diff --git a/policy-F16.patch b/policy-F16.patch
index 1b5e1ca..e0f0e9c 100644
--- a/policy-F16.patch
+++ b/policy-F16.patch
@@ -47,76 +47,6 @@ index 16e8b13..87925e6 100644
.EX
httpd_sys_content_ra_t
.EE
-diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors
-index 0ef9b12..bf24160 100644
---- a/policy/flask/access_vectors
-+++ b/policy/flask/access_vectors
-@@ -153,6 +153,8 @@ inherits file
- search
- rmdir
- open
-+ audit_access
-+ execmod
- }
-
- class file
-@@ -162,10 +164,16 @@ inherits file
- entrypoint
- execmod
- open
-+ audit_access
- }
-
- class lnk_file
- inherits file
-+{
-+ open
-+ audit_access
-+ execmod
-+}
-
- class chr_file
- inherits file
-@@ -174,24 +182,31 @@ inherits file
- entrypoint
- execmod
- open
-+ audit_access
- }
-
- class blk_file
- inherits file
- {
- open
-+ audit_access
-+ execmod
- }
-
- class sock_file
- inherits file
- {
- open
-+ audit_access
-+ execmod
- }
-
- class fifo_file
- inherits file
- {
- open
-+ audit_access
-+ execmod
- }
-
- class fd
-@@ -363,6 +378,7 @@ class security
- setbool
- setsecparam
- setcheckreqprot
-+ read_policy
- }
-
-
diff --git a/policy/global_booleans b/policy/global_booleans
index 111d004..9df7b5e 100644
--- a/policy/global_booleans
@@ -218,7 +148,7 @@ index 4705ab6..262b5ba 100644
+gen_tunable(allow_console_login,false)
+
diff --git a/policy/mcs b/policy/mcs
-index 358ce7c..6a0b4e8 100644
+index df8e0fa..ed7a0c1 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -69,16 +69,20 @@ gen_levels(1,mcs_num_cats)
@@ -246,19 +176,6 @@ index 358ce7c..6a0b4e8 100644
# New filesystem object labels must be dominated by the relabeling subject
# clearance, also the objects are single-level.
-@@ -86,10 +90,10 @@ mlsconstrain file { create relabelto }
- (( h1 dom h2 ) and ( l2 eq h2 ));
-
- # new file labels must be dominated by the relabeling subject clearance
--mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
-+mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file file } { relabelfrom }
- ( h1 dom h2 );
-
--mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file } { create relabelto }
-+mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file file } { create relabelto }
- (( h1 dom h2 ) and ( l2 eq h2 ));
-
- mlsconstrain process { transition dyntransition }
@@ -101,6 +105,9 @@ mlsconstrain process { ptrace }
mlsconstrain process { sigkill sigstop }
(( h1 dom h2 ) or ( t1 == mcskillall ));
@@ -567,15 +484,11 @@ index 2c2cdb6..73b3814 100644
+ role $2 types brctl_t;
+')
diff --git a/policy/modules/admin/certwatch.te b/policy/modules/admin/certwatch.te
-index 9de382b..a806715 100644
+index 6b02433..1e28e62 100644
--- a/policy/modules/admin/certwatch.te
+++ b/policy/modules/admin/certwatch.te
-@@ -31,11 +31,11 @@ auth_var_filetrans_cache(certwatch_t)
-
- logging_send_syslog_msg(certwatch_t)
-
--miscfiles_read_generic_certs(certwatch_t)
-+miscfiles_read_all_certs(certwatch_t)
+@@ -34,8 +34,8 @@ logging_send_syslog_msg(certwatch_t)
+ miscfiles_read_all_certs(certwatch_t)
miscfiles_read_localization(certwatch_t)
-userdom_use_user_terminals(certwatch_t)
@@ -1195,69 +1108,14 @@ index 0e19d80..a3a38b1 100644
netutils_domtrans_ping(mrtg_t)
-diff --git a/policy/modules/admin/ncftool.fc b/policy/modules/admin/ncftool.fc
-new file mode 100644
-index 0000000..ae4045e
---- /dev/null
-+++ b/policy/modules/admin/ncftool.fc
-@@ -0,0 +1,2 @@
-+
-+/usr/bin/ncftool -- gen_context(system_u:object_r:ncftool_exec_t,s0)
diff --git a/policy/modules/admin/ncftool.if b/policy/modules/admin/ncftool.if
-new file mode 100644
-index 0000000..8c2e044
---- /dev/null
+index 75ee31d..a28ab46 100644
+--- a/policy/modules/admin/ncftool.if
+++ b/policy/modules/admin/ncftool.if
-@@ -0,0 +1,78 @@
-+
-+## <summary>policy for ncftool</summary>
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run ncftool.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`ncftool_domtrans',`
-+ gen_require(`
-+ type ncftool_t, ncftool_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, ncftool_exec_t, ncftool_t)
-+')
-+
-+########################################
-+## <summary>
-+## Execute ncftool in the ncftool domain, and
-+## allow the specified role the ncftool domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access
-+## </summary>
-+## </param>
-+## <param name="role">
-+## <summary>
-+## The role to be allowed the ncftool domain.
-+## </summary>
-+## </param>
-+#
-+interface(`ncftool_run',`
-+ gen_require(`
-+ type ncftool_t;
-+ ')
-+
-+ ncftool_domtrans($1)
-+ role $2 types ncftool_t;
-+
-+ optional_policy(`
-+ brctl_run(ncftool_t, $2)
-+ ')
-+')
+@@ -46,3 +46,31 @@ interface(`ncftool_run',`
+ brctl_run(ncftool_t, $2)
+ ')
+ ')
+
+########################################
+## <summary>
@@ -1286,100 +1144,48 @@ index 0000000..8c2e044
+ ps_process_pattern($2, ncftool_t)
+ allow $2 ncftool_t:process signal;
+')
-+
diff --git a/policy/modules/admin/ncftool.te b/policy/modules/admin/ncftool.te
-new file mode 100644
-index 0000000..73ffa81
---- /dev/null
+index ec29391..41b58fd 100644
+--- a/policy/modules/admin/ncftool.te
+++ b/policy/modules/admin/ncftool.te
-@@ -0,0 +1,87 @@
-+policy_module(ncftool, 1.0.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+type ncftool_t;
-+type ncftool_exec_t;
-+application_domain(ncftool_t, ncftool_exec_t)
-+domain_obj_id_change_exemption(ncftool_t)
-+domain_system_change_exemption(ncftool_t)
-+role system_r types ncftool_t;
-+
-+########################################
-+#
-+# ncftool local policy
-+#
-+
-+allow ncftool_t self:capability { net_admin sys_ptrace };
+@@ -18,9 +18,13 @@ role system_r types ncftool_t;
+ #
+
+ allow ncftool_t self:capability { net_admin sys_ptrace };
+
-+allow ncftool_t self:process signal;
+ allow ncftool_t self:process signal;
+
-+allow ncftool_t self:fifo_file manage_fifo_file_perms;
-+allow ncftool_t self:unix_stream_socket create_stream_socket_perms;
+ allow ncftool_t self:fifo_file manage_fifo_file_perms;
+ allow ncftool_t self:unix_stream_socket create_stream_socket_perms;
+
+allow ncftool_t self:netlink_route_socket create_netlink_socket_perms;
-+allow ncftool_t self:tcp_socket create_stream_socket_perms;
-+
-+kernel_read_kernel_sysctls(ncftool_t)
-+kernel_read_modprobe_sysctls(ncftool_t)
-+kernel_read_network_state(ncftool_t)
-+kernel_read_system_state(ncftool_t)
-+kernel_request_load_module(ncftool_t)
-+kernel_rw_net_sysctls(ncftool_t)
-+
-+corecmd_exec_bin(ncftool_t)
-+corecmd_exec_shell(ncftool_t)
-+
-+domain_read_all_domains_state(ncftool_t)
-+
-+dev_read_sysfs(ncftool_t)
-+
+ allow ncftool_t self:tcp_socket create_stream_socket_perms;
+ allow ncftool_t self:netlink_route_socket create_netlink_socket_perms;
+
+@@ -38,10 +42,14 @@ domain_read_all_domains_state(ncftool_t)
+
+ dev_read_sysfs(ncftool_t)
+
+files_manage_system_conf_files(ncftool_t)
+files_relabelto_system_conf_files(ncftool_t)
-+files_read_etc_files(ncftool_t)
-+files_read_etc_runtime_files(ncftool_t)
-+files_read_usr_files(ncftool_t)
-+
+ files_read_etc_files(ncftool_t)
+ files_read_etc_runtime_files(ncftool_t)
+ files_read_usr_files(ncftool_t)
+
+term_use_all_inherited_terms(ncftool_t)
+
-+miscfiles_read_localization(ncftool_t)
-+
-+sysnet_delete_dhcpc_pid(ncftool_t)
-+sysnet_domtrans_dhcpc(ncftool_t)
-+sysnet_domtrans_ifconfig(ncftool_t)
-+sysnet_etc_filetrans_config(ncftool_t)
-+sysnet_manage_config(ncftool_t)
-+sysnet_read_dhcpc_state(ncftool_t)
+ miscfiles_read_localization(ncftool_t)
+
+ sysnet_delete_dhcpc_pid(ncftool_t)
+@@ -50,6 +58,8 @@ sysnet_domtrans_ifconfig(ncftool_t)
+ sysnet_etc_filetrans_config(ncftool_t)
+ sysnet_manage_config(ncftool_t)
+ sysnet_read_dhcpc_state(ncftool_t)
+sysnet_relabelfrom_net_conf(ncftool_t)
+sysnet_relabelto_net_conf(ncftool_t)
-+sysnet_read_dhcpc_pid(ncftool_t)
-+sysnet_signal_dhcpc(ncftool_t)
-+
-+userdom_read_user_tmp_files(ncftool_t)
-+
-+optional_policy(`
-+ consoletype_exec(ncftool_t)
-+')
-+
-+optional_policy(`
-+ dbus_system_bus_client(ncftool_t)
-+')
-+
-+optional_policy(`
-+ iptables_initrc_domtrans(ncftool_t)
-+')
-+
-+optional_policy(`
-+ netutils_domtrans(ncftool_t)
-+')
-+
-+optional_policy(`
-+ modutils_list_module_config(ncftool_t)
-+ modutils_read_module_config(ncftool_t)
-+ modutils_domtrans_insmod(ncftool_t)
-+')
+ sysnet_read_dhcpc_pid(ncftool_t)
+ sysnet_signal_dhcpc(ncftool_t)
+
diff --git a/policy/modules/admin/netutils.fc b/policy/modules/admin/netutils.fc
index 407078f..a818e14 100644
--- a/policy/modules/admin/netutils.fc
@@ -1541,6 +1347,46 @@ index e0791b9..373882d 100644
+ term_dontaudit_use_all_ttys(traceroute_t)
+ term_dontaudit_use_all_ptys(traceroute_t)
+')
+diff --git a/policy/modules/admin/passenger.if b/policy/modules/admin/passenger.if
+index f68b573..59ee69c 100644
+--- a/policy/modules/admin/passenger.if
++++ b/policy/modules/admin/passenger.if
+@@ -37,3 +37,25 @@ interface(`passenger_read_lib_files',`
+ read_lnk_files_pattern($1, passenger_var_lib_t, passenger_var_lib_t)
+ files_search_var_lib($1)
+ ')
++
++#####################################
++## <summary>
++## Manage passenger var_run content.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`passenger_manage_pid_content',`
++ gen_require(`
++ type passenger_var_run_t;
++ ')
++
++ files_search_pids($1)
++ manage_dirs_pattern($1, passenger_var_run_t, passenger_var_run_t)
++ manage_files_pattern($1, passenger_var_run_t, passenger_var_run_t)
++ manage_fifo_files_pattern($1, passenger_var_run_t, passenger_var_run_t)
++ manage_sock_files_pattern($1, passenger_var_run_t, passenger_var_run_t)
++')
+diff --git a/policy/modules/admin/passenger.te b/policy/modules/admin/passenger.te
+index 3470036..30e0f64 100644
+--- a/policy/modules/admin/passenger.te
++++ b/policy/modules/admin/passenger.te
+@@ -1,4 +1,4 @@
+-policy_module(passanger, 1.0.0)
++policy_module(passenger, 1.0.0)
+
+ ########################################
+ #
diff --git a/policy/modules/admin/portage.fc b/policy/modules/admin/portage.fc
index db46387..b665b08 100644
--- a/policy/modules/admin/portage.fc
@@ -1565,7 +1411,7 @@ index db46387..b665b08 100644
/usr/portage(/.*)? gen_context(system_u:object_r:portage_ebuild_t,s0)
diff --git a/policy/modules/admin/portage.if b/policy/modules/admin/portage.if
-index 8aaa46d..8714d7f 100644
+index 9a2c2a1..adde889 100644
--- a/policy/modules/admin/portage.if
+++ b/policy/modules/admin/portage.if
@@ -183,7 +183,7 @@ interface(`portage_compile_domain',`
@@ -1578,7 +1424,7 @@ index 8aaa46d..8714d7f 100644
# SELinux-enabled programs running in the sandbox
seutil_libselinux_linked($1)
diff --git a/policy/modules/admin/portage.te b/policy/modules/admin/portage.te
-index c633aea..d1e56f6 100644
+index 7f1d18e..a68d519 100644
--- a/policy/modules/admin/portage.te
+++ b/policy/modules/admin/portage.te
@@ -43,7 +43,7 @@ type portage_db_t;
@@ -1604,7 +1450,7 @@ index c633aea..d1e56f6 100644
optional_policy(`
seutil_use_newrole_fds(gcc_config_t)
-@@ -254,7 +256,7 @@ miscfiles_read_localization(portage_fetch_t)
+@@ -255,7 +257,7 @@ miscfiles_read_localization(portage_fetch_t)
sysnet_read_config(portage_fetch_t)
sysnet_dns_name_resolve(portage_fetch_t)
@@ -2349,116 +2195,45 @@ index c8ef84b..40ceffb 100644
optional_policy(`
mount_exec(sectoolm_t)
-diff --git a/policy/modules/admin/shorewall.fc b/policy/modules/admin/shorewall.fc
-index 029cb7e..48d1363 100644
---- a/policy/modules/admin/shorewall.fc
-+++ b/policy/modules/admin/shorewall.fc
-@@ -11,4 +11,6 @@
- /var/lib/shorewall6(/.*)? gen_context(system_u:object_r:shorewall_var_lib_t,s0)
- /var/lib/shorewall-lite(/.*)? gen_context(system_u:object_r:shorewall_var_lib_t,s0)
-
-+/var/lock/subsys/shorewall -- gen_context(system_u:object_r:shorewall_lock_t,s0)
-+
- /var/log/shorewall.* gen_context(system_u:object_r:shorewall_log_t,s0)
diff --git a/policy/modules/admin/shorewall.if b/policy/modules/admin/shorewall.if
-index 0948921..f198119 100644
+index 781ad7e..7ed03a3 100644
--- a/policy/modules/admin/shorewall.if
+++ b/policy/modules/admin/shorewall.if
-@@ -18,6 +18,24 @@ interface(`shorewall_domtrans',`
- domtrans_pattern($1, shorewall_exec_t, shorewall_t)
- ')
-
-+######################################
-+## <summary>
-+## Execute a domain transition to run shorewall.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`shorewall_domtrans_lib',`
-+ gen_require(`
-+ type shorewall_t, shorewall_var_lib_t;
-+ ')
-+
-+ domtrans_pattern($1, shorewall_var_lib_t, shorewall_t)
-+')
-+
- #######################################
- ## <summary>
- ## Read shorewall etc configuration files.
-@@ -117,6 +135,25 @@ interface(`shorewall_rw_lib_files',`
+@@ -98,9 +98,9 @@ interface(`shorewall_rw_pid_files',`
+ ## Read shorewall /var/lib files.
+ ## </summary>
+ ## <param name="domain">
+-## <summary>
+-## Domain allowed access.
+-## </summary>
++## <summary>
++## Domain allowed access.
++## </summary>
+ ## </param>
+ #
+ interface(`shorewall_read_lib_files',`
+@@ -115,12 +115,12 @@ interface(`shorewall_read_lib_files',`
#######################################
## <summary>
-+## Read shorewall tmp files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`shorewall_read_tmp_files',`
-+ gen_require(`
-+ type shorewall_tmp_t;
-+ ')
-+
-+ files_search_tmp($1)
-+ read_files_pattern($1, shorewall_tmp_t, shorewall_tmp_t)
-+')
-+
-+#######################################
-+## <summary>
- ## All of the rules required to administrate
- ## an shorewall environment
+-## Read and write shorewall /var/lib files.
++## Read and write shorewall /var/lib files.
## </summary>
-@@ -134,9 +171,10 @@ interface(`shorewall_rw_lib_files',`
+ ## <param name="domain">
+-## <summary>
+-## Domain allowed access.
+-## </summary>
++## <summary>
++## Domain allowed access.
++## </summary>
+ ## </param>
#
- interface(`shorewall_admin',`
- gen_require(`
-- type shorewall_t, shorewall_var_run_t, shorewall_lock_t;
-+ type shorewall_t, shorewall_lock_t;
-+ type shorewall_log_t;
- type shorewall_initrc_exec_t, shorewall_var_lib_t;
-- type shorewall_tmp_t;
-+ type shorewall_tmp_t, shorewall_etc_t;
- ')
-
- allow $1 shorewall_t:process { ptrace signal_perms };
-@@ -147,18 +185,18 @@ interface(`shorewall_admin',`
- role_transition $2 shorewall_initrc_exec_t system_r;
- allow $2 system_r;
-
-- files_search_etc($1)
-+ files_list_etc($1)
- admin_pattern($1, shorewall_etc_t)
-
-- files_search_locks($1)
-+ files_list_locks($1)
- admin_pattern($1, shorewall_lock_t)
-
-- files_search_pids($1)
-- admin_pattern($1, shorewall_var_run_t)
--
-- files_search_var_lib($1)
-+ files_list_var_lib($1)
- admin_pattern($1, shorewall_var_lib_t)
-
-- files_search_tmp($1)
-+ logging_list_logs($1)
-+ admin_pattern($1, shorewall_log_t)
-+
-+ files_list_tmp($1)
- admin_pattern($1, shorewall_tmp_t)
- ')
+ interface(`shorewall_rw_lib_files',`
diff --git a/policy/modules/admin/shorewall.te b/policy/modules/admin/shorewall.te
-index c17b6a6..8ddae98 100644
+index 95bce88..d1edd79 100644
--- a/policy/modules/admin/shorewall.te
+++ b/policy/modules/admin/shorewall.te
-@@ -58,6 +58,9 @@ exec_files_pattern(shorewall_t, shorewall_var_lib_t, shorewall_var_lib_t)
+@@ -59,6 +59,9 @@ exec_files_pattern(shorewall_t, shorewall_var_lib_t, shorewall_var_lib_t)
manage_dirs_pattern(shorewall_t, shorewall_var_lib_t, shorewall_var_lib_t)
manage_files_pattern(shorewall_t, shorewall_var_lib_t, shorewall_var_lib_t)
files_var_lib_filetrans(shorewall_t, shorewall_var_lib_t, { dir file })
@@ -2466,9 +2241,9 @@ index c17b6a6..8ddae98 100644
+
+allow shorewall_t shorewall_initrc_exec_t:file read_file_perms;
- kernel_read_kernel_sysctls(shorewall_t)
- kernel_read_network_state(shorewall_t)
-@@ -80,13 +83,20 @@ fs_getattr_all_fs(shorewall_t)
+ allow shorewall_t shorewall_initrc_exec_t:file read_file_perms;
+
+@@ -83,13 +86,20 @@ fs_getattr_all_fs(shorewall_t)
init_rw_utmp(shorewall_t)
@@ -3347,55 +3122,10 @@ index 48cf11b..9787bd4 100644
-/usr/lib(64)?/authbind/helper -- gen_context(system_u:object_r:authbind_exec_t,s0)
+/usr/lib/authbind/helper -- gen_context(system_u:object_r:authbind_exec_t,s0)
-diff --git a/policy/modules/apps/awstats.te b/policy/modules/apps/awstats.te
-index 1f42250..3d36ae2 100644
---- a/policy/modules/apps/awstats.te
-+++ b/policy/modules/apps/awstats.te
-@@ -70,6 +70,10 @@ optional_policy(`
- nscd_dontaudit_search_pid(awstats_t)
- ')
-
-+optional_policy(`
-+ squid_read_log(awstats_t)
-+')
-+
- ########################################
- #
- # awstats cgi script policy
-diff --git a/policy/modules/apps/calamaris.te b/policy/modules/apps/calamaris.te
-index 47d81d1..046a9de 100644
---- a/policy/modules/apps/calamaris.te
-+++ b/policy/modules/apps/calamaris.te
-@@ -66,8 +66,6 @@ miscfiles_read_localization(calamaris_t)
-
- userdom_dontaudit_list_user_home_dirs(calamaris_t)
-
--squid_read_log(calamaris_t)
--
- optional_policy(`
- apache_search_sys_content(calamaris_t)
- ')
-@@ -79,3 +77,7 @@ optional_policy(`
- optional_policy(`
- mta_send_mail(calamaris_t)
- ')
-+
-+optional_policy(`
-+ squid_read_log(calamaris_t)
-+')
diff --git a/policy/modules/apps/cdrecord.te b/policy/modules/apps/cdrecord.te
-index 1403835..128f634 100644
+index 46ea44f..f7183ef 100644
--- a/policy/modules/apps/cdrecord.te
+++ b/policy/modules/apps/cdrecord.te
-@@ -27,7 +27,7 @@ ubac_constrained(cdrecord_t)
- #
-
- allow cdrecord_t self:capability { ipc_lock sys_nice setuid dac_override sys_rawio };
--allow cdrecord_t self:process { getcap getsched setsched sigkill };
-+allow cdrecord_t self:process { getcap getsched setrlimit setsched sigkill };
- allow cdrecord_t self:unix_dgram_socket create_socket_perms;
- allow cdrecord_t self:unix_stream_socket create_stream_socket_perms;
-
@@ -56,7 +56,7 @@ logging_send_syslog_msg(cdrecord_t)
miscfiles_read_localization(cdrecord_t)
@@ -3668,7 +3398,7 @@ index 0000000..0fbe8cc
+ sandbox_use_ptys(chrome_sandbox_t)
+')
diff --git a/policy/modules/apps/cpufreqselector.te b/policy/modules/apps/cpufreqselector.te
-index e51e7f5..8e0405f 100644
+index 37475dd..7db4a01 100644
--- a/policy/modules/apps/cpufreqselector.te
+++ b/policy/modules/apps/cpufreqselector.te
@@ -17,6 +17,7 @@ application_domain(cpufreqselector_t, cpufreqselector_exec_t)
@@ -5941,7 +5671,7 @@ index 4f9dc90..8dc8a5f 100644
+ relabel_lnk_files_pattern($2, irssi_home_t, irssi_home_t)
')
diff --git a/policy/modules/apps/irc.te b/policy/modules/apps/irc.te
-index 66beb80..9c45e44 100644
+index 66beb80..702a727 100644
--- a/policy/modules/apps/irc.te
+++ b/policy/modules/apps/irc.te
@@ -24,6 +24,30 @@ userdom_user_home_content(irc_tmp_t)
@@ -5984,7 +5714,7 @@ index 66beb80..9c45e44 100644
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(irc_t)
-@@ -101,3 +125,76 @@ tunable_policy(`use_samba_home_dirs',`
+@@ -101,3 +125,73 @@ tunable_policy(`use_samba_home_dirs',`
optional_policy(`
nis_use_ypbind(irc_t)
')
@@ -5997,7 +5727,6 @@ index 66beb80..9c45e44 100644
+allow irssi_t self:process { signal sigkill };
+allow irssi_t self:fifo_file rw_fifo_file_perms;
+allow irssi_t self:tcp_socket create_stream_socket_perms;
-+allow irssi_t self:udp_socket create_socket_perms;
+
+read_files_pattern(irssi_t, irssi_etc_t, irssi_etc_t)
+
@@ -6007,28 +5736,26 @@ index 66beb80..9c45e44 100644
+userdom_user_home_dir_filetrans(irssi_t, irssi_home_t, { dir file lnk_file })
+userdom_search_user_home_dirs(irssi_t)
+
++kernel_read_system_state(irssi_t)
++
+corecmd_search_bin(irssi_t)
+corecmd_read_bin_symlinks(irssi_t)
+
+corenet_tcp_connect_ircd_port(irssi_t)
++corenet_tcp_sendrecv_ircd_port(irssi_t)
+corenet_sendrecv_ircd_client_packets(irssi_t)
+
+# Privoxy
+corenet_tcp_connect_http_cache_port(irssi_t)
++corenet_tcp_sendrecv_http_cache_port(irssi_t)
+corenet_sendrecv_http_cache_client_packets(irssi_t)
+
-+corenet_all_recvfrom_netlabel(irssi_t)
-+corenet_all_recvfrom_unlabeled(irssi_t)
-+corenet_tcp_sendrecv_generic_if(irssi_t)
-+corenet_tcp_sendrecv_generic_node(irssi_t)
-+corenet_tcp_sendrecv_generic_port(irssi_t)
+corenet_tcp_bind_generic_node(irssi_t)
+
+dev_read_urand(irssi_t)
+# irssi-otr genkey.
+dev_read_rand(irssi_t)
+
-+files_read_etc_files(irssi_t)
+files_read_usr_files(irssi_t)
+
+fs_search_auto_mountpoints(irssi_t)
@@ -6259,36 +5986,10 @@ index 0000000..bb02f40
+')
+
diff --git a/policy/modules/apps/kdumpgui.te b/policy/modules/apps/kdumpgui.te
-index f63c4c2..bf59895 100644
+index 2dde73a..12281bb 100644
--- a/policy/modules/apps/kdumpgui.te
+++ b/policy/modules/apps/kdumpgui.te
-@@ -14,6 +14,7 @@ dbus_system_domain(kdumpgui_t, kdumpgui_exec_t)
- # system-config-kdump local policy
- #
-
-+allow kdumpgui_t self:capability { net_admin sys_admin sys_rawio };
- allow kdumpgui_t self:fifo_file rw_fifo_file_perms;
- allow kdumpgui_t self:netlink_kobject_uevent_socket create_socket_perms;
-
-@@ -33,27 +34,38 @@ files_manage_etc_symlinks(kdumpgui_t)
- # for blkid.tab
- files_manage_etc_runtime_files(kdumpgui_t)
- files_etc_filetrans_etc_runtime(kdumpgui_t, file)
-+files_read_usr_files(kdumpgui_t)
-
- storage_raw_read_fixed_disk(kdumpgui_t)
- storage_raw_write_fixed_disk(kdumpgui_t)
-
- auth_use_nsswitch(kdumpgui_t)
-
--consoletype_exec(kdumpgui_t)
--
--kdump_manage_config(kdumpgui_t)
--kdump_initrc_domtrans(kdumpgui_t)
--
- logging_send_syslog_msg(kdumpgui_t)
-
- miscfiles_read_localization(kdumpgui_t)
+@@ -47,6 +47,12 @@ miscfiles_read_localization(kdumpgui_t)
init_dontaudit_read_all_script_files(kdumpgui_t)
@@ -6299,23 +6000,10 @@ index f63c4c2..bf59895 100644
+')
+
optional_policy(`
- dev_rw_lvm_control(kdumpgui_t)
- ')
-
- optional_policy(`
-+ gnome_dontaudit_search_config(kdumpgui_t)
-+')
-+
-+optional_policy(`
-+ kdump_manage_config(kdumpgui_t)
-+ kdump_initrc_domtrans(kdumpgui_t)
-+')
-+
-+optional_policy(`
- policykit_dbus_chat(kdumpgui_t)
+ consoletype_exec(kdumpgui_t)
')
diff --git a/policy/modules/apps/livecd.if b/policy/modules/apps/livecd.if
-index 12b772f..1d203dc 100644
+index b2e27ec..1d203dc 100644
--- a/policy/modules/apps/livecd.if
+++ b/policy/modules/apps/livecd.if
@@ -41,6 +41,8 @@ interface(`livecd_run',`
@@ -6352,17 +6040,8 @@ index 12b772f..1d203dc 100644
## Read livecd temporary files.
## </summary>
## <param name="domain">
-@@ -82,7 +102,7 @@ interface(`livecd_rw_tmp_files',`
- ')
-
- files_search_tmp($1)
-- allow $1 livecd_tmp_t:file rw_file_perms;
-+ rw_files_pattern($1, livecd_tmp_t, livecd_tmp_t)
- ')
-
- ########################################
diff --git a/policy/modules/apps/livecd.te b/policy/modules/apps/livecd.te
-index 49abe8e..47a193c 100644
+index a0be4ef..ae36a3f 100644
--- a/policy/modules/apps/livecd.te
+++ b/policy/modules/apps/livecd.te
@@ -27,7 +27,7 @@ manage_files_pattern(livecd_t, livecd_tmp_t, livecd_tmp_t)
@@ -6408,107 +6087,6 @@ index 0bac996..ca2388d 100644
-userdom_use_user_terminals(lockdev_t)
+userdom_use_inherited_user_terminals(lockdev_t)
-diff --git a/policy/modules/apps/mediawiki.fc b/policy/modules/apps/mediawiki.fc
-new file mode 100644
-index 0000000..d56fd69
---- /dev/null
-+++ b/policy/modules/apps/mediawiki.fc
-@@ -0,0 +1,10 @@
-+
-+/usr/lib/mediawiki/math/texvc -- gen_context(system_u:object_r:httpd_mediawiki_script_exec_t,s0)
-+/usr/lib/mediawiki/math/texvc_tex -- gen_context(system_u:object_r:httpd_mediawiki_script_exec_t,s0)
-+/usr/lib/mediawiki/math/texvc_tes -- gen_context(system_u:object_r:httpd_mediawiki_script_exec_t,s0)
-+
-+/var/www/wiki(/.*)? gen_context(system_u:object_r:httpd_mediawiki_rw_content_t,s0)
-+
-+/var/www/wiki/.*\.php -- gen_context(system_u:object_r:httpd_mediawiki_content_t,s0)
-+
-+/usr/share/mediawiki(/.*)? gen_context(system_u:object_r:httpd_mediawiki_content_t,s0)
-diff --git a/policy/modules/apps/mediawiki.if b/policy/modules/apps/mediawiki.if
-new file mode 100644
-index 0000000..1c1d012
---- /dev/null
-+++ b/policy/modules/apps/mediawiki.if
-@@ -0,0 +1,40 @@
-+## <summary>Mediawiki policy</summary>
-+
-+#######################################
-+## <summary>
-+## Allow the specified domain to read
-+## mediawiki tmp files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`mediawiki_read_tmp_files',`
-+ gen_require(`
-+ type httpd_mediawiki_tmp_t;
-+ ')
-+
-+ files_search_tmp($1)
-+ read_files_pattern($1, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t)
-+ read_lnk_files_pattern($1, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t)
-+')
-+
-+#######################################
-+## <summary>
-+## Delete mediawiki tmp files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`mediawiki_delete_tmp_files',`
-+ gen_require(`
-+ type httpd_mediawiki_tmp_t;
-+ ')
-+
-+ delete_files_pattern($1, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t)
-+')
-diff --git a/policy/modules/apps/mediawiki.te b/policy/modules/apps/mediawiki.te
-new file mode 100644
-index 0000000..d9e51a3
---- /dev/null
-+++ b/policy/modules/apps/mediawiki.te
-@@ -0,0 +1,33 @@
-+
-+policy_module(mediawiki, 1.0.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+apache_content_template(mediawiki)
-+
-+type httpd_mediawiki_tmp_t;
-+files_tmp_file(httpd_mediawiki_tmp_t)
-+
-+########################################
-+#
-+# mediawiki local policy
-+#
-+
-+manage_dirs_pattern(httpd_mediawiki_script_t, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t)
-+manage_files_pattern(httpd_mediawiki_script_t, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t)
-+manage_lnk_files_pattern(httpd_mediawiki_script_t, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t)
-+files_tmp_filetrans(httpd_mediawiki_script_t, httpd_mediawiki_tmp_t, { file dir lnk_file })
-+
-+files_search_var_lib(httpd_mediawiki_script_t)
-+
-+userdom_read_user_tmp_files(httpd_mediawiki_script_t)
-+
-+miscfiles_read_tetex_data(httpd_mediawiki_script_t)
-+
-+optional_policy(`
-+ apache_dontaudit_rw_tmp_files(httpd_mediawiki_script_t)
-+')
-+
diff --git a/policy/modules/apps/mono.if b/policy/modules/apps/mono.if
index 7b08e13..515a88a 100644
--- a/policy/modules/apps/mono.if
@@ -6573,7 +6151,7 @@ index 93ac529..35b51ab 100644
+/usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0)
+/usr/lib/xulrunner[^/]*/plugin-container -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if
-index 9a6d67d..319aac2 100644
+index fbb5c5a..90c34fa 100644
--- a/policy/modules/apps/mozilla.if
+++ b/policy/modules/apps/mozilla.if
@@ -29,6 +29,8 @@ interface(`mozilla_role',`
@@ -6585,8 +6163,8 @@ index 9a6d67d..319aac2 100644
# Allow the user domain to signal/ps.
ps_process_pattern($2, mozilla_t)
allow $2 mozilla_t:process signal_perms;
-@@ -48,8 +50,16 @@ interface(`mozilla_role',`
-
+@@ -49,8 +51,16 @@ interface(`mozilla_role',`
+ mozilla_run_plugin(mozilla_t, $1)
mozilla_dbus_chat($2)
+ userdom_manage_tmp_role($1, mozilla_t)
@@ -6602,7 +6180,7 @@ index 9a6d67d..319aac2 100644
')
')
-@@ -108,7 +118,7 @@ interface(`mozilla_dontaudit_rw_user_home_files',`
+@@ -109,7 +119,7 @@ interface(`mozilla_dontaudit_rw_user_home_files',`
type mozilla_home_t;
')
@@ -6611,185 +6189,105 @@ index 9a6d67d..319aac2 100644
')
########################################
-@@ -132,6 +142,24 @@ interface(`mozilla_dontaudit_manage_user_home_files',`
+@@ -228,6 +238,29 @@ interface(`mozilla_run_plugin',`
- ########################################
- ## <summary>
-+## Execute mozilla home directory content.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`mozilla_execute_user_home_files',`
-+ gen_require(`
-+ type mozilla_home_t;
-+ ')
-+
-+ can_exec($1, mozilla_home_t)
-+')
-+
-+########################################
-+## <summary>
- ## Execmod mozilla home directory content.
- ## </summary>
- ## <param name="domain">
-@@ -168,6 +196,82 @@ interface(`mozilla_domtrans',`
-
- ########################################
- ## <summary>
-+## Execute a domain transition to run mozilla_plugin.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`mozilla_domtrans_plugin',`
-+ gen_require(`
-+ type mozilla_plugin_t, mozilla_plugin_exec_t;
-+ class dbus send_msg;
-+ ')
-+
-+ domtrans_pattern($1, mozilla_plugin_exec_t, mozilla_plugin_t)
-+ allow mozilla_plugin_t $1:process signull;
-+
-+ ps_process_pattern($1, mozilla_plugin_t)
-+ allow $1 mozilla_plugin_t:process { ptrace signal_perms };
-+
-+ allow $1 mozilla_plugin_t:dbus send_msg;
-+ allow mozilla_plugin_t $1:dbus send_msg;
-+
-+ allow $1 mozilla_plugin_t:fd use;
-+')
-+
-+
-+########################################
-+## <summary>
-+## Execute mozilla_plugin in the mozilla_plugin domain, and
-+## allow the specified role the mozilla_plugin domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access
-+## </summary>
-+## </param>
-+## <param name="role">
-+## <summary>
-+## The role to be allowed the mozilla_plugin domain.
-+## </summary>
-+## </param>
-+#
-+interface(`mozilla_run_plugin',`
-+ gen_require(`
-+ type mozilla_plugin_t;
-+ ')
-+
-+ mozilla_domtrans_plugin($1)
-+ role $2 types mozilla_plugin_t;
+ mozilla_domtrans_plugin($1)
+ role $2 types mozilla_plugin_t;
+
+ allow $1 mozilla_plugin_t:unix_stream_socket { connectto rw_socket_perms };
+
+ allow mozilla_plugin_t $1:unix_stream_socket rw_socket_perms;
+')
+
-+########################################
++#######################################
+## <summary>
-+## Execute qemu unconfined programs in the role.
++## Execute qemu unconfined programs in the role.
+## </summary>
+## <param name="role">
-+## <summary>
-+## The role to allow the mozilla_plugin domain.
-+## </summary>
++## <summary>
++## The role to allow the mozilla_plugin domain.
++## </summary>
+## </param>
++## <rolecap/>
+#
+interface(`mozilla_role_plugin',`
-+ gen_require(`
-+ type mozilla_plugin_t;
-+ ')
-+
-+ role $1 types mozilla_plugin_t;
-+')
++ gen_require(`
++ type mozilla_plugin_t;
++ ')
+
-+########################################
-+## <summary>
- ## Send and receive messages from
- ## mozilla over dbus.
- ## </summary>
-@@ -204,3 +308,57 @@ interface(`mozilla_rw_tcp_sockets',`
++ role $1 types mozilla_plugin_t;
+ ')
+ ########################################
+@@ -269,9 +302,27 @@ interface(`mozilla_rw_tcp_sockets',`
allow $1 mozilla_t:tcp_socket rw_socket_perms;
')
-+
-+########################################
-+## <summary>
-+## Delete mozilla_plugin tmpfs files
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access
-+## </summary>
-+## </param>
-+#
-+interface(`mozilla_plugin_delete_tmpfs_files',`
-+ gen_require(`
-+ type mozilla_plugin_tmpfs_t;
-+ ')
-+
-+ allow $1 mozilla_plugin_tmpfs_t:file delete_file_perms;
-+')
-+
-+########################################
+
++#######################################
+## <summary>
-+## Read mozilla_plugin tmpfs files
++## Read mozilla_plugin tmpfs files
+## </summary>
+## <param name="domain">
-+## <summary>
-+## Domain allowed access
-+## </summary>
++## <summary>
++## Domain allowed access
++## </summary>
+## </param>
+#
+interface(`mozilla_plugin_read_tmpfs_files',`
-+ gen_require(`
-+ type mozilla_plugin_tmpfs_t;
-+ ')
++ gen_require(`
++ type mozilla_plugin_tmpfs_t;
++ ')
+
-+ allow $1 mozilla_plugin_tmpfs_t:file read_file_perms;
++ allow $1 mozilla_plugin_tmpfs_t:file read_file_perms;
+')
+
-+########################################
-+## <summary>
+ ########################################
+ ## <summary>
+-## Read mozilla_plugin tmpfs files
++## Delete mozilla_plugin tmpfs files
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -279,28 +330,28 @@ interface(`mozilla_rw_tcp_sockets',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`mozilla_plugin_read_tmpfs_files',`
++interface(`mozilla_plugin_delete_tmpfs_files',`
+ gen_require(`
+ type mozilla_plugin_tmpfs_t;
+ ')
+
+- allow $1 mozilla_plugin_tmpfs_t:file read_file_perms;
++ allow $1 mozilla_plugin_tmpfs_t:file delete_file_perms;
+ ')
+
+ ########################################
+ ## <summary>
+-## Delete mozilla_plugin tmpfs files
+## Dontaudit read/write to a mozilla_plugin leaks
-+## </summary>
-+## <param name="domain">
-+## <summary>
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain allowed access
+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## </param>
+ #
+-interface(`mozilla_plugin_delete_tmpfs_files',`
+interface(`mozilla_plugin_dontaudit_leaks',`
-+ gen_require(`
+ gen_require(`
+- type mozilla_plugin_tmpfs_t;
+ type mozilla_plugin_t;
-+ ')
-+
+ ')
+
+- allow $1 mozilla_plugin_tmpfs_t:file unlink;
+ dontaudit $1 mozilla_plugin_t:unix_stream_socket { read write };
-+')
+ ')
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
-index 2a91fa8..50e279c 100644
+index 2e9318b..456b38e 100644
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
-@@ -7,7 +7,7 @@ policy_module(mozilla, 2.3.0)
-
- ## <desc>
- ## <p>
--## Control mozilla content access
-+## allow confined web browsers to read home directory content
- ## </p>
- ## </desc>
- gen_tunable(mozilla_read_content, false)
@@ -25,6 +25,7 @@ files_config_file(mozilla_conf_t)
type mozilla_home_t;
typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t };
@@ -6797,47 +6295,29 @@ index 2a91fa8..50e279c 100644
+files_poly_member(mozilla_home_t)
userdom_user_home_content(mozilla_home_t)
- type mozilla_tmpfs_t;
-@@ -33,6 +34,17 @@ typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_
- files_tmpfs_file(mozilla_tmpfs_t)
- ubac_constrained(mozilla_tmpfs_t)
+ type mozilla_plugin_t;
+@@ -33,10 +34,12 @@ application_domain(mozilla_plugin_t, mozilla_plugin_exec_t)
+ role system_r types mozilla_plugin_t;
-+type mozilla_plugin_t;
-+type mozilla_plugin_exec_t;
-+application_domain(mozilla_plugin_t, mozilla_plugin_exec_t)
-+role system_r types mozilla_plugin_t;
-+
-+type mozilla_plugin_tmp_t;
+ type mozilla_plugin_tmp_t;
+userdom_user_tmp_content(mozilla_plugin_tmp_t)
-+
-+type mozilla_plugin_tmpfs_t;
+ files_tmp_file(mozilla_plugin_tmp_t)
+ ubac_constrained(mozilla_plugin_tmp_t)
+
+ type mozilla_plugin_tmpfs_t;
+userdom_user_tmpfs_content(mozilla_plugin_tmpfs_t)
-+
- ########################################
- #
- # Local policy
-@@ -89,16 +101,20 @@ corenet_tcp_sendrecv_generic_node(mozilla_t)
- corenet_raw_sendrecv_generic_node(mozilla_t)
+ files_tmpfs_file(mozilla_plugin_tmpfs_t)
+ ubac_constrained(mozilla_plugin_tmpfs_t)
+
+@@ -111,6 +114,7 @@ corenet_raw_sendrecv_generic_node(mozilla_t)
corenet_tcp_sendrecv_http_port(mozilla_t)
corenet_tcp_sendrecv_http_cache_port(mozilla_t)
-+corenet_tcp_sendrecv_squid_port(mozilla_t)
+ corenet_tcp_sendrecv_squid_port(mozilla_t)
+corenet_tcp_connect_flash_port(mozilla_t)
corenet_tcp_sendrecv_ftp_port(mozilla_t)
corenet_tcp_sendrecv_ipp_port(mozilla_t)
corenet_tcp_connect_http_port(mozilla_t)
- corenet_tcp_connect_http_cache_port(mozilla_t)
-+corenet_tcp_connect_squid_port(mozilla_t)
- corenet_tcp_connect_ftp_port(mozilla_t)
- corenet_tcp_connect_ipp_port(mozilla_t)
- corenet_tcp_connect_generic_port(mozilla_t)
- corenet_tcp_connect_soundd_port(mozilla_t)
- corenet_sendrecv_http_client_packets(mozilla_t)
- corenet_sendrecv_http_cache_client_packets(mozilla_t)
-+corenet_sendrecv_squid_client_packets(mozilla_t)
- corenet_sendrecv_ftp_client_packets(mozilla_t)
- corenet_sendrecv_ipp_client_packets(mozilla_t)
- corenet_sendrecv_generic_client_packets(mozilla_t)
-@@ -141,7 +157,7 @@ miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t)
+@@ -165,7 +169,7 @@ miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t)
# Browse the web, connect to printer
sysnet_dns_name_resolve(mozilla_t)
@@ -6846,7 +6326,7 @@ index 2a91fa8..50e279c 100644
xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
-@@ -238,6 +254,7 @@ optional_policy(`
+@@ -262,6 +266,7 @@ optional_policy(`
optional_policy(`
gnome_stream_connect_gconf(mozilla_t)
gnome_manage_config(mozilla_t)
@@ -6854,7 +6334,7 @@ index 2a91fa8..50e279c 100644
')
optional_policy(`
-@@ -258,6 +275,11 @@ optional_policy(`
+@@ -282,6 +287,11 @@ optional_policy(`
')
optional_policy(`
@@ -6866,171 +6346,102 @@ index 2a91fa8..50e279c 100644
pulseaudio_exec(mozilla_t)
pulseaudio_stream_connect(mozilla_t)
pulseaudio_manage_home_files(mozilla_t)
-@@ -266,3 +288,214 @@ optional_policy(`
- optional_policy(`
- thunderbird_domtrans(mozilla_t)
- ')
-+
-+########################################
-+#
-+# mozilla_plugin local policy
-+#
-+
-+dontaudit mozilla_plugin_t self:capability { sys_ptrace };
+@@ -297,15 +307,18 @@ optional_policy(`
+ #
+
+ dontaudit mozilla_plugin_t self:capability { sys_ptrace };
+
-+allow mozilla_plugin_t self:process { setsched signal_perms execmem };
+ allow mozilla_plugin_t self:process { setsched signal_perms execmem };
+-allow mozilla_plugin_t self:fifo_file manage_fifo_file_perms;
+-allow mozilla_plugin_t self:unix_stream_socket { connectto create_stream_socket_perms };
+allow mozilla_plugin_t self:netlink_route_socket r_netlink_socket_perms;
-+allow mozilla_plugin_t self:tcp_socket create_stream_socket_perms;
-+allow mozilla_plugin_t self:udp_socket create_socket_perms;
-+allow mozilla_plugin_t self:netlink_kobject_uevent_socket create_socket_perms;
+ allow mozilla_plugin_t self:tcp_socket create_stream_socket_perms;
+ allow mozilla_plugin_t self:udp_socket create_socket_perms;
+-allow mozilla_plugin_t self:netlink_route_socket r_netlink_socket_perms;
+ allow mozilla_plugin_t self:netlink_kobject_uevent_socket create_socket_perms;
+
-+allow mozilla_plugin_t self:sem create_sem_perms;
-+allow mozilla_plugin_t self:shm create_shm_perms;
+ allow mozilla_plugin_t self:sem create_sem_perms;
+ allow mozilla_plugin_t self:shm create_shm_perms;
+allow mozilla_plugin_t self:fifo_file manage_fifo_file_perms;
+allow mozilla_plugin_t self:unix_dgram_socket sendto;
+allow mozilla_plugin_t self:unix_stream_socket { connectto create_stream_socket_perms };
-+
-+can_exec(mozilla_plugin_t, mozilla_home_t)
-+read_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
-+
-+manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
-+manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
-+manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
+
+ can_exec(mozilla_plugin_t, mozilla_home_t)
+ read_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
+@@ -313,8 +326,10 @@ read_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
+ manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
+ manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
+ manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
+-files_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file })
+-userdom_user_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file })
+manage_sock_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
+files_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file sock_file })
+userdom_user_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file sock_file })
+can_exec(mozilla_plugin_t, mozilla_plugin_tmp_t)
-+
-+manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
-+manage_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
-+manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
-+manage_sock_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
-+fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file lnk_file sock_file fifo_file })
-+
-+can_exec(mozilla_plugin_t, mozilla_exec_t)
-+
-+kernel_read_kernel_sysctls(mozilla_plugin_t)
-+kernel_read_system_state(mozilla_plugin_t)
-+kernel_read_network_state(mozilla_plugin_t)
-+kernel_request_load_module(mozilla_plugin_t)
-+
-+corecmd_exec_bin(mozilla_plugin_t)
-+corecmd_exec_shell(mozilla_plugin_t)
-+
-+corenet_tcp_connect_generic_port(mozilla_plugin_t)
+
+ manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
+ manage_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
+@@ -332,11 +347,9 @@ kernel_request_load_module(mozilla_plugin_t)
+ corecmd_exec_bin(mozilla_plugin_t)
+ corecmd_exec_shell(mozilla_plugin_t)
+
+-corenet_all_recvfrom_netlabel(mozilla_plugin_t)
+-corenet_all_recvfrom_unlabeled(mozilla_plugin_t)
+-corenet_tcp_sendrecv_generic_if(mozilla_plugin_t)
+-corenet_tcp_sendrecv_generic_node(mozilla_plugin_t)
+ corenet_tcp_connect_generic_port(mozilla_plugin_t)
+corenet_tcp_connect_flash_port(mozilla_plugin_t)
+corenet_tcp_connect_streaming_port(mozilla_plugin_t)
-+corenet_tcp_connect_pulseaudio_port(mozilla_plugin_t)
-+corenet_tcp_connect_http_port(mozilla_plugin_t)
-+corenet_tcp_connect_http_cache_port(mozilla_plugin_t)
-+corenet_tcp_connect_squid_port(mozilla_plugin_t)
-+corenet_tcp_connect_ipp_port(mozilla_plugin_t)
-+corenet_tcp_connect_mmcc_port(mozilla_plugin_t)
-+corenet_tcp_connect_speech_port(mozilla_plugin_t)
+ corenet_tcp_connect_pulseaudio_port(mozilla_plugin_t)
+ corenet_tcp_connect_http_port(mozilla_plugin_t)
+ corenet_tcp_connect_http_cache_port(mozilla_plugin_t)
+@@ -344,6 +357,9 @@ corenet_tcp_connect_squid_port(mozilla_plugin_t)
+ corenet_tcp_connect_ipp_port(mozilla_plugin_t)
+ corenet_tcp_connect_mmcc_port(mozilla_plugin_t)
+ corenet_tcp_connect_speech_port(mozilla_plugin_t)
+corenet_tcp_connect_streaming_port(mozilla_plugin_t)
+corenet_tcp_bind_generic_node(mozilla_plugin_t)
+corenet_udp_bind_generic_node(mozilla_plugin_t)
-+
-+dev_read_rand(mozilla_plugin_t)
-+dev_read_urand(mozilla_plugin_t)
-+dev_read_video_dev(mozilla_plugin_t)
-+dev_write_video_dev(mozilla_plugin_t)
-+dev_read_sysfs(mozilla_plugin_t)
-+dev_read_sound(mozilla_plugin_t)
-+dev_write_sound(mozilla_plugin_t)
-+# for nvidia driver
-+dev_rw_xserver_misc(mozilla_plugin_t)
-+dev_dontaudit_rw_dri(mozilla_plugin_t)
-+
-+domain_use_interactive_fds(mozilla_plugin_t)
-+domain_dontaudit_read_all_domains_state(mozilla_plugin_t)
-+
-+files_read_config_files(mozilla_plugin_t)
-+files_read_usr_files(mozilla_plugin_t)
-+files_list_mnt(mozilla_plugin_t)
-+
-+fs_getattr_all_fs(mozilla_plugin_t)
-+fs_list_dos_dirs(mozilla_plugin_t)
-+fs_read_dos_files(mozilla_plugin_t)
-+
-+application_dontaudit_signull(mozilla_plugin_t)
-+
-+auth_use_nsswitch(mozilla_plugin_t)
-+
-+logging_send_syslog_msg(mozilla_plugin_t)
-+
-+miscfiles_read_localization(mozilla_plugin_t)
-+miscfiles_read_fonts(mozilla_plugin_t)
-+miscfiles_read_generic_certs(mozilla_plugin_t)
-+miscfiles_dontaudit_setattr_fonts_dirs(mozilla_plugin_t)
-+miscfiles_dontaudit_setattr_fonts_cache_dirs(mozilla_plugin_t)
-+
-+sysnet_dns_name_resolve(mozilla_plugin_t)
-+
-+term_getattr_all_ttys(mozilla_plugin_t)
-+term_getattr_all_ptys(mozilla_plugin_t)
-+
-+userdom_rw_user_tmpfs_files(mozilla_plugin_t)
+
+ dev_read_rand(mozilla_plugin_t)
+ dev_read_urand(mozilla_plugin_t)
+@@ -385,13 +401,19 @@ term_getattr_all_ttys(mozilla_plugin_t)
+ term_getattr_all_ptys(mozilla_plugin_t)
+
+ userdom_rw_user_tmpfs_files(mozilla_plugin_t)
+userdom_delete_user_tmpfs_files(mozilla_plugin_t)
+ userdom_dontaudit_use_user_terminals(mozilla_plugin_t)
+ userdom_manage_user_tmp_sockets(mozilla_plugin_t)
+ userdom_manage_user_tmp_dirs(mozilla_plugin_t)
+ userdom_read_user_tmp_files(mozilla_plugin_t)
+ userdom_read_user_tmp_symlinks(mozilla_plugin_t)
+userdom_stream_connect(mozilla_plugin_t)
-+userdom_dontaudit_use_user_ptys(mozilla_plugin_t)
-+userdom_dontaudit_use_user_terminals(mozilla_plugin_t)
-+userdom_manage_user_tmp_sockets(mozilla_plugin_t)
+userdom_dontaudit_rw_user_tmp_pipes(mozilla_plugin_t)
+
-+userdom_list_user_tmp(mozilla_plugin_t)
-+userdom_manage_user_tmp_dirs(mozilla_plugin_t)
-+userdom_read_user_tmp_files(mozilla_plugin_t)
-+userdom_read_user_tmp_symlinks(mozilla_plugin_t)
-+userdom_read_user_home_content_files(mozilla_plugin_t)
-+userdom_read_user_home_content_files(mozilla_plugin_t)
-+userdom_read_user_home_content_symlinks(mozilla_plugin_t)
+ userdom_read_user_home_content_files(mozilla_plugin_t)
+ userdom_read_user_home_content_symlinks(mozilla_plugin_t)
+userdom_read_home_certs(mozilla_plugin_t)
+userdom_dontaudit_write_home_certs(mozilla_plugin_t)
-+
-+tunable_policy(`allow_execmem',`
-+ allow mozilla_plugin_t self:process { execmem execstack };
-+')
-+
-+tunable_policy(`allow_execstack',`
-+ allow mozilla_plugin_t self:process { execstack };
-+')
-+
-+optional_policy(`
-+ alsa_read_rw_config(mozilla_plugin_t)
-+ alsa_read_home_files(mozilla_plugin_t)
-+')
-+
-+optional_policy(`
-+ consolekit_dbus_chat(mozilla_plugin_t)
-+')
-+
-+optional_policy(`
-+ dbus_connect_session_bus(mozilla_plugin_t)
-+ dbus_system_bus_client(mozilla_plugin_t)
-+ dbus_session_bus_client(mozilla_plugin_t)
-+ dbus_read_lib_files(mozilla_plugin_t)
-+')
-+
-+optional_policy(`
-+ git_dontaudit_read_session_content_files(mozilla_plugin_t)
-+')
-+
-+optional_policy(`
-+ gnome_manage_config(mozilla_plugin_t)
-+ gnome_setattr_home_config(mozilla_plugin_t)
-+')
-+
-+optional_policy(`
-+ java_exec(mozilla_plugin_t)
+
+ tunable_policy(`allow_execmem',`
+ allow mozilla_plugin_t self:process { execmem execstack };
+@@ -425,6 +447,11 @@ optional_policy(`
+ ')
+
+ optional_policy(`
++ git_dontaudit_read_session_content_files(mozilla_plugin_t)
+')
+
-+optional_policy(`
-+ mplayer_exec(mozilla_plugin_t)
-+ mplayer_read_user_home_files(mozilla_plugin_t)
-+')
+
+optional_policy(`
+ gnome_manage_config(mozilla_plugin_t)
+ ')
+
+@@ -438,7 +465,14 @@ optional_policy(`
+ ')
+
+ optional_policy(`
+- pcscd_stream_connect(mozilla_plugin_t)
+ nsplugin_domtrans(mozilla_plugin_t)
+ nsplugin_rw_exec(mozilla_plugin_t)
+ nsplugin_manage_home_dirs(mozilla_plugin_t)
@@ -7039,13 +6450,13 @@ index 2a91fa8..50e279c 100644
+ nsplugin_user_home_filetrans(mozilla_plugin_t, file)
+ nsplugin_read_rw_files(mozilla_plugin_t);
+ nsplugin_signal(mozilla_plugin_t)
-+')
-+
-+optional_policy(`
-+ pulseaudio_exec(mozilla_plugin_t)
-+ pulseaudio_stream_connect(mozilla_plugin_t)
-+ pulseaudio_setattr_home_dir(mozilla_plugin_t)
-+ pulseaudio_manage_home_files(mozilla_plugin_t)
+ ')
+
+ optional_policy(`
+@@ -446,10 +480,27 @@ optional_policy(`
+ pulseaudio_stream_connect(mozilla_plugin_t)
+ pulseaudio_setattr_home_dir(mozilla_plugin_t)
+ pulseaudio_manage_home_files(mozilla_plugin_t)
+ pulseaudio_manage_home_symlinks(mozilla_plugin_t)
+')
+
@@ -7059,28 +6470,17 @@ index 2a91fa8..50e279c 100644
+
+optional_policy(`
+ udev_read_db(mozilla_plugin_t)
-+')
-+
-+optional_policy(`
-+ xserver_read_xdm_pid(mozilla_plugin_t)
-+ xserver_stream_connect(mozilla_plugin_t)
-+ xserver_use_user_fonts(mozilla_plugin_t)
+ ')
+
+ optional_policy(`
+ xserver_read_xdm_pid(mozilla_plugin_t)
+ xserver_stream_connect(mozilla_plugin_t)
+ xserver_use_user_fonts(mozilla_plugin_t)
+ xserver_read_user_iceauth(mozilla_plugin_t)
+ xserver_read_user_xauth(mozilla_plugin_t)
+ xserver_append_xdm_home_files(mozilla_plugin_t);
-+')
-+
-+tunable_policy(`use_nfs_home_dirs',`
-+ fs_manage_nfs_dirs(mozilla_plugin_t)
-+ fs_manage_nfs_files(mozilla_plugin_t)
-+ fs_manage_nfs_symlinks(mozilla_plugin_t)
-+')
+ ')
+
-+tunable_policy(`use_samba_home_dirs',`
-+ fs_manage_cifs_dirs(mozilla_plugin_t)
-+ fs_manage_cifs_files(mozilla_plugin_t)
-+ fs_manage_cifs_symlinks(mozilla_plugin_t)
-+')
diff --git a/policy/modules/apps/mplayer.if b/policy/modules/apps/mplayer.if
index d8ea41d..8bdc526 100644
--- a/policy/modules/apps/mplayer.if
@@ -7126,7 +6526,7 @@ index d8ea41d..8bdc526 100644
+ domtrans_pattern($1, mplayer_exec_t, $2)
+')
diff --git a/policy/modules/apps/mplayer.te b/policy/modules/apps/mplayer.te
-index 931304b..92752c4 100644
+index 072a210..7986b0b 100644
--- a/policy/modules/apps/mplayer.te
+++ b/policy/modules/apps/mplayer.te
@@ -32,6 +32,7 @@ files_config_file(mplayer_etc_t)
@@ -7154,7 +6554,7 @@ index 931304b..92752c4 100644
manage_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
manage_lnk_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
-@@ -222,10 +224,12 @@ fs_dontaudit_getattr_all_fs(mplayer_t)
+@@ -225,10 +227,12 @@ fs_dontaudit_getattr_all_fs(mplayer_t)
fs_search_auto_mountpoints(mplayer_t)
fs_list_inotifyfs(mplayer_t)
@@ -7168,7 +6568,7 @@ index 931304b..92752c4 100644
# Read media files
userdom_list_user_tmp(mplayer_t)
userdom_read_user_tmp_files(mplayer_t)
-@@ -302,6 +306,10 @@ optional_policy(`
+@@ -305,6 +309,10 @@ optional_policy(`
')
optional_policy(`
@@ -7791,7 +7191,7 @@ index 0000000..37449c0
+')
diff --git a/policy/modules/apps/nsplugin.te b/policy/modules/apps/nsplugin.te
new file mode 100644
-index 0000000..683b225
+index 0000000..20be1c0
--- /dev/null
+++ b/policy/modules/apps/nsplugin.te
@@ -0,0 +1,336 @@
@@ -7991,7 +7391,7 @@ index 0000000..683b225
+')
+
+optional_policy(`
-+ mozilla_execute_user_home_files(nsplugin_t)
++ mozilla_exec_user_home_files(nsplugin_t)
+ mozilla_read_user_home_files(nsplugin_t)
+ mozilla_write_user_home_files(nsplugin_t)
+ mozilla_plugin_delete_tmpfs_files(nsplugin_t)
@@ -8297,27 +7697,6 @@ index 0000000..a842371
+# Unconfined java local policy
+#
+
-diff --git a/policy/modules/apps/podsleuth.te b/policy/modules/apps/podsleuth.te
-index a2f6124..9d62060 100644
---- a/policy/modules/apps/podsleuth.te
-+++ b/policy/modules/apps/podsleuth.te
-@@ -27,7 +27,7 @@ ubac_constrained(podsleuth_tmpfs_t)
- # podsleuth local policy
- #
- allow podsleuth_t self:capability { kill dac_override sys_admin sys_rawio };
--allow podsleuth_t self:process { ptrace signal getsched execheap execmem execstack };
-+allow podsleuth_t self:process { ptrace signal signull getsched execheap execmem execstack };
- allow podsleuth_t self:fifo_file rw_file_perms;
- allow podsleuth_t self:unix_stream_socket create_stream_socket_perms;
- allow podsleuth_t self:sem create_sem_perms;
-@@ -73,6 +73,7 @@ miscfiles_read_localization(podsleuth_t)
- sysnet_dns_name_resolve(podsleuth_t)
-
- userdom_signal_unpriv_users(podsleuth_t)
-+userdom_signull_unpriv_users(podsleuth_t)
- userdom_read_user_tmpfs_files(podsleuth_t)
-
- optional_policy(`
diff --git a/policy/modules/apps/pulseaudio.fc b/policy/modules/apps/pulseaudio.fc
index 84f23dc..af5b87d 100644
--- a/policy/modules/apps/pulseaudio.fc
@@ -8334,18 +7713,9 @@ index 84f23dc..af5b87d 100644
/var/lib/pulse(/.*)? gen_context(system_u:object_r:pulseaudio_var_lib_t,s0)
diff --git a/policy/modules/apps/pulseaudio.if b/policy/modules/apps/pulseaudio.if
-index 2ba7787..9a5e99c 100644
+index f40c64d..9a5e99c 100644
--- a/policy/modules/apps/pulseaudio.if
+++ b/policy/modules/apps/pulseaudio.if
-@@ -17,7 +17,7 @@
- #
- interface(`pulseaudio_role',`
- gen_require(`
-- type pulseaudio_t, pulseaudio_exec_t, print_spool_t;
-+ type pulseaudio_t, pulseaudio_exec_t;
- class dbus { acquire_svc send_msg };
- ')
-
@@ -35,6 +35,10 @@ interface(`pulseaudio_role',`
allow pulseaudio_t $2:unix_stream_socket connectto;
allow $2 pulseaudio_t:unix_stream_socket connectto;
@@ -8357,23 +7727,7 @@ index 2ba7787..9a5e99c 100644
allow $2 pulseaudio_t:dbus send_msg;
allow pulseaudio_t $2:dbus { acquire_svc send_msg };
')
-@@ -215,6 +219,7 @@ interface(`pulseaudio_read_home_files',`
-
- userdom_search_user_home_dirs($1)
- read_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t)
-+ read_lnk_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t)
- ')
-
- ########################################
-@@ -233,6 +238,7 @@ interface(`pulseaudio_rw_home_files',`
- ')
-
- rw_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t)
-+ read_lnk_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t)
- userdom_search_user_home_dirs($1)
- ')
-
-@@ -256,3 +262,63 @@ interface(`pulseaudio_manage_home_files',`
+@@ -258,3 +262,63 @@ interface(`pulseaudio_manage_home_files',`
manage_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t)
read_lnk_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t)
')
@@ -8438,7 +7792,7 @@ index 2ba7787..9a5e99c 100644
+ userdom_admin_home_dir_filetrans($1, pulseaudio_home_t, file, ".pulse-cookie")
+')
diff --git a/policy/modules/apps/pulseaudio.te b/policy/modules/apps/pulseaudio.te
-index c2d20a2..8610868 100644
+index d1eace5..8522ab4 100644
--- a/policy/modules/apps/pulseaudio.te
+++ b/policy/modules/apps/pulseaudio.te
@@ -44,6 +44,7 @@ allow pulseaudio_t self:netlink_kobject_uevent_socket create_socket_perms;
@@ -8517,7 +7871,7 @@ index c2d20a2..8610868 100644
+ virt_manage_tmpfs_files(pulseaudio_t)
+')
diff --git a/policy/modules/apps/qemu.if b/policy/modules/apps/qemu.if
-index c1d5f50..6c7a005 100644
+index 268d691..6c7a005 100644
--- a/policy/modules/apps/qemu.if
+++ b/policy/modules/apps/qemu.if
@@ -76,7 +76,7 @@ template(`qemu_domain_template',`
@@ -8604,28 +7958,7 @@ index c1d5f50..6c7a005 100644
')
########################################
-@@ -169,6 +148,7 @@ interface(`qemu_domtrans',`
- ## The role to allow the qemu domain.
