diff --git a/policy-20070703.patch b/policy-20070703.patch
index f284787..5b92dd5 100644
--- a/policy-20070703.patch
+++ b/policy-20070703.patch
@@ -1,6 +1,6 @@
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_contexts serefpolicy-3.0.7/config/appconfig-mcs/default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_contexts serefpolicy-3.0.8/config/appconfig-mcs/default_contexts
--- nsaserefpolicy/config/appconfig-mcs/default_contexts 2007-08-02 08:17:32.000000000 -0400
-+++ serefpolicy-3.0.7/config/appconfig-mcs/default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mcs/default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -1,15 +1,9 @@
-system_r:crond_t:s0 user_r:user_crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 unconfined_r:unconfined_crond_t:s0
-system_r:local_login_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
@@ -26,32 +26,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default
+system_r:sysadm_su_t:s0 system_r:unconfined_t:s0
+system_r:unconfined_t:s0 system_r:unconfined_t:s0
+system_r:xdm_t:s0 system_r:unconfined_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_type serefpolicy-3.0.7/config/appconfig-mcs/default_type
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_type serefpolicy-3.0.8/config/appconfig-mcs/default_type
--- nsaserefpolicy/config/appconfig-mcs/default_type 2007-08-02 08:17:32.000000000 -0400
-+++ serefpolicy-3.0.7/config/appconfig-mcs/default_type 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mcs/default_type 2007-09-17 16:20:18.000000000 -0400
@@ -1,4 +1,4 @@
+system_r:unconfined_t
sysadm_r:sysadm_t
staff_r:staff_t
-unconfined_r:unconfined_t
user_r:user_t
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/failsafe_context serefpolicy-3.0.7/config/appconfig-mcs/failsafe_context
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/failsafe_context serefpolicy-3.0.8/config/appconfig-mcs/failsafe_context
--- nsaserefpolicy/config/appconfig-mcs/failsafe_context 2007-08-02 08:17:32.000000000 -0400
-+++ serefpolicy-3.0.7/config/appconfig-mcs/failsafe_context 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mcs/failsafe_context 2007-09-17 16:20:18.000000000 -0400
@@ -1 +1 @@
-sysadm_r:sysadm_t:s0
+system_r:unconfined_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/guest_u_default_contexts serefpolicy-3.0.7/config/appconfig-mcs/guest_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/guest_u_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/guest_u_default_contexts
--- nsaserefpolicy/config/appconfig-mcs/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/config/appconfig-mcs/guest_u_default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mcs/guest_u_default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,4 @@
+system_r:local_login_t:s0 guest_r:guest_t:s0
+system_r:remote_login_t:s0 guest_r:guest_t:s0
+system_r:sshd_t:s0 guest_r:guest_t:s0
+system_r:crond_t:s0 guest_r:guest_crond_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_default_contexts serefpolicy-3.0.7/config/appconfig-mcs/root_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/root_default_contexts
--- nsaserefpolicy/config/appconfig-mcs/root_default_contexts 2007-08-02 08:17:32.000000000 -0400
-+++ serefpolicy-3.0.7/config/appconfig-mcs/root_default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mcs/root_default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -1,11 +1,10 @@
-system_r:crond_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0
-system_r:local_login_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
@@ -71,17 +71,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_de
-#system_r:sshd_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
+#system_r:sshd_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/seusers serefpolicy-3.0.7/config/appconfig-mcs/seusers
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/seusers serefpolicy-3.0.8/config/appconfig-mcs/seusers
--- nsaserefpolicy/config/appconfig-mcs/seusers 2007-08-02 08:17:32.000000000 -0400
-+++ serefpolicy-3.0.7/config/appconfig-mcs/seusers 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mcs/seusers 2007-09-17 16:20:18.000000000 -0400
@@ -1,3 +1,2 @@
-system_u:system_u:s0-mcs_systemhigh
root:root:s0-mcs_systemhigh
-__default__:user_u:s0
+__default__:system_u:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts serefpolicy-3.0.7/config/appconfig-mcs/staff_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/staff_u_default_contexts
--- nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/config/appconfig-mcs/staff_u_default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mcs/staff_u_default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,9 @@
+system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
+system_r:remote_login_t:s0 staff_r:staff_t:s0
@@ -92,15 +92,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/staff_u
+staff_r:staff_sudo_t:s0 staff_r:staff_t:s0
+sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0
+sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/userhelper_context serefpolicy-3.0.7/config/appconfig-mcs/userhelper_context
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/userhelper_context serefpolicy-3.0.8/config/appconfig-mcs/userhelper_context
--- nsaserefpolicy/config/appconfig-mcs/userhelper_context 2007-08-02 08:17:32.000000000 -0400
-+++ serefpolicy-3.0.7/config/appconfig-mcs/userhelper_context 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mcs/userhelper_context 2007-09-17 16:20:18.000000000 -0400
@@ -1 +1 @@
-system_u:sysadm_r:sysadm_t:s0
+system_u:system_r:unconfined_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts serefpolicy-3.0.7/config/appconfig-mcs/user_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/user_u_default_contexts
--- nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/config/appconfig-mcs/user_u_default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mcs/user_u_default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,7 @@
+system_r:local_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0
+system_r:remote_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0
@@ -109,18 +109,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/user_u_
+system_r:xdm_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0
+user_r:user_su_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0
+user_r:user_sudo_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts serefpolicy-3.0.7/config/appconfig-mcs/xguest_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/xguest_u_default_contexts
--- nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/config/appconfig-mcs/xguest_u_default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mcs/xguest_u_default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,5 @@
+system_r:local_login_t xguest_r:xguest_t:s0
+system_r:remote_login_t xguest_r:xguest_t:s0
+system_r:sshd_t xguest_r:xguest_t:s0
+system_r:crond_t xguest_r:xguest_crond_t:s0
+system_r:xdm_t xguest_r:xguest_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default_contexts serefpolicy-3.0.7/config/appconfig-mls/default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default_contexts serefpolicy-3.0.8/config/appconfig-mls/default_contexts
--- nsaserefpolicy/config/appconfig-mls/default_contexts 2007-08-02 08:17:30.000000000 -0400
-+++ serefpolicy-3.0.7/config/appconfig-mls/default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mls/default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -1,15 +1,12 @@
-system_r:crond_t:s0 user_r:user_crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 unconfined_r:unconfined_crond_t:s0
-system_r:local_login_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
@@ -148,29 +148,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default
-user_r:user_sudo_t:s0 sysadm_r:sysadm_t:s0 user_r:user_t:s0
+staff_r:staff_sudo_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0
+user_r:user_sudo_t:s0 sysadm_r:sysadm_t:s0 user_r:user_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default_type serefpolicy-3.0.7/config/appconfig-mls/default_type
---- nsaserefpolicy/config/appconfig-mls/default_type 2007-08-02 08:17:30.000000000 -0400
-+++ serefpolicy-3.0.7/config/appconfig-mls/default_type 2007-09-06 15:43:06.000000000 -0400
-@@ -1,6 +1,5 @@
--auditadm_r:auditadm_t
--secadm_r:secadm_t
- sysadm_r:sysadm_t
-+secadm_r:secadm_t
- staff_r:staff_t
--unconfined_r:unconfined_t
- user_r:user_t
-+auditadm_r:auditadm_t
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/guest_u_default_contexts serefpolicy-3.0.7/config/appconfig-mls/guest_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/guest_u_default_contexts serefpolicy-3.0.8/config/appconfig-mls/guest_u_default_contexts
--- nsaserefpolicy/config/appconfig-mls/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/config/appconfig-mls/guest_u_default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mls/guest_u_default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,4 @@
+system_r:local_login_t:s0 guest_r:guest_t:s0
+system_r:remote_login_t:s0 guest_r:guest_t:s0
+system_r:sshd_t:s0 guest_r:guest_t:s0
+system_r:crond_t:s0 guest_r:guest_crond_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/root_default_contexts serefpolicy-3.0.7/config/appconfig-mls/root_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/root_default_contexts serefpolicy-3.0.8/config/appconfig-mls/root_default_contexts
--- nsaserefpolicy/config/appconfig-mls/root_default_contexts 2007-08-02 08:17:30.000000000 -0400
-+++ serefpolicy-3.0.7/config/appconfig-mls/root_default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mls/root_default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -1,11 +1,9 @@
-system_r:crond_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0
-system_r:local_login_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
@@ -189,9 +177,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/root_de
#
-#system_r:sshd_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
+#system_r:sshd_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/staff_u_default_contexts serefpolicy-3.0.7/config/appconfig-mls/staff_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/staff_u_default_contexts serefpolicy-3.0.8/config/appconfig-mls/staff_u_default_contexts
--- nsaserefpolicy/config/appconfig-mls/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/config/appconfig-mls/staff_u_default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mls/staff_u_default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,9 @@
+system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
+system_r:remote_login_t:s0 staff_r:staff_t:s0
@@ -202,9 +190,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/staff_u
+staff_r:staff_sudo_t:s0 staff_r:staff_t:s0
+sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0
+sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/user_u_default_contexts serefpolicy-3.0.7/config/appconfig-mls/user_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/user_u_default_contexts serefpolicy-3.0.8/config/appconfig-mls/user_u_default_contexts
--- nsaserefpolicy/config/appconfig-mls/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/config/appconfig-mls/user_u_default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-mls/user_u_default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,7 @@
+system_r:local_login_t:s0 user_r:user_t:s0
+system_r:remote_login_t:s0 user_r:user_t:s0
@@ -213,17 +201,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/user_u_
+system_r:xdm_t:s0 user_r:user_t:s0
+user_r:user_su_t:s0 user_r:user_t:s0
+user_r:user_sudo_t:s0 user_r:user_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/guest_u_default_contexts serefpolicy-3.0.7/config/appconfig-standard/guest_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/guest_u_default_contexts serefpolicy-3.0.8/config/appconfig-standard/guest_u_default_contexts
--- nsaserefpolicy/config/appconfig-standard/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/config/appconfig-standard/guest_u_default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-standard/guest_u_default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,4 @@
+system_r:local_login_t guest_r:guest_t
+system_r:remote_login_t guest_r:guest_t
+system_r:sshd_t guest_r:guest_t
+system_r:crond_t guest_r:guest_crond_t
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/staff_u_default_contexts serefpolicy-3.0.7/config/appconfig-standard/staff_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/staff_u_default_contexts serefpolicy-3.0.8/config/appconfig-standard/staff_u_default_contexts
--- nsaserefpolicy/config/appconfig-standard/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/config/appconfig-standard/staff_u_default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-standard/staff_u_default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,9 @@
+system_r:local_login_t staff_r:staff_t sysadm_r:sysadm_t
+system_r:remote_login_t staff_r:staff_t
@@ -234,9 +222,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/st
+staff_r:staff_sudo_t staff_r:staff_t
+sysadm_r:sysadm_su_t sysadm_r:sysadm_t
+sysadm_r:sysadm_sudo_t sysadm_r:sysadm_t
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/user_u_default_contexts serefpolicy-3.0.7/config/appconfig-standard/user_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/user_u_default_contexts serefpolicy-3.0.8/config/appconfig-standard/user_u_default_contexts
--- nsaserefpolicy/config/appconfig-standard/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/config/appconfig-standard/user_u_default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-standard/user_u_default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,7 @@
+system_r:local_login_t system_r:unconfined_t user_r:user_t
+system_r:remote_login_t system_r:unconfined_t user_r:user_t
@@ -245,18 +233,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/us
+system_r:xdm_t system_r:unconfined_t user_r:user_t
+user_r:user_su_t system_r:unconfined_t user_r:user_t
+user_r:user_sudo_t system_r:unconfined_t user_r:user_t
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/xguest_u_default_contexts serefpolicy-3.0.7/config/appconfig-standard/xguest_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/xguest_u_default_contexts serefpolicy-3.0.8/config/appconfig-standard/xguest_u_default_contexts
--- nsaserefpolicy/config/appconfig-standard/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/config/appconfig-standard/xguest_u_default_contexts 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/config/appconfig-standard/xguest_u_default_contexts 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,5 @@
+system_r:local_login_t xguest_r:xguest_t
+system_r:remote_login_t xguest_r:xguest_t
+system_r:sshd_t xguest_r:xguest_t
+system_r:crond_t xguest_r:xguest_crond_t
+system_r:xdm_t xguest_r:xguest_t
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.0.7/man/man8/ftpd_selinux.8
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.0.8/man/man8/ftpd_selinux.8
--- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-05-25 09:09:10.000000000 -0400
-+++ serefpolicy-3.0.7/man/man8/ftpd_selinux.8 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/man/man8/ftpd_selinux.8 2007-09-17 16:20:18.000000000 -0400
@@ -12,7 +12,7 @@
.TP
chcon -R -t public_content_t /var/ftp
@@ -266,9 +254,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 sere
.TP
chcon -t public_content_rw_t /var/ftp/incoming
.TP
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/httpd_selinux.8 serefpolicy-3.0.7/man/man8/httpd_selinux.8
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/httpd_selinux.8 serefpolicy-3.0.8/man/man8/httpd_selinux.8
--- nsaserefpolicy/man/man8/httpd_selinux.8 2007-05-25 09:09:10.000000000 -0400
-+++ serefpolicy-3.0.7/man/man8/httpd_selinux.8 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/man/man8/httpd_selinux.8 2007-09-17 16:20:18.000000000 -0400
@@ -30,7 +30,7 @@
.EX
httpd_sys_script_ro_t
@@ -278,9 +266,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/httpd_selinux.8 ser
.EX
httpd_sys_script_rw_t
.EE
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.0.7/policy/flask/access_vectors
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.0.8/policy/flask/access_vectors
--- nsaserefpolicy/policy/flask/access_vectors 2007-08-22 07:14:04.000000000 -0400
-+++ serefpolicy-3.0.7/policy/flask/access_vectors 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/flask/access_vectors 2007-09-17 16:20:18.000000000 -0400
@@ -639,6 +639,8 @@
send
recv
@@ -290,9 +278,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors
}
class key
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.0.7/policy/global_tunables
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.0.8/policy/global_tunables
--- nsaserefpolicy/policy/global_tunables 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.7/policy/global_tunables 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/global_tunables 2007-09-17 16:20:18.000000000 -0400
@@ -133,3 +133,18 @@
## </desc>
gen_tunable(write_untrusted_content,false)
@@ -312,9 +300,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref
+## </desc>
+gen_tunable(xen_use_nfs,false)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.0.7/policy/modules/admin/alsa.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.0.8/policy/modules/admin/alsa.fc
--- nsaserefpolicy/policy/modules/admin/alsa.fc 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/alsa.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/alsa.fc 2007-09-17 16:20:18.000000000 -0400
@@ -1,4 +1,7 @@
/etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)
@@ -323,9 +311,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc
/usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0)
+/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.0.7/policy/modules/admin/alsa.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.0.8/policy/modules/admin/alsa.te
--- nsaserefpolicy/policy/modules/admin/alsa.te 2007-07-25 10:37:43.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/alsa.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/alsa.te 2007-09-17 16:20:18.000000000 -0400
@@ -19,20 +19,24 @@
# Local policy
#
@@ -368,9 +356,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te
+ hal_use_fds(alsa_t)
+ hal_write_log(alsa_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.if serefpolicy-3.0.7/policy/modules/admin/amanda.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.if serefpolicy-3.0.8/policy/modules/admin/amanda.if
--- nsaserefpolicy/policy/modules/admin/amanda.if 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/amanda.if 2007-09-11 08:55:05.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/amanda.if 2007-09-17 16:20:18.000000000 -0400
@@ -71,6 +71,26 @@
########################################
@@ -403,9 +391,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.
allow $1 amanda_log_t:file { read_file_perms append_file_perms };
')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.te serefpolicy-3.0.7/policy/modules/admin/amanda.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.te serefpolicy-3.0.8/policy/modules/admin/amanda.te
--- nsaserefpolicy/policy/modules/admin/amanda.te 2007-07-25 10:37:43.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/amanda.te 2007-09-11 08:54:52.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/amanda.te 2007-09-17 16:20:18.000000000 -0400
@@ -74,7 +74,6 @@
allow amanda_t self:unix_dgram_socket create_socket_perms;
allow amanda_t self:tcp_socket create_stream_socket_perms;
@@ -471,9 +459,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.
-optional_policy(`
- nscd_socket_use(amanda_recover_t)
-')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.0.7/policy/modules/admin/anaconda.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.0.8/policy/modules/admin/anaconda.te
--- nsaserefpolicy/policy/modules/admin/anaconda.te 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/anaconda.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/anaconda.te 2007-09-17 16:20:18.000000000 -0400
@@ -31,16 +31,13 @@
modutils_domtrans_insmod(anaconda_t)
@@ -492,32 +480,45 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anacond
kudzu_domtrans(anaconda_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-3.0.7/policy/modules/admin/bootloader.te
---- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-08-22 07:14:14.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/bootloader.te 2007-09-06 15:43:06.000000000 -0400
-@@ -180,6 +180,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/brctl.if serefpolicy-3.0.8/policy/modules/admin/brctl.if
+--- nsaserefpolicy/policy/modules/admin/brctl.if 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/brctl.if 2007-09-17 16:20:18.000000000 -0400
+@@ -17,3 +17,21 @@
- optional_policy(`
- hal_dontaudit_append_lib_files(bootloader_t)
-+ hal_write_log(bootloader_t)
+ domtrans_pattern($1,brctl_exec_t,brctl_t)
')
++
++########################################
++## <summary>
++## Get attributes brctl executable.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`brctl_getattr',`
++ gen_require(`
++ type brctl_exec_t;
++ ')
++
++ allow $1 brctl_exec_t:file getattr;
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/brctl.te serefpolicy-3.0.8/policy/modules/admin/brctl.te
+--- nsaserefpolicy/policy/modules/admin/brctl.te 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/brctl.te 2007-09-17 16:20:18.000000000 -0400
+@@ -25,6 +25,7 @@
+ kernel_read_network_state(brctl_t)
+ kernel_read_sysctl(brctl_t)
- optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/certwatch.if serefpolicy-3.0.7/policy/modules/admin/certwatch.if
---- nsaserefpolicy/policy/modules/admin/certwatch.if 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/certwatch.if 2007-09-06 15:43:06.000000000 -0400
-@@ -44,7 +44,7 @@
- ## </param>
- ## <rolecap/>
- #
--interface(`certwatach_run',`
-+interface(`certwatch_run',`
- gen_require(`
- type certwatch_t;
- ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.0.7/policy/modules/admin/consoletype.te
++dev_write_sysfs_dirs(brctl_t)
+ dev_rw_sysfs(brctl_t)
+
+ # Init script handling
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.0.8/policy/modules/admin/consoletype.te
--- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-08-22 07:14:14.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/consoletype.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/consoletype.te 2007-09-17 16:20:18.000000000 -0400
@@ -8,9 +8,11 @@
type consoletype_t;
@@ -561,9 +562,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console
+optional_policy(`
+ unconfined_use_terminals(consoletype_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmidecode.te serefpolicy-3.0.7/policy/modules/admin/dmidecode.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmidecode.te serefpolicy-3.0.8/policy/modules/admin/dmidecode.te
--- nsaserefpolicy/policy/modules/admin/dmidecode.te 2007-08-22 07:14:14.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/dmidecode.te 2007-09-07 17:05:59.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/dmidecode.te 2007-09-17 16:20:18.000000000 -0400
@@ -20,6 +20,7 @@
# Allow dmidecode to read /dev/mem
@@ -572,9 +573,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmideco
mls_file_read_all_levels(dmidecode_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstboot.te serefpolicy-3.0.7/policy/modules/admin/firstboot.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstboot.te serefpolicy-3.0.8/policy/modules/admin/firstboot.te
--- nsaserefpolicy/policy/modules/admin/firstboot.te 2007-07-25 10:37:43.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/firstboot.te 2007-09-06 19:24:23.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/firstboot.te 2007-09-17 16:20:18.000000000 -0400
@@ -120,6 +120,10 @@
usermanage_domtrans_admin_passwd(firstboot_t)
')
@@ -594,9 +595,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstbo
- domain_auto_trans(firstboot_t, xserver_exec_t, xdm_xserver_t)
-')
') dnl end TODO
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.0.7/policy/modules/admin/kudzu.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.0.8/policy/modules/admin/kudzu.te
--- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-08-22 07:14:14.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/kudzu.te 2007-09-06 19:20:53.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/kudzu.te 2007-09-17 16:20:18.000000000 -0400
@@ -21,8 +21,8 @@
# Local policy
#
@@ -641,18 +642,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t
')
ifdef(`TODO',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.0.7/policy/modules/admin/logrotate.te
---- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-08-22 07:14:14.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/logrotate.te 2007-09-06 15:43:06.000000000 -0400
-@@ -80,6 +80,7 @@
- selinux_get_enforce_mode(logrotate_t)
-
- auth_manage_login_records(logrotate_t)
-+auth_use_nsswitch(logrotate_t)
-
- # Run helper programs.
- corecmd_exec_bin(logrotate_t)
-@@ -95,6 +96,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.0.8/policy/modules/admin/logrotate.te
+--- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/logrotate.te 2007-09-17 16:20:18.000000000 -0400
+@@ -96,6 +96,7 @@
files_read_etc_files(logrotate_t)
files_read_etc_runtime_files(logrotate_t)
files_read_all_pids(logrotate_t)
@@ -660,42 +653,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota
# Write to /var/spool/slrnpull - should be moved into its own type.
files_manage_generic_spool(logrotate_t)
files_manage_generic_spool_dirs(logrotate_t)
-@@ -114,8 +116,6 @@
-
- seutil_dontaudit_read_config(logrotate_t)
-
--sysnet_read_config(logrotate_t)
--
- userdom_dontaudit_search_sysadm_home_dirs(logrotate_t)
- userdom_use_unpriv_users_fds(logrotate_t)
-
-@@ -177,14 +177,6 @@
- ')
-
- optional_policy(`
-- nis_use_ypbind(logrotate_t)
--')
--
--optional_policy(`
-- nscd_socket_use(logrotate_t)
--')
--
--optional_policy(`
- slrnpull_manage_spool(logrotate_t)
- ')
-
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.0.7/policy/modules/admin/logwatch.te
---- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-07-25 10:37:43.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/logwatch.te 2007-09-06 15:43:06.000000000 -0400
-@@ -29,7 +29,6 @@
- allow logwatch_t self:process signal;
- allow logwatch_t self:fifo_file rw_file_perms;
- allow logwatch_t self:unix_stream_socket create_stream_socket_perms;
--allow logwatch_t self:netlink_route_socket r_netlink_socket_perms;
-
- manage_dirs_pattern(logwatch_t,logwatch_cache_t,logwatch_cache_t)
- manage_files_pattern(logwatch_t,logwatch_cache_t,logwatch_cache_t)
-@@ -49,7 +48,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.0.8/policy/modules/admin/logwatch.te
+--- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/logwatch.te 2007-09-17 16:20:18.000000000 -0400
+@@ -48,7 +48,7 @@
corecmd_exec_shell(logwatch_t)
dev_read_urand(logwatch_t)
@@ -704,51 +665,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc
# Read /proc/PID directories for all domains.
domain_read_all_domains_state(logwatch_t)
-@@ -68,6 +67,9 @@
- fs_getattr_all_fs(logwatch_t)
- fs_dontaudit_list_auto_mountpoints(logwatch_t)
-
-+init_read_utmp(logwatch_t)
-+init_dontaudit_write_utmp(logwatch_t)
-+
- term_dontaudit_getattr_pty_dirs(logwatch_t)
- term_dontaudit_list_ptys(logwatch_t)
-
-@@ -96,6 +98,10 @@
- ')
-
- optional_policy(`
-+ auth_use_nsswitch(logwatch_t)
-+')
-+
-+optional_policy(`
- avahi_dontaudit_search_pid(logwatch_t)
- ')
-
-@@ -117,14 +123,6 @@
- ')
-
- optional_policy(`
-- nis_use_ypbind(logwatch_t)
--')
--
--optional_policy(`
-- nscd_socket_use(logwatch_t)
--')
--
--optional_policy(`
- ntp_domtrans(logwatch_t)
- ')
-
-@@ -134,4 +132,5 @@
+@@ -132,4 +132,5 @@
optional_policy(`
samba_read_log(logwatch_t)
+ samba_read_share_files(logwatch_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.0.7/policy/modules/admin/netutils.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.0.8/policy/modules/admin/netutils.te
--- nsaserefpolicy/policy/modules/admin/netutils.te 2007-07-25 10:37:43.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/netutils.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/netutils.te 2007-09-17 16:20:18.000000000 -0400
@@ -94,9 +94,18 @@
')
@@ -776,9 +701,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil
corenet_tcp_sendrecv_all_nodes(ping_t)
corenet_tcp_sendrecv_all_ports(ping_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.if serefpolicy-3.0.7/policy/modules/admin/portage.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.if serefpolicy-3.0.8/policy/modules/admin/portage.if
--- nsaserefpolicy/policy/modules/admin/portage.if 2007-07-03 07:06:36.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/portage.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/portage.if 2007-09-17 16:20:18.000000000 -0400
@@ -324,6 +324,7 @@
seutil_domtrans_setfiles($1)
# run semodule
@@ -787,9 +712,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage
portage_domtrans_gcc_config($1)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.0.7/policy/modules/admin/prelink.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.0.8/policy/modules/admin/prelink.te
--- nsaserefpolicy/policy/modules/admin/prelink.te 2007-08-02 08:17:29.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/prelink.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/prelink.te 2007-09-17 16:20:18.000000000 -0400
@@ -26,7 +26,7 @@
# Local policy
#
@@ -839,74 +764,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink
optional_policy(`
amanda_manage_lib(prelink_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.fc serefpolicy-3.0.7/policy/modules/admin/readahead.fc
---- nsaserefpolicy/policy/modules/admin/readahead.fc 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/readahead.fc 2007-09-06 15:43:06.000000000 -0400
-@@ -2,3 +2,4 @@
- # /usr
- #
- /usr/sbin/readahead -- gen_context(system_u:object_r:readahead_exec_t,s0)
-+/etc/readahead.d(/.*)? gen_context(system_u:object_r:readahead_etc_rw_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.0.7/policy/modules/admin/readahead.te
---- nsaserefpolicy/policy/modules/admin/readahead.te 2007-08-22 07:14:14.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/readahead.te 2007-09-06 15:43:06.000000000 -0400
-@@ -9,19 +9,24 @@
- type readahead_t;
- type readahead_exec_t;
- init_daemon_domain(readahead_t,readahead_exec_t)
--application_domain(readahead_t,readahead_exec_t)
-
- type readahead_var_run_t;
- files_pid_file(readahead_var_run_t)
-
-+type readahead_etc_rw_t;
-+files_pid_file(readahead_etc_rw_t)
-+
- ########################################
- #
- # Local policy
- #
-
--dontaudit readahead_t self:capability { dac_override dac_read_search sys_tty_config };
-+allow readahead_t self:capability { dac_override dac_read_search };
-+dontaudit readahead_t self:capability sys_tty_config;
- allow readahead_t self:process signal_perms;
-
-+manage_files_pattern(readahead_t,readahead_etc_rw_t,readahead_etc_rw_t)
-+
- manage_files_pattern(readahead_t,readahead_var_run_t,readahead_var_run_t)
- files_pid_filetrans(readahead_t,readahead_var_run_t,file)
-
-@@ -37,7 +42,7 @@
- dev_dontaudit_read_all_blk_files(readahead_t)
- dev_dontaudit_getattr_memory_dev(readahead_t)
- dev_dontaudit_getattr_nvram_dev(readahead_t)
--storage_dontaudit_getattr_fixed_disk_dev(readahead_t)
-+storage_raw_read_fixed_disk(readahead_t)
-
- domain_use_interactive_fds(readahead_t)
-
-@@ -68,6 +73,7 @@
- libs_use_shared_libs(readahead_t)
-
- logging_send_syslog_msg(readahead_t)
-+logging_dontaudit_search_audit_config(readahead_t)
-
- miscfiles_read_localization(readahead_t)
-
-@@ -75,5 +81,9 @@
- userdom_dontaudit_search_sysadm_home_dirs(readahead_t)
-
- optional_policy(`
-+ cron_system_entry(readahead_t, readahead_exec_t)
-+')
-+
-+optional_policy(`
- seutil_sigchld_newrole(readahead_t)
- ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.0.7/policy/modules/admin/rpm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.0.8/policy/modules/admin/rpm.fc
--- nsaserefpolicy/policy/modules/admin/rpm.fc 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/rpm.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/rpm.fc 2007-09-17 16:20:18.000000000 -0400
@@ -21,6 +21,9 @@
/usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -917,9 +777,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
')
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.7/policy/modules/admin/rpm.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.8/policy/modules/admin/rpm.if
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/rpm.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/rpm.if 2007-09-17 16:20:18.000000000 -0400
@@ -210,6 +210,24 @@
########################################
@@ -1061,9 +921,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
+
+ dontaudit $1 rpm_t:shm rw_shm_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.7/policy/modules/admin/rpm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.8/policy/modules/admin/rpm.te
--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-08-22 07:14:14.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/rpm.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/rpm.te 2007-09-17 16:20:18.000000000 -0400
@@ -321,6 +321,7 @@
seutil_domtrans_loadpolicy(rpm_script_t)
seutil_domtrans_setfiles(rpm_script_t)
@@ -1072,9 +932,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
userdom_use_all_users_fds(rpm_script_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.7/policy/modules/admin/sudo.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.8/policy/modules/admin/sudo.if
--- nsaserefpolicy/policy/modules/admin/sudo.if 2007-07-25 10:37:43.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/sudo.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/sudo.if 2007-09-17 16:20:18.000000000 -0400
@@ -55,7 +55,7 @@
#
@@ -1146,9 +1006,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
nis_use_ypbind($1_sudo_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.7/policy/modules/admin/su.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.8/policy/modules/admin/su.if
--- nsaserefpolicy/policy/modules/admin/su.if 2007-08-22 07:14:14.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/su.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/su.if 2007-09-17 16:20:18.000000000 -0400
@@ -41,12 +41,11 @@
allow $2 $1_su_t:process signal;
@@ -1243,19 +1103,37 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s
ifdef(`TODO',`
allow $1_su_t $1_home_t:file manage_file_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.0.7/policy/modules/admin/usermanage.if
---- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/usermanage.if 2007-09-06 15:43:06.000000000 -0400
-@@ -278,5 +278,5 @@
- type crack_db_t;
- ')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.0.8/policy/modules/admin/usermanage.if
+--- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/usermanage.if 2007-09-17 16:20:18.000000000 -0400
+@@ -265,6 +265,24 @@
-- allow $1 crack_db_t:file read_file_perms;
-+ read_files_pattern($1,crack_db_t,crack_db_t)
- ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.0.7/policy/modules/admin/usermanage.te
---- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-08-22 07:14:14.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/usermanage.te 2007-09-06 15:43:06.000000000 -0400
+ ########################################
+ ## <summary>
++## Dontaudit attempts to use useradd fds
++## </summary>
++## <param name="domain">
++## <summary>
++## The type of the process performing this action.
++## </summary>
++## </param>
++#
++interface(`usermanage_dontaudit_useradd_use_fds',`
++ gen_require(`
++ type useradd_t;
++ ')
++
++ dontaudit $1 useradd_t:fd use;
++')
++
++########################################
++## <summary>
+ ## Read the crack database.
+ ## </summary>
+ ## <param name="domain">
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.0.8/policy/modules/admin/usermanage.te
+--- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/admin/usermanage.te 2007-09-17 16:20:18.000000000 -0400
@@ -92,6 +92,7 @@
dev_read_urand(chfn_t)
@@ -1264,113 +1142,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
auth_dontaudit_read_shadow(chfn_t)
# allow checking if a shell is executable
-@@ -191,7 +192,6 @@
- allow groupadd_t self:unix_stream_socket create_stream_socket_perms;
- allow groupadd_t self:unix_dgram_socket sendto;
- allow groupadd_t self:unix_stream_socket connectto;
--allow groupadd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
-
- fs_getattr_xattr_fs(groupadd_t)
- fs_search_auto_mountpoints(groupadd_t)
-@@ -223,6 +223,7 @@
- # Execute /usr/bin/{passwd,chfn,chsh} and /usr/sbin/{useradd,vipw}.
