_plugin_t)
dev_read_urand(disk_munin_plugin_t)
-@@ -229,11 +232,13 @@
+-storage_getattr_fixed_disk_dev(disk_munin_plugin_t)
++storage_raw_read_fixed_disk(disk_munin_plugin_t)
+
+ sysnet_read_config(disk_munin_plugin_t)
+
+@@ -229,11 +233,13 @@
mta_read_config(mail_munin_plugin_t)
mta_send_mail(mail_munin_plugin_t)
@@ -17312,7 +17062,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni
')
optional_policy(`
-@@ -249,6 +254,8 @@
+@@ -249,6 +255,8 @@
allow services_munin_plugin_t self:udp_socket create_socket_perms;
allow services_munin_plugin_t self:netlink_route_socket r_netlink_socket_perms;
@@ -17321,7 +17071,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni
corenet_tcp_connect_all_ports(services_munin_plugin_t)
corenet_tcp_connect_http_port(services_munin_plugin_t)
-@@ -286,6 +293,10 @@
+@@ -286,6 +294,10 @@
snmp_read_snmp_var_lib_files(services_munin_plugin_t)
')
@@ -17332,7 +17082,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni
##################################
#
# local policy for system plugins
-@@ -300,6 +311,8 @@
+@@ -300,6 +312,8 @@
corecmd_exec_shell(system_munin_plugin_t)
@@ -17341,15 +17091,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni
fs_getattr_all_fs(system_munin_plugin_t)
dev_read_sysfs(system_munin_plugin_t)
-@@ -313,3 +326,5 @@
+@@ -313,3 +327,5 @@
sysnet_exec_ifconfig(system_munin_plugin_t)
term_getattr_unallocated_ttys(system_munin_plugin_t)
+term_getattr_all_ptys(system_munin_plugin_t)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.8.6/policy/modules/services/mysql.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.8.7/policy/modules/services/mysql.te
--- nsaserefpolicy/policy/modules/services/mysql.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/mysql.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/mysql.te 2010-07-14 14:08:02.000000000 -0400
@@ -64,6 +64,7 @@
manage_dirs_pattern(mysqld_t, mysqld_db_t, mysqld_db_t)
@@ -17374,9 +17124,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq
files_read_etc_files(mysqld_safe_t)
files_read_usr_files(mysqld_safe_t)
files_dontaudit_getattr_all_dirs(mysqld_safe_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.8.6/policy/modules/services/nagios.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.8.7/policy/modules/services/nagios.if
--- nsaserefpolicy/policy/modules/services/nagios.if 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/nagios.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/nagios.if 2010-07-14 14:08:02.000000000 -0400
@@ -159,6 +159,26 @@
########################################
@@ -17404,9 +17154,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi
## Execute the nagios NRPE with
## a domain transition.
## </summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.8.6/policy/modules/services/nagios.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.8.7/policy/modules/services/nagios.te
--- nsaserefpolicy/policy/modules/services/nagios.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/nagios.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/nagios.te 2010-07-14 14:08:02.000000000 -0400
@@ -107,13 +107,11 @@
files_read_etc_runtime_files(nagios_t)
files_read_kernel_symbol_table(nagios_t)
@@ -17440,9 +17190,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.8.6/policy/modules/services/networkmanager.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.8.7/policy/modules/services/networkmanager.fc
--- nsaserefpolicy/policy/modules/services/networkmanager.fc 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/networkmanager.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/networkmanager.fc 2010-07-14 14:08:02.000000000 -0400
@@ -2,6 +2,10 @@
/etc/NetworkManager/dispatcher\.d(/.*) gen_context(system_u:object_r:NetworkManager_initrc_exec_t,s0)
@@ -17454,9 +17204,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
/usr/libexec/nm-dispatcher.action -- gen_context(system_u:object_r:NetworkManager_initrc_exec_t,s0)
/sbin/wpa_cli -- gen_context(system_u:object_r:wpa_cli_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.8.6/policy/modules/services/networkmanager.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.8.7/policy/modules/services/networkmanager.if
--- nsaserefpolicy/policy/modules/services/networkmanager.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/networkmanager.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/networkmanager.if 2010-07-14 14:08:02.000000000 -0400
@@ -137,6 +137,27 @@
########################################
@@ -17536,9 +17286,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
+ allow $1 NetworkManager_log_t:dir list_dir_perms;
+ append_files_pattern($1, NetworkManager_log_t, NetworkManager_log_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.8.6/policy/modules/services/networkmanager.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.8.7/policy/modules/services/networkmanager.te
--- nsaserefpolicy/policy/modules/services/networkmanager.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/networkmanager.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/networkmanager.te 2010-07-14 14:08:02.000000000 -0400
@@ -35,7 +35,7 @@
# networkmanager will ptrace itself if gdb is installed
@@ -17629,9 +17379,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.8.6/policy/modules/services/nscd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.8.7/policy/modules/services/nscd.if
--- nsaserefpolicy/policy/modules/services/nscd.if 2009-09-16 09:09:20.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/nscd.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/nscd.if 2010-07-14 14:08:02.000000000 -0400
@@ -121,6 +121,24 @@
########################################
@@ -17666,9 +17416,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.8.6/policy/modules/services/nscd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.8.7/policy/modules/services/nscd.te
--- nsaserefpolicy/policy/modules/services/nscd.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/nscd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/nscd.te 2010-07-14 14:08:02.000000000 -0400
@@ -1,9 +1,16 @@
-policy_module(nscd, 1.10.0)
+policy_module(nscd, 1.10.1)
@@ -17732,9 +17482,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd
+optional_policy(`
+ unconfined_dontaudit_rw_packet_sockets(nscd_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nslcd.te serefpolicy-3.8.6/policy/modules/services/nslcd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nslcd.te serefpolicy-3.8.7/policy/modules/services/nslcd.te
--- nsaserefpolicy/policy/modules/services/nslcd.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/nslcd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/nslcd.te 2010-07-14 14:08:02.000000000 -0400
@@ -34,6 +34,8 @@
manage_sock_files_pattern(nslcd_t, nslcd_var_run_t, nslcd_var_run_t)
files_pid_filetrans(nslcd_t, nslcd_var_run_t, { file dir })
@@ -17744,9 +17494,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nslc
files_read_etc_files(nslcd_t)
auth_use_nsswitch(nslcd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.8.6/policy/modules/services/ntp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.8.7/policy/modules/services/ntp.te
--- nsaserefpolicy/policy/modules/services/ntp.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ntp.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ntp.te 2010-07-14 14:08:02.000000000 -0400
@@ -96,9 +96,12 @@
dev_read_sysfs(ntpd_t)
# for SSP
@@ -17760,9 +17510,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
term_use_ptmx(ntpd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nut.te serefpolicy-3.8.6/policy/modules/services/nut.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nut.te serefpolicy-3.8.7/policy/modules/services/nut.te
--- nsaserefpolicy/policy/modules/services/nut.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/nut.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/nut.te 2010-07-14 14:08:02.000000000 -0400
@@ -103,6 +103,10 @@
mta_send_mail(nut_upsmon_t)
@@ -17774,9 +17524,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nut.
########################################
#
# Local policy for upsdrvctl
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.if serefpolicy-3.8.6/policy/modules/services/nx.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.if serefpolicy-3.8.7/policy/modules/services/nx.if
--- nsaserefpolicy/policy/modules/services/nx.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/nx.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/nx.if 2010-07-14 14:08:02.000000000 -0400
@@ -35,6 +35,7 @@
allow $1 nx_server_var_lib_t:dir search_dir_perms;
@@ -17785,9 +17535,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.i
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.te serefpolicy-3.8.6/policy/modules/services/nx.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.te serefpolicy-3.8.7/policy/modules/services/nx.te
--- nsaserefpolicy/policy/modules/services/nx.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/nx.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/nx.te 2010-07-14 14:08:02.000000000 -0400
@@ -27,6 +27,9 @@
type nx_server_var_run_t;
files_pid_file(nx_server_var_run_t)
@@ -17808,18 +17558,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.t
kernel_read_system_state(nx_server_t)
kernel_read_kernel_sysctls(nx_server_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.fc serefpolicy-3.8.6/policy/modules/services/oddjob.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.fc serefpolicy-3.8.7/policy/modules/services/oddjob.fc
--- nsaserefpolicy/policy/modules/services/oddjob.fc 2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/oddjob.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/oddjob.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,4 +1,5 @@
/usr/lib(64)?/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0)
+/usr/libexec/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0)
/usr/sbin/oddjobd -- gen_context(system_u:object_r:oddjob_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.if serefpolicy-3.8.6/policy/modules/services/oddjob.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.if serefpolicy-3.8.7/policy/modules/services/oddjob.if
--- nsaserefpolicy/policy/modules/services/oddjob.if 2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/oddjob.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/oddjob.if 2010-07-14 14:08:02.000000000 -0400
@@ -44,6 +44,7 @@
')
@@ -17828,9 +17578,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-3.8.6/policy/modules/services/oddjob.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-3.8.7/policy/modules/services/oddjob.te
--- nsaserefpolicy/policy/modules/services/oddjob.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/oddjob.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/oddjob.te 2010-07-14 14:08:02.000000000 -0400
@@ -99,8 +99,7 @@
# Add/remove user home directories
@@ -17842,9 +17592,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj
+userdom_manage_user_home_content_dirs(oddjob_mkhomedir_t)
+userdom_manage_user_home_content(oddjob_mkhomedir_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oident.te serefpolicy-3.8.6/policy/modules/services/oident.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oident.te serefpolicy-3.8.7/policy/modules/services/oident.te
--- nsaserefpolicy/policy/modules/services/oident.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/oident.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/oident.te 2010-07-14 14:08:02.000000000 -0400
@@ -48,6 +48,7 @@
kernel_read_network_state(oidentd_t)
kernel_read_network_state_symlinks(oidentd_t)
@@ -17853,9 +17603,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oide
logging_send_syslog_msg(oidentd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.8.6/policy/modules/services/openvpn.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.8.7/policy/modules/services/openvpn.te
--- nsaserefpolicy/policy/modules/services/openvpn.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/openvpn.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/openvpn.te 2010-07-14 14:08:02.000000000 -0400
@@ -24,6 +24,9 @@
type openvpn_etc_rw_t;
files_config_file(openvpn_etc_rw_t)
@@ -17884,9 +17634,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
tunable_policy(`openvpn_enable_homedirs',`
userdom_read_user_home_content_files(openvpn_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.8.6/policy/modules/services/pegasus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.8.7/policy/modules/services/pegasus.te
--- nsaserefpolicy/policy/modules/services/pegasus.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/pegasus.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/pegasus.te 2010-07-14 14:08:02.000000000 -0400
@@ -29,7 +29,7 @@
# Local policy
#
@@ -17958,9 +17708,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
+ xen_stream_connect(pegasus_t)
+ xen_stream_connect_xenstore(pegasus_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/piranha.fc serefpolicy-3.8.6/policy/modules/services/piranha.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/piranha.fc serefpolicy-3.8.7/policy/modules/services/piranha.fc
--- nsaserefpolicy/policy/modules/services/piranha.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/piranha.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/piranha.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,21 @@
+
+/etc/rc\.d/init\.d/pulse -- gen_context(system_u:object_r:piranha_pulse_initrc_exec_t,s0)
@@ -17983,9 +17733,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pira
+/var/run/pulse\.pid -- gen_context(system_u:object_r:piranha_pulse_var_run_t,s0)
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/piranha.if serefpolicy-3.8.6/policy/modules/services/piranha.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/piranha.if serefpolicy-3.8.7/policy/modules/services/piranha.if
--- nsaserefpolicy/policy/modules/services/piranha.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/piranha.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/piranha.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,175 @@
+
+## <summary>policy for piranha</summary>
@@ -18162,9 +17912,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pira
+ manage_files_pattern($1, piranha_log_t, piranha_log_t)
+ manage_lnk_files_pattern($1, piranha_log_t, piranha_log_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/piranha.te serefpolicy-3.8.6/policy/modules/services/piranha.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/piranha.te serefpolicy-3.8.7/policy/modules/services/piranha.te
--- nsaserefpolicy/policy/modules/services/piranha.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/piranha.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/piranha.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,188 @@
+policy_module(piranha,1.0.0)
+
@@ -18354,9 +18104,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pira
+miscfiles_read_localization(piranha_domain)
+
+sysnet_read_config(piranha_domain)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouthd.te serefpolicy-3.8.6/policy/modules/services/plymouthd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouthd.te serefpolicy-3.8.7/policy/modules/services/plymouthd.te
--- nsaserefpolicy/policy/modules/services/plymouthd.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/plymouthd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/plymouthd.te 2010-07-14 14:08:02.000000000 -0400
@@ -60,10 +60,14 @@
files_read_etc_files(plymouthd_t)
files_read_usr_files(plymouthd_t)
@@ -18380,9 +18130,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plym
domain_use_interactive_fds(plymouth_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.fc serefpolicy-3.8.6/policy/modules/services/policykit.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.fc serefpolicy-3.8.7/policy/modules/services/policykit.fc
--- nsaserefpolicy/policy/modules/services/policykit.fc 2009-08-18 11:41:14.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/policykit.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/policykit.fc 2010-07-14 14:08:02.000000000 -0400
@@ -6,10 +6,13 @@
/usr/libexec/polkit-read-auth-helper -- gen_context(system_u:object_r:policykit_auth_exec_t,s0)
/usr/libexec/polkit-grant-helper.* -- gen_context(system_u:object_r:policykit_grant_exec_t,s0)
@@ -18398,9 +18148,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/poli
/var/lib/PolicyKit-public(/.*)? gen_context(system_u:object_r:policykit_var_lib_t,s0)
/var/run/PolicyKit(/.*)? gen_context(system_u:object_r:policykit_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.if serefpolicy-3.8.6/policy/modules/services/policykit.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.if serefpolicy-3.8.7/policy/modules/services/policykit.if
--- nsaserefpolicy/policy/modules/services/policykit.if 2009-08-18 18:39:50.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/policykit.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/policykit.if 2010-07-14 14:08:02.000000000 -0400
@@ -17,12 +17,37 @@
class dbus send_msg;
')
@@ -18497,9 +18247,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/poli
+
+ allow $1 policykit_auth_t:process signal;
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.8.6/policy/modules/services/policykit.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.8.7/policy/modules/services/policykit.te
--- nsaserefpolicy/policy/modules/services/policykit.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/policykit.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/policykit.te 2010-07-14 14:08:02.000000000 -0400
@@ -24,6 +24,9 @@
type policykit_reload_t alias polkit_reload_t;
files_type(policykit_reload_t)
@@ -18682,9 +18432,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/poli
allow policykit_resolve_t self:unix_dgram_socket create_socket_perms;
allow policykit_resolve_t self:unix_stream_socket create_stream_socket_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portreserve.fc serefpolicy-3.8.6/policy/modules/services/portreserve.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portreserve.fc serefpolicy-3.8.7/policy/modules/services/portreserve.fc
--- nsaserefpolicy/policy/modules/services/portreserve.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/portreserve.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/portreserve.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,3 +1,6 @@
+
+/etc/rc\.d/init\.d/portreserve -- gen_context(system_u:object_r:portreserve_initrc_exec_t,s0)
@@ -18692,9 +18442,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port
/etc/portreserve(/.*)? gen_context(system_u:object_r:portreserve_etc_t,s0)
/sbin/portreserve -- gen_context(system_u:object_r:portreserve_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portreserve.if serefpolicy-3.8.6/policy/modules/services/portreserve.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portreserve.if serefpolicy-3.8.7/policy/modules/services/portreserve.if
--- nsaserefpolicy/policy/modules/services/portreserve.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/portreserve.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/portreserve.if 2010-07-14 14:08:02.000000000 -0400
@@ -18,6 +18,24 @@
domtrans_pattern($1, portreserve_exec_t, portreserve_t)
')
@@ -18761,9 +18511,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port
+ files_search_pids($1)
+ admin_pattern($1, portreserve_var_run_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portreserve.te serefpolicy-3.8.6/policy/modules/services/portreserve.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portreserve.te serefpolicy-3.8.7/policy/modules/services/portreserve.te
--- nsaserefpolicy/policy/modules/services/portreserve.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/portreserve.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/portreserve.te 2010-07-14 14:08:02.000000000 -0400
@@ -9,6 +9,9 @@
type portreserve_exec_t;
init_daemon_domain(portreserve_t, portreserve_exec_t)
@@ -18780,9 +18530,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port
files_read_etc_files(portreserve_t)
+
+userdom_dontaudit_search_user_home_content(portreserve_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.8.6/policy/modules/services/postfix.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.8.7/policy/modules/services/postfix.fc
--- nsaserefpolicy/policy/modules/services/postfix.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/postfix.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/postfix.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,4 +1,5 @@
# postfix
+/etc/rc\.d/init\.d/postfix -- gen_context(system_u:object_r:postfix_initrc_exec_t,s0)
@@ -18802,9 +18552,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
/usr/sbin/postdrop -- gen_context(system_u:object_r:postfix_postdrop_exec_t,s0)
/usr/sbin/postfix -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
/usr/sbin/postkick -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.8.6/policy/modules/services/postfix.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.8.7/policy/modules/services/postfix.if
--- nsaserefpolicy/policy/modules/services/postfix.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/postfix.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/postfix.if 2010-07-14 14:08:02.000000000 -0400
@@ -376,6 +376,25 @@
domtrans_pattern($1, postfix_master_exec_t, postfix_master_t)
')
@@ -19013,9 +18763,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+ role $2 types postfix_postdrop_t;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.8.6/policy/modules/services/postfix.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.8.7/policy/modules/services/postfix.te
--- nsaserefpolicy/policy/modules/services/postfix.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/postfix.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/postfix.te 2010-07-14 14:08:02.000000000 -0400
@@ -5,6 +5,15 @@
# Declarations
#
@@ -19165,9 +18915,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+userdom_manage_user_home_content(postfix_virtual_t)
+userdom_home_filetrans_user_home_dir(postfix_virtual_t)
+userdom_user_home_dir_filetrans_user_home_content(postfix_virtual_t, {file dir })
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.8.6/policy/modules/services/ppp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.8.7/policy/modules/services/ppp.te
--- nsaserefpolicy/policy/modules/services/ppp.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ppp.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ppp.te 2010-07-14 14:08:02.000000000 -0400
@@ -70,7 +70,7 @@
# PPPD Local policy
#
@@ -19186,18 +18936,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.fc serefpolicy-3.8.6/policy/modules/services/procmail.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.fc serefpolicy-3.8.7/policy/modules/services/procmail.fc
--- nsaserefpolicy/policy/modules/services/procmail.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/procmail.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/procmail.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,3 +1,5 @@
+HOME_DIR/\.procmailrc -- gen_context(system_u:object_r:procmail_home_t, s0)
+/root/\.procmailrc -- gen_context(system_u:object_r:procmail_home_t, s0)
/usr/bin/procmail -- gen_context(system_u:object_r:procmail_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.8.6/policy/modules/services/procmail.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.8.7/policy/modules/services/procmail.te
--- nsaserefpolicy/policy/modules/services/procmail.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/procmail.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/procmail.te 2010-07-14 14:08:02.000000000 -0400
@@ -10,6 +10,9 @@
application_domain(procmail_t, procmail_exec_t)
role system_r types procmail_t;
@@ -19246,9 +18996,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc
pyzor_domtrans(procmail_t)
pyzor_signal(procmail_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/psad.if serefpolicy-3.8.6/policy/modules/services/psad.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/psad.if serefpolicy-3.8.7/policy/modules/services/psad.if
--- nsaserefpolicy/policy/modules/services/psad.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/psad.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/psad.if 2010-07-14 14:08:02.000000000 -0400
@@ -176,6 +176,26 @@
########################################
@@ -19285,9 +19035,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/psad
')
allow $1 psad_t:process { ptrace signal_perms };
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/psad.te serefpolicy-3.8.6/policy/modules/services/psad.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/psad.te serefpolicy-3.8.7/policy/modules/services/psad.te
--- nsaserefpolicy/policy/modules/services/psad.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/psad.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/psad.te 2010-07-14 14:08:02.000000000 -0400
@@ -85,6 +85,7 @@
dev_read_urand(psad_t)
@@ -19296,9 +19046,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/psad
fs_getattr_all_fs(psad_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/puppet.te serefpolicy-3.8.6/policy/modules/services/puppet.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/puppet.te serefpolicy-3.8.7/policy/modules/services/puppet.te
--- nsaserefpolicy/policy/modules/services/puppet.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/puppet.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/puppet.te 2010-07-14 14:08:02.000000000 -0400
@@ -221,6 +221,8 @@
sysnet_dns_name_resolve(puppetmaster_t)
sysnet_run_ifconfig(puppetmaster_t, system_r)
@@ -19308,9 +19058,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pupp
optional_policy(`
hostname_exec(puppetmaster_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.fc serefpolicy-3.8.6/policy/modules/services/pyzor.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.fc serefpolicy-3.8.7/policy/modules/services/pyzor.fc
--- nsaserefpolicy/policy/modules/services/pyzor.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/pyzor.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/pyzor.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,6 +1,10 @@
/etc/pyzor(/.*)? gen_context(system_u:object_r:pyzor_etc_t, s0)
+/etc/rc\.d/init\.d/pyzord -- gen_context(system_u:object_r:pyzord_initrc_exec_t,s0)
@@ -19322,9 +19072,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
/usr/bin/pyzor -- gen_context(system_u:object_r:pyzor_exec_t,s0)
/usr/bin/pyzord -- gen_context(system_u:object_r:pyzord_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.8.6/policy/modules/services/pyzor.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.8.7/policy/modules/services/pyzor.if
