diff --git a/modules-minimum.conf b/modules-minimum.conf
index ce9de57..4b896e4 100644
--- a/modules-minimum.conf
+++ b/modules-minimum.conf
@@ -1273,6 +1273,13 @@ squid = module
#
ssh = base
+# Layer: services
+# Module: sssd
+#
+# System Security Services Daemon
+#
+sssd = module
+
# Layer: kernel
# Module: storage
#
diff --git a/modules-mls.conf b/modules-mls.conf
index 8919fa2..ac6f63d 100644
--- a/modules-mls.conf
+++ b/modules-mls.conf
@@ -1266,6 +1266,13 @@ squid = module
#
ssh = base
+# Layer: services
+# Module: sssd
+#
+# System Security Services Daemon
+#
+sssd = module
+
# Layer: kernel
# Module: storage
#
diff --git a/modules-targeted.conf b/modules-targeted.conf
index ce9de57..4b896e4 100644
--- a/modules-targeted.conf
+++ b/modules-targeted.conf
@@ -1273,6 +1273,13 @@ squid = module
#
ssh = base
+# Layer: services
+# Module: sssd
+#
+# System Security Services Daemon
+#
+sssd = module
+
# Layer: kernel
# Module: storage
#
diff --git a/policy-20090105.patch b/policy-20090105.patch
index c94e06f..b226687 100644
--- a/policy-20090105.patch
+++ b/policy-20090105.patch
@@ -3553,8 +3553,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/usr/bin/pulseaudio -- gen_context(system_u:object_r:pulseaudio_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.6.8/policy/modules/apps/pulseaudio.if
--- nsaserefpolicy/policy/modules/apps/pulseaudio.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.8/policy/modules/apps/pulseaudio.if 2009-03-08 08:48:02.000000000 -0400
-@@ -0,0 +1,85 @@
++++ serefpolicy-3.6.8/policy/modules/apps/pulseaudio.if 2009-03-09 16:50:20.000000000 -0400
+@@ -0,0 +1,86 @@
+
+## policy for pulseaudio
+
@@ -3631,19 +3631,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ ps_process_pattern($2, pulseaudio_t)
+
+ allow pulseaudio_t $2:process { signal signull };
++ allow $2 pulseaudio_t:process { signal signull };
+ ps_process_pattern(pulseaudio_t, $2)
+
+ allow pulseaudio_t $2:unix_stream_socket connectto;
+ allow $2 pulseaudio_t:unix_stream_socket connectto;
+
-+ userdom_manage_home_role($1, $2)
-+ userdom_manage_tmp_role($1, $2)
-+ userdom_manage_tmpfs_role($1, $2)
++ userdom_manage_home_role($1, pulseaudio_t)
++ userdom_manage_tmp_role($1, pulseaudio_t)
++ userdom_manage_tmpfs_role($1, pulseaudio_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.8/policy/modules/apps/pulseaudio.te
--- nsaserefpolicy/policy/modules/apps/pulseaudio.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.8/policy/modules/apps/pulseaudio.te 2009-03-08 08:48:02.000000000 -0400
-@@ -0,0 +1,82 @@
++++ serefpolicy-3.6.8/policy/modules/apps/pulseaudio.te 2009-03-09 16:49:50.000000000 -0400
+@@ -0,0 +1,88 @@
+policy_module(pulseaudio,1.0.0)
+
+########################################
@@ -3687,10 +3688,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+files_read_usr_files(pulseaudio_t)
+
+fs_rw_anon_inodefs_files(pulseaudio_t)
++fs_getattr_tmpfs(pulseaudio_t)
+
+term_use_all_user_ttys(pulseaudio_t)
+term_use_all_user_ptys(pulseaudio_t)
+
++auth_use_nsswitch(pulseaudio_t)
++
+miscfiles_read_localization(pulseaudio_t)
+
+logging_send_syslog_msg(pulseaudio_t)
@@ -3718,6 +3722,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+optional_policy(`
+ xserver_common_app(pulseaudio_t)
++ xserver_read_xdm_pid(pulseaudio_t)
++ xserver_stream_connect(pulseaudio_t)
+')
+
+tunable_policy(`pulseaudio_network',`
@@ -3726,6 +3732,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+#FALSE
+')
