diff --git a/.cvsignore b/.cvsignore
index 1927067..c3738bc 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -121,3 +121,4 @@ serefpolicy-2.6.5.tgz
serefpolicy-3.0.1.tgz
serefpolicy-3.0.2.tgz
serefpolicy-3.0.3.tgz
+serefpolicy-3.0.4.tgz
diff --git a/policy-20070703.patch b/policy-20070703.patch
index d7af10d..9928244 100644
--- a/policy-20070703.patch
+++ b/policy-20070703.patch
@@ -1,14 +1,14 @@
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/guest_u_default_contexts serefpolicy-3.0.3/config/appconfig-strict-mls/guest_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/guest_u_default_contexts serefpolicy-3.0.4/config/appconfig-strict-mls/guest_u_default_contexts
--- nsaserefpolicy/config/appconfig-strict-mls/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/config/appconfig-strict-mls/guest_u_default_contexts 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/config/appconfig-strict-mls/guest_u_default_contexts 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,4 @@
+system_r:local_login_t:s0 guest_r:guest_t:s0
+system_r:remote_login_t:s0 guest_r:guest_t:s0
+system_r:sshd_t:s0 guest_r:guest_t:s0
+system_r:crond_t:s0 guest_r:guest_crond_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/staff_u_default_contexts serefpolicy-3.0.3/config/appconfig-strict-mls/staff_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/staff_u_default_contexts serefpolicy-3.0.4/config/appconfig-strict-mls/staff_u_default_contexts
--- nsaserefpolicy/config/appconfig-strict-mls/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/config/appconfig-strict-mls/staff_u_default_contexts 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/config/appconfig-strict-mls/staff_u_default_contexts 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,9 @@
+system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
+system_r:remote_login_t:s0 staff_r:staff_t:s0
@@ -19,9 +19,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/
+staff_r:staff_sudo_t:s0 staff_r:staff_t:s0
+sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0
+sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/user_u_default_contexts serefpolicy-3.0.3/config/appconfig-strict-mls/user_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/user_u_default_contexts serefpolicy-3.0.4/config/appconfig-strict-mls/user_u_default_contexts
--- nsaserefpolicy/config/appconfig-strict-mls/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/config/appconfig-strict-mls/user_u_default_contexts 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/config/appconfig-strict-mls/user_u_default_contexts 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,7 @@
+system_r:local_login_t:s0 user_r:user_t:s0
+system_r:remote_login_t:s0 user_r:user_t:s0
@@ -30,31 +30,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/
+system_r:xdm_t:s0 user_r:user_t:s0
+user_r:user_su_t:s0 user_r:user_t:s0
+user_r:user_sudo_t:s0 user_r:user_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/default_type serefpolicy-3.0.3/config/appconfig-targeted-mcs/default_type
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/default_type serefpolicy-3.0.4/config/appconfig-targeted-mcs/default_type
--- nsaserefpolicy/config/appconfig-targeted-mcs/default_type 2007-05-25 09:09:09.000000000 -0400
-+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/default_type 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/default_type 2007-07-25 13:27:51.000000000 -0400
@@ -1 +1,4 @@
system_r:unconfined_t
+sysadm_r:sysadm_t
+staff_r:staff_t
+user_r:user_t
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/guest_u_default_contexts serefpolicy-3.0.3/config/appconfig-targeted-mcs/guest_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/guest_u_default_contexts serefpolicy-3.0.4/config/appconfig-targeted-mcs/guest_u_default_contexts
--- nsaserefpolicy/config/appconfig-targeted-mcs/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/guest_u_default_contexts 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/guest_u_default_contexts 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,4 @@
+system_r:local_login_t:s0 guest_r:guest_t:s0
+system_r:remote_login_t:s0 guest_r:guest_t:s0
+system_r:sshd_t:s0 guest_r:guest_t:s0
+system_r:crond_t:s0 guest_r:guest_crond_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/initrc_context serefpolicy-3.0.3/config/appconfig-targeted-mcs/initrc_context
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/initrc_context serefpolicy-3.0.4/config/appconfig-targeted-mcs/initrc_context
--- nsaserefpolicy/config/appconfig-targeted-mcs/initrc_context 2007-05-25 09:09:09.000000000 -0400
-+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/initrc_context 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/initrc_context 2007-07-25 13:27:51.000000000 -0400
@@ -1 +1 @@
-user_u:system_r:initrc_t:s0
+system_u:system_r:initrc_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/root_default_contexts serefpolicy-3.0.3/config/appconfig-targeted-mcs/root_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/root_default_contexts serefpolicy-3.0.4/config/appconfig-targeted-mcs/root_default_contexts
--- nsaserefpolicy/config/appconfig-targeted-mcs/root_default_contexts 2007-05-25 09:09:09.000000000 -0400
-+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/root_default_contexts 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/root_default_contexts 2007-07-25 13:27:51.000000000 -0400
@@ -1,2 +1,10 @@
-system_r:unconfined_t:s0 system_r:unconfined_t:s0
-system_r:initrc_t:s0 system_r:unconfined_t:s0
@@ -68,16 +68,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mc
+#
+#system_r:sshd_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/seusers serefpolicy-3.0.3/config/appconfig-targeted-mcs/seusers
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/seusers serefpolicy-3.0.4/config/appconfig-targeted-mcs/seusers
--- nsaserefpolicy/config/appconfig-targeted-mcs/seusers 2007-05-31 15:35:39.000000000 -0400
-+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/seusers 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/seusers 2007-07-25 13:27:51.000000000 -0400
@@ -1,2 +1,2 @@
root:root:s0-mcs_systemhigh
-__default__:user_u:s0
+__default__:system_u:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/staff_u_default_contexts serefpolicy-3.0.3/config/appconfig-targeted-mcs/staff_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/staff_u_default_contexts serefpolicy-3.0.4/config/appconfig-targeted-mcs/staff_u_default_contexts
--- nsaserefpolicy/config/appconfig-targeted-mcs/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/staff_u_default_contexts 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/staff_u_default_contexts 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,9 @@
+system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
+system_r:remote_login_t:s0 staff_r:staff_t:s0
@@ -88,9 +88,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mc
+staff_r:staff_sudo_t:s0 staff_r:staff_t:s0
+sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0
+sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/user_u_default_contexts serefpolicy-3.0.3/config/appconfig-targeted-mcs/user_u_default_contexts
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/user_u_default_contexts serefpolicy-3.0.4/config/appconfig-targeted-mcs/user_u_default_contexts
--- nsaserefpolicy/config/appconfig-targeted-mcs/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/user_u_default_contexts 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/user_u_default_contexts 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,7 @@
+system_r:local_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0
+system_r:remote_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0
@@ -99,9 +99,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mc
+system_r:xdm_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0
+user_r:user_su_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0
+user_r:user_sudo_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.0.3/Makefile
---- nsaserefpolicy/Makefile 2007-05-29 13:53:56.000000000 -0400
-+++ serefpolicy-3.0.3/Makefile 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.0.4/Makefile
+--- nsaserefpolicy/Makefile 2007-07-25 10:37:43.000000000 -0400
++++ serefpolicy-3.0.4/Makefile 2007-07-25 13:27:51.000000000 -0400
@@ -158,8 +158,18 @@
headerdir = $(modpkgdir)/include
docsdir = $(prefix)/share/doc/$(PKGNAME)
@@ -131,9 +131,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.0.3/M
M4PARAM += -D enable_mcs
CHECKPOLICY += -M
CHECKMODULE += -M
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.0.3/man/man8/ftpd_selinux.8
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.0.4/man/man8/ftpd_selinux.8
--- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-05-25 09:09:10.000000000 -0400
-+++ serefpolicy-3.0.3/man/man8/ftpd_selinux.8 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/man/man8/ftpd_selinux.8 2007-07-25 13:27:51.000000000 -0400
@@ -12,7 +12,7 @@
.TP
chcon -R -t public_content_t /var/ftp
@@ -143,19 +143,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 sere
.TP
chcon -t public_content_rw_t /var/ftp/incoming
.TP
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.0.3/policy/flask/access_vectors
---- nsaserefpolicy/policy/flask/access_vectors 2007-06-19 16:23:34.000000000 -0400
-+++ serefpolicy-3.0.3/policy/flask/access_vectors 2007-07-17 15:46:25.000000000 -0400
-@@ -598,6 +598,8 @@
- shmempwd
- shmemgrp
- shmemhost
-+ getserv
-+ shmemserv
- }
-
- # Define the access vector interpretation for controlling
-@@ -623,6 +625,8 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.0.4/policy/flask/access_vectors
+--- nsaserefpolicy/policy/flask/access_vectors 2007-07-25 10:37:36.000000000 -0400
++++ serefpolicy-3.0.4/policy/flask/access_vectors 2007-07-25 13:27:51.000000000 -0400
+@@ -625,6 +625,8 @@
send
recv
relabelto
@@ -164,9 +155,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors
}
class key
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.0.3/policy/global_tunables
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.0.4/policy/global_tunables
--- nsaserefpolicy/policy/global_tunables 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/global_tunables 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/global_tunables 2007-07-25 13:27:51.000000000 -0400
@@ -133,3 +133,10 @@
## </desc>
gen_tunable(write_untrusted_content,false)
@@ -178,9 +169,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref
+## </desc>
+gen_tunable(allow_console_login,false)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.0.3/policy/mls
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.0.4/policy/mls
--- nsaserefpolicy/policy/mls 2007-07-03 07:06:36.000000000 -0400
-+++ serefpolicy-3.0.3/policy/mls 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/mls 2007-07-25 13:27:51.000000000 -0400
@@ -89,12 +89,14 @@
mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton }
(( l1 eq l2 ) or
@@ -263,9 +254,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.0.3
( t2 == unlabeled_t ));
mlsconstrain association { polmatch }
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-3.0.3/policy/modules/admin/acct.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-3.0.4/policy/modules/admin/acct.te
--- nsaserefpolicy/policy/modules/admin/acct.te 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/acct.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/acct.te 2007-07-25 13:27:51.000000000 -0400
@@ -9,6 +9,7 @@
type acct_t;
type acct_exec_t;
@@ -274,9 +265,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te
type acct_data_t;
logging_log_file(acct_data_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.0.3/policy/modules/admin/alsa.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.0.4/policy/modules/admin/alsa.fc
--- nsaserefpolicy/policy/modules/admin/alsa.fc 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/alsa.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/alsa.fc 2007-07-25 13:27:51.000000000 -0400
@@ -1,4 +1,7 @@
/etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)
@@ -285,10 +276,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc
/usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0)
+/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.0.3/policy/modules/admin/alsa.te
---- nsaserefpolicy/policy/modules/admin/alsa.te 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/alsa.te 2007-07-17 15:46:25.000000000 -0400
-@@ -20,20 +20,24 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.0.4/policy/modules/admin/alsa.te
+--- nsaserefpolicy/policy/modules/admin/alsa.te 2007-07-25 10:37:43.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/alsa.te 2007-07-25 13:27:51.000000000 -0400
+@@ -19,20 +19,24 @@
# Local policy
#
@@ -316,7 +307,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te
libs_use_ld_so(alsa_t)
libs_use_shared_libs(alsa_t)
-@@ -44,7 +48,14 @@
+@@ -43,7 +47,14 @@
userdom_manage_unpriv_user_semaphores(alsa_t)
userdom_manage_unpriv_user_shared_mem(alsa_t)
@@ -331,9 +322,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te
+ hal_write_log(alsa_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.0.3/policy/modules/admin/anaconda.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.0.4/policy/modules/admin/anaconda.te
--- nsaserefpolicy/policy/modules/admin/anaconda.te 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/anaconda.te 2007-07-23 09:26:54.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/anaconda.te 2007-07-25 13:27:51.000000000 -0400
@@ -31,16 +31,13 @@
modutils_domtrans_insmod(anaconda_t)
@@ -352,10 +343,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anacond
kudzu_domtrans(anaconda_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-3.0.3/policy/modules/admin/bootloader.te
---- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/bootloader.te 2007-07-17 15:46:25.000000000 -0400
-@@ -182,6 +182,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-3.0.4/policy/modules/admin/bootloader.te
+--- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-07-25 10:37:43.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/bootloader.te 2007-07-25 13:27:51.000000000 -0400
+@@ -180,6 +180,7 @@
optional_policy(`
hal_dontaudit_append_lib_files(bootloader_t)
@@ -363,34 +354,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.0.3/policy/modules/admin/consoletype.te
---- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/consoletype.te 2007-07-17 15:46:25.000000000 -0400
-@@ -8,12 +8,21 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.0.4/policy/modules/admin/consoletype.te
+--- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-07-25 10:37:43.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/consoletype.te 2007-07-26 10:21:26.000000000 -0400
+@@ -8,9 +8,11 @@
type consoletype_t;
type consoletype_exec_t;
+-application_executable_file(consoletype_exec_t)
-init_domain(consoletype_t,consoletype_exec_t)
-init_system_domain(consoletype_t,consoletype_exec_t)
+#dont transition from initrc
+#init_domain(consoletype_t,consoletype_exec_t)
-+domain_type(consoletype_t)
-+domain_entry_file(consoletype_t,consoletype_exec_t)
-+role system_r types consoletype_t;
++#init_system_domain(consoletype_t,consoletype_exec_t)
++application_domain(consoletype_t, consoletype_exec_t)
+
mls_file_read_up(consoletype_t)
mls_file_write_down(consoletype_t)
role system_r types consoletype_t;
-
-+ifdef(`targeted_policy',`',`
-+ init_system_domain(consoletype_t,consoletype_exec_t)
-+')
-+application_executable_file(consoletype_exec_t)
-+
- ########################################
- #
- # Local declarations
-@@ -46,7 +55,7 @@
+@@ -47,7 +49,7 @@
init_use_fds(consoletype_t)
init_use_script_ptys(consoletype_t)
init_use_script_fds(consoletype_t)
@@ -399,7 +381,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console
domain_use_interactive_fds(consoletype_t)
-@@ -86,6 +95,10 @@
+@@ -87,6 +89,10 @@
')
optional_policy(`
@@ -410,9 +392,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console
logrotate_dontaudit_use_fds(consoletype_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.0.3/policy/modules/admin/kudzu.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.0.4/policy/modules/admin/kudzu.te
--- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/kudzu.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/kudzu.te 2007-07-25 13:27:51.000000000 -0400
@@ -21,8 +21,8 @@
# Local policy
#
@@ -449,9 +431,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t
ifdef(`TODO',`
allow kudzu_t modules_conf_t:file unlink;
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.0.3/policy/modules/admin/logrotate.te
---- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-06-19 16:23:35.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/logrotate.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.0.4/policy/modules/admin/logrotate.te
+--- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-07-25 10:37:43.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/logrotate.te 2007-07-25 13:27:51.000000000 -0400
@@ -75,11 +75,13 @@
mls_file_read_up(logrotate_t)
mls_file_write_down(logrotate_t)
@@ -490,10 +472,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota
slrnpull_manage_spool(logrotate_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.0.3/policy/modules/admin/logwatch.te
---- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/logwatch.te 2007-07-17 15:46:25.000000000 -0400
-@@ -30,7 +30,6 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.0.4/policy/modules/admin/logwatch.te
+--- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-07-25 10:37:43.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/logwatch.te 2007-07-25 13:27:51.000000000 -0400
+@@ -29,7 +29,6 @@
allow logwatch_t self:process signal;
allow logwatch_t self:fifo_file rw_file_perms;
allow logwatch_t self:unix_stream_socket create_stream_socket_perms;
@@ -501,7 +483,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc
manage_dirs_pattern(logwatch_t,logwatch_cache_t,logwatch_cache_t)
manage_files_pattern(logwatch_t,logwatch_cache_t,logwatch_cache_t)
-@@ -69,6 +68,9 @@
+@@ -68,6 +67,9 @@
fs_getattr_all_fs(logwatch_t)
fs_dontaudit_list_auto_mountpoints(logwatch_t)
@@ -511,7 +493,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc
term_dontaudit_getattr_pty_dirs(logwatch_t)
term_dontaudit_list_ptys(logwatch_t)
-@@ -97,6 +99,10 @@
+@@ -96,6 +98,10 @@
')
optional_policy(`
@@ -522,7 +504,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc
avahi_dontaudit_search_pid(logwatch_t)
')
-@@ -118,14 +124,6 @@
+@@ -117,14 +123,6 @@
')
optional_policy(`
@@ -537,15 +519,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc
ntp_domtrans(logwatch_t)
')
-@@ -135,4 +133,5 @@
+@@ -134,4 +132,5 @@
optional_policy(`
samba_read_log(logwatch_t)
+ samba_read_share_files(logwatch_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.0.3/policy/modules/admin/netutils.te
---- nsaserefpolicy/policy/modules/admin/netutils.te 2007-07-03 07:06:36.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/netutils.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.0.4/policy/modules/admin/netutils.te
+--- nsaserefpolicy/policy/modules/admin/netutils.te 2007-07-25 10:37:43.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/netutils.te 2007-07-25 13:27:51.000000000 -0400
@@ -29,6 +29,7 @@
type traceroute_t;
type traceroute_exec_t;
@@ -554,9 +536,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil
role system_r types traceroute_t;
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.if serefpolicy-3.0.3/policy/modules/admin/portage.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.if serefpolicy-3.0.4/policy/modules/admin/portage.if
--- nsaserefpolicy/policy/modules/admin/portage.if 2007-07-03 07:06:36.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/portage.if 2007-07-23 09:28:12.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/portage.if 2007-07-25 13:27:51.000000000 -0400
@@ -324,6 +324,7 @@
seutil_domtrans_setfiles($1)
# run semodule
@@ -565,9 +547,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage
portage_domtrans_gcc_config($1)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.0.3/policy/modules/admin/prelink.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.0.4/policy/modules/admin/prelink.te
--- nsaserefpolicy/policy/modules/admin/prelink.te 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/prelink.te 2007-07-24 08:59:27.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/prelink.te 2007-07-25 13:27:51.000000000 -0400
@@ -26,7 +26,7 @@
# Local policy
#
@@ -625,17 +607,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink
optional_policy(`
amanda_manage_lib(prelink_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.fc serefpolicy-3.0.3/policy/modules/admin/readahead.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.fc serefpolicy-3.0.4/policy/modules/admin/readahead.fc
--- nsaserefpolicy/policy/modules/admin/readahead.fc 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/readahead.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/readahead.fc 2007-07-25 13:27:51.000000000 -0400
@@ -2,3 +2,4 @@
# /usr
#
/usr/sbin/readahead -- gen_context(system_u:object_r:readahead_exec_t,s0)
+/etc/readahead.d(/.*)? gen_context(system_u:object_r:readahead_etc_rw_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.if serefpolicy-3.0.3/policy/modules/admin/readahead.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.if serefpolicy-3.0.4/policy/modules/admin/readahead.if
--- nsaserefpolicy/policy/modules/admin/readahead.if 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/readahead.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/readahead.if 2007-07-25 13:27:51.000000000 -0400
@@ -1 +1,20 @@
## <summary>Readahead, read files into page cache for improved performance</summary>
+
@@ -657,10 +639,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe
+ corecmd_search_bin($1)
+ domtrans_pattern($1,readahead_exec_t,readahead_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.0.3/policy/modules/admin/readahead.te
---- nsaserefpolicy/policy/modules/admin/readahead.te 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/readahead.te 2007-07-17 15:46:25.000000000 -0400
-@@ -13,14 +13,20 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.0.4/policy/modules/admin/readahead.te
+--- nsaserefpolicy/policy/modules/admin/readahead.te 2007-07-25 10:37:43.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/readahead.te 2007-07-25 13:27:51.000000000 -0400
+@@ -9,19 +9,24 @@
+ type readahead_t;
+ type readahead_exec_t;
+ init_daemon_domain(readahead_t,readahead_exec_t)
+-application_domain(readahead_t,readahead_exec_t)
+
type readahead_var_run_t;
files_pid_file(readahead_var_run_t)
@@ -682,7 +669,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe
manage_files_pattern(readahead_t,readahead_var_run_t,readahead_var_run_t)
files_pid_filetrans(readahead_t,readahead_var_run_t,file)
-@@ -36,7 +42,7 @@
+@@ -37,7 +42,7 @@
dev_dontaudit_read_all_blk_files(readahead_t)
dev_dontaudit_getattr_memory_dev(readahead_t)
dev_dontaudit_getattr_nvram_dev(readahead_t)
@@ -691,7 +678,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe
domain_use_interactive_fds(readahead_t)
-@@ -76,3 +82,7 @@
+@@ -77,3 +82,7 @@
optional_policy(`
seutil_sigchld_newrole(readahead_t)
')
@@ -699,9 +686,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe
+optional_policy(`
+ logging_dontaudit_search_audit_config(readahead_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.0.3/policy/modules/admin/rpm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.0.4/policy/modules/admin/rpm.fc
--- nsaserefpolicy/policy/modules/admin/rpm.fc 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/rpm.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/rpm.fc 2007-07-25 13:27:51.000000000 -0400
@@ -21,6 +21,9 @@
/usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -712,9 +699,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
')
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.3/policy/modules/admin/rpm.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.4/policy/modules/admin/rpm.if
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/rpm.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/rpm.if 2007-07-25 13:27:51.000000000 -0400
@@ -210,6 +210,24 @@
########################################
@@ -837,9 +824,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
+
+ dontaudit $1 rpm_tmp_t:file rw_file_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.3/policy/modules/admin/rpm.te
---- nsaserefpolicy/policy/modules/admin/rpm.te 2007-07-03 07:06:36.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/rpm.te 2007-07-20 17:08:28.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.4/policy/modules/admin/rpm.te
+--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-07-25 10:37:43.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/rpm.te 2007-07-25 13:27:51.000000000 -0400
@@ -9,6 +9,8 @@
type rpm_t;
type rpm_exec_t;
@@ -857,10 +844,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
userdom_use_all_users_fds(rpm_script_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.3/policy/modules/admin/sudo.if
---- nsaserefpolicy/policy/modules/admin/sudo.if 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/sudo.if 2007-07-17 15:46:25.000000000 -0400
-@@ -69,7 +69,6 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.4/policy/modules/admin/sudo.if
+--- nsaserefpolicy/policy/modules/admin/sudo.if 2007-07-25 10:37:43.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/sudo.if 2007-07-25 13:27:51.000000000 -0400
+@@ -68,7 +68,6 @@
allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms;
allow $1_sudo_t self:unix_dgram_socket sendto;
allow $1_sudo_t self:unix_stream_socket connectto;
@@ -868,7 +855,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
allow $1_sudo_t self:netlink_route_socket r_netlink_socket_perms;