--- nsaserefpolicy/policy/modules/services/pyzor.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/pyzor.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/pyzor.if 2010-07-14 14:08:02.000000000 -0400
@@ -88,3 +88,50 @@
corecmd_search_bin($1)
can_exec($1, pyzor_exec_t)
@@ -19376,9 +19126,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.8.6/policy/modules/services/pyzor.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.8.7/policy/modules/services/pyzor.te
--- nsaserefpolicy/policy/modules/services/pyzor.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/pyzor.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/pyzor.te 2010-07-14 14:08:02.000000000 -0400
@@ -5,6 +5,38 @@
# Declarations
#
@@ -19443,9 +19193,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
userdom_dontaudit_search_user_home_dirs(pyzor_t)
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpidd.fc serefpolicy-3.8.6/policy/modules/services/qpidd.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpidd.fc serefpolicy-3.8.7/policy/modules/services/qpidd.fc
--- nsaserefpolicy/policy/modules/services/qpidd.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/qpidd.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/qpidd.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,9 @@
+
+/usr/sbin/qpidd -- gen_context(system_u:object_r:qpidd_exec_t,s0)
@@ -19456,9 +19206,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpid
+
+/var/run/qpidd(/.*)? gen_context(system_u:object_r:qpidd_var_run_t,s0)
+/var/run/qpidd\.pid gen_context(system_u:object_r:qpidd_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpidd.if serefpolicy-3.8.6/policy/modules/services/qpidd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpidd.if serefpolicy-3.8.7/policy/modules/services/qpidd.if
--- nsaserefpolicy/policy/modules/services/qpidd.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/qpidd.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/qpidd.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,236 @@
+
+## <summary>policy for qpidd</summary>
@@ -19696,9 +19446,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpid
+
+ allow $1 qpidd_t:shm rw_shm_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpidd.te serefpolicy-3.8.6/policy/modules/services/qpidd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpidd.te serefpolicy-3.8.7/policy/modules/services/qpidd.te
--- nsaserefpolicy/policy/modules/services/qpidd.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/qpidd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/qpidd.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,59 @@
+policy_module(qpidd,1.0.0)
+
@@ -19759,9 +19509,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpid
+miscfiles_read_localization(qpidd_t)
+
+sysnet_dns_name_resolve(qpidd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.8.6/policy/modules/services/radius.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.8.7/policy/modules/services/radius.te
--- nsaserefpolicy/policy/modules/services/radius.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/radius.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/radius.te 2010-07-14 14:08:02.000000000 -0400
@@ -36,7 +36,7 @@
# gzip also needs chown access to preserve GID for radwtmp files
allow radiusd_t self:capability { chown dac_override fsetid kill setgid setuid sys_resource sys_tty_config };
@@ -19771,17 +19521,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi
allow radiusd_t self:fifo_file rw_fifo_file_perms;
allow radiusd_t self:unix_stream_socket create_stream_socket_perms;
allow radiusd_t self:tcp_socket create_stream_socket_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.fc serefpolicy-3.8.6/policy/modules/services/razor.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.fc serefpolicy-3.8.7/policy/modules/services/razor.fc
--- nsaserefpolicy/policy/modules/services/razor.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/razor.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/razor.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,3 +1,4 @@
+/root/\.razor(/.*)? gen_context(system_u:object_r:razor_home_t,s0)
HOME_DIR/\.razor(/.*)? gen_context(system_u:object_r:razor_home_t,s0)
/etc/razor(/.*)? gen_context(system_u:object_r:razor_etc_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.if serefpolicy-3.8.6/policy/modules/services/razor.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.if serefpolicy-3.8.7/policy/modules/services/razor.if
--- nsaserefpolicy/policy/modules/services/razor.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/razor.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/razor.if 2010-07-14 14:08:02.000000000 -0400
@@ -157,3 +157,45 @@
domtrans_pattern($1, razor_exec_t, razor_t)
@@ -19828,9 +19578,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razo
+ read_files_pattern($1, razor_var_lib_t, razor_var_lib_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.te serefpolicy-3.8.6/policy/modules/services/razor.te
---- nsaserefpolicy/policy/modules/services/razor.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/razor.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.te serefpolicy-3.8.7/policy/modules/services/razor.te
+--- nsaserefpolicy/policy/modules/services/razor.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/razor.te 2010-07-14 14:08:02.000000000 -0400
@@ -5,6 +5,32 @@
# Declarations
#
@@ -19864,7 +19614,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razo
type razor_exec_t;
corecmd_executable_file(razor_exec_t)
-@@ -101,6 +127,8 @@
+@@ -14,6 +40,7 @@
+ type razor_home_t;
+ typealias razor_home_t alias { user_razor_home_t staff_razor_home_t sysadm_razor_home_t };
+ typealias razor_home_t alias { auditadm_razor_home_t secadm_razor_home_t };
++files_poly_member(razor_home_t)
+ userdom_user_home_content(razor_home_t)
+
+ type razor_log_t;
+@@ -100,6 +127,8 @@
manage_files_pattern(razor_t, razor_tmp_t, razor_tmp_t)
files_tmp_filetrans(razor_t, razor_tmp_t, { file dir })
@@ -19873,7 +19631,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razo
logging_send_syslog_msg(razor_t)
userdom_search_user_home_dirs(razor_t)
-@@ -119,5 +147,7 @@
+@@ -118,5 +147,7 @@
')
optional_policy(`
@@ -19882,18 +19640,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razo
+')
+
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.fc serefpolicy-3.8.6/policy/modules/services/rgmanager.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.fc serefpolicy-3.8.7/policy/modules/services/rgmanager.fc
--- nsaserefpolicy/policy/modules/services/rgmanager.fc 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/rgmanager.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rgmanager.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,3 +1,5 @@
+/etc/rc\.d/init\.d/rgmanager -- gen_context(system_u:object_r:rgmanager_initrc_exec_t,s0)
+
/usr/sbin/rgmanager -- gen_context(system_u:object_r:rgmanager_exec_t,s0)
/var/log/cluster/rgmanager\.log -- gen_context(system_u:object_r:rgmanager_var_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.if serefpolicy-3.8.6/policy/modules/services/rgmanager.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.if serefpolicy-3.8.7/policy/modules/services/rgmanager.if
--- nsaserefpolicy/policy/modules/services/rgmanager.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/rgmanager.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rgmanager.if 2010-07-14 14:08:02.000000000 -0400
@@ -75,3 +75,64 @@
fs_search_tmpfs($1)
manage_files_pattern($1, rgmanager_tmpfs_t, rgmanager_tmpfs_t)
@@ -19959,9 +19717,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgma
+ files_search_pids($1)
+ admin_pattern($1, rgmanager_var_run_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.te serefpolicy-3.8.6/policy/modules/services/rgmanager.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.te serefpolicy-3.8.7/policy/modules/services/rgmanager.te
--- nsaserefpolicy/policy/modules/services/rgmanager.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/rgmanager.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rgmanager.te 2010-07-14 14:08:02.000000000 -0400
@@ -17,6 +17,9 @@
domain_type(rgmanager_t)
init_daemon_domain(rgmanager_t, rgmanager_exec_t)
@@ -20015,9 +19773,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgma
mysql_domtrans_mysql_safe(rgmanager_t)
mysql_stream_connect(rgmanager_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs.if serefpolicy-3.8.6/policy/modules/services/rhcs.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs.if serefpolicy-3.8.7/policy/modules/services/rhcs.if
--- nsaserefpolicy/policy/modules/services/rhcs.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/rhcs.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rhcs.if 2010-07-14 14:08:02.000000000 -0400
@@ -14,6 +14,8 @@
template(`rhcs_domain_template',`
gen_require(`
@@ -20133,9 +19891,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs
+
+ allow $1 qdiskd_tmpfs_t:file read_file_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs.te serefpolicy-3.8.6/policy/modules/services/rhcs.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs.te serefpolicy-3.8.7/policy/modules/services/rhcs.te
--- nsaserefpolicy/policy/modules/services/rhcs.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/rhcs.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rhcs.te 2010-07-14 14:08:02.000000000 -0400
@@ -13,6 +13,8 @@
gen_tunable(fenced_can_network_connect, false)
@@ -20224,9 +19982,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs
+optional_policy(`
corosync_stream_connect(cluster_domain)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.fc serefpolicy-3.8.6/policy/modules/services/ricci.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.fc serefpolicy-3.8.7/policy/modules/services/ricci.fc
--- nsaserefpolicy/policy/modules/services/ricci.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ricci.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ricci.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,3 +1,6 @@
+
+/etc/rc\.d/init\.d/ricci -- gen_context(system_u:object_r:ricci_initrc_exec_t,s0)
@@ -20234,9 +19992,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc
/usr/libexec/modcluster -- gen_context(system_u:object_r:ricci_modcluster_exec_t,s0)
/usr/libexec/ricci-modlog -- gen_context(system_u:object_r:ricci_modlog_exec_t,s0)
/usr/libexec/ricci-modrpm -- gen_context(system_u:object_r:ricci_modrpm_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.if serefpolicy-3.8.6/policy/modules/services/ricci.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.if serefpolicy-3.8.7/policy/modules/services/ricci.if
--- nsaserefpolicy/policy/modules/services/ricci.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ricci.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ricci.if 2010-07-14 14:08:02.000000000 -0400
@@ -18,6 +18,24 @@
domtrans_pattern($1, ricci_exec_t, ricci_t)
')
@@ -20310,9 +20068,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc
+ files_search_pids($1)
+ admin_pattern($1, ricci_var_run_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.8.6/policy/modules/services/ricci.te
---- nsaserefpolicy/policy/modules/services/ricci.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ricci.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.8.7/policy/modules/services/ricci.te
+--- nsaserefpolicy/policy/modules/services/ricci.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ricci.te 2010-07-14 14:08:02.000000000 -0400
@@ -10,6 +10,9 @@
domain_type(ricci_t)
init_daemon_domain(ricci_t, ricci_exec_t)
@@ -20323,7 +20081,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc
type ricci_tmp_t;
files_tmp_file(ricci_tmp_t)
-@@ -448,6 +451,12 @@
+@@ -241,6 +244,10 @@
+ ')
+
+ optional_policy(`
++ rgmanager_stream_connect(ricci_modclusterd_t)
++')
++
++optional_policy(`
+ # XXX This has got to go.
+ unconfined_domain(ricci_modcluster_t)
+ ')
+@@ -444,6 +451,12 @@
files_read_usr_files(ricci_modstorage_t)
files_read_kernel_modules(ricci_modstorage_t)
@@ -20336,9 +20105,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc
storage_raw_read_fixed_disk(ricci_modstorage_t)
term_dontaudit_use_console(ricci_modstorage_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.fc serefpolicy-3.8.6/policy/modules/services/rlogin.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.fc serefpolicy-3.8.7/policy/modules/services/rlogin.fc
--- nsaserefpolicy/policy/modules/services/rlogin.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/rlogin.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rlogin.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,4 +1,7 @@
HOME_DIR/\.rlogin -- gen_context(system_u:object_r:rlogind_home_t,s0)
+HOME_DIR/\.rhosts -- gen_context(system_u:object_r:rlogind_home_t,s0)
@@ -20347,9 +20116,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog
/usr/kerberos/sbin/klogind -- gen_context(system_u:object_r:rlogind_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.8.6/policy/modules/services/rlogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.8.7/policy/modules/services/rlogin.te
--- nsaserefpolicy/policy/modules/services/rlogin.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/rlogin.te 2010-07-12 16:36:38.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rlogin.te 2010-07-14 14:08:02.000000000 -0400
@@ -43,7 +43,6 @@
manage_dirs_pattern(rlogind_t, rlogind_tmp_t, rlogind_tmp_t)
@@ -20368,9 +20137,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog
remotelogin_domtrans(rlogind_t)
remotelogin_signal(rlogind_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-3.8.6/policy/modules/services/rpcbind.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-3.8.7/policy/modules/services/rpcbind.if
--- nsaserefpolicy/policy/modules/services/rpcbind.if 2009-12-18 11:38:25.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/rpcbind.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rpcbind.if 2010-07-14 14:08:02.000000000 -0400
@@ -141,7 +141,7 @@
allow $1 rpcbind_t:process { ptrace signal_perms };
ps_process_pattern($1, rpcbind_t)
@@ -20380,9 +20149,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
domain_system_change_exemption($1)
role_transition $2 rpcbind_initrc_exec_t system_r;
allow $2 system_r;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.8.6/policy/modules/services/rpcbind.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.8.7/policy/modules/services/rpcbind.te
--- nsaserefpolicy/policy/modules/services/rpcbind.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/rpcbind.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rpcbind.te 2010-07-14 14:08:02.000000000 -0400
@@ -71,3 +71,7 @@
ifdef(`hide_broken_symptoms',`
dontaudit rpcbind_t self:udp_socket listen;
@@ -20391,9 +20160,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
+optional_policy(`
+ nis_use_ypbind(rpcbind_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.8.6/policy/modules/services/rpc.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.8.7/policy/modules/services/rpc.if
--- nsaserefpolicy/policy/modules/services/rpc.if 2010-04-06 15:15:38.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/rpc.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rpc.if 2010-07-14 14:08:02.000000000 -0400
@@ -246,6 +246,26 @@
allow rpcd_t $1:process signal;
')
@@ -20427,9 +20196,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
manage_files_pattern($1, var_lib_nfs_t, var_lib_nfs_t)
+ allow $1 var_lib_nfs_t:file { relabelfrom relabelto };
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.8.6/policy/modules/services/rpc.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.8.7/policy/modules/services/rpc.te
--- nsaserefpolicy/policy/modules/services/rpc.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/rpc.te 2010-07-12 16:35:33.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rpc.te 2010-07-14 14:08:02.000000000 -0400
@@ -97,15 +97,26 @@
seutil_dontaudit_search_config(rpcd_t)
@@ -20482,9 +20251,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.8.6/policy/modules/services/rshd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.8.7/policy/modules/services/rshd.te
--- nsaserefpolicy/policy/modules/services/rshd.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/rshd.te 2010-07-12 16:18:22.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rshd.te 2010-07-14 14:08:02.000000000 -0400
@@ -66,6 +66,7 @@
seutil_read_default_contexts(rshd_t)
@@ -20493,9 +20262,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd
tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(rshd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.if serefpolicy-3.8.6/policy/modules/services/rsync.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.if serefpolicy-3.8.7/policy/modules/services/rsync.if
--- nsaserefpolicy/policy/modules/services/rsync.if 2010-02-12 10:33:09.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/rsync.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rsync.if 2010-07-14 14:08:02.000000000 -0400
@@ -119,7 +119,7 @@
type rsync_etc_t;
')
@@ -20556,9 +20325,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn
+
+ files_etc_filetrans($1, rsync_etc_t, $2)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.8.6/policy/modules/services/rsync.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.8.7/policy/modules/services/rsync.te
--- nsaserefpolicy/policy/modules/services/rsync.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/rsync.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rsync.te 2010-07-14 14:08:02.000000000 -0400
@@ -7,6 +7,13 @@
## <desc>
@@ -20618,9 +20387,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn
+')
+
auth_can_read_shadow_passwords(rsync_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtkit.if serefpolicy-3.8.6/policy/modules/services/rtkit.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtkit.if serefpolicy-3.8.7/policy/modules/services/rtkit.if
--- nsaserefpolicy/policy/modules/services/rtkit.if 2010-03-23 10:55:15.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/rtkit.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/rtkit.if 2010-07-14 14:08:02.000000000 -0400
@@ -41,6 +41,27 @@
########################################
@@ -20649,9 +20418,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtki
## Allow rtkit to control scheduling for your process
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.8.6/policy/modules/services/samba.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.8.7/policy/modules/services/samba.fc
--- nsaserefpolicy/policy/modules/services/samba.fc 2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/samba.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/samba.fc 2010-07-14 14:08:02.000000000 -0400
@@ -51,3 +51,7 @@
/var/run/winbindd(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0)
@@ -20660,9 +20429,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
+ifndef(`enable_mls',`
+/var/lib/samba/scripts(/.*)? gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.8.6/policy/modules/services/samba.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.8.7/policy/modules/services/samba.if
--- nsaserefpolicy/policy/modules/services/samba.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/samba.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/samba.if 2010-07-14 14:08:02.000000000 -0400
@@ -79,6 +79,25 @@
########################################
@@ -20837,9 +20606,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
admin_pattern($1, winbind_var_run_t)
+ admin_pattern($1, samba_unconfined_script_exec_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.8.6/policy/modules/services/samba.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.8.7/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/samba.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/samba.te 2010-07-14 14:08:02.000000000 -0400
@@ -152,9 +152,6 @@
type winbind_log_t;
logging_log_file(winbind_log_t)
@@ -20972,9 +20741,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
+',`
+ can_exec(smbd_t, samba_unconfined_script_exec_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.8.6/policy/modules/services/sasl.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.8.7/policy/modules/services/sasl.te
--- nsaserefpolicy/policy/modules/services/sasl.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/sasl.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/sasl.te 2010-07-14 14:08:02.000000000 -0400
@@ -49,6 +49,9 @@
kernel_read_kernel_sysctls(saslauthd_t)
kernel_read_system_state(saslauthd_t)
@@ -20985,9 +20754,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl
corenet_all_recvfrom_unlabeled(saslauthd_t)
corenet_all_recvfrom_netlabel(saslauthd_t)
corenet_tcp_sendrecv_generic_if(saslauthd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.fc serefpolicy-3.8.6/policy/modules/services/sendmail.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.fc serefpolicy-3.8.7/policy/modules/services/sendmail.fc
--- nsaserefpolicy/policy/modules/services/sendmail.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/sendmail.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/sendmail.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,4 +1,6 @@
+/etc/rc\.d/init\.d/sendmail -- gen_context(system_u:object_r:sendmail_initrc_exec_t,s0)
@@ -20995,9 +20764,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
/var/log/sendmail\.st -- gen_context(system_u:object_r:sendmail_log_t,s0)
/var/log/mail(/.*)? gen_context(system_u:object_r:sendmail_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.8.6/policy/modules/services/sendmail.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.8.7/policy/modules/services/sendmail.if
--- nsaserefpolicy/policy/modules/services/sendmail.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/sendmail.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/sendmail.if 2010-07-14 14:08:02.000000000 -0400
@@ -57,6 +57,24 @@
allow sendmail_t $1:process sigchld;
')
@@ -21074,9 +20843,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
+ files_search_spool($1)
+ admin_pattern($1, mail_spool_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.8.6/policy/modules/services/sendmail.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.8.7/policy/modules/services/sendmail.te
--- nsaserefpolicy/policy/modules/services/sendmail.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/sendmail.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/sendmail.te 2010-07-14 14:08:02.000000000 -0400
@@ -19,6 +19,9 @@
mta_mailserver_delivery(sendmail_t)
mta_mailserver_sender(sendmail_t)
@@ -21139,9 +20908,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
- unconfined_domain(unconfined_sendmail_t)
+ unconfined_domain_noaudit(unconfined_sendmail_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.8.6/policy/modules/services/setroubleshoot.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.8.7/policy/modules/services/setroubleshoot.if
--- nsaserefpolicy/policy/modules/services/setroubleshoot.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/setroubleshoot.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/setroubleshoot.if 2010-07-14 14:08:02.000000000 -0400
@@ -105,6 +105,25 @@
########################################
@@ -21186,9 +20955,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr
files_list_var_lib($1)
admin_pattern($1, setroubleshoot_var_lib_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.8.6/policy/modules/services/setroubleshoot.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.8.7/policy/modules/services/setroubleshoot.te
--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/setroubleshoot.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/setroubleshoot.te 2010-07-14 14:08:02.000000000 -0400
@@ -32,6 +32,8 @@
allow setroubleshootd_t self:capability { dac_override sys_nice sys_tty_config };
@@ -21240,9 +21009,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr
optional_policy(`
rpm_signull(setroubleshoot_fixit_t)
rpm_read_db(setroubleshoot_fixit_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.8.6/policy/modules/services/smartmon.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.8.7/policy/modules/services/smartmon.te
--- nsaserefpolicy/policy/modules/services/smartmon.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/smartmon.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/smartmon.te 2010-07-14 14:08:02.000000000 -0400
@@ -82,6 +82,8 @@
storage_raw_read_fixed_disk(fsdaemon_t)
storage_raw_write_fixed_disk(fsdaemon_t)
@@ -21252,9 +21021,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar
term_dontaudit_search_ptys(fsdaemon_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smokeping.te serefpolicy-3.8.6/policy/modules/services/smokeping.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smokeping.te serefpolicy-3.8.7/policy/modules/services/smokeping.te
--- nsaserefpolicy/policy/modules/services/smokeping.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/smokeping.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/smokeping.te 2010-07-14 14:08:02.000000000 -0400
@@ -23,6 +23,7 @@
# smokeping local policy
#
@@ -21271,9 +21040,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smok
logging_send_syslog_msg(smokeping_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.8.6/policy/modules/services/snmp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.8.7/policy/modules/services/snmp.fc
+--- nsaserefpolicy/policy/modules/services/snmp.fc 2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/snmp.fc 2010-07-14 14:08:02.000000000 -0400
+@@ -18,7 +18,7 @@
+
+ /var/log/snmpd\.log -- gen_context(system_u:object_r:snmpd_log_t,s0)
+
+-/var/net-snmp(/.*) gen_context(system_u:object_r:snmpd_var_lib_t,s0)
++/var/net-snmp(/.*)? gen_context(system_u:object_r:snmpd_var_lib_t,s0)
+
+ /var/run/snmpd(/.*)? gen_context(system_u:object_r:snmpd_var_run_t,s0)
+ /var/run/snmpd\.pid -- gen_context(system_u:object_r:snmpd_var_run_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.8.7/policy/modules/services/snmp.te
--- nsaserefpolicy/policy/modules/services/snmp.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/snmp.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/snmp.te 2010-07-14 14:08:02.000000000 -0400
@@ -24,7 +24,7 @@
#
# Local policy
@@ -21291,9 +21072,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp
auth_use_nsswitch(snmpd_t)
auth_read_all_dirs_except_shadow(snmpd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snort.te serefpolicy-3.8.6/policy/modules/services/snort.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snort.te serefpolicy-3.8.7/policy/modules/services/snort.te
--- nsaserefpolicy/policy/modules/services/snort.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/snort.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/snort.te 2010-07-14 14:08:02.000000000 -0400
@@ -61,6 +61,7 @@
kernel_read_proc_symlinks(snort_t)
kernel_request_load_module(snort_t)