- corecmd_exec_bin(groupadd_t)
-
-+logging_send_audit_msgs(groupadd_t)
- logging_send_syslog_msg(groupadd_t)
-
- miscfiles_read_localization(groupadd_t)
-@@ -245,8 +246,13 @@
- ')
-
- optional_policy(`
-+ nscd_domtrans(groupadd_t)
-+')
-+
-+optional_policy(`
- rpm_use_fds(groupadd_t)
- rpm_rw_pipes(groupadd_t)
-+ rpm_dontaudit_rw_tmp_files(groupadd_t)
- ')
-
- ########################################
-@@ -254,7 +260,7 @@
- # Passwd local policy
- #
-
--allow passwd_t self:capability { chown dac_override fsetid setuid setgid sys_resource audit_control audit_write };
-+allow passwd_t self:capability { chown dac_override fsetid setuid setgid sys_resource };
- allow passwd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
- allow passwd_t self:process { setrlimit setfscreate };
- allow passwd_t self:fd use;
-@@ -264,7 +270,6 @@
- allow passwd_t self:unix_stream_socket create_stream_socket_perms;
- allow passwd_t self:unix_dgram_socket sendto;
- allow passwd_t self:unix_stream_socket connectto;
--allow passwd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
- allow passwd_t self:shm create_shm_perms;
- allow passwd_t self:sem create_sem_perms;
- allow passwd_t self:msgq create_msgq_perms;
-@@ -316,6 +321,7 @@
- libs_use_ld_so(passwd_t)
- libs_use_shared_libs(passwd_t)
-
-+logging_send_audit_msgs(passwd_t)
- logging_send_syslog_msg(passwd_t)
-
- miscfiles_read_localization(passwd_t)
-@@ -336,6 +342,7 @@
-
- optional_policy(`
- nscd_socket_use(passwd_t)
-+ nscd_domtrans(passwd_t)
- ')
-
- ########################################
-@@ -426,6 +433,7 @@
-
- optional_policy(`
- nscd_socket_use(sysadm_passwd_t)
-+ nscd_domtrans(sysadm_passwd_t)
- ')
-
- ########################################
-@@ -433,7 +441,7 @@
- # Useradd local policy
- #
-
--allow useradd_t self:capability { dac_override chown kill fowner fsetid setuid sys_resource audit_write };
-+allow useradd_t self:capability { dac_override chown kill fowner fsetid setuid sys_resource };
- dontaudit useradd_t self:capability sys_tty_config;
- allow useradd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
- allow useradd_t self:process setfscreate;
-@@ -447,7 +455,6 @@
- allow useradd_t self:unix_stream_socket create_stream_socket_perms;
- allow useradd_t self:unix_dgram_socket sendto;
- allow useradd_t self:unix_stream_socket connectto;
--allow useradd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
-
- # for getting the number of groups
- kernel_read_kernel_sysctls(useradd_t)
-@@ -492,6 +499,7 @@
- libs_use_ld_so(useradd_t)
- libs_use_shared_libs(useradd_t)
-
-+logging_send_audit_msgs(useradd_t)
- logging_send_syslog_msg(useradd_t)
-
- miscfiles_read_localization(useradd_t)
-@@ -501,6 +509,9 @@
- seutil_read_default_contexts(useradd_t)
- seutil_domtrans_semanage(useradd_t)
- seutil_domtrans_setfiles(useradd_t)
-+# Required because semanage execs these and hands them useradd_t:fd
-+seutil_domtrans_setfiles(useradd_t)
-+seutil_domtrans_loadpolicy(useradd_t)
-
- userdom_use_unpriv_users_fds(useradd_t)
- # for when /root is the cwd
-@@ -514,11 +525,26 @@
+@@ -520,6 +521,10 @@
mta_manage_spool(useradd_t)
optional_policy(`
@@ -1381,12 +1153,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
dpkg_use_fds(useradd_t)
dpkg_rw_pipes(useradd_t)
')
+@@ -529,6 +534,12 @@
+ ')
optional_policy(`
-+ nscd_domtrans(useradd_t)
-+')
-+
-+optional_policy(`
+ tunable_policy(`samba_domain_controller',`
+ samba_append_log(useradd_t)
+ ')
@@ -1395,20 +1165,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
+optional_policy(`
rpm_use_fds(useradd_t)
rpm_rw_pipes(useradd_t)
-+ rpm_dontaudit_rw_tmp_files(useradd_t)
- ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.0.7/policy/modules/admin/vbetool.te
---- nsaserefpolicy/policy/modules/admin/vbetool.te 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/admin/vbetool.te 2007-09-06 15:43:06.000000000 -0400
-@@ -32,4 +32,5 @@
-
- optional_policy(`
- hal_rw_pid_files(vbetool_t)
-+ hal_write_log(vbetool_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if serefpolicy-3.0.7/policy/modules/apps/ada.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if serefpolicy-3.0.8/policy/modules/apps/ada.if
--- nsaserefpolicy/policy/modules/apps/ada.if 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/ada.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/ada.if 2007-09-17 16:20:18.000000000 -0400
@@ -18,3 +18,34 @@
corecmd_search_bin($1)
domtrans_pattern($1, ada_exec_t, ada_t)
@@ -1444,38 +1204,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if s
+ role $2 types ada_t;
+ allow ada_t $3:chr_file rw_term_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc serefpolicy-3.0.7/policy/modules/apps/games.fc
---- nsaserefpolicy/policy/modules/apps/games.fc 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/games.fc 2007-09-06 15:43:06.000000000 -0400
-@@ -1,22 +1,16 @@
- #
- # /usr
- #
--/usr/games/powermanga -- gen_context(system_u:object_r:games_exec_t,s0)
--/usr/games/nethack-3.4.3/nethack -- gen_context(system_u:object_r:games_exec_t,s0)
--/usr/games/vulturesclaw/vulturesclaw -- gen_context(system_u:object_r:games_exec_t,s0)
--/usr/games/vultureseye/vultureseye -- gen_context(system_u:object_r:games_exec_t,s0)
--
- /usr/lib/games(/.*)? gen_context(system_u:object_r:games_exec_t,s0)
-+/usr/games/.* -- gen_context(system_u:object_r:games_exec_t,s0)
-
- #
- # /var
- #
- /var/lib/games(/.*)? gen_context(system_u:object_r:games_data_t,s0)
--
--ifdef(`distro_debian', `
--/usr/games/.* -- gen_context(system_u:object_r:games_exec_t,s0)
- /var/games(/.*)? gen_context(system_u:object_r:games_data_t,s0)
--', `
-+
-+ifdef(`distro_debian', `', `
- /usr/bin/micq -- gen_context(system_u:object_r:games_exec_t,s0)
- /usr/bin/blackjack -- gen_context(system_u:object_r:games_exec_t,s0)
- /usr/bin/gataxx -- gen_context(system_u:object_r:games_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.0.7/policy/modules/apps/gnome.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.0.8/policy/modules/apps/gnome.fc
--- nsaserefpolicy/policy/modules/apps/gnome.fc 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/gnome.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/gnome.fc 2007-09-17 16:20:18.000000000 -0400
@@ -1,8 +1,7 @@
+HOME_DIR/.gnome2(/.*)? gen_context(system_u:object_r:ROLE_gnome_home_t,s0)
HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:ROLE_gnome_home_t,s0)
@@ -1486,9 +1217,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc
/tmp/gconfd-USER/.* -- gen_context(system_u:object_r:ROLE_gconf_tmp_t,s0)
/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.0.7/policy/modules/apps/gnome.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.0.8/policy/modules/apps/gnome.if
--- nsaserefpolicy/policy/modules/apps/gnome.if 2007-07-25 10:37:37.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/gnome.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/gnome.if 2007-09-17 16:20:18.000000000 -0400
@@ -33,6 +33,51 @@
## </param>
#
@@ -1674,9 +1405,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
+ can_exec($1, gconfd_exec_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.0.7/policy/modules/apps/gnome.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.0.8/policy/modules/apps/gnome.te
--- nsaserefpolicy/policy/modules/apps/gnome.te 2007-07-25 10:37:37.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/gnome.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/gnome.te 2007-09-17 16:20:18.000000000 -0400
@@ -8,8 +8,5 @@
attribute gnomedomain;
@@ -1686,9 +1417,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te
-
type gconfd_exec_t;
application_executable_file(gconfd_exec_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.0.7/policy/modules/apps/java.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.0.8/policy/modules/apps/java.fc
--- nsaserefpolicy/policy/modules/apps/java.fc 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/java.fc 2007-09-06 19:17:45.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/java.fc 2007-09-17 16:20:18.000000000 -0400
@@ -11,6 +11,7 @@
#
/usr/(.*/)?bin/java.* -- gen_context(system_u:object_r:java_exec_t,s0)
@@ -1707,9 +1438,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc
+
+/usr/lib/jvm/java(.*/)bin(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.7/policy/modules/apps/java.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.8/policy/modules/apps/java.if
--- nsaserefpolicy/policy/modules/apps/java.if 2007-08-02 08:17:26.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/java.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/java.if 2007-09-17 16:20:18.000000000 -0400
@@ -32,7 +32,7 @@
## </summary>
## </param>
@@ -1850,9 +1581,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
+ role $2 types java_t;
+ allow java_t $3:chr_file rw_term_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.0.7/policy/modules/apps/java.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.0.8/policy/modules/apps/java.te
--- nsaserefpolicy/policy/modules/apps/java.te 2007-07-25 10:37:37.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/java.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/java.te 2007-09-17 16:20:18.000000000 -0400
@@ -31,3 +31,7 @@
unconfined_domain_noaudit(java_t)
unconfined_dbus_chat(java_t)
@@ -1861,30 +1592,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te
+optional_policy(`
+ xserver_xdm_rw_shm(java_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.0.7/policy/modules/apps/loadkeys.te
---- nsaserefpolicy/policy/modules/apps/loadkeys.te 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/loadkeys.te 2007-09-06 15:43:06.000000000 -0400
-@@ -30,7 +30,7 @@
- files_read_etc_runtime_files(loadkeys_t)
-
- term_dontaudit_use_console(loadkeys_t)
--term_dontaudit_use_unallocated_ttys(loadkeys_t)
-+term_use_unallocated_ttys(loadkeys_t)
-
- init_dontaudit_use_script_ptys(loadkeys_t)
-
-@@ -40,3 +40,8 @@
- locallogin_use_fds(loadkeys_t)
-
- miscfiles_read_localization(loadkeys_t)
-+
-+optional_policy(`
-+ nscd_dontaudit_search_pid(loadkeys_t)
-+')
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.0.7/policy/modules/apps/mono.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.0.8/policy/modules/apps/mono.if
--- nsaserefpolicy/policy/modules/apps/mono.if 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/mono.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/mono.if 2007-09-17 16:20:18.000000000 -0400
@@ -18,3 +18,98 @@
corecmd_search_bin($1)
domtrans_pattern($1, mono_exec_t, mono_t)
@@ -1984,9 +1694,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if
+ xserver_xdm_rw_shm($1_mono_t)
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.0.7/policy/modules/apps/mono.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.0.8/policy/modules/apps/mono.te
--- nsaserefpolicy/policy/modules/apps/mono.te 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/mono.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/mono.te 2007-09-17 16:20:18.000000000 -0400
@@ -46,3 +46,7 @@
unconfined_dbus_chat(mono_t)
unconfined_dbus_connect(mono_t)
@@ -1995,9 +1705,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te
+optional_policy(`
+ xserver_xdm_rw_shm(mono_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.7/policy/modules/apps/mozilla.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.8/policy/modules/apps/mozilla.if
--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-08-02 08:17:26.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/mozilla.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/mozilla.if 2007-09-17 16:20:18.000000000 -0400
@@ -36,6 +36,8 @@
gen_require(`
type mozilla_conf_t, mozilla_exec_t;
@@ -2341,9 +2051,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
+
+ allow $2 $1_mozilla_t:unix_stream_socket connectto;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.0.7/policy/modules/apps/mozilla.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.0.8/policy/modules/apps/mozilla.te
--- nsaserefpolicy/policy/modules/apps/mozilla.te 2007-07-25 10:37:37.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/mozilla.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/mozilla.te 2007-09-17 16:20:18.000000000 -0400
@@ -6,13 +6,6 @@
# Declarations
#
@@ -2358,21 +2068,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
type mozilla_conf_t;
files_config_file(mozilla_conf_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.0.7/policy/modules/apps/slocate.te
---- nsaserefpolicy/policy/modules/apps/slocate.te 2007-07-25 10:37:37.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/slocate.te 2007-09-06 15:43:06.000000000 -0400
-@@ -29,6 +29,8 @@
- manage_dirs_pattern(locate_t,locate_var_lib_t,locate_var_lib_t)
- manage_files_pattern(locate_t,locate_var_lib_t,locate_var_lib_t)
-
-+auth_use_nsswitch(locate_t)
-+
- kernel_read_system_state(locate_t)
- kernel_dontaudit_search_sysctl(locate_t)
-
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.0.7/policy/modules/apps/userhelper.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.0.8/policy/modules/apps/userhelper.if
--- nsaserefpolicy/policy/modules/apps/userhelper.if 2007-07-25 10:37:37.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/userhelper.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/userhelper.if 2007-09-17 16:20:18.000000000 -0400
@@ -130,6 +130,7 @@
term_use_all_user_ptys($1_userhelper_t)
@@ -2381,38 +2079,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp
auth_manage_pam_pid($1_userhelper_t)
auth_manage_var_auth($1_userhelper_t)
auth_search_pam_console_data($1_userhelper_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/usernetctl.te serefpolicy-3.0.7/policy/modules/apps/usernetctl.te
---- nsaserefpolicy/policy/modules/apps/usernetctl.te 2007-07-25 10:37:37.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/usernetctl.te 2007-09-06 15:43:06.000000000 -0400
-@@ -6,14 +6,6 @@
- # Declarations
- #
-
--## <desc>
--## <p>
--## Allow users to control network interfaces
--## (also needs USERCTL=true)
--## </p>
--## </desc>
--gen_tunable(user_net_control,false)
--
- type usernetctl_t;
- type usernetctl_exec_t;
- application_domain(usernetctl_t,usernetctl_exec_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.7/policy/modules/apps/vmware.fc
---- nsaserefpolicy/policy/modules/apps/vmware.fc 2007-07-03 07:05:43.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/vmware.fc 2007-09-06 15:43:06.000000000 -0400
-@@ -23,6 +23,7 @@
- /usr/bin/vmware-smbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
- /usr/bin/vmware-smbpasswd -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
- /usr/bin/vmware-smbpasswd\.bin -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
-+/usr/bin/vmware-vmx -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
- /usr/bin/vmware-wizard -- gen_context(system_u:object_r:vmware_exec_t,s0)
- /usr/bin/vmware -- gen_context(system_u:object_r:vmware_exec_t,s0)
-
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.0.7/policy/modules/apps/vmware.te
---- nsaserefpolicy/policy/modules/apps/vmware.te 2007-07-25 10:37:37.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/vmware.te 2007-09-06 15:43:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.0.8/policy/modules/apps/vmware.te
+--- nsaserefpolicy/policy/modules/apps/vmware.te 2007-09-12 10:34:49.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/vmware.te 2007-09-17 16:20:18.000000000 -0400
@@ -29,7 +29,7 @@
allow vmware_host_t self:capability { setuid net_raw };
@@ -2422,18 +2091,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.t
allow vmware_host_t self:fifo_file rw_fifo_file_perms;
allow vmware_host_t self:unix_stream_socket create_stream_socket_perms;
allow vmware_host_t self:rawip_socket create_socket_perms;
-@@ -56,6 +56,8 @@
- corenet_tcp_sendrecv_all_ports(vmware_host_t)
- corenet_udp_sendrecv_all_ports(vmware_host_t)
- corenet_raw_bind_all_nodes(vmware_host_t)
-+corenet_tcp_bind_all_nodes(vmware_host_t)
-+corenet_udp_bind_all_nodes(vmware_host_t)
- corenet_tcp_connect_all_ports(vmware_host_t)
- corenet_sendrecv_all_client_packets(vmware_host_t)
- corenet_sendrecv_all_server_packets(vmware_host_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.7/policy/modules/apps/wine.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.8/policy/modules/apps/wine.if
--- nsaserefpolicy/policy/modules/apps/wine.if 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/wine.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/wine.if 2007-09-17 16:20:18.000000000 -0400
@@ -18,3 +18,34 @@
corecmd_search_bin($1)
domtrans_pattern($1, wine_exec_t, wine_t)
@@ -2469,9 +2129,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if
+ role $2 types wine_t;
+ allow wine_t $3:chr_file rw_term_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.0.7/policy/modules/apps/wine.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.0.8/policy/modules/apps/wine.te
--- nsaserefpolicy/policy/modules/apps/wine.te 2007-07-25 10:37:37.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/apps/wine.te 2007-09-07 09:04:03.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/wine.te 2007-09-17 16:20:18.000000000 -0400
@@ -9,6 +9,7 @@
type wine_t;
type wine_exec_t;
@@ -2480,9 +2140,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te
########################################
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.7/policy/modules/kernel/corecommands.fc
+@@ -20,7 +21,12 @@
+ unconfined_domain_noaudit(wine_t)
+ files_execmod_all_files(wine_t)
+
+- optional_policy(`
+- hal_dbus_chat(wine_t)
+- ')
++')
++
++optional_policy(`
++ hal_dbus_chat(wine_t)
++')
++
++optional_policy(`
++ xserver_xdm_rw_shm(mono_t)
+ ')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc
--- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-08-22 07:14:06.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/corecommands.fc 2007-09-07 13:47:17.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc 2007-09-17 16:20:18.000000000 -0400
@@ -36,6 +36,11 @@
/etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0)
/etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0)
@@ -2524,9 +2200,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
+/etc/gdm/XKeepsCrashing[^/]* -- gen_context(system_u:object_r:bin_t,s0)
+/etc/gdm/[^/]+ -d gen_context(system_u:object_r:bin_t,s0)
+/etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.if.in serefpolicy-3.0.7/policy/modules/kernel/corenetwork.if.in
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.if.in serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in
--- nsaserefpolicy/policy/modules/kernel/corenetwork.if.in 2007-07-03 07:05:38.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/corenetwork.if.in 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in 2007-09-17 16:20:18.000000000 -0400
@@ -1449,6 +1449,43 @@
########################################
@@ -2571,9 +2247,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
## Read and write the TUN/TAP virtual network device.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.0.7/policy/modules/kernel/corenetwork.te.in
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.0.8/policy/modules/kernel/corenetwork.te.in
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-07-03 07:05:38.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/corenetwork.te.in 2007-09-11 09:22:25.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/corenetwork.te.in 2007-09-17 16:20:18.000000000 -0400
@@ -55,6 +55,11 @@
type reserved_port_t, port_type, reserved_port_type;
@@ -2645,18 +2321,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
portcon tcp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0)
portcon udp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.0.7/policy/modules/kernel/devices.fc
---- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-06-15 14:54:30.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/devices.fc 2007-09-06 15:43:06.000000000 -0400
-@@ -12,6 +12,7 @@
- /dev/atibm -c gen_context(system_u:object_r:mouse_device_t,s0)
- /dev/audio.* -c gen_context(system_u:object_r:sound_device_t,s0)
- /dev/beep -c gen_context(system_u:object_r:sound_device_t,s0)
-+/dev/dmfm -c gen_context(system_u:object_r:sound_device_t,s0)
- /dev/dsp.* -c gen_context(system_u:object_r:sound_device_t,s0)
- /dev/efirtc -c gen_context(system_u:object_r:clock_device_t,s0)
- /dev/em8300.* -c gen_context(system_u:object_r:v4l_device_t,s0)
-@@ -19,6 +20,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.0.8/policy/modules/kernel/devices.fc
+--- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-09-12 10:34:49.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/devices.fc 2007-09-17 16:20:18.000000000 -0400
+@@ -20,6 +20,7 @@
/dev/evtchn -c gen_context(system_u:object_r:xen_device_t,s0)
/dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0)
/dev/full -c gen_context(system_u:object_r:null_device_t,s0)
@@ -2664,64 +2332,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
/dev/fw.* -c gen_context(system_u:object_r:usb_device_t,s0)
/dev/hiddev.* -c gen_context(system_u:object_r:usb_device_t,s0)
/dev/hpet -c gen_context(system_u:object_r:clock_device_t,s0)
-@@ -53,7 +55,7 @@
- /dev/radio.* -c gen_context(system_u:object_r:v4l_device_t,s0)
- /dev/random -c gen_context(system_u:object_r:random_device_t,s0)
- /dev/raw1394.* -c gen_context(system_u:object_r:v4l_device_t,s0)
--/dev/(misc/)?rtc -c gen_context(system_u:object_r:clock_device_t,s0)
-+/dev/(misc/)?rtc[0-9]* -c gen_context(system_u:object_r:clock_device_t,s0)
- /dev/sequencer -c gen_context(system_u:object_r:sound_device_t,s0)
- /dev/sequencer2 -c gen_context(system_u:object_r:sound_device_t,s0)
- /dev/smpte.* -c gen_context(system_u:object_r:sound_device_t,s0)
-@@ -64,7 +66,9 @@
- /dev/sonypi -c gen_context(system_u:object_r:v4l_device_t,s0)
- /dev/tlk[0-3] -c gen_context(system_u:object_r:v4l_device_t,s0)
- /dev/urandom -c gen_context(system_u:object_r:urandom_device_t,s0)
-+/dev/usbmon[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0)
- /dev/usbdev.* -c gen_context(system_u:object_r:usb_device_t,s0)
-+/dev/usb[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0)
- /dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0)
- ifdef(`distro_suse', `
- /dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0)
-@@ -127,3 +131,7 @@
- /var/named/chroot/dev/random -c gen_context(system_u:object_r:random_device_t,s0)
- /var/named/chroot/dev/zero -c gen_context(system_u:object_r:zero_device_t,s0)
- ')
-+
-+/etc/udev/devices -d gen_context(system_u:object_r:device_t,s0)
-+/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0)
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.0.7/policy/modules/kernel/devices.if
---- nsaserefpolicy/policy/modules/kernel/devices.if 2007-06-15 14:54:30.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/devices.if 2007-09-06 15:43:06.000000000 -0400
-@@ -2803,6 +2803,24 @@
-
- ########################################
- ## <summary>
-+## Get the attributes of a directory in the usb filesystem.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_search_usbfs_dirs',`
-+ gen_require(`
-+ type usbfs_t;
-+ ')
-+
-+ allow $1 usbfs_t:dir search_dir_perms;
-+')
-+
-+########################################
-+## <summary>
- ## Do not audit attempts to get the attributes
- ## of a directory in the usb filesystem.
- ## </summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.7/policy/modules/kernel/domain.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.8/policy/modules/kernel/domain.if
--- nsaserefpolicy/policy/modules/kernel/domain.if 2007-06-19 16:23:34.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/domain.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/domain.if 2007-09-17 16:20:18.000000000 -0400
@@ -45,6 +45,11 @@
# start with basic domain
domain_base_type($1)
@@ -2763,9 +2376,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
+
+ allow $1 domain:association { sendto recvfrom };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.7/policy/modules/kernel/domain.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.8/policy/modules/kernel/domain.te
--- nsaserefpolicy/policy/modules/kernel/domain.te 2007-07-25 10:37:36.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/domain.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/domain.te 2007-09-17 16:20:18.000000000 -0400
@@ -6,6 +6,22 @@
# Declarations
#
@@ -2812,9 +2425,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
+ kernel_udp_recvfrom_unlabeled(domain)
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.7/policy/modules/kernel/files.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.8/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2007-07-03 07:05:38.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/files.if 2007-09-11 14:40:00.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/files.if 2007-09-17 16:20:18.000000000 -0400
@@ -343,8 +343,7 @@
########################################
@@ -3071,9 +2684,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
+ allow $1 root_t:dir rw_dir_perms;
+ allow $1 root_t:file { create getattr write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.0.7/policy/modules/kernel/files.te
---- nsaserefpolicy/policy/modules/kernel/files.te 2007-07-25 10:37:36.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/files.te 2007-09-11 10:46:12.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.0.8/policy/modules/kernel/files.te
+--- nsaserefpolicy/policy/modules/kernel/files.te 2007-09-12 10:34:49.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/files.te 2007-09-17 16:20:18.000000000 -0400
+@@ -1,5 +1,5 @@
+
+-policy_module(files,1.6.1)
++policy_module(files,1.6.0)
+
+ ########################################
+ #
@@ -55,6 +55,8 @@
# compatibility aliases for removed types:
typealias etc_t alias automount_etc_t;
@@ -3091,9 +2711,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
########################################
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.0.7/policy/modules/kernel/filesystem.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.0.8/policy/modules/kernel/filesystem.if
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-08-22 07:14:06.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/filesystem.if 2007-09-11 10:45:23.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.if 2007-09-17 16:20:18.000000000 -0400
@@ -271,45 +271,6 @@
########################################
@@ -3234,9 +2854,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
+ rw_files_pattern($1,anon_inodefs_t,anon_inodefs_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.7/policy/modules/kernel/filesystem.te
---- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-08-22 07:14:06.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/filesystem.te 2007-09-06 15:43:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.8/policy/modules/kernel/filesystem.te
+--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-09-12 10:34:49.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.te 2007-09-17 16:20:18.000000000 -0400
@@ -80,6 +80,7 @@
type fusefs_t;
fs_noxattr_type(fusefs_t)
@@ -3245,9 +2865,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
genfscon fuse / gen_context(system_u:object_r:fusefs_t,s0)
genfscon fuseblk / gen_context(system_u:object_r:fusefs_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.7/policy/modules/kernel/kernel.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.8/policy/modules/kernel/kernel.if
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-08-22 07:14:06.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/kernel.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/kernel.if 2007-09-17 16:20:18.000000000 -0400
@@ -1867,6 +1867,27 @@
########################################
@@ -3276,9 +2896,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
## Do not audit attempts to list unlabeled directories.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.0.7/policy/modules/kernel/kernel.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.0.8/policy/modules/kernel/kernel.te
--- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-08-22 07:14:06.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/kernel.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/kernel.te 2007-09-17 16:20:18.000000000 -0400
@@ -278,6 +278,7 @@
optional_policy(`
@@ -3287,9 +2907,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.0.7/policy/modules/kernel/selinux.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.0.8/policy/modules/kernel/selinux.if
--- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-07-03 07:05:38.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/selinux.if 2007-09-11 13:01:12.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/selinux.if 2007-09-17 16:20:18.000000000 -0400
@@ -138,6 +138,7 @@
type security_t;
')
@@ -3306,53 +2926,169 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu
allow $1 security_t:dir list_dir_perms;
allow $1 security_t:file { getattr read };
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.0.7/policy/modules/kernel/storage.fc
---- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-08-22 07:14:06.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/storage.fc 2007-09-10 15:52:30.000000000 -0400
-@@ -52,7 +52,7 @@
+@@ -239,6 +241,34 @@
- /dev/cciss/[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+ ########################################
+ ## <summary>
++## Allow caller to read the state of Booleans
++## </summary>
++## <desc>
++## <p>
++## Allow caller read the state of Booleans
++## </p>
++## </desc>
++## <param name="domain">
++## <summary>
++## The process type allowed to set the Boolean.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`selinux_get_boolean',`
++ gen_require(`
++ type security_t;
++ attribute booleans_type;
++ bool secure_mode_policyload;
++ ')
++
++ allow $1 security_t:dir list_dir_perms;
++ allow $1 booleans_type:dir list_dir_perms;
++ allow $1 booleans_type:file read_file_perms;
++')
++
++########################################
++## <summary>
+ ## Allow caller to set the state of Booleans to
+ ## enable or disable conditional portions of the policy.
+ ## </summary>
+@@ -262,11 +292,13 @@
+ interface(`selinux_set_boolean',`
+ gen_require(`
+ type security_t;
++ attribute booleans_type;
+ bool secure_mode_policyload;
+ ')
--/dev/fuse -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
-+/dev/fuse -c gen_context(system_u:object_r:fuse_device_t,mls_systemhigh)
- /dev/floppy/[^/]* -b gen_context(system_u:object_r:removable_device_t,s0)
+ allow $1 security_t:dir list_dir_perms;
+- allow $1 security_t:file { getattr read write };
++ allow $1 booleans_type:dir list_dir_perms;
++ allow $1 booleans_type:file { getattr read write };
- /dev/i2o/hd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.0.7/policy/modules/kernel/storage.if
---- nsaserefpolicy/policy/modules/kernel/storage.if 2007-08-22 07:14:06.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/storage.if 2007-09-10 15:54:45.000000000 -0400
-@@ -673,3 +673,61 @@
+ if(!secure_mode_policyload) {
+ allow $1 security_t:security setbool;
+@@ -463,3 +495,42 @@
- typeattribute $1 storage_unconfined_type;
+ typeattribute $1 selinux_unconfined_type;
')
+
+########################################
+## <summary>
-+## Allow the caller to get the attributes
-+## of device nodes of fuse devices.
++## Generate a file context for a boolean type
+## </summary>
+## <param name="domain">
+## <summary>
-+## The type of the process performing this action.
++## Domain allowed access.
+## </summary>
+## </param>
+#
-+interface(`storage_getattr_fuse_dev',`
++interface(`selinux_genbool',`
+ gen_require(`
-+ type fuse_device_t;
++ attribute booleans_type;
+ ')
+
-+ dev_list_all_dev_nodes($1)
-+ allow $1 fuse_device_t:chr_file getattr;
++ type $1, booleans_type;
++ fs_type($1)
++ mls_trusted_object($1)
+')
+
+########################################
+## <summary>
-+## read or write fuse device interfaces.
++## Generate a file context for a boolean type
+## </summary>
-+## <param name="domain">
++## <param name="type">
+## <summary>
-+## Domain to not audit.
++## Type of the boolean
++## </summary>
++## </param>
++## <param name="domain">
++## <summary>
++## name of the boolean
++## </summary>
++## </param>
++#
++interface(`selinux_genbool_mapping',`
++ genfscon selinuxfs /booleans/$2 gen_context(system_u:object_r:$1,s0)
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.te serefpolicy-3.0.8/policy/modules/kernel/selinux.te
+--- nsaserefpolicy/policy/modules/kernel/selinux.te 2007-07-25 10:37:36.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/selinux.te 2007-09-17 16:20:18.000000000 -0400
+@@ -10,6 +10,7 @@
+ attribute can_setenforce;
+ attribute can_setsecparam;
+ attribute selinux_unconfined_type;
++attribute booleans_type;
+
+ #
+ # security_t is the target type when checking
+@@ -22,6 +23,11 @@
+ sid security gen_context(system_u:object_r:security_t,mls_systemhigh)
+ genfscon selinuxfs / gen_context(system_u:object_r:security_t,s0)
+
++type boolean_t, booleans_type;
++fs_type(boolean_t)
++mls_trusted_object(boolean_t)
++#genfscon selinuxfs /booleans gen_context(system_u:object_r:boolean_t,s0)
++
+ neverallow ~{ selinux_unconfined_type can_load_policy } security_t:security load_policy;
+ neverallow ~{ selinux_unconfined_type can_setenforce } security_t:security setenforce;
+ neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam;
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.0.8/policy/modules/kernel/storage.fc
+--- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-08-22 07:14:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/storage.fc 2007-09-17 16:20:18.000000000 -0400
+@@ -52,7 +52,7 @@
+
+ /dev/cciss/[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+
+-/dev/fuse -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
++/dev/fuse -c gen_context(system_u:object_r:fuse_device_t,mls_systemhigh)
+ /dev/floppy/[^/]* -b gen_context(system_u:object_r:removable_device_t,s0)
+
+ /dev/i2o/hd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.0.8/policy/modules/kernel/storage.if
+--- nsaserefpolicy/policy/modules/kernel/storage.if 2007-08-22 07:14:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/storage.if 2007-09-17 16:20:18.000000000 -0400
+@@ -673,3 +673,61 @@
+
+ typeattribute $1 storage_unconfined_type;
+ ')
++
++########################################
++## <summary>
++## Allow the caller to get the attributes
++## of device nodes of fuse devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## The type of the process performing this action.
++## </summary>
++## </param>
++#
++interface(`storage_getattr_fuse_dev',`
++ gen_require(`
++ type fuse_device_t;
++ ')
++
++ dev_list_all_dev_nodes($1)
++ allow $1 fuse_device_t:chr_file getattr;
++')
++
++########################################
++## <summary>
++## read or write fuse device interfaces.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
+## </summary>
+## </param>
+#
@@ -3383,9 +3119,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag
+ dontaudit $1 fuse_device_t:chr_file rw_file_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.te serefpolicy-3.0.7/policy/modules/kernel/storage.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.te serefpolicy-3.0.8/policy/modules/kernel/storage.te
--- nsaserefpolicy/policy/modules/kernel/storage.te 2007-08-22 07:14:06.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/storage.te 2007-09-10 15:38:30.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/storage.te 2007-09-17 16:20:18.000000000 -0400
@@ -23,6 +23,12 @@
neverallow ~{ fixed_disk_raw_write storage_unconfined_type } fixed_disk_device_t:{ chr_file blk_file } { append write };
@@ -3399,9 +3135,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag
# scsi_generic_device_t is the type of /dev/sg*
# it gives access to ALL SCSI devices (both fixed and removable)
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.0.7/policy/modules/kernel/terminal.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.0.8/policy/modules/kernel/terminal.fc
--- nsaserefpolicy/policy/modules/kernel/terminal.fc 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/terminal.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/terminal.fc 2007-09-17 16:20:18.000000000 -0400
@@ -8,6 +8,7 @@
/dev/dcbri[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/hvc.* -c gen_context(system_u:object_r:tty_device_t,s0)
@@ -3410,10 +3146,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
/dev/ircomm[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/ip2[^/]* -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/isdn.* -c gen_context(system_u:object_r:tty_device_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.0.7/policy/modules/kernel/terminal.te
---- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-07-25 10:37:36.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/kernel/terminal.te 2007-09-06 15:43:06.000000000 -0400
-@@ -28,9 +28,15 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.0.8/policy/modules/kernel/terminal.te
+--- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-09-12 10:34:49.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/terminal.te 2007-09-17 16:38:07.000000000 -0400
+@@ -28,6 +28,7 @@
type devpts_t;
files_mountpoint(devpts_t)
fs_associate_tmpfs(devpts_t)
@@ -3421,39 +3157,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
fs_type(devpts_t)
fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0);
-+ifdef(`targeted_policy',`
-+ # cjp: the ttynode should probably be removed.
-+ typeattribute devpts_t ttynode, ptynode;
-+')
-+
- #
- # devtty_t is the type of /dev/tty.
- #
-@@ -51,6 +57,10 @@
- type tty_device_t, serial_device;
- dev_node(tty_device_t)
-
-+ifdef(`targeted_policy',`
-+ typeattribute tty_device_t ttynode;
-+')
-+
- #
- # usbtty_device_t is the type of /dev/usr/tty*
- #
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.0.7/policy/modules/services/amavis.te
---- nsaserefpolicy/policy/modules/services/amavis.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/amavis.te 2007-09-06 15:43:06.000000000 -0400
-@@ -166,6 +166,7 @@
-
- optional_policy(`
- pyzor_domtrans(amavis_t)
-+ pyzor_signal(amavis_t)
- ')
-
- optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.7/policy/modules/services/apache.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.8/policy/modules/services/apache.fc
--- nsaserefpolicy/policy/modules/services/apache.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/apache.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/apache.fc 2007-09-17 16:20:18.000000000 -0400
@@ -16,7 +16,6 @@
/usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0)
@@ -3479,9 +3185,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+/var/www/html/[^/]*/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
+
+/etc/rc\.d/init\.d/httpd -- gen_context(system_u:object_r:httpd_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.0.7/policy/modules/services/apache.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.0.8/policy/modules/services/apache.if
--- nsaserefpolicy/policy/modules/services/apache.if 2007-08-22 07:14:07.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/apache.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/apache.if 2007-09-17 16:20:18.000000000 -0400
@@ -18,10 +18,6 @@
attribute httpd_script_exec_type;
type httpd_t, httpd_suexec_t, httpd_log_t;
@@ -3726,7 +3432,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
## </summary>
## <param name="domain">
## <summary>
-@@ -1013,46 +1047,141 @@
+@@ -1013,46 +1047,147 @@
## </summary>
## </param>
#
@@ -3784,9 +3490,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
## <summary>
-## Domain run the cgi script in.
+## Domain allowed access.
