diff --git a/policy/modules/services/postfixpolicyd.if b/policy/modules/services/postfixpolicyd.if
index feae93b..d960d3f 100644
--- a/policy/modules/services/postfixpolicyd.if
+++ b/policy/modules/services/postfixpolicyd.if
@@ -20,8 +20,7 @@
interface(`postfixpolicyd_admin',`
gen_require(`
type postfix_policyd_t, postfix_policyd_conf_t;
- type postfix_policyd_var_run_t;
- type postfix_policyd_initrc_exec_t;
+ type postfix_policyd_var_run_t, postfix_policyd_initrc_exec_t;
')
allow $1 postfix_policyd_t:process { ptrace signal_perms };
diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if
index ac2d3e7..d78db2c 100644
--- a/policy/modules/services/postgresql.if
+++ b/policy/modules/services/postgresql.if
@@ -417,13 +417,10 @@ interface(`postgresql_unconfined',`
#
interface(`postgresql_admin',`
gen_require(`
- attribute sepgsql_admin_type;
- attribute sepgsql_client_type;
-
- type postgresql_t, postgresql_var_run_t;
- type postgresql_tmp_t, postgresql_db_t;
- type postgresql_etc_t, postgresql_log_t;
- type postgresql_initrc_exec_t;
+ attribute sepgsql_admin_type, sepgsql_client_type;
+ type postgresql_t, postgresql_var_run_t, postgresql_initrc_exec_t;
+ type postgresql_tmp_t, postgresql_db_t, postgresql_log_t;
+ type postgresql_etc_t;
')
typeattribute $1 sepgsql_admin_type;
diff --git a/policy/modules/services/postgrey.if b/policy/modules/services/postgrey.if
index ad15fde..70f9768 100644
--- a/policy/modules/services/postgrey.if
+++ b/policy/modules/services/postgrey.if
@@ -57,9 +57,8 @@ interface(`postgrey_search_spool',`
#
interface(`postgrey_admin',`
gen_require(`
- type postgrey_t, postgrey_etc_t;
+ type postgrey_t, postgrey_etc_t, postgrey_initrc_exec_t;
type postgrey_var_lib_t, postgrey_var_run_t;
- type postgrey_initrc_exec_t;
')
allow $1 postgrey_t:process { ptrace signal_perms };
diff --git a/policy/modules/services/ppp.if b/policy/modules/services/ppp.if
index f916c76..f66b8f2 100644
--- a/policy/modules/services/ppp.if
+++ b/policy/modules/services/ppp.if
@@ -353,11 +353,9 @@ interface(`ppp_initrc_domtrans',`
interface(`ppp_admin',`
gen_require(`
type pppd_t, pppd_tmp_t, pppd_log_t, pppd_lock_t;
- type pppd_etc_t, pppd_secret_t;
- type pppd_etc_rw_t, pppd_var_run_t;
-
+ type pppd_etc_t, pppd_secret_t, pppd_var_run_t;
type pptp_t, pptp_log_t, pptp_var_run_t;
- type pppd_initrc_exec_t;
+ type pppd_initrc_exec_t, pppd_etc_rw_t;
')
allow $1 pppd_t:process { ptrace signal_perms };
diff --git a/policy/modules/services/prelude.if b/policy/modules/services/prelude.if
index 1bf96b0..9638805 100644
--- a/policy/modules/services/prelude.if
+++ b/policy/modules/services/prelude.if
@@ -112,13 +112,10 @@ interface(`prelude_manage_spool',`
#
interface(`prelude_admin',`
gen_require(`
- type prelude_t, prelude_spool_t;
- type prelude_var_run_t, prelude_var_lib_t;
- type prelude_audisp_t, prelude_audisp_var_run_t;
- type prelude_initrc_exec_t;
-
- type prelude_lml_t, prelude_lml_tmp_t;
- type prelude_lml_var_run_t;
+ type prelude_t, prelude_spool_t, prelude_initrc_exec_t;
+ type prelude_var_run_t, prelude_var_lib_t, prelude_lml_var_run_t;
+ type prelude_audisp_t, prelude_audisp_var_run_t, prelude_lml_tmp_t;
+ type prelude_lml_t;
')
allow $1 prelude_t:process { ptrace signal_perms };
diff --git a/policy/modules/services/privoxy.if b/policy/modules/services/privoxy.if
index c8f6cb5..7221526 100644
--- a/policy/modules/services/privoxy.if
+++ b/policy/modules/services/privoxy.if
@@ -19,9 +19,8 @@
#
interface(`privoxy_admin',`
gen_require(`
- type privoxy_t, privoxy_log_t;