# Enter this derived domain from the user domain
-@@ -77,6 +76,7 @@
+@@ -76,6 +75,7 @@
# By default, revert to the calling domain when a shell is executed.
corecmd_shell_domtrans($1_sudo_t,$2)
@@ -876,7 +863,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
allow $2 $1_sudo_t:fd use;
allow $2 $1_sudo_t:fifo_file rw_file_perms;
allow $2 $1_sudo_t:process sigchld;
-@@ -91,8 +91,10 @@
+@@ -90,8 +90,10 @@
fs_getattr_xattr_fs($1_sudo_t)
auth_domtrans_chk_passwd($1_sudo_t)
@@ -887,7 +874,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
corecmd_read_bin_symlinks($1_sudo_t)
corecmd_getattr_all_executables($1_sudo_t)
-@@ -113,6 +115,7 @@
+@@ -112,6 +114,7 @@
libs_use_ld_so($1_sudo_t)
libs_use_shared_libs($1_sudo_t)
@@ -895,7 +882,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
logging_send_syslog_msg($1_sudo_t)
miscfiles_read_localization($1_sudo_t)
-@@ -127,6 +130,10 @@
+@@ -126,6 +129,10 @@
userdom_dontaudit_search_all_users_home_content($1_sudo_t)
optional_policy(`
@@ -906,9 +893,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
nis_use_ypbind($1_sudo_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.3/policy/modules/admin/su.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.4/policy/modules/admin/su.if
--- nsaserefpolicy/policy/modules/admin/su.if 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/su.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/su.if 2007-07-25 13:27:51.000000000 -0400
@@ -41,12 +41,11 @@
allow $2 $1_su_t:process signal;
@@ -1001,9 +988,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s
ifdef(`TODO',`
allow $1_su_t $1_home_t:file manage_file_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.if serefpolicy-3.0.3/policy/modules/admin/tmpreaper.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.if serefpolicy-3.0.4/policy/modules/admin/tmpreaper.if
--- nsaserefpolicy/policy/modules/admin/tmpreaper.if 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/tmpreaper.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/tmpreaper.if 2007-07-25 13:27:51.000000000 -0400
@@ -2,6 +2,25 @@
########################################
@@ -1030,9 +1017,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreap
## Execute tmpreaper in the caller domain.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.0.3/policy/modules/admin/usermanage.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.0.4/policy/modules/admin/usermanage.if
--- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/usermanage.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/usermanage.if 2007-07-25 13:27:51.000000000 -0400
@@ -278,5 +278,5 @@
type crack_db_t;
')
@@ -1040,10 +1027,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
- allow $1 crack_db_t:file read_file_perms;
+ read_files_pattern($1,crack_db_t,crack_db_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.0.3/policy/modules/admin/usermanage.te
---- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/usermanage.te 2007-07-17 15:46:25.000000000 -0400
-@@ -99,6 +99,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.0.4/policy/modules/admin/usermanage.te
+--- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-07-25 10:37:43.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/usermanage.te 2007-07-25 13:27:51.000000000 -0400
+@@ -92,6 +92,7 @@
dev_read_urand(chfn_t)
auth_domtrans_chk_passwd(chfn_t)
@@ -1051,7 +1038,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
auth_dontaudit_read_shadow(chfn_t)
# allow checking if a shell is executable
-@@ -198,7 +199,6 @@
+@@ -191,7 +192,6 @@
allow groupadd_t self:unix_stream_socket create_stream_socket_perms;
allow groupadd_t self:unix_dgram_socket sendto;
allow groupadd_t self:unix_stream_socket connectto;
@@ -1059,7 +1046,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
fs_getattr_xattr_fs(groupadd_t)
fs_search_auto_mountpoints(groupadd_t)
-@@ -230,6 +230,7 @@
+@@ -223,6 +223,7 @@
# Execute /usr/bin/{passwd,chfn,chsh} and /usr/sbin/{useradd,vipw}.
corecmd_exec_bin(groupadd_t)
@@ -1067,7 +1054,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
logging_send_syslog_msg(groupadd_t)
miscfiles_read_localization(groupadd_t)
-@@ -252,8 +253,13 @@
+@@ -245,8 +246,13 @@
')
optional_policy(`
@@ -1081,7 +1068,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
')
########################################
-@@ -261,7 +267,7 @@
+@@ -254,7 +260,7 @@
# Passwd local policy
#
@@ -1090,7 +1077,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
allow passwd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow passwd_t self:process { setrlimit setfscreate };
allow passwd_t self:fd use;
-@@ -271,7 +277,6 @@
+@@ -264,7 +270,6 @@
allow passwd_t self:unix_stream_socket create_stream_socket_perms;
allow passwd_t self:unix_dgram_socket sendto;
allow passwd_t self:unix_stream_socket connectto;
@@ -1098,7 +1085,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
allow passwd_t self:shm create_shm_perms;
allow passwd_t self:sem create_sem_perms;
allow passwd_t self:msgq create_msgq_perms;
-@@ -323,6 +328,7 @@
+@@ -316,6 +321,7 @@
libs_use_ld_so(passwd_t)
libs_use_shared_libs(passwd_t)
@@ -1106,7 +1093,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
logging_send_syslog_msg(passwd_t)
miscfiles_read_localization(passwd_t)
-@@ -343,6 +349,7 @@
+@@ -336,6 +342,7 @@
optional_policy(`
nscd_socket_use(passwd_t)
@@ -1114,7 +1101,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
')
########################################
-@@ -433,6 +440,7 @@
+@@ -426,6 +433,7 @@
optional_policy(`
nscd_socket_use(sysadm_passwd_t)
@@ -1122,7 +1109,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
')
########################################
-@@ -440,7 +448,7 @@
+@@ -433,7 +441,7 @@
# Useradd local policy
#
@@ -1131,7 +1118,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
dontaudit useradd_t self:capability sys_tty_config;
allow useradd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow useradd_t self:process setfscreate;
-@@ -454,7 +462,6 @@
+@@ -447,7 +455,6 @@
allow useradd_t self:unix_stream_socket create_stream_socket_perms;
allow useradd_t self:unix_dgram_socket sendto;
allow useradd_t self:unix_stream_socket connectto;
@@ -1139,7 +1126,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
# for getting the number of groups
kernel_read_kernel_sysctls(useradd_t)
-@@ -499,6 +506,7 @@
+@@ -492,6 +499,7 @@
libs_use_ld_so(useradd_t)
libs_use_shared_libs(useradd_t)
@@ -1147,7 +1134,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
logging_send_syslog_msg(useradd_t)
miscfiles_read_localization(useradd_t)
-@@ -508,6 +516,9 @@
+@@ -501,6 +509,9 @@
seutil_read_default_contexts(useradd_t)
seutil_domtrans_semanage(useradd_t)
seutil_domtrans_setfiles(useradd_t)
@@ -1157,7 +1144,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
userdom_use_unpriv_users_fds(useradd_t)
# for when /root is the cwd
-@@ -521,11 +532,26 @@
+@@ -514,11 +525,26 @@
mta_manage_spool(useradd_t)
optional_policy(`
@@ -1184,18 +1171,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
rpm_rw_pipes(useradd_t)
+ rpm_dontaudit_rw_tmp_files(useradd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.0.3/policy/modules/admin/vbetool.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.0.4/policy/modules/admin/vbetool.te
--- nsaserefpolicy/policy/modules/admin/vbetool.te 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/admin/vbetool.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/vbetool.te 2007-07-25 13:27:51.000000000 -0400
@@ -32,4 +32,5 @@
optional_policy(`
hal_rw_pid_files(vbetool_t)
+ hal_write_log(vbetool_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if serefpolicy-3.0.3/policy/modules/apps/ada.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if serefpolicy-3.0.4/policy/modules/apps/ada.if
--- nsaserefpolicy/policy/modules/apps/ada.if 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/ada.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/ada.if 2007-07-25 13:27:51.000000000 -0400
@@ -18,3 +18,34 @@
corecmd_search_bin($1)
domtrans_pattern($1, ada_exec_t, ada_t)
@@ -1231,9 +1218,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if s
+ role $2 types ada_t;
+ allow ada_t $3:chr_file rw_term_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc serefpolicy-3.0.3/policy/modules/apps/games.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc serefpolicy-3.0.4/policy/modules/apps/games.fc
--- nsaserefpolicy/policy/modules/apps/games.fc 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/games.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/games.fc 2007-07-25 13:27:51.000000000 -0400
@@ -1,22 +1,16 @@
#
# /usr
@@ -1260,9 +1247,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc
/usr/bin/micq -- gen_context(system_u:object_r:games_exec_t,s0)
/usr/bin/blackjack -- gen_context(system_u:object_r:games_exec_t,s0)
/usr/bin/gataxx -- gen_context(system_u:object_r:games_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.0.3/policy/modules/apps/gnome.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.0.4/policy/modules/apps/gnome.fc
--- nsaserefpolicy/policy/modules/apps/gnome.fc 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/gnome.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/gnome.fc 2007-07-25 13:27:51.000000000 -0400
@@ -1,8 +1,7 @@
+HOME_DIR/.gnome2(/.*)? gen_context(system_u:object_r:ROLE_gnome_home_t,s0)
HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:ROLE_gnome_home_t,s0)
@@ -1273,9 +1260,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc
/tmp/gconfd-USER/.* -- gen_context(system_u:object_r:ROLE_gconf_tmp_t,s0)
/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.0.3/policy/modules/apps/gnome.if
---- nsaserefpolicy/policy/modules/apps/gnome.if 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/gnome.if 2007-07-23 14:19:32.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.0.4/policy/modules/apps/gnome.if
+--- nsaserefpolicy/policy/modules/apps/gnome.if 2007-07-25 10:37:37.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/gnome.if 2007-07-25 13:27:51.000000000 -0400
@@ -33,6 +33,51 @@
## </param>
#
@@ -1328,7 +1315,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
gen_require(`
type gconfd_exec_t;
attribute gnomedomain;
-@@ -51,9 +96,6 @@
+@@ -50,9 +95,6 @@
type $1_gconf_home_t;
userdom_user_home_content($1, $1_gconf_home_t)
@@ -1338,7 +1325,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
type $1_gconf_tmp_t;
files_tmp_file($1_gconf_tmp_t)
-@@ -78,9 +120,6 @@
+@@ -77,9 +119,6 @@
allow $1_gconfd_t $2:fifo_file write;
allow $1_gconfd_t $2:unix_stream_socket connectto;
@@ -1348,7 +1335,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
ps_process_pattern($2,$1_gconfd_t)
dev_read_urand($1_gconfd_t)
-@@ -101,9 +140,18 @@
+@@ -100,9 +139,18 @@
gnome_stream_connect_gconf_template($1,$2)
optional_policy(`
@@ -1367,7 +1354,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
optional_policy(`
xserver_use_xdm_fds($1_gconfd_t)
xserver_rw_xdm_pipes($1_gconfd_t)
-@@ -136,13 +184,32 @@
+@@ -135,13 +183,32 @@
allow $2 $1_gconfd_t:unix_stream_socket connectto;
')
@@ -1401,7 +1388,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
## </p>
## <p>
## This is a templated interface, and should only
-@@ -171,6 +238,30 @@
+@@ -170,6 +237,30 @@
########################################
## <summary>
@@ -1432,7 +1419,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
## manage gnome homedir content (.config)
## </summary>
## <param name="userdomain_prefix">
-@@ -190,6 +281,26 @@
+@@ -189,6 +280,26 @@
type $1_gnome_home_t;
')
@@ -1461,9 +1448,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
+ can_exec($1, gconfd_exec_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.0.3/policy/modules/apps/gnome.te
---- nsaserefpolicy/policy/modules/apps/gnome.te 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/gnome.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.0.4/policy/modules/apps/gnome.te
+--- nsaserefpolicy/policy/modules/apps/gnome.te 2007-07-25 10:37:37.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/gnome.te 2007-07-25 13:27:51.000000000 -0400
@@ -8,8 +8,5 @@
attribute gnomedomain;
@@ -1472,10 +1459,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te
-files_type(gconf_etc_t)
-
type gconfd_exec_t;
- corecmd_executable_file(gconfd_exec_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.3/policy/modules/apps/java.if
---- nsaserefpolicy/policy/modules/apps/java.if 2007-07-03 07:05:43.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/java.if 2007-07-23 16:11:58.000000000 -0400
+ application_executable_file(gconfd_exec_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.4/policy/modules/apps/java.if
+--- nsaserefpolicy/policy/modules/apps/java.if 2007-07-25 10:37:37.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/java.if 2007-07-25 13:27:51.000000000 -0400
@@ -32,7 +32,7 @@
## </summary>
## </param>
@@ -1485,7 +1472,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
gen_require(`
type java_exec_t;
')
-@@ -82,8 +82,7 @@
+@@ -81,8 +81,7 @@
can_exec($1_javaplugin_t, java_exec_t)
@@ -1495,7 +1482,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
allow $1_javaplugin_t $2:fd use;
# Unrestricted inheritance from the caller.
allow $2 $1_javaplugin_t:process { noatsecure siginh rlimitinh };
-@@ -168,6 +167,53 @@
+@@ -167,6 +166,53 @@
optional_policy(`
xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
')
@@ -1549,7 +1536,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
')
########################################
-@@ -221,3 +267,66 @@
+@@ -220,3 +266,66 @@
corecmd_search_bin($1)
domtrans_pattern($1, java_exec_t, java_t)
')
@@ -1616,9 +1603,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
+ role $2 types java_t;
+ allow java_t $3:chr_file rw_term_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.0.3/policy/modules/apps/java.te
---- nsaserefpolicy/policy/modules/apps/java.te 2007-07-03 07:05:43.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/java.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.0.4/policy/modules/apps/java.te
+--- nsaserefpolicy/policy/modules/apps/java.te 2007-07-25 10:37:37.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/java.te 2007-07-25 13:27:51.000000000 -0400
@@ -31,3 +31,7 @@
unconfined_domain_noaudit(java_t)
unconfined_dbus_chat(java_t)
@@ -1627,9 +1614,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te
+optional_policy(`
+ xserver_xdm_rw_shm(java_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.0.3/policy/modules/apps/loadkeys.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.0.4/policy/modules/apps/loadkeys.te
--- nsaserefpolicy/policy/modules/apps/loadkeys.te 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/loadkeys.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/loadkeys.te 2007-07-25 13:27:51.000000000 -0400
@@ -40,3 +40,8 @@
locallogin_use_fds(loadkeys_t)
@@ -1639,9 +1626,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys
+ nscd_dontaudit_search_pid(loadkeys_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.0.3/policy/modules/apps/mono.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.0.4/policy/modules/apps/mono.if
--- nsaserefpolicy/policy/modules/apps/mono.if 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/mono.if 2007-07-23 16:14:31.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/mono.if 2007-07-25 13:27:51.000000000 -0400
@@ -18,3 +18,98 @@
corecmd_search_bin($1)
domtrans_pattern($1, mono_exec_t, mono_t)
@@ -1741,9 +1728,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if
+ xserver_xdm_rw_shm($1_mono_t)
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.0.3/policy/modules/apps/mono.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.0.4/policy/modules/apps/mono.te
--- nsaserefpolicy/policy/modules/apps/mono.te 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/mono.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/mono.te 2007-07-25 13:27:51.000000000 -0400
@@ -46,3 +46,7 @@
unconfined_dbus_chat(mono_t)
unconfined_dbus_connect(mono_t)
@@ -1752,9 +1739,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te
+optional_policy(`
+ xserver_xdm_rw_shm(mono_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.3/policy/modules/apps/mozilla.if
---- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-07-03 07:05:43.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/mozilla.if 2007-07-24 15:39:13.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.4/policy/modules/apps/mozilla.if
+--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-07-25 10:37:37.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/mozilla.if 2007-07-25 13:27:51.000000000 -0400
@@ -36,6 +36,8 @@
gen_require(`
type mozilla_conf_t, mozilla_exec_t;
@@ -1764,7 +1751,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
########################################
#
-@@ -53,6 +55,14 @@
+@@ -52,6 +54,14 @@
type $1_mozilla_tmpfs_t;
files_tmpfs_file($1_mozilla_tmpfs_t)
@@ -1779,7 +1766,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
########################################
#
# Local policy
-@@ -97,15 +107,37 @@
+@@ -96,15 +106,37 @@
relabel_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
relabel_lnk_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
@@ -1824,7 +1811,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
# Unrestricted inheritance from the caller.
allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh };
-@@ -116,8 +148,9 @@
+@@ -115,8 +147,9 @@
kernel_read_kernel_sysctls($1_mozilla_t)
kernel_read_network_state($1_mozilla_t)
# Access /proc, sysctl
@@ -1836,7 +1823,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
# Look for plugins
corecmd_list_bin($1_mozilla_t)
-@@ -166,11 +199,20 @@
+@@ -165,11 +198,20 @@
files_read_var_files($1_mozilla_t)
files_read_var_symlinks($1_mozilla_t)
files_dontaudit_getattr_boot_dirs($1_mozilla_t)
@@ -1857,7 +1844,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
term_dontaudit_getattr_pty_dirs($1_mozilla_t)
libs_use_ld_so($1_mozilla_t)
-@@ -186,16 +228,14 @@
+@@ -185,16 +227,14 @@
sysnet_dns_name_resolve($1_mozilla_t)
sysnet_read_config($1_mozilla_t)
@@ -1878,7 +1865,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
tunable_policy(`allow_execmem',`
allow $1_mozilla_t self:process { execmem execstack };
-@@ -213,131 +253,8 @@
+@@ -212,131 +252,8 @@
fs_manage_cifs_symlinks($1_mozilla_t)
')
@@ -2012,7 +1999,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
')
optional_policy(`
-@@ -352,21 +269,28 @@
+@@ -351,21 +268,28 @@
optional_policy(`
cups_read_rw_config($1_mozilla_t)
cups_dbus_chat($1_mozilla_t)
@@ -2044,7 +2031,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
')
optional_policy(`
-@@ -386,25 +310,6 @@
+@@ -385,25 +309,6 @@
thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t)
')
@@ -2070,7 +2057,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
')
########################################
-@@ -577,3 +482,27 @@
+@@ -576,3 +481,27 @@
allow $2 $1_mozilla_t:tcp_socket rw_socket_perms;
')
@@ -2098,9 +2085,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
+
+ allow $2 $1_mozilla_t:unix_stream_socket connectto;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.0.3/policy/modules/apps/mozilla.te
---- nsaserefpolicy/policy/modules/apps/mozilla.te 2007-07-03 07:05:43.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/mozilla.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.0.4/policy/modules/apps/mozilla.te
+--- nsaserefpolicy/policy/modules/apps/mozilla.te 2007-07-25 10:37:37.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/mozilla.te 2007-07-25 13:27:51.000000000 -0400
@@ -6,13 +6,6 @@
# Declarations
#
@@ -2115,9 +2102,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
type mozilla_conf_t;
files_config_file(mozilla_conf_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.0.3/policy/modules/apps/slocate.te
---- nsaserefpolicy/policy/modules/apps/slocate.te 2007-06-15 14:54:31.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/slocate.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.0.4/policy/modules/apps/slocate.te
+--- nsaserefpolicy/policy/modules/apps/slocate.te 2007-07-25 10:37:37.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/slocate.te 2007-07-25 13:27:51.000000000 -0400
@@ -29,6 +29,8 @@
manage_dirs_pattern(locate_t,locate_var_lib_t,locate_var_lib_t)
manage_files_pattern(locate_t,locate_var_lib_t,locate_var_lib_t)
@@ -2127,10 +2114,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.