- ## </summary>
- ## </param>
--## <param name="entrypoint">
++## </summary>
++## </param>
+#
+interface(`apache_search_bugzilla_dirs',`
+ gen_require(`
@@ -3802,21 +3507,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+## bugzill script unix domain stream sockets.
+## </summary>
+## <param name="domain">
- ## <summary>
--## Type of the executable to enter the cgi domain.
++## <summary>
+## Domain allowed access.
- ## </summary>
- ## </param>
- #
--interface(`apache_cgi_domain',`
++## </summary>
++## </param>
++#
+interface(`apache_dontaudit_rw_bugzilla_script_stream_sockets',`
- gen_require(`
-- type httpd_t, httpd_sys_script_exec_t;
++ gen_require(`
+ type httpd_bugzilla_script_t;
- ')
-
-- domtrans_pattern(httpd_t, $2, $1)
-- apache_search_sys_scripts($1)
++ ')
++
+ dontaudit $1 httpd_bugzilla_script_t:unix_stream_socket { read write };
+')
+
@@ -3842,58 +3542,79 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+## <summary>
+## All of the rules required to administrate an apache environment
+## </summary>
-+## <param name="domain">
++## <param name="prefix">
+## <summary>
-+## Domain allowed access.
++## Prefix of the domain. Example, user would be
++## the prefix for the uder_t domain.
+## </summary>
+## </param>
-+## <param name="role">
++## <param name="domain">
+## <summary>
++## Domain allowed access.
+ ## </summary>
+ ## </param>
+-## <param name="entrypoint">
++## <param name="role">
+ ## <summary>
+-## Type of the executable to enter the cgi domain.
+## The role to be allowed to manage the apache domain.
-+## </summary>
-+## </param>
-+## <param name="terminal">
-+## <summary>
-+## The type of the terminal allow the dmidecode domain to use.
-+## </summary>
-+## </param>
+ ## </summary>
+ ## </param>
+## <rolecap/>
-+#
-+interface(`apache_admin',`
+ #
+-interface(`apache_cgi_domain',`
++template(`apache_admin',`
+
-+ gen_require(`
+ gen_require(`
+- type httpd_t, httpd_sys_script_exec_t;
+ type httpd_t;
++ type httpd_bool_t;
+ type httpd_script_exec_t;
-+ ')
-+
-+ allow $1 httpd_t:process { ptrace signal_perms };
+ ')
+
+- domtrans_pattern(httpd_t, $2, $1)
+- apache_search_sys_scripts($1)
++ allow $2 httpd_t:process { ptrace signal_perms };
+
+- allow httpd_t $1:process signal;
++ # Allow $2 to restart the apache service
++ apache_script_domtrans($2)
++ domain_system_change_exemption($2)
++ role_transition $3 httpd_script_exec_t system_r;
++ allow $3 system_r;
+
-+ # Allow $1 to restart the apache service
-+ apache_script_domtrans($1)
-+ domain_system_change_exemption($1)
-+ role_transition $2 httpd_script_exec_t system_r;
-+ allow $2 system_r;
++ apache_manage_all_content($2)
++ apache_manage_config($2)
++ apache_manage_log($2)
++ apache_manage_modules($2)
++ apache_manage_lock($2)
++ apache_manage_pid($2)
++ apache_read_state($2)
++ apache_getattr($2)
++ apache_relabel($2)
+
-+ apache_manage_all_content($1)
-+ apache_manage_config($1)
-+ apache_manage_log($1)
-+ apache_manage_modules($1)
-+ apache_manage_lock($1)
-+ apache_manage_pid($1)
-+ apache_read_state($1)
-+ apache_getattr($1)
-+ apache_relabel($1)
++ seutil_domtrans_setfiles($2)
+
-+ seutil_domtrans_setfiles($1)
-
-- allow httpd_t $1:process signal;
++ seutil_setsebool_per_role_template($1, $2, $3)
++ allow $1_setsebool_t httpd_bool_t:dir list_dir_perms;
++ allow $1_setsebool_t httpd_bool_t:file rw_file_perms;
')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.7/policy/modules/services/apache.te
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.8/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2007-08-22 07:14:07.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/apache.te 2007-09-10 15:07:38.000000000 -0400
-@@ -30,6 +30,13 @@
++++ serefpolicy-3.0.8/policy/modules/services/apache.te 2007-09-17 16:20:18.000000000 -0400
+@@ -20,6 +20,8 @@
+ # Declarations
+ #
+
++selinux_genbool(httpd_bool_t)
++
+ ## <desc>
+ ## <p>
+ ## Allow Apache to modify public files
+@@ -30,6 +32,13 @@
## <desc>
## <p>
@@ -3907,7 +3628,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
## Allow Apache to use mod_auth_pam
## </p>
## </desc>
-@@ -47,6 +54,13 @@
+@@ -47,6 +56,13 @@
## Allow http daemon to tcp connect
## </p>
## </desc>
@@ -3921,7 +3642,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
gen_tunable(httpd_can_network_connect,false)
## <desc>
-@@ -97,7 +111,7 @@
+@@ -97,7 +113,7 @@
## Allow http daemon to communicate with the TTY
## </p>
## </desc>
@@ -3930,7 +3651,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
## <desc>
## <p>
-@@ -106,6 +120,27 @@
+@@ -106,6 +122,27 @@
## </desc>
gen_tunable(httpd_unified,false)
@@ -3958,7 +3679,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
attribute httpdcontent;
# domains that can exec all users scripts
-@@ -142,6 +177,9 @@
+@@ -142,6 +179,9 @@
type httpd_log_t;
logging_log_file(httpd_log_t)
@@ -3968,7 +3689,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
# httpd_modules_t is the type given to module files (libraries)
# that come with Apache /etc/httpd/modules and /usr/lib/apache
type httpd_modules_t;
-@@ -182,6 +220,14 @@
+@@ -182,6 +222,14 @@
type httpd_tmpfs_t;
files_tmpfs_file(httpd_tmpfs_t)
@@ -3983,7 +3704,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
# for apache2 memory mapped files
type httpd_var_lib_t;
files_type(httpd_var_lib_t)
-@@ -202,9 +248,11 @@
+@@ -202,9 +250,11 @@
# Apache server local policy
#
@@ -3996,7 +3717,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
allow httpd_t self:fd use;
allow httpd_t self:sock_file read_sock_file_perms;
allow httpd_t self:fifo_file rw_fifo_file_perms;
-@@ -244,6 +292,7 @@
+@@ -244,6 +294,7 @@
allow httpd_t httpd_modules_t:dir list_dir_perms;
mmap_files_pattern(httpd_t,httpd_modules_t,httpd_modules_t)
read_files_pattern(httpd_t,httpd_modules_t,httpd_modules_t)
@@ -4004,7 +3725,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
apache_domtrans_rotatelogs(httpd_t)
# Apache-httpd needs to be able to send signals to the log rotate procs.
-@@ -284,6 +333,7 @@
+@@ -284,6 +335,7 @@
kernel_read_kernel_sysctls(httpd_t)
# for modules that want to access /proc/meminfo
kernel_read_system_state(httpd_t)
@@ -4012,7 +3733,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
corenet_all_recvfrom_unlabeled(httpd_t)
corenet_all_recvfrom_netlabel(httpd_t)
-@@ -330,6 +380,10 @@
+@@ -330,6 +382,10 @@
files_read_var_lib_symlinks(httpd_t)
fs_search_auto_mountpoints(httpd_sys_script_t)
@@ -4023,7 +3744,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
libs_use_ld_so(httpd_t)
libs_use_shared_libs(httpd_t)
-@@ -348,7 +402,9 @@
+@@ -348,7 +404,9 @@
userdom_use_unpriv_users_fds(httpd_t)
@@ -4034,7 +3755,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`allow_httpd_anon_write',`
miscfiles_manage_public_files(httpd_t)
-@@ -360,6 +416,7 @@
+@@ -360,6 +418,7 @@
#
tunable_policy(`allow_httpd_mod_auth_pam',`
auth_domtrans_chk_passwd(httpd_t)
@@ -4042,7 +3763,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
')
')
-@@ -367,6 +424,16 @@
+@@ -367,6 +426,16 @@
corenet_tcp_connect_all_ports(httpd_t)
')
@@ -4059,7 +3780,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_can_network_connect_db',`
# allow httpd to connect to mysql/posgresql
corenet_tcp_connect_postgresql_port(httpd_t)
-@@ -387,6 +454,17 @@
+@@ -387,6 +456,17 @@
corenet_sendrecv_http_cache_client_packets(httpd_t)
')
@@ -4077,7 +3798,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t)
-@@ -404,11 +482,21 @@
+@@ -404,11 +484,21 @@
fs_read_nfs_symlinks(httpd_t)
')
@@ -4099,7 +3820,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_ssi_exec',`
corecmd_shell_domtrans(httpd_t,httpd_sys_script_t)
allow httpd_sys_script_t httpd_t:fd use;
-@@ -430,6 +518,12 @@
+@@ -430,6 +520,12 @@
')
optional_policy(`
@@ -4112,7 +3833,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
calamaris_read_www_files(httpd_t)
')
-@@ -442,8 +536,15 @@
+@@ -442,8 +538,15 @@
')
optional_policy(`
@@ -4129,7 +3850,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
')
optional_policy(`
-@@ -461,7 +562,6 @@
+@@ -461,7 +564,6 @@
optional_policy(`
nagios_read_config(httpd_t)
@@ -4137,7 +3858,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
')
optional_policy(`
-@@ -481,6 +581,7 @@
+@@ -481,6 +583,7 @@
')
optional_policy(`
@@ -4145,7 +3866,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
')
-@@ -512,10 +613,16 @@
+@@ -512,10 +615,16 @@
tunable_policy(`httpd_tty_comm',`
# cjp: this is redundant:
term_use_controlling_term(httpd_helper_t)
@@ -4163,7 +3884,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
########################################
#
# Apache PHP script local policy
-@@ -567,7 +674,6 @@
+@@ -567,7 +676,6 @@
allow httpd_suexec_t self:capability { setuid setgid };
allow httpd_suexec_t self:process signal_perms;
allow httpd_suexec_t self:unix_stream_socket create_stream_socket_perms;
@@ -4171,7 +3892,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
domtrans_pattern(httpd_t, httpd_suexec_exec_t, httpd_suexec_t)
-@@ -581,6 +687,10 @@
+@@ -581,6 +689,10 @@
manage_files_pattern(httpd_suexec_t,httpd_suexec_tmp_t,httpd_suexec_tmp_t)
files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir })
@@ -4182,7 +3903,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
kernel_read_kernel_sysctls(httpd_suexec_t)
kernel_list_proc(httpd_suexec_t)
kernel_read_proc_symlinks(httpd_suexec_t)
-@@ -606,6 +716,10 @@
+@@ -606,6 +718,10 @@
miscfiles_read_localization(httpd_suexec_t)
@@ -4193,7 +3914,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_can_network_connect',`
allow httpd_suexec_t self:tcp_socket create_stream_socket_perms;
allow httpd_suexec_t self:udp_socket create_socket_perms;
-@@ -620,10 +734,13 @@
+@@ -620,10 +736,13 @@
corenet_udp_sendrecv_all_ports(httpd_suexec_t)
corenet_tcp_connect_all_ports(httpd_suexec_t)
corenet_sendrecv_all_client_packets(httpd_suexec_t)
@@ -4208,7 +3929,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_enable_cgi && httpd_unified',`
domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t)
')
-@@ -634,6 +751,12 @@
+@@ -634,6 +753,12 @@
fs_exec_nfs_files(httpd_suexec_t)
')
@@ -4221,7 +3942,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_suexec_t)
fs_read_cifs_symlinks(httpd_suexec_t)
-@@ -651,18 +774,6 @@
+@@ -651,18 +776,6 @@
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
')
@@ -4240,7 +3961,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
########################################
#
# Apache system script local policy
-@@ -672,7 +783,8 @@
+@@ -672,7 +785,8 @@
dontaudit httpd_sys_script_t httpd_config_t:dir search;
@@ -4250,7 +3971,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t)
-@@ -686,15 +798,66 @@
+@@ -686,15 +800,66 @@
# Should we add a boolean?
apache_domtrans_rotatelogs(httpd_sys_script_t)
@@ -4318,7 +4039,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_sys_script_t)
fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -711,6 +874,19 @@
+@@ -711,6 +876,19 @@
########################################
#
@@ -4338,7 +4059,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
# httpd_rotatelogs local policy
#
-@@ -728,3 +904,20 @@
+@@ -728,3 +906,20 @@
logging_search_logs(httpd_rotatelogs_t)
miscfiles_read_localization(httpd_rotatelogs_t)
@@ -4359,158 +4080,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+optional_policy(`
+ postgresql_stream_connect(httpd_bugzilla_script_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-3.0.7/policy/modules/services/apcupsd.fc
---- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/apcupsd.fc 2007-09-06 15:43:06.000000000 -0400
-@@ -5,5 +5,11 @@
- /usr/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0)
-
- /var/log/apcupsd\.events.* -- gen_context(system_u:object_r:apcupsd_log_t,s0)
-+/var/log/apcupsd\.status.* -- gen_context(system_u:object_r:apcupsd_log_t,s0)
-
- /var/run/apcupsd\.pid -- gen_context(system_u:object_r:apcupsd_var_run_t,s0)
-+
-+/var/www/apcupsd/multimon.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
-+/var/www/apcupsd/upsfstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
-+/var/www/apcupsd/upsimage.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
-+/var/www/apcupsd/upsstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.0.7/policy/modules/services/apcupsd.if
---- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/apcupsd.if 2007-09-06 15:43:06.000000000 -0400
-@@ -79,3 +79,25 @@
- allow $1 apcupsd_log_t:dir list_dir_perms;
- allow $1 apcupsd_log_t:file { getattr append };
- ')
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run httpd_apcupsd_cgi_script.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`httpd_apcupsd_cgi_script_domtrans',`
-+ gen_require(`
-+ type httpd_apcupsd_cgi_script_t, httpd_apcupsd_cgi_script_exec_t;
-+ ')
-+
-+ domain_auto_trans($1,httpd_apcupsd_cgi_script_exec_t,httpd_apcupsd_cgi_script_t)
-+
-+ allow httpd_apcupsd_cgi_script_t $1:fd use;
-+ allow httpd_apcupsd_cgi_script_t $1:fifo_file rw_file_perms;
-+ allow httpd_apcupsd_cgi_script_t $1:process sigchld;
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.7/policy/modules/services/apcupsd.te
---- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/apcupsd.te 2007-09-10 10:56:09.000000000 -0400
-@@ -16,6 +16,9 @@
- type apcupsd_log_t;
- logging_log_file(apcupsd_log_t)
-
-+type apcupsd_tmp_t;
-+files_tmp_file(apcupsd_tmp_t)
-+
- type apcupsd_var_run_t;
- files_pid_file(apcupsd_var_run_t)
-
-@@ -24,6 +27,7 @@
- # apcupsd local policy
- #
-
-+allow apcupsd_t self:capability { dac_override setgid sys_tty_config };
- allow apcupsd_t self:process signal;
- allow apcupsd_t self:fifo_file rw_file_perms;
- allow apcupsd_t self:unix_stream_socket create_stream_socket_perms;
-@@ -36,9 +40,15 @@
- manage_files_pattern(apcupsd_t,apcupsd_log_t,apcupsd_log_t)
- logging_log_filetrans(apcupsd_t,apcupsd_log_t,{ file dir })
-
-+manage_files_pattern(apcupsd_t,apcupsd_tmp_t,apcupsd_tmp_t)
-+files_tmp_filetrans(apcupsd_t,apcupsd_tmp_t,file)
-+
- manage_files_pattern(apcupsd_t,apcupsd_var_run_t,apcupsd_var_run_t)
- files_pid_filetrans(apcupsd_t,apcupsd_var_run_t, file)
-
-+corecmd_exec_bin(apcupsd_t)
-+corecmd_exec_shell(apcupsd_t)
-+
- corenet_all_recvfrom_unlabeled(apcupsd_t)
- corenet_all_recvfrom_netlabel(apcupsd_t)
- corenet_tcp_sendrecv_generic_if(apcupsd_t)
-@@ -47,6 +57,7 @@
- corenet_tcp_bind_all_nodes(apcupsd_t)
- corenet_tcp_bind_apcupsd_port(apcupsd_t)
- corenet_sendrecv_apcupsd_server_packets(apcupsd_t)
-+corenet_tcp_connect_apcupsd_port(apcupsd_t)
-
- dev_rw_generic_usb_dev(apcupsd_t)
-
-@@ -55,6 +66,15 @@
-
- files_read_etc_files(apcupsd_t)
- files_search_locks(apcupsd_t)
-+# Creates /etc/nologin
-+files_manage_etc_runtime_files(apcupsd_t)
-+files_etc_filetrans_etc_runtime(apcupsd_t,file)
-+
-+#apcupsd runs shutdown, probably need a shutdown domain
-+init_rw_utmp(apcupsd_t)
-+init_telinit(apcupsd_t)
-+
-+kernel_read_system_state(apcupsd_t)
-
- libs_use_ld_so(apcupsd_t)
- libs_use_shared_libs(apcupsd_t)
-@@ -62,3 +82,43 @@
- logging_send_syslog_msg(apcupsd_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.8/policy/modules/services/apcupsd.te
+--- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-09-12 10:34:50.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/apcupsd.te 2007-09-17 16:20:18.000000000 -0400
+@@ -86,6 +86,11 @@
miscfiles_read_localization(apcupsd_t)
-+
+
+sysnet_dns_name_resolve(apcupsd_t)
+
-+# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240805
-+term_use_unallocated_ttys(apcupsd_t)
-+
+userdom_use_unpriv_users_ttys(apcupsd_t)
+userdom_use_unpriv_users_ptys(apcupsd_t)
+
-+optional_policy(`
-+ hostname_exec(apcupsd_t)
-+')
-+
-+optional_policy(`
-+ mta_send_mail(apcupsd_t)
-+')
-+
-+########################################
-+#
-+# apcupsd_cgi Declarations
-+#
-+
-+apache_content_template(apcupsd_cgi)
-+
-+# Default Networking
-+sysnet_dns_name_resolve(httpd_apcupsd_cgi_script_t)
-+corenet_all_recvfrom_unlabeled(httpd_apcupsd_cgi_script_t)
-+corenet_all_recvfrom_netlabel(httpd_apcupsd_cgi_script_t)
-+
-+allow httpd_apcupsd_cgi_script_t self:tcp_socket create_stream_socket_perms;
-+corenet_tcp_sendrecv_all_if(httpd_apcupsd_cgi_script_t)
-+corenet_tcp_sendrecv_all_nodes(httpd_apcupsd_cgi_script_t)
-+corenet_tcp_sendrecv_all_ports(httpd_apcupsd_cgi_script_t)
-+corenet_tcp_connect_apcupsd_port(httpd_apcupsd_cgi_script_t)
-+
-+allow httpd_apcupsd_cgi_script_t self:udp_socket create_socket_perms;
-+corenet_udp_sendrecv_all_if(httpd_apcupsd_cgi_script_t)
-+corenet_udp_sendrecv_all_nodes(httpd_apcupsd_cgi_script_t)
-+corenet_udp_sendrecv_all_ports(httpd_apcupsd_cgi_script_t)
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.7/policy/modules/services/audioentropy.te
+ optional_policy(`
+ hostname_exec(apcupsd_t)
+ ')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.8/policy/modules/services/audioentropy.te
--- nsaserefpolicy/policy/modules/services/audioentropy.te 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/audioentropy.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/audioentropy.te 2007-09-17 16:20:18.000000000 -0400
@@ -18,7 +18,7 @@
# Local policy
#
@@ -4529,9 +4116,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audi
dev_read_sound(entropyd_t)
fs_getattr_all_fs(entropyd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.7/policy/modules/services/automount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.8/policy/modules/services/automount.te
--- nsaserefpolicy/policy/modules/services/automount.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/automount.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/automount.te 2007-09-17 16:20:18.000000000 -0400
@@ -69,6 +69,7 @@
files_mounton_all_mountpoints(automount_t)
files_mount_all_file_type_fs(automount_t)
@@ -4548,7 +4135,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto
dev_read_urand(automount_t)
domain_use_interactive_fds(automount_t)
-@@ -147,10 +149,6 @@
+@@ -125,6 +127,8 @@
+ fs_mount_autofs(automount_t)
+ fs_manage_autofs_symlinks(automount_t)
+
++storage_rw_fuse(automount_t)
++
+ term_dontaudit_getattr_pty_dirs(automount_t)
+
+ libs_use_ld_so(automount_t)
+@@ -147,10 +151,6 @@
userdom_dontaudit_search_sysadm_home_dirs(automount_t)
optional_policy(`
@@ -4559,7 +4155,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto
bind_search_cache(automount_t)
')
-@@ -173,6 +171,11 @@
+@@ -173,6 +173,11 @@
')
optional_policy(`
@@ -4571,20 +4167,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto
seutil_sigchld_newrole(automount_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.0.7/policy/modules/services/avahi.te
---- nsaserefpolicy/policy/modules/services/avahi.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/avahi.te 2007-09-06 15:43:06.000000000 -0400
-@@ -57,6 +57,7 @@
-
- fs_getattr_all_fs(avahi_t)
- fs_search_auto_mountpoints(avahi_t)
-+fs_list_inotifyfs(avahi_t)
-
- domain_use_interactive_fds(avahi_t)
-
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.7/policy/modules/services/bind.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.8/policy/modules/services/bind.fc
--- nsaserefpolicy/policy/modules/services/bind.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/bind.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/bind.fc 2007-09-17 16:20:18.000000000 -0400
@@ -45,4 +45,7 @@
/var/named/chroot/var/named/slaves(/.*)? gen_context(system_u:object_r:named_cache_t,s0)
/var/named/chroot/var/named/data(/.*)? gen_context(system_u:object_r:named_cache_t,s0)
@@ -4593,9 +4178,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind
+/var/named/chroot/var/named/dynamic(/.*)? gen_context(system_u:object_r:named_cache_t,s0)
')
+/var/named/chroot/var/log/named.* -- gen_context(system_u:object_r:named_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.7/policy/modules/services/bind.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.8/policy/modules/services/bind.te
--- nsaserefpolicy/policy/modules/services/bind.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/bind.te 2007-09-10 11:12:34.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/bind.te 2007-09-17 16:20:18.000000000 -0400
@@ -66,7 +66,6 @@
allow named_t self:unix_dgram_socket create_socket_perms;
allow named_t self:tcp_socket create_stream_socket_perms;
@@ -4655,60 +4240,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind
corenet_sendrecv_rndc_client_packets(ndc_t)
fs_getattr_xattr_fs(ndc_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.fc serefpolicy-3.0.7/policy/modules/services/clamav.fc
---- nsaserefpolicy/policy/modules/services/clamav.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/clamav.fc 2007-09-06 15:43:06.000000000 -0400
-@@ -9,6 +9,8 @@
-
- /var/run/amavis(d)?/clamd\.pid -- gen_context(system_u:object_r:clamd_var_run_t,s0)
- /var/run/clamav(/.*)? gen_context(system_u:object_r:clamd_var_run_t,s0)
-+/var/run/clamd\..* gen_context(system_u:object_r:clamd_var_run_t,s0)
-+/var/run/clamav\..* gen_context(system_u:object_r:clamd_var_run_t,s0)
- /var/lib/clamav(/.*)? gen_context(system_u:object_r:clamd_var_lib_t,s0)
- /var/log/clamav -d gen_context(system_u:object_r:clamd_var_log_t,s0)
- /var/log/clamav/clamav.* -- gen_context(system_u:object_r:clamd_var_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.7/policy/modules/services/clamav.te
---- nsaserefpolicy/policy/modules/services/clamav.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/clamav.te 2007-09-06 15:43:06.000000000 -0400
-@@ -74,17 +74,20 @@
- manage_files_pattern(clamd_t,clamd_var_lib_t,clamd_var_lib_t)
-
- # log files
--allow clamd_t clamd_var_log_t:dir setattr;
-+manage_dirs_pattern(clamd_t,clamd_var_log_t,clamd_var_log_t)
- manage_files_pattern(clamd_t,clamd_var_log_t,clamd_var_log_t)
--logging_log_filetrans(clamd_t,clamd_var_log_t,file)
-+logging_log_filetrans(clamd_t,clamd_var_log_t,{ dir file })
-
- # pid file
-+manage_dirs_pattern(clamd_t,clamd_var_log_t,clamd_var_log_t)
- manage_files_pattern(clamd_t,clamd_var_run_t,clamd_var_run_t)
- manage_sock_files_pattern(clamd_t,clamd_var_run_t,clamd_var_run_t)
--files_pid_filetrans(clamd_t,clamd_var_run_t,file)
-+files_pid_filetrans(clamd_t,clamd_var_run_t,{ file dir })
-
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.8/policy/modules/services/clamav.te
+--- nsaserefpolicy/policy/modules/services/clamav.te 2007-09-12 10:34:50.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/clamav.te 2007-09-17 16:20:18.000000000 -0400
+@@ -87,6 +87,7 @@
kernel_dontaudit_list_proc(clamd_t)
kernel_read_sysctl(clamd_t)
-+kernel_read_kernel_sysctls(clamd_t)
+ kernel_read_kernel_sysctls(clamd_t)
+kernel_read_system_state(clamd_t)
corenet_all_recvfrom_unlabeled(clamd_t)
corenet_all_recvfrom_netlabel(clamd_t)
-@@ -208,9 +211,12 @@
- files_tmp_filetrans(clamscan_t,clamscan_tmp_t,{ file dir })
-
- # var/lib files together with clamd
--read_files_pattern(clamscan_t,clamd_var_lib_t,clamd_var_lib_t)
-+manage_files_pattern(clamscan_t,clamd_var_lib_t,clamd_var_lib_t)
- allow clamscan_t clamd_var_lib_t:dir list_dir_perms;
-
-+init_read_utmp(clamscan_t)
-+init_dontaudit_write_utmp(clamscan_t)
-+
- kernel_read_kernel_sysctls(clamscan_t)
-
- files_read_etc_files(clamscan_t)
-@@ -228,3 +234,7 @@
+@@ -233,3 +234,7 @@
optional_policy(`
apache_read_sys_content(clamscan_t)
')
@@ -4716,9 +4259,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam
+optional_policy(`
+ mailscanner_manage_spool(clamscan_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.7/policy/modules/services/consolekit.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.8/policy/modules/services/consolekit.te
--- nsaserefpolicy/policy/modules/services/consolekit.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/consolekit.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/consolekit.te 2007-09-17 16:20:18.000000000 -0400
@@ -10,7 +10,6 @@
type consolekit_exec_t;
init_daemon_domain(consolekit_t, consolekit_exec_t)
@@ -4776,9 +4319,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons
+ unconfined_ptrace(consolekit_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.7/policy/modules/services/courier.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.8/policy/modules/services/courier.te
--- nsaserefpolicy/policy/modules/services/courier.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/courier.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/courier.te 2007-09-17 16:20:18.000000000 -0400
@@ -58,6 +58,7 @@
files_getattr_tmp_dirs(courier_authdaemon_t)
@@ -4787,9 +4330,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cour
libs_read_lib_files(courier_authdaemon_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cpucontrol.te serefpolicy-3.0.7/policy/modules/services/cpucontrol.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cpucontrol.te serefpolicy-3.0.8/policy/modules/services/cpucontrol.te
--- nsaserefpolicy/policy/modules/services/cpucontrol.te 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/cpucontrol.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/cpucontrol.te 2007-09-17 16:20:18.000000000 -0400
@@ -63,6 +63,10 @@
')
@@ -4801,9 +4344,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cpuc
seutil_sigchld_newrole(cpucontrol_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.7/policy/modules/services/cron.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.8/policy/modules/services/cron.fc
--- nsaserefpolicy/policy/modules/services/cron.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/cron.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/cron.fc 2007-09-17 16:20:18.000000000 -0400
@@ -17,6 +17,8 @@
/var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0)
/var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0)
@@ -4818,9 +4361,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
/var/spool/fcron/systab -- gen_context(system_u:object_r:system_cron_spool_t,s0)
/var/spool/fcron/new\.systab -- gen_context(system_u:object_r:system_cron_spool_t,s0)
+/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.7/policy/modules/services/cron.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.8/policy/modules/services/cron.if
--- nsaserefpolicy/policy/modules/services/cron.if 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/cron.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/cron.if 2007-09-17 16:20:18.000000000 -0400
@@ -35,6 +35,7 @@
#
template(`cron_per_role_template',`
@@ -4962,9 +4505,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
## Read, and write cron daemon TCP sockets.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.7/policy/modules/services/cron.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.8/policy/modules/services/cron.te
--- nsaserefpolicy/policy/modules/services/cron.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/cron.te 2007-09-11 09:00:57.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/cron.te 2007-09-17 16:20:18.000000000 -0400
@@ -50,6 +50,7 @@
type crond_tmp_t;
@@ -4995,7 +4538,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
dontaudit crond_t self:capability { sys_resource sys_tty_config };
allow crond_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow crond_t self:process { setexec setfscreate };
-@@ -99,18 +106,18 @@
+@@ -99,18 +106,20 @@
allow crond_t crond_var_run_t:file manage_file_perms;
files_pid_filetrans(crond_t,crond_var_run_t,file)
@@ -5011,6 +4554,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
-allow crond_t system_cron_spool_t:file read_file_perms;
+list_dirs_pattern(crond_t, system_cron_spool_t, system_cron_spool_t)
+read_files_pattern(crond_t, system_cron_spool_t, system_cron_spool_t)
++
++auth_use_nsswitch(crond_t)
kernel_read_kernel_sysctls(crond_t)
kernel_search_key(crond_t)
@@ -5018,7 +4563,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
dev_read_sysfs(crond_t)
selinux_get_fs_mount(crond_t)
-@@ -127,6 +134,8 @@
+@@ -127,6 +136,8 @@
# need auth_chkpwd to check for locked accounts.
auth_domtrans_chk_passwd(crond_t)
@@ -5027,7 +4572,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
corecmd_exec_shell(crond_t)
corecmd_list_bin(crond_t)
-@@ -146,7 +155,9 @@
+@@ -146,7 +157,9 @@
libs_use_ld_so(crond_t)
libs_use_shared_libs(crond_t)
@@ -5037,7 +4582,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
seutil_read_config(crond_t)
seutil_read_default_contexts(crond_t)
-@@ -160,6 +171,16 @@
+@@ -160,6 +173,16 @@
mta_send_mail(crond_t)
@@ -5054,32 +4599,50 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
ifdef(`distro_debian',`
optional_policy(`
# Debian logcheck has the home dir set to its cache
-@@ -180,11 +201,24 @@
+@@ -180,29 +203,34 @@
locallogin_link_keys(crond_t)
')
+-tunable_policy(`fcron_crond', `
+- allow crond_t system_cron_spool_t:file manage_file_perms;
+optional_policy(`
+ # these should probably be unconfined_crond_t
+ init_dbus_send_script(crond_t)
-+')
-+
-+optional_policy(`
+ ')
+
+ optional_policy(`
+- amavis_search_lib(crond_t)
+ mono_domtrans(crond_t)
+')
+
- tunable_policy(`fcron_crond', `
- allow crond_t system_cron_spool_t:file manage_file_perms;
++tunable_policy(`fcron_crond', `
++ allow crond_t system_cron_spool_t:file manage_file_perms;
')
optional_policy(`
+- hal_dbus_send(crond_t)
+ amanda_search_var_lib(crond_t)
-+')
-+
-+optional_policy(`
- amavis_search_lib(crond_t)
')
-@@ -239,7 +273,6 @@
+ optional_policy(`
+- # cjp: why?
+- munin_search_lib(crond_t)
++ amavis_search_lib(crond_t)
+ ')
+
+ optional_policy(`
+- nis_use_ypbind(crond_t)
++ hal_dbus_send(crond_t)
+ ')
+
+ optional_policy(`
+- nscd_socket_use(crond_t)
++ # cjp: why?