+
++
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.fc serefpolicy-3.6.8/policy/modules/apps/qemu.fc
--- nsaserefpolicy/policy/modules/apps/qemu.fc 2008-08-07 11:15:02.000000000 -0400
+++ serefpolicy-3.6.8/policy/modules/apps/qemu.fc 2009-03-07 12:11:40.000000000 -0500
@@ -12684,7 +12691,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.6.8/policy/modules/services/hal.if
--- nsaserefpolicy/policy/modules/services/hal.if 2008-11-19 11:51:44.000000000 -0500
-+++ serefpolicy-3.6.8/policy/modules/services/hal.if 2009-03-09 12:17:13.000000000 -0400
++++ serefpolicy-3.6.8/policy/modules/services/hal.if 2009-03-09 16:17:22.000000000 -0400
@@ -20,6 +20,24 @@
########################################
@@ -12777,7 +12784,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+#
+interface(`hal_create_log',`
+ gen_require(`
-+ type hald_logd_t;
++ type hald_log_t;
+ ')
+
+ # log files for hald
@@ -21256,6 +21263,328 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_send_syslog_msg(ssh_keygen_t)
userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.fc serefpolicy-3.6.8/policy/modules/services/sssd.fc
+--- nsaserefpolicy/policy/modules/services/sssd.fc 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.8/policy/modules/services/sssd.fc 2009-03-09 15:47:38.000000000 -0400
+@@ -0,0 +1,6 @@
++
++/usr/sbin/sssd -- gen_context(system_u:object_r:sssd_exec_t,s0)
++
++/etc/rc.d/init.d/sssd -- gen_context(system_u:object_r:sssd_initrc_exec_t,s0)
++/var/run/sssd.pid -- gen_context(system_u:object_r:sssd_var_run_t,s0)
++/var/lib/sss(/.*)? gen_context(system_u:object_r:sssd_var_lib_t,s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.if serefpolicy-3.6.8/policy/modules/services/sssd.if
+--- nsaserefpolicy/policy/modules/services/sssd.if 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.8/policy/modules/services/sssd.if 2009-03-09 15:49:56.000000000 -0400
+@@ -0,0 +1,249 @@
++
++## policy for sssd
++
++########################################
++##
++## Execute a domain transition to run sssd.
++##
++##
++##
++## Domain allowed to transition.
++##
++##
++#
++interface(`sssd_domtrans',`
++ gen_require(`
++ type sssd_t;
++ type sssd_exec_t;
++ ')
++
++ domtrans_pattern($1,sssd_exec_t,sssd_t)
++')
++
++
++########################################
++##
++## Execute sssd server in the sssd domain.
++##
++##
++##
++## The type of the process performing this action.
++##
++##
++#
++interface(`sssd_initrc_domtrans',`
++ gen_require(`
++ type sssd_initrc_exec_t;
++ ')
++
++ init_labeled_script_domtrans($1,sssd_initrc_exec_t)
++')
++
++########################################
++##
++## Read sssd PID files.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`sssd_read_pid_files',`
++ gen_require(`
++ type sssd_var_run_t;
++ ')
++
++ files_search_pids($1)
++ allow $1 sssd_var_run_t:file read_file_perms;
++')
++
++########################################
++##
++## Manage sssd var_run files.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`sssd_manage_var_run',`
++ gen_require(`
++ type sssd_var_run_t;
++ ')
++
++ manage_dirs_pattern($1,sssd_var_run_t,sssd_var_run_t)
++ manage_files_pattern($1,sssd_var_run_t,sssd_var_run_t)
++ manage_lnk_files_pattern($1,sssd_var_run_t,sssd_var_run_t)
++')
++
++
++########################################
++##
++## Search sssd lib directories.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`sssd_search_lib',`
++ gen_require(`
++ type sssd_var_lib_t;
++ ')
++