@@ -21310,9 +21091,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snor
# Red Hat bug 559861: Snort wants read, write, and ioctl on /dev/usbmon
# Snort uses libpcap, which can also monitor USB traffic. Maybe this is a side effect?
dev_rw_generic_usb_dev(snort_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.8.6/policy/modules/services/spamassassin.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.8.7/policy/modules/services/spamassassin.fc
--- nsaserefpolicy/policy/modules/services/spamassassin.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/spamassassin.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/spamassassin.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,15 +1,26 @@
-HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:spamassassin_home_t,s0)
+HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:spamc_home_t,s0)
@@ -21342,9 +21123,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
/var/spool/spamd(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0)
+/var/spool/MD-Quarantine(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0)
+/var/spool/MIMEDefang(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.8.6/policy/modules/services/spamassassin.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.8.7/policy/modules/services/spamassassin.if
--- nsaserefpolicy/policy/modules/services/spamassassin.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/spamassassin.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/spamassassin.if 2010-07-14 14:08:02.000000000 -0400
@@ -111,6 +111,45 @@
')
@@ -21471,9 +21252,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
+ files_list_pids($1)
+ admin_pattern($1, spamd_var_run_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.8.6/policy/modules/services/spamassassin.te
---- nsaserefpolicy/policy/modules/services/spamassassin.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/spamassassin.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.8.7/policy/modules/services/spamassassin.te
+--- nsaserefpolicy/policy/modules/services/spamassassin.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/spamassassin.te 2010-07-14 14:08:02.000000000 -0400
@@ -19,6 +19,35 @@
## </desc>
gen_tunable(spamd_enable_home_dirs, true)
@@ -21510,7 +21291,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
type spamassassin_t;
type spamassassin_exec_t;
typealias spamassassin_t alias { user_spamassassin_t staff_spamassassin_t sysadm_spamassassin_t };
-@@ -50,10 +79,21 @@
+@@ -30,6 +59,7 @@
+ typealias spamassassin_home_t alias { user_spamassassin_home_t staff_spamassassin_home_t sysadm_spamassassin_home_t };
+ typealias spamassassin_home_t alias { auditadm_spamassassin_home_t secadm_spamassassin_home_t };
+ userdom_user_home_content(spamassassin_home_t)
++files_poly_member(spamassassin_home_t)
+
+ type spamassassin_tmp_t;
+ typealias spamassassin_tmp_t alias { user_spamassassin_tmp_t staff_spamassassin_tmp_t sysadm_spamassassin_tmp_t };
+@@ -49,10 +79,21 @@
typealias spamc_tmp_t alias { auditadm_spamc_tmp_t secadm_spamc_tmp_t };
files_tmp_file(spamc_tmp_t)
ubac_constrained(spamc_tmp_t)
@@ -21532,7 +21321,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
type spamd_spool_t;
files_type(spamd_spool_t)
-@@ -109,6 +149,7 @@
+@@ -108,6 +149,7 @@
dev_read_urand(spamassassin_t)
fs_search_auto_mountpoints(spamassassin_t)
@@ -21540,7 +21329,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
# this should probably be removed
corecmd_list_bin(spamassassin_t)
-@@ -149,6 +190,9 @@
+@@ -148,6 +190,9 @@
corenet_udp_sendrecv_all_ports(spamassassin_t)
corenet_tcp_connect_all_ports(spamassassin_t)
corenet_sendrecv_all_client_packets(spamassassin_t)
@@ -21550,7 +21339,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
sysnet_read_config(spamassassin_t)
')
-@@ -185,6 +229,8 @@
+@@ -184,6 +229,8 @@
optional_policy(`
mta_read_config(spamassassin_t)
sendmail_stub(spamassassin_t)
@@ -21559,7 +21348,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
')
########################################
-@@ -206,16 +252,33 @@
+@@ -205,16 +252,33 @@
allow spamc_t self:unix_stream_socket connectto;
allow spamc_t self:tcp_socket create_stream_socket_perms;
allow spamc_t self:udp_socket create_socket_perms;
@@ -21593,7 +21382,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
corenet_all_recvfrom_unlabeled(spamc_t)
corenet_all_recvfrom_netlabel(spamc_t)
-@@ -245,9 +308,16 @@
+@@ -244,9 +308,16 @@
files_dontaudit_search_var(spamc_t)
# cjp: this may be removable:
files_list_home(spamc_t)
@@ -21610,7 +21399,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
miscfiles_read_localization(spamc_t)
# cjp: this should probably be removed:
-@@ -255,27 +325,40 @@
+@@ -254,27 +325,40 @@
sysnet_read_config(spamc_t)
@@ -21657,7 +21446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
')
########################################
-@@ -287,7 +370,7 @@
+@@ -286,7 +370,7 @@
# setuids to the user running spamc. Comment this if you are not
# using this ability.
@@ -21666,7 +21455,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
dontaudit spamd_t self:capability sys_tty_config;
allow spamd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow spamd_t self:fd use;
-@@ -303,10 +386,17 @@
+@@ -302,10 +386,17 @@
allow spamd_t self:unix_stream_socket connectto;
allow spamd_t self:tcp_socket create_stream_socket_perms;
allow spamd_t self:udp_socket create_socket_perms;
@@ -21685,7 +21474,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
files_spool_filetrans(spamd_t, spamd_spool_t, { file dir })
manage_dirs_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t)
-@@ -315,10 +405,12 @@
+@@ -314,10 +405,12 @@
# var/lib files for spamd
allow spamd_t spamd_var_lib_t:dir list_dir_perms;
@@ -21699,7 +21488,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
files_pid_filetrans(spamd_t, spamd_var_run_t, { dir file })
kernel_read_all_sysctls(spamd_t)
-@@ -368,22 +460,27 @@
+@@ -367,22 +460,27 @@
init_dontaudit_rw_utmp(spamd_t)
@@ -21731,7 +21520,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
fs_manage_cifs_files(spamd_t)
')
-@@ -400,34 +497,22 @@
+@@ -399,7 +497,9 @@
')
optional_policy(`
@@ -21741,16 +21530,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
dcc_stream_connect_dccifd(spamd_t)
')
- optional_policy(`
-- milter_manage_spamass_state(spamd_t)
--')
--
--optional_policy(`
-- corenet_tcp_connect_mysqld_port(spamd_t)
-- corenet_sendrecv_mysqld_client_packets(spamd_t)
--
- mysql_search_db(spamd_t)
- mysql_stream_connect(spamd_t)
+@@ -416,10 +516,6 @@
')
optional_policy(`
@@ -21761,14 +21541,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
postfix_read_config(spamd_t)
')
- optional_policy(`
-- corenet_tcp_connect_postgresql_port(spamd_t)
-- corenet_sendrecv_postgresql_client_packets(spamd_t)
--
- postgresql_stream_connect(spamd_t)
- ')
-
-@@ -438,6 +523,10 @@
+@@ -437,6 +533,10 @@
optional_policy(`
razor_domtrans(spamd_t)
@@ -21779,19 +21552,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
')
optional_policy(`
-@@ -450,5 +539,9 @@
- ')
-
- optional_policy(`
-+ milter_manage_spamass_state(spamd_t)
-+')
-+
-+optional_policy(`
- udev_read_db(spamd_t)
- ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.fc serefpolicy-3.8.6/policy/modules/services/ssh.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.fc serefpolicy-3.8.7/policy/modules/services/ssh.fc
--- nsaserefpolicy/policy/modules/services/ssh.fc 2010-01-18 15:04:31.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/ssh.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ssh.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,4 +1,9 @@
HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+HOME_DIR/\.shosts gen_context(system_u:object_r:ssh_home_t,s0)
@@ -21802,16 +21565,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
/etc/ssh/primes -- gen_context(system_u:object_r:sshd_key_t,s0)
/etc/ssh/ssh_host_key -- gen_context(system_u:object_r:sshd_key_t,s0)
-@@ -14,3 +19,6 @@
+@@ -14,3 +19,7 @@
/usr/sbin/sshd -- gen_context(system_u:object_r:sshd_exec_t,s0)
/var/run/sshd\.init\.pid -- gen_context(system_u:object_r:sshd_var_run_t,s0)
++/var/run/sshd\.pid -- gen_context(system_u:object_r:sshd_var_run_t,s0)
+
+/root/\.ssh(/.*)? gen_context(system_u:object_r:home_ssh_t,s0)
+/root/\.shosts gen_context(system_u:object_r:home_ssh_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.8.6/policy/modules/services/ssh.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.8.7/policy/modules/services/ssh.if
--- nsaserefpolicy/policy/modules/services/ssh.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ssh.if 2010-07-12 13:45:03.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ssh.if 2010-07-14 14:08:02.000000000 -0400
@@ -36,6 +36,7 @@
gen_require(`
attribute ssh_server;
@@ -21968,9 +21732,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
########################################
## <summary>
## Execute the ssh client in the caller domain.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.8.6/policy/modules/services/ssh.te
---- nsaserefpolicy/policy/modules/services/ssh.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ssh.te 2010-07-12 16:18:09.000000000 -0400
+@@ -735,3 +767,22 @@
+ files_search_tmp($1)
+ delete_files_pattern($1, sshd_tmp_t, sshd_tmp_t)
+ ')
++
++########################################
++## <summary>
++## Send a null signal to sshd processes.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`ssh_signull',`
++ gen_require(`
++ type sshd_t;
++ ')
++
++ allow $1 sshd_t:process signull;
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.8.7/policy/modules/services/ssh.te
+--- nsaserefpolicy/policy/modules/services/ssh.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ssh.te 2010-07-14 14:08:02.000000000 -0400
@@ -19,6 +19,13 @@
## </desc>
gen_tunable(ssh_sysadm_login, false)
@@ -22057,7 +21844,62 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
tunable_policy(`allow_ssh_keysign',`
domain_auto_trans(ssh_t, ssh_keysign_exec_t, ssh_keysign_t)
-@@ -281,44 +288,64 @@
+@@ -200,6 +207,54 @@
+ xserver_domtrans_xauth(ssh_t)
+ ')
+
++########################################
++#
++# ssh_keygen local policy
++#
++
++# ssh_keygen_t is the type of the ssh-keygen program when run at install time
++# and by sysadm_t
++
++dontaudit ssh_keygen_t self:capability sys_tty_config;
++allow ssh_keygen_t self:process { sigchld sigkill sigstop signull signal };
++
++allow ssh_keygen_t self:unix_stream_socket create_stream_socket_perms;
++
++allow ssh_keygen_t sshd_key_t:file manage_file_perms;
++files_etc_filetrans(ssh_keygen_t, sshd_key_t, file)
++
++kernel_read_kernel_sysctls(ssh_keygen_t)
++
++fs_search_auto_mountpoints(ssh_keygen_t)
++
++dev_read_sysfs(ssh_keygen_t)
++dev_read_urand(ssh_keygen_t)
++
++term_dontaudit_use_console(ssh_keygen_t)
++
++domain_use_interactive_fds(ssh_keygen_t)
++
++files_read_etc_files(ssh_keygen_t)
++
++init_use_fds(ssh_keygen_t)
++init_use_script_ptys(ssh_keygen_t)
++
++logging_send_syslog_msg(ssh_keygen_t)
++
++userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t)
++
++optional_policy(`
++ nscd_socket_use(ssh_keygen_t)
++')
++
++optional_policy(`
++ seutil_sigchld_newrole(ssh_keygen_t)
++')
++
++optional_policy(`
++ udev_read_db(ssh_keygen_t)
++')
++
+ ##############################
+ #
+ # ssh_keysign_t local policy
+@@ -233,44 +288,64 @@
allow sshd_t self:netlink_route_socket r_netlink_socket_perms;
allow sshd_t self:key { search link write };
@@ -22131,7 +21973,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
')
optional_policy(`
-@@ -332,6 +359,11 @@
+@@ -284,6 +359,11 @@
')
optional_policy(`
@@ -22143,9 +21985,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
unconfined_shell_domtrans(sshd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.te serefpolicy-3.8.6/policy/modules/services/sssd.te
+@@ -353,10 +433,6 @@
+ userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t)
+
+ optional_policy(`
+- nscd_socket_use(ssh_keygen_t)
+-')
+-
+-optional_policy(`
+ seutil_sigchld_newrole(ssh_keygen_t)
+ ')
+
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.te serefpolicy-3.8.7/policy/modules/services/sssd.te
--- nsaserefpolicy/policy/modules/services/sssd.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/sssd.te 2010-07-12 14:42:46.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/sssd.te 2010-07-14 14:08:02.000000000 -0400
@@ -31,6 +31,7 @@
allow sssd_t self:capability { dac_read_search dac_override kill sys_nice setgid setuid };
allow sssd_t self:process { setfscreate setsched sigkill signal getsched };
@@ -22171,9 +22024,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd
optional_policy(`
dbus_system_bus_client(sssd_t)
dbus_connect_system_bus(sssd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.8.6/policy/modules/services/sysstat.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.8.7/policy/modules/services/sysstat.te
--- nsaserefpolicy/policy/modules/services/sysstat.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/sysstat.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/sysstat.te 2010-07-14 14:08:02.000000000 -0400
@@ -68,3 +68,8 @@
optional_policy(`
logging_send_syslog_msg(sysstat_t)
@@ -22183,9 +22036,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/syss
+ nscd_socket_use(sysstat_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/telnet.te serefpolicy-3.8.6/policy/modules/services/telnet.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/telnet.te serefpolicy-3.8.7/policy/modules/services/telnet.te
--- nsaserefpolicy/policy/modules/services/telnet.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/telnet.te 2010-07-12 16:50:40.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/telnet.te 2010-07-14 14:08:02.000000000 -0400
@@ -38,7 +38,6 @@
manage_dirs_pattern(telnetd_t, telnetd_tmp_t, telnetd_tmp_t)
@@ -22203,13 +22056,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/teln
optional_policy(`
kerberos_keytab_template(telnetd, telnetd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.if serefpolicy-3.8.6/policy/modules/services/tftp.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.if serefpolicy-3.8.7/policy/modules/services/tftp.if
--- nsaserefpolicy/policy/modules/services/tftp.if 2010-02-12 10:33:09.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/tftp.if 2010-07-12 09:05:35.000000000 -0400
-@@ -20,6 +20,25 @@
++++ serefpolicy-3.8.7/policy/modules/services/tftp.if 2010-07-14 14:08:02.000000000 -0400
+@@ -16,6 +16,26 @@
+ ')
- ########################################
- ## <summary>
+ read_files_pattern($1, tftpdir_t, tftpdir_t)
++ read_lnk_files_pattern($1, tftpdir_t, tftpdir_t)
++')
++
++########################################
++## <summary>
+## Search tftp /var/lib directories.
+## </summary>
+## <param name="domain">
@@ -22225,14 +22083,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp
+
+ search_dirs_pattern($1, tftpdir_rw_t, tftpdir_rw_t)
+ files_search_var_lib($1)
-+')
-+
-+########################################
-+## <summary>
- ## Manage tftp /var/lib files.