++ munin_search_lib(crond_t)
+ ')
+
+ optional_policy(`
+@@ -239,7 +267,6 @@
allow system_crond_t cron_var_lib_t:file manage_file_perms;
files_var_lib_filetrans(system_crond_t,cron_var_lib_t,file)
@@ -5087,7 +4650,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
# The entrypoint interface is not used as this is not
# a regular entrypoint. Since crontab files are
# not directly executed, crond must ensure that
-@@ -249,6 +282,8 @@
+@@ -249,6 +276,8 @@
# for this purpose.
allow system_crond_t system_cron_spool_t:file entrypoint;
@@ -5096,7 +4659,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
# Permit a transition from the crond_t domain to this domain.
# The transition is requested explicitly by the modified crond
# via setexeccon. There is no way to set up an automatic
-@@ -270,9 +305,16 @@
+@@ -270,9 +299,16 @@
filetrans_pattern(system_crond_t,crond_tmp_t,system_crond_tmp_t,{ file lnk_file })
files_tmp_filetrans(system_crond_t,system_crond_tmp_t,file)
@@ -5114,7 +4677,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
kernel_read_kernel_sysctls(system_crond_t)
kernel_read_system_state(system_crond_t)
-@@ -326,7 +368,7 @@
+@@ -326,7 +362,7 @@
init_read_utmp(system_crond_t)
init_dontaudit_rw_utmp(system_crond_t)
# prelink tells init to restart it self, we either need to allow or dontaudit
@@ -5123,7 +4686,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
libs_use_ld_so(system_crond_t)
libs_use_shared_libs(system_crond_t)
-@@ -334,6 +376,7 @@
+@@ -334,6 +370,7 @@
libs_exec_ld_so(system_crond_t)
logging_read_generic_logs(system_crond_t)
@@ -5131,7 +4694,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
logging_send_syslog_msg(system_crond_t)
miscfiles_read_localization(system_crond_t)
-@@ -384,6 +427,14 @@
+@@ -384,6 +421,14 @@
')
optional_policy(`
@@ -5146,7 +4709,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
mrtg_append_create_logs(system_crond_t)
')
-@@ -424,8 +475,7 @@
+@@ -424,8 +469,7 @@
')
optional_policy(`
@@ -5156,7 +4719,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
')
optional_policy(`
-@@ -433,9 +483,13 @@
+@@ -433,9 +477,13 @@
')
optional_policy(`
@@ -5171,9 +4734,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
')
ifdef(`TODO',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.7/policy/modules/services/cups.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.8/policy/modules/services/cups.fc
--- nsaserefpolicy/policy/modules/services/cups.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/cups.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/cups.fc 2007-09-17 16:20:18.000000000 -0400
@@ -8,6 +8,7 @@
/etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
/etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
@@ -5196,9 +4759,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
/var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh)
+/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.7/policy/modules/services/cups.te
---- nsaserefpolicy/policy/modules/services/cups.te 2007-08-22 07:14:07.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/cups.te 2007-09-06 15:43:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.8/policy/modules/services/cups.te
+--- nsaserefpolicy/policy/modules/services/cups.te 2007-09-12 10:34:50.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/cups.te 2007-09-17 16:20:18.000000000 -0400
@@ -81,12 +81,11 @@
# /usr/lib/cups/backend/serial needs sys_admin(?!)
allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config };
@@ -5222,7 +4785,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
allow cupsd_t cupsd_exec_t:lnk_file read;
manage_files_pattern(cupsd_t,cupsd_log_t,cupsd_log_t)
-@@ -150,20 +149,24 @@
+@@ -129,6 +128,8 @@
+ stream_connect_pattern(cupsd_t,ptal_var_run_t,ptal_var_run_t,ptal_t)
+ allow cupsd_t ptal_var_run_t : sock_file setattr;
+
++auth_use_nsswitch(cupsd_t)
++
+ kernel_read_system_state(cupsd_t)
+ kernel_read_network_state(cupsd_t)
+ kernel_read_all_sysctls(cupsd_t)
+@@ -150,21 +151,26 @@
corenet_tcp_bind_reserved_port(cupsd_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t)
corenet_tcp_connect_all_ports(cupsd_t)
@@ -5246,9 +4818,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
fs_search_auto_mountpoints(cupsd_t)
+fs_read_anon_inodefs_files(cupsd_t)
- mls_fd_use_all_levels(cupsd_t)
++mls_fd_use_all_levels(cupsd_t)
mls_file_downgrade(cupsd_t)
-@@ -175,6 +178,7 @@
+ mls_file_write_all_levels(cupsd_t)
+ mls_file_read_all_levels(cupsd_t)
+@@ -174,6 +180,7 @@
term_search_ptys(cupsd_t)
auth_domtrans_chk_passwd(cupsd_t)
@@ -5256,7 +4830,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
auth_dontaudit_read_pam_pid(cupsd_t)
# Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp
-@@ -188,7 +192,7 @@
+@@ -187,7 +194,7 @@
# read python modules
files_read_usr_files(cupsd_t)
# for /var/lib/defoma
@@ -5265,7 +4839,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
files_list_world_readable(cupsd_t)
files_read_world_readable_files(cupsd_t)
files_read_world_readable_symlinks(cupsd_t)
-@@ -222,21 +226,45 @@
+@@ -221,17 +228,37 @@
sysnet_read_config(cupsd_t)
@@ -5303,15 +4877,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
apm_domtrans_client(cupsd_t)
')
- optional_policy(`
-+ auth_use_nsswitch(cupsd_t)
-+')
-+
-+optional_policy(`
- cron_system_entry(cupsd_t, cupsd_exec_t)
- ')
-
-@@ -264,16 +292,16 @@
+@@ -263,16 +290,16 @@
')
optional_policy(`
@@ -5332,7 +4898,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
seutil_sigchld_newrole(cupsd_t)
')
-@@ -378,6 +406,14 @@
+@@ -377,6 +404,14 @@
')
optional_policy(`
@@ -5347,7 +4913,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
')
-@@ -561,7 +597,7 @@
+@@ -560,7 +595,7 @@
dev_read_urand(hplip_t)
dev_read_rand(hplip_t)
dev_rw_generic_usb_dev(hplip_t)
@@ -5356,7 +4922,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
fs_getattr_all_fs(hplip_t)
fs_search_auto_mountpoints(hplip_t)
-@@ -588,8 +624,6 @@
+@@ -587,8 +622,6 @@
userdom_dontaudit_search_sysadm_home_dirs(hplip_t)
userdom_dontaudit_search_all_users_home_content(hplip_t)
@@ -5365,9 +4931,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
optional_policy(`
seutil_sigchld_newrole(hplip_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.7/policy/modules/services/cvs.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.8/policy/modules/services/cvs.te
--- nsaserefpolicy/policy/modules/services/cvs.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/cvs.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/cvs.te 2007-09-17 16:20:18.000000000 -0400
@@ -16,6 +16,7 @@
type cvs_t;
type cvs_exec_t;
@@ -5392,9 +4958,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.
miscfiles_read_localization(cvs_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.0.7/policy/modules/services/dbus.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.0.8/policy/modules/services/dbus.fc
--- nsaserefpolicy/policy/modules/services/dbus.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/dbus.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/dbus.fc 2007-09-17 16:20:18.000000000 -0400
@@ -5,6 +5,8 @@
/bin/dbus-daemon -- gen_context(system_u:object_r:system_dbusd_exec_t,s0)
/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
@@ -5404,9 +4970,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
ifdef(`distro_redhat',`
/var/named/chroot/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.7/policy/modules/services/dbus.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.8/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/dbus.if 2007-09-11 11:08:24.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/dbus.if 2007-09-17 16:20:18.000000000 -0400
@@ -50,6 +50,12 @@
## </param>
#
@@ -5534,9 +5100,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.0.7/policy/modules/services/dbus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.0.8/policy/modules/services/dbus.te
--- nsaserefpolicy/policy/modules/services/dbus.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/dbus.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/dbus.te 2007-09-17 16:20:18.000000000 -0400
@@ -23,6 +23,9 @@
type system_dbusd_var_run_t;
files_pid_file(system_dbusd_var_run_t)
@@ -5575,21 +5141,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
+ unconfined_use_terminals(system_dbusd_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.0.7/policy/modules/services/dhcp.te
---- nsaserefpolicy/policy/modules/services/dhcp.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/dhcp.te 2007-09-06 15:43:06.000000000 -0400
-@@ -114,6 +114,8 @@
- dbus_system_bus_client_template(dhcpd,dhcpd_t)
- dbus_connect_system_bus(dhcpd_t)
- dbus_send_system_bus(dhcpd_t)
-+ dbus_read_config(dhcpd_t)
-+ dbus_dontaudit_rw_system_selinux_socket(dhcpd_t)
- ')
-
- optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.0.7/policy/modules/services/dnsmasq.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.0.8/policy/modules/services/dnsmasq.te
--- nsaserefpolicy/policy/modules/services/dnsmasq.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/dnsmasq.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/dnsmasq.te 2007-09-17 16:20:18.000000000 -0400
@@ -94,3 +94,8 @@
optional_policy(`
udev_read_db(dnsmasq_t)
@@ -5599,9 +5153,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsm
+ virt_read_lib_files(dnsmasq_t)
+ virt_append_lib_files(dnsmasq_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.7/policy/modules/services/dovecot.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.8/policy/modules/services/dovecot.fc
--- nsaserefpolicy/policy/modules/services/dovecot.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/dovecot.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/dovecot.fc 2007-09-17 16:20:18.000000000 -0400
@@ -17,16 +17,19 @@
ifdef(`distro_debian', `
@@ -5622,9 +5176,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
/var/lib/dovecot(/.*)? gen_context(system_u:object_r:dovecot_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.7/policy/modules/services/dovecot.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.8/policy/modules/services/dovecot.if
--- nsaserefpolicy/policy/modules/services/dovecot.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/dovecot.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/dovecot.if 2007-09-17 16:20:18.000000000 -0400
@@ -18,3 +18,43 @@
manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
@@ -5669,9 +5223,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
+ domtrans_pattern($1,dovecot_deliver_exec_t,dovecot_deliver_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.7/policy/modules/services/dovecot.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.8/policy/modules/services/dovecot.te
--- nsaserefpolicy/policy/modules/services/dovecot.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/dovecot.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/dovecot.te 2007-09-17 16:20:18.000000000 -0400
@@ -15,6 +15,12 @@
domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t)
role system_r types dovecot_auth_t;
@@ -5826,9 +5380,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
+ mta_manage_spool(dovecot_deliver_t)
')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.fc serefpolicy-3.0.7/policy/modules/services/exim.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.fc serefpolicy-3.0.8/policy/modules/services/exim.fc
--- nsaserefpolicy/policy/modules/services/exim.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/services/exim.fc 2007-09-10 12:01:03.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/exim.fc 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,6 @@
+
+/usr/sbin/exim -- gen_context(system_u:object_r:exim_exec_t,s0)
@@ -5836,9 +5390,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim
+/var/run/exim.pid -- gen_context(system_u:object_r:exim_var_run_t,s0)
+/var/log/exim(/.*)? gen_context(system_u:object_r:exim_log_t,s0)
+/var/spool/exim(/.*)? gen_context(system_u:object_r:exim_spool_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.if serefpolicy-3.0.7/policy/modules/services/exim.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.if serefpolicy-3.0.8/policy/modules/services/exim.if
--- nsaserefpolicy/policy/modules/services/exim.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/services/exim.if 2007-09-10 12:01:03.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/exim.if 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,330 @@
+
+## <summary>policy for exim</summary>
@@ -6170,10 +5724,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim
+ exim_manage_spool($1)
+
+')
-Binary files nsaserefpolicy/policy/modules/services/exim.pp and serefpolicy-3.0.7/policy/modules/services/exim.pp differ
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.0.7/policy/modules/services/exim.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.0.8/policy/modules/services/exim.te
--- nsaserefpolicy/policy/modules/services/exim.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/services/exim.te 2007-09-10 15:45:46.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/exim.te 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,108 @@
+policy_module(exim,1.0.0)
+
@@ -6283,9 +5836,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim
+ userdom_write_unpriv_users_tmp_files(exim_t)
+}
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.7/policy/modules/services/ftp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.8/policy/modules/services/ftp.te
--- nsaserefpolicy/policy/modules/services/ftp.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/ftp.te 2007-09-11 14:32:19.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/ftp.te 2007-09-17 16:39:01.000000000 -0400
@@ -88,6 +88,7 @@
allow ftpd_t self:unix_stream_socket create_stream_socket_perms;
allow ftpd_t self:tcp_socket create_stream_socket_perms;
@@ -6312,22 +5865,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
miscfiles_read_localization(ftpd_t)
miscfiles_read_public_files(ftpd_t)
-@@ -217,6 +221,14 @@
+@@ -217,6 +221,11 @@
userdom_manage_all_users_home_content_dirs(ftpd_t)
userdom_manage_all_users_home_content_files(ftpd_t)
userdom_manage_all_users_home_content_symlinks(ftpd_t)
+ auth_manage_all_files_except_shadow(ftpd_t)
+
-+ ifdef(`targeted_policy',`
-+ files_manage_generic_tmp_files(ftpd_t)
-+ ')
+ auth_read_all_dirs_except_shadow(ftpd_t)
+ auth_read_all_files_except_shadow(ftpd_t)
+ auth_read_all_symlinks_except_shadow(ftpd_t)
')
tunable_policy(`ftp_home_dir && use_nfs_home_dirs',`
-@@ -252,7 +264,10 @@
+@@ -252,7 +261,10 @@
')
optional_policy(`
@@ -6338,248 +5888,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.7/policy/modules/services/hal.fc
---- nsaserefpolicy/policy/modules/services/hal.fc 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/hal.fc 2007-09-11 15:14:05.000000000 -0400
-@@ -8,9 +8,17 @@
- /usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0)
-
- /usr/sbin/hald -- gen_context(system_u:object_r:hald_exec_t,s0)
-+/usr/bin/hal-setup-keymap -- gen_context(system_u:object_r:hald_keymap_exec_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.8/policy/modules/services/hal.fc
+--- nsaserefpolicy/policy/modules/services/hal.fc 2007-09-12 10:34:50.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/hal.fc 2007-09-17 16:20:18.000000000 -0400
+@@ -13,9 +13,12 @@
/var/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0)
- /var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0)
+/var/lib/PolicyKit(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0)
+ /var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0)
+
+ /var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0)
++/var/log/pm(/.*)? gen_context(system_u:object_r:hald_log_t,s0)
++/var/run/pm(/.*)? gen_context(system_u:object_r:hald_var_run_t,s0)
/var/run/haldaemon.pid -- gen_context(system_u:object_r:hald_var_run_t,s0)
-+/var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0)
-+
-+/var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0)
-+
-+/var/run/pm(/.*)? gen_context(system_u:object_r:hald_var_run_t,s0)
-+/var/log/pm(/.*)? gen_context(system_u:object_r:hald_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.0.7/policy/modules/services/hal.if
---- nsaserefpolicy/policy/modules/services/hal.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/hal.if 2007-09-06 15:43:06.000000000 -0400
-@@ -208,3 +208,98 @@
- files_search_pids($1)
- allow $1 hald_var_run_t:file rw_file_perms;
- ')
-+
-+########################################
-+## <summary>
-+## Do not audit attempts to write the hal
-+## log files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit
-+## </summary>
-+## </param>
-+#
-+interface(`hal_dontaudit_write_log',`
-+ gen_require(`
-+ type hald_log_t;
-+ ')
-+
-+ dontaudit $1 hald_log_t:file { append write };
-+')
-+
-+########################################
-+## <summary>
-+## Allow attempts to write the hal
-+## log files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit
-+## </summary>
-+## </param>
-+#
-+interface(`hal_write_log',`
-+ gen_require(`
-+ type hald_log_t;
-+ ')
-+
-+ logging_search_logs($1)
-+ allow $1 hald_log_t:file rw_file_perms;
-+')
-+
-+########################################
-+## <summary>
-+## Allow domain to use file descriptors from hal.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`hal_use_fds',`
-+ gen_require(`
-+ type hald_t;
-+ ')
-+
-+ allow $1 hald_t:fd use;
-+')
-+
-+########################################
-+## <summary>
-+## Allow attempts to read and write to
-+## hald unnamed pipes.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`hal_rw_pipes',`
-+ gen_require(`
-+ type hald_t;
-+ ')
-+
-+ allow $1 hald_t:fifo_file rw_fifo_file_perms;
-+')
-+
-+########################################
-+## <summary>
-+## Allow ptrace of hal domain
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`hal_ptrace',`
-+ gen_require(`
-+ type hald_t;
-+ ')
-+
-+ allow $1 hald_t:process ptrace;
-+')
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.7/policy/modules/services/hal.te
---- nsaserefpolicy/policy/modules/services/hal.te 2007-08-22 07:14:07.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/hal.te 2007-09-06 15:43:06.000000000 -0400
-@@ -22,6 +22,12 @@
- type hald_log_t;
- files_type(hald_log_t)
-
-+type hald_keymap_t;
-+type hald_keymap_exec_t;
-+domain_type(hald_keymap_t)
-+domain_entry_file(hald_keymap_t,hald_keymap_exec_t)
-+role system_r types hald_keymap_t;
-+
- type hald_mac_t;
- type hald_mac_exec_t;
- domain_type(hald_mac_t)
-@@ -81,6 +87,7 @@
-
- kernel_read_system_state(hald_t)
- kernel_read_network_state(hald_t)
-+kernel_read_software_raid_state(hald_t)
- kernel_rw_kernel_sysctl(hald_t)
- kernel_read_fs_sysctls(hald_t)
- kernel_rw_irq_sysctls(hald_t)
-@@ -114,6 +121,9 @@
- dev_rw_power_management(hald_t)
- # hal is now execing pm-suspend
- dev_rw_sysfs(hald_t)
-+dev_read_sound(hald_t)
-+dev_write_sound(hald_t)
-+dev_read_raw_memory(hald_t)
-
- domain_use_interactive_fds(hald_t)
- domain_read_all_domains_state(hald_t)
-@@ -131,6 +141,7 @@
- files_create_boot_flag(hald_t)
- files_getattr_all_dirs(hald_t)
- files_read_kernel_img(hald_t)
-+files_rw_lock_dirs(hald_t)
-
- fs_getattr_all_fs(hald_t)
- fs_search_all(hald_t)
-@@ -163,6 +174,7 @@
- #hal runs shutdown, probably need a shutdown domain
- init_rw_utmp(hald_t)
- init_telinit(hald_t)
-+init_dontaudit_use_fds(hald_t)
-
- libs_use_ld_so(hald_t)
- libs_use_shared_libs(hald_t)
-@@ -180,6 +192,7 @@
-
- seutil_read_config(hald_t)
- seutil_read_default_contexts(hald_t)
-+seutil_read_file_contexts(hald_t)
-
- sysnet_read_config(hald_t)
-
-@@ -187,6 +200,7 @@
- userdom_dontaudit_search_sysadm_home_dirs(hald_t)
-
- optional_policy(`
-+ alsa_domtrans(hald_t)
- alsa_read_rw_config(hald_t)
- ')
-
-@@ -283,6 +297,7 @@
- #
-
- allow hald_acl_t self:capability { dac_override fowner };
-+allow hald_acl_t self:process signal;
- allow hald_acl_t self:fifo_file read_fifo_file_perms;
-
- domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t)
-@@ -296,7 +311,10 @@
- corecmd_exec_bin(hald_acl_t)
-
- dev_getattr_all_chr_files(hald_acl_t)
-+dev_getattr_generic_usb_dev(hald_acl_t)
-+dev_getattr_video_dev(hald_acl_t)
- dev_setattr_video_dev(hald_acl_t)
-+dev_getattr_sound_dev(hald_acl_t)
- dev_setattr_sound_dev(hald_acl_t)
- dev_setattr_generic_usb_dev(hald_acl_t)
- dev_setattr_usbfs_files(hald_acl_t)
-@@ -358,3 +376,25 @@
- libs_use_shared_libs(hald_sonypic_t)
-
- miscfiles_read_localization(hald_sonypic_t)
-+
-+########################################
-+#
-+# Local hald keymap policy
-+#
-+
-+domtrans_pattern(hald_t, hald_keymap_exec_t, hald_keymap_t)
-+allow hald_t hald_keymap_t:process signal;
-+allow hald_keymap_t hald_t:unix_stream_socket connectto;
-+
-+manage_dirs_pattern(hald_keymap_t,hald_var_lib_t,hald_var_lib_t)
-+manage_files_pattern(hald_keymap_t,hald_var_lib_t,hald_var_lib_t)
-+files_search_var_lib(hald_keymap_t)
-+
-+files_read_usr_files(hald_keymap_t)
-+
-+libs_use_ld_so(hald_keymap_t)
-+libs_use_shared_libs(hald_keymap_t)
-+
-+miscfiles_read_localization(hald_keymap_t)
-+
-+dev_rw_input_dev(hald_keymap_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.7/policy/modules/services/inetd.te
---- nsaserefpolicy/policy/modules/services/inetd.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/inetd.te 2007-09-10 16:31:50.000000000 -0400
-@@ -53,6 +53,8 @@
- allow inetd_t inetd_var_run_t:file manage_file_perms;
- files_pid_filetrans(inetd_t,inetd_var_run_t,file)
-
-+auth_search_key(inetd_t)
+ /var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.8/policy/modules/services/hal.te
+--- nsaserefpolicy/policy/modules/services/hal.te 2007-09-12 10:34:50.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/hal.te 2007-09-17 16:20:18.000000000 -0400
+@@ -293,6 +293,7 @@
+ #
+
+ allow hald_acl_t self:capability { dac_override fowner };
++allow hald_acl_t self:process signal;
+ allow hald_acl_t self:fifo_file read_fifo_file_perms;
+
+ domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.8/policy/modules/services/inetd.te
+--- nsaserefpolicy/policy/modules/services/inetd.te 2007-09-12 10:34:50.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/inetd.te 2007-09-17 16:20:18.000000000 -0400
+@@ -53,6 +53,8 @@
+ allow inetd_t inetd_var_run_t:file manage_file_perms;
+ files_pid_filetrans(inetd_t,inetd_var_run_t,file)
+
++auth_search_key(inetd_t)
+
kernel_read_kernel_sysctls(inetd_t)
kernel_list_proc(inetd_t)
@@ -6606,16 +5949,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
corenet_udp_bind_tftp_port(inetd_t)
corenet_tcp_bind_ssh_port(inetd_t)
-@@ -135,14 +142,19 @@
- mls_fd_use_all_levels(inetd_t)
+@@ -132,8 +139,10 @@
+ miscfiles_read_localization(inetd_t)
+
+ # xinetd needs MLS override privileges to work
++mls_fd_use_all_levels(inetd_t)
mls_fd_share_all_levels(inetd_t)
mls_socket_read_to_clearance(inetd_t)
+mls_socket_write_to_clearance(inetd_t)
mls_process_set_level(inetd_t)
--mls_socket_read_to_clearance(inetd_t)
sysnet_read_config(inetd_t)
-
+@@ -141,6 +150,11 @@
userdom_dontaudit_use_unpriv_user_fds(inetd_t)
userdom_dontaudit_search_sysadm_home_dirs(inetd_t)
@@ -6627,7 +5972,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
optional_policy(`
amanda_search_lib(inetd_t)
')
-@@ -172,6 +184,9 @@
+@@ -170,6 +184,9 @@
# for identd
allow inetd_child_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
allow inetd_child_t self:capability { setuid setgid };
@@ -6637,7 +5982,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
files_search_home(inetd_child_t)
manage_dirs_pattern(inetd_child_t,inetd_child_tmp_t,inetd_child_tmp_t)
-@@ -214,13 +229,10 @@
+@@ -212,13 +229,10 @@
')
optional_policy(`
@@ -6653,17 +5998,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
unconfined_domain(inetd_child_t)
+ inetd_service_domain(inetd_child_t,bin_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.fc serefpolicy-3.0.7/policy/modules/services/kerberos.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.fc serefpolicy-3.0.8/policy/modules/services/kerberos.fc
--- nsaserefpolicy/policy/modules/services/kerberos.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/kerberos.fc 2007-09-11 09:03:41.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/kerberos.fc 2007-09-17 16:20:18.000000000 -0400
@@ -16,3 +16,4 @@
/var/log/krb5kdc\.log gen_context(system_u:object_r:krb5kdc_log_t,s0)
/var/log/kadmin(d)?\.log gen_context(system_u:object_r:kadmind_log_t,s0)
+/var/tmp/host_0 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-3.0.7/policy/modules/services/kerberos.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-3.0.8/policy/modules/services/kerberos.if
--- nsaserefpolicy/policy/modules/services/kerberos.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/kerberos.if 2007-09-11 09:02:54.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/kerberos.if 2007-09-17 16:20:18.000000000 -0400
@@ -42,6 +42,10 @@
dontaudit $1 krb5_conf_t:file write;
dontaudit $1 krb5kdc_conf_t:dir list_dir_perms;
@@ -6701,9 +6046,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
+ seutil_read_file_contexts($1)
+ allow $1 krb5_host_rcache_t:file manage_file_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.7/policy/modules/services/kerberos.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.8/policy/modules/services/kerberos.te
--- nsaserefpolicy/policy/modules/services/kerberos.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/kerberos.te 2007-09-11 09:02:44.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/kerberos.te 2007-09-17 16:20:18.000000000 -0400
@@ -54,6 +54,9 @@
type krb5kdc_var_run_t;
files_pid_file(krb5kdc_var_run_t)
@@ -6782,9 +6127,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ktalk.te serefpolicy-3.0.7/policy/modules/services/ktalk.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ktalk.te serefpolicy-3.0.8/policy/modules/services/ktalk.te
--- nsaserefpolicy/policy/modules/services/ktalk.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/ktalk.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/ktalk.te 2007-09-17 16:20:18.000000000 -0400
@@ -49,6 +49,8 @@
manage_files_pattern(ktalkd_t,ktalkd_var_run_t,ktalkd_var_run_t)
files_pid_filetrans(ktalkd_t,ktalkd_var_run_t,file)
@@ -6808,9 +6153,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ktal
- nscd_socket_use(ktalkd_t)
-')
+term_search_ptys(ktalkd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.7/policy/modules/services/lpd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.8/policy/modules/services/lpd.if
--- nsaserefpolicy/policy/modules/services/lpd.if 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/lpd.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/lpd.if 2007-09-17 16:20:18.000000000 -0400
@@ -394,3 +394,22 @@
domtrans_pattern($2, lpr_exec_t, $1_lpr_t)
@@ -6834,9 +6179,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.
+
+ can_exec($1,lpr_exec_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.7/policy/modules/services/mailman.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.8/policy/modules/services/mailman.te
--- nsaserefpolicy/policy/modules/services/mailman.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/mailman.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/mailman.te 2007-09-17 16:20:18.000000000 -0400
@@ -55,6 +55,7 @@
apache_use_fds(mailman_cgi_t)
apache_dontaudit_append_log(mailman_cgi_t)
@@ -6853,15 +6198,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail
files_dontaudit_search_pids(mailman_queue_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.7/policy/modules/services/mailscanner.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.8/policy/modules/services/mailscanner.fc
--- nsaserefpolicy/policy/modules/services/mailscanner.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/services/mailscanner.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/mailscanner.fc 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,2 @@
+/var/spool/MailScanner(/.*)? gen_context(system_u:object_r:mailscanner_spool_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.7/policy/modules/services/mailscanner.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.8/policy/modules/services/mailscanner.if
--- nsaserefpolicy/policy/modules/services/mailscanner.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/services/mailscanner.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/mailscanner.if 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,59 @@
+## <summary>Anti-Virus and Anti-Spam Filter</summary>
+
@@ -6922,18 +6267,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail
+ files_search_spool($1)
+ manage_files_pattern($1,mailscanner_spool_t,mailscanner_spool_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.7/policy/modules/services/mailscanner.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.8/policy/modules/services/mailscanner.te
--- nsaserefpolicy/policy/modules/services/mailscanner.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/services/mailscanner.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/mailscanner.te 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,5 @@
+
+policy_module(mailscanner,1.0.0)
+
+type mailscanner_spool_t;
+files_type(mailscanner_spool_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.7/policy/modules/services/mta.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.8/policy/modules/services/mta.if
--- nsaserefpolicy/policy/modules/services/mta.if 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/mta.if 2007-09-10 15:34:04.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/mta.if 2007-09-17 16:20:18.000000000 -0400
@@ -226,6 +226,15 @@
tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_files($1_mail_t)
@@ -7033,9 +6378,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
#######################################
## <summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.7/policy/modules/services/mta.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.8/policy/modules/services/mta.te
--- nsaserefpolicy/policy/modules/services/mta.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/mta.te 2007-09-10 15:33:31.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/mta.te 2007-09-17 16:26:13.000000000 -0400
@@ -6,6 +6,7 @@
# Declarations
#
@@ -7060,38 +6405,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
dev_read_rand(system_mail_t)
dev_read_urand(system_mail_t)
-@@ -51,16 +54,46 @@
+@@ -51,16 +54,19 @@
userdom_use_sysadm_terms(system_mail_t)
userdom_dontaudit_search_sysadm_home_dirs(system_mail_t)
+userdom_dontaudit_search_all_users_home_content(system_mail_t)
-+
-+ifdef(`targeted_policy',`
-+
-+ manage_dirs_pattern(system_mail_t,mail_spool_t,mail_spool_t)
-+ manage_files_pattern(system_mail_t,mail_spool_t,mail_spool_t)
-+ manage_lnk_files_pattern(system_mail_t,mail_spool_t,mail_spool_t)
-+ manage_fifo_files_pattern(system_mail_t,mail_spool_t,mail_spool_t)
-+
-+ # for reading .forward - maybe we need a new type for it?
-+ # also for delivering mail to maildir
-+ userdom_manage_generic_user_home_content_dirs(mailserver_delivery)
-+ userdom_manage_generic_user_home_content_files(mailserver_delivery)
-+ userdom_manage_generic_user_home_content_symlinks(mailserver_delivery)
-+ userdom_manage_generic_user_home_content_sockets(mailserver_delivery)
-+ userdom_manage_generic_user_home_content_pipes(mailserver_delivery)
-+ userdom_generic_user_home_dir_filetrans_generic_user_home_content(mailserver_delivery,{ dir file lnk_file sock_file fifo_file })
-+
-+# cjp: another require-in-else to resolve
-+# optional_policy(`',`
-+ corecmd_exec_all_executables(system_mail_t)
-+
-+ files_exec_etc_files(system_mail_t)
-+
-+ libs_exec_ld_so(system_mail_t)
-+ libs_exec_lib_files(system_mail_t)
-+# ')
-+')
optional_policy(`
apache_read_squirrelmail_data(system_mail_t)
@@ -7107,7 +6425,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
')
optional_policy(`
-@@ -73,6 +106,7 @@
+@@ -73,6 +79,7 @@
optional_policy(`
cron_read_system_job_tmp_files(system_mail_t)
@@ -7115,18 +6433,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
cron_dontaudit_write_pipes(system_mail_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.fc serefpolicy-3.0.7/policy/modules/services/mysql.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.fc serefpolicy-3.0.8/policy/modules/services/mysql.fc
--- nsaserefpolicy/policy/modules/services/mysql.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/mysql.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/mysql.fc 2007-09-17 16:20:18.000000000 -0400
@@ -22,3 +22,5 @@
/var/log/mysql.* -- gen_context(system_u:object_r:mysqld_log_t,s0)
/var/run/mysqld(/.*)? gen_context(system_u:object_r:mysqld_var_run_t,s0)
+
+/etc/rc\.d/init\.d/mysqld -- gen_context(system_u:object_r:mysqld_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.if serefpolicy-3.0.7/policy/modules/services/mysql.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.if serefpolicy-3.0.8/policy/modules/services/mysql.if
--- nsaserefpolicy/policy/modules/services/mysql.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/mysql.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/mysql.if 2007-09-17 16:20:18.000000000 -0400
@@ -157,3 +157,79 @@
logging_search_logs($1)
allow $1 mysqld_log_t:file { write append setattr ioctl };
@@ -7207,9 +6525,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq
+ manage_dirs_pattern($1,mysqld_tmp_t,mysqld_tmp_t)
+ manage_files_pattern($1,mysqld_tmp_t,mysqld_tmp_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.0.7/policy/modules/services/mysql.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.0.8/policy/modules/services/mysql.te
--- nsaserefpolicy/policy/modules/services/mysql.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/mysql.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/mysql.te 2007-09-17 16:20:18.000000000 -0400
@@ -25,6 +25,9 @@
type mysqld_tmp_t;
files_tmp_file(mysqld_tmp_t)
@@ -7220,9 +6538,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq
########################################
#
# Local policy
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.0.7/policy/modules/services/nagios.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.0.8/policy/modules/services/nagios.fc
--- nsaserefpolicy/policy/modules/services/nagios.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/nagios.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/nagios.fc 2007-09-17 16:20:18.000000000 -0400
@@ -4,13 +4,15 @@
/usr/bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0)
/usr/bin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0)
@@ -7242,9 +6560,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi
-/usr/lib/cgi-bin/nagios/.+ -- gen_context(system_u:object_r:nagios_cgi_exec_t,s0)
')
+/usr/lib(64)?/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.0.7/policy/modules/services/nagios.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.0.8/policy/modules/services/nagios.if
--- nsaserefpolicy/policy/modules/services/nagios.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/nagios.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/nagios.if 2007-09-17 16:20:18.000000000 -0400
@@ -44,25 +44,6 @@
########################################
@@ -7271,9 +6589,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi
## Execute the nagios NRPE with
## a domain transition.
## </summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.0.7/policy/modules/services/nagios.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.0.8/policy/modules/services/nagios.te
--- nsaserefpolicy/policy/modules/services/nagios.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/nagios.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/nagios.te 2007-09-17 16:20:18.000000000 -0400
@@ -10,10 +10,6 @@
type nagios_exec_t;
init_daemon_domain(nagios_t,nagios_exec_t)
@@ -7377,19 +6695,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi
########################################
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.0.7/policy/modules/services/networkmanager.fc
---- nsaserefpolicy/policy/modules/services/networkmanager.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/networkmanager.fc 2007-09-06 15:43:06.000000000 -0400
-@@ -1,5 +1,6 @@
-
- /usr/(s)?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0)
-+/usr/(s)?bin/wpa_supplicant -- gen_context(system_u:object_r:NetworkManager_exec_t,s0)
- /var/run/NetworkManager\.pid -- gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
- /var/run/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
- /var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.7/policy/modules/services/networkmanager.te
---- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-08-22 07:14:07.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/networkmanager.te 2007-09-11 14:21:48.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.8/policy/modules/services/networkmanager.te
+--- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-09-12 10:34:50.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/networkmanager.te 2007-09-17 16:20:18.000000000 -0400
@@ -20,7 +20,7 @@
# networkmanager will ptrace itself if gdb is installed
@@ -7399,16 +6707,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
dontaudit NetworkManager_t self:capability { sys_tty_config sys_ptrace };
allow NetworkManager_t self:process { ptrace setcap setpgid getsched signal_perms };
allow NetworkManager_t self:fifo_file rw_fifo_file_perms;
-@@ -41,6 +41,8 @@
- kernel_read_kernel_sysctls(NetworkManager_t)
- kernel_load_module(NetworkManager_t)
-
-+can_exec(NetworkManager_t, NetworkManager_exec_t)
-+
- corenet_all_recvfrom_unlabeled(NetworkManager_t)
- corenet_all_recvfrom_netlabel(NetworkManager_t)
- corenet_tcp_sendrecv_all_if(NetworkManager_t)
-@@ -136,6 +138,9 @@
+@@ -138,6 +138,9 @@
dbus_system_bus_client_template(NetworkManager,NetworkManager_t)
dbus_connect_system_bus(NetworkManager_t)
dbus_send_system_bus(NetworkManager_t)
@@ -7418,19 +6717,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
')
optional_policy(`
-@@ -152,6 +157,11 @@
- ')
-
- optional_policy(`
-+ openvpn_domtrans(NetworkManager_t)
-+ openvpn_signal(NetworkManager_t)
-+')
-+
-+optional_policy(`
- ppp_domtrans(NetworkManager_t)
- ppp_read_pid_files(NetworkManager_t)
- ppp_signal(NetworkManager_t)
-@@ -166,8 +176,10 @@
+@@ -173,8 +176,10 @@
')
optional_policy(`
@@ -7441,9 +6728,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.7/policy/modules/services/nis.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.8/policy/modules/services/nis.fc
--- nsaserefpolicy/policy/modules/services/nis.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/nis.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/nis.fc 2007-09-17 16:20:18.000000000 -0400
@@ -4,6 +4,7 @@
/sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0)
@@ -7452,9 +6739,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
/usr/sbin/rpc\.yppasswdd -- gen_context(system_u:object_r:yppasswdd_exec_t,s0)
/usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.7/policy/modules/services/nis.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.8/policy/modules/services/nis.if
--- nsaserefpolicy/policy/modules/services/nis.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/nis.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/nis.if 2007-09-17 16:20:18.000000000 -0400
@@ -49,8 +49,8 @@
corenet_udp_bind_all_nodes($1)
corenet_tcp_bind_generic_port($1)
@@ -7466,9 +6753,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
corenet_dontaudit_tcp_bind_all_ports($1)
corenet_dontaudit_udp_bind_all_ports($1)
corenet_tcp_connect_portmap_port($1)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.7/policy/modules/services/nis.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.8/policy/modules/services/nis.te
--- nsaserefpolicy/policy/modules/services/nis.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/nis.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/nis.te 2007-09-17 16:20:18.000000000 -0400
@@ -113,6 +113,14 @@
userdom_dontaudit_use_unpriv_user_fds(ypbind_t)
userdom_dontaudit_search_sysadm_home_dirs(ypbind_t)
@@ -7521,9 +6808,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)
corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t)
corenet_tcp_connect_all_ports(ypxfr_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.7/policy/modules/services/nscd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.8/policy/modules/services/nscd.te
--- nsaserefpolicy/policy/modules/services/nscd.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/nscd.te 2007-09-11 10:21:10.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/nscd.te 2007-09-17 16:20:18.000000000 -0400
@@ -28,14 +28,14 @@
# Local policy
#
@@ -7572,9 +6859,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd
+ samba_read_config(nscd_t)
+ samba_read_var_files(nscd_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.0.7/policy/modules/services/ntp.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.0.8/policy/modules/services/ntp.fc
--- nsaserefpolicy/policy/modules/services/ntp.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/ntp.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/ntp.fc 2007-09-17 16:20:18.000000000 -0400
@@ -17,3 +17,8 @@
/var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0)
@@ -7584,9 +6871,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
+/etc/ntp/keys -- gen_context(system_u:object_r:ntpd_key_t,s0)
+
+/etc/rc\.d/init\.d/ntpd -- gen_context(system_u:object_r:ntpd_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.if serefpolicy-3.0.7/policy/modules/services/ntp.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.if serefpolicy-3.0.8/policy/modules/services/ntp.if
--- nsaserefpolicy/policy/modules/services/ntp.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/ntp.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/ntp.if 2007-09-17 16:20:18.000000000 -0400
@@ -53,3 +53,59 @@
corecmd_search_bin($1)
domtrans_pattern($1,ntpdate_exec_t,ntpd_t)
@@ -7647,9 +6934,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
+ allow $1 ntpd_t:process signal;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.7/policy/modules/services/ntp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.8/policy/modules/services/ntp.te
--- nsaserefpolicy/policy/modules/services/ntp.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/ntp.te 2007-09-11 10:21:22.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/ntp.te 2007-09-17 16:20:18.000000000 -0400
@@ -25,6 +25,12 @@
type ntpdate_exec_t;
init_system_domain(ntpd_t,ntpdate_exec_t)
@@ -7710,157 +6997,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
logrotate_exec(ntpd_t)
')
-@@ -132,3 +150,4 @@
- optional_policy(`
- udev_read_db(ntpd_t)
- ')
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-3.0.7/policy/modules/services/openvpn.if
---- nsaserefpolicy/policy/modules/services/openvpn.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/openvpn.if 2007-09-06 15:43:06.000000000 -0400
-@@ -22,3 +22,71 @@
- read_files_pattern($1,openvpn_etc_t,openvpn_etc_t)
- read_lnk_files_pattern($1,openvpn_etc_t,openvpn_etc_t)
- ')
-+
-+########################################
-+## <summary>
-+## Execute OPENVPN clients in the openvpn domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`openvpn_domtrans',`
-+ gen_require(`
-+ type openvpn_t, openvpn_exec_t;
-+ ')
-+
-+ domtrans_pattern($1,openvpn_exec_t,openvpn_t)
-+')
-+
-+########################################
-+## <summary>
-+## Execute OPENVPN clients in the openvpn domain, and
-+## allow the specified role the openvpn domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <param name="role">
-+## <summary>
-+## The role to be allowed the openvpn domain.