++ allow $1 sssd_var_lib_t:dir search_dir_perms;
++ files_search_var_lib($1)
++')
++
++########################################
++##
++## Read sssd lib files.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`sssd_read_lib_files',`
++ gen_require(`
++ type sssd_var_lib_t;
++ ')
++
++ files_search_var_lib($1)
++ read_files_pattern($1, sssd_var_lib_t, sssd_var_lib_t)
++')
++
++########################################
++##
++## Create, read, write, and delete
++## sssd lib files.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`sssd_manage_lib_files',`
++ gen_require(`
++ type sssd_var_lib_t;
++ ')
++
++ files_search_var_lib($1)
++ manage_files_pattern($1, sssd_var_lib_t, sssd_var_lib_t)
++')
++
++########################################
++##
++## Manage sssd var_lib files.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`sssd_manage_var_lib',`
++ gen_require(`
++ type sssd_var_lib_t;
++ ')
++
++ manage_dirs_pattern($1,sssd_var_lib_t,sssd_var_lib_t)
++ manage_files_pattern($1,sssd_var_lib_t,sssd_var_lib_t)
++ manage_lnk_files_pattern($1,sssd_var_lib_t,sssd_var_lib_t)
++')
++
++
++########################################
++##
++## Send and receive messages from
++## sssd over dbus.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`sssd_dbus_chat',`
++ gen_require(`
++ type sssd_t;
++ class dbus send_msg;
++ ')
++
++ allow $1 sssd_t:dbus send_msg;
++ allow sssd_t $1:dbus send_msg;
++')
++
++
++########################################
++##
++## Connect to sssd over an unix stream socket.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`sssd_stream_connect',`
++ gen_require(`
++ type sssd_t, sssd_var_run_t;
++ ')
++
++ files_search_pids($1)
++ allow $1 sssd_var_run_t:sock_file write;
++ allow $1 sssd_t:unix_stream_socket connectto;
++')
++
++########################################
++##
++## All of the rules required to administrate
++## an sssd environment
++##
++##
++##
++## Domain allowed access.
++##
++##
++##
++##
++## The role to be allowed to manage the sssd domain.
++##
++##
++##
++##
++## The type of the user terminal.
++##
++##
++##
++#
++interface(`sssd_admin',`
++ gen_require(`
++ type sssd_t;
++ ')
++
++ allow $1 sssd_t:process { ptrace signal_perms getattr };
++ read_files_pattern($1, sssd_t, sssd_t)
++
++
++ gen_require(`
++ type sssd_initrc_exec_t;
++ ')
++
++ # Allow sssd_t to restart the apache service
++ sssd_initrc_domtrans($1)
++ domain_system_change_exemption($1)
++ role_transition $2 sssd_initrc_exec_t system_r;
++ allow $2 system_r;
++
++ sssd_manage_var_run($1)
++
++ sssd_manage_var_lib($1)
++
++')
++
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.te serefpolicy-3.6.8/policy/modules/services/sssd.te
+--- nsaserefpolicy/policy/modules/services/sssd.te 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.8/policy/modules/services/sssd.te 2009-03-09 15:47:36.000000000 -0400
+@@ -0,0 +1,55 @@
++policy_module(sssd,1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type sssd_t;
++type sssd_exec_t;
++init_daemon_domain(sssd_t, sssd_exec_t)
++
++permissive sssd_t;
++
++type sssd_initrc_exec_t;
++init_script_file(sssd_initrc_exec_t)
++
++type sssd_var_run_t;
++files_pid_file(sssd_var_run_t)
++
++type sssd_var_lib_t;
++files_type(sssd_var_lib_t)
++
++########################################
++#
++# sssd local policy
++#
++
++# Init script handling
++domain_use_interactive_fds(sssd_t)
++
++# internal communication is often done using fifo and unix sockets.