- ## </summary>
- ## <param name="domain">
-@@ -40,6 +59,36 @@
+ ')
+
+ ########################################
+@@ -40,6 +60,36 @@
########################################
## <summary>
@@ -22269,9 +22123,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp
## All of the rules required to administrate
## an tftp environment
## </summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-3.8.6/policy/modules/services/tftp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-3.8.7/policy/modules/services/tftp.te
--- nsaserefpolicy/policy/modules/services/tftp.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/tftp.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/tftp.te 2010-07-14 14:08:02.000000000 -0400
@@ -94,6 +94,10 @@
')
@@ -22283,9 +22137,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp
inetd_udp_service_domain(tftpd_t, tftpd_exec_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tgtd.te serefpolicy-3.8.6/policy/modules/services/tgtd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tgtd.te serefpolicy-3.8.7/policy/modules/services/tgtd.te
--- nsaserefpolicy/policy/modules/services/tgtd.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/tgtd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/tgtd.te 2010-07-14 14:08:02.000000000 -0400
@@ -59,8 +59,12 @@
files_read_etc_files(tgtd_t)
@@ -22299,9 +22153,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tgtd
miscfiles_read_localization(tgtd_t)
+
+iscsi_manage_semaphores(tgtd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor.te serefpolicy-3.8.6/policy/modules/services/tor.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor.te serefpolicy-3.8.7/policy/modules/services/tor.te
--- nsaserefpolicy/policy/modules/services/tor.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/tor.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/tor.te 2010-07-14 14:08:02.000000000 -0400
@@ -100,6 +100,8 @@
auth_use_nsswitch(tor_t)
@@ -22311,9 +22165,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor.
miscfiles_read_localization(tor_t)
tunable_policy(`tor_bind_all_unreserved_ports', `
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tuned.te serefpolicy-3.8.6/policy/modules/services/tuned.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tuned.te serefpolicy-3.8.7/policy/modules/services/tuned.te
--- nsaserefpolicy/policy/modules/services/tuned.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/tuned.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/tuned.te 2010-07-14 14:08:02.000000000 -0400
@@ -24,6 +24,7 @@
#
@@ -22333,9 +22187,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tune
# to allow network interface tuning
optional_policy(`
sysnet_domtrans_ifconfig(tuned_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucspitcp.te serefpolicy-3.8.6/policy/modules/services/ucspitcp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucspitcp.te serefpolicy-3.8.7/policy/modules/services/ucspitcp.te
--- nsaserefpolicy/policy/modules/services/ucspitcp.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/ucspitcp.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/ucspitcp.te 2010-07-14 14:08:02.000000000 -0400
@@ -91,3 +91,8 @@
daemontools_service_domain(ucspitcp_t, ucspitcp_exec_t)
daemontools_read_svc(ucspitcp_t)
@@ -22345,17 +22199,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucsp
+ daemontools_sigchld_run(ucspitcp_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/usbmuxd.fc serefpolicy-3.8.6/policy/modules/services/usbmuxd.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/usbmuxd.fc serefpolicy-3.8.7/policy/modules/services/usbmuxd.fc
--- nsaserefpolicy/policy/modules/services/usbmuxd.fc 2010-04-05 14:44:26.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/usbmuxd.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/usbmuxd.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,3 +1,3 @@
/usr/sbin/usbmuxd -- gen_context(system_u:object_r:usbmuxd_exec_t,s0)
-/var/run/usbmuxd -s gen_context(system_u:object_r:usbmuxd_var_run_t,s0)
+/var/run/usbmuxd.* gen_context(system_u:object_r:usbmuxd_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/varnishd.if serefpolicy-3.8.6/policy/modules/services/varnishd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/varnishd.if serefpolicy-3.8.7/policy/modules/services/varnishd.if
--- nsaserefpolicy/policy/modules/services/varnishd.if 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/varnishd.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/varnishd.if 2010-07-14 14:08:02.000000000 -0400
@@ -56,6 +56,25 @@
read_files_pattern($1, varnishd_etc_t, varnishd_etc_t)
')
@@ -22382,9 +22236,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/varn
#######################################
## <summary>
## Read varnish logs.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhostmd.if serefpolicy-3.8.6/policy/modules/services/vhostmd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhostmd.if serefpolicy-3.8.7/policy/modules/services/vhostmd.if
--- nsaserefpolicy/policy/modules/services/vhostmd.if 2010-03-29 15:04:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/vhostmd.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/vhostmd.if 2010-07-14 14:08:02.000000000 -0400
@@ -42,7 +42,7 @@
## </summary>
## <param name="domain">
@@ -22394,9 +22248,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhos
## </summary>
## </param>
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhostmd.te serefpolicy-3.8.6/policy/modules/services/vhostmd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhostmd.te serefpolicy-3.8.7/policy/modules/services/vhostmd.te
--- nsaserefpolicy/policy/modules/services/vhostmd.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/vhostmd.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/vhostmd.te 2010-07-14 14:08:02.000000000 -0400
@@ -44,6 +44,8 @@
corenet_tcp_connect_soundd_port(vhostmd_t)
@@ -22406,9 +22260,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhos
files_read_etc_files(vhostmd_t)
files_read_usr_files(vhostmd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.fc serefpolicy-3.8.6/policy/modules/services/virt.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.fc serefpolicy-3.8.7/policy/modules/services/virt.fc
--- nsaserefpolicy/policy/modules/services/virt.fc 2010-03-23 10:55:15.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/virt.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/virt.fc 2010-07-14 14:08:02.000000000 -0400
@@ -13,17 +13,18 @@
/etc/xen/.*/.* gen_context(system_u:object_r:virt_etc_rw_t,s0)
@@ -22431,9 +22285,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
+/var/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:qemu_var_run_t,s0-mls_systemhigh)
/var/vdsm(/.*)? gen_context(system_u:object_r:virt_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.8.6/policy/modules/services/virt.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.8.7/policy/modules/services/virt.if
--- nsaserefpolicy/policy/modules/services/virt.if 2010-03-23 10:55:15.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/virt.if 2010-07-12 11:30:12.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/virt.if 2010-07-14 16:34:07.000000000 -0400
@@ -21,6 +21,7 @@
type $1_t, virt_domain;
domain_type($1_t)
@@ -22545,7 +22399,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
')
########################################
-@@ -516,3 +526,32 @@
+@@ -516,3 +526,51 @@
virt_manage_log($1)
')
@@ -22578,9 +22432,28 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
+ ptchown_run(svirt_t, $2)
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.8.6/policy/modules/services/virt.te
---- nsaserefpolicy/policy/modules/services/virt.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/virt.te 2010-07-12 14:44:33.000000000 -0400
++
++########################################
++## <summary>
++## Do not audit attempts to write virt daemon unnamed pipes.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`virt_dontaudit_write_pipes',`
++ gen_require(`
++ type virtd_t;
++ ')
++
++ dontaudit $1 virtd_t:fifo_file write;
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.8.7/policy/modules/services/virt.te
+--- nsaserefpolicy/policy/modules/services/virt.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/virt.te 2010-07-14 14:08:02.000000000 -0400
@@ -4,6 +4,7 @@
#
# Declarations
@@ -22647,21 +22520,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
fs_hugetlbfs_filetrans(svirt_t, svirt_image_t, file)
list_dirs_pattern(svirt_t, virt_content_t, virt_content_t)
-@@ -147,11 +154,13 @@
+@@ -147,11 +154,15 @@
tunable_policy(`virt_use_nfs',`
fs_manage_nfs_dirs(svirt_t)
fs_manage_nfs_files(svirt_t)
-+ fs_read_nfs_symlinks(virtd_t)
++ fs_manage_nfs_named_sockets(svirt_t)
++ fs_read_nfs_symlinks(svirt_t)
')
tunable_policy(`virt_use_samba',`
fs_manage_cifs_dirs(svirt_t)
fs_manage_cifs_files(svirt_t)
++ fs_manage_cifs_named_sockets(svirt_t)
+ fs_read_cifs_symlinks(virtd_t)
')
tunable_policy(`virt_use_sysfs',`
-@@ -160,6 +169,7 @@
+@@ -160,6 +171,7 @@
tunable_policy(`virt_use_usb',`
dev_rw_usbfs(svirt_t)
@@ -22669,7 +22544,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
fs_manage_dos_dirs(svirt_t)
fs_manage_dos_files(svirt_t)
')
-@@ -178,22 +188,29 @@
+@@ -168,28 +180,39 @@
+ xen_rw_image_files(svirt_t)
+ ')
+
++optional_policy(`
++ xen_rw_image_files(svirt_t)
++')
++
+ ########################################
+ #
+ # virtd local policy
#
allow virtd_t self:capability { chown dac_override fowner ipc_lock kill mknod net_admin net_raw setpcap setuid setgid sys_admin sys_nice sys_ptrace };
@@ -22702,7 +22587,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
read_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
read_lnk_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
-@@ -204,9 +221,15 @@
+@@ -200,9 +223,15 @@
manage_files_pattern(virtd_t, virt_image_type, virt_image_type)
manage_blk_files_pattern(virtd_t, virt_image_type, virt_image_type)
@@ -22718,7 +22603,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t)
manage_files_pattern(virtd_t, virt_log_t, virt_log_t)
logging_log_filetrans(virtd_t, virt_log_t, { file dir })
-@@ -224,6 +247,7 @@
+@@ -220,6 +249,7 @@
kernel_read_system_state(virtd_t)
kernel_read_network_state(virtd_t)
kernel_rw_net_sysctls(virtd_t)
@@ -22726,7 +22611,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
kernel_request_load_module(virtd_t)
kernel_search_debugfs(virtd_t)
-@@ -247,18 +271,25 @@
+@@ -243,18 +273,25 @@
dev_rw_kvm(virtd_t)
dev_getattr_all_chr_files(virtd_t)
dev_rw_mtrr(virtd_t)
@@ -22753,7 +22638,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
fs_list_auto_mountpoints(virtd_t)
fs_getattr_xattr_fs(virtd_t)
-@@ -267,6 +298,15 @@
+@@ -263,6 +300,15 @@
fs_manage_cgroup_dirs(virtd_t)
fs_rw_cgroup_files(virtd_t)
@@ -22769,7 +22654,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
mcs_process_set_categories(virtd_t)
storage_manage_fixed_disk(virtd_t)
-@@ -290,15 +330,22 @@
+@@ -286,15 +332,22 @@
logging_send_syslog_msg(virtd_t)
@@ -22792,7 +22677,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
tunable_policy(`virt_use_nfs',`
fs_manage_nfs_dirs(virtd_t)
-@@ -369,6 +416,7 @@
+@@ -365,6 +418,7 @@
qemu_signal(virtd_t)
qemu_kill(virtd_t)
qemu_setsched(virtd_t)
@@ -22800,7 +22685,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
')
optional_policy(`
-@@ -406,6 +454,19 @@
+@@ -402,6 +456,19 @@
allow virt_domain self:unix_dgram_socket { create_socket_perms sendto };
allow virt_domain self:tcp_socket create_stream_socket_perms;
@@ -22820,7 +22705,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
append_files_pattern(virt_domain, virt_log_t, virt_log_t)
append_files_pattern(virt_domain, virt_var_lib_t, virt_var_lib_t)
-@@ -426,6 +487,7 @@
+@@ -422,6 +489,7 @@
corenet_tcp_bind_virt_migration_port(virt_domain)
corenet_tcp_connect_virt_migration_port(virt_domain)
@@ -22828,7 +22713,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
dev_read_rand(virt_domain)
dev_read_sound(virt_domain)
dev_read_urand(virt_domain)
-@@ -433,6 +495,7 @@
+@@ -429,6 +497,7 @@
dev_rw_ksm(virt_domain)
dev_rw_kvm(virt_domain)
dev_rw_qemu(virt_domain)
@@ -22836,7 +22721,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
domain_use_interactive_fds(virt_domain)
-@@ -444,6 +507,11 @@
+@@ -440,6 +509,11 @@
fs_getattr_tmpfs(virt_domain)
fs_rw_anon_inodefs_files(virt_domain)
fs_rw_tmpfs_files(virt_domain)
@@ -22848,7 +22733,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
term_use_all_terms(virt_domain)
term_getattr_pty_fs(virt_domain)
-@@ -461,8 +529,120 @@
+@@ -457,8 +531,120 @@
')
optional_policy(`
@@ -22969,9 +22854,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt
+ userdom_search_admin_dir(virsh_ssh_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.8.6/policy/modules/services/w3c.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.8.7/policy/modules/services/w3c.te
--- nsaserefpolicy/policy/modules/services/w3c.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/w3c.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/w3c.te 2010-07-14 14:08:02.000000000 -0400
@@ -7,11 +7,18 @@
apache_content_template(w3c_validator)
@@ -22997,9 +22882,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.
sysnet_dns_name_resolve(httpd_w3c_validator_script_t)
+
+apache_dontaudit_rw_tmp_files(httpd_w3c_validator_script_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.8.6/policy/modules/services/xserver.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.8.7/policy/modules/services/xserver.fc
--- nsaserefpolicy/policy/modules/services/xserver.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/xserver.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/xserver.fc 2010-07-14 14:08:02.000000000 -0400
@@ -2,13 +2,23 @@
# HOME_DIR
#
@@ -23121,9 +23006,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
+/var/lib/pqsql/\.xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
+/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.8.6/policy/modules/services/xserver.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.8.7/policy/modules/services/xserver.if
--- nsaserefpolicy/policy/modules/services/xserver.if 2010-02-12 10:33:09.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/xserver.if 2010-07-12 15:12:17.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/xserver.if 2010-07-14 14:08:02.000000000 -0400
@@ -19,9 +19,10 @@
interface(`xserver_restricted_role',`
gen_require(`
@@ -23734,9 +23619,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
+
+ manage_files_pattern($1, user_fonts_config_t, user_fonts_config_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.8.6/policy/modules/services/xserver.te
---- nsaserefpolicy/policy/modules/services/xserver.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/xserver.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.8.7/policy/modules/services/xserver.te
+--- nsaserefpolicy/policy/modules/services/xserver.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/xserver.te 2010-07-14 14:54:05.000000000 -0400
@@ -35,6 +35,13 @@
## <desc>
@@ -23795,15 +23680,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
typealias iceauth_t alias { auditadm_iceauth_t secadm_iceauth_t };
application_domain(iceauth_t, iceauth_exec_t)
ubac_constrained(iceauth_t)
-@@ -131,6 +153,7 @@
+@@ -131,22 +153,28 @@
type iceauth_home_t;
typealias iceauth_home_t alias { user_iceauth_home_t staff_iceauth_home_t sysadm_iceauth_home_t };
typealias iceauth_home_t alias { auditadm_iceauth_home_t secadm_iceauth_home_t };
+typealias iceauth_home_t alias { xguest_iceauth_home_t };
- files_poly_member(iceauth_home_t)
++files_poly_member(iceauth_home_t)
userdom_user_home_content(iceauth_home_t)
-@@ -138,17 +161,20 @@
+ type xauth_t;
type xauth_exec_t;
typealias xauth_t alias { user_xauth_t staff_xauth_t sysadm_xauth_t };
typealias xauth_t alias { auditadm_xauth_t secadm_xauth_t };
@@ -23815,7 +23700,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
typealias xauth_home_t alias { user_xauth_home_t staff_xauth_home_t sysadm_xauth_home_t };
typealias xauth_home_t alias { auditadm_xauth_home_t secadm_xauth_home_t };
+typealias xauth_home_t alias { xguest_xauth_home_t unconfined_xauth_home_t };
- files_poly_member(xauth_home_t)
++files_poly_member(xauth_home_t)
userdom_user_home_content(xauth_home_t)
type xauth_tmp_t;
@@ -23824,7 +23709,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
typealias xauth_tmp_t alias { auditadm_xauth_tmp_t secadm_xauth_tmp_t };
files_tmp_file(xauth_tmp_t)
ubac_constrained(xauth_tmp_t)
-@@ -163,16 +189,21 @@
+@@ -161,15 +189,21 @@
type xdm_exec_t;
auth_login_pgm_domain(xdm_t)
init_domain(xdm_t, xdm_exec_t)
@@ -23832,7 +23717,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
+init_system_domain(xdm_t, xdm_exec_t)
xserver_object_types_template(xdm)
xserver_common_x_domain_template(xdm, xdm_t)
--xserver_unconfined(xdm_t)
type xdm_lock_t;
files_lock_file(xdm_lock_t)
@@ -23849,7 +23733,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
type xdm_var_lib_t;
files_type(xdm_var_lib_t)
-@@ -180,13 +211,27 @@
+@@ -177,13 +211,27 @@
type xdm_var_run_t;
files_pid_file(xdm_var_run_t)
@@ -23878,7 +23762,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
# type for /var/lib/xkb
type xkb_var_lib_t;
files_type(xkb_var_lib_t)
-@@ -199,15 +244,9 @@
+@@ -196,15 +244,9 @@
init_system_domain(xserver_t, xserver_exec_t)
ubac_constrained(xserver_t)
@@ -23896,7 +23780,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
files_tmpfs_file(xserver_tmpfs_t)
ubac_constrained(xserver_tmpfs_t)
-@@ -237,9 +276,13 @@
+@@ -234,9 +276,13 @@
allow xdm_t iceauth_home_t:file read_file_perms;
@@ -23910,7 +23794,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_files(iceauth_t)
-@@ -249,30 +292,64 @@
+@@ -246,30 +292,64 @@
fs_manage_cifs_files(iceauth_t)
')
@@ -23978,7 +23862,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
fs_search_auto_mountpoints(xauth_t)