-+## </summary>
-+## </param>
-+## <param name="terminal">
-+## <summary>
-+## The type of the terminal allow the openvpn domain to use.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`openvpn_run',`
-+ gen_require(`
-+ type openvpn_t;
-+ ')
-+
-+ openvpn_domtrans($1)
-+ role $2 types openvpn_t;
-+ allow openvpn_t $3:chr_file rw_term_perms;
-+')
-+
-+########################################
-+## <summary>
-+## Send generic signals to OPENVPN clients.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`openvpn_signal',`
-+ gen_require(`
-+ type openvpn_t;
-+ ')
-+
-+ allow $1 openvpn_t:process signal;
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.7/policy/modules/services/openvpn.te
---- nsaserefpolicy/policy/modules/services/openvpn.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/openvpn.te 2007-09-06 15:43:06.000000000 -0400
-@@ -6,6 +6,13 @@
- # Declarations
- #
-
-+## <desc>
-+## <p>
-+## Allow openvpn to read home directories
-+## </p>
-+## </desc>
-+gen_tunable(openvpn_enable_homedirs,false)
-+
- # main openvpn domain
- type openvpn_t;
- type openvpn_exec_t;
-@@ -28,7 +35,9 @@
- # openvpn local policy
- #
-
--allow openvpn_t self:capability { net_bind_service net_admin setgid setuid sys_tty_config };
-+allow openvpn_t self:capability { dac_read_search dac_override net_bind_service net_admin setgid setuid sys_tty_config };
-+allow openvpn_t self:process { signal getsched };
-+
- allow openvpn_t self:unix_dgram_socket { create_socket_perms sendto };
- allow openvpn_t self:unix_stream_socket { create_stream_socket_perms connectto };
- allow openvpn_t self:udp_socket create_socket_perms;
-@@ -42,8 +51,8 @@
- allow openvpn_t openvpn_var_log_t:file manage_file_perms;
- logging_log_filetrans(openvpn_t,openvpn_var_log_t,file)
-
--allow openvpn_t openvpn_var_run_t:file manage_file_perms;
--files_pid_filetrans(openvpn_t, openvpn_var_run_t, file)
-+manage_files_pattern(openvpn_t,openvpn_var_run_t,openvpn_var_run_t)
-+files_pid_filetrans(openvpn_t, openvpn_var_run_t, { file dir })
-
- kernel_read_kernel_sysctls(openvpn_t)
- kernel_read_net_sysctls(openvpn_t)
-@@ -67,6 +76,7 @@
- corenet_udp_bind_openvpn_port(openvpn_t)
- corenet_sendrecv_openvpn_server_packets(openvpn_t)
- corenet_rw_tun_tap_dev(openvpn_t)
-+corenet_tcp_connect_openvpn_port(openvpn_t)
-
- dev_search_sysfs(openvpn_t)
- dev_read_rand(openvpn_t)
-@@ -81,10 +91,31 @@
- logging_send_syslog_msg(openvpn_t)
-
- miscfiles_read_localization(openvpn_t)
-+miscfiles_read_certs(openvpn_t)
-
- sysnet_dns_name_resolve(openvpn_t)
- sysnet_exec_ifconfig(openvpn_t)
-
-+tunable_policy(`openvpn_enable_homedirs',`
-+ userdom_read_unpriv_users_home_content_files(openvpn_t)
-+')
-+
- optional_policy(`
- daemontools_service_domain(openvpn_t,openvpn_exec_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.8/policy/modules/services/openvpn.te
+--- nsaserefpolicy/policy/modules/services/openvpn.te 2007-09-12 10:34:50.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/openvpn.te 2007-09-17 16:20:18.000000000 -0400
+@@ -108,6 +108,14 @@
+ dbus_system_bus_client_template(openvpn,openvpn_t)
+ dbus_connect_system_bus(openvpn_t)
+ dbus_send_system_bus(openvpn_t)
+-
+ networkmanager_dbus_chat(openvpn_t)
')
+
-+optional_policy(`
-+ dbus_system_bus_client_template(openvpn,openvpn_t)
-+ dbus_connect_system_bus(openvpn_t)
-+ dbus_send_system_bus(openvpn_t)
-+ networkmanager_dbus_chat(openvpn_t)
-+')
-+
+
+# Need to interact with terminals if config option "auth-user-pass" is used
+userdom_use_sysadm_terms(openvpn_t)
@@ -7869,9 +7016,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
+ unconfined_use_terminals(openvpn_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.7/policy/modules/services/pegasus.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.8/policy/modules/services/pegasus.if
--- nsaserefpolicy/policy/modules/services/pegasus.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/pegasus.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/pegasus.if 2007-09-17 16:20:18.000000000 -0400
@@ -1 +1,19 @@
## <summary>The Open Group Pegasus CIM/WBEM Server.</summary>
+
@@ -7892,9 +7039,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
+
+ domtrans_pattern($1,pegasus_exec_t,pegasus_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.7/policy/modules/services/pegasus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.8/policy/modules/services/pegasus.te
--- nsaserefpolicy/policy/modules/services/pegasus.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/pegasus.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/pegasus.te 2007-09-17 16:20:18.000000000 -0400
@@ -42,6 +42,7 @@
allow pegasus_t pegasus_conf_t:file { read_file_perms link unlink };
allow pegasus_t pegasus_conf_t:lnk_file read_lnk_file_perms;
@@ -7942,9 +7089,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
rpm_exec(pegasus_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.7/policy/modules/services/portslave.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.8/policy/modules/services/portslave.te
--- nsaserefpolicy/policy/modules/services/portslave.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/portslave.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/portslave.te 2007-09-17 16:20:18.000000000 -0400
@@ -85,6 +85,7 @@
auth_rw_login_records(portslave_t)
@@ -7953,9 +7100,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port
init_rw_utmp(portslave_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.7/policy/modules/services/postfix.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.8/policy/modules/services/postfix.fc
--- nsaserefpolicy/policy/modules/services/postfix.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/postfix.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/postfix.fc 2007-09-17 16:20:18.000000000 -0400
@@ -14,6 +14,7 @@
/usr/libexec/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
/usr/libexec/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
@@ -7964,9 +7111,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
', `
/usr/lib/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
/usr/lib/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.7/policy/modules/services/postfix.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.8/policy/modules/services/postfix.if
--- nsaserefpolicy/policy/modules/services/postfix.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/postfix.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/postfix.if 2007-09-17 16:20:18.000000000 -0400
@@ -41,6 +41,8 @@
allow postfix_$1_t self:unix_stream_socket connectto;
@@ -8088,9 +7235,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+ allow $1 postfix_private_t:dir list_dir_perms;
+ create_sock_files_pattern($1,postfix_private_t,postfix_private_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.7/policy/modules/services/postfix.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.8/policy/modules/services/postfix.te
--- nsaserefpolicy/policy/modules/services/postfix.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/postfix.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/postfix.te 2007-09-17 16:20:18.000000000 -0400
@@ -6,6 +6,14 @@
# Declarations
#
@@ -8265,18 +7412,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+# For reading spamassasin
+mta_read_config(postfix_virtual_t)
+mta_manage_spool(postfix_virtual_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.fc serefpolicy-3.0.7/policy/modules/services/postgresql.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.fc serefpolicy-3.0.8/policy/modules/services/postgresql.fc
--- nsaserefpolicy/policy/modules/services/postgresql.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/postgresql.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/postgresql.fc 2007-09-17 16:20:18.000000000 -0400
@@ -38,3 +38,5 @@
')
/var/run/postgresql(/.*)? gen_context(system_u:object_r:postgresql_var_run_t,s0)
+
+/etc/rc\.d/init\.d/postgresql -- gen_context(system_u:object_r:postgresql_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.0.7/policy/modules/services/postgresql.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.0.8/policy/modules/services/postgresql.if
--- nsaserefpolicy/policy/modules/services/postgresql.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/postgresql.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/postgresql.if 2007-09-17 16:20:18.000000000 -0400
@@ -113,3 +113,77 @@
# Some versions of postgresql put the sock file in /tmp
allow $1 postgresql_tmp_t:sock_file write;
@@ -8355,9 +7502,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+ manage_dirs_pattern($1,postgresql_tmp_t,postgresql_tmp_t)
+ manage_files_pattern($1,postgresql_tmp_t,postgresql_tmp_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.0.7/policy/modules/services/postgresql.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.0.8/policy/modules/services/postgresql.te
--- nsaserefpolicy/policy/modules/services/postgresql.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/postgresql.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/postgresql.te 2007-09-17 16:20:18.000000000 -0400
@@ -27,6 +27,9 @@
type postgresql_var_run_t;
files_pid_file(postgresql_var_run_t)
@@ -8368,9 +7515,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
########################################
#
# postgresql Local policy
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.7/policy/modules/services/procmail.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.8/policy/modules/services/procmail.te
--- nsaserefpolicy/policy/modules/services/procmail.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/procmail.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/procmail.te 2007-09-17 16:20:18.000000000 -0400
@@ -30,6 +30,8 @@
allow procmail_t procmail_tmp_t:file manage_file_perms;
files_tmp_filetrans(procmail_t, procmail_tmp_t, file)
@@ -8406,9 +7553,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc
+optional_policy(`
+ mailscanner_read_spool(procmail_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.7/policy/modules/services/pyzor.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.8/policy/modules/services/pyzor.if
--- nsaserefpolicy/policy/modules/services/pyzor.if 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/pyzor.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/pyzor.if 2007-09-17 16:20:18.000000000 -0400
@@ -25,16 +25,16 @@
#
template(`pyzor_per_role_template',`
@@ -8431,43 +7578,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.0.7/policy/modules/services/pyzor.te
---- nsaserefpolicy/policy/modules/services/pyzor.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/pyzor.te 2007-09-06 15:43:06.000000000 -0400
-@@ -70,6 +70,11 @@
-
- userdom_dontaudit_search_sysadm_home_dirs(pyzor_t)
-
-+ifdef(`targeted_policy',`
-+ userdom_dontaudit_write_sysadm_home_dirs(pyzor_t)
-+ userdom_read_generic_user_home_content_files(pyzor_t)
-+')
-+
- optional_policy(`
- amavis_manage_lib_files(pyzor_t)
- amavis_manage_spool_files(pyzor_t)
-@@ -133,6 +138,10 @@
-
- mta_manage_spool(pyzord_t)
-
-+ifdef(`targeted_policy',`
-+ userdom_read_generic_user_home_content_files(pyzord_t)
-+')
-+
- optional_policy(`
- logging_send_syslog_msg(pyzord_t)
- ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.fc serefpolicy-3.0.7/policy/modules/services/radius.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.fc serefpolicy-3.0.8/policy/modules/services/radius.fc
--- nsaserefpolicy/policy/modules/services/radius.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/radius.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/radius.fc 2007-09-17 16:20:18.000000000 -0400
@@ -18,3 +18,4 @@
/var/run/radiusd(/.*)? gen_context(system_u:object_r:radiusd_var_run_t,s0)
/var/run/radiusd\.pid -- gen_context(system_u:object_r:radiusd_var_run_t,s0)
+/var/lib/radiousd(/.*)? gen_context(system_u:object_r:radiusd_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.7/policy/modules/services/radius.te
---- nsaserefpolicy/policy/modules/services/radius.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/radius.te 2007-09-06 15:43:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.8/policy/modules/services/radius.te
+--- nsaserefpolicy/policy/modules/services/radius.te 2007-09-12 10:34:50.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/radius.te 2007-09-17 16:20:18.000000000 -0400
@@ -19,6 +19,9 @@
type radiusd_log_t;
logging_log_file(radiusd_log_t)
@@ -8495,17 +7616,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi
corecmd_exec_bin(radiusd_t)
corecmd_exec_shell(radiusd_t)
-@@ -99,6 +105,7 @@
- logging_send_syslog_msg(radiusd_t)
-
- miscfiles_read_localization(radiusd_t)
-+miscfiles_read_certs(radiusd_t)
-
- sysnet_read_config(radiusd_t)
-
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remotelogin.te serefpolicy-3.0.7/policy/modules/services/remotelogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remotelogin.te serefpolicy-3.0.8/policy/modules/services/remotelogin.te
--- nsaserefpolicy/policy/modules/services/remotelogin.te 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/remotelogin.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/remotelogin.te 2007-09-17 16:20:18.000000000 -0400
@@ -85,6 +85,7 @@
miscfiles_read_localization(remote_login_t)
@@ -8514,9 +7627,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remo
userdom_use_unpriv_users_fds(remote_login_t)
userdom_search_all_users_home_content(remote_login_t)
# Only permit unprivileged user domains to be entered via rlogin,
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.7/policy/modules/services/rhgb.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.8/policy/modules/services/rhgb.te
--- nsaserefpolicy/policy/modules/services/rhgb.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/rhgb.te 2007-09-11 11:38:16.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/rhgb.te 2007-09-17 16:20:18.000000000 -0400
@@ -59,6 +59,7 @@
corenet_sendrecv_all_client_packets(rhgb_t)
@@ -8541,9 +7654,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb
optional_policy(`
consoletype_exec(rhgb_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.7/policy/modules/services/ricci.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.8/policy/modules/services/ricci.te
--- nsaserefpolicy/policy/modules/services/ricci.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/ricci.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/ricci.te 2007-09-17 16:20:18.000000000 -0400
@@ -138,6 +138,7 @@
files_create_boot_flag(ricci_t)
@@ -8563,17 +7676,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc
unconfined_use_fds(ricci_modclusterd_t)
')
-@@ -349,6 +354,7 @@
-
- miscfiles_read_localization(ricci_modlog_t)
-
-+
- optional_policy(`
- nscd_dontaudit_search_pid(ricci_modlog_t)
- ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.7/policy/modules/services/rlogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.8/policy/modules/services/rlogin.te
--- nsaserefpolicy/policy/modules/services/rlogin.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/rlogin.te 2007-09-11 08:27:48.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/rlogin.te 2007-09-17 16:20:18.000000000 -0400
@@ -64,9 +64,10 @@
fs_getattr_xattr_fs(rlogind_t)
fs_search_auto_mountpoints(rlogind_t)
@@ -8605,9 +7710,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog
')
ifdef(`TODO',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.7/policy/modules/services/rpcbind.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.8/policy/modules/services/rpcbind.te
--- nsaserefpolicy/policy/modules/services/rpcbind.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/rpcbind.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/rpcbind.te 2007-09-17 16:20:18.000000000 -0400
@@ -21,11 +21,13 @@
# rpcbind local policy
#
@@ -8623,18 +7728,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
allow rpcbind_t self:tcp_socket create_stream_socket_perms;
manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.7/policy/modules/services/rpc.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.8/policy/modules/services/rpc.if
--- nsaserefpolicy/policy/modules/services/rpc.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/rpc.if 2007-09-06 15:43:06.000000000 -0400
-@@ -81,6 +81,7 @@
- corenet_tcp_bind_all_nodes($1_t)
- corenet_udp_bind_all_nodes($1_t)
- corenet_tcp_bind_reserved_port($1_t)
-+ corenet_tcp_bind_reserved_port($1_t)
- corenet_tcp_connect_all_ports($1_t)
- corenet_sendrecv_portmap_client_packets($1_t)
- # do not log when it tries to bind to a port belonging to another domain
-@@ -89,8 +90,11 @@
++++ serefpolicy-3.0.8/policy/modules/services/rpc.if 2007-09-17 16:20:18.000000000 -0400
+@@ -89,8 +89,11 @@
# bind to arbitary unused ports
corenet_tcp_bind_generic_port($1_t)
corenet_udp_bind_generic_port($1_t)
@@ -8647,9 +7744,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
fs_rw_rpc_named_pipes($1_t)
fs_search_auto_mountpoints($1_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.7/policy/modules/services/rpc.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.8/policy/modules/services/rpc.te
--- nsaserefpolicy/policy/modules/services/rpc.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/rpc.te 2007-09-07 10:32:33.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/rpc.te 2007-09-17 16:20:18.000000000 -0400
@@ -59,10 +59,14 @@
manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t)
files_pid_filetrans(rpcd_t,rpcd_var_run_t,file)
@@ -8719,16 +7816,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
tunable_policy(`allow_gssd_read_tmp',`
userdom_list_unpriv_users_tmp(gssd_t)
userdom_read_unpriv_users_tmp_files(gssd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.7/policy/modules/services/rshd.te
---- nsaserefpolicy/policy/modules/services/rshd.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/rshd.te 2007-09-11 09:10:14.000000000 -0400
-@@ -11,15 +11,17 @@
- domain_subj_id_change_exemption(rshd_t)
- domain_role_change_exemption(rshd_t)
- role system_r types rshd_t;
-+domain_interactive_fd(rshd_t)
-
- ########################################
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.8/policy/modules/services/rshd.te
+--- nsaserefpolicy/policy/modules/services/rshd.te 2007-09-12 10:34:50.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/rshd.te 2007-09-17 16:20:18.000000000 -0400
+@@ -16,10 +16,11 @@
#
# Local policy
#
@@ -8741,7 +7832,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd
kernel_read_kernel_sysctls(rshd_t)
-@@ -33,6 +35,8 @@
+@@ -33,6 +34,8 @@
corenet_udp_sendrecv_all_ports(rshd_t)
corenet_tcp_bind_all_nodes(rshd_t)
corenet_tcp_bind_rsh_port(rshd_t)
@@ -8750,7 +7841,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd
corenet_sendrecv_rsh_server_packets(rshd_t)
dev_read_urand(rshd_t)
-@@ -44,28 +48,44 @@
+@@ -44,28 +47,44 @@
selinux_compute_relabel_context(rshd_t)
selinux_compute_user_contexts(rshd_t)
@@ -8798,7 +7889,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd
tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(rshd_t)
fs_read_nfs_symlinks(rshd_t)
-@@ -76,15 +96,3 @@
+@@ -76,15 +95,3 @@
fs_read_cifs_symlinks(rshd_t)
')
@@ -8814,9 +7905,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd
- unconfined_domain(rshd_t)
- unconfined_shell_domtrans(rshd_t)
-')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.7/policy/modules/services/rsync.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.8/policy/modules/services/rsync.te
--- nsaserefpolicy/policy/modules/services/rsync.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/rsync.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/rsync.te 2007-09-17 16:20:18.000000000 -0400
@@ -17,6 +17,7 @@
type rsync_t;
type rsync_exec_t;
@@ -8825,117 +7916,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn
role system_r types rsync_t;
type rsync_data_t;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-3.0.7/policy/modules/services/rwho.fc
---- nsaserefpolicy/policy/modules/services/rwho.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/rwho.fc 2007-09-06 15:43:06.000000000 -0400
-@@ -1,3 +1,4 @@
- /usr/sbin/rwhod -- gen_context(system_u:object_r:rwho_exec_t,s0)
-
- /var/spool/rwho(/.*)? gen_context(system_u:object_r:rwho_spool_t,s0)
-+/var/log/rwhod(/.*)? gen_context(system_u:object_r:rwho_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-3.0.7/policy/modules/services/rwho.if
---- nsaserefpolicy/policy/modules/services/rwho.if 2007-06-15 14:54:33.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/rwho.if 2007-09-06 15:43:06.000000000 -0400
-@@ -72,6 +72,47 @@
- type rwho_spool_t;
- ')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.8/policy/modules/services/samba.fc
+--- nsaserefpolicy/policy/modules/services/samba.fc 2007-06-19 16:23:34.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/samba.fc 2007-09-17 16:20:18.000000000 -0400
+@@ -15,6 +15,7 @@
+ /usr/bin/ntlm_auth -- gen_context(system_u:object_r:winbind_helper_exec_t,s0)
+ /usr/bin/smbmount -- gen_context(system_u:object_r:smbmount_exec_t,s0)
+ /usr/bin/smbmnt -- gen_context(system_u:object_r:smbmount_exec_t,s0)
++/usr/bin/smbcontrol -- gen_context(system_u:object_r:smbcontrol_exec_t,s0)
+ /usr/sbin/swat -- gen_context(system_u:object_r:swat_exec_t,s0)
-- manage_files_pattern($1,rwho_spool_t,rwho_spool_t)
-+ allow $1 rwho_spool_t:file manage_file_perms;
-+ allow $1 rwho_spool_t:dir rw_dir_perms;
- files_search_spool($1)
- ')
-+
-+########################################
-+## <summary>
-+## Search rwho log directories.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`rwho_search_log',`
-+ gen_require(`
-+ type rwho_log_t;
-+ ')
-+
-+ allow $1 rwho_log_t:dir search_dir_perms;
-+ logging_search_logs($1)
-+')
-+
-+########################################
-+## <summary>
-+## Read rwho log files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`rwho_read_log_files',`
-+ gen_require(`
-+ type rwho_log_t;
-+ ')
-+
-+ allow $1 rwho_log_t:file r_file_perms;
-+ allow $1 rwho_log_t:dir list_dir_perms;
-+ logging_search_logs($1)
-+')
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-3.0.7/policy/modules/services/rwho.te
---- nsaserefpolicy/policy/modules/services/rwho.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/rwho.te 2007-09-06 15:43:06.000000000 -0400
-@@ -10,10 +10,12 @@
- type rwho_exec_t;
- init_daemon_domain(rwho_t, rwho_exec_t)
-
--# var/spool files
- type rwho_spool_t;
- files_type(rwho_spool_t)
-
-+type rwho_log_t;
-+files_type(rwho_log_t)
-+
- ########################################
- #
- # rwho local policy
-@@ -30,6 +32,10 @@
- allow rwho_t rwho_spool_t:file manage_file_perms;
- files_spool_filetrans(rwho_t,rwho_spool_t, { file dir })
-
-+allow rwho_t rwho_log_t:dir manage_dir_perms;
-+allow rwho_t rwho_log_t:file manage_file_perms;
-+logging_log_filetrans(rwho_t,rwho_log_t, { file dir })
-+
- kernel_read_system_state(rwho_t)
-
- corenet_all_recvfrom_unlabeled(rwho_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.7/policy/modules/services/samba.fc
---- nsaserefpolicy/policy/modules/services/samba.fc 2007-06-19 16:23:34.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/samba.fc 2007-09-11 09:23:37.000000000 -0400
-@@ -15,6 +15,7 @@
- /usr/bin/ntlm_auth -- gen_context(system_u:object_r:winbind_helper_exec_t,s0)
- /usr/bin/smbmount -- gen_context(system_u:object_r:smbmount_exec_t,s0)
- /usr/bin/smbmnt -- gen_context(system_u:object_r:smbmount_exec_t,s0)
-+/usr/bin/smbcontrol -- gen_context(system_u:object_r:smbcontrol_exec_t,s0)
- /usr/sbin/swat -- gen_context(system_u:object_r:swat_exec_t,s0)
-
- /usr/sbin/nmbd -- gen_context(system_u:object_r:nmbd_exec_t,s0)
-@@ -30,6 +31,8 @@
- /var/lib/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0)
- /var/lib/samba/winbindd_privileged(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0)
-
-+/var/lib/samba/scripts(/.*)? gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0)
+ /usr/sbin/nmbd -- gen_context(system_u:object_r:nmbd_exec_t,s0)
+@@ -30,6 +31,8 @@
+ /var/lib/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0)
+ /var/lib/samba/winbindd_privileged(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0)
+
++/var/lib/samba/scripts(/.*)? gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0)
+
/var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0)
/var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.7/policy/modules/services/samba.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.8/policy/modules/services/samba.if
--- nsaserefpolicy/policy/modules/services/samba.if 2007-06-19 16:23:35.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/samba.if 2007-09-11 09:24:00.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/samba.if 2007-09-17 16:20:18.000000000 -0400
@@ -349,6 +349,7 @@
files_search_var($1)
files_search_var_lib($1)
@@ -9047,9 +8050,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
+ role $2 types smbcontrol_t;
+ dontaudit smbcontrol_t $3:chr_file rw_term_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.7/policy/modules/services/samba.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.8/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/samba.te 2007-09-11 10:50:53.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/samba.te 2007-09-17 16:20:18.000000000 -0400
@@ -137,6 +137,11 @@
type winbind_var_run_t;
files_pid_file(winbind_var_run_t)
@@ -9100,7 +8103,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
########################################
#
# smbd Local policy
-@@ -217,17 +218,16 @@
+@@ -217,19 +218,16 @@
allow smbd_t self:msgq create_msgq_perms;
allow smbd_t self:sem create_sem_perms;
allow smbd_t self:shm create_shm_perms;
@@ -9116,12 +8119,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
-create_dirs_pattern(smbd_t,samba_log_t,samba_log_t)
-create_files_pattern(smbd_t,samba_log_t,samba_log_t)
+-allow smbd_t samba_log_t:dir setattr;
+-dontaudit smbd_t samba_log_t:dir remove_name;
+manage_dirs_pattern(smbd_t,samba_log_t,samba_log_t)
+manage_files_pattern(smbd_t,samba_log_t,samba_log_t)
- allow smbd_t samba_log_t:dir setattr;
- dontaudit smbd_t samba_log_t:dir remove_name;
-@@ -256,7 +256,7 @@
+ allow smbd_t samba_net_tmp_t:file getattr;
+
+@@ -256,7 +254,7 @@
manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t)
files_pid_filetrans(smbd_t,smbd_var_run_t,file)
@@ -9130,7 +8135,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
kernel_getattr_core_if(smbd_t)
kernel_getattr_message_if(smbd_t)
-@@ -298,6 +298,7 @@
+@@ -298,6 +296,7 @@
auth_use_nsswitch(smbd_t)
auth_domtrans_chk_passwd(smbd_t)
@@ -9138,7 +8143,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
domain_use_interactive_fds(smbd_t)
domain_dontaudit_list_all_domains_state(smbd_t)
-@@ -321,8 +322,6 @@
+@@ -321,8 +320,6 @@
miscfiles_read_localization(smbd_t)
miscfiles_read_public_files(smbd_t)
@@ -9147,7 +8152,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
userdom_dontaudit_search_sysadm_home_dirs(smbd_t)
userdom_dontaudit_use_unpriv_user_fds(smbd_t)
userdom_use_unpriv_users_fds(smbd_t)
-@@ -350,6 +349,14 @@
+@@ -350,6 +347,14 @@
')
optional_policy(`
@@ -9162,7 +8167,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
cups_read_rw_config(smbd_t)
cups_stream_connect(smbd_t)
')
-@@ -398,7 +405,7 @@
+@@ -398,7 +403,7 @@
allow nmbd_t self:msgq create_msgq_perms;
allow nmbd_t self:sem create_sem_perms;
allow nmbd_t self:shm create_shm_perms;
@@ -9171,7 +8176,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
allow nmbd_t self:tcp_socket create_stream_socket_perms;
allow nmbd_t self:udp_socket create_socket_perms;
allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto };
-@@ -421,6 +428,8 @@
+@@ -410,8 +415,7 @@
+ read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t)
+
+ manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t)
+-append_files_pattern(nmbd_t,samba_log_t,samba_log_t)
+-allow nmbd_t samba_log_t:file unlink;
++manage_files_pattern(nmbd_t,samba_log_t,samba_log_t)
+
+ read_files_pattern(nmbd_t,samba_log_t,samba_log_t)
+ create_files_pattern(nmbd_t,samba_log_t,samba_log_t)
+@@ -421,6 +425,8 @@
allow nmbd_t smbd_var_run_t:dir rw_dir_perms;
@@ -9180,7 +8195,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
kernel_getattr_core_if(nmbd_t)
kernel_getattr_message_if(nmbd_t)
kernel_read_kernel_sysctls(nmbd_t)
-@@ -462,17 +471,11 @@
+@@ -462,17 +468,11 @@
miscfiles_read_localization(nmbd_t)
@@ -9198,7 +8213,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
seutil_sigchld_newrole(nmbd_t)
')
-@@ -506,6 +509,8 @@
+@@ -506,6 +506,8 @@
manage_lnk_files_pattern(smbmount_t,samba_var_t,samba_var_t)
files_list_var_lib(smbmount_t)
@@ -9207,7 +8222,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
kernel_read_system_state(smbmount_t)
corenet_all_recvfrom_unlabeled(smbmount_t)
-@@ -533,6 +538,7 @@
+@@ -533,6 +535,7 @@
storage_raw_write_fixed_disk(smbmount_t)
term_list_ptys(smbmount_t)
@@ -9215,7 +8230,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
corecmd_list_bin(smbmount_t)
-@@ -553,16 +559,11 @@
+@@ -553,16 +556,11 @@
logging_search_logs(smbmount_t)
@@ -9234,7 +8249,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
')
########################################
-@@ -570,24 +571,28 @@
+@@ -570,24 +568,28 @@
# SWAT Local policy
#
@@ -9271,7 +8286,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
allow swat_t smbd_var_run_t:file read;
manage_dirs_pattern(swat_t,swat_tmp_t,swat_tmp_t)
-@@ -597,7 +602,11 @@
+@@ -597,7 +599,11 @@
manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t)
files_pid_filetrans(swat_t,swat_var_run_t,file)
@@ -9284,7 +8299,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
kernel_read_kernel_sysctls(swat_t)
kernel_read_system_state(swat_t)
-@@ -622,23 +631,24 @@
+@@ -622,23 +628,24 @@
dev_read_urand(swat_t)
@@ -9311,7 +8326,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
optional_policy(`
cups_read_rw_config(swat_t)
cups_stream_connect(swat_t)
-@@ -652,13 +662,16 @@
+@@ -652,13 +659,16 @@
kerberos_use(swat_t)
')
@@ -9334,7 +8349,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
########################################
#
-@@ -672,7 +685,6 @@
+@@ -672,7 +682,6 @@
allow winbind_t self:fifo_file { read write };
allow winbind_t self:unix_dgram_socket create_socket_perms;
allow winbind_t self:unix_stream_socket create_stream_socket_perms;
@@ -9342,7 +8357,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
allow winbind_t self:tcp_socket create_stream_socket_perms;
allow winbind_t self:udp_socket create_socket_perms;
-@@ -709,6 +721,8 @@
+@@ -709,6 +718,8 @@
manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t)
files_pid_filetrans(winbind_t,winbind_var_run_t,file)
@@ -9351,7 +8366,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
kernel_read_kernel_sysctls(winbind_t)
kernel_list_proc(winbind_t)
kernel_read_proc_symlinks(winbind_t)
-@@ -733,7 +747,9 @@
+@@ -733,7 +744,9 @@
fs_getattr_all_fs(winbind_t)
fs_search_auto_mountpoints(winbind_t)
@@ -9361,7 +8376,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
domain_use_interactive_fds(winbind_t)
-@@ -746,9 +762,6 @@
+@@ -746,9 +759,6 @@
miscfiles_read_localization(winbind_t)
@@ -9371,7 +8386,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
userdom_dontaudit_use_unpriv_user_fds(winbind_t)
userdom_dontaudit_search_sysadm_home_dirs(winbind_t)
userdom_priveleged_home_dir_manager(winbind_t)
-@@ -758,10 +771,6 @@
+@@ -758,10 +768,6 @@
')
optional_policy(`
@@ -9382,7 +8397,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
seutil_sigchld_newrole(winbind_t)
')
-@@ -784,6 +793,8 @@
+@@ -784,6 +790,8 @@
allow winbind_helper_t samba_var_t:dir search;
files_list_var_lib(winbind_helper_t)
@@ -9391,7 +8406,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
stream_connect_pattern(winbind_helper_t,winbind_var_run_t,winbind_var_run_t,winbind_t)
term_list_ptys(winbind_helper_t)
-@@ -804,6 +815,7 @@
+@@ -804,6 +812,7 @@
optional_policy(`
squid_read_log(winbind_helper_t)
squid_append_log(winbind_helper_t)
@@ -9399,7 +8414,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
')
########################################
-@@ -828,3 +840,36 @@
+@@ -828,3 +837,36 @@
domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t)
')
')
@@ -9436,9 +8451,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
+allow winbind_t smbcontrol_t:process signal;
+
+allow smbcontrol_t nmbd_var_run_t:file { read lock };
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.7/policy/modules/services/sasl.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.8/policy/modules/services/sasl.te
--- nsaserefpolicy/policy/modules/services/sasl.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/sasl.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/sasl.te 2007-09-17 16:20:18.000000000 -0400
@@ -64,6 +64,7 @@
selinux_compute_access_vector(saslauthd_t)
@@ -9447,33 +8462,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl
auth_use_nsswitch(saslauthd_t)
domain_use_interactive_fds(saslauthd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.7/policy/modules/services/sendmail.if
---- nsaserefpolicy/policy/modules/services/sendmail.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/sendmail.if 2007-09-10 16:44:21.000000000 -0400
-@@ -131,3 +131,102 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.8/policy/modules/services/sendmail.if
+--- nsaserefpolicy/policy/modules/services/sendmail.if 2007-09-12 10:34:50.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/sendmail.if 2007-09-17 16:20:18.000000000 -0400
+@@ -149,3 +149,85 @@
logging_log_filetrans($1,sendmail_log_t,file)
')
+
+########################################
+## <summary>
-+##f allow domain to signal sendmail
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`sendmail_signal',`
-+ gen_require(`
-+ type sendmail_t;
-+ ')
-+ allow $1 sendmail_t:process signal;
-+')
-+
-+########################################
-+## <summary>
+## Execute the sendmail program in the sendmail domain.