kernel_read_system_state(locate_t)
kernel_dontaudit_search_sysctl(locate_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.0.3/policy/modules/apps/userhelper.if
---- nsaserefpolicy/policy/modules/apps/userhelper.if 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/userhelper.if 2007-07-17 15:46:25.000000000 -0400
-@@ -131,6 +131,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.0.4/policy/modules/apps/userhelper.if
+--- nsaserefpolicy/policy/modules/apps/userhelper.if 2007-07-25 10:37:37.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/userhelper.if 2007-07-25 13:27:51.000000000 -0400
+@@ -130,6 +130,7 @@
term_use_all_user_ptys($1_userhelper_t)
auth_domtrans_chk_passwd($1_userhelper_t)
@@ -2138,9 +2125,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp
auth_manage_pam_pid($1_userhelper_t)
auth_manage_var_auth($1_userhelper_t)
auth_search_pam_console_data($1_userhelper_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.3/policy/modules/apps/vmware.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.4/policy/modules/apps/vmware.fc
--- nsaserefpolicy/policy/modules/apps/vmware.fc 2007-07-03 07:05:43.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/vmware.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/vmware.fc 2007-07-25 13:27:51.000000000 -0400
@@ -23,6 +23,7 @@
/usr/bin/vmware-smbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
/usr/bin/vmware-smbpasswd -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
@@ -2149,9 +2136,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.f
/usr/bin/vmware-wizard -- gen_context(system_u:object_r:vmware_exec_t,s0)
/usr/bin/vmware -- gen_context(system_u:object_r:vmware_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.0.3/policy/modules/apps/vmware.te
---- nsaserefpolicy/policy/modules/apps/vmware.te 2007-07-03 07:05:43.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/vmware.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.0.4/policy/modules/apps/vmware.te
+--- nsaserefpolicy/policy/modules/apps/vmware.te 2007-07-25 10:37:37.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/vmware.te 2007-07-25 13:27:51.000000000 -0400
@@ -29,7 +29,7 @@
allow vmware_host_t self:capability { setuid net_raw };
@@ -2170,9 +2157,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.t
corenet_tcp_connect_all_ports(vmware_host_t)
corenet_sendrecv_all_client_packets(vmware_host_t)
corenet_sendrecv_all_server_packets(vmware_host_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.3/policy/modules/apps/wine.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.4/policy/modules/apps/wine.if
--- nsaserefpolicy/policy/modules/apps/wine.if 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/apps/wine.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/apps/wine.if 2007-07-25 13:27:51.000000000 -0400
@@ -18,3 +18,34 @@
corecmd_search_bin($1)
domtrans_pattern($1, wine_exec_t, wine_t)
@@ -2208,9 +2195,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if
+ role $2 types wine_t;
+ allow wine_t $3:chr_file rw_term_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.3/policy/modules/kernel/corecommands.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.4/policy/modules/kernel/corecommands.fc
--- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-07-03 07:05:38.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/corecommands.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/corecommands.fc 2007-07-25 13:27:51.000000000 -0400
@@ -36,6 +36,11 @@
/etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0)
/etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0)
@@ -2231,9 +2218,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
/usr/share/system-config-rootpassword/system-config-rootpassword -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/system-config-samba/system-config-samba\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/system-config-securitylevel/system-config-securitylevel\.py -- gen_context(system_u:object_r:bin_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.0.3/policy/modules/kernel/corenetwork.te.in
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.0.4/policy/modules/kernel/corenetwork.te.in
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-07-03 07:05:38.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/corenetwork.te.in 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/corenetwork.te.in 2007-07-25 13:27:51.000000000 -0400
@@ -55,6 +55,11 @@
type reserved_port_t, port_type, reserved_port_type;
@@ -2292,9 +2279,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
portcon tcp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0)
portcon udp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.0.3/policy/modules/kernel/devices.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.0.4/policy/modules/kernel/devices.fc
--- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-06-15 14:54:30.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/devices.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/devices.fc 2007-07-25 13:27:51.000000000 -0400
@@ -53,7 +53,7 @@
/dev/radio.* -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/random -c gen_context(system_u:object_r:random_device_t,s0)
@@ -2320,9 +2307,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
+/etc/udev/devices -d gen_context(system_u:object_r:device_t,s0)
+/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.0.3/policy/modules/kernel/devices.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.0.4/policy/modules/kernel/devices.if
--- nsaserefpolicy/policy/modules/kernel/devices.if 2007-06-15 14:54:30.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/devices.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/devices.if 2007-07-25 13:27:51.000000000 -0400
@@ -2803,6 +2803,24 @@
########################################
@@ -2348,9 +2335,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
## Do not audit attempts to get the attributes
## of a directory in the usb filesystem.
## </summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.3/policy/modules/kernel/domain.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.4/policy/modules/kernel/domain.if
--- nsaserefpolicy/policy/modules/kernel/domain.if 2007-06-19 16:23:34.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/domain.if 2007-07-20 16:52:28.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/domain.if 2007-07-25 13:27:51.000000000 -0400
@@ -45,6 +45,11 @@
# start with basic domain
domain_base_type($1)
@@ -2392,9 +2379,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
+
+ allow $1 domain:association { sendto recvfrom };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.3/policy/modules/kernel/domain.te
---- nsaserefpolicy/policy/modules/kernel/domain.te 2007-06-19 16:23:34.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/domain.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.4/policy/modules/kernel/domain.te
+--- nsaserefpolicy/policy/modules/kernel/domain.te 2007-07-25 10:37:36.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/domain.te 2007-07-25 13:27:51.000000000 -0400
@@ -6,6 +6,29 @@
# Declarations
#
@@ -2451,9 +2438,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
+ ipsec_labeled(domain)
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.3/policy/modules/kernel/files.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.4/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2007-07-03 07:05:38.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/files.if 2007-07-24 13:47:36.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/files.if 2007-07-25 13:27:51.000000000 -0400
@@ -343,8 +343,7 @@
########################################
@@ -2633,9 +2620,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
+ allow $1 root_t:dir rw_dir_perms;
+ allow $1 root_t:file { create getattr write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.3/policy/modules/kernel/filesystem.te
---- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-07-03 07:05:38.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/filesystem.te 2007-07-24 13:44:42.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.4/policy/modules/kernel/filesystem.te
+--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-07-25 10:37:36.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/filesystem.te 2007-07-25 13:27:51.000000000 -0400
@@ -43,6 +43,12 @@
#
# Non-persistent/pseudo filesystems
@@ -2657,10 +2644,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
# Use a transition SID based on the allocating task SID and the
# filesystem SID to label inodes in the following filesystem types,
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.3/policy/modules/kernel/kernel.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.4/policy/modules/kernel/kernel.if
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-07-03 07:05:38.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/kernel.if 2007-07-24 13:50:13.000000000 -0400
-@@ -1848,6 +1848,27 @@
++++ serefpolicy-3.0.4/policy/modules/kernel/kernel.if 2007-07-25 14:26:57.000000000 -0400
+@@ -108,6 +108,24 @@
+
+ ########################################
+ ## <summary>
++## Set the process scheduler of kernel threads.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`kernel_setsched',`
++ gen_require(`
++ type kernel_t;
++ ')
++
++ allow $1 kernel_t:process setsched;
++')
++
++########################################
++## <summary>
+ ## Send a SIGCHLD signal to kernel threads.
+ ## </summary>
+ ## <param name="domain">
+@@ -1848,6 +1866,27 @@
########################################
## <summary>
@@ -2688,9 +2700,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
## Do not audit attempts to list unlabeled directories.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.0.3/policy/modules/kernel/kernel.te
---- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-07-17 14:52:26.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/kernel.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.0.4/policy/modules/kernel/kernel.te
+--- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-07-25 10:37:36.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/kernel.te 2007-07-25 13:27:51.000000000 -0400
@@ -26,9 +26,6 @@
role staff_r;
role user_r;
@@ -2709,9 +2721,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-3.0.3/policy/modules/kernel/mls.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-3.0.4/policy/modules/kernel/mls.if
--- nsaserefpolicy/policy/modules/kernel/mls.if 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/mls.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/mls.if 2007-07-25 13:27:51.000000000 -0400
@@ -154,6 +154,26 @@
########################################
## <summary>
@@ -2739,9 +2751,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if
## for writing to sockets at any level.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-3.0.3/policy/modules/kernel/mls.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-3.0.4/policy/modules/kernel/mls.te
--- nsaserefpolicy/policy/modules/kernel/mls.te 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/mls.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/mls.te 2007-07-25 13:27:51.000000000 -0400
@@ -18,6 +18,7 @@
attribute mlsnetreadtoclr;
attribute mlsnetwrite;
@@ -2759,9 +2771,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te
attribute mlstrustedobject;
attribute privrangetrans;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.0.3/policy/modules/kernel/selinux.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.0.4/policy/modules/kernel/selinux.if
--- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-07-03 07:05:38.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/selinux.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/selinux.if 2007-07-25 13:27:51.000000000 -0400
@@ -32,20 +32,21 @@
########################################
@@ -2830,9 +2842,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu
allow $1 security_t:dir list_dir_perms;
allow $1 security_t:file { getattr read };
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.0.3/policy/modules/kernel/storage.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.0.4/policy/modules/kernel/storage.fc
--- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-06-15 14:54:30.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/storage.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/storage.fc 2007-07-25 13:27:51.000000000 -0400
@@ -23,6 +23,7 @@
/dev/loop.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
/dev/lvm -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
@@ -2841,9 +2853,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag
/dev/mmcblk.* -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/nb[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
/dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.0.3/policy/modules/kernel/storage.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.0.4/policy/modules/kernel/storage.if
--- nsaserefpolicy/policy/modules/kernel/storage.if 2007-06-15 14:54:30.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/storage.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/storage.if 2007-07-25 13:27:51.000000000 -0400
@@ -100,6 +100,7 @@
dev_list_all_dev_nodes($1)
@@ -2860,9 +2872,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag
typeattribute $1 fixed_disk_raw_write;
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.0.3/policy/modules/kernel/terminal.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.0.4/policy/modules/kernel/terminal.fc
--- nsaserefpolicy/policy/modules/kernel/terminal.fc 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/terminal.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/terminal.fc 2007-07-25 13:27:51.000000000 -0400
@@ -8,6 +8,7 @@
/dev/dcbri[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/hvc.* -c gen_context(system_u:object_r:tty_device_t,s0)
@@ -2871,9 +2883,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
/dev/ircomm[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/ip2[^/]* -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/isdn.* -c gen_context(system_u:object_r:tty_device_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.0.3/policy/modules/kernel/terminal.te
---- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-06-15 14:54:30.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/kernel/terminal.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.0.4/policy/modules/kernel/terminal.te
+--- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-07-25 10:37:36.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/terminal.te 2007-07-25 13:27:51.000000000 -0400
@@ -28,9 +28,15 @@
type devpts_t;
files_mountpoint(devpts_t)
@@ -2901,9 +2913,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
#
# usbtty_device_t is the type of /dev/usr/tty*
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.0.3/policy/modules/services/amavis.te
---- nsaserefpolicy/policy/modules/services/amavis.te 2007-07-03 07:06:26.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/amavis.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.0.4/policy/modules/services/amavis.te
+--- nsaserefpolicy/policy/modules/services/amavis.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/amavis.te 2007-07-25 13:27:51.000000000 -0400
@@ -166,6 +166,7 @@
optional_policy(`
@@ -2912,9 +2924,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.3/policy/modules/services/apache.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.4/policy/modules/services/apache.fc
--- nsaserefpolicy/policy/modules/services/apache.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/apache.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/apache.fc 2007-07-25 13:27:51.000000000 -0400
@@ -16,7 +16,6 @@
/usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0)
@@ -2935,9 +2947,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+#viewvc file context
+/var/spool/viewvc(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t, s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.0.3/policy/modules/services/apache.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.0.4/policy/modules/services/apache.if
--- nsaserefpolicy/policy/modules/services/apache.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/apache.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/apache.if 2007-07-25 13:27:51.000000000 -0400
@@ -18,10 +18,6 @@
attribute httpd_script_exec_type;
type httpd_t, httpd_suexec_t, httpd_log_t;
@@ -3234,9 +3246,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+
+ dontaudit $1 httpd_bugzilla_script_t:unix_stream_socket { read write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.3/policy/modules/services/apache.te
---- nsaserefpolicy/policy/modules/services/apache.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/apache.te 2007-07-23 16:18:28.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.4/policy/modules/services/apache.te
+--- nsaserefpolicy/policy/modules/services/apache.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/apache.te 2007-07-26 10:06:52.000000000 -0400
@@ -30,6 +30,13 @@
## <desc>
@@ -3423,7 +3435,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_ssi_exec',`
corecmd_shell_domtrans(httpd_t,httpd_sys_script_t)
allow httpd_sys_script_t httpd_t:fd use;
-@@ -606,6 +692,10 @@
+@@ -430,6 +516,12 @@
+ ')
+
+ optional_policy(`
++ tunable_policy(`httpd_tty_comm',`
++ unconfined_use_terminals(httpd_t)
++ ')
++')
++
++optional_policy(`
+ calamaris_read_www_files(httpd_t)
+ ')
+
+@@ -512,10 +604,16 @@
+ tunable_policy(`httpd_tty_comm',`
+ # cjp: this is redundant:
+ term_use_controlling_term(httpd_helper_t)
+-
+ userdom_use_sysadm_terms(httpd_helper_t)
+ ')
+
++optional_policy(`
++ tunable_policy(`httpd_tty_comm',`
++ unconfined_use_terminals(httpd_helper_t)
++ ')
++')
++
++
+ ########################################
+ #
+ # Apache PHP script local policy
+@@ -606,6 +704,10 @@
miscfiles_read_localization(httpd_suexec_t)
@@ -3434,7 +3477,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_can_network_connect',`
allow httpd_suexec_t self:tcp_socket create_stream_socket_perms;
allow httpd_suexec_t self:udp_socket create_socket_perms;
-@@ -620,10 +710,13 @@
+@@ -620,10 +722,13 @@
corenet_udp_sendrecv_all_ports(httpd_suexec_t)
corenet_tcp_connect_all_ports(httpd_suexec_t)
corenet_sendrecv_all_client_packets(httpd_suexec_t)
@@ -3449,7 +3492,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_enable_cgi && httpd_unified',`
domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t)
')
-@@ -634,6 +727,12 @@
+@@ -634,6 +739,12 @@
fs_exec_nfs_files(httpd_suexec_t)
')
@@ -3462,7 +3505,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_suexec_t)
fs_read_cifs_symlinks(httpd_suexec_t)
-@@ -672,7 +771,8 @@
+@@ -672,7 +783,8 @@
dontaudit httpd_sys_script_t httpd_config_t:dir search;
@@ -3472,7 +3515,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t)