# cjp: why?
-@@ -282,17 +359,37 @@
+@@ -279,17 +359,37 @@
userdom_use_user_terminals(xauth_t)
userdom_read_user_tmp_files(xauth_t)
@@ -24016,7 +23900,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
optional_policy(`
ssh_sigchld(xauth_t)
ssh_read_pipes(xauth_t)
-@@ -304,20 +401,33 @@
+@@ -301,20 +401,33 @@
# XDM Local policy
#
@@ -24053,7 +23937,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
# Allow gdm to run gdm-binary
can_exec(xdm_t, xdm_exec_t)
-@@ -325,32 +435,53 @@
+@@ -322,32 +435,53 @@
allow xdm_t xdm_lock_t:file manage_file_perms;
files_lock_filetrans(xdm_t, xdm_lock_t, file)
@@ -24112,7 +23996,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
allow xdm_t xserver_t:unix_stream_socket connectto;
allow xdm_t xserver_tmp_t:sock_file rw_sock_file_perms;
-@@ -358,10 +489,13 @@
+@@ -355,10 +489,13 @@
# transition to the xdm xserver
domtrans_pattern(xdm_t, xserver_exec_t, xserver_t)
@@ -24126,7 +24010,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
# connect to xdm xserver over stream socket
stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)
-@@ -370,15 +504,22 @@
+@@ -367,15 +504,22 @@
delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
@@ -24150,7 +24034,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
corecmd_exec_shell(xdm_t)
corecmd_exec_bin(xdm_t)
-@@ -393,11 +534,14 @@
+@@ -390,11 +534,14 @@
corenet_udp_sendrecv_all_ports(xdm_t)
corenet_tcp_bind_generic_node(xdm_t)
corenet_udp_bind_generic_node(xdm_t)
@@ -24165,7 +24049,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
dev_read_rand(xdm_t)
dev_read_sysfs(xdm_t)
dev_getattr_framebuffer_dev(xdm_t)
-@@ -405,6 +549,7 @@
+@@ -402,6 +549,7 @@
dev_getattr_mouse_dev(xdm_t)
dev_setattr_mouse_dev(xdm_t)
dev_rw_apm_bios(xdm_t)
@@ -24173,7 +24057,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
dev_setattr_apm_bios_dev(xdm_t)
dev_rw_dri(xdm_t)
dev_rw_agp(xdm_t)
-@@ -413,18 +558,22 @@
+@@ -410,18 +558,22 @@
dev_getattr_misc_dev(xdm_t)
dev_setattr_misc_dev(xdm_t)
dev_dontaudit_rw_misc(xdm_t)
@@ -24199,7 +24083,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
files_read_etc_files(xdm_t)
files_read_var_files(xdm_t)
-@@ -435,9 +584,17 @@
+@@ -432,9 +584,17 @@
files_read_usr_files(xdm_t)
# Poweroff wants to create the /poweroff file when run from xdm
files_create_boot_flag(xdm_t)
@@ -24217,7 +24101,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
storage_dontaudit_read_fixed_disk(xdm_t)
storage_dontaudit_write_fixed_disk(xdm_t)
-@@ -446,14 +603,19 @@
+@@ -443,14 +603,19 @@
storage_dontaudit_raw_write_removable_device(xdm_t)
storage_dontaudit_setattr_removable_dev(xdm_t)
storage_dontaudit_rw_scsi_generic(xdm_t)
@@ -24237,7 +24121,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
auth_rw_faillog(xdm_t)
auth_write_login_records(xdm_t)
-@@ -464,10 +626,12 @@
+@@ -461,10 +626,12 @@
logging_read_generic_logs(xdm_t)
@@ -24252,7 +24136,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t)
-@@ -476,6 +640,11 @@
+@@ -473,6 +640,11 @@
# Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t)
@@ -24264,7 +24148,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
xserver_rw_session(xdm_t, xdm_tmpfs_t)
xserver_unconfined(xdm_t)
-@@ -507,11 +676,17 @@
+@@ -504,11 +676,17 @@
')
optional_policy(`
@@ -24282,7 +24166,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
')
optional_policy(`
-@@ -519,12 +694,50 @@
+@@ -516,12 +694,51 @@
')
optional_policy(`
@@ -24324,6 +24208,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
')
optional_policy(`
++ gnome_manage_config(xdm_t)
+ gnome_manage_gconf_home_files(xdm_t)
+ gnome_read_config(xdm_t)
+ gnome_read_gconf_config(xdm_t)
@@ -24333,7 +24218,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
hostname_exec(xdm_t)
')
-@@ -542,20 +755,59 @@
+@@ -539,20 +756,63 @@
')
optional_policy(`
@@ -24379,6 +24264,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
')
optional_policy(`
++ ssh_signull(xdm_t)
++')
++
++optional_policy(`
+ shutdown_domtrans(xdm_t)
+')
+
@@ -24395,7 +24284,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
ifndef(`distro_redhat',`
allow xdm_t self:process { execheap execmem };
-@@ -564,7 +816,6 @@
+@@ -561,7 +821,6 @@
ifdef(`distro_rhel4',`
allow xdm_t self:process { execheap execmem };
')
@@ -24403,7 +24292,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
optional_policy(`
userhelper_dontaudit_search_config(xdm_t)
-@@ -575,6 +826,10 @@
+@@ -572,6 +831,10 @@
')
optional_policy(`
@@ -24414,7 +24303,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
xfs_stream_connect(xdm_t)
')
-@@ -599,10 +854,9 @@
+@@ -596,10 +859,9 @@
# execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack
@@ -24426,7 +24315,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
allow xserver_t self:fd use;
allow xserver_t self:fifo_file rw_fifo_file_perms;
allow xserver_t self:sock_file read_sock_file_perms;
-@@ -614,6 +868,18 @@
+@@ -611,6 +873,18 @@
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms;
@@ -24445,7 +24334,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
-@@ -633,12 +899,19 @@
+@@ -630,12 +904,19 @@
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t)
@@ -24467,7 +24356,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
kernel_read_system_state(xserver_t)
kernel_read_device_sysctls(xserver_t)
-@@ -672,7 +945,6 @@
+@@ -669,7 +950,6 @@
dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t)
@@ -24475,7 +24364,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
dev_create_generic_dirs(xserver_t)
dev_setattr_generic_dirs(xserver_t)
# raw memory access is needed if not using the frame buffer
-@@ -682,9 +954,12 @@
+@@ -679,9 +959,12 @@
dev_rw_xserver_misc(xserver_t)
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev(xserver_t)
@@ -24489,7 +24378,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
files_read_etc_files(xserver_t)
files_read_etc_runtime_files(xserver_t)
-@@ -699,8 +974,13 @@
+@@ -696,8 +979,13 @@
fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t)
@@ -24503,7 +24392,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
selinux_validate_context(xserver_t)
selinux_compute_access_vector(xserver_t)
-@@ -722,11 +1002,14 @@
+@@ -719,11 +1007,14 @@
miscfiles_read_localization(xserver_t)
miscfiles_read_fonts(xserver_t)
@@ -24518,7 +24407,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
userdom_search_user_home_dirs(xserver_t)
userdom_use_user_ttys(xserver_t)
-@@ -778,12 +1061,28 @@
+@@ -775,12 +1066,28 @@
')
optional_policy(`
@@ -24548,7 +24437,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
unconfined_domtrans(xserver_t)
')
-@@ -807,10 +1106,10 @@
+@@ -804,10 +1111,10 @@
# NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open
# handle of a file inside the dir!!!
@@ -24561,22 +24450,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
# Label pid and temporary files with derived types.
manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
-@@ -831,9 +1130,14 @@
+@@ -828,6 +1135,13 @@
# to read ROLE_home_t - examine this in more detail
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
+userdom_read_all_users_state(xserver_t)
-
- xserver_use_user_fonts(xserver_t)
-
++
++xserver_use_user_fonts(xserver_t)
++
+optional_policy(`
+ userhelper_search_config(xserver_t)
+')
-+
+
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xserver_t)
- fs_manage_nfs_files(xserver_t)
-@@ -848,11 +1152,14 @@
+@@ -843,11 +1157,14 @@
optional_policy(`
dbus_system_bus_client(xserver_t)
@@ -24593,7 +24481,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
')
optional_policy(`
-@@ -998,3 +1305,33 @@
+@@ -993,3 +1310,33 @@
allow xserver_unconfined_type xextension_type:x_extension *;
allow xserver_unconfined_type { x_domain xserver_t }:x_resource *;
allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
@@ -24627,24 +24515,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
+tunable_policy(`use_samba_home_dirs',`
+ fs_append_cifs_files(xdmhomewriter)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zabbix.te serefpolicy-3.8.6/policy/modules/services/zabbix.te
---- nsaserefpolicy/policy/modules/services/zabbix.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/services/zabbix.te 2010-07-12 09:05:35.000000000 -0400
-@@ -12,11 +12,9 @@
- type zabbix_initrc_exec_t;
- init_script_file(zabbix_initrc_exec_t)
-
--# log files
- type zabbix_log_t;
- logging_log_file(zabbix_log_t)
-
--# pid files
- type zabbix_var_run_t;
- files_pid_file(zabbix_var_run_t)
-
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.fc serefpolicy-3.8.6/policy/modules/services/zarafa.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.fc serefpolicy-3.8.7/policy/modules/services/zarafa.fc
--- nsaserefpolicy/policy/modules/services/zarafa.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/zarafa.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/zarafa.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,27 @@
+
+/etc/zarafa(/.*)? gen_context(system_u:object_r:zarafa_etc_t,s0)
@@ -24673,9 +24546,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zara
+/var/run/zarafa-spooler\.pid -- gen_context(system_u:object_r:zarafa_spooler_var_run_t,s0)
+/var/run/zarafa-ical\.pid -- gen_context(system_u:object_r:zarafa_ical_var_run_t,s0)
+/var/run/zarafa-monitor\.pid -- gen_context(system_u:object_r:zarafa_monitor_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.if serefpolicy-3.8.6/policy/modules/services/zarafa.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.if serefpolicy-3.8.7/policy/modules/services/zarafa.if
--- nsaserefpolicy/policy/modules/services/zarafa.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/zarafa.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/zarafa.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,105 @@
+
+## <summary>policy for zarafa services</summary>
@@ -24782,9 +24655,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zara
+
+ stream_connect_pattern($1, zarafa_server_t, zarafa_server_var_run_t, zarafa_server_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.te serefpolicy-3.8.6/policy/modules/services/zarafa.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.te serefpolicy-3.8.7/policy/modules/services/zarafa.te
--- nsaserefpolicy/policy/modules/services/zarafa.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/services/zarafa.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/services/zarafa.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,133 @@
+policy_module(zarafa, 1.0.0)
+
@@ -24919,9 +24792,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zara
+optional_policy(`
+ apache_content_template(zarafa)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.8.6/policy/modules/system/application.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.8.7/policy/modules/system/application.te
--- nsaserefpolicy/policy/modules/system/application.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/application.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/application.te 2010-07-14 14:08:02.000000000 -0400
@@ -6,6 +6,22 @@
# Executables to be run by user
attribute application_exec_type;
@@ -24945,9 +24818,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic
optional_policy(`
ssh_sigchld(application_domain_type)
ssh_rw_stream_sockets(application_domain_type)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.8.6/policy/modules/system/authlogin.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.8.7/policy/modules/system/authlogin.fc
--- nsaserefpolicy/policy/modules/system/authlogin.fc 2010-03-18 10:35:11.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/authlogin.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/authlogin.fc 2010-07-14 14:08:02.000000000 -0400
@@ -10,6 +10,7 @@
/sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0)
/sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
@@ -24956,9 +24829,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
ifdef(`distro_suse', `
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.8.6/policy/modules/system/authlogin.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.8.7/policy/modules/system/authlogin.if
--- nsaserefpolicy/policy/modules/system/authlogin.if 2010-03-18 10:35:11.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/authlogin.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/authlogin.if 2010-07-14 14:08:02.000000000 -0400
@@ -91,9 +91,12 @@
interface(`auth_login_pgm_domain',`
gen_require(`
@@ -25080,9 +24953,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.8.6/policy/modules/system/authlogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.8.7/policy/modules/system/authlogin.te
--- nsaserefpolicy/policy/modules/system/authlogin.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/authlogin.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/authlogin.te 2010-07-14 14:08:02.000000000 -0400
@@ -8,6 +8,7 @@
attribute can_read_shadow_passwords;
attribute can_write_shadow_passwords;
@@ -25103,9 +24976,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+ userdom_relabelto_user_home_dirs(polydomain)
+ userdom_relabelto_user_home_files(polydomain)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/daemontools.if serefpolicy-3.8.6/policy/modules/system/daemontools.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/daemontools.if serefpolicy-3.8.7/policy/modules/system/daemontools.if
--- nsaserefpolicy/policy/modules/system/daemontools.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/daemontools.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/daemontools.if 2010-07-14 14:08:02.000000000 -0400
@@ -71,6 +71,32 @@
domtrans_pattern($1, svc_start_exec_t, svc_start_t)
')
@@ -25186,9 +25059,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/daemon
+
+ allow $1 svc_run_t:process sigchld;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/daemontools.te serefpolicy-3.8.6/policy/modules/system/daemontools.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/daemontools.te serefpolicy-3.8.7/policy/modules/system/daemontools.te
--- nsaserefpolicy/policy/modules/system/daemontools.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/daemontools.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/daemontools.te 2010-07-14 14:08:02.000000000 -0400
@@ -38,7 +38,10 @@
# multilog creates /service/*/log/status
manage_files_pattern(svc_multilog_t, svc_svc_t, svc_svc_t)
@@ -25261,9 +25134,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/daemon
+
daemontools_domtrans_run(svc_start_t)
daemontools_manage_svc(svc_start_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.8.6/policy/modules/system/fstools.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.8.7/policy/modules/system/fstools.fc
--- nsaserefpolicy/policy/modules/system/fstools.fc 2010-03-09 15:39:06.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/fstools.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/fstools.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,4 +1,3 @@
-/sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -25277,9 +25150,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.8.6/policy/modules/system/fstools.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.8.7/policy/modules/system/fstools.te
--- nsaserefpolicy/policy/modules/system/fstools.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/fstools.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/fstools.te 2010-07-14 14:08:02.000000000 -0400
@@ -117,6 +117,8 @@
fs_search_tmpfs(fsadm_t)
fs_getattr_tmpfs_dirs(fsadm_t)
@@ -25313,9 +25186,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
nis_use_ypbind(fsadm_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.8.6/policy/modules/system/getty.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.8.7/policy/modules/system/getty.te
--- nsaserefpolicy/policy/modules/system/getty.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/getty.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/getty.te 2010-07-14 14:08:02.000000000 -0400
@@ -83,7 +83,7 @@
term_setattr_all_ttys(getty_t)
term_setattr_unallocated_ttys(getty_t)
@@ -25325,9 +25198,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.
auth_rw_login_records(getty_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.8.6/policy/modules/system/hostname.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.8.7/policy/modules/system/hostname.te
--- nsaserefpolicy/policy/modules/system/hostname.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/hostname.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/hostname.te 2010-07-14 14:08:02.000000000 -0400
@@ -26,15 +26,18 @@
dev_read_sysfs(hostname_t)
@@ -25358,9 +25231,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna
xen_append_log(hostname_t)
xen_dontaudit_use_fds(hostname_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplug.te serefpolicy-3.8.6/policy/modules/system/hotplug.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplug.te serefpolicy-3.8.7/policy/modules/system/hotplug.te
--- nsaserefpolicy/policy/modules/system/hotplug.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/hotplug.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/hotplug.te 2010-07-14 14:08:02.000000000 -0400
@@ -23,7 +23,7 @@
#
@@ -25378,10 +25251,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplu
kernel_read_kernel_sysctls(hotplug_t)
kernel_read_net_sysctls(hotplug_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.fc serefpolicy-3.8.6/policy/modules/system/init.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.fc serefpolicy-3.8.7/policy/modules/system/init.fc
--- nsaserefpolicy/policy/modules/system/init.fc 2010-03-18 10:35:11.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/init.fc 2010-07-12 09:05:35.000000000 -0400
-@@ -44,6 +44,9 @@
++++ serefpolicy-3.8.7/policy/modules/system/init.fc 2010-07-15 08:43:58.000000000 -0400
+@@ -24,6 +24,11 @@
+ #
+ # /sbin
+ #
++/bin/systemd -- gen_context(system_u:object_r:init_exec_t,s0)
++
++#
++# /sbin
++#
+ /sbin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0)
+
+ ifdef(`distro_gentoo', `
+@@ -44,6 +49,9 @@
/usr/sbin/apachectl -- gen_context(system_u:object_r:initrc_exec_t,s0)
/usr/sbin/open_init_pty -- gen_context(system_u:object_r:initrc_exec_t,s0)
@@ -25391,9 +25276,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.f
#
# /var
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.8.6/policy/modules/system/init.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.8.7/policy/modules/system/init.if
--- nsaserefpolicy/policy/modules/system/init.if 2010-03-18 10:35:11.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/init.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/init.if 2010-07-14 14:08:02.000000000 -0400
@@ -193,8 +193,10 @@
gen_require(`
attribute direct_run_init, direct_init, direct_init_entry;
@@ -25655,9 +25540,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
+ init_dontaudit_use_script_fds($1)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.8.6/policy/modules/system/init.te
---- nsaserefpolicy/policy/modules/system/init.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/init.te 2010-07-12 11:30:18.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.8.7/policy/modules/system/init.te
+--- nsaserefpolicy/policy/modules/system/init.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/init.te 2010-07-14 16:30:09.000000000 -0400
@@ -16,6 +16,27 @@
## </desc>
gen_tunable(init_upstart, false)
@@ -25731,7 +25616,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
# For /var/run/shutdown.pid.
allow init_t init_var_run_t:file manage_file_perms;
-@@ -120,6 +145,7 @@
+@@ -120,12 +145,14 @@
corecmd_exec_bin(init_t)
dev_read_sysfs(init_t)
@@ -25739,7 +25624,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
domain_getpgid_all_domains(init_t)
domain_kill_all_domains(init_t)
-@@ -168,6 +194,8 @@
+ domain_signal_all_domains(init_t)
+ domain_signull_all_domains(init_t)
+ domain_sigstop_all_domains(init_t)
++domain_sigstop_all_domains(init_t)
+ domain_sigchld_all_domains(init_t)
+
+ files_read_etc_files(init_t)
+@@ -167,6 +194,8 @@
miscfiles_read_localization(init_t)
@@ -25748,7 +25640,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
ifdef(`distro_gentoo',`
allow init_t self:process { getcap setcap };
')
-@@ -191,10 +219,23 @@
+@@ -190,10 +219,23 @@
')
optional_policy(`
@@ -25772,7 +25664,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
nscd_socket_use(init_t)
')
-@@ -212,7 +253,7 @@
+@@ -211,7 +253,7 @@
#
allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@@ -25781,7 +25673,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
dontaudit initrc_t self:capability sys_module; # sysctl is triggering this
allow initrc_t self:passwd rootok;
allow initrc_t self:key manage_key_perms;
-@@ -241,6 +282,7 @@
+@@ -240,6 +282,7 @@
allow initrc_t initrc_var_run_t:file manage_file_perms;
files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@@ -25789,7 +25681,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
can_exec(initrc_t, initrc_tmp_t)
manage_files_pattern(initrc_t, initrc_tmp_t, initrc_tmp_t)
-@@ -258,11 +300,22 @@
+@@ -257,11 +300,22 @@
kernel_clear_ring_buffer(initrc_t)
kernel_get_sysvipc_info(initrc_t)
kernel_read_all_sysctls(initrc_t)
@@ -25812,17 +25704,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
corecmd_exec_all_executables(initrc_t)
-@@ -298,8 +351,7 @@
+@@ -297,11 +351,13 @@
dev_delete_generic_symlinks(initrc_t)
dev_getattr_all_blk_files(initrc_t)
dev_getattr_all_chr_files(initrc_t)
--
--corecmd_exec_all_executables(initrc_t)
+dev_rw_xserver_misc(initrc_t)
domain_kill_all_domains(initrc_t)
domain_signal_all_domains(initrc_t)
-@@ -324,8 +376,10 @@
+ domain_signull_all_domains(initrc_t)
+ domain_sigstop_all_domains(initrc_t)
++domain_sigstop_all_domains(initrc_t)
+ domain_sigchld_all_domains(initrc_t)
+ domain_read_all_domains_state(initrc_t)
+ domain_getattr_all_domains(initrc_t)
+@@ -320,8 +376,10 @@
files_getattr_all_pipes(initrc_t)
files_getattr_all_sockets(initrc_t)
files_purge_tmp(initrc_t)
@@ -25834,7 +25730,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
files_delete_all_pids(initrc_t)
files_delete_all_pid_dirs(initrc_t)
files_read_etc_files(initrc_t)
-@@ -341,6 +395,8 @@
+@@ -337,6 +395,8 @@
files_mounton_isid_type_dirs(initrc_t)
files_list_default(initrc_t)
files_mounton_default(initrc_t)
@@ -25843,7 +25739,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
fs_delete_cgroup_dirs(initrc_t)
fs_list_cgroup_dirs(initrc_t)
-@@ -354,6 +410,8 @@
+@@ -350,6 +410,8 @@
fs_unmount_all_fs(initrc_t)
fs_remount_all_fs(initrc_t)
fs_getattr_all_fs(initrc_t)
@@ -25852,7 +25748,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
# initrc_t needs to do a pidof which requires ptrace
mcs_ptrace_all(initrc_t)
-@@ -366,6 +424,7 @@
+@@ -362,6 +424,7 @@
mls_process_write_down(initrc_t)
mls_rangetrans_source(initrc_t)
mls_fd_share_all_levels(initrc_t)
@@ -25860,7 +25756,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
selinux_get_enforce_mode(initrc_t)
-@@ -397,13 +456,14 @@
+@@ -393,13 +456,14 @@
miscfiles_read_localization(initrc_t)
# slapd needs to read cert files from its initscript
@@ -25876,7 +25772,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
userdom_read_user_home_content_files(initrc_t)
# Allow access to the sysadm TTYs. Note that this will give access to the
# TTYs to any process in the initrc_t domain. Therefore, daemons and such
-@@ -476,7 +536,7 @@
+@@ -472,7 +536,7 @@
# Red Hat systems seem to have a stray
# fd open from the initrd
@@ -25885,7 +25781,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
files_dontaudit_read_root_files(initrc_t)
# These seem to be from the initrd
-@@ -522,6 +582,19 @@
+@@ -518,6 +582,19 @@
optional_policy(`
bind_manage_config_dirs(initrc_t)
bind_write_config(initrc_t)
@@ -25905,7 +25801,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
')
optional_policy(`
-@@ -529,10 +602,16 @@
+@@ -525,10 +602,17 @@
rpc_write_exports(initrc_t)
rpc_manage_nfs_state_data(initrc_t)
')
@@ -25919,10 +25815,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
+ sysnet_manage_dhcpc_state(initrc_t)
+ sysnet_relabelfrom_dhcpc_state(initrc_t)
+ sysnet_relabelfrom_net_conf(initrc_t)
++ sysnet_relabelto_net_conf(initrc_t)
')
optional_policy(`
-@@ -547,6 +626,35 @@
+@@ -543,6 +627,35 @@
')
')
@@ -25958,7 +25855,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
optional_policy(`
amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t)
-@@ -559,6 +667,8 @@
+@@ -555,6 +668,8 @@
optional_policy(`
apache_read_config(initrc_t)
apache_list_modules(initrc_t)
@@ -25967,7 +25864,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
')
optional_policy(`
-@@ -587,6 +697,11 @@
+@@ -583,6 +698,11 @@
')
optional_policy(`
@@ -25979,7 +25876,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
dev_getattr_printer_dev(initrc_t)
cups_read_log(initrc_t)
-@@ -603,6 +718,7 @@
+@@ -599,6 +719,7 @@
dbus_connect_system_bus(initrc_t)
dbus_system_bus_client(initrc_t)
dbus_read_config(initrc_t)
@@ -25987,7 +25884,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
optional_policy(`
consolekit_dbus_chat(initrc_t)
-@@ -704,7 +820,12 @@
+@@ -700,7 +821,12 @@
')
optional_policy(`
@@ -26000,7 +25897,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
mta_dontaudit_read_spool_symlinks(initrc_t)
')
-@@ -727,6 +848,10 @@
+@@ -723,6 +849,10 @@
')
optional_policy(`
@@ -26011,7 +25908,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
postgresql_manage_db(initrc_t)
postgresql_read_config(initrc_t)
')
-@@ -769,8 +894,6 @@
+@@ -765,8 +895,6 @@
# bash tries ioctl for some reason
files_dontaudit_ioctl_all_pids(initrc_t)
@@ -26020,7 +25917,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
')
optional_policy(`
-@@ -783,10 +906,12 @@
+@@ -779,10 +907,12 @@
squid_manage_logs(initrc_t)
')
@@ -26033,7 +25930,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
optional_policy(`
ssh_dontaudit_read_server_keys(initrc_t)
-@@ -808,11 +933,19 @@
+@@ -804,11 +934,19 @@
')
optional_policy(`
@@ -26054,7 +25951,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
ifdef(`distro_redhat',`
# system-config-services causes avc messages that should be dontaudited
-@@ -822,6 +955,25 @@
+@@ -818,6 +956,25 @@
optional_policy(`
mono_domtrans(initrc_t)
')
@@ -26080,7 +25977,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
')
optional_policy(`
-@@ -847,3 +999,35 @@
+@@ -843,3 +1000,35 @@
optional_policy(`
zebra_read_config(initrc_t)
')
@@ -26116,9 +26013,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
+ifdef(`init_systemd', `
+ allow daemon init_t:socket_class_set { getopt read getattr ioctl setopt write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.fc serefpolicy-3.8.6/policy/modules/system/ipsec.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.fc serefpolicy-3.8.7/policy/modules/system/ipsec.fc
--- nsaserefpolicy/policy/modules/system/ipsec.fc 2010-03-18 06:48:09.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/ipsec.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/ipsec.fc 2010-07-14 14:08:02.000000000 -0400
@@ -25,6 +25,7 @@
/usr/libexec/ipsec/klipsdebug -- gen_context(system_u:object_r:ipsec_exec_t,s0)
/usr/libexec/ipsec/pluto -- gen_context(system_u:object_r:ipsec_exec_t,s0)
@@ -26127,9 +26024,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
/usr/local/lib(64)?/ipsec/eroute -- gen_context(system_u:object_r:ipsec_exec_t,s0)
/usr/local/lib(64)?/ipsec/klipsdebug -- gen_context(system_u:object_r:ipsec_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.8.6/policy/modules/system/ipsec.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.8.7/policy/modules/system/ipsec.if
--- nsaserefpolicy/policy/modules/system/ipsec.if 2010-03-18 06:48:09.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/ipsec.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/ipsec.if 2010-07-14 14:08:02.000000000 -0400
@@ -20,6 +20,24 @@
########################################
@@ -26217,9 +26114,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
+ allow $1 ipsec_mgmt_t:process sigkill;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.8.6/policy/modules/system/ipsec.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.8.7/policy/modules/system/ipsec.te
--- nsaserefpolicy/policy/modules/system/ipsec.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/ipsec.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/ipsec.te 2010-07-14 14:08:02.000000000 -0400
@@ -72,7 +72,7 @@
#
@@ -26353,9 +26250,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
userdom_use_user_terminals(setkey_t)
+userdom_read_user_tmp_files(setkey_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.fc serefpolicy-3.8.6/policy/modules/system/iptables.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.fc serefpolicy-3.8.7/policy/modules/system/iptables.fc
--- nsaserefpolicy/policy/modules/system/iptables.fc 2010-02-12 16:41:05.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/iptables.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/iptables.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,12 +1,19 @@
/etc/rc\.d/init\.d/ip6?tables -- gen_context(system_u:object_r:iptables_initrc_exec_t,s0)
-/etc/sysconfig/ip6?tables.* -- gen_context(system_u:object_r:iptables_conf_t,s0)
@@ -26378,9 +26275,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl
/usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/iptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/iptables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.if serefpolicy-3.8.6/policy/modules/system/iptables.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.if serefpolicy-3.8.7/policy/modules/system/iptables.if
--- nsaserefpolicy/policy/modules/system/iptables.if 2009-12-04 09:43:33.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/iptables.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/iptables.if 2010-07-14 14:08:02.000000000 -0400
@@ -17,6 +17,10 @@
corecmd_search_bin($1)
@@ -26392,9 +26289,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.8.6/policy/modules/system/iptables.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.8.7/policy/modules/system/iptables.te
--- nsaserefpolicy/policy/modules/system/iptables.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/iptables.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/iptables.te 2010-07-14 14:08:02.000000000 -0400
@@ -13,9 +13,6 @@
type iptables_initrc_exec_t;
init_script_file(iptables_initrc_exec_t)
@@ -26479,9 +26376,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.if serefpolicy-3.8.6/policy/modules/system/iscsi.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.if serefpolicy-3.8.7/policy/modules/system/iscsi.if
--- nsaserefpolicy/policy/modules/system/iscsi.if 2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/iscsi.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/iscsi.if 2010-07-14 14:08:02.000000000 -0400
@@ -56,3 +56,21 @@
allow $1 iscsi_var_lib_t:dir list_dir_perms;
files_search_var_lib($1)
@@ -26504,9 +26401,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.