+## </summary>
+## <param name="domain">
@@ -9553,9 +8551,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
+ role $2 types unconfined_sendmail_t;
+ allow unconfined_sendmail_t $3:chr_file rw_file_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.0.7/policy/modules/services/sendmail.te
---- nsaserefpolicy/policy/modules/services/sendmail.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/sendmail.te 2007-09-10 16:39:01.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.0.8/policy/modules/services/sendmail.te
+--- nsaserefpolicy/policy/modules/services/sendmail.te 2007-09-12 10:34:50.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/sendmail.te 2007-09-17 16:20:18.000000000 -0400
@@ -20,19 +20,22 @@
mta_mailserver_delivery(sendmail_t)
mta_mailserver_sender(sendmail_t)
@@ -9590,11 +8588,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
corenet_all_recvfrom_unlabeled(sendmail_t)
corenet_all_recvfrom_netlabel(sendmail_t)
corenet_tcp_sendrecv_all_if(sendmail_t)
-@@ -91,32 +96,27 @@
-
- logging_send_syslog_msg(sendmail_t)
-
-+miscfiles_read_certs(sendmail_t)
+@@ -94,30 +99,24 @@
+ miscfiles_read_certs(sendmail_t)
miscfiles_read_localization(sendmail_t)
-sysnet_dns_name_resolve(sendmail_t)
@@ -9628,7 +8623,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
')
optional_policy(`
-@@ -130,6 +130,10 @@
+@@ -131,6 +130,10 @@
')
optional_policy(`
@@ -9639,14 +8634,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
seutil_sigchld_newrole(sendmail_t)
')
-@@ -155,3 +159,14 @@
+@@ -156,3 +159,15 @@
dontaudit sendmail_t admin_tty_type:chr_file { getattr ioctl };
') dnl end TODO
+
+########################################
+#
-+# Unconfined mount local policy
++# Unconfined sendmail local policy
++# Allow unconfined domain to run newalias and have transitions work
+#
+
+optional_policy(`
@@ -9654,53 +8650,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
+ unconfined_domain(unconfined_sendmail_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.0.7/policy/modules/services/setroubleshoot.if
---- nsaserefpolicy/policy/modules/services/setroubleshoot.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/setroubleshoot.if 2007-09-06 15:43:06.000000000 -0400
-@@ -19,3 +19,22 @@
- allow $1 setroubleshoot_var_run_t:sock_file write;
- allow $1 setroubleshootd_t:unix_stream_socket connectto;
- ')
-+
-+########################################
-+## <summary>
-+## Dontaudit Connect to setroubleshootd over an unix stream socket.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`setroubleshoot_dontaudit_stream_connect',`
-+ gen_require(`
-+ type setroubleshootd_t, setroubleshoot_var_run_t;
-+ ')
-+
-+ dontaudit $1 setroubleshoot_var_run_t:sock_file write;
-+ dontaudit $1 setroubleshootd_t:unix_stream_socket connectto;
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.7/policy/modules/services/setroubleshoot.te
---- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/setroubleshoot.te 2007-09-11 15:24:02.000000000 -0400
-@@ -33,7 +33,6 @@
- allow setroubleshootd_t self:tcp_socket create_stream_socket_perms;
- allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto };
- allow setroubleshootd_t self:unix_dgram_socket create_socket_perms;
--allow setroubleshootd_t self:netlink_route_socket r_netlink_socket_perms;
-
- # database files
- allow setroubleshootd_t setroubleshoot_var_lib_t:dir setattr;
-@@ -51,6 +50,8 @@
- manage_sock_files_pattern(setroubleshootd_t,setroubleshoot_var_run_t,setroubleshoot_var_run_t)
- files_pid_filetrans(setroubleshootd_t,setroubleshoot_var_run_t, { file sock_file })
-
-+auth_use_nsswitch(setroubleshootd_t)
-+
- kernel_read_kernel_sysctls(setroubleshootd_t)
- kernel_read_system_state(setroubleshootd_t)
- kernel_read_network_state(setroubleshootd_t)
-@@ -68,6 +69,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.8/policy/modules/services/setroubleshoot.te
+--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-09-12 10:34:50.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/setroubleshoot.te 2007-09-17 16:20:18.000000000 -0400
+@@ -67,6 +67,7 @@
corenet_sendrecv_smtp_client_packets(setroubleshootd_t)
dev_read_urand(setroubleshootd_t)
@@ -9708,37 +8661,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr
domain_dontaudit_search_all_domains_state(setroubleshootd_t)
-@@ -76,6 +78,9 @@
- files_getattr_all_dirs(setroubleshootd_t)
- files_getattr_all_files(setroubleshootd_t)
-
-+fs_getattr_all_dirs(setroubleshootd_t)
-+fs_getattr_all_files(setroubleshootd_t)
-+
- selinux_get_enforce_mode(setroubleshootd_t)
- selinux_validate_context(setroubleshootd_t)
-
-@@ -109,5 +114,8 @@
+@@ -111,3 +112,10 @@
+ rpm_dontaudit_manage_db(setroubleshootd_t)
+ rpm_use_script_fds(setroubleshootd_t)
')
-
- optional_policy(`
-- nis_use_ypbind(setroubleshootd_t)
++
++optional_policy(`
+ dbus_system_bus_client_template(setroubleshootd, setroubleshootd_t)
+ dbus_send_system_bus(setroubleshootd_t)
+ dbus_connect_system_bus(setroubleshootd_t)
- ')
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.0.7/policy/modules/services/snmp.fc
---- nsaserefpolicy/policy/modules/services/snmp.fc 2007-06-19 16:23:35.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/snmp.fc 2007-09-06 15:43:06.000000000 -0400
-@@ -1,3 +1,4 @@
++')
+
- #
- # /usr
- #
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.0.7/policy/modules/services/snmp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.0.8/policy/modules/services/snmp.te
--- nsaserefpolicy/policy/modules/services/snmp.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/snmp.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/snmp.te 2007-09-17 16:20:18.000000000 -0400
@@ -81,8 +81,7 @@
files_read_usr_files(snmpd_t)
files_read_etc_runtime_files(snmpd_t)
@@ -9749,9 +8685,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp
fs_getattr_all_dirs(snmpd_t)
fs_getattr_all_fs(snmpd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.fc serefpolicy-3.0.7/policy/modules/services/soundserver.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.fc serefpolicy-3.0.8/policy/modules/services/soundserver.fc
--- nsaserefpolicy/policy/modules/services/soundserver.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/soundserver.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/soundserver.fc 2007-09-17 16:20:18.000000000 -0400
@@ -1,10 +1,16 @@
-/etc/nas(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0)
-/etc/yiff(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0)
@@ -9775,9 +8711,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun
+#
+
+/usr/bin/nasd -- gen_context(system_u:object_r:soundd_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.if serefpolicy-3.0.7/policy/modules/services/soundserver.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.if serefpolicy-3.0.8/policy/modules/services/soundserver.if
--- nsaserefpolicy/policy/modules/services/soundserver.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/soundserver.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/soundserver.if 2007-09-17 16:20:18.000000000 -0400
@@ -13,3 +13,64 @@
interface(`soundserver_tcp_connect',`
refpolicywarn(`$0($*) has been deprecated.')
@@ -9843,9 +8779,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun
+ allow $1 soundd_var_run_t:sock_file r_file_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.te serefpolicy-3.0.7/policy/modules/services/soundserver.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.te serefpolicy-3.0.8/policy/modules/services/soundserver.te
--- nsaserefpolicy/policy/modules/services/soundserver.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/soundserver.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/soundserver.te 2007-09-17 16:20:18.000000000 -0400
@@ -10,9 +10,6 @@
type soundd_exec_t;
init_daemon_domain(soundd_t,soundd_exec_t)
@@ -9909,45 +8845,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun
seutil_sigchld_newrole(soundd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.0.7/policy/modules/services/spamassassin.fc
---- nsaserefpolicy/policy/modules/services/spamassassin.fc 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/spamassassin.fc 2007-09-06 15:43:06.000000000 -0400
-@@ -10,3 +10,9 @@
- /var/lib/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_lib_t,s0)
-
- /var/spool/spamassassin(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0)
-+/var/spool/spamd(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0)
-+
-+/var/run/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0)
-+/var/run/spamass-milter(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0)
-+
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.0.7/policy/modules/services/spamassassin.te
---- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-08-02 08:17:27.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/spamassassin.te 2007-09-06 15:43:06.000000000 -0400
-@@ -83,8 +83,9 @@
- allow spamd_t spamd_var_lib_t:dir list_dir_perms;
- read_files_pattern(spamd_t,spamd_var_lib_t,spamd_var_lib_t)
-
-+manage_dirs_pattern(spamd_t,spamd_var_run_t,spamd_var_run_t)
- manage_files_pattern(spamd_t,spamd_var_run_t,spamd_var_run_t)
--files_pid_filetrans(spamd_t,spamd_var_run_t,file)
-+files_pid_filetrans(spamd_t,spamd_var_run_t,{ file dir })
-
- kernel_read_all_sysctls(spamd_t)
- kernel_read_system_state(spamd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.7/policy/modules/services/squid.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.8/policy/modules/services/squid.fc
--- nsaserefpolicy/policy/modules/services/squid.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/squid.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/squid.fc 2007-09-17 16:20:18.000000000 -0400
@@ -12,3 +12,5 @@
/var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0)
/var/spool/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0)
+/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
+/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-3.0.7/policy/modules/services/squid.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-3.0.8/policy/modules/services/squid.if
--- nsaserefpolicy/policy/modules/services/squid.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/squid.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/squid.if 2007-09-17 16:20:18.000000000 -0400
@@ -131,3 +131,22 @@
interface(`squid_use',`
refpolicywarn(`$0($*) has been deprecated.')
@@ -9971,9 +8880,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
+
+ allow $1 squid_t:unix_stream_socket { read write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.7/policy/modules/services/squid.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.8/policy/modules/services/squid.te
--- nsaserefpolicy/policy/modules/services/squid.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/squid.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/squid.te 2007-09-17 16:20:18.000000000 -0400
@@ -36,7 +36,7 @@
# Local policy
#
@@ -10057,9 +8966,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
+ corenet_all_recvfrom_unlabeled(httpd_squid_script_t)
+ corenet_all_recvfrom_netlabel(httpd_squid_script_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.7/policy/modules/services/ssh.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.8/policy/modules/services/ssh.if
--- nsaserefpolicy/policy/modules/services/ssh.if 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/ssh.if 2007-09-11 09:12:11.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/ssh.if 2007-09-17 16:20:18.000000000 -0400
@@ -202,6 +202,7 @@
#
template(`ssh_per_role_template',`
@@ -10119,9 +9028,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
+ dontaudit $2 $1_ssh_agent_t:fd use;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.7/policy/modules/services/ssh.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.8/policy/modules/services/ssh.te
--- nsaserefpolicy/policy/modules/services/ssh.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/ssh.te 2007-09-06 19:21:21.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/ssh.te 2007-09-17 16:20:18.000000000 -0400
@@ -24,7 +24,7 @@
# Type for the ssh-agent executable.
@@ -10131,16 +9040,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
# ssh client executable.
type ssh_exec_t;
-@@ -73,6 +73,8 @@
- manage_sock_files_pattern(sshd_t,sshd_tmp_t,sshd_tmp_t)
- files_tmp_filetrans(sshd_t, sshd_tmp_t, { dir file sock_file })
-
-+fs_search_auto_mountpoints(sshd_t)
-+
- kernel_search_key(sshd_t)
- kernel_link_key(sshd_t)
-
-@@ -80,6 +82,8 @@
+@@ -80,6 +80,8 @@
corenet_tcp_bind_xserver_port(sshd_t)
corenet_sendrecv_xserver_server_packets(sshd_t)
@@ -10149,7 +9049,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
tunable_policy(`ssh_sysadm_login',`
# Relabel and access ptys created by sshd
# ioctl is necessary for logout() processing for utmp entry and for w to
-@@ -100,6 +104,11 @@
+@@ -100,6 +102,11 @@
userdom_use_unpriv_users_ptys(sshd_t)
')
@@ -10161,7 +9061,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
optional_policy(`
daemontools_service_domain(sshd_t, sshd_exec_t)
')
-@@ -119,7 +128,12 @@
+@@ -119,7 +126,12 @@
')
optional_policy(`
@@ -10175,7 +9075,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
')
ifdef(`TODO',`
-@@ -231,9 +245,15 @@
+@@ -231,9 +243,15 @@
')
optional_policy(`
@@ -10191,9 +9091,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/telnet.te serefpolicy-3.0.7/policy/modules/services/telnet.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/telnet.te serefpolicy-3.0.8/policy/modules/services/telnet.te
--- nsaserefpolicy/policy/modules/services/telnet.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/telnet.te 2007-09-11 08:25:22.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/telnet.te 2007-09-17 16:20:18.000000000 -0400
@@ -32,7 +32,6 @@
allow telnetd_t self:udp_socket create_socket_perms;
# for identd; cjp: this should probably only be inetd_child rules?
@@ -10251,9 +9151,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/teln
-# Allow krb5 telnetd to use fork and open /dev/tty for use
-allow telnetd_t userpty_type:chr_file setattr;
-')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-3.0.7/policy/modules/services/tftp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-3.0.8/policy/modules/services/tftp.te
--- nsaserefpolicy/policy/modules/services/tftp.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/tftp.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/tftp.te 2007-09-17 16:20:18.000000000 -0400
@@ -26,6 +26,7 @@
allow tftpd_t self:udp_socket create_socket_perms;
allow tftpd_t self:unix_dgram_socket create_socket_perms;
@@ -10262,9 +9162,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp
dontaudit tftpd_t self:capability sys_tty_config;
allow tftpd_t tftpdir_t:dir { getattr read search };
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.7/policy/modules/services/uwimap.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.8/policy/modules/services/uwimap.te
--- nsaserefpolicy/policy/modules/services/uwimap.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/uwimap.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/uwimap.te 2007-09-17 16:20:18.000000000 -0400
@@ -64,6 +64,7 @@
fs_search_auto_mountpoints(imapd_t)
@@ -10273,20 +9173,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwim
libs_use_ld_so(imapd_t)
libs_use_shared_libs(imapd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.7/policy/modules/services/w3c.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.8/policy/modules/services/w3c.fc
--- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/services/w3c.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/w3c.fc 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,2 @@
+/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0)
+/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.7/policy/modules/services/w3c.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.8/policy/modules/services/w3c.if
--- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/services/w3c.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/w3c.if 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1 @@
+## <summary>W3C</summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.7/policy/modules/services/w3c.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.8/policy/modules/services/w3c.te
--- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/services/w3c.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/w3c.te 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,14 @@
+policy_module(w3c,1.2.1)
+
@@ -10302,9 +9202,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.
+corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t)
+
+miscfiles_read_certs(httpd_w3c_validator_script_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xfs.te serefpolicy-3.0.7/policy/modules/services/xfs.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xfs.te serefpolicy-3.0.8/policy/modules/services/xfs.te
--- nsaserefpolicy/policy/modules/services/xfs.te 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/xfs.te 2007-09-11 08:19:36.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/xfs.te 2007-09-17 16:20:18.000000000 -0400
@@ -37,6 +37,15 @@
kernel_read_kernel_sysctls(xfs_t)
kernel_read_system_state(xfs_t)
@@ -10321,9 +9221,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xfs.
corecmd_list_bin(xfs_t)
dev_read_sysfs(xfs_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.7/policy/modules/services/xserver.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.8/policy/modules/services/xserver.fc
--- nsaserefpolicy/policy/modules/services/xserver.fc 2007-08-22 07:14:07.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/xserver.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/xserver.fc 2007-09-17 16:20:18.000000000 -0400
@@ -32,11 +32,6 @@
/etc/X11/wdm/Xstartup.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/X11/Xsession[^/]* -- gen_context(system_u:object_r:xsession_exec_t,s0)
@@ -10347,9 +9247,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
ifdef(`distro_suse',`
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.7/policy/modules/services/xserver.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.8/policy/modules/services/xserver.if
--- nsaserefpolicy/policy/modules/services/xserver.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/xserver.if 2007-09-11 11:45:01.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/xserver.if 2007-09-17 16:20:18.000000000 -0400
@@ -126,6 +126,8 @@
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev($1_xserver_t)
@@ -10680,9 +9580,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
+
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.7/policy/modules/services/xserver.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.8/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2007-08-22 07:14:07.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/services/xserver.te 2007-09-11 09:22:25.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/xserver.te 2007-09-17 16:20:18.000000000 -0400
@@ -16,6 +16,13 @@
## <desc>
@@ -10854,9 +9754,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
-#
-allow pam_t xdm_t:fifo_file { getattr ioctl write };
-') dnl end TODO
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.7/policy/modules/system/application.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.8/policy/modules/system/application.if
--- nsaserefpolicy/policy/modules/system/application.if 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/application.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/application.if 2007-09-17 16:20:18.000000000 -0400
@@ -63,6 +63,26 @@
########################################
@@ -10884,9 +9784,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic
## Create a domain which can be started by users
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.7/policy/modules/system/authlogin.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.8/policy/modules/system/authlogin.fc
--- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/authlogin.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/authlogin.fc 2007-09-17 16:20:18.000000000 -0400
@@ -14,6 +14,7 @@
/sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
@@ -10895,9 +9795,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
ifdef(`distro_suse', `
/sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.7/policy/modules/system/authlogin.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.8/policy/modules/system/authlogin.if
--- nsaserefpolicy/policy/modules/system/authlogin.if 2007-08-22 07:14:13.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/authlogin.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2007-09-17 16:20:18.000000000 -0400
@@ -26,7 +26,8 @@
type $1_chkpwd_t, can_read_shadow_passwords;
application_domain($1_chkpwd_t,chkpwd_exec_t)
@@ -10927,7 +9827,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
domain_type($1)
domain_subj_id_change_exemption($1)
-@@ -176,6 +180,16 @@
+@@ -176,11 +180,23 @@
domain_obj_id_change_exemption($1)
role system_r types $1;
@@ -10944,7 +9844,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
# for SSP/ProPolice
dev_read_urand($1)
-@@ -196,22 +210,27 @@
+ files_read_etc_files($1)
+
++ fs_list_auto_mountpoints($1)
++
+ selinux_get_fs_mount($1)
+ selinux_validate_context($1)
+ selinux_compute_access_vector($1)
+@@ -196,22 +212,33 @@
mls_fd_share_all_levels($1)
auth_domtrans_chk_passwd($1)
@@ -10967,13 +9874,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
seutil_read_config($1)
seutil_read_default_contexts($1)
++ userdom_set_rlimitnh($1)
++
++ optional_policy(`
++ unconfined_set_rlimitnh($1)
++ ')
++
tunable_policy(`allow_polyinstantiation',`
files_polyinstantiate_all($1)
+ mount_domtrans($1)
')
')
-@@ -309,9 +328,6 @@
+@@ -309,9 +336,6 @@
type system_chkpwd_t, chkpwd_exec_t, shadow_t;
')
@@ -10983,7 +9896,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
corecmd_search_bin($1)
domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t)
-@@ -329,6 +345,7 @@
+@@ -329,6 +353,7 @@
optional_policy(`
kerberos_use($1)
@@ -10991,7 +9904,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
')
optional_policy(`
-@@ -347,6 +364,37 @@
+@@ -347,6 +372,37 @@
########################################
## <summary>
@@ -11029,7 +9942,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
## Get the attributes of the shadow passwords file.
## </summary>
## <param name="domain">
-@@ -695,6 +743,24 @@
+@@ -695,6 +751,24 @@
########################################
## <summary>
@@ -11054,7 +9967,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
## Execute pam programs in the PAM domain.
## </summary>
## <param name="domain">
-@@ -1318,14 +1384,9 @@
+@@ -1318,14 +1392,9 @@
## </param>
#
interface(`auth_use_nsswitch',`
@@ -11069,7 +9982,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
files_list_var_lib($1)
miscfiles_read_certs($1)
-@@ -1381,3 +1442,163 @@
+@@ -1381,3 +1450,163 @@
typeattribute $1 can_write_shadow_passwords;
typeattribute $1 can_relabelto_shadow_passwords;
')
@@ -11233,9 +10146,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+ allow system_chkpwd_t $3:chr_file rw_file_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.7/policy/modules/system/authlogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.8/policy/modules/system/authlogin.te
--- nsaserefpolicy/policy/modules/system/authlogin.te 2007-08-22 07:14:12.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/authlogin.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/authlogin.te 2007-09-17 16:20:18.000000000 -0400
@@ -9,6 +9,13 @@
attribute can_read_shadow_passwords;
attribute can_write_shadow_passwords;
@@ -11308,117 +10221,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+files_manage_etc_files(updpwd_t)
+kernel_read_system_state(updpwd_t)
+logging_send_syslog_msg(updpwd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.fc serefpolicy-3.0.7/policy/modules/system/brctl.fc
---- nsaserefpolicy/policy/modules/system/brctl.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/system/brctl.fc 2007-09-06 15:43:06.000000000 -0400
-@@ -0,0 +1,2 @@
-+
-+/usr/sbin/brctl -- gen_context(system_u:object_r:brctl_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.if serefpolicy-3.0.7/policy/modules/system/brctl.if
---- nsaserefpolicy/policy/modules/system/brctl.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/system/brctl.if 2007-09-11 14:23:37.000000000 -0400
-@@ -0,0 +1,43 @@
-+
-+## <summary>Utilities for configuring the linux ethernet bridge</summary>
-+
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run brctl.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`brctl_domtrans',`
-+ gen_require(`
-+ type brctl_t, brctl_exec_t;
-+ ')
-+
-+ domain_auto_trans($1,brctl_exec_t,brctl_t)
-+
-+ allow brctl_t $1:fd use;
-+ allow brctl_t $1:fifo_file rw_file_perms;
-+ allow brctl_t $1:process sigchld;
-+')
-+
-+########################################
-+## <summary>
-+## Get attributes brctl executable.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`brctl_getattr',`
-+ gen_require(`
-+ type brctl_exec_t;
-+ ')
-+
-+ allow $1 brctl_exec_t:file getattr;
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.te serefpolicy-3.0.7/policy/modules/system/brctl.te
---- nsaserefpolicy/policy/modules/system/brctl.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/system/brctl.te 2007-09-10 08:59:32.000000000 -0400
-@@ -0,0 +1,51 @@
-+policy_module(brctl,1.0.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+type brctl_t;
-+type brctl_exec_t;
-+domain_type(brctl_t)
-+init_daemon_domain(brctl_t, brctl_exec_t)
-+
-+########################################
-+#
-+# brctl local policy
-+#
-+
-+allow brctl_t self:capability net_admin;
-+
-+allow brctl_t self:tcp_socket create_socket_perms;
-+allow brctl_t self:unix_dgram_socket create_socket_perms;
-+
-+dev_write_sysfs_dirs(brctl_t)
-+dev_rw_sysfs(brctl_t)
-+
-+# Init script handling
-+domain_use_interactive_fds(brctl_t)
-+
-+kernel_load_module(brctl_t)
-+kernel_read_network_state(brctl_t)
-+kernel_read_sysctl(brctl_t)
-+
-+## internal communication is often done using fifo and unix sockets.
-+allow brctl_t self:fifo_file rw_file_perms;
-+allow brctl_t self:unix_stream_socket create_stream_socket_perms;
-+
-+files_read_etc_files(brctl_t)
-+
-+libs_use_ld_so(brctl_t)
-+libs_use_shared_libs(brctl_t)
-+
-+miscfiles_read_localization(brctl_t)
-+
-+ifdef(`targeted_policy',`
-+ term_dontaudit_use_unallocated_ttys(brctl_t)
-+ term_dontaudit_use_generic_ptys(brctl_t)
-+')
-+
-+optional_policy(`
-+ xen_append_log(brctl_t)
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.7/policy/modules/system/fstools.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.8/policy/modules/system/fstools.fc
--- nsaserefpolicy/policy/modules/system/fstools.fc 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/fstools.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/fstools.fc 2007-09-17 16:20:18.000000000 -0400
@@ -20,7 +20,6 @@
/sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -11427,44 +10232,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.0.7/policy/modules/system/fstools.if
---- nsaserefpolicy/policy/modules/system/fstools.if 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/fstools.if 2007-09-06 15:43:06.000000000 -0400
-@@ -124,3 +124,22 @@
-
- allow $1 swapfile_t:file getattr;
- ')
-+
-+########################################
-+## <summary>
-+## Read fstools unnamed pipes.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`fstools_read_pipes',`
-+ gen_require(`
-+ type fsdaemon_t;
-+ ')
-+
-+ allow $1 fsdaemon_t:fifo_file read_fifo_file_perms;
-+')
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.7/policy/modules/system/fstools.te
---- nsaserefpolicy/policy/modules/system/fstools.te 2007-08-22 07:14:11.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/fstools.te 2007-09-06 15:43:06.000000000 -0400
-@@ -69,6 +69,7 @@
-
- dev_getattr_all_chr_files(fsadm_t)
- dev_dontaudit_getattr_all_blk_files(fsadm_t)
-+dev_dontaudit_getattr_generic_files(fsadm_t)
- # mkreiserfs and other programs need this for UUID
- dev_read_rand(fsadm_t)
- dev_read_urand(fsadm_t)
-@@ -108,8 +109,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.8/policy/modules/system/fstools.te
+--- nsaserefpolicy/policy/modules/system/fstools.te 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/fstools.te 2007-09-17 16:20:18.000000000 -0400
+@@ -109,8 +109,7 @@
term_use_console(fsadm_t)
@@ -11474,22 +10245,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
#RedHat bug #201164
corecmd_exec_shell(fsadm_t)
-@@ -179,3 +179,12 @@
- fs_dontaudit_write_ramfs_pipes(fsadm_t)
- rhgb_stub(fsadm_t)
- ')
-+
-+optional_policy(`
-+ xen_append_log(fsadm_t)
+@@ -183,4 +182,9 @@
+
+ optional_policy(`
+ xen_append_log(fsadm_t)
+ xen_rw_image_files(fsadm_t)
+')
+
+tunable_policy(`xen_use_nfs',`
+ fs_manage_nfs_files(fsadm_t)
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.7/policy/modules/system/fusermount.fc
+ ')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.8/policy/modules/system/fusermount.fc
--- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/system/fusermount.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/fusermount.fc 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,7 @@
+# fusermount executable will have:
+# label: system_u:object_r:fusermount_exec_t
@@ -11498,9 +10266,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+
+/usr/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0)
+/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.7/policy/modules/system/fusermount.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.8/policy/modules/system/fusermount.if
--- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/system/fusermount.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/fusermount.if 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,41 @@
+## <summary>policy for fusermount</summary>
+
@@ -11544,9 +10312,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+ allow $1 fusermount_t:fd use;
+')
\ No newline at end of file
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.7/policy/modules/system/fusermount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.8/policy/modules/system/fusermount.te
--- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/system/fusermount.te 2007-09-10 15:56:07.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/fusermount.te 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,45 @@
+policy_module(fusermount,1.0.0)
+
@@ -11593,9 +10361,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.7/policy/modules/system/getty.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.8/policy/modules/system/getty.te
--- nsaserefpolicy/policy/modules/system/getty.te 2007-08-22 07:14:13.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/getty.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/getty.te 2007-09-17 16:20:18.000000000 -0400
@@ -33,7 +33,8 @@
#
@@ -11606,9 +10374,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.
dontaudit getty_t self:capability sys_tty_config;
allow getty_t self:process { getpgid setpgid getsession signal_perms };
allow getty_t self:fifo_file rw_fifo_file_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.7/policy/modules/system/hostname.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.8/policy/modules/system/hostname.te
--- nsaserefpolicy/policy/modules/system/hostname.te 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/hostname.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/hostname.te 2007-09-17 16:20:18.000000000 -0400
@@ -8,7 +8,9 @@
type hostname_t;
@@ -11632,9 +10400,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna
+optional_policy(`
+ unconfined_dontaudit_rw_pipes(hostname_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.7/policy/modules/system/init.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.8/policy/modules/system/init.if
--- nsaserefpolicy/policy/modules/system/init.if 2007-08-22 07:14:12.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/init.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/init.if 2007-09-17 16:20:18.000000000 -0400
@@ -540,18 +540,19 @@
#
interface(`init_spec_domtrans_script',`
@@ -11848,9 +10616,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
+ domain_entry_file(initrc_t,$1)
+
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.7/policy/modules/system/init.te
---- nsaserefpolicy/policy/modules/system/init.te 2007-08-22 07:14:12.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/init.te 2007-09-06 15:43:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.8/policy/modules/system/init.te
+--- nsaserefpolicy/policy/modules/system/init.te 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/init.te 2007-09-17 16:37:06.000000000 -0400
@@ -10,6 +10,20 @@
# Declarations
#
@@ -11899,7 +10667,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
# is ~sys_module really needed? observed:
# sys_boot
# sys_tty_config
-@@ -186,7 +202,7 @@
+@@ -175,9 +191,13 @@
+ unconfined_domain(init_t)
+ ')
+
+-# Run the shell in the sysadm_t domain for single-user mode.
+-optional_policy(`
++# Run the shell in the unconfined_t or sysadm_t domain for single-user mode.