-@@ -686,15 +786,66 @@
+@@ -686,15 +798,66 @@
# Should we add a boolean?
apache_domtrans_rotatelogs(httpd_sys_script_t)
@@ -3540,7 +3583,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_sys_script_t)
fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -711,6 +862,19 @@
+@@ -711,6 +874,19 @@
########################################
#
@@ -3560,7 +3603,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
# httpd_rotatelogs local policy
#
-@@ -728,3 +892,26 @@
+@@ -728,3 +904,26 @@
logging_search_logs(httpd_rotatelogs_t)
miscfiles_read_localization(httpd_rotatelogs_t)
@@ -3587,10 +3630,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+ avahi_dbus_chat(httpd_t)
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-3.0.3/policy/modules/services/apcupsd.fc
---- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/apcupsd.fc 2007-07-17 15:46:25.000000000 -0400
-@@ -3,3 +3,8 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-3.0.4/policy/modules/services/apcupsd.fc
+--- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/apcupsd.fc 2007-07-25 13:27:51.000000000 -0400
+@@ -1,9 +1,10 @@
+-ifdef(`distro_debian',`
+-/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0)
+-')
+-
+ /usr/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0)
+
/var/log/apcupsd\.events.* -- gen_context(system_u:object_r:apcupsd_log_t,s0)
/var/run/apcupsd\.pid -- gen_context(system_u:object_r:apcupsd_var_run_t,s0)
@@ -3599,9 +3648,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
+/var/www/apcupsd/upsfstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
+/var/www/apcupsd/upsimage.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
+/var/www/apcupsd/upsstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.0.3/policy/modules/services/apcupsd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.0.4/policy/modules/services/apcupsd.if
--- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/apcupsd.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/apcupsd.if 2007-07-25 13:27:51.000000000 -0400
@@ -79,3 +79,25 @@
allow $1 apcupsd_log_t:dir list_dir_perms;
allow $1 apcupsd_log_t:file { getattr append };
@@ -3628,9 +3677,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
+ allow httpd_apcupsd_cgi_script_t $1:fifo_file rw_file_perms;
+ allow httpd_apcupsd_cgi_script_t $1:process sigchld;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.3/policy/modules/services/apcupsd.te
---- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/apcupsd.te 2007-07-18 08:57:22.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.4/policy/modules/services/apcupsd.te
+--- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/apcupsd.te 2007-07-25 13:27:51.000000000 -0400
@@ -16,6 +16,9 @@
type apcupsd_log_t;
logging_log_file(apcupsd_log_t)
@@ -3727,9 +3776,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
+corenet_udp_sendrecv_all_nodes(httpd_apcupsd_cgi_script_t)
+corenet_udp_sendrecv_all_ports(httpd_apcupsd_cgi_script_t)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.3/policy/modules/services/audioentropy.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.4/policy/modules/services/audioentropy.te
--- nsaserefpolicy/policy/modules/services/audioentropy.te 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/audioentropy.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/audioentropy.te 2007-07-25 13:27:51.000000000 -0400
@@ -18,7 +18,7 @@
# Local policy
#
@@ -3748,9 +3797,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audi
dev_read_sound(entropyd_t)
fs_getattr_all_fs(entropyd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.3/policy/modules/services/automount.te
---- nsaserefpolicy/policy/modules/services/automount.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/automount.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.4/policy/modules/services/automount.te
+--- nsaserefpolicy/policy/modules/services/automount.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/automount.te 2007-07-25 13:27:51.000000000 -0400
@@ -69,6 +69,7 @@
files_mounton_all_mountpoints(automount_t)
files_mount_all_file_type_fs(automount_t)
@@ -3778,9 +3827,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto
bind_search_cache(automount_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.0.3/policy/modules/services/avahi.te
---- nsaserefpolicy/policy/modules/services/avahi.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/avahi.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.0.4/policy/modules/services/avahi.te
+--- nsaserefpolicy/policy/modules/services/avahi.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/avahi.te 2007-07-25 13:27:51.000000000 -0400
@@ -57,6 +57,7 @@
fs_getattr_all_fs(avahi_t)
@@ -3789,9 +3838,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah
domain_use_interactive_fds(avahi_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.3/policy/modules/services/bind.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.4/policy/modules/services/bind.fc
--- nsaserefpolicy/policy/modules/services/bind.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/bind.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/bind.fc 2007-07-25 13:27:51.000000000 -0400
@@ -45,4 +45,6 @@
/var/named/chroot/var/named/slaves(/.*)? gen_context(system_u:object_r:named_cache_t,s0)
/var/named/chroot/var/named/data(/.*)? gen_context(system_u:object_r:named_cache_t,s0)
@@ -3799,9 +3848,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind
+/var/named/dynamic(/.*)? gen_context(system_u:object_r:named_cache_t,s0)
+/var/named/chroot/var/named/dynamic(/.*)? gen_context(system_u:object_r:named_cache_t,s0)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.3/policy/modules/services/bind.te
---- nsaserefpolicy/policy/modules/services/bind.te 2007-07-03 07:06:26.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/bind.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.4/policy/modules/services/bind.te
+--- nsaserefpolicy/policy/modules/services/bind.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/bind.te 2007-07-25 13:27:51.000000000 -0400
@@ -119,6 +119,11 @@
corenet_sendrecv_dns_client_packets(named_t)
corenet_sendrecv_rndc_server_packets(named_t)
@@ -3822,9 +3871,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind
corenet_sendrecv_rndc_client_packets(ndc_t)
fs_getattr_xattr_fs(ndc_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.0.3/policy/modules/services/bluetooth.te
---- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/bluetooth.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.0.4/policy/modules/services/bluetooth.te
+--- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/bluetooth.te 2007-07-25 13:27:51.000000000 -0400
@@ -134,6 +134,7 @@
dbus_system_bus_client_template(bluetooth,bluetooth_t)
dbus_connect_system_bus(bluetooth_t)
@@ -3884,9 +3933,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue
+optional_policy(`
+ xserver_stream_connect_xdm(bluetooth_helper_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.3/policy/modules/services/clamav.te
---- nsaserefpolicy/policy/modules/services/clamav.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/clamav.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.4/policy/modules/services/clamav.te
+--- nsaserefpolicy/policy/modules/services/clamav.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/clamav.te 2007-07-25 13:27:51.000000000 -0400
@@ -208,9 +208,12 @@
files_tmp_filetrans(clamscan_t,clamscan_tmp_t,{ file dir })
@@ -3909,9 +3958,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam
+optional_policy(`
+ mailscanner_manage_spool(clamscan_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.3/policy/modules/services/consolekit.te
---- nsaserefpolicy/policy/modules/services/consolekit.te 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/consolekit.te 2007-07-24 15:38:28.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.4/policy/modules/services/consolekit.te
+--- nsaserefpolicy/policy/modules/services/consolekit.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/consolekit.te 2007-07-25 13:27:51.000000000 -0400
@@ -10,7 +10,6 @@
type consolekit_exec_t;
init_daemon_domain(consolekit_t, consolekit_exec_t)
@@ -3970,9 +4019,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons
+ unconfined_ptrace(consolekit_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.3/policy/modules/services/courier.te
---- nsaserefpolicy/policy/modules/services/courier.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/courier.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.4/policy/modules/services/courier.te
+--- nsaserefpolicy/policy/modules/services/courier.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/courier.te 2007-07-25 13:27:51.000000000 -0400
@@ -58,6 +58,7 @@
files_getattr_tmp_dirs(courier_authdaemon_t)
@@ -3981,9 +4030,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cour
libs_read_lib_files(courier_authdaemon_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.3/policy/modules/services/cron.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.4/policy/modules/services/cron.fc
--- nsaserefpolicy/policy/modules/services/cron.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/cron.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/cron.fc 2007-07-25 13:27:51.000000000 -0400
@@ -17,6 +17,8 @@
/var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0)
/var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0)
@@ -3998,9 +4047,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
/var/spool/fcron/systab -- gen_context(system_u:object_r:system_cron_spool_t,s0)
/var/spool/fcron/new\.systab -- gen_context(system_u:object_r:system_cron_spool_t,s0)
+/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.3/policy/modules/services/cron.if
---- nsaserefpolicy/policy/modules/services/cron.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/cron.if 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.4/policy/modules/services/cron.if
+--- nsaserefpolicy/policy/modules/services/cron.if 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/cron.if 2007-07-25 13:27:51.000000000 -0400
@@ -35,6 +35,7 @@
#
template(`cron_per_role_template',`
@@ -4009,8 +4058,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
attribute cron_spool_type;
type crond_t, cron_spool_t, crontab_exec_t;
')
-@@ -54,9 +55,6 @@
- domain_entry_file($1_crontab_t,crontab_exec_t)
+@@ -53,9 +54,6 @@
+ application_domain($1_crontab_t,crontab_exec_t)
role $3 types $1_crontab_t;
- type $1_crontab_tmp_t;
@@ -4019,7 +4068,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
##############################
#
# $1_crond_t local policy
-@@ -67,6 +65,7 @@
+@@ -66,6 +64,7 @@
allow $1_crond_t self:fifo_file rw_fifo_file_perms;
allow $1_crond_t self:unix_stream_socket create_stream_socket_perms;
allow $1_crond_t self:unix_dgram_socket create_socket_perms;
@@ -4027,7 +4076,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
# The entrypoint interface is not used as this is not
# a regular entrypoint. Since crontab files are
-@@ -135,55 +134,38 @@
+@@ -134,55 +133,38 @@
miscfiles_read_localization($1_crond_t)
@@ -4091,7 +4140,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
##############################
#
-@@ -196,6 +178,7 @@
+@@ -195,6 +177,7 @@
# Transition from the user domain to the derived domain.
domtrans_pattern($2, crontab_exec_t, $1_crontab_t)
@@ -4099,7 +4148,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
# crontab shows up in user ps
ps_process_pattern($2,$1_crontab_t)
-@@ -206,9 +189,6 @@
+@@ -205,9 +188,6 @@
# Allow crond to read those crontabs in cron spool.
allow crond_t $1_cron_spool_t:file manage_file_perms;
@@ -4109,7 +4158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
# create files in /var/spool/cron
manage_files_pattern($1_crontab_t,cron_spool_t,$1_cron_spool_t)
filetrans_pattern($1_crontab_t,cron_spool_t,$1_cron_spool_t,file)
-@@ -244,10 +224,12 @@
+@@ -243,10 +223,12 @@
userdom_manage_user_tmp_dirs($1,$1_crontab_t)
userdom_manage_user_tmp_files($1,$1_crontab_t)
@@ -4122,7 +4171,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
tunable_policy(`fcron_crond',`
# fcron wants an instant update of a crontab change for the administrator
-@@ -439,6 +421,25 @@
+@@ -438,6 +420,25 @@
########################################
## <summary>
@@ -4148,9 +4197,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
## Read, and write cron daemon TCP sockets.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.3/policy/modules/services/cron.te
---- nsaserefpolicy/policy/modules/services/cron.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/cron.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.4/policy/modules/services/cron.te
+--- nsaserefpolicy/policy/modules/services/cron.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/cron.te 2007-07-25 14:02:38.000000000 -0400
@@ -50,6 +50,7 @@
type crond_tmp_t;
@@ -4208,7 +4257,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
# need auth_chkpwd to check for locked accounts.
auth_domtrans_chk_passwd(crond_t)
-+auth_domtrans_upd_passwd(crond_t)
++auth_domtrans_upd_passwd_chk(crond_t)
+auth_search_key(crond_t)
corecmd_exec_shell(crond_t)
@@ -4376,9 +4425,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
')
ifdef(`TODO',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.3/policy/modules/services/cups.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.4/policy/modules/services/cups.fc
--- nsaserefpolicy/policy/modules/services/cups.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/cups.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/cups.fc 2007-07-25 13:27:51.000000000 -0400
@@ -8,6 +8,7 @@
/etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
/etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
@@ -4392,9 +4441,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
/var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh)
+/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,mls_systemhigh)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.3/policy/modules/services/cups.te
---- nsaserefpolicy/policy/modules/services/cups.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/cups.te 2007-07-24 16:22:33.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.4/policy/modules/services/cups.te
+--- nsaserefpolicy/policy/modules/services/cups.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/cups.te 2007-07-25 14:08:39.000000000 -0400
@@ -81,12 +81,11 @@
# /usr/lib/cups/backend/serial needs sys_admin(?!)
allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config };
@@ -4432,7 +4481,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
term_search_ptys(cupsd_t)
auth_domtrans_chk_passwd(cupsd_t)
-+auth_domtrans_upd_passwd(cupsd_t)
++auth_domtrans_upd_passwd_chk(cupsd_t)
auth_dontaudit_read_pam_pid(cupsd_t)
# Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp
@@ -4556,9 +4605,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
optional_policy(`
seutil_sigchld_newrole(hplip_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.3/policy/modules/services/cvs.te
---- nsaserefpolicy/policy/modules/services/cvs.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/cvs.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.4/policy/modules/services/cvs.te
+--- nsaserefpolicy/policy/modules/services/cvs.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/cvs.te 2007-07-25 14:08:45.000000000 -0400
@@ -16,6 +16,7 @@
type cvs_t;
type cvs_exec_t;
@@ -4571,7 +4620,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.
fs_getattr_xattr_fs(cvs_t)
auth_domtrans_chk_passwd(cvs_t)
-+auth_domtrans_upd_passwd(cvs_t)
++auth_domtrans_upd_passwd_chk(cvs_t)
corecmd_exec_bin(cvs_t)
corecmd_exec_shell(cvs_t)
@@ -4583,9 +4632,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.
miscfiles_read_localization(cvs_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.3/policy/modules/services/dbus.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.4/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/dbus.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/dbus.if 2007-07-25 13:27:51.000000000 -0400
@@ -50,6 +50,12 @@
## </param>
#
@@ -4700,9 +4749,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.0.3/policy/modules/services/dhcp.te
---- nsaserefpolicy/policy/modules/services/dhcp.te 2007-07-03 07:06:26.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/dhcp.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.0.4/policy/modules/services/dhcp.te
+--- nsaserefpolicy/policy/modules/services/dhcp.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/dhcp.te 2007-07-25 13:27:51.000000000 -0400
@@ -114,6 +114,8 @@
dbus_system_bus_client_template(dhcpd,dhcpd_t)
dbus_connect_system_bus(dhcpd_t)
@@ -4712,9 +4761,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.3/policy/modules/services/dovecot.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.4/policy/modules/services/dovecot.fc
--- nsaserefpolicy/policy/modules/services/dovecot.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/dovecot.fc 2007-07-23 09:12:16.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/dovecot.fc 2007-07-25 13:27:51.000000000 -0400
@@ -17,16 +17,19 @@
ifdef(`distro_debian', `
@@ -4735,9 +4784,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
/var/lib/dovecot(/.*)? gen_context(system_u:object_r:dovecot_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.3/policy/modules/services/dovecot.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.4/policy/modules/services/dovecot.if
--- nsaserefpolicy/policy/modules/services/dovecot.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/dovecot.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/dovecot.if 2007-07-25 13:27:51.000000000 -0400
@@ -18,3 +18,43 @@
manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
@@ -4782,9 +4831,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
+ domtrans_pattern($1,dovecot_deliver_exec_t,dovecot_deliver_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.3/policy/modules/services/dovecot.te
---- nsaserefpolicy/policy/modules/services/dovecot.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/dovecot.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.4/policy/modules/services/dovecot.te
+--- nsaserefpolicy/policy/modules/services/dovecot.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/dovecot.te 2007-07-25 13:27:51.000000000 -0400
@@ -15,6 +15,12 @@
domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t)
role system_r types dovecot_auth_t;
@@ -4924,9 +4973,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
+optional_policy(`
+ mta_manage_spool(dovecot_deliver_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.3/policy/modules/services/ftp.te
---- nsaserefpolicy/policy/modules/services/ftp.te 2007-07-03 07:06:26.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/ftp.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.4/policy/modules/services/ftp.te
+--- nsaserefpolicy/policy/modules/services/ftp.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/ftp.te 2007-07-25 16:26:05.000000000 -0400
@@ -88,6 +88,7 @@
allow ftpd_t self:unix_stream_socket create_stream_socket_perms;
allow ftpd_t self:tcp_socket create_stream_socket_perms;
@@ -4939,7 +4988,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
auth_use_nsswitch(ftpd_t)
auth_domtrans_chk_passwd(ftpd_t)
-+auth_domtrans_upd_passwd(ftpd_t)
++auth_domtrans_upd_passwd_chk(ftpd_t)
# Append to /var/log/wtmp.
auth_append_login_records(ftpd_t)
#kerberized ftp requires the following
@@ -4968,9 +5017,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
')
tunable_policy(`ftp_home_dir && use_nfs_home_dirs',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.3/policy/modules/services/hal.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.4/policy/modules/services/hal.fc
--- nsaserefpolicy/policy/modules/services/hal.fc 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/hal.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/hal.fc 2007-07-25 13:27:51.000000000 -0400
@@ -8,9 +8,14 @@
/usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0)
@@ -4986,9 +5035,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
+
+/var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.0.3/policy/modules/services/hal.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.0.4/policy/modules/services/hal.if
--- nsaserefpolicy/policy/modules/services/hal.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/hal.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/hal.if 2007-07-25 13:27:51.000000000 -0400
@@ -208,3 +208,98 @@
files_search_pids($1)
allow $1 hald_var_run_t:file rw_file_perms;
@@ -5088,9 +5137,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
+ allow $1 hald_t:process ptrace;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.3/policy/modules/services/hal.te
---- nsaserefpolicy/policy/modules/services/hal.te 2007-07-03 07:06:26.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/hal.te 2007-07-20 15:18:42.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.4/policy/modules/services/hal.te
+--- nsaserefpolicy/policy/modules/services/hal.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/hal.te 2007-07-25 13:27:51.000000000 -0400
@@ -22,6 +22,12 @@
type hald_log_t;
files_type(hald_log_t)
@@ -5202,9 +5251,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
+miscfiles_read_localization(hald_keymap_t)
+
+dev_rw_input_dev(hald_keymap_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.3/policy/modules/services/inetd.te
---- nsaserefpolicy/policy/modules/services/inetd.te 2007-07-03 07:06:26.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/inetd.te 2007-07-20 09:21:48.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.4/policy/modules/services/inetd.te
+--- nsaserefpolicy/policy/modules/services/inetd.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/inetd.te 2007-07-25 13:27:51.000000000 -0400
@@ -80,16 +80,21 @@
corenet_udp_bind_comsat_port(inetd_t)
corenet_tcp_bind_dbskkd_port(inetd_t)
@@ -5274,9 +5323,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
unconfined_domain(inetd_child_t)
+ inetd_service_domain(inetd_child_t,bin_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.3/policy/modules/services/kerberos.te
---- nsaserefpolicy/policy/modules/services/kerberos.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/kerberos.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.4/policy/modules/services/kerberos.te
+--- nsaserefpolicy/policy/modules/services/kerberos.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/kerberos.te 2007-07-25 13:27:51.000000000 -0400
@@ -91,6 +91,7 @@
kernel_read_kernel_sysctls(kadmind_t)
kernel_list_proc(kadmind_t)
@@ -5311,10 +5360,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t)
userdom_dontaudit_search_sysadm_home_dirs(krb5kdc_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.3/policy/modules/services/lpd.if
---- nsaserefpolicy/policy/modules/services/lpd.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/lpd.if 2007-07-17 15:46:25.000000000 -0400
-@@ -395,3 +395,22 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.4/policy/modules/services/lpd.if
+--- nsaserefpolicy/policy/modules/services/lpd.if 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/lpd.if 2007-07-25 13:27:51.000000000 -0400
+@@ -394,3 +394,22 @@
domtrans_pattern($2, lpr_exec_t, $1_lpr_t)
')
@@ -5337,26 +5386,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.