+
+ allow $1 iscsid_t:sem create_sem_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.8.6/policy/modules/system/iscsi.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.8.7/policy/modules/system/iscsi.te
--- nsaserefpolicy/policy/modules/system/iscsi.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/iscsi.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/iscsi.te 2010-07-14 14:08:02.000000000 -0400
@@ -76,6 +76,8 @@
dev_rw_sysfs(iscsid_t)
@@ -26516,9 +26413,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.
domain_use_interactive_fds(iscsid_t)
domain_dontaudit_read_all_domains_state(iscsid_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.8.6/policy/modules/system/libraries.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.8.7/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2010-03-23 11:19:40.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/libraries.fc 2010-07-12 16:29:02.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/libraries.fc 2010-07-14 14:08:02.000000000 -0400
@@ -131,13 +131,13 @@
/usr/lib/vlc/codec/libdmo_plugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/vlc/codec/librealaudio_plugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -26727,9 +26624,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
+/opt/lgtonmc/bin/.*\.so(\.[0-9])? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/opt/google/picasa/.*\.dll -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/opt/google/picasa/.*\.yti -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.8.6/policy/modules/system/libraries.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.8.7/policy/modules/system/libraries.te
--- nsaserefpolicy/policy/modules/system/libraries.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/libraries.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/libraries.te 2010-07-14 14:08:02.000000000 -0400
@@ -61,7 +61,7 @@
manage_files_pattern(ldconfig_t, ldconfig_cache_t, ldconfig_cache_t)
@@ -26766,9 +26663,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
ifdef(`hide_broken_symptoms',`
ifdef(`distro_gentoo',`
# leaked fds from portage
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.8.6/policy/modules/system/locallogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.fc serefpolicy-3.8.7/policy/modules/system/locallogin.fc
+--- nsaserefpolicy/policy/modules/system/locallogin.fc 2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/locallogin.fc 2010-07-14 14:08:02.000000000 -0400
+@@ -1,2 +1,3 @@
+
+ /sbin/sulogin -- gen_context(system_u:object_r:sulogin_exec_t,s0)
++/sbin/sushell -- gen_context(system_u:object_r:sulogin_exec_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.8.7/policy/modules/system/locallogin.te
--- nsaserefpolicy/policy/modules/system/locallogin.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/locallogin.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/locallogin.te 2010-07-14 14:08:02.000000000 -0400
@@ -32,9 +32,8 @@
# Local login local policy
#
@@ -26870,9 +26774,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall
-optional_policy(`
- nscd_socket_use(sulogin_t)
-')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.8.6/policy/modules/system/logging.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.8.7/policy/modules/system/logging.fc
--- nsaserefpolicy/policy/modules/system/logging.fc 2010-03-18 06:48:09.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/logging.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/logging.fc 2010-07-14 14:08:02.000000000 -0400
@@ -17,6 +17,10 @@
/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
@@ -26911,9 +26815,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
/var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
+
+/var/webmin(/.*)? gen_context(system_u:object_r:var_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.8.6/policy/modules/system/logging.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.8.7/policy/modules/system/logging.if
--- nsaserefpolicy/policy/modules/system/logging.if 2010-03-18 06:48:09.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/logging.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/logging.if 2010-07-14 14:08:02.000000000 -0400
@@ -545,6 +545,25 @@
########################################
@@ -26985,9 +26889,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
init_labeled_script_domtrans($1, syslogd_initrc_exec_t)
domain_system_change_exemption($1)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.8.6/policy/modules/system/logging.te
---- nsaserefpolicy/policy/modules/system/logging.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/logging.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.8.7/policy/modules/system/logging.te
+--- nsaserefpolicy/policy/modules/system/logging.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/logging.te 2010-07-14 14:08:02.000000000 -0400
@@ -60,6 +60,7 @@
type syslogd_t;
type syslogd_exec_t;
@@ -27058,20 +26962,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
sysnet_dns_name_resolve(audisp_remote_t)
########################################
-@@ -372,8 +394,10 @@
+@@ -372,6 +394,11 @@
manage_files_pattern(syslogd_t, syslogd_var_lib_t, syslogd_var_lib_t)
files_search_var_lib(syslogd_t)
--allow syslogd_t syslogd_var_run_t:file manage_file_perms;
--files_pid_filetrans(syslogd_t, syslogd_var_run_t, file)
+manage_dirs_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t)
+manage_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t)
+manage_sock_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t)
+files_pid_filetrans(syslogd_t, syslogd_var_run_t, { dir file })
-
++
# manage pid file
manage_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t)
-@@ -415,6 +439,7 @@
+ files_pid_filetrans(syslogd_t, syslogd_var_run_t, file)
+@@ -412,6 +439,7 @@
dev_filetrans(syslogd_t, devlog_t, sock_file)
dev_read_sysfs(syslogd_t)
@@ -27079,7 +26982,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
domain_use_interactive_fds(syslogd_t)
-@@ -491,6 +516,10 @@
+@@ -488,6 +516,10 @@
')
optional_policy(`
@@ -27090,9 +26993,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
udev_read_db(syslogd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.8.6/policy/modules/system/lvm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.8.7/policy/modules/system/lvm.fc
--- nsaserefpolicy/policy/modules/system/lvm.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/lvm.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/lvm.fc 2010-07-14 14:08:02.000000000 -0400
@@ -28,10 +28,12 @@
#
/lib/lvm-10/.* -- gen_context(system_u:object_r:lvm_exec_t,s0)
@@ -27106,9 +27009,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc
/sbin/cryptsetup -- gen_context(system_u:object_r:lvm_exec_t,s0)
/sbin/dmraid -- gen_context(system_u:object_r:lvm_exec_t,s0)
/sbin/dmsetup -- gen_context(system_u:object_r:lvm_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.8.6/policy/modules/system/lvm.te
---- nsaserefpolicy/policy/modules/system/lvm.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/lvm.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.8.7/policy/modules/system/lvm.te
+--- nsaserefpolicy/policy/modules/system/lvm.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/lvm.te 2010-07-14 14:08:02.000000000 -0400
@@ -141,6 +141,11 @@
')
@@ -27129,7 +27032,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
allow lvm_t self:file rw_file_perms;
allow lvm_t self:fifo_file manage_fifo_file_perms;
allow lvm_t self:unix_dgram_socket create_socket_perms;
-@@ -217,6 +223,7 @@
+@@ -211,11 +217,13 @@
+ files_search_mnt(lvm_t)
+
+ kernel_read_system_state(lvm_t)
++kernel_read_kernel_sysctls(lvm_t)
+ # Read system variables in /proc/sys
+ kernel_read_kernel_sysctls(lvm_t)
# it has no reason to need this
kernel_dontaudit_getattr_core_if(lvm_t)
kernel_use_fds(lvm_t)
@@ -27137,7 +27046,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
kernel_search_debugfs(lvm_t)
corecmd_exec_bin(lvm_t)
-@@ -243,6 +250,7 @@
+@@ -242,6 +250,7 @@
dev_dontaudit_getattr_generic_blk_files(lvm_t)
dev_dontaudit_getattr_generic_pipes(lvm_t)
dev_create_generic_dirs(lvm_t)
@@ -27145,7 +27054,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
domain_use_interactive_fds(lvm_t)
domain_read_all_domains_state(lvm_t)
-@@ -252,8 +260,9 @@
+@@ -251,8 +260,9 @@
files_read_etc_runtime_files(lvm_t)
# for when /usr is not mounted:
files_dontaudit_search_isid_type_dirs(lvm_t)
@@ -27156,7 +27065,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
fs_search_auto_mountpoints(lvm_t)
fs_list_tmpfs(lvm_t)
fs_read_tmpfs_symlinks(lvm_t)
-@@ -263,6 +272,7 @@
+@@ -262,6 +272,7 @@
mls_file_read_all_levels(lvm_t)
mls_file_write_to_clearance(lvm_t)
@@ -27164,7 +27073,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
selinux_get_fs_mount(lvm_t)
selinux_validate_context(lvm_t)
-@@ -310,6 +320,11 @@
+@@ -309,6 +320,11 @@
')
optional_policy(`
@@ -27176,7 +27085,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
bootloader_rw_tmp_files(lvm_t)
')
-@@ -330,6 +345,10 @@
+@@ -329,6 +345,10 @@
')
optional_policy(`
@@ -27187,9 +27096,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
modutils_domtrans_insmod(lvm_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.8.6/policy/modules/system/miscfiles.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.8.7/policy/modules/system/miscfiles.fc
--- nsaserefpolicy/policy/modules/system/miscfiles.fc 2010-03-09 15:39:06.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/miscfiles.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/miscfiles.fc 2010-07-14 14:08:02.000000000 -0400
@@ -75,13 +75,11 @@
/var/cache/fonts(/.*)? gen_context(system_u:object_r:tetex_data_t,s0)
/var/cache/man(/.*)? gen_context(system_u:object_r:man_t,s0)
@@ -27206,9 +27115,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi
ifdef(`distro_debian',`
/var/lib/msttcorefonts(/.*)? gen_context(system_u:object_r:fonts_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.8.6/policy/modules/system/miscfiles.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.8.7/policy/modules/system/miscfiles.if
--- nsaserefpolicy/policy/modules/system/miscfiles.if 2010-03-09 15:39:06.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/miscfiles.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/miscfiles.if 2010-07-14 14:08:02.000000000 -0400
@@ -305,9 +305,6 @@
allow $1 locale_t:dir list_dir_perms;
read_files_pattern($1, locale_t, locale_t)
@@ -27219,9 +27128,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.if serefpolicy-3.8.6/policy/modules/system/modutils.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.if serefpolicy-3.8.7/policy/modules/system/modutils.if
--- nsaserefpolicy/policy/modules/system/modutils.if 2009-12-04 09:43:33.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/modutils.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/modutils.if 2010-07-14 14:08:02.000000000 -0400