++ifdef(`enable_mls',`
+ userdom_shell_domtrans_sysadm(init_t)
++',`
++ optional_policy(`
++ unconfined_shell_domtrans_sysadm(init_t)
++ ')
+ ')
+
+ ########################################
+@@ -186,7 +206,7 @@
#
allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@@ -11908,7 +10692,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
dontaudit initrc_t self:capability sys_module; # sysctl is triggering this
allow initrc_t self:passwd rootok;
-@@ -201,10 +217,9 @@
+@@ -201,10 +221,9 @@
allow initrc_t initrc_devpts_t:chr_file rw_term_perms;
term_create_pty(initrc_t,initrc_devpts_t)
@@ -11921,7 +10705,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
manage_dirs_pattern(initrc_t,initrc_state_t,initrc_state_t)
manage_files_pattern(initrc_t,initrc_state_t,initrc_state_t)
-@@ -496,6 +511,43 @@
+@@ -283,7 +302,6 @@
+ mls_process_read_up(initrc_t)
+ mls_process_write_down(initrc_t)
+ mls_rangetrans_source(initrc_t)
+-mls_fd_share_all_levels(initrc_t)
+
+ selinux_get_enforce_mode(initrc_t)
+
+@@ -497,6 +515,39 @@
')
optional_policy(`
@@ -11930,21 +10722,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
+
+domain_dontaudit_use_interactive_fds(daemon)
+
-+ifdef(`targeted_policy',`
-+ domain_subj_id_change_exemption(initrc_t)
-+
-+ tunable_policy(`allow_daemons_use_tty',`
-+ term_use_unallocated_ttys(daemon)
-+ term_use_generic_ptys(daemon)
-+ ', `
-+ term_dontaudit_use_unallocated_ttys(daemon)
-+ term_dontaudit_use_generic_ptys(daemon)
-+ ')
++tunable_policy(`allow_daemons_use_tty',`
++ term_use_unallocated_ttys(daemon)
++ term_use_generic_ptys(daemon)
++', `
++ term_dontaudit_use_unallocated_ttys(daemon)
++ term_dontaudit_use_generic_ptys(daemon)
++ ')
+
-+ # system-config-services causes avc messages that should be dontaudited
-+ tunable_policy(`allow_daemons_dump_core',`
-+ files_dump_core(daemon)
-+ ')
++# system-config-services causes avc messages that should be dontaudited
++tunable_policy(`allow_daemons_dump_core',`
++ files_dump_core(daemon)
+')
+
+optional_policy(`
@@ -11965,7 +10753,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t)
')
-@@ -631,12 +683,6 @@
+@@ -632,12 +683,6 @@
mta_read_config(initrc_t)
mta_dontaudit_read_spool_symlinks(initrc_t)
')
@@ -11978,7 +10766,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
optional_policy(`
ifdef(`distro_redhat',`
-@@ -702,6 +748,9 @@
+@@ -703,6 +748,9 @@
# why is this needed:
rpm_manage_db(initrc_t)
@@ -11988,9 +10776,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.7/policy/modules/system/ipsec.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.8/policy/modules/system/ipsec.te
--- nsaserefpolicy/policy/modules/system/ipsec.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/ipsec.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/ipsec.te 2007-09-17 16:20:18.000000000 -0400
@@ -283,6 +283,7 @@
allow racoon_t self:netlink_selinux_socket { bind create read };
allow racoon_t self:udp_socket create_socket_perms;
@@ -11999,19 +10787,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
# manage pid file
manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.7/policy/modules/system/iptables.te
---- nsaserefpolicy/policy/modules/system/iptables.te 2007-08-22 07:14:11.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/iptables.te 2007-09-06 15:43:06.000000000 -0400
-@@ -44,6 +44,8 @@
-
- corenet_relabelto_all_packets(iptables_t)
-
-+auth_use_nsswitch(iptables_t)
-+
- dev_read_sysfs(iptables_t)
-
- fs_getattr_xattr_fs(iptables_t)
-@@ -62,6 +64,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.8/policy/modules/system/iptables.te
+--- nsaserefpolicy/policy/modules/system/iptables.te 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/iptables.te 2007-09-17 16:20:18.000000000 -0400
+@@ -64,6 +64,7 @@
init_use_script_ptys(iptables_t)
# to allow rules to be saved on reboot:
init_rw_script_tmp_files(iptables_t)
@@ -12019,23 +10798,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl
libs_use_ld_so(iptables_t)
libs_use_shared_libs(iptables_t)
-@@ -96,11 +99,11 @@
- ')
-
- optional_policy(`
-- nscd_socket_use(iptables_t)
-+ ppp_dontaudit_use_fds(iptables_t)
+@@ -102,6 +103,10 @@
')
optional_policy(`
-- ppp_dontaudit_use_fds(iptables_t)
+ rhgb_dontaudit_use_ptys(iptables_t)
++')
++
++optional_policy(`
+ seutil_sigchld_newrole(iptables_t)
')
- optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.7/policy/modules/system/libraries.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.8/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2007-08-02 08:17:28.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/libraries.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/libraries.fc 2007-09-17 16:20:18.000000000 -0400
@@ -65,11 +65,12 @@
/opt/(.*/)?java/.+\.jar -- gen_context(system_u:object_r:lib_t,s0)
/opt/(.*/)?jre.*/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -12068,7 +10844,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
/usr/lib(64)?/python2.4/site-packages/M2Crypto/__m2crypto.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
# vmware
-@@ -284,3 +289,8 @@
+@@ -284,3 +289,9 @@
/var/spool/postfix/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0)
/var/spool/postfix/usr(/.*)? gen_context(system_u:object_r:lib_t,s0)
/var/spool/postfix/lib(64)?/ld.*\.so.* -- gen_context(system_u:object_r:ld_so_t,s0)
@@ -12077,9 +10853,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
+
+/var/cache/ldconfig(/.*)? gen_context(system_u:object_r:ldconfig_cache_t,s0)
+/usr/lib/libtheora\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.7/policy/modules/system/libraries.te
++/usr/lib/libFLAC\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.8/policy/modules/system/libraries.te
--- nsaserefpolicy/policy/modules/system/libraries.te 2007-08-02 08:17:28.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/libraries.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/libraries.te 2007-09-17 16:20:18.000000000 -0400
@@ -23,6 +23,9 @@
init_system_domain(ldconfig_t,ldconfig_exec_t)
role system_r types ldconfig_t;
@@ -12128,9 +10905,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
+ # run mkinitrd as unconfined user
+ unconfined_manage_tmp_files(ldconfig_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.7/policy/modules/system/locallogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.8/policy/modules/system/locallogin.te
--- nsaserefpolicy/policy/modules/system/locallogin.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/locallogin.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/locallogin.te 2007-09-17 16:20:18.000000000 -0400
@@ -97,6 +97,11 @@
term_setattr_all_user_ttys(local_login_t)
term_setattr_unallocated_ttys(local_login_t)
@@ -12187,9 +10964,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall
#################################
#
# Sulogin local policy
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.7/policy/modules/system/logging.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.8/policy/modules/system/logging.fc
--- nsaserefpolicy/policy/modules/system/logging.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/logging.fc 2007-09-11 11:58:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/logging.fc 2007-09-17 16:20:18.000000000 -0400
@@ -1,12 +1,15 @@
-
/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
@@ -12227,9 +11004,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+
+/etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_script_exec_t,s0)
+/etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.7/policy/modules/system/logging.if
---- nsaserefpolicy/policy/modules/system/logging.if 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/logging.if 2007-09-06 15:43:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.8/policy/modules/system/logging.if
+--- nsaserefpolicy/policy/modules/system/logging.if 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/logging.if 2007-09-17 16:20:18.000000000 -0400
@@ -33,8 +33,13 @@
## </param>
#
@@ -12309,33 +11086,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
## Create an object in the log directory, with a private
## type using a type transition.
## </summary>
-@@ -317,6 +379,25 @@
-
- ########################################
- ## <summary>
-+## dontaudit search of auditd configuration files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`logging_dontaudit_search_audit_config',`
-+ gen_require(`
-+ type auditd_etc_t;
-+ ')
-+
-+ dontaudit $1 auditd_etc_t:dir search_dir_perms;
-+')
-+
-+########################################
-+## <summary>
- ## Allows the domain to open a file in the
- ## log directory, but does not allow the listing
- ## of the contents of the log directory.
-@@ -451,7 +532,7 @@
+@@ -470,7 +532,7 @@
files_search_var($1)
allow $1 var_log_t:dir list_dir_perms;
@@ -12344,7 +11095,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
')
########################################
-@@ -495,6 +576,8 @@
+@@ -514,6 +576,8 @@
files_search_var($1)
manage_files_pattern($1,logfile,logfile)
read_lnk_files_pattern($1,logfile,logfile)
@@ -12353,7 +11104,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
')
########################################
-@@ -578,3 +661,254 @@
+@@ -597,3 +661,258 @@
files_search_var($1)
manage_files_pattern($1,var_log_t,var_log_t)
')
@@ -12496,6 +11247,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+## <summary>
+## All of the rules required to administrate an audit environment
+## </summary>
++## <param name="prefix">
++## <summary>
++## Prefix of the domain. Example, user would be
++## the prefix for the uder_t domain.
++## </summary>
++## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
@@ -12506,46 +11263,48 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+## The role to be allowed to manage the audit domain.
+## </summary>
+## </param>
-+## <param name="terminal">
-+## <summary>
-+## The type of the terminal allow the audit domain to use.
-+## </summary>
-+## </param>
+## <rolecap/>
+#
-+interface(`logging_audit_admin',`
++template(`logging_audit_admin',`
+
+ gen_require(`
+ type auditd_t;
-+ type audit_script_exec_t;
++ type auditd_script_exec_t;
+ type auditd_etc_t;
+ type auditd_log_t;
+ type auditd_var_run_t;
+ ')
+
-+ allow $1 auditd_t:process { ptrace signal_perms getattr };
-+ read_files_pattern($1, auditd_t, auditd_t)
++ allow $2 auditd_t:process { ptrace signal_perms getattr };
++ read_files_pattern($2, auditd_t, auditd_t)
+
-+ # Allow $1 to restart the apache service
-+ audit_script_domtrans($1)
-+ domain_system_change_exemption($1)
-+ role_transition $2 audit_script_exec_t system_r;
-+ allow $2 system_r;
++ # Allow $2 to restart the audit service
++ logging_audit_script_domtrans($2)
++ domain_system_change_exemption($2)
++ role_transition $3 auditd_script_exec_t system_r;
++ allow $3 system_r;
+
-+ manage_dir_perms($1,auditd_etc_t,auditd_etc_t)
-+ manage_file_perms($1,auditd_etc_t,auditd_etc_t)
++ manage_dirs_pattern($2,auditd_etc_t,auditd_etc_t)
++ manage_files_pattern($2,auditd_etc_t,auditd_etc_t)
+
-+ manage_dir_perms($1,auditd_log_t,auditd_log_t)
-+ manage_file_perms($1,auditd_log_t,auditd_log_t)
++ manage_dirs_pattern($2,auditd_log_t,auditd_log_t)
++ manage_files_pattern($2,auditd_log_t,auditd_log_t)
+
-+ manage_dir_perms($1,auditd_var_run_t,auditd_var_run_t)
-+ manage_file_perms($1,auditd_var_run_t,auditd_var_run_t)
++ manage_dirs_pattern($2,auditd_var_run_t,auditd_var_run_t)
++ manage_files_pattern($2,auditd_var_run_t,auditd_var_run_t)
++ logging_run_auditctl($2, $3,{ $1_devpts_t $1_tty_device_t })
+')
+
+########################################
+## <summary>
+## All of the rules required to administrate an audit environment
+## </summary>
++## <param name="prefix">
++## <summary>
++## Prefix of the domain. Example, user would be
++## the prefix for the uder_t domain.
++## </summary>
++## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
@@ -12556,19 +11315,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+## The role to be allowed to manage the audit domain.
+## </summary>
+## </param>
-+## <param name="terminal">
-+## <summary>
-+## The type of the terminal allow the audit domain to use.
-+## </summary>
-+## </param>
+## <rolecap/>
+#
-+interface(`logging_syslog_admin',`
++template(`logging_syslog_admin',`
+
+ gen_require(`
+ type syslogd_t;
-+ type syslog_script_exec_t;
-+ type syslogd_conf_t;
++ type klogd_t;
++ type syslogd_script_exec_t;
++ type syslog_conf_t;
+ type syslogd_tmp_t;
+ type syslogd_var_lib_t;
+ type syslogd_var_run_t;
@@ -12577,40 +11332,40 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+ type var_log_t;
+ ')
+
-+ allow $1 syslogd_t:process { ptrace signal_perms getattr };
-+ allow $1 klogd_t:process { ptrace signal_perms getattr };
-+ read_files_pattern($1, syslogd_t, syslogd_t)
-+ read_files_pattern($1, klogd_t, klogd_t)
++ allow $2 syslogd_t:process { ptrace signal_perms getattr };
++ allow $2 klogd_t:process { ptrace signal_perms getattr };
++ read_files_pattern($2, syslogd_t, syslogd_t)
++ read_files_pattern($2, klogd_t, klogd_t)
+
-+ # Allow $1 to restart the apache service
-+ syslog_script_domtrans($1)
-+ domain_system_change_exemption($1)
-+ role_transition $2 syslog_script_exec_t system_r;
-+ allow $2 system_r;
++ # Allow $2 to restart the syslog service
++ logging_syslog_script_domtrans($2)
++ domain_system_change_exemption($2)
++ role_transition $3 syslogd_script_exec_t system_r;
++ allow $3 system_r;
+
-+ manage_dir_perms($1,klogd_var_run_t,klogd_var_run_t)
-+ manage_file_perms($1,klogd_var_run_t,klogd_var_run_t)
++ manage_dirs_pattern($2, klogd_var_run_t,klogd_var_run_t)
++ manage_files_pattern($2,klogd_var_run_t,klogd_var_run_t)
+
-+ manage_dir_perms($1,klogd_tmp_t,klogd_tmp_t)
-+ manage_file_perms($1,klogd_tmp_t,klogd_tmp_t)
++ manage_dirs_pattern($2,klogd_tmp_t,klogd_tmp_t)
++ manage_files_pattern($2,klogd_tmp_t,klogd_tmp_t)
+
-+ manage_dir_perms($1,syslogd_tmp_t,syslogd_tmp_t)
-+ manage_file_perms($1,syslogd_tmp_t,syslogd_tmp_t)
++ manage_dirs_pattern($2,syslogd_tmp_t,syslogd_tmp_t)
++ manage_files_pattern($2,syslogd_tmp_t,syslogd_tmp_t)
+
-+ manage_dir_perms($1,syslogd_conf_t,syslogd_conf_t)
-+ manage_file_perms($1,syslogd_conf_t,syslogd_conf_t)
++ manage_dirs_pattern($2,syslog_conf_t,syslog_conf_t)
++ manage_files_pattern($2,syslog_conf_t,syslog_conf_t)
+
-+ manage_dir_perms($1,syslogd_var_lib_t,syslogd_var_lib_t)
-+ manage_file_perms($1,syslogd_var_lib_t,syslogd_var_lib_t)
++ manage_dirs_pattern($2,syslogd_var_lib_t,syslogd_var_lib_t)
++ manage_files_pattern($2,syslogd_var_lib_t,syslogd_var_lib_t)
+
-+ manage_dir_perms($1,syslogd_var_run_t,syslogd_var_run_t)
-+ manage_file_perms($1,syslogd_var_run_t,syslogd_var_run_t)
++ manage_dirs_pattern($2,syslogd_var_run_t,syslogd_var_run_t)
++ manage_files_pattern($2,syslogd_var_run_t,syslogd_var_run_t)
+
-+ logging_manage_all_logs($1)
++ logging_manage_all_logs($2)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.7/policy/modules/system/logging.te
---- nsaserefpolicy/policy/modules/system/logging.te 2007-08-22 07:14:11.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/logging.te 2007-09-06 15:43:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.8/policy/modules/system/logging.te
+--- nsaserefpolicy/policy/modules/system/logging.te 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/logging.te 2007-09-17 16:20:18.000000000 -0400
@@ -7,6 +7,10 @@
#
@@ -12707,7 +11462,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
logging_send_syslog_msg(auditd_t)
libs_use_ld_so(auditd_t)
-@@ -242,12 +265,18 @@
+@@ -150,6 +173,7 @@
+
+ mls_file_read_all_levels(auditd_t)
+ mls_file_write_all_levels(auditd_t) # Need to be able to write to /var/run/ directory
++mls_fd_use_all_levels(auditd_t)
+
+ seutil_dontaudit_read_config(auditd_t)
+
+@@ -241,12 +265,18 @@
allow syslogd_t self:udp_socket create_socket_perms;
allow syslogd_t self:tcp_socket create_stream_socket_perms;
@@ -12726,7 +11489,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
# Allow access for syslog-ng
allow syslogd_t var_log_t:dir { create setattr };
-@@ -256,6 +285,9 @@
+@@ -255,6 +285,9 @@
manage_files_pattern(syslogd_t,syslogd_tmp_t,syslogd_tmp_t)
files_tmp_filetrans(syslogd_t,syslogd_tmp_t,{ dir file })
@@ -12736,7 +11499,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
allow syslogd_t syslogd_var_run_t:file manage_file_perms;
files_pid_filetrans(syslogd_t,syslogd_var_run_t,file)
-@@ -313,6 +345,7 @@
+@@ -312,6 +345,7 @@
domain_use_interactive_fds(syslogd_t)
files_read_etc_files(syslogd_t)
@@ -12744,9 +11507,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
files_read_etc_runtime_files(syslogd_t)
# /initrd is not umounted before minilog starts
files_dontaudit_search_isid_type_dirs(syslogd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.7/policy/modules/system/lvm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.8/policy/modules/system/lvm.fc
--- nsaserefpolicy/policy/modules/system/lvm.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/lvm.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/lvm.fc 2007-09-17 16:20:18.000000000 -0400
@@ -15,6 +15,7 @@
#
/etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0)
@@ -12755,9 +11518,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc
/etc/lvm/archive(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0)
/etc/lvm/backup(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0)
/etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.7/policy/modules/system/lvm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.8/policy/modules/system/lvm.te
--- nsaserefpolicy/policy/modules/system/lvm.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/lvm.te 2007-09-07 09:00:42.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/lvm.te 2007-09-17 16:20:18.000000000 -0400
@@ -150,7 +150,9 @@
# DAC overrides and mknod for modifying /dev entries (vgmknodes)
@@ -12811,20 +11574,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
+ xen_dontaudit_rw_unix_stream_sockets(lvm_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.0.7/policy/modules/system/miscfiles.fc
---- nsaserefpolicy/policy/modules/system/miscfiles.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/miscfiles.fc 2007-09-06 15:43:06.000000000 -0400
-@@ -66,6 +66,7 @@
- /var/lib/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0)
-
- /var/cache/fonts(/.*)? gen_context(system_u:object_r:tetex_data_t,s0)
-+/var/cache/fontconfig(/.*)? gen_context(system_u:object_r:fonts_t,s0)
- /var/cache/man(/.*)? gen_context(system_u:object_r:man_t,s0)
-
- /var/spool/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.7/policy/modules/system/modutils.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.8/policy/modules/system/modutils.te
--- nsaserefpolicy/policy/modules/system/modutils.te 2007-08-22 07:14:12.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/modutils.te 2007-09-10 08:58:37.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/modutils.te 2007-09-17 16:20:18.000000000 -0400
@@ -42,7 +42,7 @@
# insmod local policy
#
@@ -12923,17 +11675,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.7/policy/modules/system/mount.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.8/policy/modules/system/mount.fc
--- nsaserefpolicy/policy/modules/system/mount.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/mount.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/mount.fc 2007-09-17 16:20:18.000000000 -0400
@@ -1,4 +1,2 @@
/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
-
-/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.7/policy/modules/system/mount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.8/policy/modules/system/mount.te
--- nsaserefpolicy/policy/modules/system/mount.te 2007-08-22 07:14:13.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/mount.te 2007-09-10 16:38:20.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/mount.te 2007-09-17 16:20:18.000000000 -0400
@@ -8,6 +8,13 @@
## <desc>
@@ -13086,21 +11838,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
+ hal_rw_pipes(mount_t)
')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-3.0.7/policy/modules/system/netlabel.te
---- nsaserefpolicy/policy/modules/system/netlabel.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/netlabel.te 2007-09-06 15:43:06.000000000 -0400
-@@ -19,6 +19,8 @@
- allow netlabel_mgmt_t self:capability net_admin;
- allow netlabel_mgmt_t self:netlink_socket create_socket_perms;
-
-+files_read_etc_files(netlabel_mgmt_t)
-+
- kernel_read_network_state(netlabel_mgmt_t)
-
- libs_use_ld_so(netlabel_mgmt_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.7/policy/modules/system/raid.te
---- nsaserefpolicy/policy/modules/system/raid.te 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/raid.te 2007-09-06 15:43:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.8/policy/modules/system/raid.te
+--- nsaserefpolicy/policy/modules/system/raid.te 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/raid.te 2007-09-17 16:20:18.000000000 -0400
@@ -19,7 +19,7 @@
# Local policy
#
@@ -13110,17 +11850,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t
dontaudit mdadm_t self:capability sys_tty_config;
allow mdadm_t self:process { sigchld sigkill sigstop signull signal };
allow mdadm_t self:fifo_file rw_fifo_file_perms;
-@@ -70,6 +70,7 @@
-
- userdom_dontaudit_use_unpriv_user_fds(mdadm_t)
- userdom_dontaudit_use_sysadm_ttys(mdadm_t)
-+userdom_dontaudit_search_all_users_home_content(mdadm_t)
-
- mta_send_mail(mdadm_t)
-
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.7/policy/modules/system/selinuxutil.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.8/policy/modules/system/selinuxutil.fc
--- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/selinuxutil.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.fc 2007-09-17 16:20:18.000000000 -0400
@@ -38,8 +38,9 @@
/usr/sbin/restorecond -- gen_context(system_u:object_r:restorecond_exec_t,s0)
/usr/sbin/run_init -- gen_context(system_u:object_r:run_init_exec_t,s0)
@@ -13132,9 +11864,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
/usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0)
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.7/policy/modules/system/selinuxutil.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.8/policy/modules/system/selinuxutil.if
--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/selinuxutil.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.if 2007-09-17 16:20:18.000000000 -0400
@@ -432,6 +432,7 @@
role $2 types run_init_t;
allow run_init_t $3:chr_file rw_term_perms;
@@ -13248,7 +11980,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
## Full management of the semanage
## module store.
## </summary>
-@@ -1058,3 +1134,119 @@
+@@ -1058,3 +1134,120 @@
files_search_etc($1)
rw_files_pattern($1,selinux_config_t,semanage_trans_lock_t)
')
@@ -13298,86 +12030,80 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
+ files_search_usr($2)
+ corecmd_search_bin($2)
+ domtrans_pattern($2,setsebool_exec_t,$1_setsebool_t)
++ seutil_semanage_policy($1_setsebool_t)
+')
+
-+
++#######################################
++## <summary>
++## All rules necessary to run semanage command
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
+interface(`seutil_semanage_policy',`
-+allow $1 self:capability { dac_override audit_write };
-+allow $1 self:unix_stream_socket create_stream_socket_perms;
-+allow $1 self:unix_dgram_socket create_socket_perms;
-+logging_send_audit_msgs($1)
-+
-+allow $1 policy_config_t:file { read write };
-+
-+allow $1 semanage_tmp_t:dir manage_dir_perms;
-+allow $1 semanage_tmp_t:file manage_file_perms;
-+files_tmp_filetrans($1, semanage_tmp_t, { file dir })
-+
-+kernel_read_system_state($1)
-+kernel_read_kernel_sysctls($1)
++ gen_require(`
++ type semanage_tmp_t;
++ type policy_config_t;
++ ')
++ allow $1 self:capability { dac_override audit_write };
++ allow $1 self:unix_stream_socket create_stream_socket_perms;
++ allow $1 self:unix_dgram_socket create_socket_perms;
++ logging_send_audit_msgs($1)
+
-+can_exec($1, semanage_exec_t)
++ allow $1 policy_config_t:file { read write };
+
-+corecmd_exec_bin($1)
-+corecmd_exec_shell($1)
++ allow $1 semanage_tmp_t:dir manage_dir_perms;
++ allow $1 semanage_tmp_t:file manage_file_perms;
++ files_tmp_filetrans($1, semanage_tmp_t, { file dir })
+
-+dev_read_urand($1)
++ kernel_read_system_state($1)
++ kernel_read_kernel_sysctls($1)
+
-+domain_use_interactive_fds($1)
++ corecmd_exec_bin($1)
++ corecmd_exec_shell($1)
+
-+files_read_etc_files($1)
-+files_read_etc_runtime_files($1)
-+files_read_usr_files($1)
-+files_list_pids($1)
++ dev_read_urand($1)
+
-+mls_file_write_all_levels($1)
-+mls_file_read_all_levels($1)
++ domain_use_interactive_fds($1)
+
-+selinux_validate_context($1)
-+selinux_get_enforce_mode($1)
-+# for setsebool:
-+selinux_set_boolean($1)
++ files_read_etc_files($1)
++ files_read_etc_runtime_files($1)
++ files_read_usr_files($1)
++ files_list_pids($1)
++ fs_list_inotifyfs($1)
+
-+term_use_all_terms($1)
++ mls_file_write_all_levels($1)
++ mls_file_read_all_levels($1)
+
-+# Running genhomedircon requires this for finding all users
-+auth_use_nsswitch($1)
-+# Admins are creating pp files in random locations
-+auth_read_all_files_except_shadow($1)
++ selinux_getattr_fs($1)
++ selinux_validate_context($1)
++ selinux_get_enforce_mode($1)
+
-+libs_use_ld_so($1)
-+libs_use_shared_libs($1)
++ term_use_all_terms($1)
+
-+locallogin_use_fds($1)
++ libs_use_ld_so($1)
++ libs_use_shared_libs($1)
+
-+logging_send_syslog_msg($1)
++ locallogin_use_fds($1)
+
-+miscfiles_read_localization($1)
++ logging_send_syslog_msg($1)
+
-+seutil_manage_file_contexts($1)
-+seutil_manage_selinux_config($1)
-+seutil_domtrans_setfiles($1)
-+seutil_domtrans_loadpolicy($1)
-+seutil_read_config($1)
-+seutil_manage_bin_policy($1)
-+seutil_use_newrole_fds($1)
-+seutil_manage_module_store($1)
-+seutil_get_$1rans_lock($1)
-+seutil_get_semanage_read_lock($1)
-+# netfilter_contexts:
-+seutil_manage_default_contexts($1)
++ miscfiles_read_localization($1)
+
++ seutil_domtrans_loadpolicy($1)
++ seutil_read_config($1)
++ seutil_manage_bin_policy($1)
++ seutil_use_newrole_fds($1)
++ seutil_manage_module_store($1)
++ seutil_get_semanage_trans_lock($1)
++ seutil_get_semanage_read_lock($1)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.7/policy/modules/system/selinuxutil.te
---- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-08-22 07:14:13.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/selinuxutil.te 2007-09-10 14:35:10.000000000 -0400
-@@ -1,5 +1,5 @@
-
--policy_module(selinuxutil,1.6.2)
-+policy_module(selinuxutil,1.6.1)
-
- gen_require(`
- bool secure_mode;
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.8/policy/modules/system/selinuxutil.te
+--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.te 2007-09-17 16:20:18.000000000 -0400
@@ -76,7 +76,6 @@
type restorecond_exec_t;
init_daemon_domain(restorecond_t,restorecond_exec_t)
@@ -13386,26 +12112,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
type restorecond_var_run_t;
files_pid_file(restorecond_var_run_t)
-@@ -88,11 +87,17 @@
- role system_r types run_init_t;
-
- type semanage_t;
-+domain_interactive_fd(semanage_t)
-+
- type semanage_exec_t;
- application_domain(semanage_t,semanage_exec_t)
--domain_interactive_fd(semanage_t)
+@@ -93,6 +92,10 @@
+ domain_interactive_fd(semanage_t)
role system_r types semanage_t;
++type setsebool_t;
+type setsebool_exec_t;
-+init_system_domain(semanage_t, setsebool_exec_t)
-+domain_interactive_fd(semanage_t)
-+init_use_fds(semanage_t)
++init_system_domain(setsebool_t, setsebool_exec_t)
+
type semanage_store_t;
files_type(semanage_store_t)
-@@ -194,7 +199,7 @@
+@@ -194,10 +197,15 @@
# cjp: cover up stray file descriptors.
dontaudit load_policy_t selinux_config_t:file write;
optional_policy(`
@@ -13414,7 +12132,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
')
')
-@@ -215,7 +220,7 @@
++optional_policy(`
++ usermanage_dontaudit_useradd_use_fds(load_policy_t)
++')
++
++
+ ########################################
+ #
+ # Newrole local policy
+@@ -215,7 +223,7 @@
allow newrole_t self:msg { send receive };
allow newrole_t self:unix_dgram_socket sendto;
allow newrole_t self:unix_stream_socket { create_stream_socket_perms connectto };
@@ -13423,9 +12149,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
read_files_pattern(newrole_t,selinux_config_t,selinux_config_t)
read_lnk_files_pattern(newrole_t,selinux_config_t,selinux_config_t)
-@@ -253,7 +258,9 @@
+@@ -252,8 +260,11 @@
+ term_getattr_unallocated_ttys(newrole_t)
term_dontaudit_use_unallocated_ttys(newrole_t)
++auth_use_nsswitch(newrole_t)
auth_domtrans_chk_passwd(newrole_t)
+auth_domtrans_upd_passwd_chk(newrole_t)
auth_rw_faillog(newrole_t)
@@ -13433,7 +12161,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
corecmd_list_bin(newrole_t)
corecmd_read_bin_symlinks(newrole_t)
-@@ -273,6 +280,7 @@
+@@ -273,6 +284,7 @@
libs_use_ld_so(newrole_t)
libs_use_shared_libs(newrole_t)
@@ -13441,7 +12169,36 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
logging_send_syslog_msg(newrole_t)
miscfiles_read_localization(newrole_t)
-@@ -343,6 +351,8 @@
+@@ -294,14 +306,6 @@
+ files_polyinstantiate_all(newrole_t)
+ ')
+
+-optional_policy(`
+- nis_use_ypbind(newrole_t)
+-')
+-
+-optional_policy(`
+- nscd_socket_use(newrole_t)
+-')
+-
+ ########################################
+ #
+ # Restorecond local policy
+@@ -309,11 +313,12 @@
+
+ allow restorecond_t self:capability { dac_override dac_read_search fowner };
+ allow restorecond_t self:fifo_file rw_fifo_file_perms;
+-allow restorecond_t self:netlink_route_socket r_netlink_socket_perms;
+
+ allow restorecond_t restorecond_var_run_t:file manage_file_perms;
+ files_pid_filetrans(restorecond_t,restorecond_var_run_t, file)
+
++auth_use_nsswitch(restorecond_t)
++
+ kernel_use_fds(restorecond_t)
+ kernel_rw_pipes(restorecond_t)
+ kernel_read_system_state(restorecond_t)
+@@ -343,15 +348,12 @@
miscfiles_read_localization(restorecond_t)
@@ -13450,7 +12207,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
optional_policy(`
rpm_use_script_fds(restorecond_t)
')
-@@ -361,7 +371,7 @@
+
+-optional_policy(`
+- # restorecond watches for users logging in,
+- # so it getspwnam when a user logs in to find his homedir
+- nis_use_ypbind(restorecond_t)
+-')
+
+ #################################
+ #
+@@ -361,7 +363,7 @@
allow run_init_t self:process setexec;
allow run_init_t self:capability setuid;
allow run_init_t self:fifo_file rw_file_perms;
@@ -13459,7 +12225,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
# often the administrator runs such programs from a directory that is owned
# by a different user or has restrictive SE permissions, do not want to audit
-@@ -375,6 +385,7 @@
+@@ -375,6 +377,7 @@
term_dontaudit_list_ptys(run_init_t)
auth_domtrans_chk_passwd(run_init_t)
@@ -13467,49 +12233,96 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
auth_dontaudit_read_shadow(run_init_t)
corecmd_exec_bin(run_init_t)
-@@ -431,7 +442,7 @@
- allow semanage_t self:capability { dac_override audit_write };
- allow semanage_t self:unix_stream_socket create_stream_socket_perms;
- allow semanage_t self:unix_dgram_socket create_socket_perms;
--allow semanage_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
-+logging_send_audit_msgs(semanage_t)
-
- allow semanage_t policy_config_t:file { read write };
+@@ -423,77 +426,50 @@
+ nscd_socket_use(run_init_t)
+ ')
-@@ -442,7 +453,10 @@
- kernel_read_system_state(semanage_t)
- kernel_read_kernel_sysctls(semanage_t)
-
-+can_exec(semanage_t, semanage_exec_t)
+
- corecmd_exec_bin(semanage_t)
-+corecmd_exec_shell(semanage_t)
-
- dev_read_urand(semanage_t)
+ ########################################
+ #
+-# semodule local policy
++# setsebool local policy
+ #
++seutil_semanage_policy(setsebool_t)
++selinux_set_boolean(setsebool_t)
-@@ -452,6 +466,7 @@
- files_read_etc_runtime_files(semanage_t)
- files_read_usr_files(semanage_t)
- files_list_pids(semanage_t)
-+fs_list_inotifyfs(semanage_t)
+-allow semanage_t self:capability { dac_override audit_write };
+-allow semanage_t self:unix_stream_socket create_stream_socket_perms;
+-allow semanage_t self:unix_dgram_socket create_socket_perms;
+-allow semanage_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
+-
+-allow semanage_t policy_config_t:file { read write };
+-
+-allow semanage_t semanage_tmp_t:dir manage_dir_perms;
+-allow semanage_t semanage_tmp_t:file manage_file_perms;
+-files_tmp_filetrans(semanage_t, semanage_tmp_t, { file dir })
+-
+-kernel_read_system_state(semanage_t)
+-kernel_read_kernel_sysctls(semanage_t)
+-
+-corecmd_exec_bin(semanage_t)
+-
+-dev_read_urand(semanage_t)
+-
+-domain_use_interactive_fds(semanage_t)
+-
+-files_read_etc_files(semanage_t)
+-files_read_etc_runtime_files(semanage_t)
+-files_read_usr_files(semanage_t)
+-files_list_pids(semanage_t)
+-
+-mls_file_write_all_levels(semanage_t)
+-mls_file_read_all_levels(semanage_t)
+-
+-selinux_validate_context(semanage_t)
+-selinux_get_enforce_mode(semanage_t)
+-selinux_getattr_fs(semanage_t)
+-# for setsebool:
+-selinux_set_boolean(semanage_t)
++########################################
++#
++# semodule local policy
++#
- mls_file_write_all_levels(semanage_t)
- mls_file_read_all_levels(semanage_t)
-@@ -465,6 +480,8 @@
+-term_use_all_terms(semanage_t)
++seutil_semanage_policy(semanage_t)
++can_exec(semanage_t, semanage_exec_t)
# Running genhomedircon requires this for finding all users
auth_use_nsswitch(semanage_t)
+-
+-libs_use_ld_so(semanage_t)
+-libs_use_shared_libs(semanage_t)
+-
+-locallogin_use_fds(semanage_t)
+-
+-logging_send_syslog_msg(semanage_t)
+-
+-miscfiles_read_localization(semanage_t)
+# Admins are creating pp files in random locations
+auth_read_all_files_except_shadow(semanage_t)
- libs_use_ld_so(semanage_t)
- libs_use_shared_libs(semanage_t)
-@@ -488,6 +505,17 @@
+ seutil_manage_file_contexts(semanage_t)
+ seutil_manage_selinux_config(semanage_t)
+ seutil_domtrans_setfiles(semanage_t)
+-seutil_domtrans_loadpolicy(semanage_t)
+-seutil_read_config(semanage_t)
+-seutil_manage_bin_policy(semanage_t)
+-seutil_use_newrole_fds(semanage_t)
+-seutil_manage_module_store(semanage_t)
+-seutil_get_semanage_trans_lock(semanage_t)
+-seutil_get_semanage_read_lock(semanage_t)
++
# netfilter_contexts:
seutil_manage_default_contexts(semanage_t)
+userdom_search_sysadm_home_dirs(semanage_t)
+
+ ifdef(`distro_debian',`
+ files_read_var_lib_files(semanage_t)
+ files_read_var_lib_symlinks(semanage_t)
+ ')
+
+optional_policy(`
+ #signal mcstrans on reload
+ init_spec_domtrans_script(semanage_t)
@@ -13522,7 +12335,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
# cjp: need a more general way to handle this:
ifdef(`enable_mls',`
# read secadm tmp files
-@@ -515,6 +543,8 @@
+@@ -521,6 +497,8 @@
allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:file r_file_perms;
allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:lnk_file r_file_perms;
@@ -13531,7 +12344,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
kernel_read_system_state(setfiles_t)
kernel_relabelfrom_unlabeled_dirs(setfiles_t)
kernel_relabelfrom_unlabeled_files(setfiles_t)
-@@ -531,6 +561,7 @@
+@@ -537,6 +515,7 @@
fs_getattr_xattr_fs(setfiles_t)
fs_list_all(setfiles_t)
@@ -13539,7 +12352,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
fs_search_auto_mountpoints(setfiles_t)
fs_relabelfrom_noxattr_fs(setfiles_t)
-@@ -586,6 +617,10 @@
+@@ -592,6 +571,10 @@
ifdef(`hide_broken_symptoms',`
optional_policy(`
@@ -13550,9 +12363,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
udev_dontaudit_rw_dgram_sockets(setfiles_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.7/policy/modules/system/sysnetwork.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.8/policy/modules/system/sysnetwork.if
--- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/sysnetwork.if 2007-09-11 10:23:22.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.if 2007-09-17 16:20:18.000000000 -0400
@@ -522,6 +522,8 @@
files_search_etc($1)
@@ -13586,9 +12399,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
+ dontaudit $1 dhcpc_t:fd use;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.7/policy/modules/system/sysnetwork.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.8/policy/modules/system/sysnetwork.te
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/sysnetwork.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.te 2007-09-17 16:20:18.000000000 -0400
@@ -45,7 +45,7 @@
dontaudit dhcpc_t self:capability sys_tty_config;
# for access("/etc/bashrc", X_OK) on Red Hat
@@ -13598,7 +12411,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
allow dhcpc_t self:fifo_file rw_file_perms;
allow dhcpc_t self:tcp_socket create_stream_socket_perms;
allow dhcpc_t self:udp_socket create_socket_perms;
-@@ -159,6 +159,10 @@
+@@ -136,6 +136,7 @@
+
+ modutils_domtrans_insmod(dhcpc_t)
+
++userdom_dontaudit_search_sysadm_home_dirs(dhcpc_t)
+ userdom_dontaudit_search_staff_home_dirs(dhcpc_t)
+
+ ifdef(`distro_redhat', `
+@@ -159,6 +160,10 @@
dbus_connect_system_bus(dhcpc_t)
dbus_send_system_bus(dhcpc_t)
@@ -13609,7 +12430,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
optional_policy(`
networkmanager_dbus_chat(dhcpc_t)
')
-@@ -203,9 +207,7 @@
+@@ -203,9 +208,7 @@
')
optional_policy(`
@@ -13620,7 +12441,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
')
optional_policy(`
-@@ -216,6 +218,7 @@
+@@ -216,6 +219,7 @@
optional_policy(`
seutil_sigchld_newrole(dhcpc_t)
seutil_dontaudit_search_config(dhcpc_t)
@@ -13628,7 +12449,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
')
optional_policy(`
-@@ -254,6 +257,7 @@
+@@ -254,6 +258,7 @@
allow ifconfig_t self:sem create_sem_perms;
allow ifconfig_t self:msgq create_msgq_perms;
allow ifconfig_t self:msg { send receive };
@@ -13636,7 +12457,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
# Create UDP sockets, necessary when called from dhcpc
allow ifconfig_t self:udp_socket create_socket_perms;
-@@ -280,6 +284,8 @@
+@@ -280,6 +285,8 @@
fs_getattr_xattr_fs(ifconfig_t)
fs_search_auto_mountpoints(ifconfig_t)
@@ -13645,111 +12466,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
term_dontaudit_use_all_user_ttys(ifconfig_t)
term_dontaudit_use_all_user_ptys(ifconfig_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.7/policy/modules/system/udev.te
---- nsaserefpolicy/policy/modules/system/udev.te 2007-08-22 07:14:12.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/udev.te 2007-09-06 15:43:06.000000000 -0400
-@@ -68,8 +68,9 @@
- allow udev_t udev_tbl_t:file manage_file_perms;
- dev_filetrans(udev_t,udev_tbl_t,file)
-
-+manage_dirs_pattern(udev_t,udev_var_run_t,udev_var_run_t)
- manage_files_pattern(udev_t,udev_var_run_t,udev_var_run_t)
--files_pid_filetrans(udev_t,udev_var_run_t,file)
-+files_pid_filetrans(udev_t,udev_var_run_t,{ file dir })
-
- kernel_read_system_state(udev_t)
- kernel_getattr_core_if(udev_t)
-@@ -83,16 +84,23 @@
- kernel_dgram_send(udev_t)
- kernel_signal(udev_t)
-
-+#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182
-+kernel_rw_net_sysctls(udev_t)
-+kernel_read_network_state(udev_t)
-+
- corecmd_exec_all_executables(udev_t)
-
- dev_rw_sysfs(udev_t)
- dev_manage_all_dev_nodes(udev_t)
- dev_rw_generic_files(udev_t)
- dev_delete_generic_files(udev_t)
-+dev_search_usbfs_dirs(udev_t)
-+dev_relabel_all_dev_nodes(udev_t)
-
- domain_read_all_domains_state(udev_t)
- domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these
-
-+files_read_usr_files(udev_t)
- files_read_etc_runtime_files(udev_t)
- files_read_etc_files(udev_t)
- files_exec_etc_files(udev_t)
-@@ -142,9 +150,16 @@
- seutil_read_file_contexts(udev_t)
- seutil_domtrans_setfiles(udev_t)
-
-+sysnet_read_dhcpc_pid(udev_t)
-+sysnet_rw_dhcp_config(udev_t)
-+sysnet_delete_dhcpc_pid(udev_t)
- sysnet_domtrans_ifconfig(udev_t)
- sysnet_domtrans_dhcpc(udev_t)
-+sysnet_signal_dhcpc(udev_t)
-+sysnet_etc_filetrans_config(udev_t)
-+sysnet_manage_config(udev_t)
-
-+userdom_use_sysadm_ttys(udev_t)
- userdom_dontaudit_search_all_users_home_content(udev_t)
-
- ifdef(`distro_gentoo',`
-@@ -170,6 +185,10 @@
- ')
-
- optional_policy(`
-+ brctl_domtrans(udev_t)
-+')
-+
-+optional_policy(`
- consoletype_exec(udev_t)
- ')
-
-@@ -178,6 +197,10 @@
- ')
-
- optional_policy(`
-+ fstools_domtrans(udev_t)
-+')
-+
-+optional_policy(`
- hal_dgram_send(udev_t)
- ')
-
-@@ -188,5 +211,24 @@
- ')
-
- optional_policy(`
-+ openct_read_pid_files(udev_t)
-+ openct_domtrans(udev_t)
-+')
-+
-+optional_policy(`
-+ pcscd_read_pub_files(udev_t)
-+ pcscd_domtrans(udev_t)
-+')
-+
-+optional_policy(`
-+ xen_manage_log(udev_t)
-+ kernel_write_xen_state(udev_t)
-+ kernel_read_xen_state(udev_t)
-+ xen_read_image_files(udev_t)
-+')
-+
-+optional_policy(`
- xserver_read_xdm_pid(udev_t)
- ')
-+
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.7/policy/modules/system/unconfined.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.8/policy/modules/system/unconfined.if
--- nsaserefpolicy/policy/modules/system/unconfined.if 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/unconfined.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/unconfined.if 2007-09-17 16:20:18.000000000 -0400
@@ -12,14 +12,13 @@
#
interface(`unconfined_domain_noaudit',`
@@ -13766,8 +12485,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
allow $1 self:fifo_file manage_fifo_file_perms;