+
+ can_exec($1,lpr_exec_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.3/policy/modules/services/mailman.te
---- nsaserefpolicy/policy/modules/services/mailman.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/mailman.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.4/policy/modules/services/mailman.te
+--- nsaserefpolicy/policy/modules/services/mailman.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/mailman.te 2007-07-25 14:09:02.000000000 -0400
@@ -96,6 +96,7 @@
kernel_read_proc_symlinks(mailman_queue_t)
auth_domtrans_chk_passwd(mailman_queue_t)
-+auth_domtrans_upd_passwd(mailman_queue_t)
++auth_domtrans_upd_passwd_chk(mailman_queue_t)
files_dontaudit_search_pids(mailman_queue_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.3/policy/modules/services/mailscanner.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.4/policy/modules/services/mailscanner.fc
--- nsaserefpolicy/policy/modules/services/mailscanner.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/services/mailscanner.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/mailscanner.fc 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,2 @@
+/var/spool/MailScanner(/.*)? gen_context(system_u:object_r:mailscanner_spool_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.3/policy/modules/services/mailscanner.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.4/policy/modules/services/mailscanner.if
--- nsaserefpolicy/policy/modules/services/mailscanner.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/services/mailscanner.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/mailscanner.if 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,59 @@
+## <summary>Anti-Virus and Anti-Spam Filter</summary>
+
@@ -5417,19 +5466,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail
+ files_search_spool($1)
+ manage_files_pattern($1,mailscanner_spool_t,mailscanner_spool_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.3/policy/modules/services/mailscanner.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.4/policy/modules/services/mailscanner.te
--- nsaserefpolicy/policy/modules/services/mailscanner.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/services/mailscanner.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/mailscanner.te 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,5 @@
+
+policy_module(mailscanner,1.0.0)
+
+type mailscanner_spool_t;
+files_type(mailscanner_spool_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.3/policy/modules/services/mta.if
---- nsaserefpolicy/policy/modules/services/mta.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/mta.if 2007-07-24 15:41:08.000000000 -0400
-@@ -393,6 +393,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.4/policy/modules/services/mta.if
+--- nsaserefpolicy/policy/modules/services/mta.if 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/mta.if 2007-07-25 13:27:51.000000000 -0400
+@@ -392,6 +392,7 @@
allow $1 mail_spool_t:dir list_dir_perms;
create_files_pattern($1,mail_spool_t,mail_spool_t)
read_files_pattern($1,mail_spool_t,mail_spool_t)
@@ -5437,18 +5486,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
create_lnk_files_pattern($1,mail_spool_t,mail_spool_t)
read_lnk_files_pattern($1,mail_spool_t,mail_spool_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.3/policy/modules/services/mta.te
---- nsaserefpolicy/policy/modules/services/mta.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/mta.te 2007-07-17 15:46:25.000000000 -0400
-@@ -27,6 +27,7 @@
-
- type sendmail_exec_t;
- files_type(sendmail_exec_t)
-+application_executable_file(sendmail_exec_t)
-
- mta_base_mail_template(system)
- role system_r types system_mail_t;
-@@ -52,15 +53,44 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.4/policy/modules/services/mta.te
+--- nsaserefpolicy/policy/modules/services/mta.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/mta.te 2007-07-25 13:27:51.000000000 -0400
+@@ -52,15 +52,44 @@
userdom_use_sysadm_terms(system_mail_t)
userdom_dontaudit_search_sysadm_home_dirs(system_mail_t)
@@ -5493,7 +5534,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
')
optional_policy(`
-@@ -73,6 +103,7 @@
+@@ -73,6 +102,7 @@
optional_policy(`
cron_read_system_job_tmp_files(system_mail_t)
@@ -5501,9 +5542,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
cron_dontaudit_write_pipes(system_mail_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.0.3/policy/modules/services/networkmanager.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.0.4/policy/modules/services/networkmanager.fc
--- nsaserefpolicy/policy/modules/services/networkmanager.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/networkmanager.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/networkmanager.fc 2007-07-25 13:27:51.000000000 -0400
@@ -1,5 +1,6 @@
/usr/(s)?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0)
@@ -5511,9 +5552,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
/var/run/NetworkManager\.pid -- gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
/var/run/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
/var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.3/policy/modules/services/networkmanager.te
---- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/networkmanager.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.4/policy/modules/services/networkmanager.te
+--- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/networkmanager.te 2007-07-25 13:27:51.000000000 -0400
@@ -41,6 +41,8 @@
kernel_read_kernel_sysctls(NetworkManager_t)
kernel_load_module(NetworkManager_t)
@@ -5551,9 +5592,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
# Read gnome-keyring
unconfined_read_home_content_files(NetworkManager_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.3/policy/modules/services/nis.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.4/policy/modules/services/nis.fc
--- nsaserefpolicy/policy/modules/services/nis.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/nis.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/nis.fc 2007-07-25 13:27:51.000000000 -0400
@@ -4,6 +4,7 @@
/sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0)
@@ -5562,9 +5603,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
/usr/sbin/rpc\.yppasswdd -- gen_context(system_u:object_r:yppasswdd_exec_t,s0)
/usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.3/policy/modules/services/nis.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.4/policy/modules/services/nis.if
--- nsaserefpolicy/policy/modules/services/nis.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/nis.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/nis.if 2007-07-25 13:27:51.000000000 -0400
@@ -49,8 +49,8 @@
corenet_udp_bind_all_nodes($1)
corenet_tcp_bind_generic_port($1)
@@ -5576,9 +5617,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
corenet_dontaudit_tcp_bind_all_ports($1)
corenet_dontaudit_udp_bind_all_ports($1)
corenet_tcp_connect_portmap_port($1)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.3/policy/modules/services/nis.te
---- nsaserefpolicy/policy/modules/services/nis.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/nis.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.4/policy/modules/services/nis.te
+--- nsaserefpolicy/policy/modules/services/nis.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/nis.te 2007-07-25 13:27:51.000000000 -0400
@@ -113,6 +113,14 @@
userdom_dontaudit_use_unpriv_user_fds(ypbind_t)
userdom_dontaudit_search_sysadm_home_dirs(ypbind_t)
@@ -5631,9 +5672,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)
corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t)
corenet_tcp_connect_all_ports(ypxfr_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.3/policy/modules/services/nscd.te
---- nsaserefpolicy/policy/modules/services/nscd.te 2007-07-03 07:06:26.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/nscd.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.4/policy/modules/services/nscd.te
+--- nsaserefpolicy/policy/modules/services/nscd.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/nscd.te 2007-07-25 13:27:51.000000000 -0400
@@ -28,14 +28,14 @@
# Local policy
#
@@ -5682,9 +5723,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd
+ samba_read_config(nscd_t)
+ samba_read_var_files(nscd_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.0.3/policy/modules/services/ntp.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.0.4/policy/modules/services/ntp.fc
--- nsaserefpolicy/policy/modules/services/ntp.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/ntp.fc 2007-07-23 13:11:18.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/ntp.fc 2007-07-25 13:27:51.000000000 -0400
@@ -17,3 +17,7 @@
/var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0)
@@ -5693,9 +5734,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
+/etc/ntp/crypto(/.*)? gen_context(system_u:object_r:ntpd_key_t,s0)
+/etc/ntp/keys -- gen_context(system_u:object_r:ntpd_key_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.3/policy/modules/services/ntp.te
---- nsaserefpolicy/policy/modules/services/ntp.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/ntp.te 2007-07-23 13:36:54.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.4/policy/modules/services/ntp.te
+--- nsaserefpolicy/policy/modules/services/ntp.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/ntp.te 2007-07-25 13:27:51.000000000 -0400
@@ -25,6 +25,9 @@
type ntpdate_exec_t;
init_system_domain(ntpd_t,ntpdate_exec_t)
@@ -5756,9 +5797,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
udev_read_db(ntpd_t)
')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-3.0.3/policy/modules/services/openvpn.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-3.0.4/policy/modules/services/openvpn.if
--- nsaserefpolicy/policy/modules/services/openvpn.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/openvpn.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/openvpn.if 2007-07-25 13:27:51.000000000 -0400
@@ -22,3 +22,71 @@
read_files_pattern($1,openvpn_etc_t,openvpn_etc_t)
read_lnk_files_pattern($1,openvpn_etc_t,openvpn_etc_t)
@@ -5831,9 +5872,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
+
+ allow $1 openvpn_t:process signal;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.3/policy/modules/services/openvpn.te
---- nsaserefpolicy/policy/modules/services/openvpn.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/openvpn.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.4/policy/modules/services/openvpn.te
+--- nsaserefpolicy/policy/modules/services/openvpn.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/openvpn.te 2007-07-25 13:27:51.000000000 -0400
@@ -6,6 +6,13 @@
# Declarations
#
@@ -5910,9 +5951,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
+ unconfined_use_terminals(openvpn_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.3/policy/modules/services/pegasus.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.4/policy/modules/services/pegasus.if
--- nsaserefpolicy/policy/modules/services/pegasus.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/pegasus.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/pegasus.if 2007-07-25 13:27:51.000000000 -0400
@@ -1 +1,19 @@
## <summary>The Open Group Pegasus CIM/WBEM Server.</summary>
+
@@ -5933,14 +5974,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
+
+ domtrans_pattern($1,pegasus_exec_t,pegasus_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.3/policy/modules/services/pegasus.te
---- nsaserefpolicy/policy/modules/services/pegasus.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/pegasus.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.4/policy/modules/services/pegasus.te
+--- nsaserefpolicy/policy/modules/services/pegasus.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/pegasus.te 2007-07-25 14:09:06.000000000 -0400
@@ -95,13 +95,13 @@
auth_use_nsswitch(pegasus_t)
auth_domtrans_chk_passwd(pegasus_t)
-+auth_domtrans_upd_passwd(pegasus_t)
++auth_domtrans_upd_passwd_chk(pegasus_t)
+auth_read_shadow(pegasus_t)
domain_use_interactive_fds(pegasus_t)
@@ -5975,20 +6016,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
rpm_exec(pegasus_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.3/policy/modules/services/portslave.te
---- nsaserefpolicy/policy/modules/services/portslave.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/portslave.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.4/policy/modules/services/portslave.te
+--- nsaserefpolicy/policy/modules/services/portslave.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/portslave.te 2007-07-25 14:09:10.000000000 -0400
@@ -85,6 +85,7 @@
auth_rw_login_records(portslave_t)
auth_domtrans_chk_passwd(portslave_t)
-+auth_domtrans_upd_passwd(portslave_t)
++auth_domtrans_upd_passwd_chk(portslave_t)
init_rw_utmp(portslave_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.3/policy/modules/services/postfix.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.4/policy/modules/services/postfix.fc
--- nsaserefpolicy/policy/modules/services/postfix.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/postfix.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/postfix.fc 2007-07-25 13:27:51.000000000 -0400
@@ -14,6 +14,7 @@
/usr/libexec/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
/usr/libexec/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
@@ -5997,9 +6038,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
', `
/usr/lib/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
/usr/lib/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.3/policy/modules/services/postfix.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.4/policy/modules/services/postfix.if
--- nsaserefpolicy/policy/modules/services/postfix.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/postfix.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/postfix.if 2007-07-25 13:27:51.000000000 -0400
@@ -41,6 +41,8 @@
allow postfix_$1_t self:unix_stream_socket connectto;
@@ -6113,10 +6154,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+ allow $1 postfix_private_t:dir list_dir_perms;
+ create_sock_files_pattern($1,postfix_private_t,postfix_private_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.3/policy/modules/services/postfix.te
---- nsaserefpolicy/policy/modules/services/postfix.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/postfix.te 2007-07-17 15:46:25.000000000 -0400
-@@ -84,6 +84,12 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.4/policy/modules/services/postfix.te
+--- nsaserefpolicy/policy/modules/services/postfix.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/postfix.te 2007-07-25 13:27:51.000000000 -0400
+@@ -83,6 +83,12 @@
type postfix_var_run_t;
files_pid_file(postfix_var_run_t)
@@ -6129,7 +6170,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
########################################
#
# Postfix master process local policy
-@@ -169,6 +175,11 @@
+@@ -168,6 +174,11 @@
mta_rw_aliases(postfix_master_t)
mta_read_sendmail_bin(postfix_master_t)
@@ -6141,7 +6182,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
optional_policy(`
cyrus_stream_connect(postfix_master_t)
-@@ -180,9 +191,17 @@
+@@ -179,9 +190,17 @@
')
optional_policy(`
@@ -6159,7 +6200,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
###########################################################
#
# Partially converted rules. THESE ARE ONLY TEMPORARY
-@@ -378,7 +397,7 @@
+@@ -377,7 +396,7 @@
# Postfix pipe local policy
#
@@ -6168,7 +6209,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
write_sock_files_pattern(postfix_pipe_t,postfix_private_t,postfix_private_t)
-@@ -387,6 +406,10 @@
+@@ -386,6 +405,10 @@
rw_files_pattern(postfix_pipe_t,postfix_spool_t,postfix_spool_t)
optional_policy(`
@@ -6179,7 +6220,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
procmail_domtrans(postfix_pipe_t)
')
-@@ -427,6 +450,11 @@
+@@ -426,6 +449,11 @@
cron_system_entry(postfix_postdrop_t, postfix_postdrop_exec_t)
')
@@ -6191,7 +6232,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
optional_policy(`
ppp_use_fds(postfix_postqueue_t)
ppp_sigchld(postfix_postqueue_t)
-@@ -506,8 +534,6 @@
+@@ -505,8 +533,6 @@
# Postfix smtp delivery local policy
#
@@ -6200,7 +6241,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
# connect to master process
stream_connect_pattern(postfix_smtp_t,{ postfix_private_t postfix_public_t },{ postfix_private_t postfix_public_t },postfix_master_t)
-@@ -515,6 +541,8 @@
+@@ -514,6 +540,8 @@
allow postfix_smtp_t postfix_spool_t:file rw_file_perms;
@@ -6209,7 +6250,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
optional_policy(`
cyrus_stream_connect(postfix_smtp_t)
')
-@@ -539,9 +567,45 @@
+@@ -538,9 +566,45 @@
mta_read_aliases(postfix_smtpd_t)
optional_policy(`
@@ -6255,18 +6296,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+# For reading spamassasin
+mta_read_config(postfix_virtual_t)
+mta_manage_spool(postfix_virtual_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.3/policy/modules/services/procmail.te
---- nsaserefpolicy/policy/modules/services/procmail.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/procmail.te 2007-07-17 15:46:25.000000000 -0400
-@@ -10,6 +10,7 @@
- type procmail_exec_t;
- domain_type(procmail_t)
- domain_entry_file(procmail_t,procmail_exec_t)
-+application_executable_file(procmail_exec_t)
- role system_r types procmail_t;
-
- type procmail_tmp_t;
-@@ -31,6 +32,8 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.4/policy/modules/services/procmail.te
+--- nsaserefpolicy/policy/modules/services/procmail.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/procmail.te 2007-07-25 13:27:51.000000000 -0400
+@@ -30,6 +30,8 @@
allow procmail_t procmail_tmp_t:file manage_file_perms;
files_tmp_filetrans(procmail_t, procmail_tmp_t, file)
@@ -6275,7 +6308,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc
kernel_read_system_state(procmail_t)
kernel_read_kernel_sysctls(procmail_t)
-@@ -109,6 +112,9 @@
+@@ -108,6 +110,9 @@
# for a bug in the postfix local program
postfix_dontaudit_rw_local_tcp_sockets(procmail_t)
postfix_dontaudit_use_fds(procmail_t)
@@ -6285,7 +6318,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc
')
optional_policy(`
-@@ -130,3 +136,7 @@
+@@ -129,3 +134,7 @@
spamassassin_exec_client(procmail_t)
spamassassin_read_lib_files(procmail_t)
')
@@ -6293,9 +6326,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc
+optional_policy(`
+ mailscanner_read_spool(procmail_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.3/policy/modules/services/pyzor.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.4/policy/modules/services/pyzor.if
--- nsaserefpolicy/policy/modules/services/pyzor.if 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/pyzor.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/pyzor.if 2007-07-25 13:27:51.000000000 -0400
@@ -25,16 +25,16 @@
#
template(`pyzor_per_role_template',`
@@ -6318,10 +6351,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.0.3/policy/modules/services/pyzor.te
---- nsaserefpolicy/policy/modules/services/pyzor.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/pyzor.te 2007-07-17 15:46:25.000000000 -0400
-@@ -71,6 +71,11 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.0.4/policy/modules/services/pyzor.te
+--- nsaserefpolicy/policy/modules/services/pyzor.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/pyzor.te 2007-07-25 13:27:51.000000000 -0400
+@@ -70,6 +70,11 @@
userdom_dontaudit_search_sysadm_home_dirs(pyzor_t)
@@ -6333,7 +6366,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
optional_policy(`
amavis_manage_lib_files(pyzor_t)
amavis_manage_spool_files(pyzor_t)
-@@ -134,6 +139,10 @@
+@@ -133,6 +138,10 @@
mta_manage_spool(pyzord_t)
@@ -6344,14 +6377,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
optional_policy(`
logging_send_syslog_msg(pyzord_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.3/policy/modules/services/radius.te
---- nsaserefpolicy/policy/modules/services/radius.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/radius.te 2007-07-23 10:49:33.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.4/policy/modules/services/radius.te
+--- nsaserefpolicy/policy/modules/services/radius.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/radius.te 2007-07-25 14:09:14.000000000 -0400
@@ -82,6 +82,7 @@
auth_read_shadow(radiusd_t)
auth_domtrans_chk_passwd(radiusd_t)
-+auth_domtrans_upd_passwd(radiusd_t)
++auth_domtrans_upd_passwd_chk(radiusd_t)
corecmd_exec_bin(radiusd_t)
corecmd_exec_shell(radiusd_t)
@@ -6363,9 +6396,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi
sysnet_read_config(radiusd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.3/policy/modules/services/rhgb.te
---- nsaserefpolicy/policy/modules/services/rhgb.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/rhgb.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.4/policy/modules/services/rhgb.te
+--- nsaserefpolicy/policy/modules/services/rhgb.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/rhgb.te 2007-07-25 13:27:51.000000000 -0400
@@ -109,6 +109,7 @@
userdom_dontaudit_use_unpriv_user_fds(rhgb_t)
@@ -6374,14 +6407,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb
xserver_read_xdm_xserver_tmp_files(rhgb_t)
xserver_kill_xdm_xserver(rhgb_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.3/policy/modules/services/ricci.te
---- nsaserefpolicy/policy/modules/services/ricci.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/ricci.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.4/policy/modules/services/ricci.te
+--- nsaserefpolicy/policy/modules/services/ricci.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/ricci.te 2007-07-25 14:09:18.000000000 -0400
@@ -138,6 +138,7 @@
files_create_boot_flag(ricci_t)
auth_domtrans_chk_passwd(ricci_t)
-+auth_domtrans_upd_passwd(ricci_t)
++auth_domtrans_upd_passwd_chk(ricci_t)
auth_append_login_records(ricci_t)
init_dontaudit_stream_connect_script(ricci_t)
@@ -6404,9 +6437,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc
optional_policy(`
nscd_dontaudit_search_pid(ricci_modlog_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.3/policy/modules/services/rlogin.te
---- nsaserefpolicy/policy/modules/services/rlogin.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/rlogin.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.4/policy/modules/services/rlogin.te
+--- nsaserefpolicy/policy/modules/services/rlogin.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/rlogin.te 2007-07-25 13:27:51.000000000 -0400
@@ -65,6 +65,7 @@
fs_search_auto_mountpoints(rlogind_t)
@@ -6415,9 +6448,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog
auth_rw_login_records(rlogind_t)
auth_use_nsswitch(rlogind_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.3/policy/modules/services/rpc.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.4/policy/modules/services/rpcbind.te
+--- nsaserefpolicy/policy/modules/services/rpcbind.te 2007-07-03 07:06:27.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/rpcbind.te 2007-07-25 14:28:29.000000000 -0400
+@@ -21,11 +21,13 @@
+ # rpcbind local policy
+ #
+
+-allow rpcbind_t self:capability setuid;
++allow rpcbind_t self:capability { setuid sys_tty_config };
+ allow rpcbind_t self:fifo_file rw_file_perms;
+ allow rpcbind_t self:unix_stream_socket create_stream_socket_perms;
+ allow rpcbind_t self:netlink_route_socket r_netlink_socket_perms;
+ allow rpcbind_t self:udp_socket create_socket_perms;
++# BROKEN ...