++allow sssd_t self:fifo_file rw_file_perms;
++allow sssd_t self:unix_stream_socket { create_stream_socket_perms connectto };
++
++manage_dirs_pattern(sssd_t, sssd_var_run_t, sssd_var_run_t)
++manage_files_pattern(sssd_t, sssd_var_run_t, sssd_var_run_t)
++files_pid_filetrans(sssd_t,sssd_var_run_t, { file dir })
++
++manage_dirs_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
++manage_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
++manage_sock_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
++files_var_lib_filetrans(sssd_t, sssd_var_lib_t, { file dir } )
++
++corecmd_exec_bin(sssd_t)
++
++dev_read_urand(sssd_t)
++
++files_read_etc_files(sssd_t)
++
++miscfiles_read_localization(sssd_t)
++
++optional_policy(`
++ dbus_system_bus_client(sssd_t)
++ dbus_connect_system_bus(sssd_t)
++')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stunnel.fc serefpolicy-3.6.8/policy/modules/services/stunnel.fc
--- nsaserefpolicy/policy/modules/services/stunnel.fc 2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.6.8/policy/modules/services/stunnel.fc 2009-03-07 12:11:40.000000000 -0500
@@ -22706,7 +23035,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.8/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2009-01-19 11:06:49.000000000 -0500
-+++ serefpolicy-3.6.8/policy/modules/services/xserver.te 2009-03-07 12:11:40.000000000 -0500
++++ serefpolicy-3.6.8/policy/modules/services/xserver.te 2009-03-09 16:07:15.000000000 -0400
@@ -34,6 +34,13 @@
##
@@ -23121,7 +23450,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
hostname_exec(xdm_t)
')
-@@ -542,6 +639,19 @@
+@@ -542,6 +639,23 @@
')
optional_policy(`
@@ -23130,6 +23459,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ polkit_read_reload(xdm_t)
+')
+
++optional_policy(`
++ pulseaudio_role(system_r, xdm_t)
++')
++
+# On crash gdm execs gdb to dump stack
+optional_policy(`
+ rpm_exec(xdm_t)
@@ -23141,7 +23474,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
seutil_sigchld_newrole(xdm_t)
')
-@@ -550,8 +660,9 @@
+@@ -550,8 +664,9 @@
')
optional_policy(`
@@ -23153,7 +23486,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
ifndef(`distro_redhat',`
allow xdm_t self:process { execheap execmem };
-@@ -560,7 +671,6 @@
+@@ -560,7 +675,6 @@
ifdef(`distro_rhel4',`
allow xdm_t self:process { execheap execmem };
')
@@ -23161,7 +23494,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
userhelper_dontaudit_search_config(xdm_t)
-@@ -571,6 +681,10 @@
+@@ -571,6 +685,10 @@
')
optional_policy(`
@@ -23172,7 +23505,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
xfs_stream_connect(xdm_t)
')
-@@ -587,7 +701,7 @@
+@@ -587,7 +705,7 @@
# execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack
@@ -23181,7 +23514,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dontaudit xserver_t self:capability chown;
allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow xserver_t self:memprotect mmap_zero;
-@@ -602,9 +716,11 @@
+@@ -602,9 +720,11 @@
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms;
@@ -23193,7 +23526,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow xserver_t { input_xevent_t input_xevent_type }:x_event send;
-@@ -622,7 +738,7 @@
+@@ -622,7 +742,7 @@
manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
@@ -23202,7 +23535,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
-@@ -635,9 +751,19 @@
+@@ -635,9 +755,19 @@
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t)
@@ -23222,7 +23555,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_system_state(xserver_t)
kernel_read_device_sysctls(xserver_t)
-@@ -680,9 +806,14 @@
+@@ -680,9 +810,14 @@
dev_rw_xserver_misc(xserver_t)
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev(xserver_t)
@@ -23237,7 +23570,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_read_etc_files(xserver_t)
files_read_etc_runtime_files(xserver_t)
-@@ -697,8 +828,13 @@
+@@ -697,8 +832,13 @@
fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t)
@@ -23251,7 +23584,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
selinux_validate_context(xserver_t)
selinux_compute_access_vector(xserver_t)
-@@ -720,6 +856,7 @@
+@@ -720,6 +860,7 @@
miscfiles_read_localization(xserver_t)
miscfiles_read_fonts(xserver_t)
@@ -23259,7 +23592,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
modutils_domtrans_insmod(xserver_t)
-@@ -742,7 +879,7 @@
+@@ -742,7 +883,7 @@
')
ifdef(`enable_mls',`
@@ -23268,7 +23601,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
range_transition xserver_t xserver_t:x_drawable s0 - mls_systemhigh;
')
-@@ -774,6 +911,10 @@
+@@ -774,6 +915,10 @@
')
optional_policy(`
@@ -23279,7 +23612,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
rhgb_getpgid(xserver_t)
rhgb_signal(xserver_t)
')
-@@ -806,7 +947,7 @@
+@@ -806,7 +951,7 @@
allow xserver_t xdm_var_lib_t:file { getattr read };
dontaudit xserver_t xdm_var_lib_t:dir search;
@@ -23288,7 +23621,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Label pid and temporary files with derived types.
manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
-@@ -827,9 +968,14 @@
+@@ -827,9 +972,14 @@
# to read ROLE_home_t - examine this in more detail
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
@@ -23303,7 +23636,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xserver_t)
fs_manage_nfs_files(xserver_t)
-@@ -844,11 +990,14 @@
+@@ -844,11 +994,14 @@
optional_policy(`
dbus_system_bus_client(xserver_t)
@@ -23319,7 +23652,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-@@ -856,6 +1005,11 @@
+@@ -856,6 +1009,11 @@
rhgb_rw_tmpfs_files(xserver_t)
')
@@ -23331,7 +23664,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
#
# Rules common to all X window domains
-@@ -881,6 +1035,8 @@
+@@ -881,6 +1039,8 @@
# X Server
# can read server-owned resources
allow x_domain xserver_t:x_resource read;
@@ -23340,7 +23673,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# can mess with own clients
allow x_domain self:x_client { manage destroy };
-@@ -905,6 +1061,8 @@
+@@ -905,6 +1065,8 @@
# operations allowed on my windows
allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@@ -23349,7 +23682,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# X Colormaps
# can use the default colormap
allow x_domain rootwindow_t:x_colormap { read use add_color };
-@@ -972,17 +1130,51 @@
+@@ -972,17 +1134,51 @@
allow xserver_unconfined_type { x_domain xserver_t }:x_resource *;
allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
@@ -23559,7 +23892,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.6.8/policy/modules/system/authlogin.if
--- nsaserefpolicy/policy/modules/system/authlogin.if 2008-11-11 16:13:48.000000000 -0500
-+++ serefpolicy-3.6.8/policy/modules/system/authlogin.if 2009-03-07 12:11:40.000000000 -0500
++++ serefpolicy-3.6.8/policy/modules/system/authlogin.if 2009-03-09 15:51:16.000000000 -0400
@@ -43,20 +43,38 @@
interface(`auth_login_pgm_domain',`
gen_require(`
@@ -23607,7 +23940,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
init_rw_utmp($1)
-@@ -100,9 +119,38 @@
+@@ -100,11 +119,40 @@
seutil_read_config($1)
seutil_read_default_contexts($1)
@@ -23627,9 +23960,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ optional_policy(`
+ oddjob_dbus_chat($1)
+ oddjob_domtrans_mkhomedir($1)
-+ ')
-+ ')
-+
+ ')
+ ')
+
+ optional_policy(`
+ corecmd_exec_bin($1)
+ storage_getattr_fixed_disk_dev($1)
@@ -23638,16 +23971,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+ optional_policy(`
+ nis_authenticate($1)
- ')
++ ')
+
+ optional_policy(`
+ ssh_agent_exec($1)
+ userdom_read_user_home_content_files($1)
+ ')
+
- ')
-
++')
++
########################################
+ ##
+ ## Use the login program as an entry point program.
@@ -197,8 +245,11 @@
interface(`auth_domtrans_chk_passwd',`
gen_require(`
@@ -23780,15 +24115,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
nis_use_ypbind($1)
')
-@@ -1307,6 +1413,7 @@
+@@ -1305,8 +1411,13 @@
+ ')
+
optional_policy(`
++ sssd_stream_connect($1)
++ ')
++
++ optional_policy(`
samba_stream_connect_winbind($1)
samba_read_var_files($1)
+ samba_dontaudit_write_var_files($1)
')
')
-@@ -1341,3 +1448,99 @@
+@@ -1341,3 +1452,99 @@
typeattribute $1 can_write_shadow_passwords;
typeattribute $1 can_relabelto_shadow_passwords;
')
@@ -27942,7 +28283,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.8/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-01-19 11:07:34.000000000 -0500
-+++ serefpolicy-3.6.8/policy/modules/system/userdomain.if 2009-03-07 12:36:20.000000000 -0500
++++ serefpolicy-3.6.8/policy/modules/system/userdomain.if 2009-03-09 16:06:34.000000000 -0400
@@ -30,8 +30,9 @@
')