# Transition to myself, to make get_ordered_context_list happy.
-@@ -29,10 +28,10 @@
+@@ -27,12 +26,13 @@
+
+ # Write access is for setting attributes under /proc/self/attr.
allow $1 self:file rw_file_perms;
++ allow $1 self:dir rw_dir_perms;
# Userland object managers
- allow $1 self:nscd *;
@@ -13781,7 +12503,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
kernel_unconfined($1)
corenet_unconfined($1)
-@@ -79,6 +78,10 @@
+@@ -79,6 +79,10 @@
')
optional_policy(`
@@ -13792,7 +12514,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
nscd_unconfined($1)
')
-@@ -558,7 +561,7 @@
+@@ -558,7 +562,7 @@
')
files_search_home($1)
@@ -13801,7 +12523,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
read_files_pattern($1,{ unconfined_home_dir_t unconfined_home_t },unconfined_home_t)
read_lnk_files_pattern($1,{ unconfined_home_dir_t unconfined_home_t },unconfined_home_t)
')
-@@ -601,3 +604,132 @@
+@@ -601,3 +605,149 @@
allow $1 unconfined_tmp_t:file { getattr write append };
')
@@ -13934,9 +12656,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
+ dontaudit $1 unconfined_terminal:chr_file rw_term_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.7/policy/modules/system/unconfined.te
++########################################
++## <summary>
++## Allow apps to set rlimits on userdomain
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`unconfined_set_rlimitnh',`
++ gen_require(`
++ type unconfined_t;
++ ')
++
++ allow $1 unconfined_t:process rlimitinh;
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.8/policy/modules/system/unconfined.te
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/unconfined.te 2007-09-10 16:37:23.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/unconfined.te 2007-09-17 16:20:18.000000000 -0400
@@ -5,28 +5,36 @@
#
# Declarations
@@ -14007,17 +12746,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
optional_policy(`
- ada_domtrans(unconfined_t)
-+ ada_run(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
- ')
-
- optional_policy(`
+-')
+-
+-optional_policy(`
- apache_run_helper(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
- apache_per_role_template(unconfined,unconfined_t,unconfined_r)
- # this is disallowed usage:
- unconfined_domain(httpd_unconfined_script_t)
--')
--
--optional_policy(`
++ ada_run(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
+ ')
+
+ optional_policy(`
- bind_run_ndc(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
+ bootloader_run(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
')
@@ -14099,12 +12838,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
')
optional_policy(`
-@@ -205,11 +194,12 @@
+@@ -205,11 +194,18 @@
')
optional_policy(`
- wine_domtrans(unconfined_t)
+ wine_run(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
++')
++
++optional_policy(`
++ mozilla_per_role_template(unconfined, unconfined_t, unconfined_r)
++ unconfined_domain(unconfined_mozilla_t)
++ allow unconfined_mozilla_t self:process { execstack execmem };
')
optional_policy(`
@@ -14114,7 +12859,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
')
########################################
-@@ -227,6 +217,17 @@
+@@ -227,6 +223,17 @@
unconfined_dbus_chat(unconfined_execmem_t)
optional_policy(`
@@ -14132,18 +12877,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
')
+
+corecmd_exec_all_executables(unconfined_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.0.7/policy/modules/system/userdomain.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.0.8/policy/modules/system/userdomain.fc
--- nsaserefpolicy/policy/modules/system/userdomain.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/userdomain.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/userdomain.fc 2007-09-17 16:20:18.000000000 -0400
@@ -1,4 +1,5 @@
HOME_DIR -d gen_context(system_u:object_r:ROLE_home_dir_t,s0-mls_systemhigh)
+HOME_DIR -l gen_context(system_u:object_r:ROLE_home_dir_t,s0-mls_systemhigh)
HOME_DIR/.+ gen_context(system_u:object_r:ROLE_home_t,s0)
/tmp/gconfd-USER -d gen_context(system_u:object_r:ROLE_tmp_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.7/policy/modules/system/userdomain.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.8/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-08-27 09:18:17.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/userdomain.if 2007-09-07 15:05:57.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/userdomain.if 2007-09-17 16:20:18.000000000 -0400
@@ -45,7 +45,7 @@
type $1_tty_device_t;
term_user_tty($1_t,$1_tty_device_t)
@@ -14175,6 +12920,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
#######################################
+@@ -184,7 +192,7 @@
+ files_list_home($1_t)
+
+ tunable_policy(`use_nfs_home_dirs',`
+- fs_list_nfs_dirs($1_t)
++ fs_list_nfs($1_t)
+ fs_read_nfs_files($1_t)
+ fs_read_nfs_symlinks($1_t)
+ fs_read_nfs_named_sockets($1_t)
+@@ -195,7 +203,7 @@
+ ')
+
+ tunable_policy(`use_samba_home_dirs',`
+- fs_list_cifs_dirs($1_t)
++ fs_list_cifs($1_t)
+ fs_read_cifs_files($1_t)
+ fs_read_cifs_symlinks($1_t)
+ fs_read_cifs_named_sockets($1_t)
@@ -315,13 +323,19 @@
## <rolebase/>
#
@@ -14814,22 +13577,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
-@@ -1856,17 +1940,53 @@
- ## </summary>
- ## </param>
- #
--template(`userdom_dontaudit_list_user_home_dirs',`
-+template(`userdom_dontaudit_list_user_home_dirs',`
-+ gen_require(`
-+ type $1_home_dir_t;
-+ ')
-+
-+ dontaudit $2 $1_home_dir_t:dir list_dir_perms;
-+')
-+
-+########################################
-+## <summary>
-+## Create, read, write, and delete directories
+@@ -1902,6 +1986,41 @@
+
+ ########################################
+ ## <summary>
++## dontaudit attemps to Create files
+## in a user home subdirectory.
+## </summary>
+## <desc>
@@ -14854,41 +13606,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+## </summary>
+## </param>
+#
-+template(`userdom_manage_user_home_content_dirs',`
- gen_require(`
-- type $1_home_dir_t;
-+ type $1_home_dir_t, $1_home_t;
- ')
-
-- dontaudit $2 $1_home_dir_t:dir list_dir_perms;
-+ files_search_home($2)
-+ manage_dirs_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t)
- ')
-
- ########################################
- ## <summary>
--## Create, read, write, and delete directories
-+## dontaudit attemps to Create files
- ## in a user home subdirectory.
- ## </summary>
- ## <desc>
-@@ -1891,13 +2011,12 @@
- ## </summary>
- ## </param>
- #
--template(`userdom_manage_user_home_content_dirs',`
+template(`userdom_dontaudit_create_user_home_content_files',`
- gen_require(`
-- type $1_home_dir_t, $1_home_t;
++ gen_require(`
+ type $1_home_dir_t;
- ')
-
-- files_search_home($2)
-- manage_dirs_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t)
++ ')
++
+ dontaudit $2 $1_home_dir_t:file create;
- ')
-
- ########################################
++')
++
++########################################
++## <summary>
+ ## Do not audit attempts to set the
+ ## attributes of user home files.
+ ## </summary>
@@ -3078,7 +3197,7 @@
#
template(`userdom_tmp_filetrans_user_tmp',`
@@ -14898,13 +13628,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
files_tmp_filetrans($2,$1_tmp_t,$3)
-@@ -4615,6 +4734,24 @@
- files_list_home($1)
- allow $1 home_dir_type:dir search_dir_perms;
- ')
-+########################################
-+## <summary>
-+## Read all users home directories symlinks.
+@@ -4599,7 +4718,25 @@
+
+ ########################################
+ ## <summary>
+-## Search all users home directories.
++## Search all users home directories.
+## </summary>
+## <param name="domain">
+## <summary>
@@ -14912,18 +13641,52 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+## </summary>
+## </param>
+#
-+interface(`userdom_read_all_users_home_dirs_symlinks',`
++interface(`userdom_search_all_users_home_dirs',`
+ gen_require(`
+ attribute home_dir_type;
+ ')
+
+ files_list_home($1)
-+ allow $1 home_dir_type:lnk_file read_lnk_file_perms;
++ allow $1 home_dir_type:dir search_dir_perms;
+')
++########################################
++## <summary>
++## Read all users home directories symlinks.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -4607,13 +4744,13 @@
+ ## </summary>
+ ## </param>
+ #
+-interface(`userdom_search_all_users_home_dirs',`
++interface(`userdom_read_all_users_home_dirs_symlinks',`
+ gen_require(`
+ attribute home_dir_type;
+ ')
+
+ files_list_home($1)
+- allow $1 home_dir_type:dir search_dir_perms;
++ allow $1 home_dir_type:lnk_file read_lnk_file_perms;
+ ')
########################################
- ## <summary>
-@@ -5323,7 +5460,7 @@
+@@ -4633,6 +4770,14 @@
+
+ files_list_home($1)
+ allow $1 home_dir_type:dir list_dir_perms;
++
++ tunable_policy(`use_nfs_home_dirs',`
++ fs_list_nfs(crond_t)
++ ')
++
++ tunable_policy(`use_samba_home_dirs',`
++ fs_list_cifs(crond_t)
++ ')
+ ')
+
+ ########################################
+@@ -5323,7 +5468,7 @@
attribute user_tmpfile;
')
@@ -14932,7 +13695,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -5559,3 +5696,299 @@
+@@ -5559,3 +5704,318 @@
interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.')
')
@@ -15232,10 +13995,43 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ files_search_home($1)
+ allow $1 user_home_type:file execute;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.7/policy/modules/system/userdomain.te
---- nsaserefpolicy/policy/modules/system/userdomain.te 2007-08-22 07:14:11.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/userdomain.te 2007-09-10 14:07:37.000000000 -0400
-@@ -74,6 +74,9 @@
++
++
++########################################
++## <summary>
++## Allow apps to set rlimits on userdomain
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`userdom_set_rlimitnh',`
++ gen_require(`
++ attribute userdomain;
++ ')
++ allow $1 userdomain:process rlimitinh;
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.8/policy/modules/system/userdomain.te
+--- nsaserefpolicy/policy/modules/system/userdomain.te 2007-09-12 10:34:51.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/userdomain.te 2007-09-17 16:20:18.000000000 -0400
+@@ -24,13 +24,6 @@
+
+ ## <desc>
+ ## <p>
+-## Allow users to connect to mysql
+-## </p>
+-## </desc>
+-gen_tunable(allow_user_mysql_connect,false)
+-
+-## <desc>
+-## <p>
+ ## Allow users to connect to PostgreSQL
+ ## </p>
+ ## </desc>
+@@ -74,6 +67,9 @@
# users home directory contents
attribute home_type;
@@ -15245,7 +14041,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
# The privhome attribute identifies every domain that can create files under
# regular user home directories in the regular context (IE act on behalf of
# a user in writing regular files)
-@@ -136,13 +139,6 @@
+@@ -136,13 +132,6 @@
userdom_role_change_template(secadm,sysadm)
')
@@ -15259,7 +14055,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
########################################
#
# Sysadm local policy
-@@ -161,6 +157,11 @@
+@@ -161,6 +150,11 @@
init_exec(sysadm_t)
@@ -15271,7 +14067,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
# Following for sending reboot and wall messages
userdom_use_unpriv_users_ptys(sysadm_t)
userdom_use_unpriv_users_ttys(sysadm_t)
-@@ -231,6 +232,10 @@
+@@ -231,6 +225,10 @@
')
optional_policy(`
@@ -15282,16 +14078,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
apache_run_helper(sysadm_t,sysadm_r,admin_terminal)
#apache_run_all_scripts(sysadm_t,sysadm_r)
#apache_domtrans_sys_script(sysadm_t)
-@@ -278,7 +283,7 @@
- ')
-
- optional_policy(`
-- certwatach_run(sysadm_t,sysadm_r,admin_terminal)
-+ certwatch_run(sysadm_t,sysadm_r,admin_terminal)
- ')
-
- optional_policy(`
-@@ -286,14 +291,6 @@
+@@ -286,14 +284,6 @@
')
optional_policy(`
@@ -15306,7 +14093,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
cron_admin_template(sysadm,sysadm_t,sysadm_r)
')
-@@ -394,6 +391,10 @@
+@@ -394,6 +384,10 @@
')
optional_policy(`
@@ -15317,7 +14104,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
netutils_run(sysadm_t,sysadm_r,admin_terminal)
netutils_run_ping(sysadm_t,sysadm_r,admin_terminal)
netutils_run_traceroute(sysadm_t,sysadm_r,admin_terminal)
-@@ -443,15 +444,20 @@
+@@ -443,15 +437,20 @@
optional_policy(`
samba_run_net(sysadm_t,sysadm_r,admin_terminal)
@@ -15338,7 +14125,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
', `
userdom_security_admin_template(sysadm_t,sysadm_r,admin_terminal)
')
-@@ -494,3 +500,7 @@
+@@ -494,3 +493,7 @@
optional_policy(`
yam_run(sysadm_t,sysadm_r,admin_terminal)
')
@@ -15346,14 +14133,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+tunable_policy(`allow_console_login', `
+ term_use_console(userdomain)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.fc serefpolicy-3.0.7/policy/modules/system/virt.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.fc serefpolicy-3.0.8/policy/modules/system/virt.fc
--- nsaserefpolicy/policy/modules/system/virt.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/system/virt.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/virt.fc 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1 @@
+/var/lib/libvirt(/.*)? gen_context(system_u:object_r:virt_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.0.7/policy/modules/system/virt.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.0.8/policy/modules/system/virt.if
--- nsaserefpolicy/policy/modules/system/virt.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/system/virt.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/virt.if 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,58 @@
+## <summary>Virtualization </summary>
+
@@ -15413,16 +14200,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.i
+ files_list_var_lib($1)
+ rw_files_pattern($1,virt_var_lib_t,virt_var_lib_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.0.7/policy/modules/system/virt.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.0.8/policy/modules/system/virt.te
--- nsaserefpolicy/policy/modules/system/virt.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/system/virt.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/virt.te 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,3 @@
+# var/lib files
+type virt_var_lib_t;
+files_type(virt_var_lib_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.7/policy/modules/system/xen.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.8/policy/modules/system/xen.if
--- nsaserefpolicy/policy/modules/system/xen.if 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/xen.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/xen.if 2007-09-17 16:20:18.000000000 -0400
@@ -191,3 +191,24 @@
domtrans_pattern($1,xm_exec_t,xm_t)
@@ -15448,10 +14235,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if
+ allow $1 xend_var_lib_t:dir search_dir_perms;
+ rw_files_pattern($1,xen_image_t,xen_image_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.7/policy/modules/system/xen.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.8/policy/modules/system/xen.te
--- nsaserefpolicy/policy/modules/system/xen.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.7/policy/modules/system/xen.te 2007-09-11 14:25:59.000000000 -0400
-@@ -95,7 +95,7 @@
++++ serefpolicy-3.0.8/policy/modules/system/xen.te 2007-09-17 16:20:18.000000000 -0400
+@@ -45,9 +45,7 @@
+
+ type xenstored_t;
+ type xenstored_exec_t;
+-domain_type(xenstored_t)
+-domain_entry_file(xenstored_t,xenstored_exec_t)
+-role system_r types xenstored_t;
++init_daemon_domain(xenstored_t,xenstored_exec_t)
+
+ # var/lib files
+ type xenstored_var_lib_t;
+@@ -59,8 +57,7 @@
+
+ type xenconsoled_t;
+ type xenconsoled_exec_t;
+-domain_type(xenconsoled_t)
+-domain_entry_file(xenconsoled_t,xenconsoled_exec_t)
++init_daemon_domain(xenconsoled_t,xenconsoled_exec_t)
+ role system_r types xenconsoled_t;
+
+ # pid files
+@@ -95,7 +92,7 @@
read_lnk_files_pattern(xend_t,xen_image_t,xen_image_t)
rw_blk_files_pattern(xend_t,xen_image_t,xen_image_t)
@@ -15460,22 +14268,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
dev_filetrans(xend_t, xenctl_t, fifo_file)
manage_files_pattern(xend_t,xend_tmp_t,xend_tmp_t)
-@@ -122,11 +122,13 @@
+@@ -122,15 +119,13 @@
manage_fifo_files_pattern(xend_t,xend_var_lib_t,xend_var_lib_t)
files_var_lib_filetrans(xend_t,xend_var_lib_t,{ file dir })
+init_stream_connect_script(xend_t)
+
# transition to store
- domain_auto_trans(xend_t, xenstored_exec_t, xenstored_t)
- allow xenstored_t xend_t:fd use;
- allow xenstored_t xend_t:process sigchld;
+-domain_auto_trans(xend_t, xenstored_exec_t, xenstored_t)
+-allow xenstored_t xend_t:fd use;
+-allow xenstored_t xend_t:process sigchld;
-allow xenstored_t xend_t:fifo_file write;
-+allow xenstored_t xend_t:fifo_file write_fifo_file_perms;
++domtrans_pattern(xend_t, xenstored_exec_t, xenstored_t)
# transition to console
- domain_auto_trans(xend_t, xenconsoled_exec_t, xenconsoled_t)
-@@ -176,6 +178,7 @@
+-domain_auto_trans(xend_t, xenconsoled_exec_t, xenconsoled_t)
+-allow xenconsoled_t xend_t:fd use;
++domtrans_pattern(xend_t, xenconsoled_exec_t, xenconsoled_t)
+
+ kernel_read_kernel_sysctls(xend_t)
+ kernel_read_system_state(xend_t)
+@@ -176,6 +171,7 @@
files_manage_etc_runtime_files(xend_t)
files_etc_filetrans_etc_runtime(xend_t,file)
files_read_usr_files(xend_t)
@@ -15483,18 +14296,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
storage_raw_read_fixed_disk(xend_t)
storage_raw_write_fixed_disk(xend_t)
-@@ -214,6 +217,10 @@
+@@ -214,6 +210,10 @@
netutils_domtrans(xend_t)
optional_policy(`
-+ brctl_getattr(xend_t)
++ brctl_domtrans(xend_t)
+')
+
+optional_policy(`
consoletype_exec(xend_t)
')
-@@ -224,7 +231,7 @@
+@@ -224,7 +224,7 @@
allow xenconsoled_t self:capability { dac_override fsetid ipc_lock };
allow xenconsoled_t self:unix_stream_socket create_stream_socket_perms;
@@ -15503,7 +14316,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
allow xenconsoled_t xen_devpts_t:chr_file rw_term_perms;
-@@ -257,7 +264,7 @@
+@@ -257,7 +257,7 @@
miscfiles_read_localization(xenconsoled_t)
@@ -15512,7 +14325,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
xen_stream_connect_xenstore(xenconsoled_t)
########################################
-@@ -265,7 +272,7 @@
+@@ -265,7 +265,7 @@
# Xen store local policy
#
@@ -15521,7 +14334,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
allow xenstored_t self:unix_stream_socket create_stream_socket_perms;
allow xenstored_t self:unix_dgram_socket create_socket_perms;
-@@ -318,12 +325,13 @@
+@@ -318,12 +318,13 @@
allow xm_t self:capability { dac_override ipc_lock sys_tty_config };
# internal communication is often done using fifo and unix sockets.
@@ -15536,7 +14349,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
files_search_var_lib(xm_t)
allow xm_t xen_image_t:dir rw_dir_perms;
-@@ -336,6 +344,7 @@
+@@ -336,6 +337,7 @@
kernel_write_xen_state(xm_t)
corecmd_exec_bin(xm_t)
@@ -15544,7 +14357,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
corenet_tcp_sendrecv_generic_if(xm_t)
corenet_tcp_sendrecv_all_nodes(xm_t)
-@@ -353,6 +362,7 @@
+@@ -353,6 +355,7 @@
term_use_all_terms(xm_t)
@@ -15552,7 +14365,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
init_rw_script_stream_sockets(xm_t)
init_use_fds(xm_t)
-@@ -366,3 +376,14 @@
+@@ -366,3 +369,14 @@
xen_append_log(xm_t)
xen_stream_connect(xm_t)
xen_stream_connect_xenstore(xm_t)
@@ -15567,19 +14380,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
+ fs_manage_nfs_files(xend_t)
+ fs_read_nfs_symlinks(xend_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.7/policy/modules/users/guest.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.8/policy/modules/users/guest.fc
--- nsaserefpolicy/policy/modules/users/guest.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/users/guest.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/users/guest.fc 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1 @@
+# No guest file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.7/policy/modules/users/guest.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.8/policy/modules/users/guest.if
--- nsaserefpolicy/policy/modules/users/guest.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/users/guest.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/users/guest.if 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1 @@
+## <summary>Policy for guest user</summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.7/policy/modules/users/guest.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.8/policy/modules/users/guest.te
--- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/users/guest.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/users/guest.te 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,9 @@
+policy_module(guest,1.0.0)
+userdom_unpriv_login_user(guest)
@@ -15590,20 +14403,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.t
+optional_policy(`
+ hal_dbus_chat(xguest_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.7/policy/modules/users/logadm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.8/policy/modules/users/logadm.fc
--- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/users/logadm.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/users/logadm.fc 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1 @@
+# No logadm file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.7/policy/modules/users/logadm.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.8/policy/modules/users/logadm.if
--- nsaserefpolicy/policy/modules/users/logadm.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/users/logadm.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/users/logadm.if 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1 @@
+## <summary>Policy for logadm user</summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.7/policy/modules/users/logadm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.8/policy/modules/users/logadm.te
--- nsaserefpolicy/policy/modules/users/logadm.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/users/logadm.te 2007-09-06 15:43:06.000000000 -0400
-@@ -0,0 +1,33 @@
++++ serefpolicy-3.0.8/policy/modules/users/logadm.te 2007-09-17 16:20:18.000000000 -0400
+@@ -0,0 +1,12 @@
+policy_module(logadm,1.0.0)
+
+########################################
@@ -15614,47 +14427,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.
+
+allow logadm_t self:capability { dac_override dac_read_search kill sys_ptrace sys_nice };
+
-+logging_etc_filetrans_syslog_conf(logadm_t)
-+logging_manage_syslog_config(logadm_t)
-+logging_manage_all_logs(logadm_t)
-+
-+seutil_run_runinit(logadm_t, logadm_r, { logadm_tty_device_t logadm_devpts_t })
-+
-+domain_kill_all_domains(logadm_t)
-+seutil_read_bin_policy(logadm_t)
-+corecmd_exec_shell(logadm_t)
-+logging_send_syslog_msg(logadm_t)
-+logging_read_generic_logs(logadm_t)
-+logging_manage_audit_log(logadm_t)
-+logging_manage_audit_config(logadm_t)
-+logging_run_auditctl(logadm_t,logadm_r,{ logadm_tty_device_t logadm_devpts_t })
-+logging_run_auditd(logadm_t, logadm_r, { logadm_tty_device_t logadm_devpts_t })
-+userdom_dontaudit_read_sysadm_home_content_files(logadm_t)
-+consoletype_exec(logadm_t)
-+
-+kernel_read_ring_buffer(logadm_t)
-+dmesg_exec(logadm_t)
-+
-+files_dontaudit_search_all_dirs(logadm_t)
-+files_dontaudit_getattr_all_files(logadm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.7/policy/modules/users/metadata.xml
++logging_syslog_admin(logadm, logadm_t, logadm_r)
++logging_audit_admin(logadm, logadm_t, logadm_r)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.8/policy/modules/users/metadata.xml
--- nsaserefpolicy/policy/modules/users/metadata.xml 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/users/metadata.xml 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/users/metadata.xml 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1 @@
+<summary>Policy modules for users</summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.7/policy/modules/users/webadm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.8/policy/modules/users/webadm.fc
--- nsaserefpolicy/policy/modules/users/webadm.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/users/webadm.fc 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/users/webadm.fc 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1 @@
+# No webadm file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.7/policy/modules/users/webadm.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.8/policy/modules/users/webadm.if
--- nsaserefpolicy/policy/modules/users/webadm.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/users/webadm.if 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/users/webadm.if 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1 @@
+## <summary>Policy for webadm user</summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.7/policy/modules/users/webadm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.8/policy/modules/users/webadm.te
--- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.7/policy/modules/users/webadm.te 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/users/webadm.te 2007-09-17 16:20:18.000000000 -0400
@@ -0,0 +1,42 @@
+policy_module(webadm,1.0.0)
+
@@ -15691,16 +14483,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.
+userdom_dontaudit_search_sysadm_home_dirs(webadm_t)
+userdom_dontaudit_search_generic_user_home_dirs(webadm_t)
+
-+apache_admin(webadm_t, webadm_r, { webadm_tty_device_t webadm_devpts_t })
++apache_admin(webadm, webadm_t, webadm_r)
+
+gen_require(`
+ type gadmin_t;
+')
+allow gadmin_t webadm_t:process transition;
+allow webadm_t gadmin_t:dir getattr;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.7/policy/support/obj_perm_sets.spt
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.8/policy/support/obj_perm_sets.spt
--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-08-22 07:14:18.000000000 -0400
-+++ serefpolicy-3.0.7/policy/support/obj_perm_sets.spt 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/support/obj_perm_sets.spt 2007-09-17 16:20:18.000000000 -0400
@@ -216,7 +216,7 @@
define(`getattr_file_perms',`{ getattr }')
define(`setattr_file_perms',`{ setattr }')
@@ -15724,9 +14516,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
+define(`all_association', `{ sendto recvfrom setcontext polmatch } ')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.7/policy/users
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.8/policy/users
--- nsaserefpolicy/policy/users 2007-07-17 14:52:27.000000000 -0400
-+++ serefpolicy-3.0.7/policy/users 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/policy/users 2007-09-17 16:20:18.000000000 -0400
@@ -16,7 +16,7 @@
# and a user process should never be assigned the system user
# identity.
@@ -15761,9 +14553,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0
- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
-')
+gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.7/Rules.modular
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.8/Rules.modular
--- nsaserefpolicy/Rules.modular 2007-05-25 09:09:10.000000000 -0400
-+++ serefpolicy-3.0.7/Rules.modular 2007-09-06 15:43:06.000000000 -0400
++++ serefpolicy-3.0.8/Rules.modular 2007-09-17 16:20:18.000000000 -0400
@@ -219,6 +219,16 @@
########################################
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 711dc3a..47a3f8c 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -16,8 +16,8 @@
%define CHECKPOLICYVER 2.0.3-1
Summary: SELinux policy configuration
Name: selinux-policy
-Version: 3.0.7
-Release: 10%{?dist}
+Version: 3.0.8
+Release: 1%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -362,6 +362,9 @@ exit 0
%endif
%changelog
+* Mon Sep 17 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-1
+- Allow cron to search nfs and samba homedirs
+
* Tue Sep 11 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-10
- Allow NetworkManager to dbus chat with yum-updated