@@ -39,6 +39,26 @@
########################################
@@ -27249,9 +27158,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
## Read the configuration options used when
## loading modules.
## </summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.8.6/policy/modules/system/modutils.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.8.7/policy/modules/system/modutils.te
--- nsaserefpolicy/policy/modules/system/modutils.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/modutils.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/modutils.te 2010-07-14 16:35:18.000000000 -0400
@@ -18,6 +18,7 @@
type insmod_exec_t;
application_domain(insmod_t, insmod_exec_t)
@@ -27333,9 +27242,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
userdom_dontaudit_search_user_home_dirs(insmod_t)
if( ! secure_mode_insmod ) {
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.8.6/policy/modules/system/mount.fc
+@@ -235,6 +243,10 @@
+ ')
+
+ optional_policy(`
++ virt_dontaudit_write_pipes(insmod_t)
++')
++
++optional_policy(`
+ # cjp: why is this needed:
+ dev_rw_xserver_misc(insmod_t)
+
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.8.7/policy/modules/system/mount.fc
--- nsaserefpolicy/policy/modules/system/mount.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/mount.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/mount.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,4 +1,10 @@
/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
@@ -27348,9 +27268,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
-/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0)
+/var/cache/davfs2(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0)
+/var/run/davfs2(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-3.8.6/policy/modules/system/mount.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-3.8.7/policy/modules/system/mount.if
--- nsaserefpolicy/policy/modules/system/mount.if 2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/mount.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/mount.if 2010-07-14 14:08:02.000000000 -0400
@@ -16,6 +16,14 @@
')
@@ -27548,9 +27468,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
+ mount_domtrans_showmount($1)
+ role $2 types showmount_t;
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.8.6/policy/modules/system/mount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.8.7/policy/modules/system/mount.te
--- nsaserefpolicy/policy/modules/system/mount.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/mount.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/mount.te 2010-07-14 14:08:02.000000000 -0400
@@ -17,8 +17,15 @@
init_system_domain(mount_t, mount_exec_t)
role system_r types mount_t;
@@ -27834,9 +27754,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
+sysnet_dns_name_resolve(showmount_t)
+
+userdom_use_user_terminals(showmount_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.8.6/policy/modules/system/raid.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.8.7/policy/modules/system/raid.te
--- nsaserefpolicy/policy/modules/system/raid.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/raid.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/raid.te 2010-07-14 14:08:02.000000000 -0400
@@ -57,6 +57,7 @@
files_read_etc_files(mdadm_t)
@@ -27845,9 +27765,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t
fs_search_auto_mountpoints(mdadm_t)
fs_dontaudit_list_tmpfs(mdadm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.8.6/policy/modules/system/selinuxutil.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.8.7/policy/modules/system/selinuxutil.fc
--- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/selinuxutil.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/selinuxutil.fc 2010-07-14 14:08:02.000000000 -0400
@@ -6,13 +6,13 @@
/etc/selinux(/.*)? gen_context(system_u:object_r:selinux_config_t,s0)
/etc/selinux/([^/]*/)?contexts(/.*)? gen_context(system_u:object_r:default_context_t,s0)
@@ -27887,9 +27807,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
+
+/etc/share/selinux/targeted(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
+/etc/share/selinux/mls(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.8.6/policy/modules/system/selinuxutil.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.8.7/policy/modules/system/selinuxutil.if
--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2010-03-03 23:26:37.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/selinuxutil.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/selinuxutil.if 2010-07-14 14:08:02.000000000 -0400
@@ -361,6 +361,27 @@
########################################
@@ -28266,9 +28186,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
+ hotplug_use_fds($1)
+')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.8.6/policy/modules/system/selinuxutil.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.8.7/policy/modules/system/selinuxutil.te
--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/selinuxutil.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/selinuxutil.te 2010-07-14 14:08:02.000000000 -0400
@@ -22,6 +22,9 @@
type selinux_config_t;
files_type(selinux_config_t)
@@ -28652,9 +28572,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
- hotplug_use_fds(setfiles_t)
+ unconfined_domain(setfiles_mac_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/setrans.te serefpolicy-3.8.6/policy/modules/system/setrans.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/setrans.te serefpolicy-3.8.7/policy/modules/system/setrans.te
--- nsaserefpolicy/policy/modules/system/setrans.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/setrans.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/setrans.te 2010-07-14 14:08:02.000000000 -0400
@@ -12,6 +12,7 @@
type setrans_t;
type setrans_exec_t;
@@ -28663,15 +28583,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/setran
type setrans_initrc_exec_t;
init_script_file(setrans_initrc_exec_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosreport.fc serefpolicy-3.8.6/policy/modules/system/sosreport.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosreport.fc serefpolicy-3.8.7/policy/modules/system/sosreport.fc
--- nsaserefpolicy/policy/modules/system/sosreport.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/sosreport.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/sosreport.fc 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,2 @@
+
+/usr/sbin/sosreport -- gen_context(system_u:object_r:sosreport_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosreport.if serefpolicy-3.8.6/policy/modules/system/sosreport.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosreport.if serefpolicy-3.8.7/policy/modules/system/sosreport.if
--- nsaserefpolicy/policy/modules/system/sosreport.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/sosreport.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/sosreport.if 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,131 @@
+
+## <summary>policy for sosreport</summary>
@@ -28804,9 +28724,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosrep
+
+ allow $1 sosreport_tmp_t:file append;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosreport.te serefpolicy-3.8.6/policy/modules/system/sosreport.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosreport.te serefpolicy-3.8.7/policy/modules/system/sosreport.te
--- nsaserefpolicy/policy/modules/system/sosreport.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/sosreport.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/sosreport.te 2010-07-14 14:08:02.000000000 -0400
@@ -0,0 +1,154 @@
+policy_module(sosreport,1.0.0)
+
@@ -28962,18 +28882,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosrep
+optional_policy(`
+ unconfined_domain(sosreport_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.fc serefpolicy-3.8.6/policy/modules/system/sysnetwork.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.fc serefpolicy-3.8.7/policy/modules/system/sysnetwork.fc
--- nsaserefpolicy/policy/modules/system/sysnetwork.fc 2010-03-23 10:55:15.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/sysnetwork.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/sysnetwork.fc 2010-07-14 14:08:02.000000000 -0400
@@ -64,3 +64,5 @@
ifdef(`distro_gentoo',`
/var/lib/dhcpc(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0)
')
+
+/etc/firestarter/firestarter\.sh gen_context(system_u:object_r:dhcpc_helper_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.8.6/policy/modules/system/sysnetwork.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.8.7/policy/modules/system/sysnetwork.if
--- nsaserefpolicy/policy/modules/system/sysnetwork.if 2010-03-23 10:55:15.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/sysnetwork.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/sysnetwork.if 2010-07-14 14:08:02.000000000 -0400
@@ -60,25 +60,24 @@
netutils_run(dhcpc_t, $2)
netutils_run_ping(dhcpc_t, $2)
@@ -29221,9 +29141,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
+
+ role_transition $1 dhcpc_exec_t system_r;
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.8.6/policy/modules/system/sysnetwork.te
---- nsaserefpolicy/policy/modules/system/sysnetwork.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/sysnetwork.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.8.7/policy/modules/system/sysnetwork.te
+--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/sysnetwork.te 2010-07-14 14:08:02.000000000 -0400
@@ -19,6 +19,9 @@
init_daemon_domain(dhcpc_t, dhcpc_exec_t)
role system_r types dhcpc_t;
@@ -29279,12 +29199,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
')
optional_policy(`
-@@ -192,6 +205,12 @@
+@@ -192,6 +205,13 @@
')
optional_policy(`
+ networkmanager_domtrans(dhcpc_t)
+ networkmanager_read_pid_files(dhcpc_t)
++ networkmanager_read_lib_files(dhcpc_t)
+')
+
+optional_policy(`
@@ -29292,7 +29213,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
nis_read_ypbind_pid(dhcpc_t)
')
-@@ -213,6 +232,7 @@
+@@ -213,6 +233,7 @@
optional_policy(`
seutil_sigchld_newrole(dhcpc_t)
seutil_dontaudit_search_config(dhcpc_t)
@@ -29300,7 +29221,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
')
optional_policy(`
-@@ -276,8 +296,11 @@
+@@ -276,8 +297,11 @@
domain_use_interactive_fds(ifconfig_t)
@@ -29312,7 +29233,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
fs_getattr_xattr_fs(ifconfig_t)
fs_search_auto_mountpoints(ifconfig_t)
-@@ -305,6 +328,8 @@
+@@ -305,6 +329,8 @@
seutil_use_runinit_fds(ifconfig_t)
@@ -29321,7 +29242,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
userdom_use_user_terminals(ifconfig_t)
userdom_use_all_users_fds(ifconfig_t)
-@@ -327,6 +352,8 @@
+@@ -327,6 +353,8 @@
optional_policy(`
hal_dontaudit_rw_pipes(ifconfig_t)
hal_dontaudit_rw_dgram_sockets(ifconfig_t)
@@ -29330,17 +29251,28 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.fc serefpolicy-3.8.6/policy/modules/system/udev.fc
+@@ -334,6 +362,10 @@
+ ')
+
+ optional_policy(`
++ netutils_domtrans(dhcpc_t)
++')
++
++optional_policy(`
+ nis_use_ypbind(ifconfig_t)
+ ')
+
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.fc serefpolicy-3.8.7/policy/modules/system/udev.fc
--- nsaserefpolicy/policy/modules/system/udev.fc 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/udev.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/udev.fc 2010-07-14 14:08:02.000000000 -0400
@@ -22,3 +22,4 @@
/usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0)
/var/run/PackageKit/udev(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0)
+/var/run/libgpod(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.8.6/policy/modules/system/udev.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.8.7/policy/modules/system/udev.te
--- nsaserefpolicy/policy/modules/system/udev.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/udev.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/udev.te 2010-07-14 16:42:17.000000000 -0400
@@ -52,6 +52,7 @@
allow udev_t self:unix_stream_socket connectto;
allow udev_t self:netlink_kobject_uevent_socket create_socket_perms;
@@ -29349,7 +29281,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
allow udev_t udev_exec_t:file write;
can_exec(udev_t, udev_exec_t)
-@@ -216,6 +217,10 @@
+@@ -116,6 +117,7 @@
+ files_dontaudit_search_isid_type_dirs(udev_t)
+ files_getattr_generic_locks(udev_t)
+ files_search_mnt(udev_t)
++files_list_tmp(udev_t)
+
+ fs_getattr_all_fs(udev_t)
+ fs_list_inotifyfs(udev_t)
+@@ -216,6 +218,10 @@
')
optional_policy(`
@@ -29360,7 +29300,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
consoletype_exec(udev_t)
')
-@@ -259,6 +264,10 @@
+@@ -259,6 +265,10 @@
')
optional_policy(`
@@ -29371,7 +29311,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
openct_read_pid_files(udev_t)
openct_domtrans(udev_t)
')
-@@ -273,6 +282,10 @@
+@@ -273,6 +283,10 @@
')
optional_policy(`
@@ -29382,9 +29322,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
unconfined_signal(udev_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.8.6/policy/modules/system/unconfined.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.8.7/policy/modules/system/unconfined.fc
--- nsaserefpolicy/policy/modules/system/unconfined.fc 2010-02-22 08:30:53.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/unconfined.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/unconfined.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,15 +1 @@
# Add programs here which should not be confined by SELinux
-# e.g.:
@@ -29401,9 +29341,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
-ifdef(`distro_gentoo',`
-/usr/lib32/openoffice/program/[^/]+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
-')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.8.6/policy/modules/system/unconfined.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.8.7/policy/modules/system/unconfined.if
--- nsaserefpolicy/policy/modules/system/unconfined.if 2010-03-01 15:12:54.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/unconfined.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/unconfined.if 2010-07-14 14:08:02.000000000 -0400
@@ -12,14 +12,13 @@
#
interface(`unconfined_domain_noaudit',`
@@ -29898,9 +29838,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
-
- allow $1 unconfined_t:dbus acquire_svc;
-')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.8.6/policy/modules/system/unconfined.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.8.7/policy/modules/system/unconfined.te
--- nsaserefpolicy/policy/modules/system/unconfined.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/unconfined.te 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/unconfined.te 2010-07-14 14:08:02.000000000 -0400
@@ -4,227 +4,5 @@
#
# Declarations
@@ -30130,9 +30070,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
- hal_dbus_chat(unconfined_execmem_t)
- ')
-')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.8.6/policy/modules/system/userdomain.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.8.7/policy/modules/system/userdomain.fc
--- nsaserefpolicy/policy/modules/system/userdomain.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/userdomain.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/userdomain.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,4 +1,14 @@
HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
+HOME_DIR -l gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
@@ -30149,9 +30089,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+HOME_DIR/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
+HOME_DIR/\.pki(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
+HOME_DIR/\.gvfs(/.*)? <<none>>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.8.6/policy/modules/system/userdomain.if
---- nsaserefpolicy/policy/modules/system/userdomain.if 2010-06-08 10:35:48.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/userdomain.if 2010-07-12 11:40:53.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.8.7/policy/modules/system/userdomain.if
+--- nsaserefpolicy/policy/modules/system/userdomain.if 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/userdomain.if 2010-07-14 14:08:02.000000000 -0400
@@ -30,8 +30,9 @@
')
@@ -30318,7 +30258,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
#######################################
-@@ -168,27 +200,6 @@
+@@ -149,6 +181,8 @@
+ type user_home_t, user_home_dir_t;
+ ')
+
++ role $1 types { user_home_t user_home_dir_t };
++
+ ##############################
+ #
+ # Domain access to home dir
+@@ -166,27 +200,6 @@
read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
files_list_home($2)
@@ -30346,19 +30295,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
#######################################
-@@ -220,9 +231,10 @@
+@@ -218,8 +231,11 @@
interface(`userdom_manage_home_role',`
gen_require(`
type user_home_t, user_home_dir_t;
+ attribute user_home_type;
')
-- role $1 types { user_home_t user_home_dir_t };
+ role $1 types { user_home_type user_home_dir_t };
-
++
##############################
#
-@@ -232,17 +244,21 @@
+ # Domain access to home dir
+@@ -228,17 +244,21 @@
type_member $2 user_home_dir_t:dir user_home_dir_t;
# full control of the home directory
@@ -30390,7 +30339,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
files_list_home($2)
-@@ -250,25 +266,23 @@
+@@ -246,25 +266,23 @@
allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
tunable_policy(`use_nfs_home_dirs',`
@@ -30420,7 +30369,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
')
-@@ -303,6 +317,45 @@
+@@ -289,6 +307,8 @@
+ type user_tmp_t;
+ ')
+
++ role $1 types user_tmp_t;
++
+ files_poly_member_tmp($2, user_tmp_t)
+
+ manage_dirs_pattern($2, user_tmp_t, user_tmp_t)
+@@ -297,6 +317,45 @@
manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
@@ -30466,7 +30424,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
#######################################
-@@ -322,6 +375,7 @@
+@@ -316,6 +375,7 @@
')
exec_files_pattern($1, user_tmp_t, user_tmp_t)
@@ -30474,7 +30432,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
files_search_tmp($1)
')
-@@ -368,46 +422,41 @@
+@@ -350,6 +410,8 @@
+ type user_tmpfs_t;
+ ')
+
++ role $1 types user_tmpfs_t;
++
+ manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t)
+ manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
+ manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
+@@ -360,46 +422,41 @@
#######################################
## <summary>
@@ -30496,12 +30463,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
- gen_require(`
- type $1_t;
- ')
-+interface(`userdom_basic_networking',`
-
+-
- allow $1_t self:tcp_socket create_stream_socket_perms;
- allow $1_t self:udp_socket create_socket_perms;
-+ allow $1 self:tcp_socket create_stream_socket_perms;
-+ allow $1 self:udp_socket create_socket_perms;
++interface(`userdom_basic_networking',`
- corenet_all_recvfrom_unlabeled($1_t)
- corenet_all_recvfrom_netlabel($1_t)
@@ -30513,7 +30478,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
- corenet_udp_sendrecv_all_ports($1_t)
- corenet_tcp_connect_all_ports($1_t)
- corenet_sendrecv_all_client_packets($1_t)
--
++ allow $1 self:tcp_socket create_stream_socket_perms;
++ allow $1 self:udp_socket create_socket_perms;
+
- corenet_all_recvfrom_labeled($1_t, $1_t)
+ corenet_all_recvfrom_unlabeled($1)
+ corenet_all_recvfrom_netlabel($1)
@@ -30541,7 +30508,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
#######################################
-@@ -438,6 +487,7 @@
+@@ -430,6 +487,7 @@
dev_dontaudit_rw_dri($1_t)
# GNOME checks for usb and other devices:
dev_rw_usbfs($1_t)
@@ -30549,7 +30516,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
xserver_xsession_entry_type($1_t)
-@@ -498,7 +548,7 @@
+@@ -490,7 +548,7 @@
attribute unpriv_userdomain;
')
@@ -30558,7 +30525,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
##############################
#
-@@ -508,73 +558,78 @@
+@@ -500,73 +558,78 @@
# evolution and gnome-session try to create a netlink socket
dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
@@ -30579,27 +30546,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ kernel_get_sysvipc_info($1_usertype)
# Find CDROM devices:
- kernel_read_device_sysctls($1_t)
--
-- corecmd_exec_bin($1_t)
+ kernel_read_device_sysctls($1_usertype)
+ kernel_request_load_module($1_usertype)
-- corenet_udp_bind_generic_node($1_t)
-- corenet_udp_bind_generic_port($1_t)
+- corecmd_exec_bin($1_t)
+ corenet_udp_bind_generic_node($1_usertype)
+ corenet_udp_bind_generic_port($1_usertype)
-- dev_read_rand($1_t)
-- dev_write_sound($1_t)
-- dev_read_sound($1_t)
-- dev_read_sound_mixer($1_t)
-- dev_write_sound_mixer($1_t)
+- corenet_udp_bind_generic_node($1_t)
+- corenet_udp_bind_generic_port($1_t)
+ dev_read_rand($1_usertype)
+ dev_write_sound($1_usertype)
+ dev_read_sound($1_usertype)
+ dev_read_sound_mixer($1_usertype)
+ dev_write_sound_mixer($1_usertype)
+- dev_read_rand($1_t)
+- dev_write_sound($1_t)
+- dev_read_sound($1_t)
+- dev_read_sound_mixer($1_t)
+- dev_write_sound_mixer($1_t)
+-
- files_exec_etc_files($1_t)
- files_search_locks($1_t)
+ files_exec_etc_files($1_usertype)
@@ -30677,7 +30644,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
tunable_policy(`user_ttyfile_stat',`
-@@ -582,65 +637,108 @@
+@@ -574,65 +637,108 @@
')
optional_policy(`
@@ -30713,40 +30680,40 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ optional_policy(`
+ policykit_dbus_chat($1_usertype)
+ ')
-+
-+ optional_policy(`
-+ bluetooth_dbus_chat($1_usertype)
-+ ')
optional_policy(`
- bluetooth_dbus_chat($1_t)
-+ consolekit_dbus_chat($1_usertype)
-+ consolekit_read_log($1_usertype)
++ bluetooth_dbus_chat($1_usertype)
')
optional_policy(`
- evolution_dbus_chat($1_t)
- evolution_alarm_dbus_chat($1_t)
-+ devicekit_dbus_chat($1_usertype)
-+ devicekit_dbus_chat_power($1_usertype)
-+ devicekit_dbus_chat_disk($1_usertype)
++ consolekit_dbus_chat($1_usertype)
++ consolekit_read_log($1_usertype)
')
optional_policy(`
- cups_dbus_chat_config($1_t)
-+ evolution_dbus_chat($1_usertype)
-+ evolution_alarm_dbus_chat($1_usertype)
++ devicekit_dbus_chat($1_usertype)
++ devicekit_dbus_chat_power($1_usertype)
++ devicekit_dbus_chat_disk($1_usertype)
')
optional_policy(`
- hal_dbus_chat($1_t)
-+ gnome_dbus_chat_gconfdefault($1_usertype)
++ evolution_dbus_chat($1_usertype)
++ evolution_alarm_dbus_chat($1_usertype)
')
optional_policy(`
- networkmanager_dbus_chat($1_t)
++ gnome_dbus_chat_gconfdefault($1_usertype)
++ ')
++
++ optional_policy(`
+ hal_dbus_chat($1_usertype)
- ')
++ ')
+
+ optional_policy(`
+ modemmanager_dbus_chat($1_usertype)
@@ -30759,31 +30726,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+
+ optional_policy(`
+ vpn_dbus_chat($1_usertype)
-+ ')
-+ ')
-+
-+ optional_policy(`
-+ git_session_role($1_r, $1_usertype)
+ ')
')
optional_policy(`
- inetd_use_fds($1_t)
- inetd_rw_tcp_sockets($1_t)
-+ inetd_use_fds($1_usertype)
-+ inetd_rw_tcp_sockets($1_usertype)
++ git_session_role($1_r, $1_usertype)
')
optional_policy(`
- inn_read_config($1_t)
- inn_read_news_lib($1_t)
- inn_read_news_spool($1_t)
-+ inn_read_config($1_usertype)
-+ inn_read_news_lib($1_usertype)
-+ inn_read_news_spool($1_usertype)
++ inetd_use_fds($1_usertype)
++ inetd_rw_tcp_sockets($1_usertype)
')
optional_policy(`
- locate_read_lib_files($1_t)
++ inn_read_config($1_usertype)
++ inn_read_news_lib($1_usertype)
++ inn_read_news_spool($1_usertype)
++ ')
++
++ optional_policy(`
+ locate_read_lib_files($1_usertype)
')
@@ -30791,20 +30758,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
optional_policy(`
- modutils_read_module_config($1_t)
+ modutils_read_module_config($1_usertype)
++ ')
++
++ optional_policy(`
++ mta_rw_spool($1_usertype)
++ mta_manage_queue($1_usertype)
')
optional_policy(`
- mta_rw_spool($1_t)
-+ mta_rw_spool($1_usertype)
-+ mta_manage_queue($1_usertype)
-+ ')
-+
-+ optional_policy(`
+ nsplugin_role($1_r, $1_usertype)
')
optional_policy(`
-@@ -651,41 +749,50 @@
+@@ -643,41 +749,50 @@
optional_policy(`
# to allow monitoring of pcmcia status
@@ -30866,7 +30833,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
#######################################
-@@ -713,13 +820,26 @@
+@@ -705,13 +820,26 @@
userdom_base_user_template($1)
@@ -30875,12 +30842,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+
+ userdom_manage_tmp_role($1_r, $1_usertype)
+ userdom_manage_tmpfs_role($1_r, $1_usertype)
-+
-+ ifelse(`$1',`unconfined',`',`
-+ gen_tunable(allow_$1_exec_content, true)
- userdom_manage_tmp_role($1_r, $1_t)
- userdom_manage_tmpfs_role($1_r, $1_t)
++ ifelse(`$1',`unconfined',`',`
++ gen_tunable(allow_$1_exec_content, true)
++
+ tunable_policy(`allow_$1_exec_content',`
+ userdom_exec_user_tmp_files($1_usertype)
+ userdom_exec_user_home_content_files($1_usertype)
@@ -30898,7 +30865,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
userdom_change_password_template($1)
-@@ -737,72 +857,74 @@
+@@ -729,72 +857,74 @@
allow $1_t self:context contains;
@@ -30966,10 +30933,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
- miscfiles_exec_tetex_data($1_t)
+ miscfiles_read_tetex_data($1_usertype)
+ miscfiles_exec_tetex_data($1_usertype)
++
++ seutil_read_config($1_usertype)
- seutil_read_config($1_t)
-+ seutil_read_config($1_usertype)
-+
+ optional_policy(`
+ cups_read_config($1_usertype)
+ cups_stream_connect($1_usertype)
@@ -31008,7 +30975,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
')
-@@ -834,12 +956,35 @@
+@@ -826,12 +956,35 @@
typeattribute $1_t unpriv_userdomain;
domain_interactive_fd($1_t)
@@ -31044,7 +31011,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
loadkeys_run($1_t,$1_r)
')
')
-@@ -875,45 +1020,83 @@
+@@ -867,45 +1020,83 @@
#
auth_role($1_r, $1_t)
@@ -31115,14 +31082,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
- ')
+ optional_policy(`
+ openoffice_role_template($1, $1_r, $1_usertype)
-+ ')
-+
-+ optional_policy(`
-+ policykit_role($1_r, $1_usertype)
')
optional_policy(`
- java_role($1_r, $1_t)
++ policykit_role($1_r, $1_usertype)
++ ')
++
++ optional_policy(`
+ pulseaudio_role($1_r, $1_usertype)
+ ')
+
@@ -31143,7 +31110,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
')