- ## </summary>
- ## </param>
-+## <rolecap/>
- #
- interface(`qemu_run',`
- gen_require(`
-@@ -177,10 +157,8 @@ interface(`qemu_run',`
-
- qemu_domtrans($1)
- role $2 types qemu_t;
--
-- optional_policy(`
-- samba_run_smb(qemu_t, $2, $3)
-- ')
-+ allow qemu_t $1:process signull;
-+ allow $1 qemu_t:process signull;
- ')
-
- ########################################
-@@ -275,6 +253,67 @@ interface(`qemu_domtrans_unconfined',`
+@@ -274,6 +253,67 @@ interface(`qemu_domtrans_unconfined',`
########################################
## <summary>
@@ -8693,7 +8026,7 @@ index c1d5f50..6c7a005 100644
## Manage qemu temporary dirs.
## </summary>
## <param name="domain">
-@@ -308,3 +347,22 @@ interface(`qemu_manage_tmp_files',`
+@@ -307,3 +347,22 @@ interface(`qemu_manage_tmp_files',`
manage_files_pattern($1, qemu_tmp_t, qemu_tmp_t)
')
@@ -8717,19 +8050,10 @@ index c1d5f50..6c7a005 100644
+ domain_entry_file($1, qemu_exec_t)
+')
diff --git a/policy/modules/apps/qemu.te b/policy/modules/apps/qemu.te
-index 5ef2f7d..13057b7 100644
+index 1813e16..c667ed2 100644
--- a/policy/modules/apps/qemu.te
+++ b/policy/modules/apps/qemu.te
-@@ -21,7 +21,7 @@ gen_tunable(qemu_use_cifs, true)
-
- ## <desc>
- ## <p>
--## Allow qemu to user serial/parallel communication ports
-+## Allow qemu to use serial/parallel communication ports
- ## </p>
- ## </desc>
- gen_tunable(qemu_use_comm, false)
-@@ -55,14 +55,15 @@ storage_raw_read_removable_device(qemu_t)
+@@ -55,6 +55,7 @@ storage_raw_read_removable_device(qemu_t)
userdom_search_user_home_content(qemu_t)
userdom_read_user_tmpfs_files(qemu_t)
@@ -8737,23 +8061,7 @@ index 5ef2f7d..13057b7 100644
tunable_policy(`qemu_full_network',`
allow qemu_t self:udp_socket create_socket_perms;
-
-- corenet_udp_sendrecv_all_if(qemu_t)
-- corenet_udp_sendrecv_all_nodes(qemu_t)
-+ corenet_udp_sendrecv_generic_if(qemu_t)
-+ corenet_udp_sendrecv_generic_node(qemu_t)
- corenet_udp_sendrecv_all_ports(qemu_t)
-- corenet_udp_bind_all_nodes(qemu_t)
-+ corenet_udp_bind_generic_node(qemu_t)
- corenet_udp_bind_all_ports(qemu_t)
- corenet_tcp_bind_all_ports(qemu_t)
- corenet_tcp_connect_all_ports(qemu_t)
-@@ -90,10 +91,22 @@ tunable_policy(`qemu_use_usb',`
- ')
-
- optional_policy(`
-- samba_domtrans_smbd(qemu_t)
-+ dbus_read_lib_files(qemu_t)
+@@ -99,6 +100,18 @@ optional_policy(`
')
optional_policy(`
@@ -8772,19 +8080,7 @@ index 5ef2f7d..13057b7 100644
virt_manage_images(qemu_t)
virt_append_log(qemu_t)
')
-@@ -102,6 +115,11 @@ optional_policy(`
- xen_rw_image_files(qemu_t)
- ')
-
-+optional_policy(`
-+ xserver_read_xdm_pid(qemu_t)
-+ xserver_stream_connect(qemu_t)
-+')
-+
- ########################################
- #
- # Unconfined qemu local policy
-@@ -112,6 +130,8 @@ optional_policy(`
+@@ -122,6 +135,8 @@ optional_policy(`
typealias unconfined_qemu_t alias qemu_unconfined_t;
application_type(unconfined_qemu_t)
unconfined_domain(unconfined_qemu_t)
@@ -8801,157 +8097,18 @@ index 4c091ca..a58f123 100644
/usr/bin/rssh -- gen_context(system_u:object_r:rssh_exec_t,s0)
+
+/usr/libexec/rssh_chroot_helper -- gen_context(system_u:object_r:rssh_chroot_helper_exec_t,s0)
-diff --git a/policy/modules/apps/rssh.if b/policy/modules/apps/rssh.if
-index 7cdac1e..8b920c8 100644
---- a/policy/modules/apps/rssh.if
-+++ b/policy/modules/apps/rssh.if
-@@ -2,6 +2,25 @@
-
- ########################################
- ## <summary>
-+## Execute the rssh program
-+## in the caller domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`rssh_exec',`
-+ gen_require(`
-+ type rssh_exec_t;
-+ ')
-+
-+ can_exec($1, rssh_exec_t)
-+')
-+
-+########################################
-+## <summary>
- ## Role access for rssh
- ## </summary>
- ## <param name="role">
-@@ -64,3 +83,21 @@ interface(`rssh_read_ro_content',`
- read_files_pattern($1, rssh_ro_t, rssh_ro_t)
- read_lnk_files_pattern($1, rssh_ro_t, rssh_ro_t)
- ')
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run rssh_chroot_helper.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`rssh_domtrans_chroot_helper',`
-+ gen_require(`
-+ type rssh_chroot_helper_t, rssh_chroot_helper_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, rssh_chroot_helper_exec_t, rssh_chroot_helper_t)
-+')
-diff --git a/policy/modules/apps/rssh.te b/policy/modules/apps/rssh.te
-index c605046..97b3df2 100644
---- a/policy/modules/apps/rssh.te
-+++ b/policy/modules/apps/rssh.te
-@@ -31,6 +31,10 @@ typealias rssh_rw_t alias { user_rssh_rw_t staff_rssh_rw_t sysadm_rssh_rw_t };
- typealias rssh_rw_t alias { auditadm_rssh_rw_t secadm_rssh_rw_t };
- userdom_user_home_content(rssh_rw_t)
-
-+type rssh_chroot_helper_t;
-+type rssh_chroot_helper_exec_t;
-+init_system_domain(rssh_chroot_helper_t, rssh_chroot_helper_exec_t)
-+
- ##############################
- #
- # Local policy
-@@ -78,3 +82,25 @@ ssh_rw_stream_sockets(rssh_t)
- optional_policy(`
- nis_use_ypbind(rssh_t)
- ')
-+
-+########################################
-+#
-+# rssh_chroot_helper local policy
-+#
-+rssh_domtrans_chroot_helper(rssh_t)
-+
-+allow rssh_chroot_helper_t self:capability { sys_chroot setuid };
-+
-+allow rssh_chroot_helper_t self:fifo_file rw_fifo_file_perms;
-+allow rssh_chroot_helper_t self:unix_stream_socket create_stream_socket_perms;
-+
-+domain_use_interactive_fds(rssh_chroot_helper_t)
-+
-+files_read_etc_files(rssh_chroot_helper_t)
-+
-+auth_use_nsswitch(rssh_chroot_helper_t)
-+
-+logging_send_syslog_msg(rssh_chroot_helper_t)
-+
-+miscfiles_read_localization(rssh_chroot_helper_t)
-+
diff --git a/policy/modules/apps/sambagui.te b/policy/modules/apps/sambagui.te
-index 9ec1478..e3734df 100644
+index f594e12..340c389 100644
--- a/policy/modules/apps/sambagui.te
+++ b/policy/modules/apps/sambagui.te
-@@ -27,9 +27,10 @@ corecmd_exec_bin(sambagui_t)
+@@ -27,6 +27,7 @@ corecmd_exec_bin(sambagui_t)
dev_dontaudit_read_urand(sambagui_t)
+files_read_usr_files(sambagui_t)
files_read_etc_files(sambagui_t)
files_search_var_lib(sambagui_t)
--files_search_usr(sambagui_t)
-+files_read_usr_files(sambagui_t)
-
- auth_use_nsswitch(sambagui_t)
-
-@@ -37,21 +38,32 @@ logging_send_syslog_msg(sambagui_t)
-
- miscfiles_read_localization(sambagui_t)
-
--nscd_dontaudit_search_pid(sambagui_t)
-
--# handling with samba conf files
--samba_append_log(sambagui_t)
--samba_manage_config(sambagui_t)
--samba_manage_var_files(sambagui_t)
--samba_read_secrets(sambagui_t)
--samba_initrc_domtrans(sambagui_t)
--samba_domtrans_smbd(sambagui_t)
--samba_domtrans_nmbd(sambagui_t)
-+userdom_dontaudit_search_admin_dir(sambagui_t)
-
- optional_policy(`
- consoletype_exec(sambagui_t)
- ')
-
- optional_policy(`
-+ nscd_dontaudit_search_pid(sambagui_t)
-+')
-+
-+optional_policy(`
-+ gnome_dontaudit_search_config(sambagui_t)
-+')
-+
-+optional_policy(`
- policykit_dbus_chat(sambagui_t)
- ')
-+
-+optional_policy(`
-+ # handling with samba conf files
-+ samba_append_log(sambagui_t)
-+ samba_manage_config(sambagui_t)
-+ samba_manage_var_files(sambagui_t)
-+ samba_read_secrets(sambagui_t)
-+ samba_initrc_domtrans(sambagui_t)
-+ samba_domtrans_smbd(sambagui_t)
-+ samba_domtrans_nmbd(sambagui_t)
-+')
+ files_read_usr_files(sambagui_t)
diff --git a/policy/modules/apps/sandbox.fc b/policy/modules/apps/sandbox.fc
new file mode 100644
index 0000000..6caef63
@@ -9827,12 +8984,12 @@ index 0000000..d6d2f78
+ mozilla_plugin_dontaudit_leaks(sandbox_x_domain)
+')
diff --git a/policy/modules/apps/screen.fc b/policy/modules/apps/screen.fc
-index 1f2cde4..7227631 100644
+index c8254dd..4112daa 100644
--- a/policy/modules/apps/screen.fc
+++ b/policy/modules/apps/screen.fc
-@@ -2,6 +2,9 @@
- # /home
+@@ -3,6 +3,9 @@
#
+ HOME_DIR/\.screen(/.*)? gen_context(system_u:object_r:screen_home_t,s0)
HOME_DIR/\.screenrc -- gen_context(system_u:object_r:screen_home_t,s0)
+HOME_DIR/\.screen(/.*)? gen_context(system_u:object_r:screen_home_t,s0)
+
@@ -9841,45 +8998,18 @@ index 1f2cde4..7227631 100644
#
# /usr
diff --git a/policy/modules/apps/screen.if b/policy/modules/apps/screen.if
-index 320df26..bd8db22 100644
+index a57e81e..bd8db22 100644
--- a/policy/modules/apps/screen.if
+++ b/policy/modules/apps/screen.if
-@@ -50,7 +50,7 @@ template(`screen_role_template',`
- allow $1_screen_t self:udp_socket create_socket_perms;
- # Internal screen networking
- allow $1_screen_t self:fd use;
-- allow $1_screen_t self:unix_stream_socket create_socket_perms;
-+ allow $1_screen_t self:unix_stream_socket { create_socket_perms connectto };
- allow $1_screen_t self:unix_dgram_socket create_socket_perms;
-
- manage_dirs_pattern($1_screen_t, screen_tmp_t, screen_tmp_t)
-@@ -61,9 +61,14 @@ template(`screen_role_template',`
- # Create fifo
- manage_fifo_files_pattern($1_screen_t, screen_var_run_t, screen_var_run_t)
- manage_dirs_pattern($1_screen_t, screen_var_run_t, screen_var_run_t)
-+ manage_sock_files_pattern($1_screen_t, screen_var_run_t, screen_var_run_t)
- files_pid_filetrans($1_screen_t, screen_var_run_t, dir)
-
- allow $1_screen_t screen_home_t:dir list_dir_perms;
-+ manage_dirs_pattern($1_screen_t, screen_home_t, screen_home_t)
-+ manage_fifo_files_pattern($1_screen_t, screen_home_t, screen_home_t)
-+ userdom_user_home_dir_filetrans($1_screen_t, screen_home_t, dir)
+@@ -68,6 +68,7 @@ template(`screen_role_template',`
+ manage_dirs_pattern($1_screen_t, screen_home_t, screen_home_t)
+ manage_fifo_files_pattern($1_screen_t, screen_home_t, screen_home_t)
+ userdom_user_home_dir_filetrans($1_screen_t, screen_home_t, dir)
+ userdom_admin_home_dir_filetrans($1_screen_t, screen_home_t, dir)
read_files_pattern($1_screen_t, screen_home_t, screen_home_t)
read_lnk_files_pattern($1_screen_t, screen_home_t, screen_home_t)
-@@ -71,8 +76,10 @@ template(`screen_role_template',`
-
- domtrans_pattern($3, screen_exec_t, $1_screen_t)
- allow $3 $1_screen_t:process { signal sigchld };
-+ dontaudit $3 $1_screen_t:unix_stream_socket { read write };
- allow $1_screen_t $3:process signal;
-
-+ manage_fifo_files_pattern($3, screen_home_t, screen_home_t)
- manage_dirs_pattern($3, screen_home_t, screen_home_t)
- manage_files_pattern($3, screen_home_t, screen_home_t)
- manage_lnk_files_pattern($3, screen_home_t, screen_home_t)
-@@ -81,8 +88,6 @@ template(`screen_role_template',`
+@@ -87,8 +88,6 @@ template(`screen_role_template',`
relabel_lnk_files_pattern($3, screen_home_t, screen_home_t)
manage_dirs_pattern($3, screen_var_run_t, screen_var_run_t)
@@ -9888,7 +9018,7 @@ index 320df26..bd8db22 100644
manage_fifo_files_pattern($3, screen_var_run_t, screen_var_run_t)
kernel_read_system_state($1_screen_t)
-@@ -112,6 +117,7 @@ template(`screen_role_template',`
+@@ -118,6 +117,7 @@ template(`screen_role_template',`
# for SSP
dev_read_urand($1_screen_t)
@@ -10038,269 +9168,62 @@ index 7590165..9a7ebe5 100644
+tunable_policy(`use_fusefs_home_dirs',`
+ fs_mounton_fusefs(seunshare_domain)
+')
-diff --git a/policy/modules/apps/slocate.te b/policy/modules/apps/slocate.te
-index e43c380..410027f 100644
---- a/policy/modules/apps/slocate.te
-+++ b/policy/modules/apps/slocate.te
-@@ -38,6 +38,7 @@ dev_getattr_all_blk_files(locate_t)
- dev_getattr_all_chr_files(locate_t)
-
- files_list_all(locate_t)
-+files_dontaudit_read_all_symlinks(locate_t)
- files_getattr_all_files(locate_t)
- files_getattr_all_pipes(locate_t)
- files_getattr_all_sockets(locate_t)
-diff --git a/policy/modules/apps/telepathy.fc b/policy/modules/apps/telepathy.fc
-new file mode 100644
-index 0000000..8075b7b
---- /dev/null
-+++ b/policy/modules/apps/telepathy.fc
-@@ -0,0 +1,18 @@
-+HOME_DIR/\.mission-control(/.*)? gen_context(system_u:object_r:telepathy_mission_control_home_t, s0)
-+HOME_DIR/\.cache/\.mc_connections -- gen_context(system_u:object_r:telepathy_mission_control_cache_home_t, s0)
-+HOME_DIR/\.cache/telepathy/gabble(/.*)? gen_context(system_u:object_r:telepathy_gabble_cache_home_t, s0)
-+HOME_DIR/.telepathy-sunshine(/.*)? gen_context(system_u:object_r:telepathy_sunshine_home_t, s0)
-+HOME_DIR/\.cache/wocky(/.*)? gen_context(system_u:object_r:telepathy_gabble_cache_home_t, s0)
-+HOME_DIR/\.cache/telepathy/logger/sqlite-data-journal -- gen_context(system_u:object_r:telepathy_logger_cache_home_t,s0)
-+HOME_DIR/\.local/share/TpLogger(/.*)? gen_context(system_u:object_r:telepathy_logger_data_home_t,s0)
-+
-+/usr/libexec/mission-control-5 -- gen_context(system_u:object_r:telepathy_mission_control_exec_t, s0)
-+/usr/libexec/telepathy-butterfly -- gen_context(system_u:object_r:telepathy_msn_exec_t, s0)
-+/usr/libexec/telepathy-gabble -- gen_context(system_u:object_r:telepathy_gabble_exec_t, s0)
-+/usr/libexec/telepathy-haze -- gen_context(system_u:object_r:telepathy_msn_exec_t, s0)
-+/usr/libexec/telepathy-idle -- gen_context(system_u:object_r:telepathy_idle_exec_t, s0)
-+/usr/libexec/telepathy-logger -- gen_context(system_u:object_r:telepathy_logger_exec_t,s0)
-+/usr/libexec/telepathy-salut -- gen_context(system_u:object_r:telepathy_salut_exec_t, s0)
-+/usr/libexec/telepathy-sofiasip -- gen_context(system_u:object_r:telepathy_sofiasip_exec_t, s0)
-+/usr/libexec/telepathy-stream-engine -- gen_context(system_u:object_r:telepathy_stream_engine_exec_t, s0)
-+/usr/libexec/telepathy-sunshine -- gen_context(system_u:object_r:telepathy_sunshine_exec_t, s0)
diff --git a/policy/modules/apps/telepathy.if b/policy/modules/apps/telepathy.if
-new file mode 100644
-index 0000000..1d0f110
---- /dev/null
+index 3cfb128..de71ea8 100644
+--- a/policy/modules/apps/telepathy.if
+++ b/policy/modules/apps/telepathy.if
-@@ -0,0 +1,269 @@
+@@ -11,7 +11,6 @@
+ ## </summary>
+ ## </param>
+ #
+-#
+ template(`telepathy_domain_template',`
+
+ gen_require(`
+@@ -32,7 +31,7 @@ template(`telepathy_domain_template',`
+ #######################################
+ ## <summary>
+ ## Role access for telepathy domains
+-### that executes via dbus-session
++## that executes via dbus-session
+ ## </summary>
+ ## <param name="user_role">
+ ## <summary>
+@@ -46,6 +45,7 @@ template(`telepathy_domain_template',`
+ ## </param>
+ #
+ template(`telepathy_role', `
+
-+## <summary>Telepathy framework.</summary>
+ gen_require(`
+ attribute telepathy_domain;
+ type telepathy_gabble_t, telepathy_sofiasip_t, telepathy_idle_t;
+@@ -179,3 +179,75 @@ interface(`telepathy_salut_stream_connect', `
+ stream_connect_pattern($1, telepathy_salut_tmp_t, telepathy_salut_tmp_t, telepathy_salut_t)
+ files_search_tmp($1)
+ ')
+
+#######################################
+## <summary>
-+## Creates basic types for telepathy
-+## domain
++## Send DBus messages to and from
++## all Telepathy domain.
+## </summary>
-+## <param name="prefix">
++## <param name="domain">
+## <summary>
-+## Prefix for the domain.
++## Domain allowed access.
+## </summary>
+## </param>
+#
-+#
-+template(`telepathy_domain_template',`
-+
-+ gen_require(`
-+ attribute telepathy_domain;
-+ attribute telepathy_executable;
-+ ')
-+
-+ type telepathy_$1_t, telepathy_domain;
-+ type telepathy_$1_exec_t, telepathy_executable;
-+ application_domain(telepathy_$1_t, telepathy_$1_exec_t)
-+ ubac_constrained(telepathy_$1_t)
-+
-+ type telepathy_$1_tmp_t;
-+ files_tmp_file(telepathy_$1_tmp_t)
-+ ubac_constrained(telepathy_$1_tmp_t)
-+')
-+
-+#######################################
-+## <summary>
-+## Role access for telepathy domains
-+### that executes via dbus-session
-+## </summary>
-+## <param name="user_role">
-+## <summary>
-+## The role associated with the user domain.
-+## </summary>
-+## </param>
-+## <param name="user_domain">
-+## <summary>
-+## The type of the user domain.
-+## </summary>
-+## </param>
-+#
-+template(`telepathy_dbus_session_role', `
-+ gen_require(`
-+ attribute telepathy_domain;
-+ type telepathy_gabble_t;
-+ type telepathy_sofiasip_t;
-+ type telepathy_idle_t;
-+ type telepathy_mission_control_t;
-+ type telepathy_salut_t;
-+ type telepathy_sunshine_t;
-+ type telepathy_stream_engine_t;
-+ type telepathy_msn_t;
-+ type telepathy_gabble_exec_t;
-+ type telepathy_sofiasip_exec_t;
-+ type telepathy_idle_exec_t;
-+ type telepathy_mission_control_exec_t;
-+ type telepathy_salut_exec_t;
-+ type telepathy_sunshine_exec_t;
-+ type telepathy_stream_engine_exec_t;
-+ type telepathy_msn_exec_t;
-+ type telepathy_logger_exec_t;
-+ type telepathy_logger_t;
-+ ')
-+
-+ role $1 types telepathy_domain;
-+
-+ allow $2 telepathy_domain:process { ptrace signal_perms };
-+ ps_process_pattern($2, telepathy_domain)
-+
-+ optional_policy(`
-+ telepathy_dbus_chat($2)
-+ ')
-+
-+ telepathy_gabble_stream_connect($2)
-+ telepathy_msn_stream_connect($2)
-+ telepathy_salut_stream_connect($2)
-+
-+ dbus_session_domain($3, telepathy_gabble_exec_t, telepathy_gabble_t)
-+ dbus_session_domain($3, telepathy_sofiasip_exec_t, telepathy_sofiasip_t)
-+ dbus_session_domain($3, telepathy_idle_exec_t, telepathy_idle_t)
-+ dbus_session_domain($3, telepathy_logger_exec_t, telepathy_logger_t)
-+ dbus_session_domain($3, telepathy_mission_control_exec_t, telepathy_mission_control_t)
-+ dbus_session_domain($3, telepathy_salut_exec_t, telepathy_salut_t)
-+ dbus_session_domain($3, telepathy_sunshine_exec_t, telepathy_sunshine_t)
-+ dbus_session_domain($3, telepathy_stream_engine_exec_t, telepathy_stream_engine_t)
-+ dbus_session_domain($3, telepathy_msn_exec_t, telepathy_msn_t)
-+
-+')
-+
-+########################################
-+## <summary>
-+## Send DBus messages to and from
-+## all Telepathy domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+interface(`telepathy_dbus_chat', `
-+ gen_require(`
-+ attribute telepathy_domain;
-+ class dbus send_msg;
-+ ')
-+
-+ allow $1 telepathy_domain:dbus send_msg;
-+ allow telepathy_domain $1:dbus send_msg;
-+')
-+
-+########################################
-+## <summary>
-+## Send DBus messages to and from
-+## Telepathy Gabble.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`telepathy_gabble_dbus_chat', `
-+ gen_require(`
-+ type telepathy_gabble_t;
-+ class dbus send_msg;
-+ ')
-+
-+ allow $1 telepathy_gabble_t:dbus send_msg;
-+ allow telepathy_gabble_t $1:dbus send_msg;
-+')
-+
-+########################################
-+## <summary>
-+## Stream connect to Telepathy Gabble
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`telepathy_gabble_stream_connect', `
-+ gen_require(`
-+ type telepathy_gabble_t, telepathy_gabble_tmp_t;
-+ ')
-+
-+ stream_connect_pattern($1, telepathy_gabble_tmp_t, telepathy_gabble_tmp_t, telepathy_gabble_t)
-+ files_search_tmp($1)
-+')
-+
-+#######################################
-+## <summary>
-+## Stream connect to telepathy MSN managers
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`telepathy_msn_stream_connect', `
-+ gen_require(`
-+ type telepathy_msn_t, telepathy_msn_tmp_t;
-+ ')
-+
-+ stream_connect_pattern($1, telepathy_msn_tmp_t, telepathy_msn_tmp_t, telepathy_msn_t)
-+ files_search_tmp($1)
-+')
-+
-+
-+########################################
-+## <summary>
-+## Stream connect to Telepathy Salut
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`telepathy_salut_stream_connect', `
-+ gen_require(`
-+ type telepathy_salut_t, telepathy_salut_tmp_t;
-+ ')
-+
-+ stream_connect_pattern($1, telepathy_salut_tmp_t, telepathy_salut_tmp_t, telepathy_salut_t)
-+ files_search_tmp($1)
-+')
-+
-+########################################
-+## <summary>
-+## Read telepathy mission control state.
-+## </summary>
-+## <param name="role_prefix">
-+## <summary>
-+## Prefix to be used.
-+## </summary>
-+## </param>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`telepathy_mission_control_read_state',`
-+ gen_require(`
-+ type telepathy_mission_control_t;
-+ ')
++ gen_require(`
++ attribute telepathy_domain;
++ class dbus send_msg;
++ ')
+
-+ kernel_search_proc($1)
-+ ps_process_pattern($1, telepathy_mission_control_t)
++ allow $1 telepathy_domain:dbus send_msg;
++ allow telepathy_domain $1:dbus send_msg;
+')
+
-+#######################################
++######################################
+## <summary>
+## Execute telepathy executable
+## in the specified domain.
@@ -10335,6 +9258,7 @@ index 0000000..1d0f110
+## </param>
+#
+interface(`telepathy_command_domtrans', `
++
+ gen_require(`
+ attribute telepathy_executable;
+ ')
@@ -10344,402 +9268,119 @@ index 0000000..1d0f110
+ type_transition $1 telepathy_executable:process $2;
+
+ # needs to dbus chat with unconfined_t and unconfined_dbusd_t
-+ optional_policy(`
++ optional_policy(`
+ telepathy_dbus_chat($1)
+ telepathy_dbus_chat($2)
+ ')
+')
diff --git a/policy/modules/apps/telepathy.te b/policy/modules/apps/telepathy.te
-new file mode 100644
-index 0000000..aaaf4e0
---- /dev/null
+index 2533ea0..f41eb44 100644
+--- a/policy/modules/apps/telepathy.te
+++ b/policy/modules/apps/telepathy.te
-@@ -0,0 +1,385 @@
-+
-+policy_module(telepathy, 1.0.0)
-+
-+########################################
-+#
-+# Declarations.
-+#
-+
-+## <desc>
-+## <p>
-+## Allow the Telepathy connection managers
-+## to connect to any generic TCP port.
-+## </p>
-+## </desc>
-+gen_tunable(telepathy_tcp_connect_generic_network_ports, false)
-+
-+## <desc>
-+## <p>
-+## Allow the Telepathy connection managers
-+## to connect to any network port.
-+## </p>
-+## </desc>
-+gen_tunable(telepathy_connect_all_ports, true)
-+
-+attribute telepathy_domain;
-+attribute telepathy_executable;
-+
-+telepathy_domain_template(gabble)
-+
-+type telepathy_gabble_cache_home_t;
-+userdom_user_home_content(telepathy_gabble_cache_home_t)
-+
-+telepathy_domain_template(idle)
-+telepathy_domain_template(mission_control)
-+
-+type telepathy_mission_control_home_t;
-+userdom_user_home_content(telepathy_mission_control_home_t)
-+
-+type telepathy_mission_control_cache_home_t;
-+userdom_user_home_content(telepathy_mission_control_cache_home_t)
-+
-+type telepathy_sunshine_home_t;
-+userdom_user_home_content(telepathy_sunshine_home_t)
-+
-+type telepathy_logger_cache_home_t;
-+userdom_user_home_content(telepathy_logger_cache_home_t)
-+
-+type telepathy_logger_data_home_t;
-+userdom_user_home_content(telepathy_logger_data_home_t)
-+
-+telepathy_domain_template(msn)
-+telepathy_domain_template(salut)
-+telepathy_domain_template(sofiasip)
-+telepathy_domain_template(stream_engine)
-+telepathy_domain_template(sunshine)
-+telepathy_domain_template(logger)
-+# New in F16
+@@ -32,6 +32,8 @@ userdom_user_home_content(telepathy_gabble_cache_home_t)
+ telepathy_domain_template(idle)
+ telepathy_domain_template(logger)
+
+permissive telepathy_logger_t;
+
-+#######################################
-+#
-+# Telepathy Butterfly and Haze local policy.
-+#
-+
-+allow telepathy_msn_t self:process setsched;
-+allow telepathy_msn_t self:unix_dgram_socket { write create connect };
-+
-+manage_dirs_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
-+manage_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
-+manage_sock_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
-+exec_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
-+files_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file sock_file })
-+userdom_user_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file sock_file })
-+userdom_dontaudit_setattr_user_tmp(telepathy_msn_t)
-+can_exec(telepathy_msn_t, telepathy_msn_tmp_t)
-+
-+corenet_sendrecv_http_client_packets(telepathy_msn_t)
-+corenet_sendrecv_mmcc_client_packets(telepathy_msn_t)
-+corenet_sendrecv_msnp_client_packets(telepathy_msn_t)
-+corenet_tcp_connect_http_port(telepathy_msn_t)
-+corenet_tcp_connect_mmcc_port(telepathy_msn_t)
-+corenet_tcp_connect_msnp_port(telepathy_msn_t)
-+corenet_tcp_connect_sametime_port(telepathy_msn_t)
-+corenet_tcp_connect_ssdp_port(telepathy_msn_t)
-+corenet_tcp_connect_sip_port(telepathy_msn_t)
-+
-+corecmd_exec_bin(telepathy_msn_t)
-+corecmd_exec_shell(telepathy_msn_t)
-+corecmd_read_bin_symlinks(telepathy_msn_t)
-+
-+files_read_etc_files(telepathy_msn_t)
-+files_read_usr_files(telepathy_msn_t)
-+
-+init_read_state(telepathy_msn_t)
-+
-+libs_exec_ldconfig(telepathy_msn_t)
-+
-+logging_send_syslog_msg(telepathy_msn_t)
-+
-+miscfiles_read_all_certs(telepathy_msn_t)
-+
-+userdom_read_all_users_state(telepathy_msn_t)
-+
-+optional_policy(`
-+ dbus_system_bus_client(telepathy_msn_t)
-+ optional_policy(`
-+ networkmanager_dbus_chat(telepathy_msn_t)
-+ ')
-+')
-+
-+optional_policy(`
-+ gnome_read_gconf_home_files(telepathy_msn_t)
-+')
-+
-+#######################################
-+#
-+# Telepathy Gabble local policy.
-+#
-+
-+allow telepathy_gabble_t self:tcp_socket { listen accept };
-+allow telepathy_gabble_t self:unix_dgram_socket { write read create getattr sendto };
-+
-+manage_dirs_pattern(telepathy_gabble_t, telepathy_gabble_tmp_t, telepathy_gabble_tmp_t)
-+manage_sock_files_pattern(telepathy_gabble_t, telepathy_gabble_tmp_t, telepathy_gabble_tmp_t)
-+files_tmp_filetrans(telepathy_gabble_t, telepathy_gabble_tmp_t, { dir sock_file })
-+
+ type telepathy_logger_cache_home_t;
+ userdom_user_home_content(telepathy_logger_cache_home_t)
+
+@@ -67,6 +69,14 @@ manage_dirs_pattern(telepathy_gabble_t, telepathy_gabble_tmp_t, telepathy_gabble
+ manage_sock_files_pattern(telepathy_gabble_t, telepathy_gabble_tmp_t, telepathy_gabble_tmp_t)
+ files_tmp_filetrans(telepathy_gabble_t, telepathy_gabble_tmp_t, { dir sock_file })
+
+# ~/.cache/gabble/caps-cache.db-journal
++# optional_policy(`
+optional_policy(`
+ manage_dirs_pattern(telepathy_gabble_t, telepathy_gabble_cache_home_t, telepathy_gabble_cache_home_t)
+ manage_files_pattern(telepathy_gabble_t, telepathy_gabble_cache_home_t, telepathy_gabble_cache_home_t)
+ gnome_cache_filetrans(telepathy_gabble_t, telepathy_gabble_cache_home_t, { dir file })
-+')
-+
-+corenet_sendrecv_commplex_client_packets(telepathy_gabble_t)
-+corenet_sendrecv_http_client_packets(telepathy_gabble_t)
-+corenet_sendrecv_jabber_client_client_packets(telepathy_gabble_t)
-+corenet_sendrecv_vnc_client_packets(telepathy_gabble_t)
-+
-+corenet_tcp_connect_commplex_port(telepathy_gabble_t)
-+corenet_tcp_connect_http_port(telepathy_gabble_t)
-+corenet_tcp_connect_jabber_client_port(telepathy_gabble_t)
-+corenet_tcp_connect_vnc_port(telepathy_gabble_t)
-+
-+dev_read_rand(telepathy_gabble_t)
-+
-+files_read_config_files(telepathy_gabble_t)
-+files_read_usr_files(telepathy_gabble_t)
-+
-+miscfiles_read_all_certs(telepathy_gabble_t)
-+
-+optional_policy(`
-+ dbus_system_bus_client(telepathy_gabble_t)
-+')
-+
-+tunable_policy(`use_nfs_home_dirs', `
-+ fs_manage_nfs_dirs(telepathy_gabble_t)
-+ fs_manage_nfs_files(telepathy_gabble_t)
-+')
-+
-+tunable_policy(`use_samba_home_dirs', `
-+ fs_manage_cifs_dirs(telepathy_gabble_t)
-+ fs_manage_cifs_files(telepathy_gabble_t)
-+')
++')
+
+ corenet_all_recvfrom_netlabel(telepathy_gabble_t)
+ corenet_all_recvfrom_unlabeled(telepathy_gabble_t)
+ corenet_tcp_sendrecv_generic_if(telepathy_gabble_t)
+@@ -168,6 +178,11 @@ tunable_policy(`use_samba_home_dirs',`
+ fs_manage_cifs_files(telepathy_logger_t)
+ ')
+
+optional_policy(`
-+ gnome_read_home_config(telepathy_gabble_t)
++# ~/.config/dconf/user
++ gnome_read_home_config(telepathy_logger_t)
+')
+
-+#######################################
-+#
-+# Telepathy Idle local policy.
-+#
-+
-+corenet_sendrecv_ircd_client_packets(telepathy_idle_t)
-+corenet_tcp_connect_gatekeeper_port(telepathy_idle_t)
-+corenet_tcp_connect_ircd_port(telepathy_idle_t)
-+
-+dev_read_rand(telepathy_idle_t)
-+
-+files_read_etc_files(telepathy_idle_t)
-+
-+#######################################
-+#
-+# Telepathy Mission-Control local policy.
-+#
-+
-+manage_dirs_pattern(telepathy_mission_control_t, telepathy_mission_control_home_t, telepathy_mission_control_home_t)
-+manage_files_pattern(telepathy_mission_control_t, telepathy_mission_control_home_t, telepathy_mission_control_home_t)
-+userdom_user_home_dir_filetrans(telepathy_mission_control_t, telepathy_mission_control_home_t, { dir file })
+ #######################################
+ #
+ # Telepathy Mission-Control local policy.
+@@ -176,6 +191,7 @@ tunable_policy(`use_samba_home_dirs',`
+ manage_dirs_pattern(telepathy_mission_control_t, telepathy_mission_control_home_t, telepathy_mission_control_home_t)
+ manage_files_pattern(telepathy_mission_control_t, telepathy_mission_control_home_t, telepathy_mission_control_home_t)
+ userdom_user_home_dir_filetrans(telepathy_mission_control_t, telepathy_mission_control_home_t, { dir file })
+userdom_search_user_home_dirs(telepathy_mission_control_t)
-+
-+dev_read_rand(telepathy_mission_control_t)
-+
-+files_read_etc_files(telepathy_mission_control_t)
-+files_read_usr_files(telepathy_mission_control_t)
-+
-+tunable_policy(`use_nfs_home_dirs', `
-+ fs_manage_nfs_dirs(telepathy_mission_control_t)
-+ fs_manage_nfs_files(telepathy_mission_control_t)
-+')
-+
-+tunable_policy(`use_samba_home_dirs', `
-+ fs_manage_cifs_dirs(telepathy_mission_control_t)
-+ fs_manage_cifs_files(telepathy_mission_control_t)
-+')
-+
+
+ dev_read_rand(telepathy_mission_control_t)
+
+@@ -194,6 +210,12 @@ tunable_policy(`use_samba_home_dirs',`
+ fs_manage_cifs_files(telepathy_mission_control_t)
+ ')
+
+# ~/.cache/.mc_connections.
+optional_policy(`
+ manage_files_pattern(telepathy_mission_control_t, telepathy_mission_control_cache_home_t, telepathy_mission_control_cache_home_t)
+ gnome_cache_filetrans(telepathy_mission_control_t, telepathy_mission_control_cache_home_t, file)
+')
+
-+optional_policy(`
-+ gnome_read_gconf_home_files(telepathy_mission_control_t)
-+ gnome_setattr_cache_home_dir(telepathy_mission_control_t)
-+ gnome_read_generic_cache_files(telepathy_mission_control_t)
-+ gnome_dbus_chat_gkeyringd(telepathy_mission_control_t)
-+')
-+
-+#######################################
-+#
-+# Telepathy Salut local policy.
-+#
-+allow telepathy_salut_t self:tcp_socket { accept listen };
-+
-+manage_sock_files_pattern(telepathy_salut_t, telepathy_salut_tmp_t, telepathy_salut_tmp_t)
-+files_tmp_filetrans(telepathy_salut_t, telepathy_salut_tmp_t, sock_file)
-+
-+corenet_sendrecv_presence_server_packets(telepathy_salut_t)
-+corenet_tcp_bind_presence_port(telepathy_salut_t)
-+corenet_tcp_connect_presence_port(telepathy_salut_t)
-+
-+files_read_etc_files(telepathy_salut_t)
-+
-+optional_policy(`
-+ dbus_system_bus_client(telepathy_salut_t)
-+
-+ optional_policy(`
-+ avahi_dbus_chat(telepathy_salut_t)
-+ ')
-+')
-+
-+#######################################
-+#
-+# Telepathy Sofiasip local policy.
-+#
-+allow telepathy_sofiasip_t self:rawip_socket { create_socket_perms listen };
-+allow telepathy_sofiasip_t self:tcp_socket { listen };
-+
-+corenet_sendrecv_sip_client_packets(telepathy_sofiasip_t)
-+corenet_tcp_connect_sip_port(telepathy_sofiasip_t)
-+corenet_udp_bind_all_ports(telepathy_sofiasip_t)
-+corenet_tcp_bind_all_unreserved_ports(telepathy_sofiasip_t)
-+corenet_dontaudit_tcp_bind_all_ports(telepathy_sofiasip_t)
-+
-+kernel_request_load_module(telepathy_sofiasip_t)
-+
-+#######################################
-+#
-+# Telepathy Sunshine local policy.
-+#
-+manage_dirs_pattern(telepathy_sunshine_t, telepathy_sunshine_home_t, telepathy_sunshine_home_t)
-+manage_files_pattern(telepathy_sunshine_t, telepathy_sunshine_home_t, telepathy_sunshine_home_t)
-+userdom_user_home_dir_filetrans(telepathy_sunshine_t, telepathy_sunshine_home_t, { dir file })
-+userdom_search_user_home_dirs(telepathy_sunshine_t)
-+
-+manage_files_pattern(telepathy_sunshine_t, telepathy_sunshine_tmp_t, telepathy_sunshine_tmp_t)
-+exec_files_pattern(telepathy_sunshine_t, telepathy_sunshine_tmp_t, telepathy_sunshine_tmp_t)
-+files_tmp_filetrans(telepathy_sunshine_t, telepathy_sunshine_tmp_t, file)
-+
-+corecmd_exec_bin(telepathy_sunshine_t)
-+
-+files_read_etc_files(telepathy_sunshine_t)
-+files_read_usr_files(telepathy_sunshine_t)
-+
-+optional_policy(`
-+ xserver_read_xdm_pid(telepathy_sunshine_t)
-+ xserver_stream_connect(telepathy_sunshine_t)
-+')
-+
-+#######################################
-+#
-+# Telepathy Logger local policy.
-+#
-+
-+allow telepathy_logger_t self:unix_stream_socket create_socket_perms;
-+
-+manage_files_pattern(telepathy_logger_t, telepathy_logger_cache_home_t, telepathy_logger_cache_home_t)
-+gnome_cache_filetrans(telepathy_logger_t, telepathy_logger_cache_home_t, file)
-+
-+manage_dirs_pattern(telepathy_logger_t, telepathy_logger_data_home_t, telepathy_logger_data_home_t)
-+manage_files_pattern(telepathy_logger_t, telepathy_logger_data_home_t, telepathy_logger_data_home_t)
-+gnome_data_filetrans(telepathy_logger_t, telepathy_logger_data_home_t, dir)
-+
-+files_read_etc_files(telepathy_logger_t)
-+files_read_usr_files(telepathy_logger_t)
-+files_search_pids(telepathy_logger_t)
-+
-+tunable_policy(`use_nfs_home_dirs',`
-+ fs_manage_nfs_dirs(telepathy_logger_t)
-+ fs_manage_nfs_files(telepathy_logger_t)
-+')
-+
-+tunable_policy(`use_samba_home_dirs',`
-+ fs_manage_cifs_dirs(telepathy_logger_t)
-+ fs_manage_cifs_files(telepathy_logger_t)
-+')
-+
-+optional_policy(`
-+ # ~/.config/dconf/user
-+ gnome_read_home_config(telepathy_logger_t)
-+')
-+
-+#######################################
-+#
-+# telepathy domains common policy
-+#
-+
-+allow telepathy_domain self:process { getsched signal sigkill };
-+allow telepathy_domain self:fifo_file rw_fifo_file_perms;
-+allow telepathy_domain self:tcp_socket create_socket_perms;
-+allow telepathy_domain self:udp_socket create_socket_perms;
-+
-+corenet_all_recvfrom_netlabel(telepathy_domain)
-+corenet_all_recvfrom_unlabeled(telepathy_domain)
-+corenet_raw_bind_generic_node(telepathy_domain)
-+corenet_raw_sendrecv_generic_if(telepathy_domain)
-+corenet_raw_sendrecv_generic_node(telepathy_domain)
-+corenet_tcp_bind_generic_node(telepathy_domain)
-+corenet_tcp_sendrecv_generic_if(telepathy_domain)
-+corenet_tcp_sendrecv_generic_node(telepathy_domain)
-+corenet_udp_bind_generic_node(telepathy_domain)
-+
-+dev_read_urand(telepathy_domain)
-+
-+kernel_read_system_state(telepathy_domain)
-+
-+fs_getattr_all_fs(telepathy_domain)
-+fs_search_auto_mountpoints(telepathy_domain)
-+
-+auth_use_nsswitch(telepathy_domain)
-+
-+miscfiles_read_localization(telepathy_domain)
-+
-+# This interface does not facilitate files_search_tmp which appears to be a bug.