+ type privoxy_t, privoxy_log_t, privoxy_initrc_exec_t;
type privoxy_etc_rw_t, privoxy_var_run_t;
- type privoxy_initrc_exec_t;
')
allow $1 privoxy_t:process { ptrace signal_perms };
diff --git a/policy/modules/services/psad.if b/policy/modules/services/psad.if
index 96440db..3fc5163 100644
--- a/policy/modules/services/psad.if
+++ b/policy/modules/services/psad.if
@@ -253,8 +253,8 @@ interface(`psad_rw_tmp_files',`
interface(`psad_admin',`
gen_require(`
type psad_t, psad_var_run_t, psad_var_log_t;
- type psad_initrc_exec_t, psad_var_lib_t;
- type psad_tmp_t, psad_etc_t;
+ type psad_initrc_exec_t, psad_var_lib_t, psad_etc_t;
+ type psad_tmp_t;
')
allow $1 psad_t:process { ptrace signal_perms };
diff --git a/policy/modules/services/pyzor.if b/policy/modules/services/pyzor.if
index 6443f30..748e7d3 100644
--- a/policy/modules/services/pyzor.if
+++ b/policy/modules/services/pyzor.if
@@ -109,8 +109,7 @@ interface(`pyzor_exec',`
interface(`pyzor_admin',`
gen_require(`
type pyzord_t, pyzor_tmp_t, pyzord_log_t;
- type pyzor_etc_t, pyzor_var_lib_t;
- type pyzord_initrc_exec_t;
+ type pyzor_etc_t, pyzor_var_lib_t, pyzord_initrc_exec_t;
')
allow $1 pyzord_t:process { ptrace signal_perms };
diff --git a/policy/modules/services/qpidd.if b/policy/modules/services/qpidd.if
index 5dbca44..f97e16c 100644
--- a/policy/modules/services/qpidd.if
+++ b/policy/modules/services/qpidd.if
@@ -176,17 +176,13 @@ interface(`qpidd_manage_var_lib',`
#
interface(`qpidd_admin',`
gen_require(`
- type qpidd_t;
+ type qpidd_t, qpidd_initrc_exec_t;
')
allow $1 qpidd_t:process { ptrace signal_perms };
ps_process_pattern($1, qpidd_t)
- gen_require(`
- type qpidd_initrc_exec_t;
- ')
-
# Allow qpidd_t to restart the apache service
qpidd_initrc_domtrans($1)
domain_system_change_exemption($1)
diff --git a/policy/modules/services/radvd.if b/policy/modules/services/radvd.if
index be05bff..2bd662a 100644
--- a/policy/modules/services/radvd.if
+++ b/policy/modules/services/radvd.if
@@ -19,8 +19,8 @@
#
interface(`radvd_admin',`
gen_require(`
- type radvd_t, radvd_etc_t;
- type radvd_var_run_t, radvd_initrc_exec_t;
+ type radvd_t, radvd_etc_t, radvd_initrc_exec_t;
+ type radvd_var_run_t;
')
allow $1 radvd_t:process { ptrace signal_perms };
diff --git a/policy/modules/services/rhcs.if b/policy/modules/services/rhcs.if
index d8b97c2..30c9aff 100644
--- a/policy/modules/services/rhcs.if
+++ b/policy/modules/services/rhcs.if
@@ -13,9 +13,7 @@
#
template(`rhcs_domain_template',`
gen_require(`
- attribute cluster_domain;
- attribute cluster_tmpfs;
- attribute cluster_pid;
+ attribute cluster_domain, cluster_tmpfs, cluster_pid;
')
##############################
@@ -349,8 +347,7 @@ interface(`rhcs_rw_groupd_shm',`
#
interface(`rhcs_rw_cluster_shm',`
gen_require(`
- attribute cluster_domain;
- attribute cluster_tmpfs;
+ attribute cluster_domain, cluster_tmpfs;
')
allow $1 cluster_domain:shm { rw_shm_perms destroy };
@@ -390,8 +387,7 @@ interface(`rhcs_rw_cluster_semaphores',`
#
interface(`rhcs_stream_connect_cluster',`
gen_require(`
- attribute cluster_domain;
- attribute cluster_pid;
+ attribute cluster_domain, cluster_pid;
')
files_search_pids($1)
diff --git a/policy/modules/services/samba.if b/policy/modules/services/samba.if
index 84732e5..aace276 100644
--- a/policy/modules/services/samba.if
+++ b/policy/modules/services/samba.if
@@ -761,9 +761,8 @@ interface(`samba_admin',`
type smbd_t, smbd_tmp_t, samba_secrets_t;
type samba_initrc_exec_t, samba_log_t, samba_var_t;
type samba_etc_t, samba_share_t, winbind_log_t;