++dontaudit rpcbind_t self:udp_socket listen;
+ allow rpcbind_t self:tcp_socket create_stream_socket_perms;
+
+ manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.4/policy/modules/services/rpc.if
--- nsaserefpolicy/policy/modules/services/rpc.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/rpc.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/rpc.if 2007-07-25 13:27:51.000000000 -0400
@@ -81,6 +81,7 @@
corenet_tcp_bind_all_nodes($1_t)
corenet_udp_bind_all_nodes($1_t)
@@ -6439,9 +6490,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
fs_rw_rpc_named_pipes($1_t)
fs_search_auto_mountpoints($1_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.3/policy/modules/services/rpc.te
---- nsaserefpolicy/policy/modules/services/rpc.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/rpc.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.4/policy/modules/services/rpc.te
+--- nsaserefpolicy/policy/modules/services/rpc.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/rpc.te 2007-07-25 13:27:51.000000000 -0400
@@ -59,6 +59,8 @@
manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t)
files_pid_filetrans(rpcd_t,rpcd_var_run_t,file)
@@ -6506,14 +6557,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
tunable_policy(`allow_gssd_read_tmp',`
userdom_list_unpriv_users_tmp(gssd_t)
userdom_read_unpriv_users_tmp_files(gssd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.3/policy/modules/services/rshd.te
---- nsaserefpolicy/policy/modules/services/rshd.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/rshd.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.4/policy/modules/services/rshd.te
+--- nsaserefpolicy/policy/modules/services/rshd.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/rshd.te 2007-07-25 16:26:56.000000000 -0400
@@ -45,6 +45,7 @@
selinux_compute_user_contexts(rshd_t)
auth_domtrans_chk_passwd(rshd_t)
-+auth_domtrans_upd_passwd(rshd_t)
++auth_domtrans_upd_passwd_chk(rshd_t)
corecmd_read_bin_symlinks(rshd_t)
@@ -6524,9 +6575,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd
- unconfined_domain(rshd_t)
unconfined_shell_domtrans(rshd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.3/policy/modules/services/rsync.te
---- nsaserefpolicy/policy/modules/services/rsync.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/rsync.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.4/policy/modules/services/rsync.te
+--- nsaserefpolicy/policy/modules/services/rsync.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/rsync.te 2007-07-25 13:27:51.000000000 -0400
@@ -17,6 +17,7 @@
type rsync_t;
type rsync_exec_t;
@@ -6535,17 +6586,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn
role system_r types rsync_t;
type rsync_data_t;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-3.0.3/policy/modules/services/rwho.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-3.0.4/policy/modules/services/rwho.fc
--- nsaserefpolicy/policy/modules/services/rwho.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/rwho.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/rwho.fc 2007-07-25 13:27:51.000000000 -0400
@@ -1,3 +1,4 @@
/usr/sbin/rwhod -- gen_context(system_u:object_r:rwho_exec_t,s0)
/var/spool/rwho(/.*)? gen_context(system_u:object_r:rwho_spool_t,s0)
+/var/log/rwhod(/.*)? gen_context(system_u:object_r:rwho_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-3.0.3/policy/modules/services/rwho.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-3.0.4/policy/modules/services/rwho.if
--- nsaserefpolicy/policy/modules/services/rwho.if 2007-06-15 14:54:33.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/rwho.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/rwho.if 2007-07-25 13:27:51.000000000 -0400
@@ -72,6 +72,47 @@
type rwho_spool_t;
')
@@ -6595,9 +6646,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho
+ logging_search_logs($1)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-3.0.3/policy/modules/services/rwho.te
---- nsaserefpolicy/policy/modules/services/rwho.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/rwho.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-3.0.4/policy/modules/services/rwho.te
+--- nsaserefpolicy/policy/modules/services/rwho.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/rwho.te 2007-07-25 13:27:51.000000000 -0400
@@ -10,10 +10,12 @@
type rwho_exec_t;
init_daemon_domain(rwho_t, rwho_exec_t)
@@ -6623,9 +6674,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho
kernel_read_system_state(rwho_t)
corenet_all_recvfrom_unlabeled(rwho_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.3/policy/modules/services/samba.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.4/policy/modules/services/samba.fc
--- nsaserefpolicy/policy/modules/services/samba.fc 2007-06-19 16:23:34.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/samba.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/samba.fc 2007-07-25 13:27:51.000000000 -0400
@@ -30,6 +30,8 @@
/var/lib/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0)
/var/lib/samba/winbindd_privileged(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0)
@@ -6635,9 +6686,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
/var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0)
/var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.3/policy/modules/services/samba.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.4/policy/modules/services/samba.if
--- nsaserefpolicy/policy/modules/services/samba.if 2007-06-19 16:23:35.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/samba.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/samba.if 2007-07-25 13:27:51.000000000 -0400
@@ -349,6 +349,7 @@
files_search_var($1)
files_search_var_lib($1)
@@ -6699,9 +6750,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
+ read_files_pattern($1, samba_share_t, samba_share_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.3/policy/modules/services/samba.te
---- nsaserefpolicy/policy/modules/services/samba.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/samba.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.4/policy/modules/services/samba.te
+--- nsaserefpolicy/policy/modules/services/samba.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/samba.te 2007-07-25 16:27:22.000000000 -0400
@@ -190,6 +190,8 @@
miscfiles_read_localization(samba_net_t)
@@ -6830,9 +6881,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
seutil_sigchld_newrole(winbind_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.3/policy/modules/services/sasl.te
---- nsaserefpolicy/policy/modules/services/sasl.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/sasl.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.4/policy/modules/services/sasl.te
+--- nsaserefpolicy/policy/modules/services/sasl.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/sasl.te 2007-07-25 13:27:51.000000000 -0400
@@ -64,6 +64,7 @@
selinux_compute_access_vector(saslauthd_t)
@@ -6841,9 +6892,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl
auth_use_nsswitch(saslauthd_t)
domain_use_interactive_fds(saslauthd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.3/policy/modules/services/sendmail.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.4/policy/modules/services/sendmail.if
--- nsaserefpolicy/policy/modules/services/sendmail.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/sendmail.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/sendmail.if 2007-07-25 13:27:51.000000000 -0400
@@ -131,3 +131,21 @@
logging_log_filetrans($1,sendmail_log_t,file)
@@ -6866,9 +6917,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
+ allow $1 sendmail_t:process signal;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.0.3/policy/modules/services/setroubleshoot.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.0.4/policy/modules/services/setroubleshoot.if
--- nsaserefpolicy/policy/modules/services/setroubleshoot.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/setroubleshoot.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/setroubleshoot.if 2007-07-25 13:27:51.000000000 -0400
@@ -19,3 +19,22 @@
allow $1 setroubleshoot_var_run_t:sock_file write;
allow $1 setroubleshootd_t:unix_stream_socket connectto;
@@ -6892,9 +6943,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr
+ dontaudit $1 setroubleshoot_var_run_t:sock_file write;
+ dontaudit $1 setroubleshootd_t:unix_stream_socket connectto;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.3/policy/modules/services/setroubleshoot.te
---- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-07-03 07:06:26.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/setroubleshoot.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.4/policy/modules/services/setroubleshoot.te
+--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/setroubleshoot.te 2007-07-25 13:27:51.000000000 -0400
@@ -76,6 +76,9 @@
files_getattr_all_dirs(setroubleshootd_t)
files_getattr_all_files(setroubleshootd_t)
@@ -6905,9 +6956,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr
selinux_get_enforce_mode(setroubleshootd_t)
selinux_validate_context(setroubleshootd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.0.3/policy/modules/services/smartmon.te
---- nsaserefpolicy/policy/modules/services/smartmon.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/smartmon.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.0.4/policy/modules/services/smartmon.te
+--- nsaserefpolicy/policy/modules/services/smartmon.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/smartmon.te 2007-07-25 13:27:51.000000000 -0400
@@ -61,6 +61,7 @@
fs_search_auto_mountpoints(fsdaemon_t)
@@ -6916,9 +6967,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar
storage_raw_read_fixed_disk(fsdaemon_t)
storage_raw_write_fixed_disk(fsdaemon_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.0.3/policy/modules/services/snmp.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.0.4/policy/modules/services/snmp.fc
--- nsaserefpolicy/policy/modules/services/snmp.fc 2007-06-19 16:23:35.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/snmp.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/snmp.fc 2007-07-25 13:27:51.000000000 -0400
@@ -1,3 +1,10 @@
+
+#
@@ -6930,9 +6981,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp
#
# /usr
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.0.3/policy/modules/services/spamassassin.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.0.4/policy/modules/services/spamassassin.fc
--- nsaserefpolicy/policy/modules/services/spamassassin.fc 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/spamassassin.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/spamassassin.fc 2007-07-25 13:27:51.000000000 -0400
@@ -10,3 +10,9 @@
/var/lib/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_lib_t,s0)
@@ -6943,27 +6994,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
+/var/run/spamass-milter(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0)
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.0.3/policy/modules/services/spamassassin.te
---- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/spamassassin.te 2007-07-17 15:46:25.000000000 -0400
-@@ -22,7 +22,7 @@
-
- # spamassassin client executable
- type spamc_exec_t;
--corecmd_executable_file(spamc_exec_t)
-+application_executable_file(spamc_exec_t)
-
- type spamd_t;
- type spamd_exec_t;
-@@ -42,7 +42,7 @@
- files_pid_file(spamd_var_run_t)
-
- type spamassassin_exec_t;
--corecmd_executable_file(spamassassin_exec_t)
-+application_executable_file(spamassassin_exec_t)
-
- ########################################
- #
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.0.4/policy/modules/services/spamassassin.te
+--- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/spamassassin.te 2007-07-25 13:27:51.000000000 -0400
@@ -83,8 +83,9 @@
allow spamd_t spamd_var_lib_t:dir list_dir_perms;
read_files_pattern(spamd_t,spamd_var_lib_t,spamd_var_lib_t)
@@ -6975,18 +7008,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
kernel_read_all_sysctls(spamd_t)
kernel_read_system_state(spamd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.3/policy/modules/services/squid.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.4/policy/modules/services/squid.fc
--- nsaserefpolicy/policy/modules/services/squid.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/squid.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/squid.fc 2007-07-25 13:27:51.000000000 -0400
@@ -12,3 +12,5 @@
/var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0)
/var/spool/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0)
+/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
+/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.3/policy/modules/services/squid.te
---- nsaserefpolicy/policy/modules/services/squid.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/squid.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.4/policy/modules/services/squid.te
+--- nsaserefpolicy/policy/modules/services/squid.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/squid.te 2007-07-25 13:27:51.000000000 -0400
@@ -109,6 +109,8 @@
fs_getattr_all_fs(squid_t)
@@ -7013,10 +7046,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
+ corenet_all_recvfrom_unlabeled(httpd_squid_script_t)
+ corenet_all_recvfrom_netlabel(httpd_squid_script_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.3/policy/modules/services/ssh.if
---- nsaserefpolicy/policy/modules/services/ssh.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/ssh.if 2007-07-17 15:46:25.000000000 -0400
-@@ -203,6 +203,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.4/policy/modules/services/ssh.if
+--- nsaserefpolicy/policy/modules/services/ssh.if 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/ssh.if 2007-07-25 13:27:51.000000000 -0400
+@@ -202,6 +202,7 @@
#
template(`ssh_per_role_template',`
gen_require(`
@@ -7024,7 +7057,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
type ssh_agent_exec_t, ssh_keysign_exec_t;
')
-@@ -711,3 +712,42 @@
+@@ -708,3 +709,42 @@
dontaudit $1 sshd_key_t:file { getattr read };
')
@@ -7067,10 +7100,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
+ dontaudit $2 $1_ssh_agent_t:fd use;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.3/policy/modules/services/ssh.te
---- nsaserefpolicy/policy/modules/services/ssh.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/ssh.te 2007-07-17 15:46:25.000000000 -0400
-@@ -24,11 +24,11 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.4/policy/modules/services/ssh.te
+--- nsaserefpolicy/policy/modules/services/ssh.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/ssh.te 2007-07-25 13:27:51.000000000 -0400
+@@ -24,7 +24,7 @@
# Type for the ssh-agent executable.
type ssh_agent_exec_t;
@@ -7079,11 +7112,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
# ssh client executable.
type ssh_exec_t;
--corecmd_executable_file(ssh_exec_t)
-+application_executable_file(ssh_exec_t)
-
- type ssh_keygen_t;
- type ssh_keygen_exec_t;
@@ -100,6 +100,11 @@
userdom_use_unpriv_users_ptys(sshd_t)
')
@@ -7110,9 +7138,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
')
ifdef(`TODO',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.3/policy/modules/services/uwimap.te
---- nsaserefpolicy/policy/modules/services/uwimap.te 2007-07-03 07:06:26.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/uwimap.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.4/policy/modules/services/uwimap.te
+--- nsaserefpolicy/policy/modules/services/uwimap.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/uwimap.te 2007-07-25 13:27:51.000000000 -0400
@@ -64,6 +64,7 @@
fs_search_auto_mountpoints(imapd_t)
@@ -7121,20 +7149,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwim
libs_use_ld_so(imapd_t)
libs_use_shared_libs(imapd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.3/policy/modules/services/w3c.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.4/policy/modules/services/w3c.fc
--- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/services/w3c.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/w3c.fc 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,2 @@
+/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0)
+/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.3/policy/modules/services/w3c.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.4/policy/modules/services/w3c.if
--- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/services/w3c.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/w3c.if 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1 @@
+## <summary>W3C</summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.3/policy/modules/services/w3c.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.4/policy/modules/services/w3c.te
--- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/services/w3c.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/w3c.te 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,14 @@
+policy_module(w3c,1.2.1)
+
@@ -7150,9 +7178,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.
+corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t)
+
+miscfiles_read_certs(httpd_w3c_validator_script_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.3/policy/modules/services/xserver.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.4/policy/modules/services/xserver.fc
--- nsaserefpolicy/policy/modules/services/xserver.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/xserver.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/xserver.fc 2007-07-25 13:27:51.000000000 -0400
@@ -92,6 +92,7 @@
/var/log/XFree86.* -- gen_context(system_u:object_r:xserver_log_t,s0)
/var/log/Xorg.* -- gen_context(system_u:object_r:xserver_log_t,s0)
@@ -7161,9 +7189,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
/var/run/[gx]dm\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0)
/var/run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.3/policy/modules/services/xserver.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.4/policy/modules/services/xserver.if
--- nsaserefpolicy/policy/modules/services/xserver.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/xserver.if 2007-07-24 13:48:58.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/xserver.if 2007-07-25 13:27:51.000000000 -0400
@@ -353,12 +353,6 @@
# allow ps to show xauth
ps_process_pattern($2,$1_xauth_t)
@@ -7438,9 +7466,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
+
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.3/policy/modules/services/xserver.te
---- nsaserefpolicy/policy/modules/services/xserver.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/services/xserver.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.4/policy/modules/services/xserver.te
+--- nsaserefpolicy/policy/modules/services/xserver.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/xserver.te 2007-07-25 13:27:51.000000000 -0400
@@ -16,6 +16,13 @@
## <desc>
@@ -7592,80 +7620,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
-#
-allow pam_t xdm_t:fifo_file { getattr ioctl write };
-') dnl end TODO
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-3.0.3/policy/modules/system/application.fc
---- nsaserefpolicy/policy/modules/system/application.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/system/application.fc 2007-07-17 15:46:25.000000000 -0400
-@@ -0,0 +1 @@
-+# No application file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.3/policy/modules/system/application.if
---- nsaserefpolicy/policy/modules/system/application.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/system/application.if 2007-07-17 15:46:25.000000000 -0400
-@@ -0,0 +1,104 @@
-+## <summary>Policy for application domains</summary>
-+
-+########################################
-+## <summary>
-+## Make the specified type usable as an application domain.
-+## </summary>
-+## <param name="type">
-+## <summary>
-+## Type to be used as a domain type.
-+## </summary>
-+## </param>
-+#
-+interface(`application_type',`
-+ gen_require(`
-+ attribute application_domain_type;
-+ ')
-+
-+ typeattribute $1 application_domain_type;
-+
-+ # start with basic domain
-+ domain_type($1)
-+')
-+
-+########################################
-+## <summary>
-+## Make the specified type usable for files
-+## that are exectuables, such as binary programs.
-+## This does not include shared libraries.
-+## </summary>
-+## <param name="type">
-+## <summary>
-+## Type to be used for files.
-+## </summary>
-+## </param>
-+#
-+interface(`application_executable_file',`
-+ gen_require(`
-+ attribute application_exec_type;
-+ ')
-+
-+ typeattribute $1 application_exec_type;
-+
-+ corecmd_executable_file($1)
-+')
-+
-+########################################
-+## <summary>
-+## Execute application executables in the caller domain.
-+## </summary>
-+## <param name="type">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`application_exec',`
-+ gen_require(`
-+ attribute application_exec_type;
-+ ')
-+
-+ can_exec($1, application_exec_type)
-+')
-+
-+########################################
-+## <summary>
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.4/policy/modules/system/application.if
+--- nsaserefpolicy/policy/modules/system/application.if 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/application.if 2007-07-25 13:27:51.000000000 -0400
+@@ -63,6 +63,26 @@
+
+ ########################################
+ ## <summary>
+## Execute all executable files.
+## </summary>
+## <param name="domain">
@@ -7686,46 +7647,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic
+
+########################################
+## <summary>
-+## Create a domain which can be started by users
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Type to be used as a domain.
-+## </summary>
-+## </param>
-+## <param name="entry_point">
-+## <summary>
-+## Type of the program to be used as an entry point to this domain.
-+## </summary>
-+## </param>
-+#
-+interface(`application_domain',`
-+
-+ application_type($1)
-+ application_executable_file($2)
-+ domain_entry_file($1,$2)
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.0.3/policy/modules/system/application.te
---- nsaserefpolicy/policy/modules/system/application.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/system/application.te 2007-07-17 15:46:25.000000000 -0400
-@@ -0,0 +1,14 @@
-+
-+policy_module(application,1.0.0)
-+
-+# Attribute of user applications
-+attribute application_domain_type;
-+
-+# Executables to be run by user
-+attribute application_exec_type;
-+
-+optional_policy(`
-+ ssh_sigchld(application_domain_type)
-+ ssh_rw_stream_sockets(application_domain_type)
-+')
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.3/policy/modules/system/authlogin.fc
+ ## Create a domain which can be started by users
+ ## </summary>
+ ## <param name="domain">
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.4/policy/modules/system/authlogin.fc
--- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/authlogin.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/authlogin.fc 2007-07-25 13:27:51.000000000 -0400
@@ -14,6 +14,7 @@
/sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
@@ -7734,12 +7661,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
ifdef(`distro_suse', `
/sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.3/policy/modules/system/authlogin.if
---- nsaserefpolicy/policy/modules/system/authlogin.if 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/authlogin.if 2007-07-20 14:51:53.000000000 -0400
-@@ -27,7 +27,8 @@
- domain_type($1_chkpwd_t)
- domain_entry_file($1_chkpwd_t,chkpwd_exec_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.4/policy/modules/system/authlogin.if
+--- nsaserefpolicy/policy/modules/system/authlogin.if 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/authlogin.if 2007-07-26 10:17:19.000000000 -0400
+@@ -26,7 +26,8 @@
+ type $1_chkpwd_t, can_read_shadow_passwords;
+ application_domain($1_chkpwd_t,chkpwd_exec_t)
- allow $1_chkpwd_t self:capability { audit_control setuid };
+ allow $1_chkpwd_t self:capability { dac_override setuid };
@@ -7747,7 +7674,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
allow $1_chkpwd_t self:process getattr;
files_list_etc($1_chkpwd_t)
-@@ -108,7 +109,7 @@
+@@ -107,7 +108,7 @@
role $3 types system_chkpwd_t;
# cjp: is this really needed?
@@ -7756,7 +7683,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
dontaudit $2 shadow_t:file { getattr read };
-@@ -170,6 +171,9 @@
+@@ -169,6 +170,9 @@
## </param>
#
interface(`auth_login_pgm_domain',`
@@ -7766,7 +7693,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
domain_type($1)
domain_subj_id_change_exemption($1)
-@@ -177,6 +181,12 @@
+@@ -176,6 +180,12 @@
domain_obj_id_change_exemption($1)
role system_r types $1;
@@ -7779,7 +7706,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
# for SSP/ProPolice
dev_read_urand($1)
-@@ -197,22 +207,27 @@
+@@ -196,22 +206,27 @@
mls_fd_share_all_levels($1)
auth_domtrans_chk_passwd($1)
@@ -7808,7 +7735,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
')
')
-@@ -310,9 +325,6 @@
+@@ -309,9 +324,6 @@
type system_chkpwd_t, chkpwd_exec_t, shadow_t;
')
@@ -7818,7 +7745,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
corecmd_search_bin($1)
domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t)
-@@ -348,6 +360,37 @@
+@@ -347,6 +359,37 @@
########################################
## <summary>
@@ -7856,7 +7783,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
## Get the attributes of the shadow passwords file.
## </summary>
## <param name="domain">
-@@ -696,6 +739,24 @@
+@@ -695,6 +738,24 @@
########################################
## <summary>
@@ -7881,7 +7808,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
## Execute pam programs in the PAM domain.
## </summary>
## <param name="domain">
-@@ -1319,14 +1380,9 @@
+@@ -1318,14 +1379,9 @@
## </param>
#
interface(`auth_use_nsswitch',`
@@ -7896,7 +7823,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
files_list_var_lib($1)
miscfiles_read_certs($1)
-@@ -1382,3 +1438,114 @@
+@@ -1381,3 +1437,166 @@
typeattribute $1 can_write_shadow_passwords;
typeattribute $1 can_relabelto_shadow_passwords;
')
@@ -7982,6 +7909,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+
+########################################
+## <summary>
++## Execute a domain transition to run unix_update in Read Only Mode.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`auth_domtrans_upd_passwd_chk',`
++ gen_require(`
++ type system_chkpwd_t, updpwd_exec_t;
++ ')
++
++ domain_auto_trans($1,updpwd_exec_t,system_chkpwd_t)
++ allow system_chkpwd_t $1:fd use;
++ allow system_chkpwd_t $1:fifo_file rw_file_perms;
++ allow system_chkpwd_t $1:process sigchld;
++ auth_dontaudit_read_shadow($1)
++
++')
++
++########################################
++## <summary>
+## Execute updpwd programs in the updpwd domain.
+## </summary>
+## <param name="domain">
@@ -8008,12 +7958,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+ auth_domtrans_upd_passwd($1)
+ role $2 types updpwd_t;
+ allow updpwd_t $3:chr_file rw_file_perms;
-+ auth_dontaudit_read_shadow($1)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.3/policy/modules/system/authlogin.te
---- nsaserefpolicy/policy/modules/system/authlogin.te 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/authlogin.te 2007-07-17 15:46:25.000000000 -0400
++########################################
++## <summary>
++## Execute updpwd programs in the chkpwd domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <param name="role">
++## <summary>
++## The role to allow the updpwd domain.
++## </summary>
++## </param>
++## <param name="terminal">
++## <summary>
++## The type of the terminal allow the updpwd domain to use.
++## </summary>
++## </param>
++#
++interface(`auth_run_upd_passwd_chk',`
++ gen_require(`
++ type system_chkpwd_t;
++ ')
++
++ auth_domtrans_upd_passwd_chk($1)
++ role $2 types system_chkpwd_t;
++ allow system_chkpwd_t $3:chr_file rw_file_perms;
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.4/policy/modules/system/authlogin.te
+--- nsaserefpolicy/policy/modules/system/authlogin.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/authlogin.te 2007-07-25 13:27:51.000000000 -0400
@@ -9,6 +9,13 @@
attribute can_read_shadow_passwords;
attribute can_write_shadow_passwords;
@@ -8027,8 +8006,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+role system_r types updpwd_t;
type chkpwd_exec_t;
- corecmd_executable_file(chkpwd_exec_t)
-@@ -161,6 +168,8 @@
+ application_executable_file(chkpwd_exec_t)
+@@ -159,6 +166,8 @@
dev_setattr_mouse_dev(pam_console_t)
dev_getattr_power_mgmt_dev(pam_console_t)
dev_setattr_power_mgmt_dev(pam_console_t)
@@ -8037,7 +8016,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
dev_getattr_scanner_dev(pam_console_t)
dev_setattr_scanner_dev(pam_console_t)
dev_getattr_sound_dev(pam_console_t)
-@@ -238,7 +247,7 @@
+@@ -236,7 +245,7 @@
optional_policy(`
xserver_read_xdm_pid(pam_console_t)
@@ -8046,7 +8025,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
')
########################################
-@@ -304,3 +313,30 @@
+@@ -302,3 +311,30 @@
xserver_use_xdm_fds(utempter_t)
xserver_rw_xdm_pipes(utempter_t)
')
@@ -8077,15 +8056,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+optional_policy(`
+ nscd_socket_use(updpwd_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.fc serefpolicy-3.0.3/policy/modules/system/brctl.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.fc serefpolicy-3.0.4/policy/modules/system/brctl.fc
--- nsaserefpolicy/policy/modules/system/brctl.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/system/brctl.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/brctl.fc 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,2 @@
+
+/usr/sbin/brctl -- gen_context(system_u:object_r:brctl_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.if serefpolicy-3.0.3/policy/modules/system/brctl.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.if serefpolicy-3.0.4/policy/modules/system/brctl.if
--- nsaserefpolicy/policy/modules/system/brctl.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/system/brctl.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/brctl.if 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,25 @@
+
+## <summary>Utilities for configuring the linux ethernet bridge</summary>
@@ -8112,9 +8091,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.