-+userdom_stream_connect(telepathy_domain)
-+userdom_use_inherited_user_terminals(telepathy_domain)
-+
-+tunable_policy(`telepathy_tcp_connect_generic_network_ports', `
-+ corenet_tcp_connect_generic_port(telepathy_domain)
-+ corenet_sendrecv_generic_client_packets(telepathy_domain)
-+')
-+
-+tunable_policy(`telepathy_connect_all_ports', `
-+ corenet_tcp_connect_all_ports(telepathy_domain)
-+ corenet_tcp_sendrecv_all_ports(telepathy_domain)
-+ corenet_udp_sendrecv_all_ports(telepathy_domain)
-+')
-+
-+optional_policy(`
-+ automount_dontaudit_getattr_tmp_dirs(telepathy_domain)
+ #######################################
+ #
+ # Telepathy Butterfly and Haze local policy.
+@@ -205,8 +227,11 @@ allow telepathy_msn_t self:unix_dgram_socket { write create connect };
+ manage_dirs_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
+ manage_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
+ manage_sock_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
++exec_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
+ files_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file sock_file })
+ userdom_user_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file sock_file })
++userdom_dontaudit_setattr_user_tmp(telepathy_msn_t)
++can_exec(telepathy_msn_t, telepathy_msn_tmp_t)
+
+ corenet_all_recvfrom_netlabel(telepathy_msn_t)
+ corenet_all_recvfrom_unlabeled(telepathy_msn_t)
+@@ -246,6 +271,10 @@ tunable_policy(`telepathy_tcp_connect_generic_network_ports',`
+ ')
+
+ optional_policy(`
++ gnome_read_gconf_home_files(telepathy_msn_t)
+')
+
+optional_policy(`
-+ gnome_read_generic_cache_files(telepathy_domain)
-+ gnome_write_generic_cache_files(telepathy_domain)
+ dbus_system_bus_client(telepathy_msn_t)
+
+ optional_policy(`
+@@ -376,5 +405,23 @@ optional_policy(`
+ ')
+
+ optional_policy(`
++ gnome_read_generic_cache_files(telepathy_domain)
++ gnome_write_generic_cache_files(telepathy_domain)
+')
+
+optional_policy(`
-+ telepathy_dbus_chat(telepathy_domain)
++ telepathy_dbus_chat(telepathy_domain)
+')
+
+optional_policy(`
-+ xserver_rw_xdm_pipes(telepathy_domain)
-+')
-+
+ xserver_rw_xdm_pipes(telepathy_domain)
+ ')
+
+# Just for F15
-+optional_policy(`
-+ gen_require(`
-+ role unconfined_r;
-+ ')
-+
-+ role unconfined_r types telepathy_domain;
-+')
++#optional_policy(`
++# gen_require(`
++# role unconfined_r;
++# ')
++#
++# role unconfined_r types telepathy_domain;
++#')
diff --git a/policy/modules/apps/tvtime.te b/policy/modules/apps/tvtime.te
index 11fe4f2..98bfbf3 100644
--- a/policy/modules/apps/tvtime.te
@@ -10947,7 +9588,7 @@ index 03fc701..f58654e 100644
-userdom_use_user_terminals(vlock_t)
+userdom_use_inherited_user_terminals(vlock_t)
diff --git a/policy/modules/apps/vmware.fc b/policy/modules/apps/vmware.fc
-index 5872ea2..179960c 100644
+index f647c7e..252468a 100644
--- a/policy/modules/apps/vmware.fc
+++ b/policy/modules/apps/vmware.fc
@@ -39,12 +39,6 @@ ifdef(`distro_redhat',`
@@ -10963,15 +9604,8 @@ index 5872ea2..179960c 100644
/usr/sbin/vmware-guest.* -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
/usr/sbin/vmware-serverd -- gen_context(system_u:object_r:vmware_exec_t,s0)
-@@ -66,5 +60,6 @@ ifdef(`distro_gentoo',`
- /var/log/vmware.* -- gen_context(system_u:object_r:vmware_log_t,s0)
- /var/log/vnetlib.* -- gen_context(system_u:object_r:vmware_log_t,s0)
-
-+/var/run/vmnet.* gen_context(system_u:object_r:vmware_var_run_t,s0)
- /var/run/vmnat.* -s gen_context(system_u:object_r:vmware_var_run_t,s0)
- /var/run/vmware.* gen_context(system_u:object_r:vmware_var_run_t,s0)
diff --git a/policy/modules/apps/vmware.te b/policy/modules/apps/vmware.te
-index c76ceb2..e174a83 100644
+index 23066a1..6aff330 100644
--- a/policy/modules/apps/vmware.te
+++ b/policy/modules/apps/vmware.te
@@ -126,6 +126,7 @@ dev_getattr_all_blk_files(vmware_host_t)
@@ -10982,31 +9616,33 @@ index c76ceb2..e174a83 100644
domain_use_interactive_fds(vmware_host_t)
domain_dontaudit_read_all_domains_state(vmware_host_t)
-@@ -133,6 +134,7 @@ domain_dontaudit_read_all_domains_state(vmware_host_t)
+@@ -133,7 +134,7 @@ domain_dontaudit_read_all_domains_state(vmware_host_t)
files_list_tmp(vmware_host_t)
files_read_etc_files(vmware_host_t)
files_read_etc_runtime_files(vmware_host_t)
+-files_read_usr_files(vmware_host_t)
+files_read_usr_files(vmware_host_t)
fs_getattr_all_fs(vmware_host_t)
fs_search_auto_mountpoints(vmware_host_t)
-@@ -151,6 +153,7 @@ logging_send_syslog_msg(vmware_host_t)
+@@ -152,7 +153,7 @@ logging_send_syslog_msg(vmware_host_t)
miscfiles_read_localization(vmware_host_t)
sysnet_dns_name_resolve(vmware_host_t)
+-sysnet_domtrans_ifconfig(vmware_host_t)
+sysnet_domtrans_ifconfig(vmware_host_t)
userdom_dontaudit_use_unpriv_user_fds(vmware_host_t)
userdom_dontaudit_search_user_home_dirs(vmware_host_t)
-@@ -158,8 +161,23 @@ userdom_dontaudit_search_user_home_dirs(vmware_host_t)
- netutils_domtrans_ping(vmware_host_t)
+@@ -161,10 +162,22 @@ netutils_domtrans_ping(vmware_host_t)
optional_policy(`
-+ hostname_exec(vmware_host_t)
+ hostname_exec(vmware_host_t)
+-')
+')
-+
-+optional_policy(`
-+ modutils_domtrans_insmod(vmware_host_t)
+
+ optional_policy(`
+ modutils_domtrans_insmod(vmware_host_t)
+')
+
+optional_policy(`
@@ -11014,15 +9650,15 @@ index c76ceb2..e174a83 100644
+')
+
+optional_policy(`
- seutil_sigchld_newrole(vmware_host_t)
++ seutil_sigchld_newrole(vmware_host_t)
+')
-
++
+optional_policy(`
+ shutdown_domtrans(vmware_host_t)
')
optional_policy(`
-@@ -270,7 +288,7 @@ libs_read_lib_files(vmware_t)
+@@ -275,7 +288,7 @@ libs_read_lib_files(vmware_t)
miscfiles_read_localization(vmware_t)
@@ -11032,7 +9668,7 @@ index c76ceb2..e174a83 100644
# cjp: why?
userdom_read_user_home_content_files(vmware_t)
diff --git a/policy/modules/apps/webalizer.te b/policy/modules/apps/webalizer.te
-index f79314b..381d5eb 100644
+index b11941a..dc37e57 100644
--- a/policy/modules/apps/webalizer.te
+++ b/policy/modules/apps/webalizer.te
@@ -81,7 +81,7 @@ miscfiles_read_public_files(webalizer_t)
@@ -11044,14 +9680,6 @@ index f79314b..381d5eb 100644
userdom_use_unpriv_users_fds(webalizer_t)
userdom_dontaudit_search_user_home_content(webalizer_t)
-@@ -103,3 +103,7 @@ optional_policy(`
- optional_policy(`
- nscd_socket_use(webalizer_t)
- ')
-+
-+optional_policy(`
-+ squid_manage_logs(webalizer_t)
-+')
diff --git a/policy/modules/apps/wine.fc b/policy/modules/apps/wine.fc
index 9d24449..2666317 100644
--- a/policy/modules/apps/wine.fc
@@ -11073,7 +9701,7 @@ index 9d24449..2666317 100644
/opt/picasa/wine/bin/wine.* -- gen_context(system_u:object_r:wine_exec_t,s0)
diff --git a/policy/modules/apps/wine.if b/policy/modules/apps/wine.if
-index 0440b4c..4b055c1 100644
+index f9a73d0..4b055c1 100644
--- a/policy/modules/apps/wine.if
+++ b/policy/modules/apps/wine.if
@@ -29,12 +29,16 @@
@@ -11136,31 +9764,8 @@ index 0440b4c..4b055c1 100644
optional_policy(`
xserver_role($1_r, $1_wine_t)
')
-@@ -157,3 +168,22 @@ interface(`wine_run',`
- wine_domtrans($1)
- role $2 types wine_t;
- ')
-+
-+########################################
-+## <summary>
-+## Read and write wine Shared
-+## memory segments.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`wine_rw_shm',`
-+ gen_require(`
-+ type wine_t;
-+ ')
-+
-+ allow $1 wine_t:shm rw_shm_perms;
-+')
diff --git a/policy/modules/apps/wine.te b/policy/modules/apps/wine.te
-index 953cb28..bf6c62e 100644
+index be9246b..e3de8fa 100644
--- a/policy/modules/apps/wine.te
+++ b/policy/modules/apps/wine.te
@@ -40,7 +40,7 @@ domain_mmap_low(wine_t)
@@ -11172,19 +9777,6 @@ index 953cb28..bf6c62e 100644
tunable_policy(`wine_mmap_zero_ignore',`
dontaudit wine_t self:memprotect mmap_zero;
-@@ -51,7 +51,11 @@ optional_policy(`
- ')
-
- optional_policy(`
-- unconfined_domain_noaudit(wine_t)
-+ policykit_dbus_chat(wine_t)
-+')
-+
-+optional_policy(`
-+ unconfined_domain(wine_t)
- ')
-
- optional_policy(`
diff --git a/policy/modules/apps/wireshark.te b/policy/modules/apps/wireshark.te
index 8bfe97d..6bba1a8 100644
--- a/policy/modules/apps/wireshark.te
@@ -11197,34 +9789,11 @@ index 8bfe97d..6bba1a8 100644
userdom_user_home_content(wireshark_home_t)
type wireshark_tmp_t;
-diff --git a/policy/modules/apps/wm.fc b/policy/modules/apps/wm.fc
-index be30d55..93d128c 100644
---- a/policy/modules/apps/wm.fc
-+++ b/policy/modules/apps/wm.fc
-@@ -1,3 +1,4 @@
- /usr/bin/twm -- gen_context(system_u:object_r:wm_exec_t,s0)
- /usr/bin/openbox -- gen_context(system_u:object_r:wm_exec_t,s0)
- /usr/bin/metacity -- gen_context(system_u:object_r:wm_exec_t,s0)
-+/usr/bin/gnome-shell -- gen_context(system_u:object_r:wm_exec_t,s0)
diff --git a/policy/modules/apps/wm.if b/policy/modules/apps/wm.if
-index 82842a0..50c1a74 100644
+index b3efef7..50c1a74 100644
--- a/policy/modules/apps/wm.if
+++ b/policy/modules/apps/wm.if
-@@ -44,7 +44,7 @@ template(`wm_role_template',`
-
- allow $1_wm_t $3:unix_stream_socket connectto;
- allow $3 $1_wm_t:unix_stream_socket connectto;
-- allow $3 $1_wm_t:process { signal sigchld };
-+ allow $3 $1_wm_t:process { signal sigchld signull };
- allow $1_wm_t $3:process { signull sigkill };
-
- allow $1_wm_t $3:dbus send_msg;
-@@ -72,9 +72,16 @@ template(`wm_role_template',`
-
- auth_use_nsswitch($1_wm_t)
-
-+ application_signull($1_wm_t)
-+
+@@ -77,6 +77,11 @@ template(`wm_role_template',`
miscfiles_read_fonts($1_wm_t)
miscfiles_read_localization($1_wm_t)
@@ -11263,21 +9832,10 @@ index 223ad43..d400ef6 100644
# Reading dotfiles...
# cjp: ?
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
-index 34c9d01..ddb1528 100644
+index 3fae11a..c8607de 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
-@@ -72,7 +72,9 @@ ifdef(`distro_redhat',`
- /etc/kde/shutdown(/.*)? gen_context(system_u:object_r:bin_t,s0)
-
- /etc/mail/make -- gen_context(system_u:object_r:bin_t,s0)
--/etc/mgetty\+sendfax/new_fax -- gen_context(system_u:object_r:bin_t,s0)
-+/etc/mcelog/cache-error-trigger -- gen_context(system_u:object_r:bin_t,s0)
-+/etc/mcelog/triggers(/.*)? gen_context(system_u:object_r:bin_t,s0)
-+etc/mgetty\+sendfax/new_fax -- gen_context(system_u:object_r:bin_t,s0)
-
- /etc/netplug\.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
-
-@@ -95,8 +97,6 @@ ifdef(`distro_redhat',`
+@@ -97,8 +97,6 @@ ifdef(`distro_redhat',`
/etc/rc\.d/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0)
@@ -11286,7 +9844,7 @@ index 34c9d01..ddb1528 100644
/etc/sysconfig/crond -- gen_context(system_u:object_r:bin_t,s0)
/etc/sysconfig/init -- gen_context(system_u:object_r:bin_t,s0)
/etc/sysconfig/libvirtd -- gen_context(system_u:object_r:bin_t,s0)
-@@ -128,18 +128,15 @@ ifdef(`distro_debian',`
+@@ -130,18 +128,15 @@ ifdef(`distro_debian',`
/lib/readahead(/.*)? gen_context(system_u:object_r:bin_t,s0)
/lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0)
@@ -11307,7 +9865,7 @@ index 34c9d01..ddb1528 100644
/lib/rcscripts/addons(/.*)? gen_context(system_u:object_r:bin_t,s0)
/lib/rcscripts/sh(/.*)? gen_context(system_u:object_r:bin_t,s0)
-@@ -177,6 +174,8 @@ ifdef(`distro_gentoo',`
+@@ -179,6 +174,8 @@ ifdef(`distro_gentoo',`
/opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0)
')
@@ -11316,7 +9874,7 @@ index 34c9d01..ddb1528 100644
#
# /usr
#
-@@ -196,47 +195,51 @@ ifdef(`distro_gentoo',`
+@@ -198,48 +195,51 @@ ifdef(`distro_gentoo',`
/usr/lib/pgsql/test/regress/.*\.sh -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/qt.*/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib/wicd/monitor\.py -- gen_context(system_u:object_r:bin_t, s0)
@@ -11326,6 +9884,7 @@ index 34c9d01..ddb1528 100644
-/usr/lib(64)?/ConsoleKit/run-session.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
-/usr/lib(64)?/courier(/.*)? gen_context(system_u:object_r:bin_t,s0)
-/usr/lib(64)?/cups(/.*)? gen_context(system_u:object_r:bin_t,s0)
+-/usr/lib(64)?/cyrus/.* -- gen_context(system_u:object_r:bin_t,s0)
-/usr/lib(64)?/cyrus-imapd/.* -- gen_context(system_u:object_r:bin_t,s0)
-/usr/lib(64)?/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0)
-/usr/lib(64)?/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0)
@@ -11409,7 +9968,7 @@ index 34c9d01..ddb1528 100644
/usr/libexec(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/libexec/git-core/git-shell -- gen_context(system_u:object_r:shell_exec_t,s0)
-@@ -244,9 +247,13 @@ ifdef(`distro_gentoo',`
+@@ -247,9 +247,13 @@ ifdef(`distro_gentoo',`
/usr/libexec/openssh/sftp-server -- gen_context(system_u:object_r:bin_t,s0)
@@ -11424,7 +9983,7 @@ index 34c9d01..ddb1528 100644
/usr/local/linuxprinter/filters(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0)
-@@ -283,6 +290,7 @@ ifdef(`distro_gentoo',`
+@@ -286,6 +290,7 @@ ifdef(`distro_gentoo',`
/usr/share/smolt/client(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall/compiler\.pl -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall/configpath -- gen_context(system_u:object_r:bin_t,s0)
@@ -11432,7 +9991,7 @@ index 34c9d01..ddb1528 100644
/usr/share/shorewall-perl(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall-shell(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall-lite(/.*)? gen_context(system_u:object_r:bin_t,s0)
-@@ -291,7 +299,7 @@ ifdef(`distro_gentoo',`
+@@ -294,7 +299,7 @@ ifdef(`distro_gentoo',`
/usr/share/turboprint/lib(/.*)? -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/vhostmd/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -11441,7 +10000,7 @@ index 34c9d01..ddb1528 100644
ifdef(`distro_gentoo', `
/usr/.*-.*-linux-gnu/gcc-bin/.*(/.*)? gen_context(system_u:object_r:bin_t,s0)
-@@ -304,9 +312,8 @@ ifdef(`distro_redhat', `
+@@ -307,9 +312,8 @@ ifdef(`distro_redhat', `
/etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0)
/usr/lib/.*/program(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -11452,7 +10011,7 @@ index 34c9d01..ddb1528 100644
/usr/lib/vmware-tools/(s)?bin32(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib/vmware-tools/(s)?bin64(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/authconfig/authconfig-gtk\.py -- gen_context(system_u:object_r:bin_t,s0)
-@@ -316,9 +323,11 @@ ifdef(`distro_redhat', `
+@@ -319,9 +323,11 @@ ifdef(`distro_redhat', `
/usr/share/clamav/clamd-gen -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/clamav/freshclam-sleep -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/createrepo(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -11464,7 +10023,7 @@ index 34c9d01..ddb1528 100644
/usr/share/pwlib/make/ptlib-config -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/pydict/pydict\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/rhn/rhn_applet/applet\.py -- gen_context(system_u:object_r:bin_t,s0)
-@@ -360,7 +369,7 @@ ifdef(`distro_redhat', `
+@@ -363,7 +369,7 @@ ifdef(`distro_redhat', `
ifdef(`distro_suse', `
/usr/lib/cron/run-crons -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/samba/classic/.* -- gen_context(system_u:object_r:bin_t,s0)
@@ -11473,7 +10032,7 @@ index 34c9d01..ddb1528 100644
/usr/share/apache2/[^/]* -- gen_context(system_u:object_r:bin_t,s0)
')
-@@ -372,8 +381,9 @@ ifdef(`distro_suse', `
+@@ -375,8 +381,9 @@ ifdef(`distro_suse', `
/var/ftp/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/var/lib/asterisk/agi-bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -11530,90 +10089,11 @@ index 9e9263a..59c2125 100644
manage_files_pattern($1, bin_t, exec_type)
manage_lnk_files_pattern($1, bin_t, bin_t)
')
-diff --git a/policy/modules/kernel/corenetwork.fc b/policy/modules/kernel/corenetwork.fc
-index 9e5c83e..953e0e8 100644
---- a/policy/modules/kernel/corenetwork.fc
-+++ b/policy/modules/kernel/corenetwork.fc
-@@ -5,3 +5,6 @@
- /dev/tap.* -c gen_context(system_u:object_r:tun_tap_device_t,s0)
-
- /dev/net/.* -c gen_context(system_u:object_r:tun_tap_device_t,s0)
-+
-+/lib/udev/devices/ppp -c gen_context(system_u:object_r:ppp_device_t,s0)
-+/lib/udev/devices/net/.* -c gen_context(system_u:object_r:tun_tap_device_t,s0)
diff --git a/policy/modules/kernel/corenetwork.if.in b/policy/modules/kernel/corenetwork.if.in
-index 5a07a43..eb5f76e 100644
+index 4f3b542..4581434 100644
--- a/policy/modules/kernel/corenetwork.if.in
+++ b/policy/modules/kernel/corenetwork.if.in
-@@ -32,6 +32,33 @@ interface(`corenet_port',`
-
- ########################################
- ## <summary>
-+## Define type to be a network node type
-+## </summary>
-+## <desc>
-+## <p>
-+## Define type to be a network node type
-+## </p>
-+## <p>
-+## This is for supporting third party modules and its
-+## use is not allowed in upstream reference policy.
-+## </p>
-+## </desc>
-+## <param name="domain">
-+## <summary>
-+## Type to be used for network nodes.
-+## </summary>
-+## </param>
-+#
-+interface(`corenet_node',`
-+ gen_require(`
-+ attribute node_type;
-+ ')
-+
-+ typeattribute $1 node_type;
-+')
-+
-+########################################
-+## <summary>
- ## Define network type to be a reserved port (lt 1024)
- ## </summary>
- ## <desc>
-@@ -86,6 +113,33 @@ interface(`corenet_rpc_port',`
-
- ########################################
- ## <summary>
-+## Define type to be a network packet type
-+## </summary>
-+## <desc>
-+## <p>
-+## Define type to be a network packet type
-+## </p>
-+## <p>
-+## This is for supporting third party modules and its
-+## use is not allowed in upstream reference policy.
-+## </p>
-+## </desc>
-+## <param name="domain">
-+## <summary>
-+## Type to be used for a network packet.
-+## </summary>
-+## </param>
-+#
-+interface(`corenet_packet',`
-+ gen_require(`
-+ attribute packet_type;
-+ ')
-+
-+ typeattribute $1 packet_type;
-+')
-+
-+########################################
-+## <summary>
- ## Define type to be a network client packet type
- ## </summary>
- ## <desc>
-@@ -561,6 +615,24 @@ interface(`corenet_raw_sendrecv_all_if',`
+@@ -615,6 +615,24 @@ interface(`corenet_raw_sendrecv_all_if',`
########################################
## <summary>
@@ -11638,7 +10118,7 @@ index 5a07a43..eb5f76e 100644
## Send and receive TCP network traffic on generic nodes.
## </summary>
## <desc>
-@@ -735,6 +807,24 @@ interface(`corenet_raw_sendrecv_generic_node',`
+@@ -789,6 +807,24 @@ interface(`corenet_raw_sendrecv_generic_node',`
########################################
## <summary>
@@ -11663,7 +10143,7 @@ index 5a07a43..eb5f76e 100644
## Bind TCP sockets to generic nodes.
## </summary>
## <desc>
-@@ -874,6 +964,24 @@ interface(`corenet_inout_generic_node',`
+@@ -928,6 +964,24 @@ interface(`corenet_inout_generic_node',`
########################################
## <summary>
@@ -11688,7 +10168,7 @@ index 5a07a43..eb5f76e 100644
## Send and receive TCP network traffic on all nodes.
## </summary>
## <param name="domain">
-@@ -1048,6 +1156,24 @@ interface(`corenet_raw_sendrecv_all_nodes',`
+@@ -1102,6 +1156,24 @@ interface(`corenet_raw_sendrecv_all_nodes',`
########################################
## <summary>
@@ -11713,7 +10193,7 @@ index 5a07a43..eb5f76e 100644
## Bind TCP sockets to all nodes.
## </summary>
## <param name="domain">
-@@ -1103,6 +1229,24 @@ interface(`corenet_raw_bind_all_nodes',`
+@@ -1157,6 +1229,24 @@ interface(`corenet_raw_bind_all_nodes',`
########################################
## <summary>
@@ -11738,7 +10218,7 @@ index 5a07a43..eb5f76e 100644
## Send and receive TCP network traffic on generic ports.
## </summary>
## <param name="domain">
-@@ -1121,6 +1265,26 @@ interface(`corenet_tcp_sendrecv_generic_port',`
+@@ -1175,6 +1265,26 @@ interface(`corenet_tcp_sendrecv_generic_port',`
########################################
## <summary>
@@ -11765,7 +10245,7 @@ index 5a07a43..eb5f76e 100644
## Do not audit send and receive TCP network traffic on generic ports.
## </summary>
## <param name="domain">
-@@ -1190,6 +1354,26 @@ interface(`corenet_udp_sendrecv_generic_port',`
+@@ -1244,6 +1354,26 @@ interface(`corenet_udp_sendrecv_generic_port',`
########################################
## <summary>
@@ -11792,7 +10272,7 @@ index 5a07a43..eb5f76e 100644
## Bind TCP sockets to generic ports.
## </summary>
## <param name="domain">
-@@ -1210,6 +1394,25 @@ interface(`corenet_tcp_bind_generic_port',`
+@@ -1264,6 +1394,25 @@ interface(`corenet_tcp_bind_generic_port',`
########################################
## <summary>
@@ -11818,7 +10298,7 @@ index 5a07a43..eb5f76e 100644
## Do not audit bind TCP sockets to generic ports.
## </summary>
## <param name="domain">
-@@ -1248,6 +1451,24 @@ interface(`corenet_udp_bind_generic_port',`
+@@ -1302,6 +1451,24 @@ interface(`corenet_udp_bind_generic_port',`
########################################
## <summary>
@@ -11843,7 +10323,7 @@ index 5a07a43..eb5f76e 100644
## Connect TCP sockets to generic ports.
## </summary>
## <param name="domain">
-@@ -1266,6 +1487,24 @@ interface(`corenet_tcp_connect_generic_port',`
+@@ -1320,6 +1487,24 @@ interface(`corenet_tcp_connect_generic_port',`
########################################
## <summary>
@@ -11868,7 +10348,7 @@ index 5a07a43..eb5f76e 100644
## Send and receive TCP network traffic on all ports.
## </summary>
## <desc>
-@@ -1385,6 +1624,25 @@ interface(`corenet_udp_sendrecv_all_ports',`
+@@ -1439,6 +1624,25 @@ interface(`corenet_udp_sendrecv_all_ports',`
########################################
## <summary>
@@ -11894,7 +10374,7 @@ index 5a07a43..eb5f76e 100644
## Bind TCP sockets to all ports.
## </summary>
## <param name="domain">
-@@ -1404,6 +1662,24 @@ interface(`corenet_tcp_bind_all_ports',`
+@@ -1458,6 +1662,24 @@ interface(`corenet_tcp_bind_all_ports',`
########################################
## <summary>
@@ -11919,7 +10399,7 @@ index 5a07a43..eb5f76e 100644
## Do not audit attepts to bind TCP sockets to any ports.
## </summary>
## <param name="domain">
-@@ -1459,6 +1735,24 @@ interface(`corenet_dontaudit_udp_bind_all_ports',`
+@@ -1513,6 +1735,24 @@ interface(`corenet_dontaudit_udp_bind_all_ports',`
########################################
## <summary>
@@ -11944,75 +10424,37 @@ index 5a07a43..eb5f76e 100644
## Connect TCP sockets to all ports.
## </summary>
## <desc>
-@@ -1505,7 +1799,7 @@ interface(`corenet_tcp_connect_all_ports',`
+@@ -1559,6 +1799,25 @@ interface(`corenet_tcp_connect_all_ports',`
########################################
## <summary>
--## Do not audit attempts to connect TCP sockets
+## Do not audit attempts to connect DCCP sockets
- ## to all ports.
- ## </summary>
- ## <param name="domain">
-@@ -1514,35 +1808,72 @@ interface(`corenet_tcp_connect_all_ports',`
- ## </summary>
- ## </param>
- #
--interface(`corenet_dontaudit_tcp_connect_all_ports',`
-+interface(`corenet_dontaudit_dccp_connect_all_ports',`
- gen_require(`
- attribute port_type;
- ')
-
-- dontaudit $1 port_type:tcp_socket name_connect;
-+ dontaudit $1 port_type:dccp_socket name_connect;
- ')
-
- ########################################
- ## <summary>
--## Send and receive TCP network traffic on generic reserved ports.
-+## Do not audit attempts to connect TCP sockets
+## to all ports.
- ## </summary>
- ## <param name="domain">
- ## <summary>
--## Domain allowed access.
-+## Domain to not audit.
- ## </summary>
- ## </param>
- #
--interface(`corenet_tcp_sendrecv_reserved_port',`
-+interface(`corenet_dontaudit_tcp_connect_all_ports',`
- gen_require(`
-- type reserved_port_t;
-+ attribute port_type;
- ')
-
-- allow $1 reserved_port_t:tcp_socket { send_msg recv_msg };
-+ dontaudit $1 port_type:tcp_socket name_connect;
- ')
-
- ########################################
- ## <summary>
--## Send UDP network traffic on generic reserved ports.
-+## Send and receive DCCP network traffic on generic reserved ports.
+## </summary>
+## <param name="domain">
+## <summary>
-+## Domain allowed access.
++## Domain to not audit.
+## </summary>
+## </param>
+#
-+interface(`corenet_dccp_sendrecv_reserved_port',`
++interface(`corenet_dontaudit_dccp_connect_all_ports',`
+ gen_require(`
-+ type reserved_port_t;
++ attribute port_type;
+ ')
+
-+ allow $1 reserved_port_t:dccp_socket { send_msg recv_msg };
++ dontaudit $1 port_type:dccp_socket name_connect;
+')
+
+########################################
+## <summary>
-+## Send and receive TCP network traffic on generic reserved ports.
+ ## Do not audit attempts to connect TCP sockets
+ ## to all ports.
+ ## </summary>
+@@ -1578,6 +1837,24 @@ interface(`corenet_dontaudit_tcp_connect_all_ports',`
+
+ ########################################
+ ## <summary>
++## Send and receive DCCP network traffic on generic reserved ports.
+## </summary>
+## <param name="domain">
+## <summary>
@@ -12020,21 +10462,20 @@ index 5a07a43..eb5f76e 100644
+## </summary>
+## </param>
+#
-+interface(`corenet_tcp_sendrecv_reserved_port',`
++interface(`corenet_dccp_sendrecv_reserved_port',`
+ gen_require(`
+ type reserved_port_t;
+ ')
+
-+ allow $1 reserved_port_t:tcp_socket { send_msg recv_msg };
++ allow $1 reserved_port_t:dccp_socket { send_msg recv_msg };
+')
+
+########################################
+## <summary>
-+## Send UDP network traffic on generic reserved ports.
+ ## Send and receive TCP network traffic on generic reserved ports.
## </summary>
## <param name="domain">
- ## <summary>
-@@ -1593,6 +1924,25 @@ interface(`corenet_udp_sendrecv_reserved_port',`
+@@ -1647,6 +1924,25 @@ interface(`corenet_udp_sendrecv_reserved_port',`
########################################
## <summary>
@@ -12060,11 +10501,55 @@ index 5a07a43..eb5f76e 100644
## Bind TCP sockets to generic reserved ports.
## </summary>
## <param name="domain">
-@@ -1631,6 +1981,24 @@ interface(`corenet_udp_bind_reserved_port',`
+@@ -1685,7 +1981,7 @@ interface(`corenet_udp_bind_reserved_port',`
########################################
## <summary>
+-## Connect TCP sockets to generic reserved ports.
+## Connect DCCP sockets to generic reserved ports.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -1693,17 +1989,17 @@ interface(`corenet_udp_bind_reserved_port',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`corenet_tcp_connect_reserved_port',`
++interface(`corenet_dccp_connect_reserved_port',`
+ gen_require(`
+ type reserved_port_t;
+ ')
+
+- allow $1 reserved_port_t:tcp_socket name_connect;
++ allow $1 reserved_port_t:dccp_socket name_connect;
+ ')
+
+ ########################################
+ ## <summary>
+-## Send and receive TCP network traffic on all reserved ports.
++## Connect TCP sockets to generic reserved ports.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -1711,17 +2007,53 @@ interface(`corenet_tcp_connect_reserved_port',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`corenet_tcp_sendrecv_all_reserved_ports',`
++interface(`corenet_tcp_connect_reserved_port',`
+ gen_require(`
+- attribute reserved_port_type;
++ type reserved_port_t;
+ ')
+
+- allow $1 reserved_port_type:tcp_socket { send_msg recv_msg };
++ allow $1 reserved_port_t:tcp_socket name_connect;
+ ')
+
+ ########################################
+ ## <summary>
+-## Send UDP network traffic on all reserved ports.
++## Send and receive DCCP network traffic on all reserved ports.
+## </summary>
+## <param name="domain">
+## <summary>
@@ -12072,24 +10557,17 @@ index 5a07a43..eb5f76e 100644
+## </summary>
+## </param>
+#
-+interface(`corenet_dccp_connect_reserved_port',`
++interface(`corenet_dccp_sendrecv_all_reserved_ports',`
+ gen_require(`
-+ type reserved_port_t;
++ attribute reserved_port_type;
+ ')
+
-+ allow $1 reserved_port_t:dccp_socket name_connect;
++ allow $1 reserved_port_type:dccp_socket { send_msg recv_msg };
+')
+
+########################################
+## <summary>
- ## Connect TCP sockets to generic reserved ports.
- ## </summary>
- ## <param name="domain">
-@@ -1649,6 +2017,24 @@ interface(`corenet_tcp_connect_reserved_port',`
-
- ########################################
- ## <summary>
-+## Send and receive DCCP network traffic on all reserved ports.
++## Send and receive TCP network traffic on all reserved ports.
+## </summary>
+## <param name="domain">
+## <summary>
@@ -12097,20 +10575,21 @@ index 5a07a43..eb5f76e 100644
+## </summary>
+## </param>
+#
-+interface(`corenet_dccp_sendrecv_all_reserved_ports',`
++interface(`corenet_tcp_sendrecv_all_reserved_ports',`
+ gen_require(`
+ attribute reserved_port_type;
+ ')
+
-+ allow $1 reserved_port_type:dccp_socket { send_msg recv_msg };
++ allow $1 reserved_port_type:tcp_socket { send_msg recv_msg };
+')
+
+########################################
+## <summary>
- ## Send and receive TCP network traffic on all reserved ports.
++## Send UDP network traffic on all reserved ports.
## </summary>
## <param name="domain">
-@@ -1718,6 +2104,25 @@ interface(`corenet_udp_sendrecv_all_reserved_ports',`
+ ## <summary>
+@@ -1772,6 +2104,25 @@ interface(`corenet_udp_sendrecv_all_reserved_ports',`
########################################
## <summary>
@@ -12136,7 +10615,7 @@ index 5a07a43..eb5f76e 100644
## Bind TCP sockets to all reserved ports.
## </summary>
## <param name="domain">
-@@ -1737,6 +2142,24 @@ interface(`corenet_tcp_bind_all_reserved_ports',`
+@@ -1791,6 +2142,24 @@ interface(`corenet_tcp_bind_all_reserved_ports',`
########################################
## <summary>
@@ -12161,7 +10640,7 @@ index 5a07a43..eb5f76e 100644
## Do not audit attempts to bind TCP sockets to all reserved ports.
## </summary>
## <param name="domain">
-@@ -1792,6 +2215,24 @@ interface(`corenet_dontaudit_udp_bind_all_reserved_ports',`
+@@ -1846,6 +2215,24 @@ interface(`corenet_dontaudit_udp_bind_all_reserved_ports',`
########################################
## <summary>
@@ -12186,7 +10665,7 @@ index 5a07a43..eb5f76e 100644
## Bind TCP sockets to all ports > 1024.
## </summary>
## <param name="domain">
-@@ -1828,6 +2269,24 @@ interface(`corenet_udp_bind_all_unreserved_ports',`
+@@ -1882,6 +2269,24 @@ interface(`corenet_udp_bind_all_unreserved_ports',`
########################################
## <summary>
@@ -12211,7 +10690,7 @@ index 5a07a43..eb5f76e 100644
## Connect TCP sockets to reserved ports.
## </summary>
## <param name="domain">
-@@ -1846,6 +2305,24 @@ interface(`corenet_tcp_connect_all_reserved_ports',`
+@@ -1900,6 +2305,24 @@ interface(`corenet_tcp_connect_all_reserved_ports',`
########################################
## <summary>
@@ -12236,7 +10715,7 @@ index 5a07a43..eb5f76e 100644
## Connect TCP sockets to all ports > 1024.
## </summary>
## <param name="domain">
-@@ -1864,6 +2341,25 @@ interface(`corenet_tcp_connect_all_unreserved_ports',`
+@@ -1918,6 +2341,25 @@ interface(`corenet_tcp_connect_all_unreserved_ports',`
########################################
## <summary>
@@ -12262,7 +10741,7 @@ index 5a07a43..eb5f76e 100644
## Do not audit attempts to connect TCP sockets
## all reserved ports.
## </summary>
-@@ -1883,6 +2379,24 @@ interface(`corenet_dontaudit_tcp_connect_all_reserved_ports',`
+@@ -1937,6 +2379,24 @@ interface(`corenet_dontaudit_tcp_connect_all_reserved_ports',`
########################################
## <summary>
@@ -12287,7 +10766,7 @@ index 5a07a43..eb5f76e 100644
## Connect TCP sockets to rpc ports.
## </summary>
## <param name="domain">
-@@ -1901,6 +2415,25 @@ interface(`corenet_tcp_connect_all_rpc_ports',`
+@@ -1955,6 +2415,25 @@ interface(`corenet_tcp_connect_all_rpc_ports',`
########################################
## <summary>
@@ -12313,7 +10792,7 @@ index 5a07a43..eb5f76e 100644
## Do not audit attempts to connect TCP sockets
## all rpc ports.
## </summary>
-@@ -1939,6 +2472,24 @@ interface(`corenet_rw_tun_tap_dev',`
+@@ -1993,6 +2472,24 @@ interface(`corenet_rw_tun_tap_dev',`
########################################
## <summary>
@@ -12338,7 +10817,7 @@ index 5a07a43..eb5f76e 100644
## Do not audit attempts to read or write the TUN/TAP
## virtual network device.
## </summary>
-@@ -1995,6 +2546,25 @@ interface(`corenet_rw_ppp_dev',`
+@@ -2049,6 +2546,25 @@ interface(`corenet_rw_ppp_dev',`
########################################
## <summary>
@@ -12364,7 +10843,7 @@ index 5a07a43..eb5f76e 100644
## Bind TCP sockets to all RPC ports.
## </summary>
## <param name="domain">
-@@ -2014,6 +2584,24 @@ interface(`corenet_tcp_bind_all_rpc_ports',`
+@@ -2068,6 +2584,24 @@ interface(`corenet_tcp_bind_all_rpc_ports',`
########################################
## <summary>
@@ -12389,7 +10868,7 @@ index 5a07a43..eb5f76e 100644
## Do not audit attempts to bind TCP sockets to all RPC ports.
## </summary>
## <param name="domain">
-@@ -2140,6 +2728,25 @@ interface(`corenet_tcp_recv_netlabel',`
+@@ -2194,6 +2728,25 @@ interface(`corenet_tcp_recv_netlabel',`
########################################
## <summary>
@@ -12415,7 +10894,7 @@ index 5a07a43..eb5f76e 100644
## Receive TCP packets from a NetLabel connection.
## </summary>
## <param name="domain">
-@@ -2159,6 +2766,31 @@ interface(`corenet_tcp_recvfrom_netlabel',`
+@@ -2213,6 +2766,31 @@ interface(`corenet_tcp_recvfrom_netlabel',`
########################################
## <summary>
@@ -12447,7 +10926,7 @@ index 5a07a43..eb5f76e 100644
## Receive TCP packets from an unlabled connection.
## </summary>
## <param name="domain">
-@@ -2168,9 +2800,14 @@ interface(`corenet_tcp_recvfrom_netlabel',`
+@@ -2222,9 +2800,14 @@ interface(`corenet_tcp_recvfrom_netlabel',`
## </param>
#
interface(`corenet_tcp_recvfrom_unlabeled',`
@@ -12462,7 +10941,7 @@ index 5a07a43..eb5f76e 100644
# XXX - at some point the oubound/send access check will be removed
# but for right now we need to keep this in place so as not to break
# older systems
-@@ -2195,6 +2832,26 @@ interface(`corenet_dontaudit_tcp_recv_netlabel',`
+@@ -2249,6 +2832,26 @@ interface(`corenet_dontaudit_tcp_recv_netlabel',`
########################################
## <summary>
@@ -12489,7 +10968,7 @@ index 5a07a43..eb5f76e 100644
## Do not audit attempts to receive TCP packets from a NetLabel
## connection.
## </summary>
-@@ -2215,6 +2872,27 @@ interface(`corenet_dontaudit_tcp_recvfrom_netlabel',`
+@@ -2269,6 +2872,27 @@ interface(`corenet_dontaudit_tcp_recvfrom_netlabel',`
########################################
## <summary>
@@ -12517,7 +10996,7 @@ index 5a07a43..eb5f76e 100644
## Do not audit attempts to receive TCP packets from an unlabeled
## connection.
## </summary>
-@@ -2479,6 +3157,7 @@ interface(`corenet_dontaudit_raw_recvfrom_unlabeled',`
+@@ -2533,6 +3157,7 @@ interface(`corenet_dontaudit_raw_recvfrom_unlabeled',`
## <infoflow type="read" weight="10"/>
#
interface(`corenet_all_recvfrom_unlabeled',`
@@ -12525,7 +11004,7 @@ index 5a07a43..eb5f76e 100644
kernel_tcp_recvfrom_unlabeled($1)
kernel_udp_recvfrom_unlabeled($1)
kernel_raw_recvfrom_unlabeled($1)
-@@ -2517,7 +3196,31 @@ interface(`corenet_all_recvfrom_netlabel',`
+@@ -2571,7 +3196,31 @@ interface(`corenet_all_recvfrom_netlabel',`
')
allow $1 netlabel_peer_t:peer recv;
@@ -12558,7 +11037,7 @@ index 5a07a43..eb5f76e 100644
')
########################################
-@@ -2531,6 +3234,7 @@ interface(`corenet_all_recvfrom_netlabel',`
+@@ -2585,6 +3234,7 @@ interface(`corenet_all_recvfrom_netlabel',`
## </param>
#
interface(`corenet_dontaudit_all_recvfrom_unlabeled',`
@@ -12566,7 +11045,7 @@ index 5a07a43..eb5f76e 100644
kernel_dontaudit_tcp_recvfrom_unlabeled($1)
kernel_dontaudit_udp_recvfrom_unlabeled($1)
kernel_dontaudit_raw_recvfrom_unlabeled($1)
-@@ -2559,7 +3263,35 @@ interface(`corenet_dontaudit_all_recvfrom_netlabel',`
+@@ -2613,7 +3263,35 @@ interface(`corenet_dontaudit_all_recvfrom_netlabel',`
')
dontaudit $1 netlabel_peer_t:peer recv;
@@ -12603,7 +11082,7 @@ index 5a07a43..eb5f76e 100644
')
########################################
-@@ -2673,6 +3405,7 @@ interface(`corenet_raw_recvfrom_labeled',`
+@@ -2727,6 +3405,7 @@ interface(`corenet_raw_recvfrom_labeled',`
## </param>
#
interface(`corenet_all_recvfrom_labeled',`
@@ -12612,7 +11091,7 @@ index 5a07a43..eb5f76e 100644
corenet_udp_recvfrom_labeled($1, $2)
corenet_raw_recvfrom_labeled($1, $2)
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
-index 0757523..1bec39a 100644
+index 99b71cb..11ee490 100644
--- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in
@@ -16,6 +16,7 @@ attribute rpc_port_type;
@@ -12650,7 +11129,7 @@ index 0757523..1bec39a 100644
type client_packet_t, packet_type, client_packet_type;
#
-@@ -65,20 +79,26 @@ type hi_reserved_port_t, port_type, reserved_port_type, rpc_port_type;
+@@ -65,22 +79,26 @@ type hi_reserved_port_t, port_type, reserved_port_type, rpc_port_type;
type server_packet_t, packet_type, server_packet_type;
network_port(afs_bos, udp,7007,s0)
@@ -12664,8 +11143,8 @@ index 0757523..1bec39a 100644
network_port(amanda, udp,10080-10082,s0, tcp,10080-10083,s0)
network_port(amavisd_recv, tcp,10024,s0)
network_port(amavisd_send, tcp,10025,s0)
+ network_port(amqp, udp,5671-5672,s0, tcp,5671-5672,s0)
-network_port(aol, udp,5190-5193,s0, tcp,5190-5193,s0)
-+network_port(amqp, udp,5671-5672,s0, tcp,5671-5672,s0)
+network_port(aol, udp,5190-5193,s0, tcp,5190-5193,s0)
network_port(apcupsd, tcp,3551,s0, udp,3551,s0)
+network_port(apertus_ldp, tcp,539,s0, udp,539,s0)
@@ -12673,12 +11152,12 @@ index 0757523..1bec39a 100644
network_port(audit, tcp,60,s0)
network_port(auth, tcp,113,s0)
network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0)
-+network_port(boinc, tcp,31416,s0)
+ network_port(boinc, tcp,31416,s0)
+network_port(boinc_client_ctrl, tcp,1043,s0)
type biff_port_t, port_type, reserved_port_type; dnl network_port(biff) # no defined portcon in current strict
network_port(certmaster, tcp,51235,s0)
network_port(chronyd, udp,323,s0)
-@@ -86,9 +106,11 @@ network_port(clamd, tcp,3310,s0)
+@@ -88,6 +106,7 @@ network_port(clamd, tcp,3310,s0)
network_port(clockspeed, udp,4041,s0)
network_port(cluster, tcp,5149,s0, udp,5149,s0, tcp,40040,s0, tcp,50006-50008,s0, udp,50006-50008,s0)
network_port(cobbler, tcp,25151,s0)
@@ -12686,11 +11165,7 @@ index 0757523..1bec39a 100644
network_port(comsat, udp,512,s0)
network_port(cvs, tcp,2401,s0, udp,2401,s0)
network_port(cyphesis, tcp,6767,s0, tcp,6769,s0, tcp,6780-6799,s0, udp,32771,s0)
-+network_port(daap, tcp,3689,s0, udp,3689,s0)
- network_port(dbskkd, tcp,1178,s0)
- network_port(dcc, udp,6276,s0, udp,6277,s0)
- network_port(dccm, tcp,5679,s0, udp,5679,s0)
-@@ -96,9 +118,14 @@ network_port(dhcpc, udp,68,s0, tcp,68,s0, udp,546,s0, tcp, 546,s0)
+@@ -99,9 +118,14 @@ network_port(dhcpc, udp,68,s0, tcp,68,s0, udp,546,s0, tcp, 546,s0)
network_port(dhcpd, udp,67,s0, udp,547,s0, tcp, 547,s0, udp,548,s0, tcp, 548,s0, tcp,647,s0, udp,647,s0, tcp,847,s0, udp,847,s0, tcp,7911,s0)
network_port(dict, tcp,2628,s0)
network_port(distccd, tcp,3632,s0)
@@ -12705,16 +11180,7 @@ index 0757523..1bec39a 100644
network_port(ftp, tcp,21,s0, tcp,990,s0, udp,990,s0)
network_port(ftp_data, tcp,20,s0)
network_port(gatekeeper, udp,1718,s0, udp,1719,s0, tcp,1721,s0, tcp,7000,s0)
-@@ -112,7 +139,7 @@ network_port(hddtemp, tcp,7634,s0)
- network_port(howl, tcp,5335,s0, udp,5353,s0)
- network_port(hplip, tcp,1782,s0, tcp,2207,s0, tcp,2208,s0, tcp, 8290,s0, tcp,50000,s0, tcp,50002,s0, tcp,8292,s0, tcp,9100,s0, tcp,9101,s0, tcp,9102,s0, tcp,9220,s0, tcp,9221,s0, tcp,9222,s0, tcp,9280,s0, tcp,9281,s0, tcp,9282,s0, tcp,9290,s0, tcp,9291,s0, tcp,9292,s0)
- network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0, tcp,8009,s0, tcp,8443,s0) #8443 is mod_nss default port
--network_port(http_cache, tcp,3128,s0, udp,3130,s0, tcp,8080,s0, tcp,8118,s0, tcp,10001-10010,s0) # 8118 is for privoxy
-+network_port(http_cache, udp,3130,s0, tcp,8080,s0, tcp,8118,s0, tcp,10001-10010,s0) # 8118 is for privoxy
- network_port(i18n_input, tcp,9010,s0)
- network_port(imaze, tcp,5323,s0, udp,5323,s0)
- network_port(inetd_child, tcp,1,s0, udp,1,s0, tcp,7,s0, udp,7,s0, tcp,9,s0, udp,9,s0, tcp,13,s0, udp,13,s0, tcp,19,s0, udp,19,s0, tcp,37,s0, udp,37,s0, tcp,512,s0, tcp,543,s0, tcp,544,s0, tcp,891,s0, udp,891,s0, tcp,892,s0, udp,892,s0, tcp,2105,s0, tcp,5666,s0)
-@@ -126,43 +153,59 @@ network_port(iscsi, tcp,3260,s0)
+@@ -129,20 +153,25 @@ network_port(iscsi, tcp,3260,s0)
network_port(isns, tcp,3205,s0, udp,3205,s0)
network_port(jabber_client, tcp,5222,s0, tcp,5223,s0)
network_port(jabber_interserver, tcp,5269,s0)
@@ -12740,22 +11206,11 @@ index 0757523..1bec39a 100644
network_port(mmcc, tcp,5050,s0, udp,5050,s0)
network_port(monopd, tcp,1234,s0)
+network_port(movaz_ssc, tcp,5252,s0)
-+network_port(mpd, tcp,6600,s0)
+ network_port(mpd, tcp,6600,s0)
network_port(msnp, tcp,1863,s0, udp,1863,s0)
--network_port(mssql, tcp,1433,s0, tcp,1434,s0, udp,1433,s0, udp,1434,s0)
-+network_port(mssql, tcp,1433-1434,s0, udp,1433-1434,s0)
- network_port(munin, tcp,4949,s0, udp,4949,s0)
--network_port(mysqld, tcp,1186,s0, tcp,3306,s0, tcp,63132-63163,s0)
-+network_port(mysqld, tcp,1186,s0, tcp,3306,s0, tcp,63132-63164,s0)
- network_port(mysqlmanagerd, tcp,2273,s0)
- network_port(nessus, tcp,1241,s0)
- network_port(netport, tcp,3129,s0, udp,3129,s0)
- network_port(netsupport, tcp,5404,s0, udp,5404,s0, tcp,5405,s0, udp,5405,s0)
- network_port(nmbd, udp,137,s0, udp,138,s0)
--network_port(ntop, tcp,3000,s0, udp,3000,s0, tcp,3001,s0, udp,3001,s0)
-+network_port(ntop, tcp,3000-3001,s0, udp,3000-3001,s0)
- network_port(ntp, udp,123,s0)
-+network_port(oracledb, tcp, 1521,s0,udp, 1521,s0, tcp,2483,s0,udp,2483,s0, tcp,2484,s0, udp,2484,s0)
+ network_port(mssql, tcp,1433-1434,s0, udp,1433-1434,s0)
+@@ -158,10 +187,18 @@ network_port(ntp, udp,123,s0)
+ network_port(oracledb, tcp, 1521,s0,udp, 1521,s0, tcp,2483,s0,udp,2483,s0, tcp,2484,s0, udp,2484,s0)
network_port(ocsp, tcp,9080,s0)
network_port(openvpn, tcp,1194,s0, udp,1194,s0)
+network_port(pktcable, tcp,2126,s0, udp,2126,s0, tcp,3198,s0, udp,3198,s0)
@@ -12773,14 +11228,7 @@ index 0757523..1bec39a 100644
network_port(pop, tcp,106,s0, tcp,109,s0, tcp,110,s0, tcp,143,s0, tcp,220,s0, tcp,993,s0, tcp,995,s0, tcp,1109,s0)
network_port(portmap, udp,111,s0, tcp,111,s0)
network_port(postfix_policyd, tcp,10031,s0)
- network_port(postgresql, tcp,5432,s0)
- network_port(postgrey, tcp,60000,s0)
- network_port(prelude, tcp,4690,s0, udp,4690,s0)
-+network_port(presence, tcp,5298-5299,s0, udp,5298-5299,s0)
- network_port(printer, tcp,515,s0)
- network_port(ptal, tcp,5703,s0)
- network_port(pulseaudio, tcp,4713,s0)
-@@ -177,24 +220,29 @@ network_port(ricci, tcp,11111,s0, udp,11111,s0)
+@@ -183,25 +220,29 @@ network_port(ricci, tcp,11111,s0, udp,11111,s0)
network_port(ricci_modcluster, tcp,16851,s0, udp,16851,s0)
network_port(rlogind, tcp,513,s0)
network_port(rndc, tcp,953,s0)
@@ -12792,9 +11240,8 @@ index 0757523..1bec39a 100644
network_port(sap, tcp,9875,s0, udp,9875,s0)
+network_port(sametime, tcp,1533,s0, udp,1533,s0)
network_port(sieve, tcp,4190,s0)
--network_port(sip, tcp,5060,s0, udp,5060,s0, tcp,5061,s0, udp,5061,s0)
-+network_port(sip, tcp,5060-5061,s0, udp,5060-5061,s0)
-+network_port(sixxsconfig, tcp,3874,s0, udp,3874,s0)
+ network_port(sip, tcp,5060,s0, udp,5060,s0, tcp,5061,s0, udp,5061,s0)
+ network_port(sixxsconfig, tcp,3874,s0, udp,3874,s0)
network_port(smbd, tcp,137-139,s0, tcp,445,s0)
network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0)
-network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0, tcp, 1161, s0)
@@ -12814,12 +11261,8 @@ index 0757523..1bec39a 100644
network_port(syslogd, udp,514,s0)
network_port(tcs, tcp, 30003, s0)
network_port(telnetd, tcp,23,s0)
-@@ -205,20 +253,22 @@ network_port(transproxy, tcp,8081,s0)
- network_port(ups, tcp,3493,s0)
- type utcpserver_port_t, port_type; dnl network_port(utcpserver) # no defined portcon
- network_port(uucpd, tcp,540,s0)
--network_port(varnishd, tcp,6081,s0, tcp,6082,s0)
-+network_port(varnishd, tcp,6081-6082,s0)
+@@ -215,7 +256,7 @@ network_port(uucpd, tcp,540,s0)
+ network_port(varnishd, tcp,6081-6082,s0)
network_port(virt, tcp,16509,s0, udp,16509,s0, tcp,16514,s0, udp,16514,s0)
network_port(virt_migration, tcp,49152-49216,s0)
-network_port(vnc, tcp,5900,s0)
@@ -12827,12 +11270,7 @@ index 0757523..1bec39a 100644
network_port(wccp, udp,2048,s0)
network_port(whois, tcp,43,s0, udp,43,s0, tcp, 4321, s0 , udp, 4321, s0 )
network_port(xdmcp, udp,177,s0, tcp,177,s0)
- network_port(xen, tcp,8002,s0)
- network_port(xfs, tcp,7100,s0)
--network_port(xserver, tcp,6000-6020,s0)
-+network_port(xserver, tcp,6000-6150,s0)
-+network_port(zarafa, tcp,236,s0, tcp,237,s0)
- network_port(zookeeper_client, tcp,2181,s0)
+@@ -229,6 +270,7 @@ network_port(zookeeper_client, tcp,2181,s0)
network_port(zookeeper_election, tcp,3888,s0)
network_port(zookeeper_leader, tcp,2888,s0)
network_port(zebra, tcp,2600-2604,s0, tcp,2606,s0, udp,2600-2604,s0, udp,2606,s0)
@@ -12840,7 +11278,7 @@ index 0757523..1bec39a 100644
network_port(zope, tcp,8021,s0)
# Defaults for reserved ports. Earlier portcon entries take precedence;
-@@ -272,9 +322,10 @@ typealias netif_t alias { lo_netif_t netif_lo_t };
+@@ -282,9 +324,10 @@ typealias netif_t alias { lo_netif_t netif_lo_t };
allow corenet_unconfined_type node_type:node *;
allow corenet_unconfined_type netif_type:netif *;
allow corenet_unconfined_type packet_type:packet *;
@@ -12849,7 +11287,7 @@ index 0757523..1bec39a 100644
allow corenet_unconfined_type port_type:udp_socket { send_msg recv_msg };