- type swat_var_run_t, swat_tmp_t;
- type winbind_var_run_t, winbind_tmp_t;
- type samba_unconfined_script_t, samba_unconfined_script_exec_t;
+ type swat_var_run_t, swat_tmp_t, samba_unconfined_script_exec_t;
+ type winbind_var_run_t, winbind_tmp_t, samba_unconfined_script_t;
')
allow $1 smbd_t:process { ptrace signal_perms };
diff --git a/policy/modules/services/setroubleshoot.if b/policy/modules/services/setroubleshoot.if
index a7fbedc..d9f5dbc 100644
--- a/policy/modules/services/setroubleshoot.if
+++ b/policy/modules/services/setroubleshoot.if
@@ -136,8 +136,8 @@ interface(`setroubleshoot_fixit_dontaudit_leaks',`
#
interface(`setroubleshoot_admin',`
gen_require(`
- type setroubleshootd_t, setroubleshoot_var_log_t;
- type setroubleshoot_var_lib_t, setroubleshoot_var_run_t;
+ type setroubleshootd_t, setroubleshoot_var_log_t, setroubleshoot_var_run_t;
+ type setroubleshoot_var_lib_t;
')
allow $1 setroubleshootd_t:process { ptrace signal_perms };
diff --git a/policy/modules/services/snmp.if b/policy/modules/services/snmp.if
index 6aa68d8..bfdf197 100644
--- a/policy/modules/services/snmp.if
+++ b/policy/modules/services/snmp.if
@@ -125,9 +125,8 @@ interface(`snmp_dontaudit_write_snmp_var_lib_files',`
#
interface(`snmp_admin',`
gen_require(`
- type snmpd_t, snmpd_log_t;
+ type snmpd_t, snmpd_log_t, snmpd_initrc_exec_t;
type snmpd_var_lib_t, snmpd_var_run_t;
- type snmpd_initrc_exec_t;
')
allow $1 snmpd_t:process { ptrace signal_perms };
diff --git a/policy/modules/services/soundserver.if b/policy/modules/services/soundserver.if
index 93fe7bf..4a15633 100644
--- a/policy/modules/services/soundserver.if
+++ b/policy/modules/services/soundserver.if
@@ -33,9 +33,8 @@ interface(`soundserver_tcp_connect',`
#
interface(`soundserver_admin',`
gen_require(`
- type soundd_t, soundd_etc_t;
+ type soundd_t, soundd_etc_t, soundd_initrc_exec_t;
type soundd_tmp_t, soundd_var_run_t;
- type soundd_initrc_exec_t;
')
allow $1 soundd_t:process { ptrace signal_perms };
diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
index f34a53f..88b6040 100644
--- a/policy/modules/services/xserver.if
+++ b/policy/modules/services/xserver.if
@@ -358,7 +358,7 @@ interface(`xserver_user_client',`
#
template(`xserver_common_x_domain_template',`
gen_require(`
- type root_xdrawable_t;
+ type root_xdrawable_t, xdm_t, xserver_t;
type xproperty_t, $1_xproperty_t;
type xevent_t, client_xevent_t;
type input_xevent_t, $1_input_xevent_t;
@@ -375,7 +375,6 @@ template(`xserver_common_x_domain_template',`
class x_screen { saver_setattr saver_hide saver_show };
class x_pointer { get_property set_property manage };
class x_keyboard { read manage };
- type xdm_t, xserver_t;
')
##############################
@@ -474,8 +473,8 @@ template(`xserver_object_types_template',`
#
template(`xserver_user_x_domain_template',`
gen_require(`
- type xdm_t, xdm_tmp_t;
- type xauth_home_t, iceauth_home_t, xserver_t, xserver_tmpfs_t;
+ type xdm_t, xdm_tmp_t, xserver_tmpfs_t;
+ type xauth_home_t, iceauth_home_t, xserver_t;
')
allow $2 self:shm create_shm_perms;
diff --git a/policy/modules/services/zebra.if b/policy/modules/services/zebra.if
index 5860687..347f754 100644
--- a/policy/modules/services/zebra.if
+++ b/policy/modules/services/zebra.if
@@ -61,8 +61,7 @@ interface(`zebra_stream_connect',`
interface(`zebra_admin',`
gen_require(`
type zebra_t, zebra_tmp_t, zebra_log_t;
- type zebra_conf_t, zebra_var_run_t;
- type zebra_initrc_exec_t;
+ type zebra_conf_t, zebra_var_run_t, zebra_initrc_exec_t;
')
allow $1 zebra_t:process { ptrace signal_perms };