+ allow brctl_t $1:fifo_file rw_file_perms;
+ allow brctl_t $1:process sigchld;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.te serefpolicy-3.0.3/policy/modules/system/brctl.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.te serefpolicy-3.0.4/policy/modules/system/brctl.te
--- nsaserefpolicy/policy/modules/system/brctl.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/system/brctl.te 2007-07-19 09:01:33.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/brctl.te 2007-07-25 16:13:13.000000000 -0400
@@ -0,0 +1,50 @@
+policy_module(brctl,1.0.0)
+
@@ -8138,7 +8117,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.
+allow brctl_t self:tcp_socket create_socket_perms;
+allow brctl_t self:unix_dgram_socket create_socket_perms;
+
-+dev_search_sysfs(brctl_t)
++dev_list_sysfs(brctl_t)
+
+# Init script handling
+domain_use_interactive_fds(brctl_t)
@@ -8166,9 +8145,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.
+optional_policy(`
+ xen_append_log(brctl_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.3/policy/modules/system/fstools.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.4/policy/modules/system/fstools.fc
--- nsaserefpolicy/policy/modules/system/fstools.fc 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/fstools.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/fstools.fc 2007-07-25 13:27:51.000000000 -0400
@@ -20,7 +20,6 @@
/sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -8177,9 +8156,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.0.3/policy/modules/system/fstools.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.0.4/policy/modules/system/fstools.if
--- nsaserefpolicy/policy/modules/system/fstools.if 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/fstools.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/fstools.if 2007-07-25 13:27:51.000000000 -0400
@@ -124,3 +124,22 @@
allow $1 swapfile_t:file getattr;
@@ -8203,9 +8182,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
+ allow $1 fsdaemon_t:fifo_file read_fifo_file_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.3/policy/modules/system/fstools.te
---- nsaserefpolicy/policy/modules/system/fstools.te 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/fstools.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.4/policy/modules/system/fstools.te
+--- nsaserefpolicy/policy/modules/system/fstools.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/fstools.te 2007-07-25 13:27:51.000000000 -0400
@@ -9,6 +9,7 @@
type fsadm_t;
type fsadm_exec_t;
@@ -8221,11 +8200,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
+
+optional_policy(`
+ xen_append_log(fsadm_t)
-+ xen_rw_image_files(udev_t)
++ xen_rw_image_files(fsadm_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.3/policy/modules/system/fusermount.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.4/policy/modules/system/fusermount.fc
--- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/system/fusermount.fc 2007-07-23 08:11:14.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/fusermount.fc 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,7 @@
+# fusermount executable will have:
+# label: system_u:object_r:fusermount_exec_t
@@ -8234,9 +8213,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+
+/usr/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0)
+/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.3/policy/modules/system/fusermount.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.4/policy/modules/system/fusermount.if
--- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/system/fusermount.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/fusermount.if 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,41 @@
+## <summary>policy for fusermount</summary>
+
@@ -8280,9 +8259,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+ allow $1 fusermount_t:fd use;
+')
\ No newline at end of file
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.3/policy/modules/system/fusermount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.4/policy/modules/system/fusermount.te
--- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/system/fusermount.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/fusermount.te 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,46 @@
+policy_module(fusermount,1.0.0)
+
@@ -8330,9 +8309,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+ mount_ntfs_rw_stream_sockets(fusermount_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.3/policy/modules/system/getty.te
---- nsaserefpolicy/policy/modules/system/getty.te 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/getty.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.4/policy/modules/system/getty.te
+--- nsaserefpolicy/policy/modules/system/getty.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/getty.te 2007-07-25 13:27:51.000000000 -0400
@@ -33,7 +33,8 @@
#
@@ -8343,9 +8322,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.
dontaudit getty_t self:capability sys_tty_config;
allow getty_t self:process { getpgid setpgid getsession signal_perms };
allow getty_t self:fifo_file rw_fifo_file_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.3/policy/modules/system/hostname.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.4/policy/modules/system/hostname.te
--- nsaserefpolicy/policy/modules/system/hostname.te 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/hostname.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/hostname.te 2007-07-25 13:27:51.000000000 -0400
@@ -8,8 +8,12 @@
type hostname_t;
@@ -8372,25 +8351,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna
+optional_policy(`
+ unconfined_dontaudit_rw_pipes(hostname_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.3/policy/modules/system/init.if
---- nsaserefpolicy/policy/modules/system/init.if 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/init.if 2007-07-17 15:46:25.000000000 -0400
-@@ -194,11 +194,14 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.4/policy/modules/system/init.if
+--- nsaserefpolicy/policy/modules/system/init.if 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/init.if 2007-07-25 13:27:51.000000000 -0400
+@@ -194,9 +194,13 @@
gen_require(`
type initrc_t;
role system_r;
+ attribute daemon;
')
- domain_type($1)
- domain_entry_file($1,$2)
-
-+ typeattribute $1 daemon;
+- application_domain($1,$2)
++ domain_type($1)
++ domain_entry_file($1,$2)
+
++ typeattribute $1 daemon;
+
role system_r types $1;
- domtrans_pattern(initrc_t,$2,$1)
-@@ -1251,7 +1254,7 @@
+@@ -1250,7 +1254,7 @@
type initrc_var_run_t;
')
@@ -8399,7 +8378,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
')
########################################
-@@ -1272,3 +1275,42 @@
+@@ -1271,3 +1275,42 @@
files_search_pids($1)
allow $1 initrc_var_run_t:file manage_file_perms;
')
@@ -8442,9 +8421,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
+
+ allow $1 init_t:process ptrace;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.3/policy/modules/system/init.te
---- nsaserefpolicy/policy/modules/system/init.te 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/init.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.4/policy/modules/system/init.te
+--- nsaserefpolicy/policy/modules/system/init.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/init.te 2007-07-25 13:27:51.000000000 -0400
@@ -10,6 +10,20 @@
# Declarations
#
@@ -8534,7 +8513,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t)
')
-@@ -631,12 +677,6 @@
+@@ -636,12 +682,6 @@
mta_read_config(initrc_t)
mta_dontaudit_read_spool_symlinks(initrc_t)
')
@@ -8547,7 +8526,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
optional_policy(`
ifdef(`distro_redhat',`
-@@ -702,6 +742,9 @@
+@@ -707,6 +747,9 @@
# why is this needed:
rpm_manage_db(initrc_t)
@@ -8557,9 +8536,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.0.3/policy/modules/system/ipsec.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.0.4/policy/modules/system/ipsec.if
--- nsaserefpolicy/policy/modules/system/ipsec.if 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/ipsec.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/ipsec.if 2007-07-25 13:27:51.000000000 -0400
@@ -114,6 +114,26 @@
########################################
@@ -8587,9 +8566,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
## Execute racoon in the racoon domain.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.3/policy/modules/system/ipsec.te
---- nsaserefpolicy/policy/modules/system/ipsec.te 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/ipsec.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.4/policy/modules/system/ipsec.te
+--- nsaserefpolicy/policy/modules/system/ipsec.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/ipsec.te 2007-07-25 13:27:51.000000000 -0400
@@ -283,6 +283,7 @@
allow racoon_t self:netlink_selinux_socket { bind create read };
allow racoon_t self:udp_socket create_socket_perms;
@@ -8598,9 +8577,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
# manage pid file
manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.3/policy/modules/system/iptables.te
---- nsaserefpolicy/policy/modules/system/iptables.te 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/iptables.te 2007-07-19 09:15:48.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.4/policy/modules/system/iptables.te
+--- nsaserefpolicy/policy/modules/system/iptables.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/iptables.te 2007-07-25 13:27:51.000000000 -0400
@@ -44,6 +44,8 @@
corenet_relabelto_all_packets(iptables_t)
@@ -8629,9 +8608,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl
ppp_dontaudit_use_fds(iptables_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.3/policy/modules/system/libraries.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.4/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/libraries.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/libraries.fc 2007-07-25 13:27:51.000000000 -0400
@@ -158,8 +158,11 @@
/usr/(local/)?.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:shlib_t,s0)
/usr/(local/)?lib(64)?/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -8661,9 +8640,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
+/usr/lib/mozilla/plugins/libvlcplugin.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib64/mozilla/plugins/libvlcplugin.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.3/policy/modules/system/libraries.te
---- nsaserefpolicy/policy/modules/system/libraries.te 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/libraries.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.4/policy/modules/system/libraries.te
+--- nsaserefpolicy/policy/modules/system/libraries.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/libraries.te 2007-07-25 13:27:51.000000000 -0400
@@ -97,6 +97,11 @@
')
')
@@ -8688,21 +8667,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
+ # run mkinitrd as unconfined user
+ unconfined_manage_tmp_files(ldconfig_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.3/policy/modules/system/locallogin.te
---- nsaserefpolicy/policy/modules/system/locallogin.te 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/locallogin.te 2007-07-17 15:46:25.000000000 -0400
-@@ -56,6 +56,10 @@
- allow local_login_t local_login_tmp_t:file manage_file_perms;
- files_tmp_filetrans(local_login_t, local_login_tmp_t, { file dir })
-
-+corecmd_exec_bin(local_login_t)
-+
-+kernel_read_network_state(local_login_t)
-+kernel_search_network_sysctl(local_login_t)
- kernel_read_system_state(local_login_t)
- kernel_read_kernel_sysctls(local_login_t)
- kernel_search_key(local_login_t)
-@@ -98,6 +102,11 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.4/policy/modules/system/locallogin.te
+--- nsaserefpolicy/policy/modules/system/locallogin.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/locallogin.te 2007-07-25 13:27:51.000000000 -0400
+@@ -25,6 +25,7 @@
+ domain_role_change_exemption(sulogin_t)
+ domain_interactive_fd(sulogin_t)
+ init_domain(sulogin_t,sulogin_exec_t)
++init_system_domain(sulogin_t,sulogin_exec_t)
+ role system_r types sulogin_t;
+
+ ########################################
+@@ -97,6 +98,11 @@
term_setattr_all_user_ttys(local_login_t)
term_setattr_unallocated_ttys(local_login_t)
@@ -8714,7 +8690,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall
auth_rw_login_records(local_login_t)
auth_rw_faillog(local_login_t)
auth_manage_pam_console_data(local_login_t)
-@@ -161,6 +170,15 @@
+@@ -160,6 +166,15 @@
')
optional_policy(`
@@ -8730,7 +8706,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall
gpm_getattr_gpmctl(local_login_t)
gpm_setattr_gpmctl(local_login_t)
')
-@@ -179,13 +197,18 @@
+@@ -178,13 +193,18 @@
')
optional_policy(`
@@ -8750,9 +8726,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall
#################################
#
# Sulogin local policy
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.3/policy/modules/system/logging.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.4/policy/modules/system/logging.fc
--- nsaserefpolicy/policy/modules/system/logging.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/logging.fc 2007-07-19 11:20:26.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/logging.fc 2007-07-25 13:27:51.000000000 -0400
@@ -1,12 +1,15 @@
-
/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
@@ -8776,9 +8752,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
/var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
+
+/var/log/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.3/policy/modules/system/logging.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.4/policy/modules/system/logging.if
--- nsaserefpolicy/policy/modules/system/logging.if 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/logging.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/logging.if 2007-07-25 13:27:51.000000000 -0400
@@ -33,8 +33,13 @@
## </param>
#
@@ -9004,9 +8980,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+ typeattribute $1 can_send_audit_msgs;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.3/policy/modules/system/logging.te
---- nsaserefpolicy/policy/modules/system/logging.te 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/logging.te 2007-07-23 15:43:28.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.4/policy/modules/system/logging.te
+--- nsaserefpolicy/policy/modules/system/logging.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/logging.te 2007-07-25 13:27:51.000000000 -0400
@@ -7,10 +7,15 @@
#
@@ -9142,9 +9118,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
files_read_etc_runtime_files(syslogd_t)
# /initrd is not umounted before minilog starts
files_dontaudit_search_isid_type_dirs(syslogd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.3/policy/modules/system/lvm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.4/policy/modules/system/lvm.fc
--- nsaserefpolicy/policy/modules/system/lvm.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/lvm.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/lvm.fc 2007-07-25 13:27:51.000000000 -0400
@@ -15,6 +15,7 @@
#
/etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0)
@@ -9153,9 +9129,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc
/etc/lvm/archive(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0)
/etc/lvm/backup(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0)
/etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.3/policy/modules/system/lvm.te
---- nsaserefpolicy/policy/modules/system/lvm.te 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/lvm.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.4/policy/modules/system/lvm.te
+--- nsaserefpolicy/policy/modules/system/lvm.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/lvm.te 2007-07-25 13:27:51.000000000 -0400
@@ -16,6 +16,7 @@
type lvm_t;
type lvm_exec_t;
@@ -9208,9 +9184,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
+ xen_dontaudit_rw_unix_stream_sockets(lvm_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.0.3/policy/modules/system/miscfiles.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.0.4/policy/modules/system/miscfiles.fc
--- nsaserefpolicy/policy/modules/system/miscfiles.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/miscfiles.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/miscfiles.fc 2007-07-25 13:27:51.000000000 -0400
@@ -66,6 +66,7 @@
/var/lib/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0)
@@ -9219,10 +9195,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi
/var/cache/man(/.*)? gen_context(system_u:object_r:man_t,s0)
/var/spool/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.3/policy/modules/system/modutils.te
---- nsaserefpolicy/policy/modules/system/modutils.te 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/modutils.te 2007-07-23 09:23:58.000000000 -0400
-@@ -43,7 +43,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.4/policy/modules/system/modutils.te
+--- nsaserefpolicy/policy/modules/system/modutils.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/modutils.te 2007-07-25 14:27:32.000000000 -0400
+@@ -42,7 +42,7 @@
# insmod local policy
#
@@ -9231,7 +9207,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
allow insmod_t self:udp_socket create_socket_perms;
-@@ -77,9 +77,7 @@
+@@ -63,6 +63,7 @@
+ kernel_read_kernel_sysctls(insmod_t)
+ kernel_rw_kernel_sysctl(insmod_t)
+ kernel_read_hotplug_sysctls(insmod_t)
++kernel_setsched(insmod_t)
+
+ files_read_kernel_modules(insmod_t)
+ # for locking: (cjp: ????)
+@@ -76,9 +77,7 @@
dev_read_sound(insmod_t)
dev_write_sound(insmod_t)
dev_rw_apm_bios(insmod_t)
@@ -9242,7 +9226,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
fs_getattr_xattr_fs(insmod_t)
-@@ -102,6 +100,7 @@
+@@ -101,6 +100,7 @@
init_use_fds(insmod_t)
init_use_script_fds(insmod_t)
init_use_script_ptys(insmod_t)
@@ -9250,7 +9234,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
libs_use_ld_so(insmod_t)
libs_use_shared_libs(insmod_t)
-@@ -113,11 +112,25 @@
+@@ -112,11 +112,25 @@
seutil_read_file_contexts(insmod_t)
@@ -9276,7 +9260,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
hotplug_search_config(insmod_t)
')
-@@ -150,6 +163,7 @@
+@@ -149,6 +163,7 @@
optional_policy(`
rpm_rw_pipes(insmod_t)
@@ -9284,7 +9268,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
')
optional_policy(`
-@@ -180,6 +194,7 @@
+@@ -179,6 +194,7 @@
files_read_kernel_symbol_table(depmod_t)
files_read_kernel_modules(depmod_t)
@@ -9292,7 +9276,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
fs_getattr_xattr_fs(depmod_t)
-@@ -206,9 +221,12 @@
+@@ -205,9 +221,12 @@
userdom_read_staff_home_content_files(depmod_t)
userdom_read_sysadm_home_content_files(depmod_t)
@@ -9305,18 +9289,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.3/policy/modules/system/mount.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.4/policy/modules/system/mount.fc
--- nsaserefpolicy/policy/modules/system/mount.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/mount.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/mount.fc 2007-07-25 13:27:51.000000000 -0400
@@ -1,4 +1,3 @@
/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
-
-/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0)
+/sbin/mount.ntfs-3g -- gen_context(system_u:object_r:mount_ntfs_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-3.0.3/policy/modules/system/mount.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-3.0.4/policy/modules/system/mount.if
--- nsaserefpolicy/policy/modules/system/mount.if 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/mount.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/mount.if 2007-07-25 13:27:51.000000000 -0400
@@ -171,3 +171,40 @@
role $2 types unconfined_mount_t;
allow unconfined_mount_t $3:chr_file rw_file_perms;
@@ -9358,9 +9342,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
+
+ allow $1 mount_ntfs_t:unix_stream_socket { read write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.3/policy/modules/system/mount.te
---- nsaserefpolicy/policy/modules/system/mount.te 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/mount.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.4/policy/modules/system/mount.te
+--- nsaserefpolicy/policy/modules/system/mount.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/mount.te 2007-07-25 13:27:51.000000000 -0400
@@ -8,6 +8,13 @@
## <desc>
@@ -9375,7 +9359,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
## Allow mount to mount any file
## </p>
## </desc>
-@@ -16,20 +23,23 @@
+@@ -16,19 +23,22 @@
type mount_t;
type mount_exec_t;
init_system_domain(mount_t,mount_exec_t)
@@ -9396,13 +9380,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
-# this is optionally declared in monolithic
-# policy--duplicate type declaration
type unconfined_mount_t;
- domain_type(unconfined_mount_t)
- domain_entry_file(unconfined_mount_t,mount_exec_t)
+ application_domain(unconfined_mount_t,mount_exec_t)
+role system_r types unconfined_mount_t;
########################################
#
-@@ -37,7 +47,7 @@
+@@ -36,7 +46,7 @@
#
# setuid/setgid needed to mount cifs
@@ -9411,7 +9394,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
allow mount_t mount_loopback_t:file read_file_perms;
allow mount_t self:netlink_route_socket r_netlink_socket_perms;
-@@ -52,6 +62,7 @@
+@@ -51,6 +61,7 @@
kernel_read_system_state(mount_t)
kernel_read_kernel_sysctls(mount_t)
kernel_dontaudit_getattr_core_if(mount_t)
@@ -9419,7 +9402,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
dev_getattr_all_blk_files(mount_t)
dev_list_all_dev_nodes(mount_t)
-@@ -102,6 +113,8 @@
+@@ -101,6 +112,8 @@
init_use_fds(mount_t)
init_use_script_ptys(mount_t)
init_dontaudit_getattr_initctl(mount_t)
@@ -9428,7 +9411,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
libs_use_ld_so(mount_t)
libs_use_shared_libs(mount_t)
-@@ -128,10 +141,15 @@
+@@ -127,10 +140,15 @@
')
')
@@ -9445,7 +9428,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
')
optional_policy(`
-@@ -202,4 +220,53 @@
+@@ -201,4 +219,53 @@
optional_policy(`
files_etc_filetrans_etc_runtime(unconfined_mount_t,file)
unconfined_domain(unconfined_mount_t)
@@ -9499,10 +9482,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
+ hal_rw_pipes(mount_ntfs_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-3.0.3/policy/modules/system/netlabel.te
---- nsaserefpolicy/policy/modules/system/netlabel.te 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/netlabel.te 2007-07-17 15:46:25.000000000 -0400
-@@ -20,6 +20,8 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-3.0.4/policy/modules/system/netlabel.te
+--- nsaserefpolicy/policy/modules/system/netlabel.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/netlabel.te 2007-07-25 13:27:51.000000000 -0400
+@@ -19,6 +19,8 @@
allow netlabel_mgmt_t self:capability net_admin;
allow netlabel_mgmt_t self:netlink_socket create_socket_perms;
@@ -9511,9 +9494,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlab
kernel_read_network_state(netlabel_mgmt_t)
libs_use_ld_so(netlabel_mgmt_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.3/policy/modules/system/raid.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.4/policy/modules/system/raid.te
--- nsaserefpolicy/policy/modules/system/raid.te 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/raid.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/raid.te 2007-07-25 13:27:51.000000000 -0400
@@ -19,7 +19,7 @@
# Local policy
#
@@ -9523,9 +9506,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t
dontaudit mdadm_t self:capability sys_tty_config;
allow mdadm_t self:process { sigchld sigkill sigstop signull signal };
allow mdadm_t self:fifo_file rw_fifo_file_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.3/policy/modules/system/selinuxutil.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.4/policy/modules/system/selinuxutil.fc
--- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/selinuxutil.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/selinuxutil.fc 2007-07-25 13:27:51.000000000 -0400
@@ -38,8 +38,9 @@
/usr/sbin/restorecond -- gen_context(system_u:object_r:restorecond_exec_t,s0)
/usr/sbin/run_init -- gen_context(system_u:object_r:run_init_exec_t,s0)
@@ -9537,14 +9520,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
/usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0)
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.3/policy/modules/system/selinuxutil.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.4/policy/modules/system/selinuxutil.if
--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/selinuxutil.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/selinuxutil.if 2007-07-25 14:07:42.000000000 -0400
@@ -432,6 +432,7 @@
role $2 types run_init_t;
allow run_init_t $3:chr_file rw_term_perms;
allow $2 system_r;
-+ auth_run_upd_passwd($1,$2,$3)
++ auth_run_upd_passwd_chk($1,$2,$3)
')
########################################
@@ -9746,24 +9729,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
+seutil_manage_default_contexts($1)
+
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.3/policy/modules/system/selinuxutil.te
---- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/selinuxutil.te 2007-07-24 16:27:49.000000000 -0400
-@@ -24,11 +24,9 @@
- files_type(selinux_config_t)
-
- type checkpolicy_t, can_write_binary_policy;
--domain_type(checkpolicy_t)
--role system_r types checkpolicy_t;
--
- type checkpolicy_exec_t;
--domain_entry_file(checkpolicy_t,checkpolicy_exec_t)
-+application_domain(checkpolicy_t, checkpolicy_exec_t)
-+role system_r types checkpolicy_t;
-
- #
- # default_context_t is the type applied to
-@@ -81,25 +79,26 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.4/policy/modules/system/selinuxutil.te
+--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/selinuxutil.te 2007-07-25 14:07:51.000000000 -0400
+@@ -76,7 +76,6 @@
type restorecond_exec_t;
init_daemon_domain(restorecond_t,restorecond_exec_t)
domain_obj_id_change_exemption(restorecond_t)
@@ -9771,23 +9740,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
type restorecond_var_run_t;
files_pid_file(restorecond_var_run_t)
-
- type run_init_t;
- type run_init_exec_t;
--domain_type(run_init_t)
--domain_entry_file(run_init_t,run_init_exec_t)
-+application_domain(run_init_t, run_init_exec_t)
- domain_system_change_exemption(run_init_t)
-+role system_r types run_init_t;
-
- type semanage_t;
--domain_type(semanage_t)
--domain_interactive_fd(semanage_t)
--
- type semanage_exec_t;
--domain_entry_file(semanage_t, semanage_exec_t)
-+application_domain(semanage_t, semanage_exec_t)
-+domain_interactive_fd(semanage_t)
+@@ -94,6 +93,10 @@
+ application_domain(semanage_t,semanage_exec_t)
role system_r types semanage_t;
+type setsebool_exec_t;
@@ -9797,7 +9751,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
type semanage_store_t;
files_type(semanage_store_t)
-@@ -157,6 +156,11 @@
+@@ -151,6 +154,11 @@
userdom_use_all_users_fds(checkpolicy_t)
@@ -9809,7 +9763,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
########################################
#
# Load_policy local policy
-@@ -179,6 +183,7 @@
+@@ -173,6 +181,7 @@
fs_getattr_xattr_fs(load_policy_t)
mls_file_read_up(load_policy_t)
@@ -9817,7 +9771,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
selinux_get_fs_mount(load_policy_t)
selinux_load_policy(load_policy_t)