# Bind to any network address.
--allow corenet_unconfined_type port_type:{ tcp_socket udp_socket } name_bind;
+-allow corenet_unconfined_type port_type:{ tcp_socket udp_socket rawip_socket } name_bind;
-allow corenet_unconfined_type node_type:{ tcp_socket udp_socket rawip_socket } node_bind;
+allow corenet_unconfined_type port_type:{ dccp_socket tcp_socket udp_socket rawip_socket } name_bind;
+allow corenet_unconfined_type node_type:{ dccp_socket tcp_socket udp_socket rawip_socket } node_bind;
@@ -12884,7 +11322,7 @@ index 6cf8784..5b25039 100644
+#
+/sys(/.*)? gen_context(system_u:object_r:sysfs_t,s0)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
-index e9313fb..8695196 100644
+index f820f3b..d53edca 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -146,14 +146,33 @@ interface(`dev_relabel_all_dev_nodes',`
@@ -12973,7 +11411,7 @@ index e9313fb..8695196 100644
########################################
## <summary>
## Read and write generic files in /dev.
-@@ -444,6 +499,42 @@ interface(`dev_getattr_generic_blk_files',`
+@@ -462,6 +517,42 @@ interface(`dev_getattr_generic_blk_files',`
########################################
## <summary>
@@ -13016,7 +11454,7 @@ index e9313fb..8695196 100644
## Dontaudit getattr on generic block devices.
## </summary>
## <param name="domain">
-@@ -552,6 +643,24 @@ interface(`dev_dontaudit_getattr_generic_chr_files',`
+@@ -570,6 +661,24 @@ interface(`dev_dontaudit_getattr_generic_chr_files',`
########################################
## <summary>
@@ -13041,7 +11479,7 @@ index e9313fb..8695196 100644
## Dontaudit setattr for generic character device files.
## </summary>
## <param name="domain">
-@@ -628,7 +737,7 @@ interface(`dev_rw_generic_blk_files',`
+@@ -646,7 +755,7 @@ interface(`dev_rw_generic_blk_files',`
## </summary>
## <param name="domain">
## <summary>
@@ -13050,7 +11488,7 @@ index e9313fb..8695196 100644
## </summary>
## </param>
#
-@@ -715,7 +824,7 @@ interface(`dev_dontaudit_setattr_generic_symlinks',`
+@@ -733,7 +842,7 @@ interface(`dev_dontaudit_setattr_generic_symlinks',`
########################################
## <summary>
@@ -13059,7 +11497,7 @@ index e9313fb..8695196 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -723,17 +832,17 @@ interface(`dev_dontaudit_setattr_generic_symlinks',`
+@@ -741,17 +850,17 @@ interface(`dev_dontaudit_setattr_generic_symlinks',`
## </summary>
## </param>
#
@@ -13080,7 +11518,7 @@ index e9313fb..8695196 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -741,17 +850,17 @@ interface(`dev_read_generic_symlinks',`
+@@ -759,17 +868,17 @@ interface(`dev_read_generic_symlinks',`
## </summary>
## </param>
#
@@ -13101,7 +11539,7 @@ index e9313fb..8695196 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -759,12 +868,12 @@ interface(`dev_create_generic_symlinks',`
+@@ -777,12 +886,12 @@ interface(`dev_create_generic_symlinks',`
## </summary>
## </param>
#
@@ -13116,7 +11554,7 @@ index e9313fb..8695196 100644
')
########################################
-@@ -920,7 +1029,7 @@ interface(`dev_filetrans',`
+@@ -938,7 +1047,7 @@ interface(`dev_filetrans',`
type device_t;
')
@@ -13125,7 +11563,7 @@ index e9313fb..8695196 100644
dev_associate($2)
files_associate_tmp($2)
-@@ -1006,6 +1115,7 @@ interface(`dev_dontaudit_getattr_all_blk_files',`
+@@ -1024,6 +1133,7 @@ interface(`dev_dontaudit_getattr_all_blk_files',`
interface(`dev_getattr_all_chr_files',`
gen_require(`
attribute device_node;
@@ -13133,7 +11571,7 @@ index e9313fb..8695196 100644
')
getattr_chr_files_pattern($1, device_t, device_node)
-@@ -1178,6 +1288,42 @@ interface(`dev_create_all_chr_files',`
+@@ -1196,6 +1306,42 @@ interface(`dev_create_all_chr_files',`
########################################
## <summary>
@@ -13176,7 +11614,7 @@ index e9313fb..8695196 100644
## Delete all block device files.
## </summary>
## <param name="domain">
-@@ -2663,7 +2809,7 @@ interface(`dev_write_misc',`
+@@ -2681,7 +2827,7 @@ interface(`dev_write_misc',`
## </summary>
## <param name="domain">
## <summary>
@@ -13185,7 +11623,7 @@ index e9313fb..8695196 100644
## </summary>
## </param>
#
-@@ -3192,24 +3338,6 @@ interface(`dev_rw_printer',`
+@@ -3210,24 +3356,6 @@ interface(`dev_rw_printer',`
########################################
## <summary>
@@ -13210,7 +11648,7 @@ index e9313fb..8695196 100644
## Get the attributes of the QEMU
## microcode and id interfaces.
## </summary>
-@@ -3793,6 +3921,24 @@ interface(`dev_getattr_sysfs_dirs',`
+@@ -3811,6 +3939,24 @@ interface(`dev_getattr_sysfs_dirs',`
########################################
## <summary>
@@ -13235,7 +11673,7 @@ index e9313fb..8695196 100644
## Search the sysfs directories.
## </summary>
## <param name="domain">
-@@ -3884,25 +4030,6 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
+@@ -3902,25 +4048,6 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
########################################
## <summary>
@@ -13261,7 +11699,7 @@ index e9313fb..8695196 100644
## Read hardware state information.
## </summary>
## <desc>
-@@ -3954,6 +4081,42 @@ interface(`dev_rw_sysfs',`
+@@ -3972,6 +4099,42 @@ interface(`dev_rw_sysfs',`
########################################
## <summary>
@@ -13304,7 +11742,7 @@ index e9313fb..8695196 100644
## Read and write the TPM device.
## </summary>
## <param name="domain">
-@@ -4477,6 +4640,24 @@ interface(`dev_rw_vhost',`
+@@ -4495,6 +4658,24 @@ interface(`dev_rw_vhost',`
########################################
## <summary>
@@ -13329,32 +11767,7 @@ index e9313fb..8695196 100644
## Read and write VMWare devices.
## </summary>
## <param name="domain">
-@@ -4514,6 +4695,24 @@ interface(`dev_rwx_vmware',`
-
- ########################################
- ## <summary>
-+## Read to watchdog devices.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_read_watchdog',`
-+ gen_require(`
-+ type device_t, watchdog_device_t;
-+ ')
-+
-+ read_chr_files_pattern($1, device_t, watchdog_device_t)
-+')
-+
-+########################################
-+## <summary>
- ## Write to watchdog devices.
- ## </summary>
- ## <param name="domain">
-@@ -4748,3 +4947,772 @@ interface(`dev_unconfined',`
+@@ -4784,3 +4965,772 @@ interface(`dev_unconfined',`
typeattribute $1 devices_unconfined_type;
')
@@ -14128,7 +12541,7 @@ index e9313fb..8695196 100644
+ filetrans_pattern($1, device_t, usb_device_t, chr_file, "ubc")
+')
diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
-index 3ff4f60..c028367 100644
+index 08f01e7..95a6de8 100644
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -108,6 +108,7 @@ dev_node(ksm_device_t)
@@ -14155,36 +12568,10 @@ index 3ff4f60..c028367 100644
+allow devices_unconfined_type device_node:{ blk_file chr_file lnk_file } *;
allow devices_unconfined_type mtrr_device_t:file *;
diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if
-index aad8c52..53b0624 100644
+index 6a1e4d1..cf3d50b 100644
--- a/policy/modules/kernel/domain.if
+++ b/policy/modules/kernel/domain.if
-@@ -474,6 +474,25 @@ interface(`domain_signal_all_domains',`
-
- ########################################
- ## <summary>
-+## Dontaudit sending general signals to all domains.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`domain_dontaudit_signal_all_domains',`
-+ gen_require(`
-+ attribute domain;
-+ ')
-+
-+ dontaudit $1 domain:process signal;
-+')
-+
-+########################################
-+## <summary>
- ## Send a null signal to all domains.
- ## </summary>
- ## <param name="domain">
-@@ -611,7 +630,7 @@ interface(`domain_read_all_domains_state',`
+@@ -631,7 +631,7 @@ interface(`domain_read_all_domains_state',`
########################################
## <summary>
@@ -14193,12 +12580,7 @@ index aad8c52..53b0624 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -630,11 +649,11 @@ interface(`domain_getattr_all_domains',`
-
- ########################################
- ## <summary>
--## Get the attributes of all domains of all domains.
-+## Dontaudit geting the attributes of all domains.
+@@ -655,7 +655,7 @@ interface(`domain_getattr_all_domains',`
## </summary>
## <param name="domain">
## <summary>
@@ -14207,57 +12589,7 @@ index aad8c52..53b0624 100644
## </summary>
## </param>
#
-@@ -886,6 +905,24 @@ interface(`domain_getsched_all_domains',`
-
- ########################################
- ## <summary>
-+## Get the capability information of all domains.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`domain_getcap_all_domains',`
-+ gen_require(`
-+ attribute domain;
-+ ')
-+
-+ allow $1 domain:process getcap;
-+')
-+
-+########################################
-+## <summary>
- ## Get the attributes of all domains
- ## sockets, for all socket types.
- ## </summary>
-@@ -1260,6 +1297,24 @@ interface(`domain_exec_all_entry_files',`
-
- ########################################
- ## <summary>
-+## dontaudit gettattr on all entry point files
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`domain_dontaudit_getattr_all_entry_files',`
-+ gen_require(`
-+ attribute entry_type;
-+ ')
-+
-+ dontaudit $1 entry_type:file exec_file_perms;
-+')
-+
-+########################################
-+## <summary>
- ## dontaudit checking for execute on all entry point files
- ## </summary>
- ## <param name="domain">
-@@ -1472,4 +1527,29 @@ interface(`domain_unconfined',`
+@@ -1530,4 +1530,29 @@ interface(`domain_unconfined',`
typeattribute $1 can_change_object_identity;
typeattribute $1 set_curr_context;
typeattribute $1 process_uncond_exempt;
@@ -14288,10 +12620,10 @@ index aad8c52..53b0624 100644
+ dontaudit $1 domain:socket_class_set { read write };
')
diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
-index bc534c1..0ffb0e4 100644
+index fae1ab1..1f0b08f 100644
--- a/policy/modules/kernel/domain.te
+++ b/policy/modules/kernel/domain.te
-@@ -4,6 +4,21 @@ policy_module(domain, 1.9.0)
+@@ -4,6 +4,21 @@ policy_module(domain, 1.9.1)
#
# Declarations
#
@@ -14471,7 +12803,7 @@ index bc534c1..0ffb0e4 100644
+# broken kernel
+dontaudit can_change_object_identity can_change_object_identity:key link;
diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
-index 16108f6..d993f7e 100644
+index c19518a..ba08cfe 100644
--- a/policy/modules/kernel/files.fc
+++ b/policy/modules/kernel/files.fc
@@ -18,6 +18,7 @@ ifdef(`distro_redhat',`
@@ -14508,16 +12840,7 @@ index 16108f6..d993f7e 100644
ifdef(`distro_gentoo', `
/etc/profile\.env -- gen_context(system_u:object_r:etc_runtime_t,s0)
-@@ -89,7 +100,7 @@ ifdef(`distro_suse',`
- # HOME_ROOT
- # expanded by genhomedircon
- #
--HOME_ROOT -d gen_context(system_u:object_r:home_root_t,s0-mls_systemhigh)
-+HOME_ROOT gen_context(system_u:object_r:home_root_t,s0-mls_systemhigh)
- HOME_ROOT/\.journal <<none>>
- HOME_ROOT/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
- HOME_ROOT/lost\+found/.* <<none>>
-@@ -101,10 +112,9 @@ HOME_ROOT/lost\+found/.* <<none>>
+@@ -102,10 +113,9 @@ HOME_ROOT/lost\+found/.* <<none>>
/initrd -d gen_context(system_u:object_r:root_t,s0)
#
@@ -14529,7 +12852,7 @@ index 16108f6..d993f7e 100644
#
# /lost+found
-@@ -145,7 +155,7 @@ HOME_ROOT/lost\+found/.* <<none>>
+@@ -146,7 +156,7 @@ HOME_ROOT/lost\+found/.* <<none>>
/opt -d gen_context(system_u:object_r:usr_t,s0)
/opt/.* gen_context(system_u:object_r:usr_t,s0)
@@ -14538,7 +12861,7 @@ index 16108f6..d993f7e 100644
#
# /proc
-@@ -153,6 +163,17 @@ HOME_ROOT/lost\+found/.* <<none>>
+@@ -154,6 +164,12 @@ HOME_ROOT/lost\+found/.* <<none>>
/proc -d <<none>>
/proc/.* <<none>>
@@ -14548,28 +12871,10 @@ index 16108f6..d993f7e 100644
+/rhev/[^/]*/.* <<none>>
+')
+
-+/run -d gen_context(system_u:object_r:var_run_t,s0-mls_systemhigh)
-+/run/.* gen_context(system_u:object_r:var_run_t,s0)
-+/run/.*\.*pid <<none>>
-+/run/lock(/.*)? gen_context(system_u:object_r:var_lock_t,s0)
-+
- #
- # /selinux
- #
-@@ -166,12 +187,6 @@ HOME_ROOT/lost\+found/.* <<none>>
- /srv/.* gen_context(system_u:object_r:var_t,s0)
-
#
--# /sys
--#
--/sys -d <<none>>
--/sys/.* <<none>>
--
--#
- # /tmp
+ # /run
#
- /tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
-@@ -211,7 +226,6 @@ HOME_ROOT/lost\+found/.* <<none>>
+@@ -214,7 +230,6 @@ HOME_ROOT/lost\+found/.* <<none>>
ifndef(`distro_redhat',`
/usr/local/src(/.*)? gen_context(system_u:object_r:src_t,s0)
@@ -14577,7 +12882,7 @@ index 16108f6..d993f7e 100644
/usr/src(/.*)? gen_context(system_u:object_r:src_t,s0)
/usr/src/kernels/.+/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
')
-@@ -227,23 +241,27 @@ ifndef(`distro_redhat',`
+@@ -230,17 +245,20 @@ ifndef(`distro_redhat',`
/var/ftp/etc(/.*)? gen_context(system_u:object_r:etc_t,s0)
@@ -14594,26 +12899,19 @@ index 16108f6..d993f7e 100644
/var/lost\+found/.* <<none>>
/var/run -d gen_context(system_u:object_r:var_run_t,s0-mls_systemhigh)
+-/var/run -l gen_context(system_u:object_r:var_run_t,s0)
+/var/run -l gen_context(system_u:object_r:var_run_t,s0-mls_systemhigh)
/var/run/.* gen_context(system_u:object_r:var_run_t,s0)
/var/run/.*\.*pid <<none>>
- /var/spool(/.*)? gen_context(system_u:object_r:var_spool_t,s0)
- /var/spool/postfix/etc(/.*)? gen_context(system_u:object_r:etc_t,s0)
-
--/var/tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
-+/var/tmp gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
- /var/tmp/.* <<none>>
- /var/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
- /var/tmp/lost\+found/.* <<none>>
-@@ -252,3 +270,5 @@ ifndef(`distro_redhat',`
+@@ -257,3 +275,5 @@ ifndef(`distro_redhat',`
ifdef(`distro_debian',`
/var/run/motd -- gen_context(system_u:object_r:etc_runtime_t,s0)
')
+/nsr(/.*)? gen_context(system_u:object_r:var_t,s0)
+/nsr/logs(/.*)? gen_context(system_u:object_r:var_log_t,s0)
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
-index 958ca84..62352ec 100644
+index ff006ea..5ce2d76 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -1053,10 +1053,8 @@ interface(`files_relabel_all_files',`
@@ -14629,53 +12927,10 @@ index 958ca84..62352ec 100644
# satisfy the assertions:
seutil_relabelto_bin_policy($1)
-@@ -1410,6 +1408,24 @@ interface(`files_getattr_all_mountpoints',`
-
- ########################################
- ## <summary>
-+## Set the attributes of all mount points.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`files_setattr_all_mountpoints',`
-+ gen_require(`
-+ attribute mountpoint;
-+ ')
-+
-+ allow $1 mountpoint:dir setattr;
-+')
-+
-+########################################
-+## <summary>
- ## Search all mount points.
- ## </summary>
- ## <param name="domain">
-@@ -1446,6 +1462,60 @@ interface(`files_dontaudit_search_all_mountpoints',`
+@@ -1482,6 +1480,42 @@ interface(`files_dontaudit_list_all_mountpoints',`
########################################
## <summary>
-+## Do not audit listing of all mount points.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`files_dontaudit_list_all_mountpoints',`
-+ gen_require(`
-+ attribute mountpoint;
-+ ')
-+
-+ dontaudit $1 mountpoint:dir list_dir_perms;
-+')
-+
-+########################################
-+## <summary>
+## Write all mount points.
+## </summary>
+## <param name="domain">
@@ -14715,7 +12970,7 @@ index 958ca84..62352ec 100644
## List the contents of the root directory.
## </summary>
## <param name="domain">
-@@ -1526,7 +1596,7 @@ interface(`files_root_filetrans',`
+@@ -1562,7 +1596,7 @@ interface(`files_root_filetrans',`
type root_t;
')
@@ -14724,32 +12979,7 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -1731,6 +1801,24 @@ interface(`files_list_boot',`
- allow $1 boot_t:dir list_dir_perms;
- ')
-
-+#######################################
-+## <summary>
-+## Dontaudit List the /boot directory.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`files_dontaudit_list_boot',`
-+ gen_require(`
-+ type boot_t;
-+ ')
-+
-+ dontaudit $1 boot_t:dir list_dir_perms;
-+')
-+
- ########################################
- ## <summary>
- ## Create directories in /boot
-@@ -1794,7 +1882,7 @@ interface(`files_boot_filetrans',`
+@@ -1848,7 +1882,7 @@ interface(`files_boot_filetrans',`
type boot_t;
')
@@ -14758,33 +12988,7 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -1854,6 +1942,25 @@ interface(`files_relabelfrom_boot_files',`
- relabelfrom_files_pattern($1, boot_t, boot_t)
- ')
-
-+######################################
-+## <summary>
-+## Read symbolic links
-+## in the /boot directory.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`files_read_boot_symlinks',`
-+ gen_require(`
-+ type boot_t;
-+ ')
-+
-+ read_lnk_files_pattern($1, boot_t, boot_t)
-+')
-+
- ########################################
- ## <summary>
- ## Read and write symbolic links
-@@ -2300,6 +2407,24 @@ interface(`files_rw_etc_dirs',`
+@@ -2372,6 +2406,24 @@ interface(`files_rw_etc_dirs',`
allow $1 etc_t:dir rw_dir_perms;
')
@@ -14809,7 +13013,7 @@ index 958ca84..62352ec 100644
##########################################
## <summary>
## Manage generic directories in /etc
-@@ -2379,7 +2504,7 @@ interface(`files_read_etc_files',`
+@@ -2451,7 +2503,7 @@ interface(`files_read_etc_files',`
## </summary>
## <param name="domain">
## <summary>
@@ -14818,7 +13022,7 @@ index 958ca84..62352ec 100644
## </summary>
## </param>
#
-@@ -2453,6 +2578,24 @@ interface(`files_delete_etc_files',`
+@@ -2525,6 +2577,24 @@ interface(`files_delete_etc_files',`
########################################
## <summary>
@@ -14843,7 +13047,7 @@ index 958ca84..62352ec 100644
## Execute generic files in /etc.
## </summary>
## <param name="domain">
-@@ -2552,7 +2695,7 @@ interface(`files_etc_filetrans',`
+@@ -2624,7 +2694,7 @@ interface(`files_etc_filetrans',`
type etc_t;
')
@@ -14852,39 +13056,32 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -2583,6 +2726,31 @@ interface(`files_create_boot_flag',`
+@@ -2680,24 +2750,6 @@ interface(`files_delete_boot_flag',`
########################################
## <summary>
-+## Delete a boot flag.
-+## </summary>
-+## <desc>
-+## <p>
-+## Delete a boot flag, such as
-+## /.autorelabel and /.autofsck.
-+## </p>
-+## </desc>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`files_delete_boot_flag',`
-+ gen_require(`
-+ type root_t, etc_runtime_t;
-+ ')
-+
-+ delete_files_pattern($1, root_t, etc_runtime_t)
-+')
-+
-+########################################
-+## <summary>
+-## Do not audit attempts to set the attributes of the etc_runtime files
+-## </summary>
+-## <param name="domain">
+-## <summary>
+-## Domain allowed access.
+-## </summary>
+-## </param>
+-#
+-interface(`files_dontaudit_setattr_etc_runtime_files',`
+- gen_require(`
+- type etc_runtime_t;
+- ')
+-
+- dontaudit $1 etc_runtime_t:file setattr;
+-')
+-
+-########################################
+-## <summary>
## Read files in /etc that are dynamically
## created on boot, such as mtab.
## </summary>
-@@ -2623,6 +2791,24 @@ interface(`files_read_etc_runtime_files',`
+@@ -2738,6 +2790,24 @@ interface(`files_read_etc_runtime_files',`
########################################
## <summary>
@@ -14909,7 +13106,7 @@ index 958ca84..62352ec 100644
## Do not audit attempts to read files
## in /etc that are dynamically
## created on boot, such as mtab.
-@@ -2660,6 +2846,7 @@ interface(`files_rw_etc_runtime_files',`
+@@ -2775,6 +2845,7 @@ interface(`files_rw_etc_runtime_files',`
allow $1 etc_t:dir list_dir_perms;
rw_files_pattern($1, etc_t, etc_runtime_t)
@@ -14917,23 +13114,7 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -3104,6 +3291,7 @@ interface(`files_getattr_home_dir',`
- ')
-
- allow $1 home_root_t:dir getattr;
-+ allow $1 home_root_t:lnk_file getattr;
- ')
-
- ########################################
-@@ -3124,6 +3312,7 @@ interface(`files_dontaudit_getattr_home_dir',`
- ')
-
- dontaudit $1 home_root_t:dir getattr;
-+ dontaudit $1 home_root_t:lnk_file getattr;
- ')
-
- ########################################
-@@ -3247,7 +3436,7 @@ interface(`files_home_filetrans',`
+@@ -3364,7 +3435,7 @@ interface(`files_home_filetrans',`
type home_root_t;
')
@@ -14942,37 +13123,11 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -3287,6 +3476,24 @@ interface(`files_dontaudit_getattr_lost_found_dirs',`
- dontaudit $1 lost_found_t:dir getattr;
- ')
+@@ -3502,20 +3573,38 @@ interface(`files_list_mnt',`
-+#######################################
-+## <summary>
-+## List the contents of /tmp/lost-found
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`files_list_lost_found_dirs',`
-+ gen_require(`
-+ type lost_found_t;
-+ ')
-+
-+ allow $1 lost_found_t:dir list_dir_perms;
-+')
-+
- ########################################
+ ######################################
## <summary>
- ## Create, read, write, and delete objects in
-@@ -3365,6 +3572,43 @@ interface(`files_list_mnt',`
- allow $1 mnt_t:dir list_dir_perms;
- ')
-
-+######################################
-+## <summary>
+-## Do not audit attempts to list the contents of /mnt.
+## dontaudit List the contents of /mnt.
+## </summary>
+## <param name="domain">
@@ -14993,50 +13148,26 @@ index 958ca84..62352ec 100644
+## <summary>
+## Do not audit attempts to check the
+## write access on mnt files
-+## </summary>
-+## <param name="domain">
-+## <summary>
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain allowed access.
+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## </param>
+ #
+-interface(`files_dontaudit_list_mnt',`
+interface(`files_dontaudit_access_check_mnt',`
-+ gen_require(`
-+ type mnt_t;
-+ ')
-+
+ gen_require(`
+ type mnt_t;
+ ')
+-
+- dontaudit $1 mnt_t:dir list_dir_perms;
+ dontaudit $1 mnt_t:file_class_set audit_access;
-+')
-+
- ########################################
- ## <summary>
- ## Mount a filesystem on /mnt.
-@@ -3438,6 +3682,24 @@ interface(`files_read_mnt_files',`
- read_files_pattern($1, mnt_t, mnt_t)
')
-+######################################
-+## <summary>
-+## Read symbolic links in /mnt.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`files_read_mnt_symlinks',`
-+ gen_require(`
-+ type mnt_t;
-+ ')
-+
-+ read_lnk_files_pattern($1, mnt_t, mnt_t)
-+')
-+
########################################
- ## <summary>
- ## Create, read, write, and delete symbolic links in /mnt.
-@@ -3729,6 +3991,99 @@ interface(`files_read_world_readable_sockets',`
+@@ -3900,6 +3989,99 @@ interface(`files_read_world_readable_sockets',`
allow $1 readable_t:sock_file read_sock_file_perms;
')
@@ -15136,7 +13267,7 @@ index 958ca84..62352ec 100644
########################################
## <summary>
## Allow the specified type to associate
-@@ -3774,7 +4129,7 @@ interface(`files_getattr_tmp_dirs',`
+@@ -3945,7 +4127,7 @@ interface(`files_getattr_tmp_dirs',`
## </summary>
## <param name="domain">
## <summary>
@@ -15145,7 +13276,7 @@ index 958ca84..62352ec 100644
## </summary>
## </param>
#
-@@ -3846,7 +4201,7 @@ interface(`files_list_tmp',`
+@@ -4017,7 +4199,7 @@ interface(`files_list_tmp',`
## </summary>
## <param name="domain">
## <summary>
@@ -15154,7 +13285,7 @@ index 958ca84..62352ec 100644
## </summary>
## </param>
#
-@@ -3858,6 +4213,24 @@ interface(`files_dontaudit_list_tmp',`
+@@ -4029,6 +4211,24 @@ interface(`files_dontaudit_list_tmp',`
dontaudit $1 tmp_t:dir list_dir_perms;
')
@@ -15179,13 +13310,12 @@ index 958ca84..62352ec 100644
########################################
## <summary>
## Remove entries from the tmp directory.
-@@ -3914,25 +4287,33 @@ interface(`files_manage_generic_tmp_dirs',`
+@@ -4085,6 +4285,32 @@ interface(`files_manage_generic_tmp_dirs',`
########################################
## <summary>
--## Manage temporary files and directories in /tmp.
+## Allow shared library text relocations in tmp files.
- ## </summary>
++## </summary>
+## <desc>
+## <p>
+## Allow shared library text relocations in tmp files.
@@ -15194,70 +13324,26 @@ index 958ca84..62352ec 100644
+## This is added to support java policy.
+## </p>
+## </desc>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
--interface(`files_manage_generic_tmp_files',`
-+interface(`files_execmod_tmp',`
- gen_require(`
-- type tmp_t;
-+ attribute tmpfile;
- ')
-
-- manage_files_pattern($1, tmp_t, tmp_t)
-+ allow $1 tmpfile:file execmod;
- ')
-
- ########################################
- ## <summary>
--## Read symbolic links in the tmp directory (/tmp).
-+## Manage temporary files and directories in /tmp.
- ## </summary>
- ## <param name="domain">
- ## <summary>
-@@ -3940,17 +4321,35 @@ interface(`files_manage_generic_tmp_files',`
- ## </summary>
- ## </param>
- #
--interface(`files_read_generic_tmp_symlinks',`
-+interface(`files_manage_generic_tmp_files',`
- gen_require(`
- type tmp_t;
- ')
-
-- read_lnk_files_pattern($1, tmp_t, tmp_t)
-+ manage_files_pattern($1, tmp_t, tmp_t)
- ')
-
- ########################################
- ## <summary>
--## Read and write generic named sockets in the tmp directory (/tmp).
-+## Read symbolic links in the tmp directory (/tmp).
-+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
-+interface(`files_read_generic_tmp_symlinks',`
++interface(`files_execmod_tmp',`
+ gen_require(`
-+ type tmp_t;
++ attribute tmpfile;
+ ')
+
-+ read_lnk_files_pattern($1, tmp_t, tmp_t)
++ allow $1 tmpfile:file execmod;
+')
+
+########################################
+## <summary>
-+## Read and write generic named sockets in the tmp directory (/tmp).
+ ## Manage temporary files and directories in /tmp.
## </summary>
## <param name="domain">
- ## <summary>
-@@ -3968,6 +4367,84 @@ interface(`files_rw_generic_tmp_sockets',`
+@@ -4139,6 +4365,42 @@ interface(`files_rw_generic_tmp_sockets',`
########################################
## <summary>
@@ -15297,52 +13383,10 @@ index 958ca84..62352ec 100644
+
+########################################
+## <summary>
-+## Relabel all tmp dirs.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`files_relabel_all_tmp_dirs',`
-+ gen_require(`
-+ attribute tmpfile;
-+ type var_t;
-+ ')
-+
-+ allow $1 var_t:dir search_dir_perms;
-+ relabel_dirs_pattern($1, tmpfile, tmpfile)
-+')
-+
-+########################################
-+## <summary>
-+## Relabel all tmp files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`files_relabel_all_tmp_files',`
-+ gen_require(`
-+ attribute tmpfile;
-+ type var_t;
-+ ')
-+
-+ allow $1 var_t:dir search_dir_perms;
-+ relabel_files_pattern($1, tmpfile, tmpfile)
-+')
-+
-+########################################
-+## <summary>
## Set the attributes of all tmp directories.
## </summary>
## <param name="domain">
-@@ -4009,7 +4486,7 @@ interface(`files_list_all_tmp',`
+@@ -4202,7 +4464,7 @@ interface(`files_relabel_all_tmp_dirs',`
## </summary>
## <param name="domain">
## <summary>
@@ -15351,7 +13395,7 @@ index 958ca84..62352ec 100644
## </summary>
## </param>
#
-@@ -4047,7 +4524,7 @@ interface(`files_getattr_all_tmp_files',`
+@@ -4262,7 +4524,7 @@ interface(`files_relabel_all_tmp_files',`
## </summary>
## <param name="domain">
## <summary>
@@ -15360,7 +13404,7 @@ index 958ca84..62352ec 100644
## </summary>
## </param>
#
-@@ -4103,7 +4580,7 @@ interface(`files_tmp_filetrans',`
+@@ -4318,7 +4580,7 @@ interface(`files_tmp_filetrans',`
type tmp_t;
')
@@ -15369,12 +13413,13 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -4127,6 +4604,15 @@ interface(`files_purge_tmp',`
+@@ -4342,6 +4604,16 @@ interface(`files_purge_tmp',`
delete_lnk_files_pattern($1, tmpfile, tmpfile)
delete_fifo_files_pattern($1, tmpfile, tmpfile)
delete_sock_files_pattern($1, tmpfile, tmpfile)
+ delete_chr_files_pattern($1, tmpfile, tmpfile)
+ delete_blk_files_pattern($1, tmpfile, tmpfile)
++ files_list_isid_type_dirs($1)
+ files_delete_isid_type_dirs($1)
+ files_delete_isid_type_files($1)
+ files_delete_isid_type_symlinks($1)
@@ -15385,7 +13430,7 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -4466,7 +4952,7 @@ interface(`files_usr_filetrans',`
+@@ -4681,7 +4953,7 @@ interface(`files_usr_filetrans',`
type usr_t;
')
@@ -15394,32 +13439,7 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -4736,6 +5222,24 @@ interface(`files_read_var_files',`
-
- ########################################
- ## <summary>
-+## Append files in the /var directory.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`files_append_var_files',`
-+ gen_require(`
-+ type var_t;
-+ ')
-+
-+ append_files_pattern($1, var_t, var_t)
-+')
-+
-+########################################
-+## <summary>
- ## Read and write files in the /var directory.
- ## </summary>
- ## <param name="domain">
-@@ -4851,7 +5355,7 @@ interface(`files_var_filetrans',`
+@@ -5084,7 +5356,7 @@ interface(`files_var_filetrans',`
type var_t;
')
@@ -15428,7 +13448,7 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -4986,7 +5490,7 @@ interface(`files_var_lib_filetrans',`
+@@ -5219,7 +5491,7 @@ interface(`files_var_lib_filetrans',`
')
allow $1 var_t:dir search_dir_perms;
@@ -15437,7 +13457,7 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -5071,6 +5575,25 @@ interface(`files_manage_mounttab',`
+@@ -5304,6 +5576,25 @@ interface(`files_manage_mounttab',`
########################################
## <summary>
@@ -15463,7 +13483,7 @@ index 958ca84..62352ec 100644
## Search the locks directory (/var/lock).
## </summary>
## <param name="domain">
-@@ -5084,6 +5607,8 @@ interface(`files_search_locks',`
+@@ -5317,6 +5608,8 @@ interface(`files_search_locks',`
type var_t, var_lock_t;
')
@@ -15472,7 +13492,7 @@ index 958ca84..62352ec 100644
search_dirs_pattern($1, var_t, var_lock_t)
')
-@@ -5103,11 +5628,50 @@ interface(`files_dontaudit_search_locks',`
+@@ -5336,12 +5629,14 @@ interface(`files_dontaudit_search_locks',`
type var_lock_t;
')
@@ -15482,22 +13502,23 @@ index 958ca84..62352ec 100644
########################################
## <summary>
+-## List generic lock directories.
+## create a directory in the /var/lock
+## directories.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -5349,12 +5644,30 @@ interface(`files_dontaudit_search_locks',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`files_list_locks',`
+interface(`files_create_lock_dirs',`
-+ gen_require(`
-+ type var_t, var_lock_t;
-+ ')
-+
+ gen_require(`
+ type var_t, var_lock_t;
+ ')
+ files_search_locks($1)
-+ allow $1 var_lock_t:dir create_dir_perms;
++ allow $1 var_lock_t:dir create_dir_perms;
+')
+
+########################################
@@ -15514,16 +13535,13 @@ index 958ca84..62352ec 100644
+ gen_require(`
+ type var_lock_t;
+ ')
-+
+
+- list_dirs_pattern($1, var_t, var_lock_t)
+ allow $1 var_lock_t:dir setattr;
-+')
-+
-+########################################
-+## <summary>
- ## Add and remove entries in the /var/lock
- ## directories.
- ## </summary>
-@@ -5122,6 +5686,7 @@ interface(`files_rw_lock_dirs',`
+ ')
+
+ ########################################
+@@ -5373,6 +5686,7 @@ interface(`files_rw_lock_dirs',`
type var_t, var_lock_t;
')
@@ -15531,7 +13549,15 @@ index 958ca84..62352ec 100644
rw_dirs_pattern($1, var_t, var_lock_t)
')
-@@ -5140,7 +5705,7 @@ interface(`files_getattr_generic_locks',`
+@@ -5385,7 +5699,6 @@ interface(`files_rw_lock_dirs',`
+ ## Domain allowed access.
+ ## </summary>
+ ## </param>
+-## <rolecap/>
+ #
+ interface(`files_relabel_all_lock_dirs',`
+ gen_require(`
+@@ -5412,7 +5725,7 @@ interface(`files_getattr_generic_locks',`
type var_t, var_lock_t;
')
@@ -15540,7 +13566,7 @@ index 958ca84..62352ec 100644
allow $1 var_lock_t:dir list_dir_perms;
getattr_files_pattern($1, var_lock_t, var_lock_t)
')
-@@ -5156,12 +5721,12 @@ interface(`files_getattr_generic_locks',`
+@@ -5428,12 +5741,12 @@ interface(`files_getattr_generic_locks',`
## </param>
#
interface(`files_delete_generic_locks',`
@@ -15557,7 +13583,7 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -5180,7 +5745,7 @@ interface(`files_manage_generic_locks',`
+@@ -5452,7 +5765,7 @@ interface(`files_manage_generic_locks',`
type var_t, var_lock_t;
')
@@ -15566,35 +13592,7 @@ index 958ca84..62352ec 100644
manage_files_pattern($1, var_lock_t, var_lock_t)
')
-@@ -5207,6 +5772,27 @@ interface(`files_delete_all_locks',`
-
- ########################################
- ## <summary>
-+## Relabel all lock files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`files_relabel_all_lock_dirs',`
-+ gen_require(`
-+ attribute lockfile;
-+ type var_t;
-+ ')
-+
-+ allow $1 var_t:dir search_dir_perms;
-+ relabel_dirs_pattern($1, lockfile, lockfile)
-+')
-+
-+########################################
-+## <summary>
- ## Read all lock files.
- ## </summary>
- ## <param name="domain">
-@@ -5221,7 +5807,7 @@ interface(`files_read_all_locks',`
+@@ -5493,7 +5806,7 @@ interface(`files_read_all_locks',`
type var_t, var_lock_t;
')
@@ -15603,7 +13601,7 @@ index 958ca84..62352ec 100644
allow $1 lockfile:dir list_dir_perms;
read_files_pattern($1, lockfile, lockfile)
read_lnk_files_pattern($1, lockfile, lockfile)
-@@ -5243,7 +5829,7 @@ interface(`files_manage_all_locks',`
+@@ -5515,7 +5828,7 @@ interface(`files_manage_all_locks',`
type var_t, var_lock_t;
')
@@ -15612,7 +13610,7 @@ index 958ca84..62352ec 100644
manage_dirs_pattern($1, lockfile, lockfile)
manage_files_pattern($1, lockfile, lockfile)
manage_lnk_files_pattern($1, lockfile, lockfile)
-@@ -5275,8 +5861,8 @@ interface(`files_lock_filetrans',`
+@@ -5547,8 +5860,8 @@ interface(`files_lock_filetrans',`
type var_t, var_lock_t;
')
@@ -15623,11 +13621,7 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -5332,9 +5918,47 @@ interface(`files_search_pids',`
- type var_t, var_run_t;
- ')
-
-+ allow $1 var_run_t:lnk_file read_lnk_file_perms;
+@@ -5608,6 +5921,43 @@ interface(`files_search_pids',`
search_dirs_pattern($1, var_t, var_run_t)
')
@@ -15671,7 +13665,7 @@ index 958ca84..62352ec 100644
########################################
## <summary>
## Do not audit attempts to search
-@@ -5463,7 +6087,7 @@ interface(`files_pid_filetrans',`
+@@ -5736,7 +6086,7 @@ interface(`files_pid_filetrans',`
')
allow $1 var_t:dir search_dir_perms;
@@ -15680,7 +13674,7 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -5542,6 +6166,80 @@ interface(`files_dontaudit_ioctl_all_pids',`
+@@ -5815,6 +6165,80 @@ interface(`files_dontaudit_ioctl_all_pids',`
########################################
## <summary>
@@ -15761,7 +13755,7 @@ index 958ca84..62352ec 100644
## Read all process ID files.
## </summary>
## <param name="domain">
-@@ -5559,6 +6257,44 @@ interface(`files_read_all_pids',`
+@@ -5832,6 +6256,44 @@ interface(`files_read_all_pids',`
list_dirs_pattern($1, var_t, pidfile)
read_files_pattern($1, pidfile, pidfile)
@@ -15806,7 +13800,7 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -5769,7 +6505,7 @@ interface(`files_spool_filetrans',`
+@@ -6042,7 +6504,7 @@ interface(`files_spool_filetrans',`
')
allow $1 var_t:dir search_dir_perms;
@@ -15815,7 +13809,7 @@ index 958ca84..62352ec 100644
')
########################################
-@@ -5844,3 +6580,284 @@ interface(`files_unconfined',`
+@@ -6117,3 +6579,284 @@ interface(`files_unconfined',`
typeattribute $1 files_unconfined_type;
')
@@ -16101,7 +14095,7 @@ index 958ca84..62352ec 100644
+ dontaudit $1 file_type:dir_file_class_set write;
+')
diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te
-index 6e01635..207d34a 100644
+index 22821ff..567322b 100644
--- a/policy/modules/kernel/files.te
+++ b/policy/modules/kernel/files.te
@@ -11,6 +11,7 @@ attribute lockfile;
@@ -16143,29 +14137,8 @@ index 6e01635..207d34a 100644
#
# var_run_t is the type of /var/run, usually
-diff --git a/policy/modules/kernel/filesystem.fc b/policy/modules/kernel/filesystem.fc
-index 59bae6a..2e55e71 100644
---- a/policy/modules/kernel/filesystem.fc
-+++ b/policy/modules/kernel/filesystem.fc
-@@ -2,5 +2,16 @@
- /dev/shm/.* <<none>>
-
- /cgroup -d gen_context(system_u:object_r:cgroup_t,s0)
-+/cgroup/.* <<none>>
-
-+/lib/udev/devices/hugepages -d gen_context(system_u:object_r:hugetlbfs_t,s0)
-+/lib/udev/devices/hugepages/.* <<none>>
-+
-+/lib/udev/devices/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
-+/lib/udev/devices/shm/.* <<none>>
-+
-+/sys/fs/cgroup -d gen_context(system_u:object_r:cgroup_t,s0)
- /sys/fs/cgroup(/.*)? <<none>>
-+
-+/dev/hugepages -d gen_context(system_u:object_r:hugetlbfs_t,s0)
-+/dev/hugepages(/.*)? <<none>>
diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
-index dfe361a..7484288 100644
+index 97fcdac..3babb37 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -631,6 +631,27 @@ interface(`fs_getattr_cgroup',`
@@ -16306,32 +14279,7 @@ index dfe361a..7484288 100644
dev_search_sysfs($1)
')
-@@ -1052,6 +1119,24 @@ interface(`fs_list_noxattr_fs',`
-
- ########################################
- ## <summary>
-+## Do not audit Read all noxattrfs directories.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`fs_dontaudit_list_noxattr_fs',`
-+ gen_require(`
-+ attribute noxattrfs;
-+ ')
-+
-+ dontaudit $1 noxattrfs:dir list_dir_perms;
-+')
-+
-+########################################
-+## <summary>
- ## Create, read, write, and delete all noxattrfs directories.
- ## </summary>
- ## <param name="domain">
-@@ -1088,6 +1173,42 @@ interface(`fs_read_noxattr_fs_files',`
+@@ -1107,6 +1174,24 @@ interface(`fs_read_noxattr_fs_files',`
########################################
## <summary>
@@ -16353,28 +14301,10 @@ index dfe361a..7484288 100644
+
+########################################
+## <summary>
-+## Do not audit read all noxattrfs files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`fs_dontaudit_read_noxattr_fs_files',`
-+ gen_require(`
-+ attribute noxattrfs;
-+ ')
-+
-+ dontaudit $1 noxattrfs:file read_file_perms;
-+')
-+
-+########################################
-+## <summary>
- ## Dont audit attempts to write to noxattrfs files.
+ ## Do not audit attempts to read all
+ ## noxattrfs files.
## </summary>
- ## <param name="domain">
-@@ -1227,6 +1348,42 @@ interface(`fs_dontaudit_append_cifs_files',`
+@@ -1265,6 +1350,42 @@ interface(`fs_dontaudit_append_cifs_files',`
########################################
## <summary>
@@ -16417,7 +14347,7 @@ index dfe361a..7484288 100644
## Do not audit attempts to read or
## write files on a CIFS or SMB filesystem.
## </summary>
-@@ -1241,7 +1398,7 @@ interface(`fs_dontaudit_rw_cifs_files',`
+@@ -1279,7 +1400,7 @@ interface(`fs_dontaudit_rw_cifs_files',`
type cifs_t;
')
@@ -16426,7 +14356,7 @@ index dfe361a..7484288 100644
')
########################################
-@@ -1504,6 +1661,25 @@ interface(`fs_cifs_domtrans',`
+@@ -1542,6 +1663,25 @@ interface(`fs_cifs_domtrans',`
domain_auto_transition_pattern($1, cifs_t, $2)
')
@@ -16452,155 +14382,7 @@ index dfe361a..7484288 100644
#######################################
## <summary>
## Create, read, write, and delete dirs
-@@ -1659,6 +1835,25 @@ interface(`fs_search_dos',`
-
- ########################################
- ## <summary>
-+## list dirs
-+## on a DOS filesystem.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`fs_list_dos_dirs',`
-+ gen_require(`
-+ type dosfs_t;
-+ ')
-+
-+ list_dirs_pattern($1, dosfs_t, dosfs_t)
-+')
-+
-+########################################
-+## <summary>
- ## Create, read, write, and delete dirs
- ## on a DOS filesystem.
- ## </summary>
-@@ -1774,6 +1969,24 @@ interface(`fs_unmount_fusefs',`
-
- ########################################
- ## <summary>
-+## Mounton a FUSEFS filesystem.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`fs_mounton_fusefs',`
-+ gen_require(`
-+ type fusefs_t;
-+ ')
-+
-+ allow $1 fusefs_t:dir mounton;
-+')
-+
-+########################################
-+## <summary>
- ## Search directories
- ## on a FUSEFS filesystem.
- ## </summary>
-@@ -1892,6 +2105,26 @@ interface(`fs_manage_fusefs_files',`
-
- ########################################
- ## <summary>
-+## Execute files on a FUSEFS filesystem.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`fs_exec_fusefs_files',`
-+ gen_require(`
-+ type fusefs_t;
-+ ')
-+
-+ allow $1 fusefs_t:dir list_dir_perms;
-+ exec_files_pattern($1, fusefs_t, fusefs_t)
-+')
-+
-+########################################
-+## <summary>
- ## Do not audit attempts to create,
- ## read, write, and delete files
- ## on a FUSEFS filesystem.
-@@ -1931,7 +2164,26 @@ interface(`fs_read_fusefs_symlinks',`
-
- ########################################
- ## <summary>
--## Read and write hugetlbfs files.
-+## Get the attributes of an hugetlbfs
-+## filesystem;
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`fs_getattr_hugetlbfs',`
-+ gen_require(`
-+ type hugetlbfs_t;
-+ ')
-+
-+ allow $1 hugetlbfs_t:filesystem getattr;
-+')
-+
-+########################################
-+## <summary>
-+## R/W hugetlbfs files.
- ## </summary>
- ## <param name="domain">
- ## <summary>
-@@ -1946,6 +2198,41 @@ interface(`fs_rw_hugetlbfs_files',`
-
- rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t)
- ')
-+########################################
-+## <summary>
-+## Manage hugetlbfs dirs.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`fs_manage_hugetlbfs_dirs',`
-+ gen_require(`
-+ type hugetlbfs_t;
-+ ')
-+
-+ manage_dirs_pattern($1, hugetlbfs_t, hugetlbfs_t)
-+')
-+
-+########################################
-+## <summary>
-+## List hugetlbfs dirs
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`fs_list_hugetlbfs',`
-+ gen_require(`
-+ type hugetlbfs_t;
-+ ')
-+
-+ allow $1 hugetlbfs_t:dir list_dir_perms;
-+')
-
- ########################################
- ## <summary>
-@@ -1999,6 +2286,7 @@ interface(`fs_list_inotifyfs',`
+@@ -2148,6 +2288,7 @@ interface(`fs_list_inotifyfs',`
')
allow $1 inotifyfs_t:dir list_dir_perms;
@@ -16608,7 +14390,7 @@ index dfe361a..7484288 100644
')
########################################
-@@ -2331,6 +2619,7 @@ interface(`fs_read_nfs_files',`
+@@ -2480,6 +2621,7 @@ interface(`fs_read_nfs_files',`
type nfs_t;
')
@@ -16616,7 +14398,7 @@ index dfe361a..7484288 100644
allow $1 nfs_t:dir list_dir_perms;
read_files_pattern($1, nfs_t, nfs_t)
')
-@@ -2369,6 +2658,7 @@ interface(`fs_write_nfs_files',`
+@@ -2518,6 +2660,7 @@ interface(`fs_write_nfs_files',`
type nfs_t;
')
@@ -16624,7 +14406,7 @@ index dfe361a..7484288 100644
allow $1 nfs_t:dir list_dir_perms;
write_files_pattern($1, nfs_t, nfs_t)
')
-@@ -2395,6 +2685,25 @@ interface(`fs_exec_nfs_files',`
+@@ -2544,6 +2687,25 @@ interface(`fs_exec_nfs_files',`
########################################
## <summary>
@@ -16650,7 +14432,7 @@ index dfe361a..7484288 100644
## Append files
## on a NFS filesystem.
## </summary>
-@@ -2435,6 +2744,42 @@ interface(`fs_dontaudit_append_nfs_files',`
+@@ -2584,6 +2746,42 @@ interface(`fs_dontaudit_append_nfs_files',`
########################################
## <summary>
@@ -16693,7 +14475,7 @@ index dfe361a..7484288 100644
## Do not audit attempts to read or
## write files on a NFS filesystem.
## </summary>
-@@ -2449,7 +2794,7 @@ interface(`fs_dontaudit_rw_nfs_files',`
+@@ -2598,7 +2796,7 @@ interface(`fs_dontaudit_rw_nfs_files',`
type nfs_t;
')
@@ -16702,7 +14484,7 @@ index dfe361a..7484288 100644
')
########################################
-@@ -2587,7 +2932,7 @@ interface(`fs_search_removable',`
+@@ -2736,7 +2934,7 @@ interface(`fs_search_removable',`
## </summary>
## <param name="domain">
## <summary>
@@ -16711,7 +14493,7 @@ index dfe361a..7484288 100644
## </summary>
## </param>
#
-@@ -2623,7 +2968,7 @@ interface(`fs_read_removable_files',`
+@@ -2772,7 +2970,7 @@ interface(`fs_read_removable_files',`
## </summary>
## <param name="domain">
## <summary>
@@ -16720,58 +14502,7 @@ index dfe361a..7484288 100644
## </summary>
## </param>
#
-@@ -2637,6 +2982,24 @@ interface(`fs_dontaudit_read_removable_files',`
-
- ########################################
- ## <summary>
-+## Do not audit attempts to write removable storage files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`fs_dontaudit_write_removable_files',`
-+ gen_require(`
-+ type removable_t;
-+ ')
-+
-+ dontaudit $1 removable_t:file write_file_perms;
-+')
-+
-+########################################
-+## <summary>
- ## Read removable storage symbolic links.
- ## </summary>
- ## <param name="domain">
-@@ -2653,6 +3016,25 @@ interface(`fs_read_removable_symlinks',`
- read_lnk_files_pattern($1, removable_t, removable_t)
- ')
-
-+######################################
-+## <summary>
-+## Read block nodes on removable filesystems.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`fs_read_removable_blk_files',`
-+ gen_require(`
-+ type removable_t;
-+ ')
-+
-+ allow $1 removable_t:dir list_dir_perms;
-+ read_blk_files_pattern($1, removable_t, removable_t)
-+')
-+
- ########################################
- ## <summary>
- ## Read and write block nodes on removable filesystems.