-@@ -948,7 +1131,7 @@
+@@ -940,7 +1131,7 @@
#
# Inherit rules for ordinary users.
@@ -31152,7 +31119,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
userdom_common_user_template($1)
##############################
-@@ -957,54 +1140,77 @@
+@@ -949,54 +1140,77 @@
#
# port access is audited even if dac would not have allowed it, so dontaudit it here
@@ -31241,26 +31208,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+
+ optional_policy(`
+ mount_run_fusermount($1_t, $1_r)
-+ ')
-+
-+ optional_policy(`
-+ wine_role_template($1, $1_r, $1_t)
')
- # Run pppd in pppd_t by default for user
optional_policy(`
- ppp_run_cond($1_t,$1_r)
-+ postfix_run_postdrop($1_t, $1_r)
++ wine_role_template($1, $1_r, $1_t)
')
-+ # Run pppd in pppd_t by default for user
optional_policy(`
- setroubleshoot_stream_connect($1_t)
++ postfix_run_postdrop($1_t, $1_r)
++ ')
++
++ # Run pppd in pppd_t by default for user
++ optional_policy(`
+ ppp_run_cond($1_t, $1_r)
')
')
-@@ -1040,7 +1246,7 @@
+@@ -1032,7 +1246,7 @@
template(`userdom_admin_user_template',`
gen_require(`
attribute admindomain;
@@ -31269,7 +31236,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
##############################
-@@ -1075,6 +1281,9 @@
+@@ -1067,6 +1281,9 @@
# Skip authentication when pam_rootok is specified.
allow $1_t self:passwd rootok;
@@ -31279,7 +31246,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
kernel_getattr_message_if($1_t)
-@@ -1089,6 +1298,7 @@
+@@ -1081,6 +1298,7 @@
kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t)
@@ -31287,7 +31254,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels
-@@ -1120,10 +1330,13 @@
+@@ -1112,10 +1330,13 @@
domain_sigchld_all_domains($1_t)
# for lsof
domain_getattr_all_sockets($1_t)
@@ -31301,7 +31268,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
fs_set_all_quotas($1_t)
fs_exec_noxattr($1_t)
-@@ -1143,6 +1356,7 @@
+@@ -1135,6 +1356,7 @@
logging_send_syslog_msg($1_t)
modutils_domtrans_insmod($1_t)
@@ -31309,7 +31276,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
# The following rule is temporary until such time that a complete
# policy management infrastructure is in place so that an administrator
-@@ -1211,6 +1425,8 @@
+@@ -1203,6 +1425,8 @@
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@@ -31318,7 +31285,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
-@@ -1238,6 +1454,7 @@
+@@ -1230,6 +1454,7 @@
seutil_run_checkpolicy($1,$2)
seutil_run_loadpolicy($1,$2)
seutil_run_semanage($1,$2)
@@ -31326,7 +31293,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
seutil_run_setfiles($1, $2)
optional_policy(`
-@@ -1276,11 +1493,15 @@
+@@ -1268,12 +1493,15 @@
interface(`userdom_user_home_content',`
gen_require(`
type user_home_t;
@@ -31335,6 +31302,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
allow $1 user_home_t:filesystem associate;
files_type($1)
+- files_poly_member($1)
ubac_constrained($1)
+
+ files_poly_member($1)
@@ -31342,7 +31310,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1391,6 +1612,7 @@
+@@ -1384,6 +1612,7 @@
')
allow $1 user_home_dir_t:dir search_dir_perms;
@@ -31350,7 +31318,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
files_search_home($1)
')
-@@ -1437,6 +1659,14 @@
+@@ -1430,6 +1659,14 @@
allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1)
@@ -31365,7 +31333,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1452,9 +1682,11 @@
+@@ -1445,9 +1682,11 @@
interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
type user_home_dir_t;
@@ -31377,7 +31345,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1511,6 +1743,42 @@
+@@ -1504,6 +1743,42 @@
allow $1 user_home_dir_t:dir relabelto;
')
@@ -31420,7 +31388,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
########################################
## <summary>
## Create directories in the home dir root with
-@@ -1585,6 +1853,8 @@
+@@ -1578,6 +1853,8 @@
')
dontaudit $1 user_home_t:dir search_dir_perms;
@@ -31429,7 +31397,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1599,10 +1869,12 @@
+@@ -1592,10 +1869,12 @@
#
interface(`userdom_list_user_home_content',`
gen_require(`
@@ -31444,68 +31412,87 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1645,6 +1917,25 @@
+@@ -1638,26 +1917,27 @@
########################################
## <summary>
+-## Do not audit attempts to set the
+-## attributes of user home files.
+## Set the attributes of user home files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+ ## Domain allowed access.
+ ## </summary>
+ ## </param>
+## <rolecap/>
-+#
+ #
+-interface(`userdom_dontaudit_setattr_user_home_content_files',`
+interface(`userdom_setattr_user_home_content_files',`
-+ gen_require(`
-+ type user_home_t;
-+ ')
-+
-+ allow $1 user_home_t:file setattr;
-+')
-+
-+########################################
-+## <summary>
- ## Do not audit attempts to set the
- ## attributes of user home files.
- ## </summary>
-@@ -1696,13 +1987,14 @@
- type user_home_dir_t, user_home_t;
+ gen_require(`
+ type user_home_t;
')
-+ list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
- read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
- files_search_home($1)
+- dontaudit $1 user_home_t:file setattr_file_perms;
++ allow $1 user_home_t:file setattr;
')
########################################
## <summary>
--## Do not audit attempts to read user home files.
-+## Do not audit attempts to getattr user home files.
+-## Mmap user home files.
++## Do not audit attempts to set the
++## attributes of user home files.
## </summary>
## <param name="domain">
## <summary>
-@@ -1710,13 +2002,35 @@
+@@ -1665,13 +1945,31 @@
## </summary>
## </param>
#
--interface(`userdom_dontaudit_read_user_home_content_files',`
-+interface(`userdom_dontaudit_getattr_user_home_content',`
+-interface(`userdom_mmap_user_home_content_files',`
++interface(`userdom_dontaudit_setattr_user_home_content_files',`
gen_require(`
-- type user_home_t;
-+ attribute user_home_type;
+- type user_home_dir_t, user_home_t;
++ type user_home_t;
')
-- dontaudit $1 user_home_t:dir list_dir_perms;
-- dontaudit $1 user_home_t:file read_file_perms;
-+ dontaudit $1 user_home_type:dir getattr;
-+ dontaudit $1 user_home_type:file getattr;
+- mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
+- files_search_home($1)
++ dontaudit $1 user_home_t:file setattr_file_perms;
+')
+
+########################################
+## <summary>
-+## Do not audit attempts to read user home files.
++## Mmap user home files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`userdom_mmap_user_home_content_files',`
++ gen_require(`
++ type user_home_dir_t, user_home_t;
++ ')
++
++ mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
++ files_search_home($1)
+ ')
+
+ ########################################
+@@ -1689,12 +1987,32 @@
+ type user_home_dir_t, user_home_t;
+ ')
+
++ list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
+ read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
+ files_search_home($1)
+ ')
+
+ ########################################
+ ## <summary>
++## Do not audit attempts to getattr user home files.
+## </summary>
+## <param name="domain">
+## <summary>
@@ -31513,12 +31500,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+## </summary>
+## </param>
+#
-+interface(`userdom_dontaudit_read_user_home_content_files',`
++interface(`userdom_dontaudit_getattr_user_home_content',`
+ gen_require(`
+ attribute user_home_type;
-+ type user_home_dir_t;
+ ')
+
++ dontaudit $1 user_home_type:dir getattr;
++ dontaudit $1 user_home_type:file getattr;
++')
++
++########################################
++## <summary>
+ ## Do not audit attempts to read user home files.
+ ## </summary>
+ ## <param name="domain">
+@@ -1705,11 +2023,14 @@
+ #
+ interface(`userdom_dontaudit_read_user_home_content_files',`
+ gen_require(`
+- type user_home_t;
++ attribute user_home_type;
++ type user_home_dir_t;
+ ')
+
+- dontaudit $1 user_home_t:dir list_dir_perms;
+- dontaudit $1 user_home_t:file read_file_perms;
+ dontaudit $1 user_home_dir_t:dir list_dir_perms;
+ dontaudit $1 user_home_type:dir list_dir_perms;
+ dontaudit $1 user_home_type:file read_file_perms;
@@ -31526,7 +31532,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1806,8 +2120,7 @@
+@@ -1799,8 +2120,7 @@
type user_home_dir_t, user_home_t;
')
@@ -31536,7 +31542,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1823,20 +2136,14 @@
+@@ -1816,20 +2136,14 @@
#
interface(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -31561,7 +31567,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
########################################
## <summary>
-@@ -2178,7 +2485,7 @@
+@@ -2171,7 +2485,7 @@
type user_tmp_t;
')
@@ -31570,7 +31576,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2431,13 +2738,14 @@
+@@ -2424,13 +2738,14 @@
')
read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
@@ -31586,7 +31592,34 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## </summary>
## <param name="domain">
## <summary>
-@@ -2791,7 +3099,7 @@
+@@ -2451,26 +2766,6 @@
+
+ ########################################
+ ## <summary>
+-## Create, read, write, and delete user tmpfs files.
+-## </summary>
+-## <param name="domain">
+-## <summary>
+-## Domain allowed access.
+-## </summary>
+-## </param>
+-#
+-interface(`userdom_manage_user_tmpfs_files',`
+- gen_require(`
+- type user_tmpfs_t;
+- ')
+-
+- manage_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+- allow $1 user_tmpfs_t:dir list_dir_perms;
+- fs_search_tmpfs($1)
+-')
+-
+-########################################
+-## <summary>
+ ## Get the attributes of a user domain tty.
+ ## </summary>
+ ## <param name="domain">
+@@ -2804,7 +3099,7 @@
domain_entry_file_spec_domtrans($1, unpriv_userdomain)
allow unpriv_userdomain $1:fd use;
@@ -31595,7 +31628,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
allow unpriv_userdomain $1:process sigchld;
')
-@@ -2807,11 +3115,13 @@
+@@ -2820,11 +3115,13 @@
#
interface(`userdom_search_user_home_content',`
gen_require(`
@@ -31611,7 +31644,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2948,7 +3258,45 @@
+@@ -2961,7 +3258,45 @@
type user_tmp_t;
')
@@ -31658,7 +31691,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2985,6 +3333,7 @@
+@@ -2998,6 +3333,7 @@
')
read_files_pattern($1, userdomain, userdomain)
@@ -31666,7 +31699,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
kernel_search_proc($1)
')
-@@ -3115,3 +3464,779 @@
+@@ -3128,3 +3464,779 @@
allow $1 userdomain:dbus send_msg;
')
@@ -32446,9 +32479,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+
+ dontaudit $1 user_tmp_t:dir search_dir_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.8.6/policy/modules/system/userdomain.te
---- nsaserefpolicy/policy/modules/system/userdomain.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/userdomain.te 2010-07-12 11:38:28.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.8.7/policy/modules/system/userdomain.te
+--- nsaserefpolicy/policy/modules/system/userdomain.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/userdomain.te 2010-07-14 14:08:02.000000000 -0400
@@ -43,6 +43,13 @@
## <desc>
@@ -32479,7 +32512,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
type user_home_dir_t alias { staff_home_dir_t sysadm_home_dir_t secadm_home_dir_t auditadm_home_dir_t unconfined_home_dir_t };
fs_associate_tmpfs(user_home_dir_t)
files_type(user_home_dir_t)
-@@ -71,6 +87,7 @@
+@@ -71,18 +87,21 @@
type user_home_t alias { staff_home_t sysadm_home_t secadm_home_t auditadm_home_t unconfined_home_t };
typealias user_home_t alias { staff_untrusted_content_t sysadm_untrusted_content_t secadm_untrusted_content_t auditadm_untrusted_content_t unconfined_untrusted_content_t };
@@ -32487,7 +32520,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
userdom_user_home_content(user_home_t)
fs_associate_tmpfs(user_home_t)
files_associate_tmp(user_home_t)
-@@ -84,7 +101,7 @@
++files_poly_member(user_home_t)
+ files_poly_parent(user_home_t)
+ files_mountpoint(user_home_t)
++ubac_constrained(user_home_t)
+
+ type user_devpts_t alias { staff_devpts_t sysadm_devpts_t secadm_devpts_t auditadm_devpts_t unconfined_devpts_t };
+ dev_node(user_devpts_t)
files_type(user_devpts_t)
ubac_constrained(user_devpts_t)
@@ -32496,7 +32535,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
typealias user_tmp_t alias { staff_untrusted_content_tmp_t sysadm_untrusted_content_tmp_t secadm_untrusted_content_tmp_t auditadm_untrusted_content_tmp_t unconfined_untrusted_content_tmp_t };
files_tmp_file(user_tmp_t)
userdom_user_home_content(user_tmp_t)
-@@ -96,3 +113,24 @@
+@@ -94,3 +113,24 @@
type user_tty_device_t alias { staff_tty_device_t sysadm_tty_device_t secadm_tty_device_t auditadm_tty_device_t unconfined_tty_device_t };
dev_node(user_tty_device_t)
ubac_constrained(user_tty_device_t)
@@ -32521,9 +32560,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+
+# Nautilus causes this avc
+dontaudit unpriv_userdomain self:dir setattr;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc serefpolicy-3.8.6/policy/modules/system/xen.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc serefpolicy-3.8.7/policy/modules/system/xen.fc
--- nsaserefpolicy/policy/modules/system/xen.fc 2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.8.6/policy/modules/system/xen.fc 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/xen.fc 2010-07-14 14:08:02.000000000 -0400
@@ -1,7 +1,5 @@
/dev/xen/tapctrl.* -p gen_context(system_u:object_r:xenctl_t,s0)
@@ -32532,9 +32571,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc
/usr/sbin/evtchnd -- gen_context(system_u:object_r:evtchnd_exec_t,s0)
ifdef(`distro_debian',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.8.6/policy/modules/system/xen.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.8.7/policy/modules/system/xen.if
--- nsaserefpolicy/policy/modules/system/xen.if 2010-03-23 10:55:15.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/xen.if 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/xen.if 2010-07-14 14:08:02.000000000 -0400
@@ -87,6 +87,26 @@
## </summary>
## </param>
@@ -32573,9 +32612,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if
domtrans_pattern($1, xm_exec_t, xm_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.8.6/policy/modules/system/xen.te
---- nsaserefpolicy/policy/modules/system/xen.te 2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.6/policy/modules/system/xen.te 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.8.7/policy/modules/system/xen.te
+--- nsaserefpolicy/policy/modules/system/xen.te 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/modules/system/xen.te 2010-07-14 14:08:02.000000000 -0400
@@ -4,6 +4,7 @@
#
# Declarations
@@ -32612,7 +32651,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
fs_manage_xenfs_files(xenstored_t)
storage_raw_read_fixed_disk(xenstored_t)
-@@ -366,98 +364,9 @@
+@@ -353,6 +351,7 @@
+ storage_raw_read_removable_device(xenstored_t)
+
+ term_use_generic_ptys(xenstored_t)
++term_use_console(xenconsoled_t)
+
+ init_use_fds(xenstored_t)
+ init_use_script_ptys(xenstored_t)
+@@ -365,98 +364,9 @@
########################################
#
@@ -32711,9 +32758,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
#Should have a boolean wrapping these
fs_list_auto_mountpoints(xend_t)
files_search_mnt(xend_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-3.8.6/policy/support/misc_patterns.spt
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-3.8.7/policy/support/misc_patterns.spt
--- nsaserefpolicy/policy/support/misc_patterns.spt 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.6/policy/support/misc_patterns.spt 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/support/misc_patterns.spt 2010-07-14 14:08:02.000000000 -0400
@@ -15,7 +15,7 @@
domain_transition_pattern($1,$2,$3)
@@ -32737,9 +32784,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns
')
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.8.6/policy/support/obj_perm_sets.spt
---- nsaserefpolicy/policy/support/obj_perm_sets.spt 2010-03-04 11:44:07.000000000 -0500
-+++ serefpolicy-3.8.6/policy/support/obj_perm_sets.spt 2010-07-12 09:05:35.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.8.7/policy/support/obj_perm_sets.spt
+--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/policy/support/obj_perm_sets.spt 2010-07-14 14:08:02.000000000 -0400
@@ -28,7 +28,7 @@
#
# All socket classes.
@@ -32849,9 +32896,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
+define(`all_dbus_perms', `{ acquire_svc send_msg } ')
+define(`all_passwd_perms', `{ passwd chfn chsh rootok crontab } ')
+define(`all_association_perms', `{ sendto recvfrom setcontext polmatch } ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.8.6/policy/users
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.8.7/policy/users
--- nsaserefpolicy/policy/users 2009-12-18 11:38:25.000000000 -0500
-+++ serefpolicy-3.8.6/policy/users 2010-07-12 09:05:35.000000000 -0400
++++ serefpolicy-3.8.7/policy/users 2010-07-14 14:08:02.000000000 -0400
@@ -15,7 +15,7 @@
# and a user process should never be assigned the system user
# identity.
@@ -32885,3 +32932,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.8
- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
-')
+gen_user(root, user, unconfined_r sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.8.7/support/Makefile.devel
+--- nsaserefpolicy/support/Makefile.devel 2010-07-14 11:21:53.000000000 -0400
++++ serefpolicy-3.8.7/support/Makefile.devel 2010-07-14 14:08:02.000000000 -0400
+@@ -68,8 +68,8 @@
+
+ # default MLS/MCS sensitivity and category settings.
+ MLS_SENS ?= 16
+-MLS_CATS ?= 1024
+-MCS_CATS ?= 1024
++MLS_CATS ?= 256
++MCS_CATS ?= 256
+
+ ifeq ($(QUIET),y)
+ verbose := @
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 8e2b7ff..88b63ff 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,8 +19,8 @@
%define CHECKPOLICYVER 2.0.21-1
Summary: SELinux policy configuration
Name: selinux-policy
-Version: 3.8.6
-Release: 3%{?dist}
+Version: 3.8.7
+Release: 1%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -331,7 +331,7 @@ if [ $1 -eq 1 ]; then
%loadpolicy targeted $packages
restorecon -R /root /var/log /var/run /var/lib 2> /dev/null
else
- semodule -n -s targeted -r moilscanner -r mailscanner -r gamin -r audio_entropy -r iscsid -r polkit_auth -r polkit -r rtkit_daemon -r ModemManager 2>/dev/null
+ semodule -n -s targeted -r moilscanner mailscanner gamin audio_entropy iscsid polkit_auth polkit rtkit_daemon ModemManager telepathysofiasip ethereal 2>/dev/null
%loadpolicy targeted $packages
%relabel targeted
fi
@@ -450,7 +450,7 @@ SELinux Reference policy mls base module.
%saveFileContext mls
%post mls
-semodule -n -s mls -r mailscanner -r polkit -r ModemManager 2>/dev/null
+semodule -n -s mls -r mailscanner polkit ModemManager telepathysofiasip ethereal 2>/dev/null
packages=`cat /usr/share/selinux/mls/modules.lst`
%loadpolicy mls $packages
@@ -469,6 +469,9 @@ exit 0
%endif
%changelog
+* Mon Jul 14 2010 Dan Walsh <dwalsh@redhat.com> 3.8.7-1
+- Update to upstream
+
* Mon Jul 12 2010 Dan Walsh <dwalsh@redhat.com> 3.8.6-3
- Add boolean to turn off port forwarding in sshd.
diff --git a/sources b/sources
index 3b6d800..92b8b05 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
4c7d323036f1662a06a7a4f2a7da57a5 config.tgz
-5fa7e359d8016e05ebb27e9b4ec74584 serefpolicy-3.8.6.tgz
+d50240e814f78bdcb7c4e49829f0b18d serefpolicy-3.8.7.tgz