-@@ -201,10 +206,15 @@
+@@ -195,10 +204,15 @@
# cjp: cover up stray file descriptors.
dontaudit load_policy_t selinux_config_t:file write;
optional_policy(`
@@ -9834,7 +9788,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
########################################
#
# Newrole local policy
-@@ -222,7 +232,7 @@
+@@ -216,7 +230,7 @@
allow newrole_t self:msg { send receive };
allow newrole_t self:unix_dgram_socket sendto;
allow newrole_t self:unix_stream_socket { create_stream_socket_perms connectto };
@@ -9843,17 +9797,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
read_files_pattern(newrole_t,selinux_config_t,selinux_config_t)
read_lnk_files_pattern(newrole_t,selinux_config_t,selinux_config_t)
-@@ -260,7 +270,9 @@
+@@ -254,7 +268,9 @@
term_dontaudit_use_unallocated_ttys(newrole_t)
auth_domtrans_chk_passwd(newrole_t)
-+auth_domtrans_upd_passwd(newrole_t)
++auth_domtrans_upd_passwd_chk(newrole_t)
auth_rw_faillog(newrole_t)
+auth_search_key(newrole_t)
corecmd_list_bin(newrole_t)
corecmd_read_bin_symlinks(newrole_t)
-@@ -280,6 +292,7 @@
+@@ -274,6 +290,7 @@
libs_use_ld_so(newrole_t)
libs_use_shared_libs(newrole_t)
@@ -9861,7 +9815,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
logging_send_syslog_msg(newrole_t)
miscfiles_read_localization(newrole_t)
-@@ -368,7 +381,7 @@
+@@ -362,7 +379,7 @@
allow run_init_t self:process setexec;
allow run_init_t self:capability setuid;
allow run_init_t self:fifo_file rw_file_perms;
@@ -9870,15 +9824,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
# often the administrator runs such programs from a directory that is owned
# by a different user or has restrictive SE permissions, do not want to audit
-@@ -382,6 +395,7 @@
+@@ -376,6 +393,7 @@
term_dontaudit_list_ptys(run_init_t)
auth_domtrans_chk_passwd(run_init_t)
-+auth_domtrans_upd_passwd(run_init_t)
++auth_domtrans_upd_passwd_chk(run_init_t)
auth_dontaudit_read_shadow(run_init_t)
corecmd_exec_bin(run_init_t)
-@@ -438,7 +452,7 @@
+@@ -432,7 +450,7 @@
allow semanage_t self:capability { dac_override audit_write };
allow semanage_t self:unix_stream_socket create_stream_socket_perms;
allow semanage_t self:unix_dgram_socket create_socket_perms;
@@ -9887,7 +9841,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
allow semanage_t policy_config_t:file { read write };
-@@ -449,7 +463,10 @@
+@@ -443,7 +461,10 @@
kernel_read_system_state(semanage_t)
kernel_read_kernel_sysctls(semanage_t)
@@ -9898,7 +9852,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
dev_read_urand(semanage_t)
-@@ -473,6 +490,8 @@
+@@ -467,6 +488,8 @@
# Running genhomedircon requires this for finding all users
auth_use_nsswitch(semanage_t)
@@ -9907,7 +9861,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
libs_use_ld_so(semanage_t)
libs_use_shared_libs(semanage_t)
-@@ -497,6 +516,17 @@
+@@ -491,6 +514,17 @@
# netfilter_contexts:
seutil_manage_default_contexts(semanage_t)
@@ -9925,7 +9879,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
# cjp: need a more general way to handle this:
ifdef(`enable_mls',`
# read secadm tmp files
-@@ -524,6 +554,8 @@
+@@ -518,6 +552,8 @@
allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:file r_file_perms;
allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:lnk_file r_file_perms;
@@ -9934,7 +9888,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
kernel_read_system_state(setfiles_t)
kernel_relabelfrom_unlabeled_dirs(setfiles_t)
kernel_relabelfrom_unlabeled_files(setfiles_t)
-@@ -540,6 +572,7 @@
+@@ -534,6 +570,7 @@
fs_getattr_xattr_fs(setfiles_t)
fs_list_all(setfiles_t)
@@ -9942,7 +9896,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
fs_search_auto_mountpoints(setfiles_t)
fs_relabelfrom_noxattr_fs(setfiles_t)
-@@ -595,6 +628,10 @@
+@@ -589,6 +626,10 @@
ifdef(`hide_broken_symptoms',`
optional_policy(`
@@ -9953,9 +9907,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
udev_dontaudit_rw_dgram_sockets(setfiles_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.3/policy/modules/system/sysnetwork.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.4/policy/modules/system/sysnetwork.if
--- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/sysnetwork.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/sysnetwork.if 2007-07-25 13:27:51.000000000 -0400
@@ -522,6 +522,8 @@
files_search_etc($1)
@@ -9965,9 +9919,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.3/policy/modules/system/sysnetwork.te
---- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/sysnetwork.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.4/policy/modules/system/sysnetwork.te
+--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/sysnetwork.te 2007-07-25 13:27:51.000000000 -0400
@@ -159,6 +159,10 @@
dbus_connect_system_bus(dhcpc_t)
dbus_send_system_bus(dhcpc_t)
@@ -10004,9 +9958,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
term_dontaudit_use_all_user_ttys(ifconfig_t)
term_dontaudit_use_all_user_ptys(ifconfig_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.3/policy/modules/system/udev.te
---- nsaserefpolicy/policy/modules/system/udev.te 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/udev.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.4/policy/modules/system/udev.te
+--- nsaserefpolicy/policy/modules/system/udev.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/udev.te 2007-07-25 13:27:51.000000000 -0400
@@ -68,8 +68,9 @@
allow udev_t udev_tbl_t:file manage_file_perms;
dev_filetrans(udev_t,udev_tbl_t,file)
@@ -10106,9 +10060,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.3/policy/modules/system/unconfined.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.4/policy/modules/system/unconfined.if
--- nsaserefpolicy/policy/modules/system/unconfined.if 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/unconfined.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/unconfined.if 2007-07-25 14:31:13.000000000 -0400
@@ -12,14 +12,13 @@
#
interface(`unconfined_domain_noaudit',`
@@ -10182,7 +10136,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
+
+ files_search_tmp($1)
+ manage_files_pattern($1,unconfined_tmp_t,unconfined_tmp_t)
-+ read_lnk_files_pattern($1,unconfined_tmp_t,unconfined_tmp_t)
++ manage_lnk_files_pattern($1,unconfined_tmp_t,unconfined_tmp_t)
+')
+
+########################################
@@ -10292,9 +10246,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
+
+ allow $1 unconfined_terminal:chr_file rw_term_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.3/policy/modules/system/unconfined.te
---- nsaserefpolicy/policy/modules/system/unconfined.te 2007-07-17 14:52:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/unconfined.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.4/policy/modules/system/unconfined.te
+--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/unconfined.te 2007-07-25 13:27:51.000000000 -0400
@@ -5,28 +5,36 @@
#
# Declarations
@@ -10487,9 +10441,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
')
+
+corecmd_exec_all_executables(unconfined_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.3/policy/modules/system/userdomain.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.4/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/userdomain.if 2007-07-24 15:42:37.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/userdomain.if 2007-07-26 10:11:38.000000000 -0400
@@ -62,6 +62,10 @@
allow $1_t $1_tty_device_t:chr_file { setattr rw_chr_file_perms };
@@ -10741,7 +10695,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
auth_search_pam_console_data($1_t)
auth_run_pam($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
auth_run_utempter($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
-+ auth_run_upd_passwd($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
++ auth_run_upd_passwd_chk($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
+ auth_read_key($1_t)
init_read_utmp($1_t)
@@ -11510,9 +11464,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ ')
+ typeattribute $1 user_home_type;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.3/policy/modules/system/userdomain.te
---- nsaserefpolicy/policy/modules/system/userdomain.te 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/userdomain.te 2007-07-17 15:46:25.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.4/policy/modules/system/userdomain.te
+--- nsaserefpolicy/policy/modules/system/userdomain.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/userdomain.te 2007-07-25 13:27:51.000000000 -0400
@@ -74,6 +74,9 @@
# users home directory contents
attribute home_type;
@@ -11610,9 +11564,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+tunable_policy(`allow_console_login', `
+ term_use_console(userdomain)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.3/policy/modules/system/xen.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.4/policy/modules/system/xen.if
--- nsaserefpolicy/policy/modules/system/xen.if 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/xen.if 2007-07-19 08:59:44.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/xen.if 2007-07-25 13:27:51.000000000 -0400
@@ -191,3 +191,24 @@
domtrans_pattern($1,xm_exec_t,xm_t)
@@ -11638,9 +11592,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if
+ allow $1 xend_var_lib_t:dir search_dir_perms;
+ rw_files_pattern($1,xen_image_t,xen_image_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.3/policy/modules/system/xen.te
---- nsaserefpolicy/policy/modules/system/xen.te 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.3/policy/modules/system/xen.te 2007-07-18 16:21:11.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.4/policy/modules/system/xen.te
+--- nsaserefpolicy/policy/modules/system/xen.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/xen.te 2007-07-25 13:27:51.000000000 -0400
+@@ -70,7 +70,7 @@
+ type xm_t;
+ type xm_exec_t;
+ domain_type(xm_t)
+-init_system_domain(xm_t, xm_exec_t)
++init_daemon_domain(xm_t, xm_exec_t)
+
+ ########################################
+ #
@@ -176,6 +176,7 @@
files_manage_etc_runtime_files(xend_t)
files_etc_filetrans_etc_runtime(xend_t,file)
@@ -11680,38 +11643,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
+fs_write_nfs_files(xend_t)
+fs_read_nfs_files(xend_t)
+fs_read_nfs_symlinks(xend_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.3/policy/modules/users/guest.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.4/policy/modules/users/guest.fc
--- nsaserefpolicy/policy/modules/users/guest.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/users/guest.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/users/guest.fc 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1 @@
+# No guest file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.3/policy/modules/users/guest.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.4/policy/modules/users/guest.if
--- nsaserefpolicy/policy/modules/users/guest.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/users/guest.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/users/guest.if 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1 @@
+## <summary>Policy for guest user</summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.3/policy/modules/users/guest.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.4/policy/modules/users/guest.te
--- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/users/guest.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/users/guest.te 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,5 @@
+policy_module(guest,1.0.0)
+userdom_unpriv_login_user(guest)
+userdom_unpriv_login_user(gadmin)
+userdom_unpriv_xwindows_login_user(xguest)
+mozilla_per_role_template(xguest, xguest_t, xguest_r)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.3/policy/modules/users/logadm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.4/policy/modules/users/logadm.fc
--- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/users/logadm.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/users/logadm.fc 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1 @@
+# No logadm file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.3/policy/modules/users/logadm.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.4/policy/modules/users/logadm.if
--- nsaserefpolicy/policy/modules/users/logadm.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/users/logadm.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/users/logadm.if 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1 @@
+## <summary>Policy for logadm user</summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.3/policy/modules/users/logadm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.4/policy/modules/users/logadm.te
--- nsaserefpolicy/policy/modules/users/logadm.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/users/logadm.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/users/logadm.te 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,33 @@
+policy_module(logadm,1.0.0)
+
@@ -11746,24 +11709,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.
+
+files_dontaudit_search_all_dirs(logadm_t)
+files_dontaudit_getattr_all_files(logadm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.3/policy/modules/users/metadata.xml
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.4/policy/modules/users/metadata.xml
--- nsaserefpolicy/policy/modules/users/metadata.xml 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/users/metadata.xml 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/users/metadata.xml 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1 @@
+<summary>Policy modules for users</summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.3/policy/modules/users/webadm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.4/policy/modules/users/webadm.fc
--- nsaserefpolicy/policy/modules/users/webadm.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/users/webadm.fc 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/users/webadm.fc 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1 @@
+# No webadm file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.3/policy/modules/users/webadm.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.4/policy/modules/users/webadm.if
--- nsaserefpolicy/policy/modules/users/webadm.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/users/webadm.if 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/users/webadm.if 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1 @@
+## <summary>Policy for webadm user</summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.3/policy/modules/users/webadm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.4/policy/modules/users/webadm.te
--- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.3/policy/modules/users/webadm.te 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/users/webadm.te 2007-07-25 13:27:51.000000000 -0400
@@ -0,0 +1,70 @@
+policy_module(webadm,1.0.0)
+
@@ -11835,9 +11798,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.
+allow webadm_t gadmin_t:dir getattr;
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.3/policy/support/obj_perm_sets.spt
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.4/policy/support/obj_perm_sets.spt
--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.3/policy/support/obj_perm_sets.spt 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/support/obj_perm_sets.spt 2007-07-25 13:27:51.000000000 -0400
@@ -201,7 +201,7 @@
define(`search_dir_perms',`{ getattr search }')
define(`list_dir_perms',`{ getattr search read lock ioctl }')
@@ -11870,9 +11833,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
+define(`all_association', `{ sendto recvfrom setcontext polmatch } ')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.3/policy/users
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.4/policy/users
--- nsaserefpolicy/policy/users 2007-07-17 14:52:27.000000000 -0400
-+++ serefpolicy-3.0.3/policy/users 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/policy/users 2007-07-25 13:27:51.000000000 -0400
@@ -16,7 +16,7 @@
# and a user process should never be assigned the system user
# identity.
@@ -11907,9 +11870,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0
- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
-')
+gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.3/Rules.modular
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.4/Rules.modular
--- nsaserefpolicy/Rules.modular 2007-05-25 09:09:10.000000000 -0400
-+++ serefpolicy-3.0.3/Rules.modular 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/Rules.modular 2007-07-25 13:27:51.000000000 -0400
@@ -167,7 +167,7 @@
# these have to run individually because order matters:
$(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
@@ -11936,9 +11899,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.
# Clean the sources
#
clean:
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.0.3/support/Makefile.devel
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.0.4/support/Makefile.devel
--- nsaserefpolicy/support/Makefile.devel 2007-05-29 13:53:56.000000000 -0400
-+++ serefpolicy-3.0.3/support/Makefile.devel 2007-07-17 15:46:25.000000000 -0400
++++ serefpolicy-3.0.4/support/Makefile.devel 2007-07-25 13:27:51.000000000 -0400
@@ -24,7 +24,7 @@
XMLLINT := $(BINDIR)/xmllint
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 39aa85c..87b2716 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -16,8 +16,8 @@
%define CHECKPOLICYVER 2.0.3-1
Summary: SELinux policy configuration
Name: selinux-policy
-Version: 3.0.3
-Release: 6%{?dist}
+Version: 3.0.4
+Release: 1%{?dist}
License: GPL
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -293,7 +293,7 @@ semodule -r moilscanner 2>/dev/null
%relabel targeted
exit 0
-%triggerpostun targeted -- selinux-policy-targeted <= 3.0.3-5
+%triggerpostun targeted -- selinux-policy-targeted < 3.0.4-1
setsebool -P use_nfs_home_dirs=1
restorecon -R /root /etc/selinux/targeted 2> /dev/null
semanage login -m -s "system_u" __default__ 2> /dev/null
@@ -359,6 +359,9 @@ exit 0
%endif
%changelog
+* Tue Jul 23 2007 Dan Walsh <dwalsh@redhat.com> 3.0.4-1
+- Update with latest changes from upstream
+
* Tue Jul 23 2007 Dan Walsh <dwalsh@redhat.com> 3.0.3-6
- Fix prelink to handle execmod
diff --git a/sources b/sources
index 95187b2..0e2abb7 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-af54ae49007f995f1cb9e5d6f5baf8bf serefpolicy-3.0.3.tgz
+a19850a065ff7c17da5eff9259b86d9c serefpolicy-3.0.4.tgz