-@@ -2779,6 +3161,7 @@ interface(`fs_manage_nfs_dirs',`
+@@ -2965,6 +3163,7 @@ interface(`fs_manage_nfs_dirs',`
type nfs_t;
')
@@ -16779,7 +14510,7 @@ index dfe361a..7484288 100644
allow $1 nfs_t:dir manage_dir_perms;
')
-@@ -2819,6 +3202,7 @@ interface(`fs_manage_nfs_files',`
+@@ -3005,6 +3204,7 @@ interface(`fs_manage_nfs_files',`
type nfs_t;
')
@@ -16787,16 +14518,7 @@ index dfe361a..7484288 100644
manage_files_pattern($1, nfs_t, nfs_t)
')
-@@ -2845,7 +3229,7 @@ interface(`fs_dontaudit_manage_nfs_files',`
- #########################################
- ## <summary>
- ## Create, read, write, and delete symbolic links
--## on a CIFS or SMB network filesystem.
-+## on a NFS network filesystem.
- ## </summary>
- ## <param name="domain">
- ## <summary>
-@@ -2859,6 +3243,7 @@ interface(`fs_manage_nfs_symlinks',`
+@@ -3045,6 +3245,7 @@ interface(`fs_manage_nfs_symlinks',`
type nfs_t;
')
@@ -16804,7 +14526,7 @@ index dfe361a..7484288 100644
manage_lnk_files_pattern($1, nfs_t, nfs_t)
')
-@@ -3772,6 +4157,42 @@ interface(`fs_dontaudit_list_tmpfs',`
+@@ -3958,6 +4159,42 @@ interface(`fs_dontaudit_list_tmpfs',`
########################################
## <summary>
@@ -16847,7 +14569,7 @@ index dfe361a..7484288 100644
## Create, read, write, and delete
## tmpfs directories
## </summary>
-@@ -3989,6 +4410,24 @@ interface(`fs_dontaudit_use_tmpfs_chr_dev',`
+@@ -4175,6 +4412,24 @@ interface(`fs_dontaudit_use_tmpfs_chr_dev',`
########################################
## <summary>
@@ -16872,7 +14594,7 @@ index dfe361a..7484288 100644
## Relabel character nodes on tmpfs filesystems.
## </summary>
## <param name="domain">
-@@ -4271,6 +4710,8 @@ interface(`fs_mount_all_fs',`
+@@ -4457,6 +4712,8 @@ interface(`fs_mount_all_fs',`
')
allow $1 filesystem_type:filesystem mount;
@@ -16881,7 +14603,7 @@ index dfe361a..7484288 100644
')
########################################
-@@ -4317,7 +4758,7 @@ interface(`fs_unmount_all_fs',`
+@@ -4503,7 +4760,7 @@ interface(`fs_unmount_all_fs',`
## <desc>
## <p>
## Allow the specified domain to
@@ -16890,7 +14612,7 @@ index dfe361a..7484288 100644
## Example attributes:
## </p>
## <ul>
-@@ -4681,3 +5122,24 @@ interface(`fs_unconfined',`
+@@ -4866,3 +5123,24 @@ interface(`fs_unconfined',`
typeattribute $1 filesystem_unconfined_type;
')
@@ -16916,7 +14638,7 @@ index dfe361a..7484288 100644
+')
+
diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
-index e49c148..4d6bbf4 100644
+index f125dc2..3c6e827 100644
--- a/policy/modules/kernel/filesystem.te
+++ b/policy/modules/kernel/filesystem.te
@@ -52,6 +52,7 @@ type anon_inodefs_t;
@@ -16927,7 +14649,7 @@ index e49c148..4d6bbf4 100644
type bdev_t;
fs_type(bdev_t)
-@@ -67,10 +68,11 @@ fs_type(capifs_t)
+@@ -67,7 +68,7 @@ fs_type(capifs_t)
files_mountpoint(capifs_t)
genfscon capifs / gen_context(system_u:object_r:capifs_t,s0)
@@ -16936,11 +14658,7 @@ index e49c148..4d6bbf4 100644
fs_type(cgroup_t)
files_type(cgroup_t)
files_mountpoint(cgroup_t)
-+dev_associate_sysfs(cgroup_t)
- genfscon cgroup / gen_context(system_u:object_r:cgroup_t,s0)
-
- type configfs_t;
-@@ -100,12 +102,22 @@ type hugetlbfs_t;
+@@ -96,6 +97,7 @@ type hugetlbfs_t;
fs_type(hugetlbfs_t)
files_mountpoint(hugetlbfs_t)
fs_use_trans hugetlbfs gen_context(system_u:object_r:hugetlbfs_t,s0);
@@ -16948,35 +14666,7 @@ index e49c148..4d6bbf4 100644
type ibmasmfs_t;
fs_type(ibmasmfs_t)
- allow ibmasmfs_t self:filesystem associate;
- genfscon ibmasmfs / gen_context(system_u:object_r:ibmasmfs_t,s0)
-
-+#
-+# infinibandeventfs fs
-+#
-+
-+type infinibandeventfs_t;
-+fs_type(infinibandeventfs_t)
-+allow infinibandeventfs_t self:filesystem associate;
-+genfscon infinibandeventfs / gen_context(system_u:object_r:infinibandeventfs_t,s0)
-+
- type inotifyfs_t;
- fs_type(inotifyfs_t)
- genfscon inotifyfs / gen_context(system_u:object_r:inotifyfs_t,s0)
-@@ -148,6 +160,12 @@ fs_type(squash_t)
- genfscon squash / gen_context(system_u:object_r:squash_t,s0)
- files_mountpoint(squash_t)
-
-+type sysv_t;
-+fs_noxattr_type(sysv_t)
-+files_mountpoint(sysv_t)
-+genfscon sysv / gen_context(system_u:object_r:sysv_t,s0)
-+genfscon v7 / gen_context(system_u:object_r:sysv_t,s0)
-+
- type vmblock_t;
- fs_noxattr_type(vmblock_t)
- files_mountpoint(vmblock_t)
-@@ -168,6 +186,7 @@ fs_type(tmpfs_t)
+@@ -175,6 +177,7 @@ fs_type(tmpfs_t)
files_type(tmpfs_t)
files_mountpoint(tmpfs_t)
files_poly_parent(tmpfs_t)
@@ -16984,7 +14674,7 @@ index e49c148..4d6bbf4 100644
# Use a transition SID based on the allocating task SID and the
# filesystem SID to label inodes in the following filesystem types,
-@@ -247,6 +266,8 @@ genfscon udf / gen_context(system_u:object_r:iso9660_t,s0)
+@@ -254,6 +257,8 @@ genfscon udf / gen_context(system_u:object_r:iso9660_t,s0)
type removable_t;
allow removable_t noxattrfs:filesystem associate;
fs_noxattr_type(removable_t)
@@ -16993,7 +14683,7 @@ index e49c148..4d6bbf4 100644
files_mountpoint(removable_t)
#
-@@ -266,6 +287,7 @@ genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
+@@ -273,6 +278,7 @@ genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon panfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon gadgetfs / gen_context(system_u:object_r:nfs_t,s0)
@@ -17002,63 +14692,10 @@ index e49c148..4d6bbf4 100644
########################################
#
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
-index 069d36c..4f7bf15 100644
+index 6346378..edbe041 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
-@@ -735,6 +735,26 @@ interface(`kernel_dontaudit_write_debugfs_dirs',`
-
- ########################################
- ## <summary>
-+## Manage information from the debugging filesystem.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`kernel_manage_debugfs',`
-+ gen_require(`
-+ type debugfs_t;
-+ ')
-+
-+ manage_files_pattern($1, debugfs_t, debugfs_t)
-+ read_lnk_files_pattern($1, debugfs_t, debugfs_t)
-+ list_dirs_pattern($1, debugfs_t, debugfs_t)
-+')
-+
-+########################################
-+## <summary>
- ## Mount a kernel VM filesystem.
- ## </summary>
- ## <param name="domain">
-@@ -863,6 +883,25 @@ interface(`kernel_dontaudit_write_proc_dirs',`
-
- ########################################
- ## <summary>
-+## Do not audit attempts to setattr
-+## directories in /proc.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`kernel_dontaudit_setattr_proc_dirs',`
-+ gen_require(`
-+ type proc_t;
-+ ')
-+
-+ dontaudit $1 proc_t:dir setattr;
-+')
-+
-+########################################
-+## <summary>
- ## Get the attributes of files in /proc.
- ## </summary>
- ## <param name="domain">
-@@ -2033,7 +2072,7 @@ interface(`kernel_dontaudit_list_all_sysctls',`
+@@ -2072,7 +2072,7 @@ interface(`kernel_dontaudit_list_all_sysctls',`
')
dontaudit $1 sysctl_type:dir list_dir_perms;
@@ -17067,7 +14704,7 @@ index 069d36c..4f7bf15 100644
')
########################################
-@@ -2254,7 +2293,7 @@ interface(`kernel_read_unlabeled_state',`
+@@ -2293,7 +2293,7 @@ interface(`kernel_read_unlabeled_state',`
## </summary>
## <param name="domain">
## <summary>
@@ -17076,7 +14713,7 @@ index 069d36c..4f7bf15 100644
## </summary>
## </param>
#
-@@ -2436,6 +2475,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
+@@ -2475,6 +2475,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
########################################
## <summary>
@@ -17101,7 +14738,7 @@ index 069d36c..4f7bf15 100644
## Do not audit attempts by caller to get attributes for
## unlabeled character devices.
## </summary>
-@@ -2580,7 +2637,7 @@ interface(`kernel_sendrecv_unlabeled_association',`
+@@ -2619,7 +2637,7 @@ interface(`kernel_sendrecv_unlabeled_association',`
allow $1 unlabeled_t:association { sendto recvfrom };
# temporary hack until labeling on packets is supported
@@ -17110,7 +14747,7 @@ index 069d36c..4f7bf15 100644
')
########################################
-@@ -2618,6 +2675,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
+@@ -2657,6 +2675,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
########################################
## <summary>
@@ -17135,7 +14772,7 @@ index 069d36c..4f7bf15 100644
## Receive TCP packets from an unlabeled connection.
## </summary>
## <desc>
-@@ -2645,6 +2720,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',`
+@@ -2684,6 +2720,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',`
########################################
## <summary>
@@ -17161,7 +14798,7 @@ index 069d36c..4f7bf15 100644
## Do not audit attempts to receive TCP packets from an unlabeled
## connection.
## </summary>
-@@ -2754,6 +2848,33 @@ interface(`kernel_raw_recvfrom_unlabeled',`
+@@ -2793,6 +2848,33 @@ interface(`kernel_raw_recvfrom_unlabeled',`
allow $1 unlabeled_t:rawip_socket recvfrom;
')
@@ -17195,7 +14832,7 @@ index 069d36c..4f7bf15 100644
########################################
## <summary>
-@@ -2909,6 +3030,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
+@@ -2948,6 +3030,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
########################################
## <summary>
@@ -17220,7 +14857,7 @@ index 069d36c..4f7bf15 100644
## Unconfined access to kernel module resources.
## </summary>
## <param name="domain">
-@@ -2924,3 +3063,23 @@ interface(`kernel_unconfined',`
+@@ -2963,3 +3063,23 @@ interface(`kernel_unconfined',`
typeattribute $1 kern_unconfined;
')
@@ -17245,7 +14882,7 @@ index 069d36c..4f7bf15 100644
+')
+
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
-index 5001b89..c90e93e 100644
+index d91c62f..30d03e3 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -50,6 +50,8 @@ sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
@@ -17257,15 +14894,15 @@ index 5001b89..c90e93e 100644
allow debugfs_t self:filesystem associate;
genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0)
-@@ -156,6 +158,7 @@ genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
- #
+@@ -157,6 +159,7 @@ genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
type unlabeled_t;
+ fs_associate(unlabeled_t)
sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
+fs_associate(unlabeled_t)
# These initial sids are no longer used, and can be removed:
sid any_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
-@@ -246,6 +249,9 @@ dev_delete_generic_blk_files(kernel_t)
+@@ -247,6 +250,9 @@ dev_delete_generic_blk_files(kernel_t)
dev_create_generic_chr_files(kernel_t)
dev_delete_generic_chr_files(kernel_t)
dev_mounton(kernel_t)
@@ -17275,7 +14912,7 @@ index 5001b89..c90e93e 100644
# Mount root file system. Used when loading a policy
# from initrd, then mounting the root filesystem
-@@ -254,7 +260,8 @@ fs_unmount_all_fs(kernel_t)
+@@ -255,7 +261,8 @@ fs_unmount_all_fs(kernel_t)
selinux_load_policy(kernel_t)
@@ -17285,7 +14922,7 @@ index 5001b89..c90e93e 100644
corecmd_exec_shell(kernel_t)
corecmd_list_bin(kernel_t)
-@@ -268,19 +275,40 @@ files_list_root(kernel_t)
+@@ -269,19 +276,40 @@ files_list_root(kernel_t)
files_list_etc(kernel_t)
files_list_home(kernel_t)
files_read_usr_files(kernel_t)
@@ -17326,7 +14963,7 @@ index 5001b89..c90e93e 100644
optional_policy(`
hotplug_search_config(kernel_t)
')
-@@ -296,6 +324,19 @@ optional_policy(`
+@@ -297,6 +325,19 @@ optional_policy(`
optional_policy(`
logging_send_syslog_msg(kernel_t)
@@ -17346,7 +14983,7 @@ index 5001b89..c90e93e 100644
')
optional_policy(`
-@@ -357,6 +398,15 @@ optional_policy(`
+@@ -358,6 +399,15 @@ optional_policy(`
unconfined_domain_noaudit(kernel_t)
')
@@ -17427,7 +15064,7 @@ index 0e5b661..3168d72 100644
+attribute mcsuntrustedproc;
+attribute mcsnetwrite;
diff --git a/policy/modules/kernel/selinux.if b/policy/modules/kernel/selinux.if
-index 786449a..23a065c 100644
+index ca7e808..23a065c 100644
--- a/policy/modules/kernel/selinux.if
+++ b/policy/modules/kernel/selinux.if
@@ -40,7 +40,7 @@ interface(`selinux_labeled_boolean',`
@@ -17546,35 +15183,15 @@ index 786449a..23a065c 100644
allow $1 security_t:dir list_dir_perms;
allow $1 security_t:file rw_file_perms;
typeattribute $1 can_load_policy;
-@@ -358,6 +388,27 @@ interface(`selinux_load_policy',`
+@@ -371,6 +401,7 @@ interface(`selinux_read_policy',`
+ type security_t;
+ ')
- ########################################
- ## <summary>
-+## Allow caller to read the policy from the kernel.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`selinux_read_policy',`
-+ gen_require(`
-+ type security_t;
-+ ')
-+
+ dev_search_sysfs($1)
-+ allow $1 security_t:dir list_dir_perms;
-+ allow $1 security_t:file read_file_perms;
-+ allow $1 security_t:security read_policy;
-+')
-+
-+########################################
-+## <summary>
- ## Allow caller to set the state of Booleans to
- ## enable or disable conditional portions of the policy. (Deprecated)
- ## </summary>
-@@ -416,6 +467,7 @@ interface(`selinux_set_generic_booleans',`
+ allow $1 security_t:dir list_dir_perms;
+ allow $1 security_t:file read_file_perms;
+ allow $1 security_t:security read_policy;
+@@ -436,6 +467,7 @@ interface(`selinux_set_generic_booleans',`
bool secure_mode_policyload;
')
@@ -17582,7 +15199,7 @@ index 786449a..23a065c 100644
allow $1 security_t:dir list_dir_perms;
allow $1 security_t:file rw_file_perms;
-@@ -458,7 +510,9 @@ interface(`selinux_set_all_booleans',`
+@@ -478,7 +510,9 @@ interface(`selinux_set_all_booleans',`
bool secure_mode_policyload;
')
@@ -17592,7 +15209,7 @@ index 786449a..23a065c 100644
allow $1 boolean_type:file rw_file_perms;
if(!secure_mode_policyload) {
-@@ -499,6 +553,7 @@ interface(`selinux_set_parameters',`
+@@ -519,6 +553,7 @@ interface(`selinux_set_parameters',`
attribute can_setsecparam;
')
@@ -17600,7 +15217,7 @@ index 786449a..23a065c 100644
allow $1 security_t:dir list_dir_perms;
allow $1 security_t:file rw_file_perms;
allow $1 security_t:security setsecparam;
-@@ -522,6 +577,7 @@ interface(`selinux_validate_context',`
+@@ -542,6 +577,7 @@ interface(`selinux_validate_context',`
type security_t;
')
@@ -17608,7 +15225,7 @@ index 786449a..23a065c 100644
allow $1 security_t:dir list_dir_perms;
allow $1 security_t:file rw_file_perms;
allow $1 security_t:security check_context;
-@@ -564,6 +620,7 @@ interface(`selinux_compute_access_vector',`
+@@ -584,6 +620,7 @@ interface(`selinux_compute_access_vector',`
type security_t;
')
@@ -17616,7 +15233,7 @@ index 786449a..23a065c 100644
allow $1 security_t:dir list_dir_perms;
allow $1 security_t:file rw_file_perms;
allow $1 security_t:security compute_av;
-@@ -585,6 +642,7 @@ interface(`selinux_compute_create_context',`
+@@ -605,6 +642,7 @@ interface(`selinux_compute_create_context',`
type security_t;
')
@@ -17624,7 +15241,7 @@ index 786449a..23a065c 100644
allow $1 security_t:dir list_dir_perms;
allow $1 security_t:file rw_file_perms;
allow $1 security_t:security compute_create;
-@@ -606,6 +664,7 @@ interface(`selinux_compute_member',`
+@@ -626,6 +664,7 @@ interface(`selinux_compute_member',`
type security_t;
')
@@ -17632,7 +15249,7 @@ index 786449a..23a065c 100644
allow $1 security_t:dir list_dir_perms;
allow $1 security_t:file rw_file_perms;
allow $1 security_t:security compute_member;
-@@ -635,6 +694,7 @@ interface(`selinux_compute_relabel_context',`
+@@ -655,6 +694,7 @@ interface(`selinux_compute_relabel_context',`
type security_t;
')
@@ -17640,7 +15257,7 @@ index 786449a..23a065c 100644
allow $1 security_t:dir list_dir_perms;
allow $1 security_t:file rw_file_perms;
allow $1 security_t:security compute_relabel;
-@@ -655,6 +715,7 @@ interface(`selinux_compute_user_contexts',`
+@@ -675,6 +715,7 @@ interface(`selinux_compute_user_contexts',`
type security_t;
')
@@ -17648,7 +15265,7 @@ index 786449a..23a065c 100644
allow $1 security_t:dir list_dir_perms;
allow $1 security_t:file rw_file_perms;
allow $1 security_t:security compute_user;
-@@ -677,3 +738,24 @@ interface(`selinux_unconfined',`
+@@ -697,3 +738,24 @@ interface(`selinux_unconfined',`
typeattribute $1 selinux_unconfined_type;
')
@@ -17673,27 +15290,8 @@ index 786449a..23a065c 100644
+ mls_trusted_object($1)
+')
+
-diff --git a/policy/modules/kernel/storage.fc b/policy/modules/kernel/storage.fc
-index a9b8982..57c4a6a 100644
---- a/policy/modules/kernel/storage.fc
-+++ b/policy/modules/kernel/storage.fc
-@@ -12,6 +12,7 @@
- /dev/cdu.* -b gen_context(system_u:object_r:removable_device_t,s0)
- /dev/cm20.* -b gen_context(system_u:object_r:removable_device_t,s0)
- /dev/dasd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
-+/dev/dasd[^/]* -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
- /dev/dm-[0-9]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
- /dev/drbd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
- /dev/etherd/.+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
-@@ -77,3 +78,6 @@ ifdef(`distro_redhat', `
- /dev/scramdisk/.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
-
- /dev/usb/rio500 -c gen_context(system_u:object_r:removable_device_t,s0)
-+
-+/lib/udev/devices/loop.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
-+/lib/udev/devices/fuse -c gen_context(system_u:object_r:fuse_device_t,s0)
diff --git a/policy/modules/kernel/storage.if b/policy/modules/kernel/storage.if
-index 3723150..346dfb1 100644
+index 1700ef2..02ff02d7 100644
--- a/policy/modules/kernel/storage.if
+++ b/policy/modules/kernel/storage.if
@@ -101,6 +101,8 @@ interface(`storage_raw_read_fixed_disk',`
@@ -17705,18 +15303,15 @@ index 3723150..346dfb1 100644
typeattribute $1 fixed_disk_raw_read;
')
-@@ -203,7 +205,10 @@ interface(`storage_create_fixed_disk_dev',`
- type fixed_disk_device_t;
- ')
+@@ -205,6 +207,7 @@ interface(`storage_create_fixed_disk_dev',`
-+ allow $1 self:capability mknod;
-+
+ allow $1 self:capability mknod;
allow $1 fixed_disk_device_t:blk_file create_blk_file_perms;
+ allow $1 fixed_disk_device_t:chr_file create_chr_file_perms;
dev_add_entry_generic_dirs($1)
')
-@@ -807,3 +812,358 @@ interface(`storage_unconfined',`
+@@ -808,3 +811,358 @@ interface(`storage_unconfined',`
typeattribute $1 storage_unconfined_type;
')
@@ -18076,18 +15671,10 @@ index 3723150..346dfb1 100644
+ dev_filetrans($1, removable_device_t, chr_file, "rio500")
+')
diff --git a/policy/modules/kernel/terminal.fc b/policy/modules/kernel/terminal.fc
-index 3994e57..a1923fe 100644
+index 7d45d15..6727eb7 100644
--- a/policy/modules/kernel/terminal.fc
+++ b/policy/modules/kernel/terminal.fc
-@@ -6,6 +6,7 @@
- /dev/console -c gen_context(system_u:object_r:console_device_t,s0)
- /dev/cu.* -c gen_context(system_u:object_r:tty_device_t,s0)
- /dev/dcbri[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0)
-+/dev/hpilo/[^/]* -c gen_context(system_u:object_r:tty_device_t,s0)
- /dev/hvc.* -c gen_context(system_u:object_r:tty_device_t,s0)
- /dev/hvsi.* -c gen_context(system_u:object_r:tty_device_t,s0)
- /dev/i2c[^/]* -c gen_context(system_u:object_r:tty_device_t,s0)
-@@ -18,6 +19,7 @@
+@@ -19,6 +19,7 @@
/dev/slamr[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/tty -c gen_context(system_u:object_r:devtty_t,s0)
/dev/ttySG.* -c gen_context(system_u:object_r:tty_device_t,s0)
@@ -18095,14 +15682,14 @@ index 3994e57..a1923fe 100644
/dev/xvc[^/]* -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/pty/.* -c gen_context(system_u:object_r:bsdpty_device_t,s0)
-@@ -40,3 +42,5 @@ ifdef(`distro_gentoo',`
+@@ -41,3 +42,5 @@ ifdef(`distro_gentoo',`
# used by init scripts to initally populate udev /dev
/lib/udev/devices/console -c gen_context(system_u:object_r:console_device_t,s0)
')
+
+/lib/udev/devices/pts -d gen_context(system_u:object_r:devpts_t,s0-mls_systemhigh)
diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
-index f3acfee..590c2c0 100644
+index 01dd2f1..8a67d21 100644
--- a/policy/modules/kernel/terminal.if
+++ b/policy/modules/kernel/terminal.if
@@ -208,6 +208,27 @@ interface(`term_use_all_terms',`
@@ -18155,15 +15742,6 @@ index f3acfee..590c2c0 100644
')
########################################
-@@ -341,7 +364,7 @@ interface(`term_relabel_console',`
- ')
-
- dev_list_all_dev_nodes($1)
-- allow $1 console_device_t:chr_file { relabelfrom relabelto };
-+ allow $1 console_device_t:chr_file relabel_chr_file_perms;
- ')
-
- ########################################
@@ -462,6 +485,24 @@ interface(`term_list_ptys',`
########################################
@@ -18197,33 +15775,7 @@ index f3acfee..590c2c0 100644
dontaudit $1 devpts_t:chr_file { getattr read write ioctl };
')
-@@ -658,6 +700,25 @@ interface(`term_use_controlling_term',`
- allow $1 devtty_t:chr_file { rw_term_perms lock append };
- ')
-
-+#######################################
-+## <summary>
-+## Allow attempts to get attributes
-+## on the pty multiplexor (/dev/ptmx).
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`term_getattr_ptmx',`
-+ gen_require(`
-+ type ptmx_t;
-+ ')
-+
-+ allow $1 ptmx_t:chr_file getattr;
-+')
-+
- ########################################
- ## <summary>
- ## Do not audit attempts to get attributes
-@@ -842,6 +903,26 @@ interface(`term_use_all_ptys',`
+@@ -860,6 +902,26 @@ interface(`term_use_all_ptys',`
########################################
## <summary>
@@ -18250,7 +15802,7 @@ index f3acfee..590c2c0 100644
## Do not audit attempts to read or write any ptys.
## </summary>
## <param name="domain">
-@@ -855,7 +936,7 @@ interface(`term_dontaudit_use_all_ptys',`
+@@ -873,7 +935,7 @@ interface(`term_dontaudit_use_all_ptys',`
attribute ptynode;
')
@@ -18259,7 +15811,7 @@ index f3acfee..590c2c0 100644
')
########################################
-@@ -903,7 +984,7 @@ interface(`term_getattr_all_user_ptys',`
+@@ -921,7 +983,7 @@ interface(`term_getattr_all_user_ptys',`
## </summary>
## <param name="domain">
## <summary>
@@ -18268,16 +15820,7 @@ index f3acfee..590c2c0 100644
## </summary>
## </param>
#
-@@ -1123,7 +1204,7 @@ interface(`term_relabel_unallocated_ttys',`
- ')
-
- dev_list_all_dev_nodes($1)
-- allow $1 tty_device_t:chr_file { relabelfrom relabelto };
-+ allow $1 tty_device_t:chr_file relabel_chr_file_perms;
- ')
-
- ########################################
-@@ -1222,7 +1303,8 @@ interface(`term_dontaudit_use_unallocated_ttys',`
+@@ -1240,7 +1302,8 @@ interface(`term_dontaudit_use_unallocated_ttys',`
type tty_device_t;
')
@@ -18287,7 +15830,7 @@ index f3acfee..590c2c0 100644
')
########################################
-@@ -1238,11 +1320,13 @@ interface(`term_dontaudit_use_unallocated_ttys',`
+@@ -1256,11 +1319,13 @@ interface(`term_dontaudit_use_unallocated_ttys',`
#
interface(`term_getattr_all_ttys',`
gen_require(`
@@ -18301,7 +15844,7 @@ index f3acfee..590c2c0 100644
')
########################################
-@@ -1259,10 +1343,12 @@ interface(`term_getattr_all_ttys',`
+@@ -1277,10 +1342,12 @@ interface(`term_getattr_all_ttys',`
interface(`term_dontaudit_getattr_all_ttys',`
gen_require(`
attribute ttynode;
@@ -18314,16 +15857,7 @@ index f3acfee..590c2c0 100644
')
########################################
-@@ -1301,7 +1387,7 @@ interface(`term_relabel_all_ttys',`
- ')
-
- dev_list_all_dev_nodes($1)
-- allow $1 ttynode:chr_file { relabelfrom relabelto };
-+ allow $1 ttynode:chr_file relabel_chr_file_perms;
- ')
-
- ########################################
-@@ -1340,7 +1426,27 @@ interface(`term_use_all_ttys',`
+@@ -1358,7 +1425,27 @@ interface(`term_use_all_ttys',`
')
dev_list_all_dev_nodes($1)
@@ -18352,7 +15886,7 @@ index f3acfee..590c2c0 100644
')
########################################
-@@ -1359,7 +1465,7 @@ interface(`term_dontaudit_use_all_ttys',`
+@@ -1377,7 +1464,7 @@ interface(`term_dontaudit_use_all_ttys',`
attribute ttynode;
')
@@ -18361,7 +15895,7 @@ index f3acfee..590c2c0 100644
')
########################################
-@@ -1467,7 +1573,7 @@ interface(`term_use_all_user_ttys',`
+@@ -1485,7 +1572,7 @@ interface(`term_use_all_user_ttys',`
## </summary>
## <param name="domain">
## <summary>
@@ -18370,7 +15904,7 @@ index f3acfee..590c2c0 100644
## </summary>
## </param>
#
-@@ -1475,3 +1581,393 @@ interface(`term_dontaudit_use_all_user_ttys',`
+@@ -1493,3 +1580,393 @@ interface(`term_dontaudit_use_all_user_ttys',`
refpolicywarn(`$0() is deprecated, use term_dontaudit_use_all_ttys() instead.')
term_dontaudit_use_all_ttys($1)
')
@@ -18700,7 +16234,7 @@ index f3acfee..590c2c0 100644
+ dev_filetrans($1, tty_device_t, chr_file, "isdn7")
+ dev_filetrans($1, tty_device_t, chr_file, "isdn8")
+ dev_filetrans($1, tty_device_t, chr_file, "isdn9")
-+ #filetrans_pattern($1, devpts_t, chr_file, "ptmx")
++ filetrans_pattern($1, devpts_t, ptmx_t, chr_file, "ptmx")
+ dev_filetrans($1, ptmx_t, chr_file, "ptmx")
+ dev_filetrans($1, tty_device_t, chr_file, "rfcomm0")
+ dev_filetrans($1, tty_device_t, chr_file, "rfcomm1")
@@ -18765,7 +16299,7 @@ index f3acfee..590c2c0 100644
+ dev_filetrans($1, tty_device_t, chr_file, "xvc9")
+')
diff --git a/policy/modules/kernel/terminal.te b/policy/modules/kernel/terminal.te
-index 361692e..0f09fb5 100644
+index 2241b7d..b0ab494 100644
--- a/policy/modules/kernel/terminal.te
+++ b/policy/modules/kernel/terminal.te
@@ -29,6 +29,7 @@ files_mountpoint(devpts_t)
@@ -19141,7 +16675,7 @@ index 2be17d2..1a6d9d1 100644
+ userdom_execmod_user_home_files(staff_usertype)
+')
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
-index 4a8d146..15fbd76 100644
+index e14b961..bd304b2 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -24,20 +24,55 @@ ifndef(`enable_mls',`
@@ -19276,14 +16810,14 @@ index 4a8d146..15fbd76 100644
- libs_run_ldconfig(sysadm_t, sysadm_r)
+ kerberos_exec_kadmind(sysadm_t)
+ kerberos_filetrans_named_content(sysadm_t)
-+')
-+
-+optional_policy(`
-+ kudzu_run(sysadm_t, sysadm_r)
')
optional_policy(`
- lockdev_role(sysadm_r, sysadm_t)
++ kudzu_run(sysadm_t, sysadm_r)
++')
++
++optional_policy(`
+ libs_run_ldconfig(sysadm_t, sysadm_r)
')
@@ -19351,7 +16885,7 @@ index 4a8d146..15fbd76 100644
')
optional_policy(`
-- raid_domtrans_mdadm(sysadm_t)
+- raid_run_mdadm(sysadm_r, sysadm_t)
+ quota_run(sysadm_t, sysadm_r)
')
@@ -19497,14 +17031,14 @@ index 4a8d146..15fbd76 100644
optional_policy(`
- irc_role(sysadm_r, sysadm_t)
+ java_role(sysadm_r, sysadm_t)
++ ')
++
++ optional_policy(`
++ lockdev_role(sysadm_r, sysadm_t)
')
optional_policy(`
- java_role(sysadm_r, sysadm_t)
-+ lockdev_role(sysadm_r, sysadm_t)
-+ ')
-+
-+ optional_policy(`
+ mozilla_role(sysadm_r, sysadm_t)
+ ')
+
@@ -19518,8 +17052,9 @@ index 4a8d146..15fbd76 100644
+
+ optional_policy(`
+ razor_role(sysadm_r, sysadm_t)
-+ ')
-+
+ ')
+-')
+
+ optional_policy(`
+ rssh_role(sysadm_r, sysadm_t)
+ ')
@@ -19550,9 +17085,8 @@ index 4a8d146..15fbd76 100644
+
+ optional_policy(`
+ wireshark_role(sysadm_r, sysadm_t)
- ')
--')
-
++ ')
++
+ optional_policy(`
+ xserver_role(sysadm_r, sysadm_t)
+ ')
@@ -21753,221 +19287,22 @@ index a496fde..847609a 100644
########################################
#
# AFS bossserver local policy
-diff --git a/policy/modules/services/aiccu.fc b/policy/modules/services/aiccu.fc
-new file mode 100644
-index 0000000..069518f
---- /dev/null
-+++ b/policy/modules/services/aiccu.fc
-@@ -0,0 +1,6 @@
-+/etc/aiccu.conf -- gen_context(system_u:object_r:aiccu_etc_t,s0)
-+/etc/rc\.d/init\.d/aiccu -- gen_context(system_u:object_r:aiccu_initrc_exec_t,s0)
-+
-+/usr/sbin/aiccu -- gen_context(system_u:object_r:aiccu_exec_t,s0)
-+
-+/var/run/aiccu\.pid -- gen_context(system_u:object_r:aiccu_var_run_t,s0)
-diff --git a/policy/modules/services/aiccu.if b/policy/modules/services/aiccu.if
-new file mode 100644
-index 0000000..6bf0ad6
---- /dev/null
-+++ b/policy/modules/services/aiccu.if
-@@ -0,0 +1,116 @@
-+## <summary>Automatic IPv6 Connectivity Client Utility.</summary>
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run aiccu.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`aiccu_domtrans',`
-+ gen_require(`
-+ type aiccu_t, aiccu_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, aiccu_exec_t, aiccu_t)
-+ corecmd_search_bin($1)
-+')
-+
-+########################################
-+## <summary>
-+## Execute aiccu server in the aiccu domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`aiccu_initrc_domtrans',`
-+ gen_require(`
-+ type aiccu_initrc_exec_t;
-+ ')
-+
-+ init_labeled_script_domtrans($1, aiccu_initrc_exec_t)
-+')
-+
-+########################################
-+## <summary>
-+## Read aiccu PID files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`aiccu_read_pid_files',`
-+ gen_require(`
-+ type aiccu_var_run_t;
-+ ')
-+
-+ allow $1 aiccu_var_run_t:file read_file_perms;
-+ files_search_pids($1)
-+')
-+
-+########################################
-+## <summary>
-+## Manage aiccu PID files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`aiccu_manage_var_run',`
-+ gen_require(`
-+ type aiccu_var_run_t;
-+ ')
-+
-+ manage_dirs_pattern($1, aiccu_var_run_t, aiccu_var_run_t)
-+ manage_files_pattern($1, aiccu_var_run_t, aiccu_var_run_t)
-+ manage_lnk_files_pattern($1, aiccu_var_run_t, aiccu_var_run_t)
-+ files_search_pids($1)
-+')
-+
-+########################################
-+## <summary>
-+## All of the rules required to administrate
-+## an aiccu environment
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <param name="role">
-+## <summary>
-+## Role allowed access.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`aiccu_admin',`
-+ gen_require(`
-+ type aiccu_t, aiccu_initrc_exec_t, aiccu_etc_t;
-+ type aiccu_var_run_t;
-+ ')
-+
-+ allow $1 aiccu_t:process { ptrace signal_perms };
-+ ps_process_pattern($1, aiccu_t)
-+
-+ aiccu_initrc_domtrans($1)
-+ domain_system_change_exemption($1)
-+ role_transition $2 aiccu_initrc_exec_t system_r;
-+ allow $2 system_r;
-+
-+ admin_pattern($1, aiccu_etc_t)
-+ files_list_etc($1)
-+
-+ admin_pattern($1, aiccu_var_run_t)
-+ files_list_pids($1)
-+')
diff --git a/policy/modules/services/aiccu.te b/policy/modules/services/aiccu.te
-new file mode 100644
-index 0000000..dda9c93
---- /dev/null
+index 6d685ba..4114d9b 100644
+--- a/policy/modules/services/aiccu.te
+++ b/policy/modules/services/aiccu.te
-@@ -0,0 +1,75 @@
-+policy_module(aiccu, 1.0.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+type aiccu_t;
-+type aiccu_exec_t;
-+init_daemon_domain(aiccu_t, aiccu_exec_t)
-+
-+type aiccu_initrc_exec_t;
-+init_script_file(aiccu_initrc_exec_t)
-+
-+type aiccu_etc_t;
-+files_config_file(aiccu_etc_t)
-+
-+type aiccu_var_run_t;
-+files_pid_file(aiccu_var_run_t)
-+
-+########################################
-+#
-+# aiccu local policy
-+#
-+
-+allow aiccu_t self:capability { kill net_admin net_raw };
-+dontaudit aiccu_t self:capability sys_tty_config;
-+allow aiccu_t self:process signal;
-+allow aiccu_t self:fifo_file rw_fifo_file_perms;
-+allow aiccu_t self:netlink_route_socket create_netlink_socket_perms;
-+allow aiccu_t self:tcp_socket create_stream_socket_perms;
-+allow aiccu_t self:tun_socket create_socket_perms;
-+allow aiccu_t self:udp_socket create_stream_socket_perms;
-+allow aiccu_t self:unix_stream_socket create_stream_socket_perms;
-+
-+allow aiccu_t aiccu_etc_t:file read_file_perms;
-+
-+manage_dirs_pattern(aiccu_t, aiccu_var_run_t, aiccu_var_run_t)
-+manage_files_pattern(aiccu_t, aiccu_var_run_t, aiccu_var_run_t)
-+files_pid_filetrans(aiccu_t, aiccu_var_run_t, { file dir })
-+
-+kernel_read_system_state(aiccu_t)
-+
-+corecmd_exec_shell(aiccu_t)
-+
-+corenet_all_recvfrom_netlabel(aiccu_t)
-+corenet_all_recvfrom_unlabeled(aiccu_t)
+@@ -45,9 +45,11 @@ corecmd_exec_shell(aiccu_t)
+
+ corenet_all_recvfrom_netlabel(aiccu_t)
+ corenet_all_recvfrom_unlabeled(aiccu_t)
+corenet_tcp_bind_generic_node(aiccu_t)
-+corenet_tcp_sendrecv_generic_if(aiccu_t)
-+corenet_tcp_sendrecv_generic_node(aiccu_t)
-+corenet_tcp_sendrecv_generic_port(aiccu_t)
+ corenet_tcp_sendrecv_generic_if(aiccu_t)
+ corenet_tcp_sendrecv_generic_node(aiccu_t)
+ corenet_tcp_sendrecv_generic_port(aiccu_t)
+corenet_sendrecv_sixxsconfig_client_packets(aiccu_t)
-+corenet_tcp_sendrecv_sixxsconfig_port(aiccu_t)
-+corenet_tcp_connect_sixxsconfig_port(aiccu_t)
-+corenet_rw_tun_tap_dev(aiccu_t)
-+
-+domain_use_interactive_fds(aiccu_t)
-+
-+dev_read_rand(aiccu_t)
-+dev_read_urand(aiccu_t)
-+
-+files_read_etc_files(aiccu_t)
-+
-+logging_send_syslog_msg(aiccu_t)
-+
-+miscfiles_read_localization(aiccu_t)
-+
-+optional_policy(`
-+ modutils_domtrans_insmod(aiccu_t)
-+')
-+
-+optional_policy(`
-+ sysnet_domtrans_ifconfig(aiccu_t)
-+ sysnet_dns_name_resolve(aiccu_t)
-+')
+ corenet_tcp_sendrecv_sixxsconfig_port(aiccu_t)
+ corenet_tcp_bind_generic_node(aiccu_t)
+ corenet_tcp_connect_sixxsconfig_port(aiccu_t)
diff --git a/policy/modules/services/aide.fc b/policy/modules/services/aide.fc
index 7798464..ff76db7 100644
--- a/policy/modules/services/aide.fc
@@ -22034,27 +19369,10 @@ index 0370dba..af5d229 100644
#
interface(`aisexec_domtrans',`
diff --git a/policy/modules/services/aisexec.te b/policy/modules/services/aisexec.te
-index 97c9cae..568e37d 100644
+index 64953f7..99a750b 100644
--- a/policy/modules/services/aisexec.te
+++ b/policy/modules/services/aisexec.te
-@@ -32,7 +32,7 @@ files_pid_file(aisexec_var_run_t)
- # aisexec local policy
- #
-
--allow aisexec_t self:capability { sys_nice sys_resource ipc_lock };
-+allow aisexec_t self:capability { sys_nice sys_resource ipc_lock ipc_owner };
- allow aisexec_t self:process { setrlimit setsched signal };
- allow aisexec_t self:fifo_file rw_fifo_file_perms;
- allow aisexec_t self:sem create_sem_perms;
-@@ -81,11 +81,18 @@ logging_send_syslog_msg(aisexec_t)
-
- miscfiles_read_localization(aisexec_t)
-
-+userdom_rw_semaphores(aisexec_t)
-+userdom_rw_unpriv_user_shared_mem(aisexec_t)
-+
- optional_policy(`
- ccs_stream_connect(aisexec_t)
+@@ -89,6 +89,10 @@ optional_policy(`
')
optional_policy(`
@@ -22252,59 +19570,11 @@ index d96fdfa..e07158f 100644
ifdef(`distro_debian',`
/usr/sbin/amavisd-new-cronjob -- gen_context(system_u:object_r:amavis_exec_t,s0)
-diff --git a/policy/modules/services/amavis.if b/policy/modules/services/amavis.if
-index ceb2142..e31d92a 100644
---- a/policy/modules/services/amavis.if
-+++ b/policy/modules/services/amavis.if
-@@ -183,7 +183,7 @@ interface(`amavis_setattr_pid_files',`
- type amavis_var_run_t;
- ')
-
-- allow $1 amavis_var_run_t:file setattr;
-+ allow $1 amavis_var_run_t:file setattr_file_perms;
- files_search_pids($1)
- ')
-
diff --git a/policy/modules/services/amavis.te b/policy/modules/services/amavis.te
-index c3a1903..19fb14a 100644
+index deca9d3..841fa8f 100644
--- a/policy/modules/services/amavis.te
+++ b/policy/modules/services/amavis.te
-@@ -47,7 +47,7 @@ files_type(amavis_spool_t)
-
- allow amavis_t self:capability { kill chown dac_override setgid setuid };
- dontaudit amavis_t self:capability sys_tty_config;
--allow amavis_t self:process { signal sigchld signull };
-+allow amavis_t self:process { signal sigchld sigkill signull };
- allow amavis_t self:fifo_file rw_fifo_file_perms;
- allow amavis_t self:unix_stream_socket create_stream_socket_perms;
- allow amavis_t self:unix_dgram_socket create_socket_perms;
-@@ -76,7 +76,7 @@ files_search_spool(amavis_t)
-
- # tmp files
- manage_files_pattern(amavis_t, amavis_tmp_t, amavis_tmp_t)
--allow amavis_t amavis_tmp_t:dir setattr;
-+allow amavis_t amavis_tmp_t:dir setattr_dir_perms;
- files_tmp_filetrans(amavis_t, amavis_tmp_t, file)
-
- # var/lib files for amavis
-@@ -86,7 +86,7 @@ manage_sock_files_pattern(amavis_t, amavis_var_lib_t, amavis_var_lib_t)
- files_search_var_lib(amavis_t)
-
- # log files
--allow amavis_t amavis_var_log_t:dir setattr;
-+allow amavis_t amavis_var_log_t:dir setattr_dir_perms;
- manage_files_pattern(amavis_t, amavis_var_log_t, amavis_var_log_t)
- manage_sock_files_pattern(amavis_t, amavis_var_log_t, amavis_var_log_t)
- logging_log_filetrans(amavis_t, amavis_var_log_t, { sock_file file dir })
-@@ -105,6 +105,7 @@ kernel_dontaudit_read_system_state(amavis_t)
-
- # find perl
- corecmd_exec_bin(amavis_t)
-+corecmd_exec_shell(amavis_t)
-
- corenet_all_recvfrom_unlabeled(amavis_t)
- corenet_all_recvfrom_netlabel(amavis_t)
-@@ -152,24 +153,32 @@ sysnet_use_ldap(amavis_t)
+@@ -153,24 +153,28 @@ sysnet_use_ldap(amavis_t)
userdom_dontaudit_search_user_home_dirs(amavis_t)
@@ -22337,11 +19607,7 @@ index c3a1903..19fb14a 100644
+')
+
+optional_policy(`
-+ nslcd_stream_connect(amavis_t)
-+')
-+
-+optional_policy(`
- postfix_read_config(amavis_t)
+ nslcd_stream_connect(amavis_t)
')
diff --git a/policy/modules/services/apache.fc b/policy/modules/services/apache.fc
@@ -25189,164 +22455,63 @@ index 0000000..1442451
+ java_exec(boinc_project_t)
+')
diff --git a/policy/modules/services/bugzilla.fc b/policy/modules/services/bugzilla.fc
-new file mode 100644
-index 0000000..18f37e2
---- /dev/null
+index 8c84063..c8bfb68 100644
+--- a/policy/modules/services/bugzilla.fc
+++ b/policy/modules/services/bugzilla.fc
-@@ -0,0 +1,4 @@
+@@ -1,3 +1,4 @@
+
-+/usr/share/bugzilla(/.*)? -d gen_context(system_u:object_r:httpd_bugzilla_content_t,s0)
-+/usr/share/bugzilla(/.*)? -- gen_context(system_u:object_r:httpd_bugzilla_script_exec_t,s0)
-+/var/lib/bugzilla(/.*)? gen_context(system_u:object_r:httpd_bugzilla_rw_content_t,s0)
+ /usr/share/bugzilla(/.*)? -d gen_context(system_u:object_r:httpd_bugzilla_content_t,s0)
+ /usr/share/bugzilla(/.*)? -- gen_context(system_u:object_r:httpd_bugzilla_script_exec_t,s0)
+
diff --git a/policy/modules/services/bugzilla.if b/policy/modules/services/bugzilla.if
-new file mode 100644
-index 0000000..d1fd21d
---- /dev/null
+index de89d0f..0deec20 100644
+--- a/policy/modules/services/bugzilla.if
+++ b/policy/modules/services/bugzilla.if
-@@ -0,0 +1,80 @@
-+## <summary>Bugzilla server</summary>
-+
-+########################################
-+## <summary>
-+## Allow the specified domain to search
-+## bugzilla directories.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`bugzilla_search_dirs',`
-+ gen_require(`
-+ type httpd_bugzilla_content_t;
-+ ')
-+
-+ allow $1 httpd_bugzilla_content_t:dir search_dir_perms;
-+')
-+
-+########################################
-+## <summary>
-+## Do not audit attempts to read and write
-+## bugzilla script unix domain stream sockets.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`bugzilla_dontaudit_rw_script_stream_sockets',`
-+ gen_require(`
-+ type httpd_bugzilla_script_t;
-+ ')
-+
-+ dontaudit $1 httpd_bugzilla_script_t:unix_stream_socket { read write };
-+')
-+
-+########################################
-+## <summary>
-+## All of the rules required to administrate
-+## an bugzilla environment
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <param name="role">
-+## <summary>
-+## The role to be allowed to manage the bugzilla domain.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`bugzilla_admin',`
-+ gen_require(`
-+ type httpd_bugzilla_script_t, httpd_bugzilla_content_t, httpd_bugzilla_ra_content_t;
-+ type httpd_bugzilla_rw_content_t, httpd_bugzilla_tmp_t, httpd_bugzilla_script_exec_t;
-+ type httpd_bugzilla_htaccess_t;
-+ ')
-+
-+ allow $1 httpd_bugzilla_script_t:process { ptrace signal_perms };
-+ ps_process_pattern($1, httpd_bugzilla_script_t)
-+
+@@ -58,13 +58,16 @@ interface(`bugzilla_dontaudit_rw_stream_sockets',`
+ interface(`bugzilla_admin',`
+ gen_require(`
+ type httpd_bugzilla_script_t, httpd_bugzilla_content_t, httpd_bugzilla_ra_content_t;
+- type httpd_bugzilla_rw_content_t, httpd_bugzilla_script_exec_t;
+- type httpd_bugzilla_htaccess_t;
+- ')
++ type httpd_bugzilla_rw_content_t, httpd_bugzilla_script_exec_t;
++ type httpd_bugzilla_htaccess_t;
++ ')
+
+ allow $1 httpd_bugzilla_script_t:process { ptrace signal_perms };
+ ps_process_pattern($1, httpd_bugzilla_script_t)
+
+ files_list_tmp($1)
+ admin_pattern($1, httpd_bugzilla_tmp_t)
+
-+ files_list_var_lib(httpd_bugzilla_script_t)
-+
-+ apache_list_sys_content($1)
-+ admin_pattern($1, httpd_bugzilla_script_exec_t)
-+ admin_pattern($1, httpd_bugzilla_script_t)
-+ admin_pattern($1, httpd_bugzilla_content_t)
-+ admin_pattern($1, httpd_bugzilla_htaccess_t)
-+ admin_pattern($1, httpd_bugzilla_rw_content_t)
-+ admin_pattern($1, httpd_bugzilla_ra_content_t)
-+')
+ files_list_var_lib(httpd_bugzilla_script_t)
+
+ apache_list_sys_content($1)
diff --git a/policy/modules/services/bugzilla.te b/policy/modules/services/bugzilla.te
-new file mode 100644
-index 0000000..5fa8122
---- /dev/null
+index 048abbf..7368f57 100644
+--- a/policy/modules/services/bugzilla.te
+++ b/policy/modules/services/bugzilla.te
-@@ -0,0 +1,57 @@
-+policy_module(bugzilla, 1.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+apache_content_template(bugzilla)
-+
+@@ -7,6 +7,9 @@ policy_module(bugzilla, 1.0.0)
+
+ apache_content_template(bugzilla)
+
+type httpd_bugzilla_tmp_t;
+files_tmp_file(httpd_bugzilla_tmp_t)
+
-+########################################
-+#
-+# bugzilla local policy
-+#
-+
-+allow httpd_bugzilla_script_t self:netlink_route_socket r_netlink_socket_perms;
-+allow httpd_bugzilla_script_t self:tcp_socket create_stream_socket_perms;
-+allow httpd_bugzilla_script_t self:udp_socket create_socket_perms;
-+
-+corenet_all_recvfrom_unlabeled(httpd_bugzilla_script_t)
-+corenet_all_recvfrom_netlabel(httpd_bugzilla_script_t)
-+corenet_tcp_sendrecv_generic_if(httpd_bugzilla_script_t)
-+corenet_udp_sendrecv_generic_if(httpd_bugzilla_script_t)
-+corenet_tcp_sendrecv_generic_node(httpd_bugzilla_script_t)
-+corenet_udp_sendrecv_generic_node(httpd_bugzilla_script_t)
-+corenet_tcp_sendrecv_all_ports(httpd_bugzilla_script_t)
-+corenet_udp_sendrecv_all_ports(httpd_bugzilla_script_t)
-+corenet_tcp_connect_postgresql_port(httpd_bugzilla_script_t)
-+corenet_tcp_connect_mysqld_port(httpd_bugzilla_script_t)
-+corenet_tcp_connect_http_port(httpd_bugzilla_script_t)
-+corenet_tcp_connect_smtp_port(httpd_bugzilla_script_t)
-+corenet_sendrecv_postgresql_client_packets(httpd_bugzilla_script_t)
-+corenet_sendrecv_mysqld_client_packets(httpd_bugzilla_script_t)
-+
+ ########################################
+ #
+ # bugzilla local policy
+@@ -31,6 +34,10 @@ corenet_tcp_connect_smtp_port(httpd_bugzilla_script_t)
+ corenet_sendrecv_postgresql_client_packets(httpd_bugzilla_script_t)
+ corenet_sendrecv_mysqld_client_packets(httpd_bugzilla_script_t)
+
+manage_dirs_pattern(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, httpd_bugzilla_tmp_t)
+manage_files_pattern(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, httpd_bugzilla_tmp_t)
+files_tmp_filetrans(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, { file dir })
+
-+files_search_var_lib(httpd_bugzilla_script_t)
-+
-+sysnet_read_config(httpd_bugzilla_script_t)
-+sysnet_use_ldap(httpd_bugzilla_script_t)
-+
-+optional_policy(`
-+ mta_send_mail(httpd_bugzilla_script_t)
-+')
-+
-+optional_policy(`
-+ mysql_search_db(httpd_bugzilla_script_t)
-+ mysql_stream_connect(httpd_bugzilla_script_t)
-+')
-+
-+optional_policy(`
-+ postgresql_stream_connect(httpd_bugzilla_script_t)
-+')
+ files_search_var_lib(httpd_bugzilla_script_t)
+
+ sysnet_read_config(httpd_bugzilla_script_t)
diff --git a/policy/modules/services/cachefilesd.fc b/policy/modules/services/cachefilesd.fc
new file mode 100644
index 0000000..24d9837
@@ -26312,18 +23477,8 @@ index c3e3f79..3e78d4e 100644
pcscd_stream_connect(certmonger_t)
')
+
-diff --git a/policy/modules/services/cgroup.fc b/policy/modules/services/cgroup.fc
-index 420c9d3..b6bb46c 100644
---- a/policy/modules/services/cgroup.fc
-+++ b/policy/modules/services/cgroup.fc
-@@ -11,4 +11,5 @@
- /sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0)
- /sbin/cgclear -- gen_context(system_u:object_r:cgclear_exec_t,s0)
-
-+/var/log/cgrulesengd\.log -- gen_context(system_u:object_r:cgred_log_t,s0)
- /var/run/cgred.* gen_context(system_u:object_r:cgred_var_run_t,s0)
diff --git a/policy/modules/services/cgroup.if b/policy/modules/services/cgroup.if
-index d020c93..e5cbcef 100644
+index 33facaf..e5cbcef 100644
--- a/policy/modules/services/cgroup.if
+++ b/policy/modules/services/cgroup.if
@@ -6,9 +6,9 @@
@@ -26362,33 +23517,11 @@ index d020c93..e5cbcef 100644
## </param>
#
interface(`cgroup_domtrans_cgred',`
-@@ -182,10 +182,10 @@ interface(`cgroup_admin',`
-
- admin_pattern($1, cgconfig_etc_t)
- admin_pattern($1, cgrules_etc_t)
-- files_search_etc($1)
-+ files_list_etc($1)
-
- admin_pattern($1, cgred_var_run_t)
-- files_search_pids($1)
-+ files_list_pids($1)
-
- cgroup_initrc_domtrans_cgconfig($1)
- domain_system_change_exemption($1)
diff --git a/policy/modules/services/cgroup.te b/policy/modules/services/cgroup.te
-index 8ca2333..93c7789 100644
+index dad226c..7617c53 100644
--- a/policy/modules/services/cgroup.te
+++ b/policy/modules/services/cgroup.te
-@@ -16,14 +16,17 @@ init_daemon_domain(cgred_t, cgred_exec_t)
- type cgred_initrc_exec_t;
- init_script_file(cgred_initrc_exec_t)
-
-+type cgred_log_t;
-+logging_log_file(cgred_log_t)
-+
- type cgred_var_run_t;
- files_pid_file(cgred_var_run_t)
-
+@@ -25,8 +25,8 @@ files_pid_file(cgred_var_run_t)
type cgrules_etc_t;
files_config_file(cgrules_etc_t)
@@ -26399,40 +23532,15 @@ index 8ca2333..93c7789 100644
init_daemon_domain(cgconfig_t, cgconfig_exec_t)
type cgconfig_initrc_exec_t;
-@@ -36,8 +39,7 @@ files_config_file(cgconfig_etc_t)
+@@ -39,7 +39,6 @@ files_config_file(cgconfig_etc_t)
#
# cgclear personal policy.
#
-
--allow cgclear_t self:capability sys_admin;
-+allow cgclear_t self:capability { dac_read_search dac_override sys_admin };
+ allow cgclear_t self:capability { dac_read_search dac_override sys_admin };
kernel_read_system_state(cgclear_t)
-
-@@ -52,7 +54,7 @@ fs_unmount_cgroup(cgclear_t)
- # cgconfig personal policy.
- #
-
--allow cgconfig_t self:capability { chown sys_admin };
-+allow cgconfig_t self:capability { dac_override fowner fsetid chown sys_admin sys_tty_config };
-
- allow cgconfig_t cgconfig_etc_t:file read_file_perms;
-
-@@ -67,18 +69,22 @@ fs_manage_cgroup_dirs(cgconfig_t)
- fs_manage_cgroup_files(cgconfig_t)
- fs_mount_cgroup(cgconfig_t)
- fs_mounton_cgroup(cgconfig_t)
-+fs_unmount_cgroup(cgconfig_t)
-
- ########################################
- #
- # cgred personal policy.
- #
-
--allow cgred_t self:capability { net_admin sys_admin sys_ptrace dac_override };
-+allow cgred_t self:capability { chown fsetid net_admin sys_admin sys_ptrace dac_override };
- allow cgred_t self:netlink_socket { write bind create read };
- allow cgred_t self:unix_dgram_socket { write create connect };
+@@ -86,6 +85,9 @@ logging_log_filetrans(cgred_t, cgred_log_t, file)
allow cgred_t cgrules_etc_t:file read_file_perms;
@@ -26442,7 +23550,7 @@ index 8ca2333..93c7789 100644
# rc script creates pid file
manage_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t)
manage_sock_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t)
-@@ -97,6 +103,8 @@ files_read_etc_files(cgred_t)
+@@ -104,6 +106,8 @@ files_read_etc_files(cgred_t)
fs_write_cgroup_files(cgred_t)
@@ -26942,200 +24050,31 @@ index 6077339..d10acd2 100644
dev_read_lvm_control(clogd_t)
dev_manage_generic_blk_files(clogd_t)
diff --git a/policy/modules/services/cmirrord.fc b/policy/modules/services/cmirrord.fc
-new file mode 100644
-index 0000000..e500fa5
---- /dev/null
+index 049e2b6..e500fa5 100644
+--- a/policy/modules/services/cmirrord.fc
+++ b/policy/modules/services/cmirrord.fc
-@@ -0,0 +1,6 @@
-+
-+/etc/rc\.d/init\.d/cmirrord -- gen_context(system_u:object_r:cmirrord_initrc_exec_t,s0)
-+
-+/usr/sbin/cmirrord -- gen_context(system_u:object_r:cmirrord_exec_t,s0)
+@@ -1,3 +1,4 @@
+
-+/var/run/cmirrord\.pid -- gen_context(system_u:object_r:cmirrord_var_run_t,s0)
+ /etc/rc\.d/init\.d/cmirrord -- gen_context(system_u:object_r:cmirrord_initrc_exec_t,s0)
+
+ /usr/sbin/cmirrord -- gen_context(system_u:object_r:cmirrord_exec_t,s0)
diff --git a/policy/modules/services/cmirrord.if b/policy/modules/services/cmirrord.if
-new file mode 100644
-index 0000000..756ac91
---- /dev/null
+index f8463c0..bed51fb 100644
+--- a/policy/modules/services/cmirrord.if
+++ b/policy/modules/services/cmirrord.if
-@@ -0,0 +1,113 @@
-+## <summary>policy for cmirrord</summary>
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run cmirrord.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`cmirrord_domtrans',`
-+ gen_require(`
-+ type cmirrord_t, cmirrord_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, cmirrord_exec_t, cmirrord_t)
-+')
-+
-+########################################
-+## <summary>
-+## Execute cmirrord server in the cmirrord domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`cmirrord_initrc_domtrans',`
-+ gen_require(`
-+ type cmirrord_initrc_exec_t;
-+ ')
-+
-+ init_labeled_script_domtrans($1, cmirrord_initrc_exec_t)
-+')
-+
-+########################################
-+## <summary>
-+## Read cmirrord PID files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`cmirrord_read_pid_files',`
-+ gen_require(`
-+ type cmirrord_var_run_t;
-+ ')
-+
-+ files_search_pids($1)
-+ allow $1 cmirrord_var_run_t:file read_file_perms;
-+')
-+
-+#######################################
-+## <summary>
-+## Read and write to cmirrord shared memory.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`cmirrord_rw_shm',`
-+ gen_require(`
-+ type cmirrord_t, cmirrord_tmpfs_t;
-+ ')
-+
+@@ -70,10 +70,11 @@ interface(`cmirrord_rw_shm',`
+ type cmirrord_t, cmirrord_tmpfs_t;
+ ')
+
+- allow $1 cmirrord_t:shm rw_shm_perms;
+ allow $1 cmirrord_t:shm { rw_shm_perms destroy };
-+ allow $1 cmirrord_tmpfs_t:dir list_dir_perms;
-+ rw_files_pattern($1, cmirrord_tmpfs_t, cmirrord_tmpfs_t)
+
+ allow $1 cmirrord_tmpfs_t:dir list_dir_perms;
+ rw_files_pattern($1, cmirrord_tmpfs_t, cmirrord_tmpfs_t)
+ delete_files_pattern($1, cmirrord_tmpfs_t, cmirrord_tmpfs_t)
-+ read_lnk_files_pattern($1, cmirrord_tmpfs_t, cmirrord_tmpfs_t)
-+ fs_search_tmpfs($1)
-+')
-+
-+########################################
-+## <summary>
-+## All of the rules required to administrate
-+## an cmirrord environment
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <param name="role">
-+## <summary>
-+## Role allowed access.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`cmirrord_admin',`
-+ gen_require(`
-+ type cmirrord_t, cmirrord_initrc_exec_t, cmirrord_var_run_t;
-+ ')
-+
-+ allow $1 cmirrord_t:process { ptrace signal_perms };
-+ ps_process_pattern($1, cmirrord_t)
-+
-+ cmirrord_initrc_domtrans($1)
-+ domain_system_change_exemption($1)
-+ role_transition $2 cmirrord_initrc_exec_t system_r;
-+ allow $2 system_r;
-+
-+ files_list_pids($1)
-+ admin_pattern($1, cmirrord_var_run_t)
-+')
-diff --git a/policy/modules/services/cmirrord.te b/policy/modules/services/cmirrord.te
-new file mode 100644
-index 0000000..28fdd8a
---- /dev/null
-+++ b/policy/modules/services/cmirrord.te
-@@ -0,0 +1,58 @@
-+policy_module(cmirrord, 1.0.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+type cmirrord_t;
-+type cmirrord_exec_t;
-+init_daemon_domain(cmirrord_t, cmirrord_exec_t)
-+
-+type cmirrord_initrc_exec_t;
-+init_script_file(cmirrord_initrc_exec_t)
-+
-+type cmirrord_tmpfs_t;
-+files_tmpfs_file(cmirrord_tmpfs_t)
-+
-+type cmirrord_var_run_t;
-+files_pid_file(cmirrord_var_run_t)
-+
-+########################################
-+#
-+# cmirrord local policy
-+#
-+
-+allow cmirrord_t self:capability { net_admin kill };
-+dontaudit cmirrord_t self:capability sys_tty_config;
-+allow cmirrord_t self:process { setfscreate signal};
-+allow cmirrord_t self:fifo_file rw_fifo_file_perms;
-+allow cmirrord_t self:sem create_sem_perms;
-+allow cmirrord_t self:shm create_shm_perms;
-+allow cmirrord_t self:netlink_socket create_socket_perms;
-+allow cmirrord_t self:unix_stream_socket create_stream_socket_perms;
-+
-+manage_dirs_pattern(cmirrord_t, cmirrord_tmpfs_t, cmirrord_tmpfs_t)
-+manage_files_pattern(cmirrord_t, cmirrord_tmpfs_t, cmirrord_tmpfs_t)
-+fs_tmpfs_filetrans(cmirrord_t, cmirrord_tmpfs_t, { dir file })
-+
-+manage_dirs_pattern(cmirrord_t, cmirrord_var_run_t, cmirrord_var_run_t)
-+manage_files_pattern(cmirrord_t, cmirrord_var_run_t, cmirrord_var_run_t)
-+files_pid_filetrans(cmirrord_t, cmirrord_var_run_t, file)
-+
-+domain_use_interactive_fds(cmirrord_t)
-+domain_obj_id_change_exemption(cmirrord_t)
-+
-+files_read_etc_files(cmirrord_t)
-+
-+storage_create_fixed_disk_dev(cmirrord_t)
-+
-+seutil_read_file_contexts(cmirrord_t)
-+
-+logging_send_syslog_msg(cmirrord_t)
-+
-+miscfiles_read_localization(cmirrord_t)
-+
-+optional_policy(`
-+ corosync_stream_connect(cmirrord_t)
-+')
+ read_lnk_files_pattern($1, cmirrord_tmpfs_t, cmirrord_tmpfs_t)
+ fs_search_tmpfs($1)
+ ')
diff --git a/policy/modules/services/cobbler.fc b/policy/modules/services/cobbler.fc
index 1cf6c4e..e4bac67 100644
--- a/policy/modules/services/cobbler.fc
@@ -27180,7 +24119,7 @@ index 1cf6c4e..e4bac67 100644
-/var/lib/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t, s0)
-/var/log/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_log_t, s0)
diff --git a/policy/modules/services/cobbler.if b/policy/modules/services/cobbler.if
-index 293e08d..82306eb 100644
+index 116d60f..82306eb 100644
--- a/policy/modules/services/cobbler.if
+++ b/policy/modules/services/cobbler.if
@@ -1,12 +1,12 @@
@@ -27241,7 +24180,7 @@ index 293e08d..82306eb 100644
type cobbler_etc_t;
')
-- read_files_pattern($1, cobbler_etc_t, cobbler_etc_t);
+- read_files_pattern($1, cobbler_etc_t, cobbler_etc_t)
+ list_dirs_pattern($1, cobbler_etc_t, cobbler_etc_t)
files_search_etc($1)
')
@@ -27596,204 +24535,68 @@ index 0258b48..8535cc6 100644
+list_dirs_pattern(cobblerd_t, httpd_cobbler_content_t, httpd_cobbler_content_t)
manage_dirs_pattern(cobblerd_t, httpd_cobbler_content_rw_t, httpd_cobbler_content_rw_t)
manage_files_pattern(cobblerd_t, httpd_cobbler_content_rw_t, httpd_cobbler_content_rw_t)
-diff --git a/policy/modules/services/colord.fc b/policy/modules/services/colord.fc
-new file mode 100644
-index 0000000..0a83e88
---- /dev/null
-+++ b/policy/modules/services/colord.fc
-@@ -0,0 +1,5 @@
-+
-+/usr/libexec/colord -- gen_context(system_u:object_r:colord_exec_t,s0)
-+
-+/var/lib/color(/.*)? gen_context(system_u:object_r:colord_var_lib_t,s0)
-+/var/lib/colord(/.*)? gen_context(system_u:object_r:colord_var_lib_t,s0)
-diff --git a/policy/modules/services/colord.if b/policy/modules/services/colord.if
-new file mode 100644
-index 0000000..939d76e
---- /dev/null
-+++ b/policy/modules/services/colord.if
-@@ -0,0 +1,60 @@
-+
-+## <summary>policy for colord</summary>
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run colord.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`colord_domtrans',`
-+ gen_require(`
-+ type colord_t, colord_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, colord_exec_t, colord_t)
-+')
-+
-+########################################
-+## <summary>
-+## Send and receive messages from
-+## colord over dbus.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`colord_dbus_chat',`
-+ gen_require(`
-+ type colord_t;
-+ class dbus send_msg;
-+ ')
-+
-+ allow $1 colord_t:dbus send_msg;
-+ allow colord_t $1:dbus send_msg;
-+')
-+
-+######################################
-+## <summary>
-+## Read colord lib files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`colord_read_lib_files',`
-+ gen_require(`
-+ type colord_var_lib_t;
-+ ')
-+
-+ files_search_var_lib($1)
-+ read_files_pattern($1, colord_var_lib_t, colord_var_lib_t)
-+')
diff --git a/policy/modules/services/colord.te b/policy/modules/services/colord.te
-new file mode 100644
-index 0000000..08d2de0
---- /dev/null
+index 74505cc..101c266 100644
+--- a/policy/modules/services/colord.te
+++ b/policy/modules/services/colord.te
-@@ -0,0 +1,115 @@
-+policy_module(colord,1.0.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+type colord_t;
-+type colord_exec_t;
-+dbus_system_domain(colord_t, colord_exec_t)
-+
-+type colord_var_lib_t;
-+files_type(colord_var_lib_t)
-+
-+type colord_tmp_t;
-+files_tmp_file(colord_tmp_t)
-+
-+type colord_tmpfs_t;
-+files_tmpfs_file(colord_tmpfs_t)
-+
-+########################################
-+#
-+# colord local policy
-+#
-+allow colord_t self:capability { dac_read_search dac_override };
-+allow colord_t self:process signal;
-+allow colord_t self:fifo_file rw_fifo_file_perms;
-+allow colord_t self:netlink_kobject_uevent_socket create_socket_perms;
-+allow colord_t self:udp_socket create_socket_perms;
-+allow colord_t self:unix_dgram_socket create_socket_perms;
-+
-+manage_dirs_pattern(colord_t, colord_tmp_t, colord_tmp_t)
-+manage_files_pattern(colord_t, colord_tmp_t, colord_tmp_t)
-+files_tmp_filetrans(colord_t, colord_tmp_t, { file dir })
-+
-+manage_dirs_pattern(colord_t, colord_tmpfs_t, colord_tmpfs_t)
-+manage_files_pattern(colord_t, colord_tmpfs_t, colord_tmpfs_t)
-+fs_tmpfs_filetrans(colord_t, colord_tmpfs_t, { dir file })
-+
-+manage_dirs_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
-+manage_files_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
-+files_var_lib_filetrans(colord_t, colord_var_lib_t, { file dir })
-+
-+kernel_getattr_proc_files(colord_t)
-+kernel_read_device_sysctls(colord_t)
+@@ -43,6 +43,7 @@ files_var_lib_filetrans(colord_t, colord_var_lib_t, { file dir })
+
+ kernel_getattr_proc_files(colord_t)
+ kernel_read_device_sysctls(colord_t)
+kernel_request_load_module(colord_t)
-+
-+corenet_udp_bind_generic_node(colord_t)
-+corenet_udp_bind_ipp_port(colord_t)
-+corenet_tcp_connect_ipp_port(colord_t)
-+
+
+ corenet_all_recvfrom_unlabeled(colord_t)
+ corenet_all_recvfrom_netlabel(colord_t)
+@@ -50,6 +51,8 @@ corenet_udp_bind_generic_node(colord_t)
+ corenet_udp_bind_ipp_port(colord_t)
+ corenet_tcp_connect_ipp_port(colord_t)
+
+dev_read_raw_memory(colord_t)
+dev_write_raw_memory(colord_t)
-+dev_read_video_dev(colord_t)
-+dev_write_video_dev(colord_t)
-+dev_rw_printer(colord_t)
-+dev_read_rand(colord_t)
-+dev_read_sysfs(colord_t)
-+dev_read_urand(colord_t)
-+dev_list_sysfs(colord_t)
-+dev_rw_generic_usb_dev(colord_t)
-+
-+domain_use_interactive_fds(colord_t)
-+
-+files_list_mnt(colord_t)
-+files_read_etc_files(colord_t)
-+files_read_usr_files(colord_t)
-+
+ dev_read_video_dev(colord_t)
+ dev_write_video_dev(colord_t)
+ dev_rw_printer(colord_t)
+@@ -65,8 +68,16 @@ files_list_mnt(colord_t)
+ files_read_etc_files(colord_t)
+ files_read_usr_files(colord_t)
+
+fs_search_all(colord_t)
+fs_getattr_noxattr_fs(colord_t)
+fs_list_noxattr_fs(colord_t)
-+fs_read_noxattr_fs_files(colord_t)
-+
+ fs_read_noxattr_fs_files(colord_t)
+
+storage_getattr_fixed_disk_dev(colord_t)
+storage_getattr_removable_dev(colord_t)
+storage_read_scsi_generic(colord_t)
+storage_write_scsi_generic(colord_t)
+
-+logging_send_syslog_msg(colord_t)
-+
-+miscfiles_read_localization(colord_t)
-+
-+sysnet_dns_name_resolve(colord_t)
-+
-+tunable_policy(`use_nfs_home_dirs',`
+ logging_send_syslog_msg(colord_t)
+
+ miscfiles_read_localization(colord_t)
+@@ -74,10 +85,12 @@ miscfiles_read_localization(colord_t)
+ sysnet_dns_name_resolve(colord_t)
+
+ tunable_policy(`use_nfs_home_dirs',`
+ fs_getattr_nfs(colord_t)
-+ fs_read_nfs_files(colord_t)
-+')
-+
-+tunable_policy(`use_samba_home_dirs',`
+ fs_read_nfs_files(colord_t)
+ ')
+
+ tunable_policy(`use_samba_home_dirs',`
+ fs_getattr_cifs(colord_t)
-+ fs_read_cifs_files(colord_t)
-+')
-+
-+optional_policy(`
-+ cups_read_config(colord_t)
-+ cups_read_rw_config(colord_t)
-+ cups_stream_connect(colord_t)
-+ cups_dbus_chat(colord_t)
-+')
-+
-+optional_policy(`
+ fs_read_cifs_files(colord_t)
+ ')
+
+@@ -89,6 +102,10 @@ optional_policy(`
+ ')
+
+ optional_policy(`
+ gnome_read_home_icc_data_content(colord_t)
+')
+
+optional_policy(`
-+ policykit_dbus_chat(colord_t)
-+ policykit_domtrans_auth(colord_t)
-+ policykit_read_lib(colord_t)
-+ policykit_read_reload(colord_t)
-+')
-+
-+optional_policy(`
-+ udev_read_db(colord_t)
-+')
+ policykit_dbus_chat(colord_t)
+ policykit_domtrans_auth(colord_t)
+ policykit_read_lib(colord_t)
diff --git a/policy/modules/services/consolekit.if b/policy/modules/services/consolekit.if
index fd15dfe..0716ee4 100644
--- a/policy/modules/services/consolekit.if
@@ -28006,7 +24809,7 @@ index 5220c9d..a2e6830 100644
## <summary>
## Allow the specified domain to read corosync's log files.
diff --git a/policy/modules/services/corosync.te b/policy/modules/services/corosync.te
-index 7d2cf85..92b621a 100644
+index 04969e5..4e1d434 100644
--- a/policy/modules/services/corosync.te
+++ b/policy/modules/services/corosync.te
@@ -32,8 +32,8 @@ files_pid_file(corosync_var_run_t)
@@ -28092,14 +24895,14 @@ index 7d2cf85..92b621a 100644
optional_policy(`
diff --git a/policy/modules/services/courier.fc b/policy/modules/services/courier.fc
-index f1bf79a..7be46b4 100644
+index 01d31f1..a390070 100644
--- a/policy/modules/services/courier.fc
+++ b/policy/modules/services/courier.fc
@@ -6,15 +6,15 @@
/usr/sbin/courierldapaliasd -- gen_context(system_u:object_r:courier_exec_t,s0)
/usr/sbin/couriertcpd -- gen_context(system_u:object_r:courier_tcpd_exec_t,s0)
--/usr/lib(64)?/courier/authlib/.* -- gen_context(system_u:object_r:courier_authdaemon_exec_t,s0)
+-/usr/lib(64)?/courier/(courier-)?authlib/.* -- gen_context(system_u:object_r:courier_authdaemon_exec_t,s0)
-/usr/lib(64)?/courier/courier/.* -- gen_context(system_u:object_r:courier_exec_t,s0)
-/usr/lib(64)?/courier/courier/courierpop.* -- gen_context(system_u:object_r:courier_pop_exec_t,s0)
-/usr/lib(64)?/courier/courier/imaplogin -- gen_context(system_u:object_r:courier_pop_exec_t,s0)
@@ -28118,8 +24921,8 @@ index f1bf79a..7be46b4 100644
+/usr/lib/courier/rootcerts(/.*)? gen_context(system_u:object_r:courier_etc_t,s0)
+/usr/lib/courier/sqwebmail/cleancache\.pl -- gen_context(system_u:object_r:sqwebmail_cron_exec_t,s0)
- /var/lib/courier(/.*)? -- gen_context(system_u:object_r:courier_var_lib_t,s0)
-
+ ifdef(`distro_gentoo',`
+ /usr/lib(64)?/courier-imap/couriertcpd -- gen_context(system_u:object_r:courier_tcpd_exec_t,s0)
diff --git a/policy/modules/services/courier.if b/policy/modules/services/courier.if
index 9971337..f081899 100644
--- a/policy/modules/services/courier.if
@@ -28157,10 +24960,10 @@ index 9971337..f081899 100644
')
diff --git a/policy/modules/services/courier.te b/policy/modules/services/courier.te
-index 2802dbb..5d323df 100644
+index 838dec7..452741c 100644
--- a/policy/modules/services/courier.te
+++ b/policy/modules/services/courier.te
-@@ -93,7 +93,7 @@ allow courier_pop_t courier_authdaemon_t:process sigchld;
+@@ -95,7 +95,7 @@ allow courier_pop_t courier_authdaemon_t:process sigchld;
allow courier_pop_t courier_tcpd_t:{ unix_stream_socket tcp_socket } rw_stream_socket_perms;
# inherits file handle - should it?
@@ -29359,18 +26162,21 @@ index 9d44538..7e9057e 100644
#
interface(`cyphesis_domtrans',`
diff --git a/policy/modules/services/cyrus.fc b/policy/modules/services/cyrus.fc
-index 445d93d..a5bce33 100644
+index 25546bc..4def4f7 100644
--- a/policy/modules/services/cyrus.fc
+++ b/policy/modules/services/cyrus.fc
-@@ -1,5 +1,5 @@
+@@ -1,7 +1,7 @@
/etc/rc\.d/init\.d/cyrus -- gen_context(system_u:object_r:cyrus_initrc_exec_t,s0)
+-/usr/lib(64)?/cyrus/master -- gen_context(system_u:object_r:cyrus_exec_t,s0)
-/usr/lib(64)?/cyrus-imapd/cyrus-master -- gen_context(system_u:object_r:cyrus_exec_t,s0)
+/usr/lib/cyrus-imapd/cyrus-master -- gen_context(system_u:object_r:cyrus_exec_t,s0)
++/usr/lib/cyrus/master -- gen_context(system_u:object_r:cyrus_exec_t,s0)
+ /var/imap(/.*)? gen_context(system_u:object_r:cyrus_var_lib_t,s0)
/var/lib/imap(/.*)? gen_context(system_u:object_r:cyrus_var_lib_t,s0)
diff --git a/policy/modules/services/cyrus.te b/policy/modules/services/cyrus.te
-index e182bf4..aab657c 100644
+index a01be9d..f82c32f 100644
--- a/policy/modules/services/cyrus.te
+++ b/policy/modules/services/cyrus.te
@@ -26,7 +26,7 @@ files_pid_file(cyrus_var_run_t)
@@ -29427,7 +26233,7 @@ index 81eba14..d0ab56c 100644
/usr/bin/dbus-daemon(-1)? -- gen_context(system_u:object_r:dbusd_exec_t,s0)
/usr/libexec/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
diff --git a/policy/modules/services/dbus.if b/policy/modules/services/dbus.if
-index 0d5711c..5a0ca9f 100644
+index 1a1becd..5a0ca9f 100644
--- a/policy/modules/services/dbus.if
+++ b/policy/modules/services/dbus.if
@@ -41,9 +41,9 @@ interface(`dbus_stub',`
@@ -29532,7 +26338,7 @@ index 0d5711c..5a0ca9f 100644
xserver_use_xdm_fds($1_dbusd_t)
xserver_rw_xdm_pipes($1_dbusd_t)
')
-@@ -181,10 +191,12 @@ interface(`dbus_system_bus_client',`
+@@ -181,11 +191,12 @@ interface(`dbus_system_bus_client',`
type system_dbusd_t, system_dbusd_t;
type system_dbusd_var_run_t, system_dbusd_var_lib_t;
class dbus send_msg;
@@ -29541,11 +26347,12 @@ index 0d5711c..5a0ca9f 100644
# SE-DBus specific permissions
allow $1 { system_dbusd_t self }:dbus send_msg;
+- allow system_dbusd_t $1:dbus send_msg;
+ allow { system_dbusd_t dbusd_unconfined } $1:dbus send_msg;
read_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
files_search_var_lib($1)
-@@ -197,6 +209,34 @@ interface(`dbus_system_bus_client',`
+@@ -198,6 +209,34 @@ interface(`dbus_system_bus_client',`
#######################################
## <summary>
@@ -29580,7 +26387,7 @@ index 0d5711c..5a0ca9f 100644
## Template for creating connections to
## a user DBUS.
## </summary>
-@@ -217,6 +257,8 @@ interface(`dbus_session_bus_client',`
+@@ -218,6 +257,8 @@ interface(`dbus_session_bus_client',`
# For connecting to the bus
allow $1 session_bus_type:unix_stream_socket connectto;
@@ -29589,7 +26396,7 @@ index 0d5711c..5a0ca9f 100644
')
########################################
-@@ -335,13 +377,13 @@ interface(`dbus_connect_session_bus',`
+@@ -336,13 +377,13 @@ interface(`dbus_connect_session_bus',`
#
interface(`dbus_session_domain',`
gen_require(`
@@ -29607,7 +26414,7 @@ index 0d5711c..5a0ca9f 100644
')
########################################
-@@ -431,14 +473,33 @@ interface(`dbus_system_domain',`
+@@ -432,14 +473,33 @@ interface(`dbus_system_domain',`
domtrans_pattern(system_dbusd_t, $2, $1)
@@ -29642,7 +26449,7 @@ index 0d5711c..5a0ca9f 100644
dontaudit $1 system_dbusd_t:netlink_selinux_socket { read write };
')
')
-@@ -463,26 +524,25 @@ interface(`dbus_use_system_bus_fds',`
+@@ -464,26 +524,25 @@ interface(`dbus_use_system_bus_fds',`
########################################
## <summary>
@@ -29675,7 +26482,7 @@ index 0d5711c..5a0ca9f 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -490,10 +550,12 @@ interface(`dbus_dontaudit_system_bus_rw_tcp_sockets',`
+@@ -491,10 +550,12 @@ interface(`dbus_dontaudit_system_bus_rw_tcp_sockets',`
## </summary>
## </param>
#
@@ -29692,7 +26499,7 @@ index 0d5711c..5a0ca9f 100644
')
+
diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te
-index 86d09b4..e54a616 100644
+index 1bff6ee..ace3e22 100644
--- a/policy/modules/services/dbus.te
+++ b/policy/modules/services/dbus.te
@@ -36,6 +36,7 @@ files_type(system_dbusd_var_lib_t)
@@ -29746,7 +26553,7 @@ index 86d09b4..e54a616 100644
logging_send_audit_msgs(system_dbusd_t)
logging_send_syslog_msg(system_dbusd_t)
-@@ -141,10 +147,19 @@ optional_policy(`
+@@ -141,6 +147,19 @@ optional_policy(`
')
optional_policy(`
@@ -29755,10 +26562,10 @@ index 86d09b4..e54a616 100644
+')
+
+optional_policy(`
- cpufreqselector_dbus_chat(system_dbusd_t)
- ')
-
- optional_policy(`
++ cpufreqselector_dbus_chat(system_dbusd_t)
++')
++
++optional_policy(`
+ networkmanager_initrc_domtrans(system_dbusd_t)
+')
+
@@ -29766,7 +26573,7 @@ index 86d09b4..e54a616 100644
policykit_dbus_chat(system_dbusd_t)
policykit_domtrans_auth(system_dbusd_t)
policykit_search_lib(system_dbusd_t)
-@@ -162,5 +177,12 @@ optional_policy(`
+@@ -158,5 +177,12 @@ optional_policy(`
#
# Unconfined access to this module
#
@@ -31425,7 +28232,7 @@ index e1d7dc5..673f185 100644
admin_pattern($1, dovecot_var_run_t)
diff --git a/policy/modules/services/dovecot.te b/policy/modules/services/dovecot.te
-index cbe14e4..1d725ff 100644
+index acf6d4f..f4f2402 100644
--- a/policy/modules/services/dovecot.te
+++ b/policy/modules/services/dovecot.te
@@ -18,7 +18,7 @@ type dovecot_auth_tmp_t;
@@ -31483,16 +28290,15 @@ index cbe14e4..1d725ff 100644
kernel_read_kernel_sysctls(dovecot_t)
kernel_read_system_state(dovecot_t)
-@@ -110,6 +116,8 @@ corenet_tcp_sendrecv_all_ports(dovecot_t)
+@@ -110,6 +116,7 @@ corenet_tcp_sendrecv_all_ports(dovecot_t)
corenet_tcp_bind_generic_node(dovecot_t)
corenet_tcp_bind_mail_port(dovecot_t)
corenet_tcp_bind_pop_port(dovecot_t)
+corenet_tcp_bind_lmtp_port(dovecot_t)
-+corenet_tcp_bind_sieve_port(dovecot_t)
+ corenet_tcp_bind_sieve_port(dovecot_t)
corenet_tcp_connect_all_ports(dovecot_t)
corenet_tcp_connect_postgresql_port(dovecot_t)
- corenet_sendrecv_pop_server_packets(dovecot_t)
-@@ -159,6 +167,15 @@ optional_policy(`
+@@ -160,6 +167,15 @@ optional_policy(`
')
optional_policy(`
@@ -31508,7 +28314,7 @@ index cbe14e4..1d725ff 100644
postgresql_stream_connect(dovecot_t)
')
-@@ -179,7 +196,7 @@ optional_policy(`
+@@ -180,7 +196,7 @@ optional_policy(`
# dovecot auth local policy
#
@@ -31517,7 +28323,7 @@ index cbe14e4..1d725ff 100644
allow dovecot_auth_t self:process { signal_perms getcap setcap };
allow dovecot_auth_t self:fifo_file rw_fifo_file_perms;
allow dovecot_auth_t self:unix_dgram_socket create_socket_perms;
-@@ -189,6 +206,9 @@ allow dovecot_auth_t dovecot_t:unix_stream_socket { connectto rw_stream_socket_p
+@@ -190,6 +206,9 @@ allow dovecot_auth_t dovecot_t:unix_stream_socket { connectto rw_stream_socket_p
read_files_pattern(dovecot_auth_t, dovecot_passwd_t, dovecot_passwd_t)
@@ -31527,7 +28333,7 @@ index cbe14e4..1d725ff 100644
manage_dirs_pattern(dovecot_auth_t, dovecot_auth_tmp_t, dovecot_auth_tmp_t)
manage_files_pattern(dovecot_auth_t, dovecot_auth_tmp_t, dovecot_auth_tmp_t)
files_tmp_filetrans(dovecot_auth_t, dovecot_auth_tmp_t, { file dir })
-@@ -203,6 +223,7 @@ kernel_read_system_state(dovecot_auth_t)
+@@ -204,6 +223,7 @@ kernel_read_system_state(dovecot_auth_t)
logging_send_audit_msgs(dovecot_auth_t)
logging_send_syslog_msg(dovecot_auth_t)
@@ -31535,7 +28341,7 @@ index cbe14e4..1d725ff 100644
dev_read_urand(dovecot_auth_t)
auth_domtrans_chk_passwd(dovecot_auth_t)
-@@ -217,6 +238,8 @@ files_read_var_lib_files(dovecot_auth_t)
+@@ -218,6 +238,8 @@ files_read_var_lib_files(dovecot_auth_t)
files_search_tmp(dovecot_auth_t)
files_read_var_lib_files(dovecot_t)
@@ -31544,7 +28350,7 @@ index cbe14e4..1d725ff 100644
init_rw_utmp(dovecot_auth_t)
miscfiles_read_localization(dovecot_auth_t)
-@@ -235,6 +258,8 @@ optional_policy(`
+@@ -236,6 +258,8 @@ optional_policy(`
optional_policy(`
mysql_search_db(dovecot_auth_t)
mysql_stream_connect(dovecot_auth_t)
@@ -31553,7 +28359,7 @@ index cbe14e4..1d725ff 100644
')
optional_policy(`
-@@ -242,6 +267,8 @@ optional_policy(`
+@@ -243,6 +267,8 @@ optional_policy(`
')
optional_policy(`
@@ -31562,7 +28368,7 @@ index cbe14e4..1d725ff 100644
postfix_search_spool(dovecot_auth_t)
')
-@@ -249,23 +276,42 @@ optional_policy(`
+@@ -250,23 +276,42 @@ optional_policy(`
#
# dovecot deliver local policy
#
@@ -31607,7 +28413,7 @@ index cbe14e4..1d725ff 100644
miscfiles_read_localization(dovecot_deliver_t)
-@@ -301,5 +347,19 @@ tunable_policy(`use_samba_home_dirs',`
+@@ -302,5 +347,19 @@ tunable_policy(`use_samba_home_dirs',`
')
optional_policy(`
@@ -32866,7 +29672,7 @@ index 69dcd2a..a9a9116 100644
/var/log/xferreport.* -- gen_context(system_u:object_r:xferlog_t,s0)
+/usr/libexec/webmin/vsftpd/webalizer/xfer_log -- gen_context(system_u:object_r:xferlog_t,s0)
diff --git a/policy/modules/services/ftp.if b/policy/modules/services/ftp.if
-index bc27421..a65582e 100644
+index 9d3201b..21a7a73 100644
--- a/policy/modules/services/ftp.if
+++ b/policy/modules/services/ftp.if
@@ -1,5 +1,43 @@
@@ -34137,7 +30943,7 @@ index 2d0b4e1..e268ede 100644
')
')
diff --git a/policy/modules/services/hadoop.te b/policy/modules/services/hadoop.te
-index 9821a88..1367b08 100644
+index 7d3a469..5b1ec32 100644
--- a/policy/modules/services/hadoop.te
+++ b/policy/modules/services/hadoop.te
@@ -165,7 +165,7 @@ miscfiles_read_localization(hadoop_t)
@@ -36064,7 +32870,7 @@ index 771e04b..81d98b3 100644
manage_files_pattern($1_t, $1_var_run_t, $1_var_run_t)
files_pid_filetrans($1_t, $1_var_run_t, file)
diff --git a/policy/modules/services/likewise.te b/policy/modules/services/likewise.te
-index 3acbf1d..ed036d1 100644
+index 5037e06..18dc6e5 100644
--- a/policy/modules/services/likewise.te
+++ b/policy/modules/services/likewise.te
@@ -17,7 +17,7 @@ type likewise_var_lib_t;
@@ -36076,15 +32882,6 @@ index 3acbf1d..ed036d1 100644
type likewise_krb5_ad_t;
files_type(likewise_krb5_ad_t)
-@@ -137,7 +137,7 @@ selinux_validate_context(lsassd_t)
- seutil_read_config(lsassd_t)
- seutil_read_default_contexts(lsassd_t)
- seutil_read_file_contexts(lsassd_t)
--seutil_run_semanage(lsassd_t, lsassd_t)
-+seutil_run_semanage(lsassd_t, system_r)
-
- sysnet_use_ldap(lsassd_t)
- sysnet_read_config(lsassd_t)
@@ -205,7 +205,7 @@ stream_connect_pattern(lwsmd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_
# Likewise DC location service local policy
#
@@ -37192,6 +33989,51 @@ index 0000000..dca01cd
+miscfiles_read_localization(matahari_domain)
+
+sysnet_dns_name_resolve(matahari_domain)
+diff --git a/policy/modules/services/mediawiki.if b/policy/modules/services/mediawiki.if
+index 98d28b4..1c1d012 100644
+--- a/policy/modules/services/mediawiki.if
++++ b/policy/modules/services/mediawiki.if
+@@ -1 +1,40 @@
+ ## <summary>Mediawiki policy</summary>
++
++#######################################
++## <summary>
++## Allow the specified domain to read
++## mediawiki tmp files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`mediawiki_read_tmp_files',`
++ gen_require(`
++ type httpd_mediawiki_tmp_t;
++ ')
++
++ files_search_tmp($1)
++ read_files_pattern($1, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t)
++ read_lnk_files_pattern($1, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t)
++')
++
++#######################################
++## <summary>
++## Delete mediawiki tmp files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`mediawiki_delete_tmp_files',`
++ gen_require(`
++ type httpd_mediawiki_tmp_t;
++ ')
++
++ delete_files_pattern($1, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t)
++')
diff --git a/policy/modules/services/memcached.if b/policy/modules/services/memcached.if
index db4fd6f..5008a6c 100644
--- a/policy/modules/services/memcached.if
@@ -37972,399 +34814,24 @@ index 83f002c..ed69996 100644
corenet_tcp_connect_postgresql_port(httpd_mojomojo_script_t)
corenet_tcp_connect_mysqld_port(httpd_mojomojo_script_t)
corenet_tcp_connect_smtp_port(httpd_mojomojo_script_t)
-diff --git a/policy/modules/services/mpd.fc b/policy/modules/services/mpd.fc
-new file mode 100644
-index 0000000..564b22d
---- /dev/null
-+++ b/policy/modules/services/mpd.fc
-@@ -0,0 +1,10 @@
-+
-+/etc/mpd\.conf -- gen_context(system_u:object_r:mpd_etc_t,s0)
-+
-+/etc/rc\.d/init\.d/mpd -- gen_context(system_u:object_r:mpd_initrc_exec_t,s0)
-+
-+/usr/bin/mpd -- gen_context(system_u:object_r:mpd_exec_t,s0)
-+
-+/var/lib/mpd(/.*)? gen_context(system_u:object_r:mpd_var_lib_t,s0)
-+/var/lib/mpd/music(/.*)? gen_context(system_u:object_r:mpd_data_t,s0)
-+/var/lib/mpd/playlists(/.*)? gen_context(system_u:object_r:mpd_data_t,s0)
-diff --git a/policy/modules/services/mpd.if b/policy/modules/services/mpd.if
-new file mode 100644
-index 0000000..311aaed
---- /dev/null
-+++ b/policy/modules/services/mpd.if
-@@ -0,0 +1,267 @@
-+## <summary>policy for daemon for playing music</summary>
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run mpd.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`mpd_domtrans',`
-+ gen_require(`
-+ type mpd_t, mpd_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, mpd_exec_t, mpd_t)
-+')
-+
-+########################################
-+## <summary>
-+## Execute mpd server in the mpd domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`mpd_initrc_domtrans',`
-+ gen_require(`
-+ type mpd_initrc_exec_t;
-+ ')
-+
-+ init_labeled_script_domtrans($1, mpd_initrc_exec_t)
-+')
-+
-+#######################################
-+## <summary>
-+## Read mpd data files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`mpd_read_data_files',`
-+ gen_require(`
-+ type mpd_data_t;
-+ ')
-+
-+ mpd_search_lib($1)
-+ read_files_pattern($1, mpd_data_t, mpd_data_t)
-+')
-+
-+#######################################
-+## <summary>
-+## Read mpd tmpfs files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`mpd_read_tmpfs_files',`
-+ gen_require(`
-+ type mpd_tmpfs_t;
-+ ')
-+
-+ fs_search_tmpfs($1)
-+ read_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t)
-+')
-+
-+###################################
-+## <summary>
-+## Manage mpd tmpfs files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`mpd_manage_tmpfs_files',`
-+ gen_require(`
-+ type mpd_tmpfs_t;
-+ ')
-+
-+ fs_search_tmpfs($1)
-+ manage_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t)
-+ manage_lnk_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t)
-+')
-+
-+######################################
-+## <summary>
-+## Manage mpd data files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`mpd_manage_data_files',`
-+ gen_require(`
-+ type mpd_data_t;
-+ ')
-+
-+ mpd_search_lib($1)
-+ manage_files_pattern($1, mpd_data_t, mpd_data_t)
-+')
-+
-+########################################
-+## <summary>
-+## Search mpd lib directories.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`mpd_search_lib',`
-+ gen_require(`
-+ type mpd_var_lib_t;
-+ ')
-+
-+ allow $1 mpd_var_lib_t:dir search_dir_perms;
-+ files_search_var_lib($1)
-+')
-+
-+########################################
-+## <summary>
-+## Read mpd lib files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`mpd_read_lib_files',`
-+ gen_require(`
-+ type mpd_var_lib_t;
-+ ')
-+
-+ files_search_var_lib($1)
-+ read_files_pattern($1, mpd_var_lib_t, mpd_var_lib_t)
-+')
-+
-+########################################
-+## <summary>
-+## Create, read, write, and delete
-+## mpd lib files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`mpd_manage_lib_files',`
-+ gen_require(`
-+ type mpd_var_lib_t;
-+ ')
-+
-+ files_search_var_lib($1)
-+ manage_files_pattern($1, mpd_var_lib_t, mpd_var_lib_t)
-+')
-+
-+#######################################
-+## <summary>
-+## Create an object in the root directory, with a private
-+## type using a type transition.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <param name="private type">
-+## <summary>
-+## The type of the object to be created.
-+## </summary>
-+## </param>
-+## <param name="object">
-+## <summary>
-+## The object class of the object being created.
-+## </summary>
-+## </param>
-+#
-+interface(`mpd_var_lib_filetrans',`
-+ gen_require(`
-+ type mpd_var_lib_t;
-+ ')
-+
-+ files_search_var_lib($1)
-+ filetrans_pattern($1, mpd_var_lib_t, $2, $3)
-+')
-+
-+########################################
-+## <summary>
-+## Manage mpd lib dirs files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`mpd_manage_lib_dirs',`
-+ gen_require(`
-+ type mpd_var_lib_t;
-+ ')
-+
-+ files_search_var_lib($1)
-+ manage_dirs_pattern($1, mpd_var_lib_t, mpd_var_lib_t)
-+')
-+
-+########################################
-+## <summary>
-+## All of the rules required to administrate
-+## an mpd environment
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <param name="role">
-+## <summary>
-+## Role allowed access.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`mpd_admin',`
-+ gen_require(`
-+ type mpd_t, mpd_initrc_exec_t, mpd_etc_t;
-+ type mpd_data_t, mpd_log_t, mpd_var_lib_t;
-+ type mpd_tmpfs_t;
-+ ')
-+
-+ allow $1 mpd_t:process { ptrace signal_perms };
-+ ps_process_pattern($1, mpd_t)
-+
-+ mpd_initrc_domtrans($1)
-+ domain_system_change_exemption($1)
-+ role_transition $2 mpd_initrc_exec_t system_r;
-+ allow $2 system_r;
-+
-+ admin_pattern($1, mpd_etc_t)
-+ files_list_etc($1)
-+
-+ files_list_var_lib($1)
-+ admin_pattern($1, mpd_var_lib_t)
-+
-+ admin_pattern($1, mpd_data_t)
-+
-+ admin_pattern($1, mpd_log_t)
-+
-+ fs_list_tmpfs($1)
-+ admin_pattern($1, mpd_tmpfs_t)
-+')
diff --git a/policy/modules/services/mpd.te b/policy/modules/services/mpd.te
-new file mode 100644
-index 0000000..0b9257a
---- /dev/null
+index 7f68872..e4ac35e 100644
+--- a/policy/modules/services/mpd.te
+++ b/policy/modules/services/mpd.te
-@@ -0,0 +1,141 @@
-+policy_module(mpd, 1.0.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+type mpd_t;
-+type mpd_exec_t;
-+init_daemon_domain(mpd_t, mpd_exec_t)
-+
-+type mpd_initrc_exec_t;
-+init_script_file(mpd_initrc_exec_t)
-+
-+type mpd_etc_t;
-+files_config_file(mpd_etc_t)
-+
-+# type for music content
-+type mpd_data_t;
-+files_type(mpd_data_t)
-+
-+type mpd_log_t;
-+logging_log_file(mpd_log_t)
-+
-+type mpd_tmp_t;
-+files_tmp_file(mpd_tmp_t)
-+
-+type mpd_tmpfs_t;
-+files_tmpfs_file(mpd_tmpfs_t)
-+
-+type mpd_var_lib_t;
-+files_type(mpd_var_lib_t)
-+
-+########################################
-+#
-+# mpd local policy
-+#
-+
-+#cjp: dac_override bug in mpd relating to mpd.log file
-+allow mpd_t self:capability { dac_override kill setgid setuid };
-+allow mpd_t self:process { getsched setsched setrlimit signal signull };
-+allow mpd_t self:fifo_file rw_fifo_file_perms;
-+allow mpd_t self:unix_stream_socket { connectto create_stream_socket_perms };
-+allow mpd_t self:tcp_socket create_stream_socket_perms;
-+allow mpd_t self:netlink_kobject_uevent_socket create_socket_perms;
+@@ -44,6 +44,9 @@ allow mpd_t self:unix_stream_socket { connectto create_stream_socket_perms };
+ allow mpd_t self:unix_dgram_socket { create_socket_perms sendto };
+ allow mpd_t self:tcp_socket create_stream_socket_perms;
+ allow mpd_t self:netlink_kobject_uevent_socket create_socket_perms;
+allow mpd_t self:unix_dgram_socket { create_socket_perms sendto };
+
+read_files_pattern(mpd_t, mpd_etc_t, mpd_etc_t)
-+
-+manage_dirs_pattern(mpd_t, mpd_data_t, mpd_data_t)
-+manage_files_pattern(mpd_t, mpd_data_t, mpd_data_t)
-+manage_lnk_files_pattern(mpd_t, mpd_data_t, mpd_data_t)
-+
-+manage_dirs_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t)
-+manage_files_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t)
-+manage_sock_files_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t)
-+files_tmp_filetrans(mpd_t, mpd_tmp_t, { dir file sock_file })
-+
-+manage_files_pattern(mpd_t, mpd_tmpfs_t, mpd_tmpfs_t)
-+manage_dirs_pattern(mpd_t, mpd_tmpfs_t, mpd_tmpfs_t)
-+fs_tmpfs_filetrans(mpd_t, mpd_tmpfs_t, file )
-+
-+manage_dirs_pattern(mpd_t, mpd_var_lib_t, mpd_var_lib_t)
-+manage_files_pattern(mpd_t, mpd_var_lib_t, mpd_var_lib_t)
-+manage_lnk_files_pattern(mpd_t, mpd_var_lib_t, mpd_var_lib_t)
-+files_var_lib_filetrans(mpd_t, mpd_var_lib_t, { dir file lnk_file })
-+
-+# needed by pulseaudio
-+kernel_getattr_proc(mpd_t)
-+kernel_read_system_state(mpd_t)
-+kernel_read_kernel_sysctls(mpd_t)
-+
-+corecmd_exec_bin(mpd_t)
-+
-+corenet_sendrecv_pulseaudio_client_packets(mpd_t)
-+corenet_tcp_connect_http_port(mpd_t)
-+corenet_tcp_connect_http_cache_port(mpd_t)
-+corenet_tcp_connect_pulseaudio_port(mpd_t)
-+corenet_tcp_connect_soundd_port(mpd_t)
-+corenet_tcp_bind_mpd_port(mpd_t)
-+corenet_tcp_bind_soundd_port(mpd_t)
-+
-+dev_read_sound(mpd_t)
-+dev_write_sound(mpd_t)
-+dev_read_sysfs(mpd_t)
-+
-+files_read_usr_files(mpd_t)
-+
-+fs_getattr_tmpfs(mpd_t)
-+fs_list_inotifyfs(mpd_t)
-+fs_rw_anon_inodefs_files(mpd_t)
-+
-+auth_use_nsswitch(mpd_t)
-+
-+logging_send_syslog_msg(mpd_t)
-+
-+miscfiles_read_localization(mpd_t)
-+
+
+ manage_dirs_pattern(mpd_t, mpd_data_t, mpd_data_t)
+ manage_files_pattern(mpd_t, mpd_data_t, mpd_data_t)
+@@ -103,6 +106,19 @@ logging_send_syslog_msg(mpd_t)
+
+ miscfiles_read_localization(mpd_t)
+
+userdom_read_home_audio_files(mpd_t)
+userdom_read_user_tmpfs_files(mpd_t)
+
@@ -38378,31 +34845,19 @@ index 0000000..0b9257a
+ fs_read_nfs_symlinks(mpd_t)
+')
+
-+optional_policy(`
-+ alsa_read_rw_config(mpd_t)
-+')
-+
-+optional_policy(`
-+ consolekit_dbus_chat(mpd_t)
-+')
-+
-+optional_policy(`
-+ dbus_system_bus_client(mpd_t)
-+')
-+
-+optional_policy(`
-+ pulseaudio_exec(mpd_t)
-+ pulseaudio_stream_connect(mpd_t)
-+ pulseaudio_signull(mpd_t)
-+')
-+
-+optional_policy(`
+ optional_policy(`
+ alsa_read_rw_config(mpd_t)
+ ')
+@@ -122,5 +138,14 @@ optional_policy(`
+ ')
+
+ optional_policy(`
+ rtkit_daemon_dontaudit_dbus_chat(mpd_t)
+')
+
+optional_policy(`
-+ udev_read_db(mpd_t)
-+')
+ udev_read_db(mpd_t)
+ ')
+
+optional_policy(`
+ xserver_dontaudit_stream_connect(mpd_t)
@@ -38819,7 +35274,7 @@ index 343cee3..5e792cc 100644
+ mta_filetrans_admin_home_content($1)
+')
diff --git a/policy/modules/services/mta.te b/policy/modules/services/mta.te
-index 64268e4..5f0c71d 100644
+index 64268e4..dbddbef 100644
--- a/policy/modules/services/mta.te
+++ b/policy/modules/services/mta.te
@@ -20,8 +20,8 @@ files_type(etc_aliases_t)
@@ -38895,8 +35350,8 @@ index 64268e4..5f0c71d 100644
')
optional_policy(`
-+ bugzilla_search_dirs(system_mail_t)
-+ bugzilla_dontaudit_rw_script_stream_sockets(system_mail_t)
++ bugzilla_search_content(system_mail_t)
++ bugzilla_dontaudit_rw_stream_sockets(system_mail_t)
+')
+
+optional_policy(`
@@ -41296,181 +37751,6 @@ index b246bdd..07baada 100644
files_read_etc_files(pads_t)
files_search_spool(pads_t)
-diff --git a/policy/modules/services/passenger.fc b/policy/modules/services/passenger.fc
-new file mode 100644
-index 0000000..498c07f
---- /dev/null
-+++ b/policy/modules/services/passenger.fc
-@@ -0,0 +1,16 @@
-+
-+/usr/lib/ruby/gems/.*/passenger-.*/ext/apache2/ApplicationPoolServerExecutable -- gen_context(system_u:object_r:passenger_exec_t,s0)
-+
-+/usr/lib/ruby/gems/.*/passenger-.*/agents/PassengerWatchdog -- gen_context(system_u:object_r:passenger_exec_t,s0)
-+
-+/usr/lib/ruby/gems/.*/passenger-.*/agents/PassengerLoggingAgent -- gen_context(system_u:object_r:passenger_exec_t,s0)
-+
-+/usr/lib/ruby/gems/.*/passenger-.*/agents/apache2/PassengerHelperAgent -- gen_context(system_u:object_r:passenger_exec_t,s0)
-+
-+
-+/var/log/passenger(/.*)? gen_context(system_u:object_r:passenger_log_t,s0)
-+/var/log/passenger.* -- gen_context(system_u:object_r:passenger_log_t,s0)
-+
-+/var/lib/passenger(/.*)? gen_context(system_u:object_r:passenger_var_lib_t,s0)
-+
-+/var/run/passenger(/.*)? gen_context(system_u:object_r:passenger_var_run_t,s0)
-diff --git a/policy/modules/services/passenger.if b/policy/modules/services/passenger.if
-new file mode 100644
-index 0000000..9ef0492
---- /dev/null
-+++ b/policy/modules/services/passenger.if
-@@ -0,0 +1,67 @@
-+## <summary>Passenger policy</summary>
-+
-+######################################
-+## <summary>
-+## Execute passenger in the passenger domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`passenger_domtrans',`
-+ gen_require(`
-+ type passenger_t, passenger_exec_t;
-+ ')
-+
-+ allow $1 self:capability { fowner fsetid };
-+
-+ allow $1 passenger_t:process signal;
-+
-+ domtrans_pattern($1, passenger_exec_t, passenger_t)
-+ allow $1 passenger_t:unix_stream_socket { read write connectto shutdown };
-+ allow passenger_t $1:unix_stream_socket { read write };
-+')
-+
-+######################################
-+## <summary>
-+## Manage passenger var_run content.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`passenger_manage_pid_content',`
-+ gen_require(`
-+ type passenger_var_run_t;
-+ ')
-+
-+ files_search_pids($1)
-+ manage_dirs_pattern($1, passenger_var_run_t, passenger_var_run_t)
-+ manage_files_pattern($1, passenger_var_run_t, passenger_var_run_t)
-+ manage_fifo_files_pattern($1, passenger_var_run_t, passenger_var_run_t)
-+ manage_sock_files_pattern($1, passenger_var_run_t, passenger_var_run_t)
-+')
-+
-+########################################
-+## <summary>
-+## Read passenger lib files
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`passenger_read_lib_files',`
-+ gen_require(`
-+ type passenger_var_lib_t;
-+ ')
-+
-+ files_search_var_lib($1)
-+ read_files_pattern($1, passenger_var_lib_t, passenger_var_lib_t)
-+ read_lnk_files_pattern($1, passenger_var_lib_t, passenger_var_lib_t)
-+')
-diff --git a/policy/modules/services/passenger.te b/policy/modules/services/passenger.te
-new file mode 100644
-index 0000000..d2cc57b
---- /dev/null
-+++ b/policy/modules/services/passenger.te
-@@ -0,0 +1,74 @@
-+policy_module(passenger, 1.0.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+type passenger_t;
-+type passenger_exec_t;
-+domain_type(passenger_t)
-+domain_entry_file(passenger_t, passenger_exec_t)
-+role system_r types passenger_t;
-+
-+type passenger_tmp_t;
-+files_tmp_file(passenger_tmp_t)
-+
-+type passenger_log_t;
-+logging_log_file(passenger_log_t)
-+
-+type passenger_var_lib_t;
-+files_type(passenger_var_lib_t)
-+
-+type passenger_var_run_t;
-+files_pid_file(passenger_var_run_t)
-+
-+########################################
-+#
-+# passenger local policy
-+#
-+
-+allow passenger_t self:capability { chown dac_override fsetid fowner kill setuid setgid sys_nice };
-+allow passenger_t self:process { setpgid setsched sigkill signal };
-+
-+allow passenger_t self:fifo_file rw_fifo_file_perms;
-+allow passenger_t self:unix_stream_socket { create_stream_socket_perms connectto };
-+
-+manage_dirs_pattern(passenger_t, passenger_log_t, passenger_log_t)
-+manage_files_pattern(passenger_t, passenger_log_t, passenger_log_t)
-+logging_log_filetrans(passenger_t, passenger_log_t, file)
-+
-+files_search_var_lib(passenger_t)
-+manage_dirs_pattern(passenger_t, passenger_var_lib_t, passenger_var_lib_t)
-+manage_files_pattern(passenger_t, passenger_var_lib_t, passenger_var_lib_t)
-+
-+manage_dirs_pattern(passenger_t, passenger_var_run_t, passenger_var_run_t)
-+manage_files_pattern(passenger_t, passenger_var_run_t, passenger_var_run_t)
-+manage_fifo_files_pattern(passenger_t, passenger_var_run_t, passenger_var_run_t)
-+manage_sock_files_pattern(passenger_t, passenger_var_run_t, passenger_var_run_t)
-+files_pid_filetrans(passenger_t, passenger_var_run_t, { file dir sock_file })
-+
-+can_exec(passenger_t, passenger_exec_t)
-+
-+kernel_read_system_state(passenger_t)
-+kernel_read_kernel_sysctls(passenger_t)
-+
-+corenet_tcp_connect_http_port(passenger_t)
-+
-+corecmd_exec_bin(passenger_t)
-+corecmd_exec_shell(passenger_t)
-+
-+dev_read_urand(passenger_t)
-+
-+files_read_etc_files(passenger_t)
-+
-+auth_use_nsswitch(passenger_t)
-+
-+miscfiles_read_localization(passenger_t)
-+
-+userdom_dontaudit_use_user_terminals(passenger_t)
-+
-+optional_policy(`
-+ apache_append_log(passenger_t)
-+ apache_read_sys_content(passenger_t)
-+')
diff --git a/policy/modules/services/pcscd.if b/policy/modules/services/pcscd.if
index 1c2a091..ea5ae69 100644
--- a/policy/modules/services/pcscd.if
@@ -42927,7 +39207,7 @@ index 69c331e..0555635 100644
auth_rw_login_records(portslave_t)
diff --git a/policy/modules/services/postfix.fc b/policy/modules/services/postfix.fc
-index 55e62d2..f2674e8 100644
+index a3e85c9..cb05623 100644
--- a/policy/modules/services/postfix.fc
+++ b/policy/modules/services/postfix.fc
@@ -1,5 +1,6 @@
@@ -42938,20 +39218,45 @@ index 55e62d2..f2674e8 100644
ifdef(`distro_redhat', `
/usr/libexec/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
/usr/libexec/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
-@@ -29,12 +30,10 @@ ifdef(`distro_redhat', `
- /usr/lib/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
- /usr/lib/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
- /usr/lib/postfix/pipe -- gen_context(system_u:object_r:postfix_pipe_exec_t,s0)
--/usr/lib/postfix/virtual -- gen_context(system_u:object_r:postfix_virtual_exec_t,s0)
+@@ -16,22 +17,24 @@ ifdef(`distro_redhat', `
+ /usr/libexec/postfix/pipe -- gen_context(system_u:object_r:postfix_pipe_exec_t,s0)
+ /usr/libexec/postfix/virtual -- gen_context(system_u:object_r:postfix_virtual_exec_t,s0)
+ ', `
+-/usr/lib(64)?/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
+-/usr/lib(64)?/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
+-/usr/lib(64)?/postfix/local -- gen_context(system_u:object_r:postfix_local_exec_t,s0)
+-/usr/lib(64)?/postfix/master -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
+-/usr/lib(64)?/postfix/pickup -- gen_context(system_u:object_r:postfix_pickup_exec_t,s0)
+-/usr/lib(64)?/postfix/(n)?qmgr -- gen_context(system_u:object_r:postfix_qmgr_exec_t,s0)
+-/usr/lib(64)?/postfix/smtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
+-/usr/lib(64)?/postfix/lmtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
+-/usr/lib(64)?/postfix/scache -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
+-/usr/lib(64)?/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
+-/usr/lib(64)?/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
+-/usr/lib(64)?/postfix/pipe -- gen_context(system_u:object_r:postfix_pipe_exec_t,s0)
+-/usr/lib(64)?/postfix/virtual -- gen_context(system_u:object_r:postfix_virtual_exec_t,s0)
++/usr/lib/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
++/usr/lib/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
++/usr/lib/postfix/local -- gen_context(system_u:object_r:postfix_local_exec_t,s0)
++/usr/lib/postfix/master -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
++/usr/lib/postfix/pickup -- gen_context(system_u:object_r:postfix_pickup_exec_t,s0)
++/usr/lib/postfix/(n)?qmgr -- gen_context(system_u:object_r:postfix_qmgr_exec_t,s0)
++/usr/lib/postfix/showq -- gen_context(system_u:object_r:postfix_showq_exec_t,s0)
++/usr/lib/postfix/smtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
++/usr/lib/postfix/lmtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
++/usr/lib/postfix/scache -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
++/usr/lib/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
++/usr/lib/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
++/usr/lib/postfix/pipe -- gen_context(system_u:object_r:postfix_pipe_exec_t,s0)
')
/etc/postfix/postfix-script.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
/etc/postfix/prng_exch -- gen_context(system_u:object_r:postfix_prng_t,s0)
- /usr/sbin/postalias -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
--/usr/sbin/postcat -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
++/usr/sbin/postalias -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
++')
+ /usr/sbin/postcat -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
/usr/sbin/postdrop -- gen_context(system_u:object_r:postfix_postdrop_exec_t,s0)
/usr/sbin/postfix -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
- /usr/sbin/postkick -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
-@@ -44,9 +43,10 @@ ifdef(`distro_redhat', `
+@@ -42,9 +45,10 @@ ifdef(`distro_redhat', `
/usr/sbin/postqueue -- gen_context(system_u:object_r:postfix_postqueue_exec_t,s0)
/usr/sbin/postsuper -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
@@ -43306,10 +39611,10 @@ index 46bee12..c22af86 100644
+ role $2 types postfix_postdrop_t;
+')
diff --git a/policy/modules/services/postfix.te b/policy/modules/services/postfix.te
-index 06e37d4..ea5feb2 100644
+index a32c4b3..06be6b1 100644
--- a/policy/modules/services/postfix.te
+++ b/policy/modules/services/postfix.te
-@@ -5,6 +5,14 @@ policy_module(postfix, 1.12.0)
+@@ -5,6 +5,14 @@ policy_module(postfix, 1.12.1)
# Declarations
#
@@ -43502,7 +39807,7 @@ index 06e37d4..ea5feb2 100644
+')
+
+optional_policy(`
-+ zarafa_deliver_domtrans(postfix_local_t)
++ zarafa_domtrans_deliver(postfix_local_t)
+ zarafa_stream_connect_server(postfix_local_t)
+')
+
@@ -43862,7 +40167,7 @@ index 09aeffa..dd70b14 100644
postgresql_tcp_connect($1)
diff --git a/policy/modules/services/postgresql.te b/policy/modules/services/postgresql.te
-index 8ed5067..a5603cd 100644
+index 4a5387a..acf8ed1 100644
--- a/policy/modules/services/postgresql.te
+++ b/policy/modules/services/postgresql.te
@@ -19,16 +19,16 @@ gen_require(`
@@ -45297,220 +41602,210 @@ index 355b2a2..54329f9 100644
#
allow qmail_tcp_env_t qmail_smtpd_exec_t:file read_file_perms;
-diff --git a/policy/modules/services/qpidd.fc b/policy/modules/services/qpidd.fc
-new file mode 100644
-index 0000000..f3b89e4
---- /dev/null
-+++ b/policy/modules/services/qpidd.fc
-@@ -0,0 +1,9 @@
-+
+diff --git a/policy/modules/services/qpid.fc b/policy/modules/services/qpid.fc
+index 4f94229..f3b89e4 100644
+--- a/policy/modules/services/qpid.fc
++++ b/policy/modules/services/qpid.fc
+@@ -1,6 +1,7 @@
+-/etc/rc\.d/init\.d/qpidd -- gen_context(system_u:object_r:qpidd_initrc_exec_t,s0)
+
+-/usr/sbin/qpidd -- gen_context(system_u:object_r:qpidd_exec_t,s0)
+/usr/sbin/qpidd -- gen_context(system_u:object_r:qpidd_exec_t,s0)
+
+/etc/rc\.d/init\.d/qpidd -- gen_context(system_u:object_r:qpidd_initrc_exec_t,s0)
-+
-+/var/lib/qpidd(/.*)? gen_context(system_u:object_r:qpidd_var_lib_t,s0)
-+
-+/var/run/qpidd(/.*)? gen_context(system_u:object_r:qpidd_var_run_t,s0)
-+/var/run/qpidd\.pid gen_context(system_u:object_r:qpidd_var_run_t,s0)
-diff --git a/policy/modules/services/qpidd.if b/policy/modules/services/qpidd.if
-new file mode 100644
-index 0000000..c403abc
---- /dev/null
-+++ b/policy/modules/services/qpidd.if
-@@ -0,0 +1,228 @@
+
+ /var/lib/qpidd(/.*)? gen_context(system_u:object_r:qpidd_var_lib_t,s0)
+
+diff --git a/policy/modules/services/qpid.if b/policy/modules/services/qpid.if
+index 5a9630c..c403abc 100644
+--- a/policy/modules/services/qpid.if
++++ b/policy/modules/services/qpid.if
+@@ -1,4 +1,4 @@
+-## <summary>Apache QPID AMQP messaging server.</summary>
+## <summary>policy for qpidd</summary>
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run qpidd.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`qpidd_domtrans',`
-+ gen_require(`
-+ type qpidd_t, qpidd_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, qpidd_exec_t, qpidd_t)
-+')
-+
+
+ ########################################
+ ## <summary>
+@@ -18,9 +18,9 @@ interface(`qpidd_domtrans',`
+ domtrans_pattern($1, qpidd_exec_t, qpidd_t)
+ ')
+
+-#####################################
+########################################
-+## <summary>
+ ## <summary>
+-## Allow read and write access to qpidd semaphores.
+## Execute qpidd server in the qpidd domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -28,17 +28,17 @@ interface(`qpidd_domtrans',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`qpidd_rw_semaphores',`
+interface(`qpidd_initrc_domtrans',`
-+ gen_require(`
+ gen_require(`
+- type qpidd_t;
+ type qpidd_initrc_exec_t;
-+ ')
-+
+ ')
+
+- allow $1 qpidd_t:sem rw_sem_perms;
+ init_labeled_script_domtrans($1, qpidd_initrc_exec_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Read and write to qpidd shared memory.
+## Read qpidd PID files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -46,17 +46,18 @@ interface(`qpidd_rw_semaphores',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`qpidd_rw_shm',`
+interface(`qpidd_read_pid_files',`
-+ gen_require(`
+ gen_require(`
+- type qpidd_t;
+ type qpidd_var_run_t;
-+ ')
-+
+ ')
+
+- allow $1 qpidd_t:shm rw_shm_perms;
+ files_search_pids($1)
+ allow $1 qpidd_var_run_t:file read_file_perms;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Execute qpidd server in the qpidd domain.
+## Manage qpidd var_run files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -64,17 +65,20 @@ interface(`qpidd_rw_shm',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`qpidd_initrc_domtrans',`
+interface(`qpidd_manage_var_run',`
-+ gen_require(`
+ gen_require(`
+- type qpidd_initrc_exec_t;
+ type qpidd_var_run_t;
-+ ')
-+
+ ')
+
+- init_labeled_script_domtrans($1, qpidd_initrc_exec_t)
+ files_search_pids($1)
+ manage_dirs_pattern($1, qpidd_var_run_t, qpidd_var_run_t)
+ manage_files_pattern($1, qpidd_var_run_t, qpidd_var_run_t)
+ manage_lnk_files_pattern($1, qpidd_var_run_t, qpidd_var_run_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Read qpidd PID files.
+## Search qpidd lib directories.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -82,18 +86,18 @@ interface(`qpidd_initrc_domtrans',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`qpidd_read_pid_files',`
+interface(`qpidd_search_lib',`
-+ gen_require(`
+ gen_require(`
+- type qpidd_var_run_t;
+ type qpidd_var_lib_t;
-+ ')
-+
+ ')
+
+- files_search_pids($1)
+- allow $1 qpidd_var_run_t:file read_file_perms;
+ allow $1 qpidd_var_lib_t:dir search_dir_perms;
+ files_search_var_lib($1)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Search qpidd lib directories.
+## Read qpidd lib files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -101,18 +105,19 @@ interface(`qpidd_read_pid_files',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`qpidd_search_lib',`
+interface(`qpidd_read_lib_files',`
-+ gen_require(`
-+ type qpidd_var_lib_t;
-+ ')
-+
-+ files_search_var_lib($1)
+ gen_require(`
+ type qpidd_var_lib_t;
+ ')
+
+- allow $1 qpidd_var_lib_t:dir search_dir_perms;
+ files_search_var_lib($1)
+ read_files_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Read qpidd lib files.
+## Create, read, write, and delete
+## qpidd lib files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -120,19 +125,18 @@ interface(`qpidd_search_lib',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`qpidd_read_lib_files',`
+interface(`qpidd_manage_lib_files',`
-+ gen_require(`
-+ type qpidd_var_lib_t;
-+ ')
-+
-+ files_search_var_lib($1)
+ gen_require(`
+ type qpidd_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+- read_files_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t)
+ manage_files_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Create, read, write, and delete
+-## qpidd lib files.
+## Manage qpidd var_lib files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -140,13 +144,15 @@ interface(`qpidd_read_lib_files',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`qpidd_manage_lib_files',`
+interface(`qpidd_manage_var_lib',`
-+ gen_require(`
-+ type qpidd_var_lib_t;
-+ ')
-+
-+ files_search_var_lib($1)
+ gen_require(`
+ type qpidd_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_dirs_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t)
-+ manage_files_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t)
+ manage_files_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t)
+ manage_lnk_files_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t)
-+')
-+
-+########################################
-+## <summary>
-+## All of the rules required to administrate
-+## an qpidd environment
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <param name="role">
-+## <summary>
-+## Role allowed access.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`qpidd_admin',`
-+ gen_require(`
-+ type qpidd_t, qpidd_initrc_exec_t;
-+ ')
-+
-+ allow $1 qpidd_t:process { ptrace signal_perms };
-+ ps_process_pattern($1, qpidd_t)
-+
-+ # Allow qpidd_t to restart the apache service
-+ qpidd_initrc_domtrans($1)
-+ domain_system_change_exemption($1)
-+ role_transition $2 qpidd_initrc_exec_t system_r;
-+ allow $2 system_r;
-+
+ ')
+
+ ########################################
+@@ -180,7 +186,43 @@ interface(`qpidd_admin',`
+ role_transition $2 qpidd_initrc_exec_t system_r;
+ allow $2 system_r;
+
+- admin_pattern($1, qpidd_var_lib_t)
+ qpidd_manage_var_run($1)
+
+ qpidd_manage_var_lib($1)
+')
-+
+
+- admin_pattern($1, qpidd_var_run_t)
+#####################################
+## <summary>
+## Allow read and write access to qpidd semaphores.
@@ -45545,77 +41840,61 @@ index 0000000..c403abc
+ ')
+
+ allow $1 qpidd_t:shm rw_shm_perms;
-+')
-diff --git a/policy/modules/services/qpidd.te b/policy/modules/services/qpidd.te
-new file mode 100644
-index 0000000..4c6848c
---- /dev/null
-+++ b/policy/modules/services/qpidd.te
-@@ -0,0 +1,69 @@
-+policy_module(qpidd, 1.0.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+type qpidd_t;
-+type qpidd_exec_t;
-+init_daemon_domain(qpidd_t, qpidd_exec_t)
-+
-+type qpidd_initrc_exec_t;
-+init_script_file(qpidd_initrc_exec_t)
-+
-+type qpidd_var_run_t;
-+files_pid_file(qpidd_var_run_t)
-+
+ ')
+diff --git a/policy/modules/services/qpid.te b/policy/modules/services/qpid.te
+index cb7ecb5..ebf59f1 100644
+--- a/policy/modules/services/qpid.te
++++ b/policy/modules/services/qpid.te
+@@ -12,12 +12,12 @@ init_daemon_domain(qpidd_t, qpidd_exec_t)
+ type qpidd_initrc_exec_t;
+ init_script_file(qpidd_initrc_exec_t)
+
+-type qpidd_var_lib_t;
+-files_type(qpidd_var_lib_t)
+-
+ type qpidd_var_run_t;
+ files_pid_file(qpidd_var_run_t)
+
+type qpidd_var_lib_t;
+files_type(qpidd_var_lib_t)
+
-+########################################
-+#
-+# qpidd local policy
-+#
-+
-+allow qpidd_t self:process { setsched signull };
-+allow qpidd_t self:fifo_file rw_fifo_file_perms;
-+allow qpidd_t self:sem create_sem_perms;
-+allow qpidd_t self:shm create_shm_perms;
-+allow qpidd_t self:tcp_socket create_stream_socket_perms;
-+allow qpidd_t self:unix_stream_socket create_stream_socket_perms;
-+
+ ########################################
+ #
+ # qpidd local policy
+@@ -30,23 +30,24 @@ allow qpidd_t self:shm create_shm_perms;
+ allow qpidd_t self:tcp_socket create_stream_socket_perms;
+ allow qpidd_t self:unix_stream_socket create_stream_socket_perms;
+
+-manage_dirs_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
+-manage_files_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
+manage_dirs_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
+manage_files_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
-+files_var_lib_filetrans(qpidd_t, qpidd_var_lib_t, { file dir })
-+
+ files_var_lib_filetrans(qpidd_t, qpidd_var_lib_t, { file dir })
+
+-manage_dirs_pattern(qpidd_t, qpidd_var_run_t, qpidd_var_run_t)
+-manage_files_pattern(qpidd_t, qpidd_var_run_t, qpidd_var_run_t)
+manage_dirs_pattern(qpidd_t, qpidd_var_run_t, qpidd_var_run_t)
+manage_files_pattern(qpidd_t, qpidd_var_run_t, qpidd_var_run_t)
-+files_pid_filetrans(qpidd_t, qpidd_var_run_t, { file dir })
-+
-+kernel_read_system_state(qpidd_t)
-+
-+corenet_all_recvfrom_unlabeled(qpidd_t)
-+corenet_all_recvfrom_netlabel(qpidd_t)
+ files_pid_filetrans(qpidd_t, qpidd_var_run_t, { file dir })
+
+ kernel_read_system_state(qpidd_t)
+
+ corenet_all_recvfrom_unlabeled(qpidd_t)
+ corenet_all_recvfrom_netlabel(qpidd_t)
+corenet_tcp_bind_generic_node(qpidd_t)
-+corenet_tcp_sendrecv_generic_if(qpidd_t)
-+corenet_tcp_sendrecv_generic_node(qpidd_t)
-+corenet_tcp_sendrecv_all_ports(qpidd_t)
-+corenet_tcp_bind_amqp_port(qpidd_t)
+ corenet_tcp_sendrecv_generic_if(qpidd_t)
+ corenet_tcp_sendrecv_generic_node(qpidd_t)
+ corenet_tcp_sendrecv_all_ports(qpidd_t)
+-corenet_tcp_bind_generic_node(qpidd_t)
+ corenet_tcp_bind_amqp_port(qpidd_t)
+corenet_tcp_bind_matahari_port(qpidd_t)
-+
-+dev_read_urand(qpidd_t)
-+
-+files_read_etc_files(qpidd_t)
-+
-+logging_send_syslog_msg(qpidd_t)
-+
-+miscfiles_read_localization(qpidd_t)
-+
-+sysnet_dns_name_resolve(qpidd_t)
-+
-+optional_policy(`
-+ corosync_stream_connect(qpidd_t)
-+')
+
+ dev_read_urand(qpidd_t)
+
+@@ -61,3 +62,8 @@ sysnet_dns_name_resolve(qpidd_t)
+ optional_policy(`
+ corosync_stream_connect(qpidd_t)
+ ')
+
+optional_policy(`
+ matahari_manage_lib_files(qpidd_t)
@@ -47561,7 +43840,7 @@ index cda37bb..484e552 100644
+ allow $1 var_lib_nfs_t:file relabel_file_perms;
')
diff --git a/policy/modules/services/rpc.te b/policy/modules/services/rpc.te
-index 8e1ab72..eaa8036 100644
+index b1468ed..446729b 100644
--- a/policy/modules/services/rpc.te
+++ b/policy/modules/services/rpc.te
@@ -6,18 +6,18 @@ policy_module(rpc, 1.12.0)
@@ -48835,7 +45114,7 @@ index f1aea88..a5a75a8 100644
admin_pattern($1, saslauthd_var_run_t)
')
diff --git a/policy/modules/services/sasl.te b/policy/modules/services/sasl.te
-index 22184ad..3d85b76 100644
+index cfc60dd..53a9d2d 100644
--- a/policy/modules/services/sasl.te
+++ b/policy/modules/services/sasl.te
@@ -19,9 +19,6 @@ init_daemon_domain(saslauthd_t, saslauthd_exec_t)
@@ -51603,57 +47882,8 @@ index 8294f6f..4847b43 100644
/usr/sbin/tgtd -- gen_context(system_u:object_r:tgtd_exec_t,s0)
/var/lib/tgtd(/.*)? gen_context(system_u:object_r:tgtd_var_lib_t,s0)
+/var/run/tgtd.* -s gen_context(system_u:object_r:tgtd_var_run_t,s0)
-diff --git a/policy/modules/services/tgtd.if b/policy/modules/services/tgtd.if
-index b113b41..c2ed23a 100644
---- a/policy/modules/services/tgtd.if
-+++ b/policy/modules/services/tgtd.if
-@@ -11,18 +11,36 @@
-
- #####################################
- ## <summary>
--## Allow read and write access to tgtd semaphores.
-+## Allow read and write access to tgtd semaphores.
- ## </summary>
- ## <param name="domain">
--## <summary>
--## Domain allowed access.
--## </summary>
-+## <summary>
-+## Domain allowed access.
-+## </summary>
- ## </param>
- #
- interface(`tgtd_rw_semaphores',`
-- gen_require(`
-- type tgtd_t;
-- ')
-+ gen_require(`
-+ type tgtd_t;
-+ ')
-
-- allow $1 tgtd_t:sem rw_sem_perms;
-+ allow $1 tgtd_t:sem rw_sem_perms;
-+')
-+
-+######################################
-+## <summary>
-+## Manage tgtd sempaphores.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`tgtd_manage_semaphores',`
-+ gen_require(`
-+ type tgtd_t;
-+ ')
-+
-+ allow $1 tgtd_t:sem create_sem_perms;
- ')
diff --git a/policy/modules/services/tgtd.te b/policy/modules/services/tgtd.te
-index aa0cc45..a8c69f5 100644
+index 665bf7c..d100080 100644
--- a/policy/modules/services/tgtd.te
+++ b/policy/modules/services/tgtd.te
@@ -21,6 +21,9 @@ files_tmpfs_file(tgtd_tmpfs_t)
@@ -53295,253 +49525,52 @@ index 3eca020..4dec4ad 100644
+ userdom_search_admin_dir(virsh_ssh_t)
+')
diff --git a/policy/modules/services/vnstatd.fc b/policy/modules/services/vnstatd.fc
-new file mode 100644
-index 0000000..4d81b99
---- /dev/null
+index 11533cc..4d81b99 100644
+--- a/policy/modules/services/vnstatd.fc
+++ b/policy/modules/services/vnstatd.fc
-@@ -0,0 +1,8 @@
-+
-+/usr/bin/vnstat -- gen_context(system_u:object_r:vnstat_exec_t,s0)
-+
-+/usr/sbin/vnstatd -- gen_context(system_u:object_r:vnstatd_exec_t,s0)
-+
-+/var/lib/vnstat(/.*)? gen_context(system_u:object_r:vnstatd_var_lib_t,s0)
+@@ -1,3 +1,4 @@
+
-+/var/run/vnstat\.pid gen_context(system_u:object_r:vnstatd_var_run_t,s0)
+ /usr/bin/vnstat -- gen_context(system_u:object_r:vnstat_exec_t,s0)
+
+ /usr/sbin/vnstatd -- gen_context(system_u:object_r:vnstatd_exec_t,s0)
diff --git a/policy/modules/services/vnstatd.if b/policy/modules/services/vnstatd.if
-new file mode 100644
-index 0000000..b9104b7
---- /dev/null
+index 727fe95..21af852 100644
+--- a/policy/modules/services/vnstatd.if
+++ b/policy/modules/services/vnstatd.if
-@@ -0,0 +1,144 @@
-+## <summary>policy for vnstatd</summary>
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run vnstatd.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`vnstatd_domtrans',`
-+ gen_require(`
-+ type vnstatd_t, vnstatd_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, vnstatd_exec_t, vnstatd_t)
-+')
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run vnstat.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`vnstatd_domtrans_vnstat',`
-+ gen_require(`
-+ type vnstat_t, vnstat_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, vnstat_exec_t, vnstat_t)
-+')
-+
-+########################################
-+## <summary>
-+## Search vnstatd lib directories.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`vnstatd_search_lib',`
-+ gen_require(`
-+ type vnstatd_var_lib_t;
-+ ')
-+
-+ allow $1 vnstatd_var_lib_t:dir search_dir_perms;
-+ files_search_var_lib($1)
-+')
-+
-+########################################
-+## <summary>
-+## Read vnstatd lib files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`vnstatd_read_lib_files',`
-+ gen_require(`
-+ type vnstatd_var_lib_t;
-+ ')
-+
-+ files_search_var_lib($1)
-+ read_files_pattern($1, vnstatd_var_lib_t, vnstatd_var_lib_t)
-+')
-+
-+########################################
-+## <summary>
-+## Create, read, write, and delete
-+## vnstatd lib files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`vnstatd_manage_lib_files',`
-+ gen_require(`
-+ type vnstatd_var_lib_t;
-+ ')
-+
-+ files_search_var_lib($1)
-+ manage_files_pattern($1, vnstatd_var_lib_t, vnstatd_var_lib_t)
-+')
-+
-+########################################
-+## <summary>
-+## Manage vnstatd lib dirs files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`vnstatd_manage_lib_dirs',`
-+ gen_require(`
-+ type vnstatd_var_lib_t;
-+ ')
-+
-+ files_search_var_lib($1)
-+ manage_dirs_pattern($1, vnstatd_var_lib_t, vnstatd_var_lib_t)
-+')
-+
-+
-+########################################
-+## <summary>
-+## All of the rules required to administrate
-+## an vnstatd environment
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <param name="role">
-+## <summary>
-+## Role allowed access.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`vnstatd_admin',`
-+ gen_require(`
-+ type vnstatd_t, vnstatd_var_lib_t;
-+ ')
-+
-+ allow $1 vnstatd_t:process { ptrace signal_perms };
-+ ps_process_pattern($1, vnstatd_t)
+@@ -113,6 +113,7 @@ interface(`vnstatd_manage_lib_files',`
+ manage_files_pattern($1, vnstatd_var_lib_t, vnstatd_var_lib_t)
+ ')
+
+
-+ files_list_var_lib($1)
-+ admin_pattern($1, vnstatd_var_lib_t)
-+')
+ ########################################
+ ## <summary>
+ ## All of the rules required to administrate
diff --git a/policy/modules/services/vnstatd.te b/policy/modules/services/vnstatd.te
-new file mode 100644
-index 0000000..90b8072
---- /dev/null
+index 8121937..5a462fb 100644
+--- a/policy/modules/services/vnstatd.te
+++ b/policy/modules/services/vnstatd.te
-@@ -0,0 +1,78 @@
-+policy_module(vnstatd, 1.0.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+type vnstatd_t;
-+type vnstatd_exec_t;
-+init_daemon_domain(vnstatd_t, vnstatd_exec_t)
-+
-+type vnstatd_var_lib_t;
-+files_type(vnstatd_var_lib_t)
-+
-+type vnstatd_var_run_t;
-+files_pid_file(vnstatd_var_run_t)
-+
-+type vnstat_t;
-+type vnstat_exec_t;
-+application_domain(vnstat_t, vnstat_exec_t)
-+
-+########################################
-+#
-+# vnstatd local policy
-+#
-+allow vnstatd_t self:process { fork signal };
-+allow vnstatd_t self:fifo_file rw_fifo_file_perms;
-+allow vnstatd_t self:unix_stream_socket create_stream_socket_perms;
-+
+@@ -28,9 +28,12 @@ allow vnstatd_t self:process signal;
+ allow vnstatd_t self:fifo_file rw_fifo_file_perms;
+ allow vnstatd_t self:unix_stream_socket create_stream_socket_perms;
+
+manage_files_pattern(vnstatd_t, vnstatd_var_run_t, vnstatd_var_run_t)
+manage_dirs_pattern(vnstatd_t, vnstatd_var_run_t, vnstatd_var_run_t)
+files_pid_filetrans(vnstatd_t, vnstatd_var_run_t, { dir file })
+
-+manage_dirs_pattern(vnstatd_t, vnstatd_var_lib_t, vnstatd_var_lib_t)
-+manage_files_pattern(vnstatd_t, vnstatd_var_lib_t, vnstatd_var_lib_t)
-+files_var_lib_filetrans(vnstatd_t, vnstatd_var_lib_t, { dir file })
-+
-+kernel_read_network_state(vnstatd_t)
-+kernel_read_system_state(vnstatd_t)
-+
-+domain_use_interactive_fds(vnstatd_t)
-+
-+files_read_etc_files(vnstatd_t)
-+
-+fs_getattr_xattr_fs(vnstatd_t)
-+
-+logging_send_syslog_msg(vnstatd_t)
-+
-+miscfiles_read_localization(vnstatd_t)
-+
-+optional_policy(`
-+ cron_system_entry(vnstat_t, vnstat_exec_t)
-+')
-+
-+########################################
-+#
-+# vnstat local policy
-+#
-+allow vnstat_t self:process signal;
-+allow vnstat_t self:fifo_file rw_fifo_file_perms;
-+allow vnstat_t self:unix_stream_socket create_stream_socket_perms;
-+
-+manage_dirs_pattern(vnstat_t, vnstatd_var_lib_t, vnstatd_var_lib_t)
-+manage_files_pattern(vnstat_t, vnstatd_var_lib_t, vnstatd_var_lib_t)
-+files_var_lib_filetrans(vnstat_t, vnstatd_var_lib_t, { dir file })
-+
-+kernel_read_network_state(vnstat_t)
-+kernel_read_system_state(vnstat_t)
-+
-+domain_use_interactive_fds(vnstat_t)
-+
-+files_read_etc_files(vnstat_t)
-+
-+fs_getattr_xattr_fs(vnstat_t)
-+
-+logging_send_syslog_msg(vnstat_t)
-+
-+miscfiles_read_localization(vnstat_t)
+ manage_dirs_pattern(vnstatd_t, vnstatd_var_lib_t, vnstatd_var_lib_t)
+ manage_files_pattern(vnstatd_t, vnstatd_var_lib_t, vnstatd_var_lib_t)
+-files_var_lib_filetrans(vnstatd_t, vnstatd_var_lib_t, { dir file })
+
+ manage_files_pattern(vnstatd_t, vnstatd_var_run_t, vnstatd_var_run_t)
+ manage_dirs_pattern(vnstatd_t, vnstatd_var_run_t, vnstatd_var_run_t)
+@@ -64,7 +67,6 @@ allow vnstat_t self:unix_stream_socket create_stream_socket_perms;
+
+ manage_dirs_pattern(vnstat_t, vnstatd_var_lib_t, vnstatd_var_lib_t)
+ manage_files_pattern(vnstat_t, vnstatd_var_lib_t, vnstatd_var_lib_t)
+-files_var_lib_filetrans(vnstat_t, vnstatd_var_lib_t, { dir file })
+
+ kernel_read_network_state(vnstat_t)
+ kernel_read_system_state(vnstat_t)
diff --git a/policy/modules/services/w3c.te b/policy/modules/services/w3c.te
index 1174ad8..f4c4c1b 100644
--- a/policy/modules/services/w3c.te
@@ -53751,10 +49780,10 @@ index aa6e5a8..42a0efb 100644
########################################
## <summary>
diff --git a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc
-index 6f1e3c7..ade9046 100644
+index 4966c94..ade9046 100644
--- a/policy/modules/services/xserver.fc
+++ b/policy/modules/services/xserver.fc
-@@ -2,12 +2,34 @@
+@@ -2,13 +2,34 @@
# HOME_DIR
#
HOME_DIR/\.fonts\.conf -- gen_context(system_u:object_r:user_fonts_config_t,s0)
@@ -53765,7 +49794,7 @@ index 6f1e3c7..ade9046 100644
HOME_DIR/\.fonts\.cache-.* -- gen_context(system_u:object_r:user_fonts_cache_t,s0)
+HOME_DIR/\.DCOP.* -- gen_context(system_u:object_r:iceauth_home_t,s0)
HOME_DIR/\.ICEauthority.* -- gen_context(system_u:object_r:iceauth_home_t,s0)
-+HOME_DIR/\.serverauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
+ HOME_DIR/\.serverauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
HOME_DIR/\.xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
+HOME_DIR/\.Xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
@@ -53789,7 +49818,7 @@ index 6f1e3c7..ade9046 100644
#
# /dev
-@@ -20,6 +42,8 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
+@@ -21,6 +42,8 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
/etc/init\.d/xfree86-common -- gen_context(system_u:object_r:xserver_exec_t,s0)
@@ -53798,7 +49827,7 @@ index 6f1e3c7..ade9046 100644
/etc/kde3?/kdm/Xstartup -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/kde3?/kdm/Xreset -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/kde3?/kdm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
-@@ -32,11 +56,6 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
+@@ -33,11 +56,6 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
/etc/X11/wdm/Xstartup.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/X11/Xsession[^/]* -- gen_context(system_u:object_r:xsession_exec_t,s0)
@@ -53810,7 +49839,7 @@ index 6f1e3c7..ade9046 100644
#
# /opt
#
-@@ -47,28 +66,30 @@ ifdef(`distro_redhat',`
+@@ -48,28 +66,30 @@ ifdef(`distro_redhat',`
# /tmp
#
@@ -53847,7 +49876,7 @@ index 6f1e3c7..ade9046 100644
/usr/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
-@@ -89,17 +110,44 @@ ifdef(`distro_debian', `
+@@ -90,17 +110,44 @@ ifdef(`distro_debian', `
/var/[xgk]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
@@ -55010,7 +51039,7 @@ index 130ced9..ea8077d 100644
+ userdom_admin_home_dir_filetrans($1, user_fonts_cache_t, dir, ".fontconfig")
+')
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
-index 6c01261..b5cca5e 100644
+index 143c893..5774644 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -26,27 +26,50 @@ gen_require(`
@@ -55216,7 +51245,7 @@ index 6c01261..b5cca5e 100644
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_files(iceauth_t)
-@@ -247,50 +301,110 @@ tunable_policy(`use_samba_home_dirs',`
+@@ -247,52 +301,112 @@ tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_files(iceauth_t)
')
@@ -55269,6 +51298,8 @@ index 6c01261..b5cca5e 100644
+
+kernel_read_system_state(xauth_t)
+ kernel_request_load_module(xauth_t)
+
domain_use_interactive_fds(xauth_t)
+domain_dontaudit_leaks(xauth_t)
@@ -55333,7 +51364,7 @@ index 6c01261..b5cca5e 100644
optional_policy(`
ssh_sigchld(xauth_t)
ssh_read_pipes(xauth_t)
-@@ -302,20 +416,36 @@ optional_policy(`
+@@ -304,20 +418,36 @@ optional_policy(`
# XDM Local policy
#
@@ -55374,7 +51405,7 @@ index 6c01261..b5cca5e 100644
# Allow gdm to run gdm-binary
can_exec(xdm_t, xdm_exec_t)
-@@ -323,43 +453,62 @@ can_exec(xdm_t, xdm_exec_t)
+@@ -325,43 +455,62 @@ can_exec(xdm_t, xdm_exec_t)
allow xdm_t xdm_lock_t:file manage_file_perms;
files_lock_filetrans(xdm_t, xdm_lock_t, file)
@@ -55443,7 +51474,7 @@ index 6c01261..b5cca5e 100644
# connect to xdm xserver over stream socket
stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)
-@@ -368,18 +517,26 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)
+@@ -370,18 +519,26 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)
delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
@@ -55471,7 +51502,7 @@ index 6c01261..b5cca5e 100644
corenet_all_recvfrom_unlabeled(xdm_t)
corenet_all_recvfrom_netlabel(xdm_t)
-@@ -391,38 +548,49 @@ corenet_tcp_sendrecv_all_ports(xdm_t)
+@@ -393,38 +550,49 @@ corenet_tcp_sendrecv_all_ports(xdm_t)
corenet_udp_sendrecv_all_ports(xdm_t)
corenet_tcp_bind_generic_node(xdm_t)
corenet_udp_bind_generic_node(xdm_t)
@@ -55525,7 +51556,7 @@ index 6c01261..b5cca5e 100644
files_read_etc_files(xdm_t)
files_read_var_files(xdm_t)
-@@ -433,9 +601,23 @@ files_list_mnt(xdm_t)
+@@ -435,9 +603,23 @@ files_list_mnt(xdm_t)
files_read_usr_files(xdm_t)
# Poweroff wants to create the /poweroff file when run from xdm
files_create_boot_flag(xdm_t)
@@ -55549,7 +51580,7 @@ index 6c01261..b5cca5e 100644
storage_dontaudit_read_fixed_disk(xdm_t)
storage_dontaudit_write_fixed_disk(xdm_t)
-@@ -444,28 +626,36 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
+@@ -446,28 +628,36 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
storage_dontaudit_raw_write_removable_device(xdm_t)
storage_dontaudit_setattr_removable_dev(xdm_t)
storage_dontaudit_rw_scsi_generic(xdm_t)
@@ -55588,7 +51619,7 @@ index 6c01261..b5cca5e 100644
userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t)
-@@ -474,9 +664,30 @@ userdom_read_user_home_content_files(xdm_t)
+@@ -476,9 +666,30 @@ userdom_read_user_home_content_files(xdm_t)
# Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t)
@@ -55619,7 +51650,7 @@ index 6c01261..b5cca5e 100644
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xdm_t)
-@@ -492,6 +703,14 @@ tunable_policy(`use_samba_home_dirs',`
+@@ -494,6 +705,14 @@ tunable_policy(`use_samba_home_dirs',`
fs_exec_cifs_files(xdm_t)
')
@@ -55634,7 +51665,7 @@ index 6c01261..b5cca5e 100644
tunable_policy(`xdm_sysadm_login',`
userdom_xsession_spec_domtrans_all_users(xdm_t)
# FIXME:
-@@ -505,11 +724,21 @@ tunable_policy(`xdm_sysadm_login',`
+@@ -507,11 +726,21 @@ tunable_policy(`xdm_sysadm_login',`
')
optional_policy(`
@@ -55656,11 +51687,10 @@ index 6c01261..b5cca5e 100644
')
optional_policy(`
-@@ -517,7 +746,43 @@ optional_policy(`
+@@ -519,12 +748,62 @@ optional_policy(`
')
optional_policy(`
-- cpufreqselector_dbus_chat(xdm_t)
+ # Use dbus to start other processes as xdm_t
+ dbus_role_template(xdm, system_r, xdm_t)
+
@@ -55698,10 +51728,12 @@ index 6c01261..b5cca5e 100644
+ optional_policy(`
+ networkmanager_dbus_chat(xdm_t)
+ ')
- ')
-
- optional_policy(`
-@@ -527,6 +792,16 @@ optional_policy(`
++')
++
++optional_policy(`
+ # Talk to the console mouse server.
+ gpm_stream_connect(xdm_t)
+ gpm_setattr_gpmctl(xdm_t)
')
optional_policy(`
@@ -55718,7 +51750,7 @@ index 6c01261..b5cca5e 100644
hostname_exec(xdm_t)
')
-@@ -544,28 +819,70 @@ optional_policy(`
+@@ -542,28 +821,70 @@ optional_policy(`
')
optional_policy(`
@@ -55798,7 +51830,7 @@ index 6c01261..b5cca5e 100644
')
optional_policy(`
-@@ -577,6 +894,14 @@ optional_policy(`
+@@ -575,6 +896,14 @@ optional_policy(`
')
optional_policy(`
@@ -55813,7 +51845,7 @@ index 6c01261..b5cca5e 100644
xfs_stream_connect(xdm_t)
')
-@@ -601,7 +926,7 @@ allow xserver_t input_xevent_t:x_event send;
+@@ -599,7 +928,7 @@ allow xserver_t input_xevent_t:x_event send;
# execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack
@@ -55822,7 +51854,7 @@ index 6c01261..b5cca5e 100644
dontaudit xserver_t self:capability chown;
allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow xserver_t self:fd use;
-@@ -615,8 +940,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
+@@ -613,8 +942,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms;
@@ -55838,7 +51870,7 @@ index 6c01261..b5cca5e 100644
manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
-@@ -635,12 +967,19 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
+@@ -633,12 +969,19 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t)
@@ -55860,7 +51892,7 @@ index 6c01261..b5cca5e 100644
kernel_read_system_state(xserver_t)
kernel_read_device_sysctls(xserver_t)
-@@ -648,6 +987,7 @@ kernel_read_modprobe_sysctls(xserver_t)
+@@ -646,6 +989,7 @@ kernel_read_modprobe_sysctls(xserver_t)
# Xorg wants to check if kernel is tainted
kernel_read_kernel_sysctls(xserver_t)
kernel_write_proc_files(xserver_t)
@@ -55868,7 +51900,7 @@ index 6c01261..b5cca5e 100644
# Run helper programs in xserver_t.
corecmd_exec_bin(xserver_t)
-@@ -674,7 +1014,6 @@ dev_rw_apm_bios(xserver_t)
+@@ -672,7 +1016,6 @@ dev_rw_apm_bios(xserver_t)
dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t)
@@ -55876,7 +51908,7 @@ index 6c01261..b5cca5e 100644
dev_create_generic_dirs(xserver_t)
dev_setattr_generic_dirs(xserver_t)
# raw memory access is needed if not using the frame buffer
-@@ -684,11 +1023,17 @@ dev_wx_raw_memory(xserver_t)
+@@ -682,11 +1025,17 @@ dev_wx_raw_memory(xserver_t)
dev_rw_xserver_misc(xserver_t)
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev(xserver_t)
@@ -55894,7 +51926,7 @@ index 6c01261..b5cca5e 100644
# brought on by rhgb
files_search_mnt(xserver_t)
-@@ -699,8 +1044,13 @@ fs_getattr_xattr_fs(xserver_t)
+@@ -697,8 +1046,13 @@ fs_getattr_xattr_fs(xserver_t)
fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t)
@@ -55908,7 +51940,7 @@ index 6c01261..b5cca5e 100644
selinux_validate_context(xserver_t)
selinux_compute_access_vector(xserver_t)
-@@ -713,8 +1063,6 @@ init_getpgid(xserver_t)
+@@ -711,8 +1065,6 @@ init_getpgid(xserver_t)
term_setattr_unallocated_ttys(xserver_t)
term_use_unallocated_ttys(xserver_t)
@@ -55917,7 +51949,7 @@ index 6c01261..b5cca5e 100644
locallogin_use_fds(xserver_t)
logging_send_syslog_msg(xserver_t)
-@@ -722,11 +1070,12 @@ logging_send_audit_msgs(xserver_t)
+@@ -720,11 +1072,12 @@ logging_send_audit_msgs(xserver_t)
miscfiles_read_localization(xserver_t)
miscfiles_read_fonts(xserver_t)
@@ -55932,7 +51964,7 @@ index 6c01261..b5cca5e 100644
userdom_search_user_home_dirs(xserver_t)
userdom_use_user_ttys(xserver_t)
-@@ -780,16 +1129,36 @@ optional_policy(`
+@@ -778,16 +1131,36 @@ optional_policy(`
')
optional_policy(`
@@ -55970,7 +52002,7 @@ index 6c01261..b5cca5e 100644
unconfined_domtrans(xserver_t)
')
-@@ -798,6 +1167,10 @@ optional_policy(`
+@@ -796,6 +1169,10 @@ optional_policy(`
')
optional_policy(`
@@ -55981,7 +52013,7 @@ index 6c01261..b5cca5e 100644
xfs_stream_connect(xserver_t)
')
-@@ -813,10 +1186,10 @@ allow xserver_t xdm_t:shm rw_shm_perms;
+@@ -811,10 +1188,10 @@ allow xserver_t xdm_t:shm rw_shm_perms;
# NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open
# handle of a file inside the dir!!!
@@ -55995,7 +52027,7 @@ index 6c01261..b5cca5e 100644
# Label pid and temporary files with derived types.
manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
-@@ -824,7 +1197,7 @@ manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
+@@ -822,7 +1199,7 @@ manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
manage_sock_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
# Run xkbcomp.
@@ -56004,7 +52036,7 @@ index 6c01261..b5cca5e 100644
can_exec(xserver_t, xkb_var_lib_t)
# VNC v4 module in X server
-@@ -837,6 +1210,9 @@ init_use_fds(xserver_t)
+@@ -835,6 +1212,9 @@ init_use_fds(xserver_t)
# to read ROLE_home_t - examine this in more detail
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
@@ -56014,7 +52046,7 @@ index 6c01261..b5cca5e 100644
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xserver_t)
-@@ -844,6 +1220,11 @@ tunable_policy(`use_nfs_home_dirs',`
+@@ -842,6 +1222,11 @@ tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_symlinks(xserver_t)
')
@@ -56026,7 +52058,7 @@ index 6c01261..b5cca5e 100644
tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_dirs(xserver_t)
fs_manage_cifs_files(xserver_t)
-@@ -852,11 +1233,14 @@ tunable_policy(`use_samba_home_dirs',`
+@@ -850,11 +1235,14 @@ tunable_policy(`use_samba_home_dirs',`
optional_policy(`
dbus_system_bus_client(xserver_t)
@@ -56043,7 +52075,7 @@ index 6c01261..b5cca5e 100644
')
optional_policy(`
-@@ -864,6 +1248,10 @@ optional_policy(`
+@@ -862,6 +1250,10 @@ optional_policy(`
rhgb_rw_tmpfs_files(xserver_t)
')
@@ -56054,7 +52086,7 @@ index 6c01261..b5cca5e 100644
########################################
#
# Rules common to all X window domains
-@@ -907,7 +1295,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
+@@ -905,7 +1297,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show };
# operations allowed on my windows
allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@@ -56063,7 +52095,7 @@ index 6c01261..b5cca5e 100644
# operations allowed on all windows
allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child };
-@@ -961,11 +1349,31 @@ allow x_domain self:x_resource { read write };
+@@ -959,11 +1351,31 @@ allow x_domain self:x_resource { read write };
# can mess with the screensaver
allow x_domain xserver_t:x_screen { getattr saver_getattr };
@@ -56095,7 +52127,7 @@ index 6c01261..b5cca5e 100644
tunable_policy(`! xserver_object_manager',`
# should be xserver_unconfined(x_domain),
# but typeattribute doesnt work in conditionals
-@@ -987,18 +1395,32 @@ tunable_policy(`! xserver_object_manager',`
+@@ -985,18 +1397,32 @@ tunable_policy(`! xserver_object_manager',`
allow x_domain xevent_type:{ x_event x_synthetic_event } *;
')
@@ -56144,24 +52176,25 @@ index 6c01261..b5cca5e 100644
+ unconfined_getpgid(xserver_t)
+')
diff --git a/policy/modules/services/zabbix.fc b/policy/modules/services/zabbix.fc
-index 3102286..4ef4400 100644
+index 664cd7a..e3eaec5 100644
--- a/policy/modules/services/zabbix.fc
+++ b/policy/modules/services/zabbix.fc
-@@ -1,6 +1,10 @@
--/etc/rc\.d/init\.d/zabbix -- gen_context(system_u:object_r:zabbix_initrc_exec_t,s0)
-+/etc/rc\.d/init\.d/zabbix -- gen_context(system_u:object_r:zabbix_initrc_exec_t,s0)
+@@ -1,8 +1,10 @@
+ /etc/rc\.d/init\.d/zabbix -- gen_context(system_u:object_r:zabbix_initrc_exec_t,s0)
+-/etc/rc\.d/init\.d/zabbix-agentd -- gen_context(system_u:object_r:zabbix_agent_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/zabbix-server -- gen_context(system_u:object_r:zabbix_initrc_exec_t,s0)
--/usr/bin/zabbix_server -- gen_context(system_u:object_r:zabbix_exec_t,s0)
+-/usr/(s)?bin/zabbix_server -- gen_context(system_u:object_r:zabbix_exec_t,s0)
+-/usr/(s)?bin/zabbix_agentd -- gen_context(system_u:object_r:zabbix_agent_t,s0)
+/usr/sbin/zabbix_server -- gen_context(system_u:object_r:zabbix_exec_t,s0)
+/usr/sbin/zabbix_server_mysql -- gen_context(system_u:object_r:zabbix_exec_t,s0)
+/usr/sbin/zabbix_server_pgsql -- gen_context(system_u:object_r:zabbix_exec_t,s0)
+/usr/sbin/zabbix_server_sqlite3 -- gen_context(system_u:object_r:zabbix_exec_t,s0)
- /var/log/zabbix(/.*)? gen_context(system_u:object_r:zabbix_log_t,s0)
+ /var/log/zabbix(/.*)? gen_context(system_u:object_r:zabbix_log_t,s0)
diff --git a/policy/modules/services/zabbix.if b/policy/modules/services/zabbix.if
-index d77e631..4776863 100644
+index c9981d1..05ae02f 100644
--- a/policy/modules/services/zabbix.if
+++ b/policy/modules/services/zabbix.if
@@ -5,9 +5,9 @@
@@ -56176,7 +52209,7 @@ index d77e631..4776863 100644
## </param>
#
interface(`zabbix_domtrans',`
-@@ -44,9 +44,9 @@ interface(`zabbix_read_log',`
+@@ -65,9 +65,9 @@ interface(`zabbix_read_log',`
## zabbix log files.
## </summary>
## <param name="domain">
@@ -56189,20 +52222,24 @@ index d77e631..4776863 100644
#
interface(`zabbix_append_log',`
diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te
-index c26ecf5..ad41551 100644
+index 7f88f5f..bd6493d 100644
--- a/policy/modules/services/zabbix.te
+++ b/policy/modules/services/zabbix.te
-@@ -25,12 +25,14 @@ files_pid_file(zabbix_var_run_t)
+@@ -36,16 +36,17 @@ files_pid_file(zabbix_var_run_t)
# zabbix local policy
#
-allow zabbix_t self:capability { setuid setgid };
-allow zabbix_t self:fifo_file rw_file_perms;
+-allow zabbix_t self:process { setsched getsched signal };
+allow zabbix_t self:capability { dac_read_search dac_override setuid setgid };
+allow zabbix_t self:process setsched;
+allow zabbix_t self:sem create_sem_perms;
+allow zabbix_t self:fifo_file rw_fifo_file_perms;
allow zabbix_t self:unix_stream_socket create_stream_socket_perms;
+ allow zabbix_t self:sem create_sem_perms;
+ allow zabbix_t self:shm create_shm_perms;
+ allow zabbix_t self:tcp_socket create_stream_socket_perms;
# log files
-allow zabbix_t zabbix_log_t:dir setattr;
@@ -56210,187 +52247,46 @@ index c26ecf5..ad41551 100644
manage_files_pattern(zabbix_t, zabbix_log_t, zabbix_log_t)
logging_log_filetrans(zabbix_t, zabbix_log_t, file)
-@@ -39,8 +41,12 @@ manage_dirs_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t)
+@@ -58,11 +59,15 @@ manage_dirs_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t)
manage_files_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t)
files_pid_filetrans(zabbix_t, zabbix_var_run_t, { dir file })
+kernel_read_kernel_sysctls(zabbix_t)
+
+ corenet_tcp_bind_generic_node(zabbix_t)
+ corenet_tcp_bind_zabbix_port(zabbix_t)
+
files_read_etc_files(zabbix_t)
+auth_use_nsswitch(zabbix_t)
+
miscfiles_read_localization(zabbix_t)
- optional_policy(`
+ sysnet_dns_name_resolve(zabbix_t)
diff --git a/policy/modules/services/zarafa.fc b/policy/modules/services/zarafa.fc
-new file mode 100644
-index 0000000..8d9a111
---- /dev/null
+index 3defaa1..7fc57b2 100644
+--- a/policy/modules/services/zarafa.fc
+++ b/policy/modules/services/zarafa.fc
-@@ -0,0 +1,34 @@
-+
-+/etc/zarafa(/.*)? gen_context(system_u:object_r:zarafa_etc_t,s0)
-+
-+/usr/bin/zarafa-dagent -- gen_context(system_u:object_r:zarafa_deliver_exec_t,s0)
-+
-+/usr/bin/zarafa-server -- gen_context(system_u:object_r:zarafa_server_exec_t,s0)
-+
-+/usr/bin/zarafa-gateway -- gen_context(system_u:object_r:zarafa_gateway_exec_t,s0)
-+
-+/usr/bin/zarafa-spooler -- gen_context(system_u:object_r:zarafa_spooler_exec_t,s0)
-+
-+/usr/bin/zarafa-ical -- gen_context(system_u:object_r:zarafa_ical_exec_t,s0)
-+
-+/usr/bin/zarafa-indexer -- gen_context(system_u:object_r:zarafa_indexer_exec_t,s0)
-+
-+/usr/bin/zarafa-monitor -- gen_context(system_u:object_r:zarafa_monitor_exec_t,s0)
-+
-+/var/lib/zarafa(/.*)? gen_context(system_u:object_r:zarafa_var_lib_t,s0)
-+/var/lib/zarafa-webaccess(/.*)? gen_context(system_u:object_r:zarafa_var_lib_t,s0)
-+
-+/var/log/zarafa/server\.log -- gen_context(system_u:object_r:zarafa_server_log_t,s0)
-+/var/log/zarafa/spooler\.log -- gen_context(system_u:object_r:zarafa_spooler_log_t,s0)
-+/var/log/zarafa/gateway\.log -- gen_context(system_u:object_r:zarafa_gateway_log_t,s0)
-+/var/log/zarafa/ical\.log -- gen_context(system_u:object_r:zarafa_ical_log_t,s0)
-+/var/log/zarafa/indexer\.log -- gen_context(system_u:object_r:zarafa_indexer_log_t,s0)
-+/var/log/zarafa/monitor\.log -- gen_context(system_u:object_r:zarafa_monitor_log_t,s0)
-+
-+/var/run/zarafa -s gen_context(system_u:object_r:zarafa_server_var_run_t,s0)
-+/var/run/zarafa-gateway\.pid -- gen_context(system_u:object_r:zarafa_gateway_var_run_t,s0)
-+/var/run/zarafa-server\.pid -- gen_context(system_u:object_r:zarafa_server_var_run_t,s0)
-+/var/run/zarafa-spooler\.pid -- gen_context(system_u:object_r:zarafa_spooler_var_run_t,s0)
-+/var/run/zarafa-ical\.pid -- gen_context(system_u:object_r:zarafa_ical_var_run_t,s0)
-+/var/run/zarafa-indexer -- gen_context(system_u:object_r:zarafa_indexer_var_run_t,s0)
-+/var/run/zarafa-monitor\.pid -- gen_context(system_u:object_r:zarafa_monitor_var_run_t,s0)
+@@ -8,7 +8,8 @@
+ /usr/bin/zarafa-server -- gen_context(system_u:object_r:zarafa_server_exec_t,s0)
+ /usr/bin/zarafa-spooler -- gen_context(system_u:object_r:zarafa_spooler_exec_t,s0)
+
+-/var/lib/zarafa-.* gen_context(system_u:object_r:zarafa_var_lib_t,s0)
++/var/lib/zarafa(/.*)? gen_context(system_u:object_r:zarafa_var_lib_t,s0)
++/var/lib/zarafa-webaccess(/.*)? gen_context(system_u:object_r:zarafa_var_lib_t,s0)
+
+ /var/log/zarafa/gateway\.log -- gen_context(system_u:object_r:zarafa_gateway_log_t,s0)
+ /var/log/zarafa/ical\.log -- gen_context(system_u:object_r:zarafa_ical_log_t,s0)
diff --git a/policy/modules/services/zarafa.if b/policy/modules/services/zarafa.if
-new file mode 100644
-index 0000000..7ee5092
---- /dev/null
+index 21ae664..fcc91a1 100644
+--- a/policy/modules/services/zarafa.if
+++ b/policy/modules/services/zarafa.if
-@@ -0,0 +1,141 @@
-+## <summary>policy for zarafa services</summary>
-+
-+######################################
-+## <summary>
-+## Creates types and rules for a basic
-+## zararfa init daemon domain.
-+## </summary>
-+## <param name="prefix">
-+## <summary>
-+## Prefix for the domain.
-+## </summary>
-+## </param>
-+#
-+template(`zarafa_domain_template',`
-+ gen_require(`
-+ attribute zarafa_domain;
-+ ')
-+
-+ ##############################
-+ #
-+ # $1_t declarations
-+ #
-+
-+ type zarafa_$1_t, zarafa_domain;
-+ type zarafa_$1_exec_t;
-+ init_daemon_domain(zarafa_$1_t, zarafa_$1_exec_t)
-+
-+ type zarafa_$1_log_t;
-+ logging_log_file(zarafa_$1_log_t)
-+
-+ type zarafa_$1_var_run_t;
-+ files_pid_file(zarafa_$1_var_run_t)
-+
-+ ##############################
-+ #
-+ # $1_t local policy
-+ #
-+
-+ manage_files_pattern(zarafa_$1_t, zarafa_$1_var_run_t, zarafa_$1_var_run_t)
-+ manage_sock_files_pattern(zarafa_$1_t, zarafa_$1_var_run_t, zarafa_$1_var_run_t)
-+ files_pid_filetrans(zarafa_$1_t, zarafa_$1_var_run_t, { file sock_file })
-+
-+ manage_files_pattern(zarafa_$1_t, zarafa_$1_log_t,zarafa_$1_log_t)
-+ logging_log_filetrans(zarafa_$1_t,zarafa_$1_log_t,{ file })
-+')
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run zarafa_server.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`zarafa_server_domtrans',`
-+ gen_require(`
-+ type zarafa_server_t, zarafa_server_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, zarafa_server_exec_t, zarafa_server_t)
-+')
-+
-+########################################
-+## <summary>
-+## Execute a domain transition to run zarafa_deliver.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`zarafa_deliver_domtrans',`
-+ gen_require(`
-+ type zarafa_deliver_t, zarafa_deliver_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, zarafa_deliver_exec_t, zarafa_deliver_t)
-+')
-+
-+#######################################
-+## <summary>
-+## Connect to zarafa-server unix domain stream socket.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`zarafa_stream_connect_server',`
-+ gen_require(`
-+ type zarafa_server_t, zarafa_server_var_run_t;
-+ ')
-+
-+ files_search_var_lib($1)
-+ stream_connect_pattern($1, zarafa_server_var_run_t, zarafa_server_var_run_t, zarafa_server_t)
-+')
-+
-+######################################
-+## <summary>
-+## Allow the specified domain to search
-+## zarafa configuration dirs.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`zarafa_search_config',`
-+ gen_require(`
-+ type zarafa_etc_t;
-+ ')
-+
-+ files_search_etc($1)
-+ allow $1 zarafa_etc_t:dir search_dir_perms;
-+')
+@@ -118,3 +118,24 @@ interface(`zarafa_stream_connect_server',`
+ files_search_var_lib($1)
+ stream_connect_pattern($1, zarafa_server_var_run_t, zarafa_server_var_run_t, zarafa_server_t)
+ ')
+
-+#####################################
++####################################
+## <summary>
+## Allow the specified domain to manage
+## zarafa /var/lib files.
@@ -56405,55 +52301,40 @@ index 0000000..7ee5092
+ gen_require(`
+ type zarafa_var_lib_t;
+ ')
-+
-+ files_search_var_lib($1)
-+ manage_files_pattern($1, zarafa_var_lib_t, zarafa_var_lib_t)
-+ manage_dirs_pattern($1, zarafa_var_lib_t, zarafa_var_lib_t)
++
++ files_search_var_lib($1)
++ manage_files_pattern($1, zarafa_var_lib_t, zarafa_var_lib_t)
++ manage_dirs_pattern($1, zarafa_var_lib_t, zarafa_var_lib_t)
+')
diff --git a/policy/modules/services/zarafa.te b/policy/modules/services/zarafa.te
-new file mode 100644
-index 0000000..0b1d997
---- /dev/null
+index 9fb4747..54abc7a 100644
+--- a/policy/modules/services/zarafa.te
+++ b/policy/modules/services/zarafa.te
-@@ -0,0 +1,153 @@
-+policy_module(zarafa, 1.0.0)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+attribute zarafa_domain;
-+
-+zarafa_domain_template(monitor)
-+zarafa_domain_template(indexer)
-+zarafa_domain_template(ical)
-+zarafa_domain_template(server)
-+zarafa_domain_template(spooler)
-+zarafa_domain_template(gateway)
-+zarafa_domain_template(deliver)
-+
-+type zarafa_deliver_tmp_t;
-+files_tmp_file(zarafa_deliver_tmp_t)
+@@ -18,6 +18,10 @@ files_config_file(zarafa_etc_t)
+ zarafa_domain_template(gateway)
+ zarafa_domain_template(ical)
+ zarafa_domain_template(indexer)
+
+type zarafa_indexer_tmp_t;
+files_tmp_file(zarafa_indexer_tmp_t)
+
-+type zarafa_server_tmp_t;
-+files_tmp_file(zarafa_server_tmp_t)
-+
-+type zarafa_var_lib_t;
-+files_tmp_file(zarafa_var_lib_t)
-+
-+type zarafa_etc_t;
-+files_config_file(zarafa_etc_t)
-+
-+type zarafa_share_t;
-+files_type(zarafa_share_t)
-+
+ zarafa_domain_template(monitor)
+ zarafa_domain_template(server)
+
+@@ -32,6 +36,8 @@ zarafa_domain_template(spooler)
+ type zarafa_var_lib_t;
+ files_tmp_file(zarafa_var_lib_t)
+
+permissive zarafa_indexer_t;
+
-+#######################################
+ ########################################
+ #
+ # zarafa-deliver local policy
+@@ -57,6 +63,19 @@ corenet_tcp_sendrecv_all_ports(zarafa_gateway_t)
+ corenet_tcp_bind_generic_node(zarafa_gateway_t)
+ corenet_tcp_bind_pop_port(zarafa_gateway_t)
+
++######################################
+#
+# zarafa-indexer local policy
+#
@@ -56465,63 +52346,14 @@ index 0000000..0b1d997
+manage_dirs_pattern(zarafa_indexer_t, zarafa_var_lib_t, zarafa_var_lib_t)
+manage_files_pattern(zarafa_indexer_t, zarafa_var_lib_t, zarafa_var_lib_t)
+
-+########################################
-+#
-+# zarafa-deliver local policy
-+#
-+
-+manage_dirs_pattern(zarafa_deliver_t, zarafa_deliver_tmp_t, zarafa_deliver_tmp_t)
-+manage_files_pattern(zarafa_deliver_t, zarafa_deliver_tmp_t, zarafa_deliver_tmp_t)
-+files_tmp_filetrans(zarafa_deliver_t, zarafa_deliver_tmp_t, { file dir })
-+
-+
-+########################################
-+#
-+# zarafa_server local policy
-+#
-+
-+allow zarafa_server_t self:capability { chown kill net_bind_service };
-+allow zarafa_server_t self:process setrlimit;
-+
-+manage_dirs_pattern(zarafa_server_t, zarafa_server_tmp_t, zarafa_server_tmp_t)
-+manage_files_pattern(zarafa_server_t, zarafa_server_tmp_t, zarafa_server_tmp_t)
-+files_tmp_filetrans(zarafa_server_t, zarafa_server_tmp_t, { file dir })
-+
-+manage_dirs_pattern(zarafa_server_t, zarafa_var_lib_t, zarafa_var_lib_t)
-+manage_files_pattern(zarafa_server_t, zarafa_var_lib_t, zarafa_var_lib_t)
-+
-+stream_connect_pattern(zarafa_server_t, zarafa_indexer_var_run_t, zarafa_indexer_var_run_t, zarafa_indexer_t)
-+
-+corenet_tcp_bind_zarafa_port(zarafa_server_t)
-+
-+files_read_usr_files(zarafa_server_t)
-+
-+logging_send_syslog_msg(zarafa_server_t)
-+logging_send_audit_msgs(zarafa_server_t)
-+
-+sysnet_dns_name_resolve(zarafa_server_t)
-+
-+optional_policy(`
-+ mysql_stream_connect(zarafa_server_t)
-+')
-+
-+optional_policy(`
-+ kerberos_use(zarafa_server_t)
-+')
-+
-+########################################
-+#
-+# zarafa_spooler local policy
-+#
-+
-+allow zarafa_spooler_t self:capability { chown kill };
+
-+can_exec(zarafa_spooler_t, zarafa_spooler_exec_t)
-+
-+corenet_tcp_connect_smtp_port(zarafa_spooler_t)
-+
-+########################################
-+#
+ #######################################
+ #
+ # zarafa-ical local policy
+@@ -138,6 +157,32 @@ corenet_tcp_connect_smtp_port(zarafa_spooler_t)
+
+ ########################################
+ #
+# zarafa_gateway local policy
+#
+
@@ -56548,27 +52380,9 @@ index 0000000..0b1d997
+
+########################################
+#
-+# zarafa domains local policy
-+#
-+
-+# bad permission on /etc/zarafa
-+allow zarafa_domain self:capability { dac_override setgid setuid };
-+allow zarafa_domain self:process signal;
-+allow zarafa_domain self:fifo_file rw_fifo_file_perms;
-+allow zarafa_domain self:tcp_socket create_stream_socket_perms;
-+allow zarafa_domain self:unix_stream_socket create_stream_socket_perms;
-+
-+stream_connect_pattern(zarafa_domain, zarafa_server_var_run_t, zarafa_server_var_run_t, zarafa_server_t)
-+
-+read_files_pattern(zarafa_domain, zarafa_etc_t, zarafa_etc_t)
-+
-+kernel_read_system_state(zarafa_domain)
-+
-+files_read_etc_files(zarafa_domain)
-+
-+auth_use_nsswitch(zarafa_domain)
-+
-+miscfiles_read_localization(zarafa_domain)
+ # zarafa domains local policy
+ #
+
diff --git a/policy/modules/services/zebra.if b/policy/modules/services/zebra.if
index 6b87605..347f754 100644
--- a/policy/modules/services/zebra.if
@@ -56668,105 +52482,33 @@ index f9a06d2..3d407c6 100644
files_read_etc_files(zos_remote_t)
diff --git a/policy/modules/system/application.if b/policy/modules/system/application.if
-index ac50333..b784a12 100644
+index 1b6619e..c480ddd 100644
--- a/policy/modules/system/application.if
+++ b/policy/modules/system/application.if
-@@ -130,3 +130,93 @@ interface(`application_signull',`
+@@ -205,3 +205,21 @@ interface(`application_dontaudit_sigkill',`
- allow $1 application_domain_type:process signull;
+ dontaudit $1 application_domain_type:process sigkill;
')
+
-+########################################
-+## <summary>
-+## Dontaudit signull sent to all application domains.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`application_dontaudit_signull',`
-+ gen_require(`
-+ attribute application_domain_type;
-+ ')
-+
-+ dontaudit $1 application_domain_type:process signull;
-+')
-+
-+########################################
-+## <summary>
-+## Dontaudit signal sent to all application domains.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`application_dontaudit_signal',`
-+ gen_require(`
-+ attribute application_domain_type;
-+ ')
-+
-+ dontaudit $1 application_domain_type:process signal;
-+')
-+
-+########################################
-+## <summary>
-+## Dontaudit kill signal sent to all application domains.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`application_dontaudit_sigkill',`
-+ gen_require(`
-+ attribute application_domain_type;
-+ ')
-+
-+ dontaudit $1 application_domain_type:process sigkill;
-+')
-+
-+########################################
-+## <summary>
-+## Send signal to all application domains.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`application_signal',`
-+ gen_require(`
-+ attribute application_domain_type;
-+ ')
-+
-+ allow $1 application_domain_type:process signal;
-+')
-+
-+########################################
++#######################################
+## <summary>
-+## Getattr all application sockets.
++## Getattr all application sockets.
+## </summary>
+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
++## <summary>
++## Domain allowed access.
++## </summary>
+## </param>
+#
+interface(`application_getattr_socket',`
-+ gen_require(`
-+ attribute application_domain_type;
-+ ')
++ gen_require(`
++ attribute application_domain_type;
++ ')
+
-+ allow $1 application_domain_type:socket_class_set getattr;
++ allow $1 application_domain_type:socket_class_set getattr;
+')
diff --git a/policy/modules/system/application.te b/policy/modules/system/application.te
-index 88df85d..78e0fc2 100644
+index c6fdab7..41198a4 100644
--- a/policy/modules/system/application.te
+++ b/policy/modules/system/application.te
@@ -6,6 +6,24 @@ attribute application_domain_type;
@@ -56792,38 +52534,10 @@ index 88df85d..78e0fc2 100644
+')
+
optional_policy(`
- ssh_sigchld(application_domain_type)
- ssh_rw_stream_sockets(application_domain_type)
-diff --git a/policy/modules/system/authlogin.fc b/policy/modules/system/authlogin.fc
-index 2952cef..d845132 100644
---- a/policy/modules/system/authlogin.fc
-+++ b/policy/modules/system/authlogin.fc
-@@ -10,6 +10,7 @@
- /sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0)
- /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
- /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
-+/usr/sbin/validate -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
- /sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
- /sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
- ifdef(`distro_suse', `
-@@ -27,6 +28,7 @@ ifdef(`distro_gentoo', `
-
- /var/db/shadow.* -- gen_context(system_u:object_r:shadow_t,s0)
-
-+/var/run/user(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
- /var/lib/abl(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
- /var/lib/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
-
-@@ -39,6 +41,7 @@ ifdef(`distro_gentoo', `
- /var/log/wtmp.* -- gen_context(system_u:object_r:wtmp_t,s0)
-
- /var/run/console(/.*)? gen_context(system_u:object_r:pam_var_console_t,s0)
-+/var/run/faillock(/.*)? gen_context(system_u:object_r:faillog_t,s0)
- /var/run/pam_mount(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
- /var/run/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
- /var/run/sepermit(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
+ cron_sigchld(application_domain_type)
+ ')
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
-index 42b4f0f..0e6f84a 100644
+index 73554ec..e053e7d 100644
--- a/policy/modules/system/authlogin.if
+++ b/policy/modules/system/authlogin.if
@@ -57,6 +57,8 @@ interface(`auth_use_pam',`
@@ -56835,18 +52549,7 @@ index 42b4f0f..0e6f84a 100644
logging_send_audit_msgs($1)
logging_send_syslog_msg($1)
-@@ -66,6 +68,10 @@ interface(`auth_use_pam',`
- optional_policy(`
- consolekit_dbus_chat($1)
- ')
-+
-+ optional_policy(`
-+ fprintd_dbus_chat($1)
-+ ')
- ')
-
- optional_policy(`
-@@ -91,9 +97,12 @@ interface(`auth_use_pam',`
+@@ -95,9 +97,12 @@ interface(`auth_use_pam',`
interface(`auth_login_pgm_domain',`
gen_require(`
type var_auth_t, auth_cache_t;
@@ -56859,7 +52562,7 @@ index 42b4f0f..0e6f84a 100644
domain_subj_id_change_exemption($1)
domain_role_change_exemption($1)
domain_obj_id_change_exemption($1)
-@@ -107,8 +116,10 @@ interface(`auth_login_pgm_domain',`
+@@ -111,8 +116,10 @@ interface(`auth_login_pgm_domain',`
allow $1 self:capability ipc_lock;
allow $1 self:process setkeycreate;
allow $1 self:key manage_key_perms;
@@ -56870,7 +52573,7 @@ index 42b4f0f..0e6f84a 100644
manage_files_pattern($1, var_auth_t, var_auth_t)
manage_dirs_pattern($1, auth_cache_t, auth_cache_t)
-@@ -119,13 +130,19 @@ interface(`auth_login_pgm_domain',`
+@@ -123,13 +130,19 @@ interface(`auth_login_pgm_domain',`
# needed for afs - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=253321
kernel_rw_afs_state($1)
@@ -56891,7 +52594,7 @@ index 42b4f0f..0e6f84a 100644
selinux_get_fs_mount($1)
selinux_validate_context($1)
-@@ -141,6 +158,8 @@ interface(`auth_login_pgm_domain',`
+@@ -145,6 +158,8 @@ interface(`auth_login_pgm_domain',`
mls_process_set_level($1)
mls_fd_share_all_levels($1)
@@ -56900,7 +52603,7 @@ index 42b4f0f..0e6f84a 100644
auth_use_pam($1)
init_rw_utmp($1)
-@@ -151,13 +170,68 @@ interface(`auth_login_pgm_domain',`
+@@ -155,13 +170,68 @@ interface(`auth_login_pgm_domain',`
seutil_read_config($1)
seutil_read_default_contexts($1)
@@ -56971,11 +52674,7 @@ index 42b4f0f..0e6f84a 100644
## Use the login program as an entry point program.
## </summary>
## <param name="domain">
-@@ -361,17 +435,18 @@ interface(`auth_domtrans_chk_passwd',`
-
- optional_policy(`
- kerberos_read_keytab($1)
-- kerberos_connect_524($1)
+@@ -368,13 +438,15 @@ interface(`auth_domtrans_chk_passwd',`
')
optional_policy(`
@@ -56992,7 +52691,7 @@ index 42b4f0f..0e6f84a 100644
')
########################################
-@@ -418,6 +493,25 @@ interface(`auth_run_chk_passwd',`
+@@ -421,6 +493,25 @@ interface(`auth_run_chk_passwd',`
auth_domtrans_chk_passwd($1)
role $2 types chkpwd_t;
@@ -57018,16 +52717,7 @@ index 42b4f0f..0e6f84a 100644
')
########################################
-@@ -694,7 +788,7 @@ interface(`auth_relabel_shadow',`
- ')
-
- files_search_etc($1)
-- allow $1 shadow_t:file { relabelfrom relabelto };
-+ allow $1 shadow_t:file relabel_file_perms;
- typeattribute $1 can_relabelto_shadow_passwords;
- ')
-
-@@ -733,7 +827,47 @@ interface(`auth_rw_faillog',`
+@@ -736,7 +827,47 @@ interface(`auth_rw_faillog',`
')
logging_search_logs($1)
@@ -57076,54 +52766,7 @@ index 42b4f0f..0e6f84a 100644
')
#######################################
-@@ -874,6 +1008,46 @@ interface(`auth_exec_pam',`
-
- ########################################
- ## <summary>
-+## Read var auth files. Used by various other applications
-+## and pam applets etc.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`auth_read_var_auth',`
-+ gen_require(`
-+ type var_auth_t;
-+ ')
-+
-+ files_search_var($1)
-+ read_files_pattern($1, var_auth_t, var_auth_t)
-+')
-+
-+#######################################
-+## <summary>
-+## Read and write var auth files. Used by various other applications
-+## and pam applets etc.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`auth_rw_var_auth',`
-+ gen_require(`
-+ type var_auth_t;
-+ ')
-+
-+ files_search_var($1)
-+ rw_files_pattern($1, var_auth_t, var_auth_t)
-+')
-+
-+########################################
-+## <summary>
- ## Manage var auth files. Used by various other applications
- ## and pam applets etc.
- ## </summary>
-@@ -889,9 +1063,30 @@ interface(`auth_manage_var_auth',`
+@@ -932,9 +1063,30 @@ interface(`auth_manage_var_auth',`
')
files_search_var($1)
@@ -57157,32 +52800,7 @@ index 42b4f0f..0e6f84a 100644
')
########################################
-@@ -1093,6 +1288,24 @@ interface(`auth_delete_pam_console_data',`
-
- ########################################
- ## <summary>
-+## Relable all pid directories
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`auth_relabel_pam_console_data_dirs',`
-+ gen_require(`
-+ type pam_var_console_t;
-+ ')
-+
-+ relabel_dirs_pattern($1, pam_var_console_t, pam_var_console_t)
-+')
-+
-+########################################
-+## <summary>
- ## Read all directories on the filesystem, except
- ## the shadow passwords and listed exceptions.
- ## </summary>
-@@ -1326,6 +1539,25 @@ interface(`auth_setattr_login_records',`
+@@ -1387,6 +1539,25 @@ interface(`auth_setattr_login_records',`
########################################
## <summary>
@@ -57208,7 +52826,32 @@ index 42b4f0f..0e6f84a 100644
## Read login records files (/var/log/wtmp).
## </summary>
## <param name="domain">
-@@ -1500,28 +1732,36 @@ interface(`auth_manage_login_records',`
+@@ -1541,24 +1712,6 @@ interface(`auth_manage_login_records',`
+
+ ########################################
+ ## <summary>
+-## Relabel login record files.
+-## </summary>
+-## <param name="domain">
+-## <summary>
+-## Domain allowed access.
+-## </summary>
+-## </param>
+-#
+-interface(`auth_relabel_login_records',`
+- gen_require(`
+- type wtmp_t;
+- ')
+-
+- allow $1 wtmp_t:file relabel_file_perms;
+-')
+-
+-########################################
+-## <summary>
+ ## Use nsswitch to look up user, password, group, or
+ ## host information.
+ ## </summary>
+@@ -1579,28 +1732,36 @@ interface(`auth_relabel_login_records',`
#
interface(`auth_use_nsswitch',`
@@ -57252,25 +52895,17 @@ index 42b4f0f..0e6f84a 100644
optional_policy(`
kerberos_use($1)
')
-@@ -1531,7 +1771,15 @@ interface(`auth_use_nsswitch',`
+@@ -1610,7 +1771,7 @@ interface(`auth_use_nsswitch',`
')
optional_policy(`
- nscd_socket_use($1)
+ nscd_use($1)
-+ ')
-+
-+ optional_policy(`
-+ nslcd_stream_connect($1)
-+ ')
-+
-+ optional_policy(`
-+ sssd_stream_connect($1)
')
optional_policy(`
diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
-index 66d13c4..335900f 100644
+index b7a5f00..335900f 100644
--- a/policy/modules/system/authlogin.te
+++ b/policy/modules/system/authlogin.te
@@ -5,9 +5,24 @@ policy_module(authlogin, 2.2.1)
@@ -57298,15 +52933,6 @@ index 66d13c4..335900f 100644
type auth_cache_t;
logging_log_file(auth_cache_t)
-@@ -44,7 +59,7 @@ type pam_tmp_t;
- files_tmp_file(pam_tmp_t)
-
- type pam_var_console_t;
--files_type(pam_var_console_t)
-+files_pid_file(pam_var_console_t)
-
- type pam_var_run_t;
- files_pid_file(pam_var_run_t)
@@ -100,6 +115,8 @@ dev_read_urand(chkpwd_t)
files_read_etc_files(chkpwd_t)
# for nscd
@@ -57403,102 +53029,18 @@ index b9ed25b..de3738c 100644
domain_use_interactive_fds(hwclock_t)
diff --git a/policy/modules/system/daemontools.if b/policy/modules/system/daemontools.if
-index 89cc088..81e5ed4 100644
+index ce3e676..0158314 100644
--- a/policy/modules/system/daemontools.if
+++ b/policy/modules/system/daemontools.if
-@@ -71,6 +71,32 @@ interface(`daemontools_domtrans_start',`
- domtrans_pattern($1, svc_start_exec_t, svc_start_t)
- ')
-
-+######################################
-+## <summary>
-+## Execute svc_start in the svc_start domain, and
-+## allow the specified role the svc_start domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <param name="role">
-+## <summary>
-+## The role to be allowed the svc_start domain.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`daemonstools_run_start',`
-+ gen_require(`
-+ type svc_start_t;
-+ ')
-+
-+ daemontools_domtrans_start($1)
-+ role $2 types svc_start_t;
-+')
-+
- ########################################
- ## <summary>
- ## Execute in the svc_run_t domain.
-@@ -127,6 +153,24 @@ interface(`daemontools_read_svc',`
- allow $1 svc_svc_t:file read_file_perms;
- ')
-
-+######################################
-+## <summary>
-+## Search svc_svc_t directory.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`daemontools_search_svc_dir',`
-+ gen_require(`
-+ type svc_svc_t;
-+ ')
-+
-+ allow $1 svc_svc_t:dir search_dir_perms;
-+')
-+
- ########################################
- ## <summary>
- ## Allow a domain to create svc_svc_t files.
-@@ -148,3 +192,21 @@ interface(`daemontools_manage_svc',`
+@@ -210,3 +210,4 @@ interface(`daemontools_manage_svc',`
allow $1 svc_svc_t:file manage_file_perms;
allow $1 svc_svc_t:lnk_file { read create };
')
+
-+######################################
-+## <summary>
-+## Send a SIGCHLD signal to svc_run domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`daemontools_sigchld_run',`
-+ gen_require(`
-+ type svc_run_t;
-+ ')
-+
-+ allow $1 svc_run_t:process sigchld;
-+')
diff --git a/policy/modules/system/daemontools.te b/policy/modules/system/daemontools.te
-index 183fcf1..d923d03 100644
+index dcc5f1c..5610417 100644
--- a/policy/modules/system/daemontools.te
+++ b/policy/modules/system/daemontools.te
-@@ -6,7 +6,7 @@ policy_module(daemontools, 1.2.0)
- #
-
- type svc_conf_t;
--files_type(svc_conf_t)
-+files_config_file(svc_conf_t)
-
- type svc_log_t;
- files_type(svc_log_t)
@@ -38,7 +38,10 @@ files_type(svc_svc_t)
# multilog creates /service/*/log/status
manage_files_pattern(svc_multilog_t, svc_svc_t, svc_svc_t)
@@ -57510,21 +53052,7 @@ index 183fcf1..d923d03 100644
# writes to /var/log/*/*
logging_manage_generic_logs(svc_multilog_t)
-@@ -52,7 +55,7 @@ daemontools_ipc_domain(svc_multilog_t)
- # ie. softlimit, setuidgid, envuidgid, envdir, fghack ..
- #
-
--allow svc_run_t self:capability { setgid setuid chown fsetid };
-+allow svc_run_t self:capability { setgid setuid chown fsetid sys_resource };
- allow svc_run_t self:process setrlimit;
- allow svc_run_t self:fifo_file rw_fifo_file_perms;
- allow svc_run_t self:unix_stream_socket create_stream_socket_perms;
-@@ -64,9 +67,13 @@ can_exec(svc_run_t, svc_run_exec_t)
-
- kernel_read_system_state(svc_run_t)
-
-+dev_read_urand(svc_run_t)
-+
+@@ -69,6 +72,8 @@ dev_read_urand(svc_run_t)
corecmd_exec_bin(svc_run_t)
corecmd_exec_shell(svc_run_t)
@@ -57533,25 +53061,15 @@ index 183fcf1..d923d03 100644
files_read_etc_files(svc_run_t)
files_read_etc_runtime_files(svc_run_t)
files_search_pids(svc_run_t)
-@@ -88,21 +95,36 @@ optional_policy(`
- # ie svc, svscan, supervise ...
- #
-
--allow svc_start_t svc_run_t:process signal;
-+allow svc_start_t svc_run_t:process { signal setrlimit };
-
- allow svc_start_t self:fifo_file rw_fifo_file_perms;
- allow svc_start_t self:capability kill;
-+allow svc_start_t self:tcp_socket create_stream_socket_perms;
- allow svc_start_t self:unix_stream_socket create_socket_perms;
+@@ -99,17 +104,28 @@ allow svc_start_t self:unix_stream_socket create_socket_perms;
can_exec(svc_start_t, svc_start_exec_t)
+mmap_files_pattern(svc_start_t, svc_svc_t, svc_svc_t)
+
-+kernel_read_kernel_sysctls(svc_start_t)
-+kernel_read_system_state(svc_start_t)
-+
+ kernel_read_kernel_sysctls(svc_start_t)
+ kernel_read_system_state(svc_start_t)
+
corecmd_exec_bin(svc_start_t)
corecmd_exec_shell(svc_start_t)
@@ -57571,6 +53089,7 @@ index 183fcf1..d923d03 100644
+
daemontools_domtrans_run(svc_start_t)
daemontools_manage_svc(svc_start_t)
+
diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
index a97a096..ab1e16a 100644
--- a/policy/modules/system/fstools.fc
@@ -57598,35 +53117,10 @@ index a97a096..ab1e16a 100644
/usr/bin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/scsi_unique_id -- gen_context(system_u:object_r:fsadm_exec_t,s0)
diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te
-index a442acc..028a90f 100644
+index c28da1c..73883c4 100644
--- a/policy/modules/system/fstools.te
+++ b/policy/modules/system/fstools.te
-@@ -55,6 +55,7 @@ allow fsadm_t swapfile_t:file { rw_file_perms swapon };
-
- kernel_read_system_state(fsadm_t)
- kernel_read_kernel_sysctls(fsadm_t)
-+kernel_request_load_module(fsadm_t)
- # Allow console log change (updfstab)
- kernel_change_ring_buffer_level(fsadm_t)
- # mkreiserfs needs this
-@@ -78,6 +79,7 @@ dev_dontaudit_getattr_generic_files(fsadm_t)
- # mkreiserfs and other programs need this for UUID
- dev_read_rand(fsadm_t)
- dev_read_urand(fsadm_t)
-+dev_write_kmsg(fsadm_t)
- # Recreate /dev/cdrom.
- dev_manage_generic_symlinks(fsadm_t)
- # fdisk needs this for early boot
-@@ -85,7 +87,7 @@ dev_manage_generic_blk_files(fsadm_t)
- # Access to /initrd devices
- dev_search_usbfs(fsadm_t)
- # for swapon
--dev_read_sysfs(fsadm_t)
-+dev_rw_sysfs(fsadm_t)
- # Access to /initrd devices
- dev_getattr_usbfs_dirs(fsadm_t)
- # Access to /dev/mapper/control
-@@ -99,6 +101,8 @@ files_read_usr_files(fsadm_t)
+@@ -101,6 +101,8 @@ files_read_usr_files(fsadm_t)
files_read_etc_files(fsadm_t)
files_manage_lost_found(fsadm_t)
files_manage_isid_type_dirs(fsadm_t)
@@ -57635,11 +53129,7 @@ index a442acc..028a90f 100644
# Write to /etc/mtab.
files_manage_etc_runtime_files(fsadm_t)
files_etc_filetrans_etc_runtime(fsadm_t, file)
-@@ -114,9 +118,13 @@ fs_rw_tmpfs_files(fsadm_t)
- # remount file system to apply changes
- fs_remount_xattr_fs(fsadm_t)
- # for /dev/shm
-+fs_list_auto_mountpoints(fsadm_t)
+@@ -120,6 +122,9 @@ fs_list_auto_mountpoints(fsadm_t)
fs_search_tmpfs(fsadm_t)
fs_getattr_tmpfs_dirs(fsadm_t)
fs_read_tmpfs_symlinks(fsadm_t)
@@ -57649,7 +53139,7 @@ index a442acc..028a90f 100644
# Recreate /mnt/cdrom.
files_manage_mnt_dirs(fsadm_t)
# for tune2fs
-@@ -130,10 +138,12 @@ storage_raw_write_fixed_disk(fsadm_t)
+@@ -133,10 +138,12 @@ storage_raw_write_fixed_disk(fsadm_t)
storage_raw_read_removable_device(fsadm_t)
storage_raw_write_removable_device(fsadm_t)
storage_read_scsi_generic(fsadm_t)
@@ -57662,13 +53152,8 @@ index a442acc..028a90f 100644
init_use_fds(fsadm_t)
init_use_script_ptys(fsadm_t)
init_dontaudit_getattr_initctl(fsadm_t)
-@@ -142,18 +152,15 @@ logging_send_syslog_msg(fsadm_t)
-
- miscfiles_read_localization(fsadm_t)
+@@ -147,13 +154,13 @@ miscfiles_read_localization(fsadm_t)
--modutils_read_module_config(fsadm_t)
--modutils_read_module_deps(fsadm_t)
--
seutil_read_config(fsadm_t)
-userdom_use_user_terminals(fsadm_t)
@@ -57687,7 +53172,7 @@ index a442acc..028a90f 100644
optional_policy(`
amanda_rw_dumpdates_files(fsadm_t)
-@@ -166,6 +173,24 @@ optional_policy(`
+@@ -166,6 +173,11 @@ optional_policy(`
')
optional_policy(`
@@ -57696,30 +53181,13 @@ index a442acc..028a90f 100644
+')
+
+optional_policy(`
-+ hal_dontaudit_write_log(fsadm_t)
-+')
-+
-+optional_policy(`
-+ livecd_rw_tmp_files(fsadm_t)
-+')
-+
-+optional_policy(`
-+ modutils_read_module_config(fsadm_t)
-+ modutils_read_module_deps(fsadm_t)
-+')
-+
-+optional_policy(`
- nis_use_ypbind(fsadm_t)
+ hal_dontaudit_write_log(fsadm_t)
')
-@@ -175,6 +200,14 @@ optional_policy(`
+@@ -192,6 +204,10 @@ optional_policy(`
')
optional_policy(`
-+ udev_read_db(fsadm_t)
-+')
-+
-+optional_policy(`
+ virt_read_blk_images(fsadm_t)
+')
+
@@ -57774,32 +53242,6 @@ index c310775..ec32c5e 100644
logging_send_syslog_msg(hostname_t)
-diff --git a/policy/modules/system/hotplug.te b/policy/modules/system/hotplug.te
-index 882c6a2..d0ff4ec 100644
---- a/policy/modules/system/hotplug.te
-+++ b/policy/modules/system/hotplug.te
-@@ -105,9 +105,6 @@ libs_read_lib_files(hotplug_t)
- miscfiles_read_hwdata(hotplug_t)
- miscfiles_read_localization(hotplug_t)
-
--modutils_domtrans_insmod(hotplug_t)
--modutils_read_module_deps(hotplug_t)
--
- seutil_dontaudit_search_config(hotplug_t)
-
- sysnet_read_config(hotplug_t)
-@@ -154,6 +151,11 @@ optional_policy(`
- ')
-
- optional_policy(`
-+ modutils_domtrans_insmod(hotplug_t)
-+ modutils_read_module_deps(hotplug_t)
-+')
-+
-+optional_policy(`
- mount_domtrans(hotplug_t)
- ')
-
diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
index 354ce93..b8b14b9 100644
--- a/policy/modules/system/init.fc
@@ -57845,7 +53287,7 @@ index 354ce93..b8b14b9 100644
')
+/var/run/systemd(/.*)? gen_context(system_u:object_r:init_var_run_t,s0)
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
-index cc83689..6569096 100644
+index 94fd8dd..2ae760f 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -79,6 +79,41 @@ interface(`init_script_domain',`
@@ -58633,7 +54075,7 @@ index cc83689..6569096 100644
+ read_fifo_files_pattern($1, initrc_var_run_t, initrc_var_run_t)
+')
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index ea29513..34ac96c 100644
+index 29a9565..ad617a2 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -16,6 +16,34 @@ gen_require(`
@@ -59383,16 +54825,7 @@ index ea29513..34ac96c 100644
')
optional_policy(`
-@@ -781,14 +1108,21 @@ optional_policy(`
- ')
-
- optional_policy(`
-+ # shorewall-init script run /var/lib/shorewall/firewall
-+ shorewall_domtrans_lib(initrc_t)
-+')
-+
-+optional_policy(`
- squid_read_config(initrc_t)
+@@ -790,10 +1117,12 @@ optional_policy(`
squid_manage_logs(initrc_t)
')
@@ -59405,7 +54838,7 @@ index ea29513..34ac96c 100644
optional_policy(`
ssh_dontaudit_read_server_keys(initrc_t)
-@@ -800,7 +1134,6 @@ optional_policy(`
+@@ -805,7 +1134,6 @@ optional_policy(`
')
optional_policy(`
@@ -59413,7 +54846,7 @@ index ea29513..34ac96c 100644
udev_manage_pid_files(initrc_t)
udev_manage_rules_files(initrc_t)
')
-@@ -810,11 +1143,24 @@ optional_policy(`
+@@ -815,11 +1143,24 @@ optional_policy(`
')
optional_policy(`
@@ -59439,7 +54872,7 @@ index ea29513..34ac96c 100644
ifdef(`distro_redhat',`
# system-config-services causes avc messages that should be dontaudited
-@@ -824,6 +1170,25 @@ optional_policy(`
+@@ -829,6 +1170,25 @@ optional_policy(`
optional_policy(`
mono_domtrans(initrc_t)
')
@@ -59465,7 +54898,7 @@ index ea29513..34ac96c 100644
')
optional_policy(`
-@@ -839,6 +1204,10 @@ optional_policy(`
+@@ -844,6 +1204,10 @@ optional_policy(`
')
optional_policy(`
@@ -59476,7 +54909,7 @@ index ea29513..34ac96c 100644
# Set device ownerships/modes.
xserver_setattr_console_pipes(initrc_t)
-@@ -849,3 +1218,45 @@ optional_policy(`
+@@ -854,3 +1218,45 @@ optional_policy(`
optional_policy(`
zebra_read_config(initrc_t)
')
@@ -59523,7 +54956,7 @@ index ea29513..34ac96c 100644
+
+init_stream_connect(initrc_t)
diff --git a/policy/modules/system/ipsec.fc b/policy/modules/system/ipsec.fc
-index 07eba2b..a75297a 100644
+index fb09b9e..e25c6b6 100644
--- a/policy/modules/system/ipsec.fc
+++ b/policy/modules/system/ipsec.fc
@@ -12,12 +12,12 @@
@@ -59545,11 +54978,9 @@ index 07eba2b..a75297a 100644
/usr/libexec/ipsec/_plutoload -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
/usr/libexec/ipsec/_plutorun -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
-@@ -25,16 +25,19 @@
- /usr/libexec/ipsec/klipsdebug -- gen_context(system_u:object_r:ipsec_exec_t,s0)
- /usr/libexec/ipsec/pluto -- gen_context(system_u:object_r:ipsec_exec_t,s0)
+@@ -27,10 +27,10 @@
/usr/libexec/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0)
-+/usr/libexec/nm-openswan-service -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
+ /usr/libexec/nm-openswan-service -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
-/usr/local/lib(64)?/ipsec/eroute -- gen_context(system_u:object_r:ipsec_exec_t,s0)
-/usr/local/lib(64)?/ipsec/klipsdebug -- gen_context(system_u:object_r:ipsec_exec_t,s0)
@@ -59562,43 +54993,35 @@ index 07eba2b..a75297a 100644
/usr/sbin/ipsec -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
/usr/sbin/racoon -- gen_context(system_u:object_r:racoon_exec_t,s0)
- /usr/sbin/setkey -- gen_context(system_u:object_r:setkey_exec_t,s0)
-
-+/var/lock/subsys/ipsec -- gen_context(system_u:object_r:ipsec_mgmt_lock_t,s0)
-+
- /var/log/pluto\.log -- gen_context(system_u:object_r:ipsec_log_t,s0)
-
- /var/racoon(/.*)? gen_context(system_u:object_r:ipsec_var_run_t,s0)
diff --git a/policy/modules/system/ipsec.if b/policy/modules/system/ipsec.if
-index 8232f91..8897e32 100644
+index 0d4c8d3..9d66bf7 100644
--- a/policy/modules/system/ipsec.if
+++ b/policy/modules/system/ipsec.if
-@@ -20,6 +20,24 @@ interface(`ipsec_domtrans',`
-
- ########################################
- ## <summary>
-+## Execute ipsec in the ipsec mgmt domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`ipsec_domtrans_mgmt',`
-+ gen_require(`
-+ type ipsec_mgmt_t, ipsec_mgmt_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, ipsec_mgmt_exec_t, ipsec_mgmt_t)
-+')
-+
-+########################################
-+## <summary>
- ## Connect to IPSEC using a unix domain stream socket.
- ## </summary>
- ## <param name="domain">
-@@ -129,6 +147,7 @@ interface(`ipsec_match_default_spd',`
+@@ -120,7 +120,6 @@ interface(`ipsec_exec_mgmt',`
+ ## </summary>
+ ## </param>
+ #
+-#
+ interface(`ipsec_signal_mgmt',`
+ gen_require(`
+ type ipsec_mgmt_t;
+@@ -139,7 +138,6 @@ interface(`ipsec_signal_mgmt',`
+ ## </summary>
+ ## </param>
+ #
+-#
+ interface(`ipsec_signull_mgmt',`
+ gen_require(`
+ type ipsec_mgmt_t;
+@@ -158,7 +156,6 @@ interface(`ipsec_signull_mgmt',`
+ ## </summary>
+ ## </param>
+ #
+-#
+ interface(`ipsec_kill_mgmt',`
+ gen_require(`
+ type ipsec_mgmt_t;
+@@ -225,6 +222,7 @@ interface(`ipsec_match_default_spd',`
allow $1 ipsec_spd_t:association polmatch;
allow $1 self:association sendto;
@@ -59606,125 +55029,11 @@ index 8232f91..8897e32 100644
')
########################################
-@@ -273,3 +292,81 @@ interface(`ipsec_run_setkey',`
- ipsec_domtrans_setkey($1)
- role $2 types setkey_t;
- ')
-+
-+########################################
-+## <summary>
-+## Send ipsec mgmt a signal
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+#
-+interface(`ipsec_signal_mgmt',`
-+ gen_require(`
-+ type ipsec_mgmt_t;
-+ ')
-+
-+ allow $1 ipsec_mgmt_t:process signal;
-+')
-+
-+########################################
-+## <summary>
-+## Send ipsec mgmt a signull
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+#
-+interface(`ipsec_signull_mgmt',`
-+ gen_require(`
-+ type ipsec_mgmt_t;
-+ ')
-+
-+ allow $1 ipsec_mgmt_t:process signull;
-+')
-+
-+########################################
-+## <summary>
-+## Send ipsec mgmt a kill signal.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+#
-+interface(`ipsec_kill_mgmt',`
-+ gen_require(`
-+ type ipsec_mgmt_t;
-+ ')
-+
-+ allow $1 ipsec_mgmt_t:process sigkill;
-+')
-+
-+######################################
-+## <summary>
-+## Send and receive messages from
-+## ipsec-mgmt over dbus.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`ipsec_mgmt_dbus_chat',`
-+ gen_require(`
-+ type ipsec_mgmt_t;
-+ class dbus send_msg;
-+ ')
-+
-+ allow $1 ipsec_mgmt_t:dbus send_msg;
-+ allow ipsec_mgmt_t $1:dbus send_msg;
-+')
diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te
-index 98d6081..e46bdda 100644
+index 55a6cd8..bec6385 100644
--- a/policy/modules/system/ipsec.te
+++ b/policy/modules/system/ipsec.te
-@@ -73,7 +73,7 @@ role system_r types setkey_t;
- #
-
- allow ipsec_t self:capability { net_admin dac_override dac_read_search setpcap sys_nice };
--dontaudit ipsec_t self:capability sys_tty_config;
-+dontaudit ipsec_t self:capability { sys_ptrace sys_tty_config };
- allow ipsec_t self:process { getcap setcap getsched signal setsched };
- allow ipsec_t self:tcp_socket create_stream_socket_perms;
- allow ipsec_t self:udp_socket create_socket_perms;
-@@ -95,9 +95,10 @@ manage_dirs_pattern(ipsec_t, ipsec_tmp_t, ipsec_tmp_t)
- manage_files_pattern(ipsec_t, ipsec_tmp_t, ipsec_tmp_t)
- files_tmp_filetrans(ipsec_t, ipsec_tmp_t, { dir file })
-
-+manage_dirs_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t)
- manage_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t)
- manage_sock_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t)
--files_pid_filetrans(ipsec_t, ipsec_var_run_t, { file sock_file })
-+files_pid_filetrans(ipsec_t, ipsec_var_run_t, { dir file sock_file })
-
- can_exec(ipsec_t, ipsec_mgmt_exec_t)
-
-@@ -108,8 +109,8 @@ can_exec(ipsec_t, ipsec_mgmt_exec_t)
- corecmd_shell_domtrans(ipsec_t, ipsec_mgmt_t)
- allow ipsec_mgmt_t ipsec_t:fd use;
- allow ipsec_mgmt_t ipsec_t:fifo_file rw_fifo_file_perms;
--dontaudit ipsec_mgmt_t ipsec_t:unix_stream_socket { read write };
--allow ipsec_mgmt_t ipsec_t:process sigchld;
-+allow ipsec_mgmt_t ipsec_t:unix_stream_socket { read write };
-+allow ipsec_mgmt_t ipsec_t:process { rlimitinh sigchld };
-
- kernel_read_kernel_sysctls(ipsec_t)
- kernel_list_proc(ipsec_t)
-@@ -127,13 +128,13 @@ corecmd_exec_bin(ipsec_t)
+@@ -128,13 +128,13 @@ corecmd_exec_bin(ipsec_t)
# Pluto needs network access
corenet_all_recvfrom_unlabeled(ipsec_t)
@@ -59744,15 +55053,7 @@ index 98d6081..e46bdda 100644
corenet_tcp_bind_reserved_port(ipsec_t)
corenet_tcp_bind_isakmp_port(ipsec_t)
corenet_udp_bind_isakmp_port(ipsec_t)
-@@ -150,6 +151,7 @@ domain_use_interactive_fds(ipsec_t)
- files_list_tmp(ipsec_t)
- files_read_etc_files(ipsec_t)
- files_read_usr_files(ipsec_t)
-+files_dontaudit_search_home(ipsec_t)
-
- fs_getattr_all_fs(ipsec_t)
- fs_search_auto_mountpoints(ipsec_t)
-@@ -167,6 +169,8 @@ logging_send_syslog_msg(ipsec_t)
+@@ -169,6 +169,8 @@ logging_send_syslog_msg(ipsec_t)
miscfiles_read_localization(ipsec_t)
sysnet_domtrans_ifconfig(ipsec_t)
@@ -59761,26 +55062,7 @@ index 98d6081..e46bdda 100644
userdom_dontaudit_use_unpriv_user_fds(ipsec_t)
userdom_dontaudit_search_user_home_dirs(ipsec_t)
-@@ -185,8 +189,8 @@ optional_policy(`
- #
-
- allow ipsec_mgmt_t self:capability { dac_override dac_read_search net_admin setpcap sys_nice };
--dontaudit ipsec_mgmt_t self:capability sys_tty_config;
--allow ipsec_mgmt_t self:process { getsched ptrace setrlimit signal };
-+dontaudit ipsec_mgmt_t self:capability { sys_ptrace sys_tty_config };
-+allow ipsec_mgmt_t self:process { getsched ptrace setrlimit setsched signal };
- allow ipsec_mgmt_t self:unix_stream_socket create_stream_socket_perms;
- allow ipsec_mgmt_t self:tcp_socket create_stream_socket_perms;
- allow ipsec_mgmt_t self:udp_socket create_socket_perms;
-@@ -225,7 +229,6 @@ allow ipsec_mgmt_t ipsec_conf_file_t:file read_file_perms;
-
- manage_files_pattern(ipsec_mgmt_t, ipsec_key_file_t, ipsec_key_file_t)
- manage_lnk_files_pattern(ipsec_mgmt_t, ipsec_key_file_t, ipsec_key_file_t)
--files_etc_filetrans(ipsec_mgmt_t, ipsec_key_file_t, file)
-
- # whack needs to connect to pluto
- stream_connect_pattern(ipsec_mgmt_t, ipsec_var_run_t, ipsec_var_run_t, ipsec_t)
-@@ -244,6 +247,17 @@ kernel_read_kernel_sysctls(ipsec_mgmt_t)
+@@ -245,6 +247,17 @@ kernel_read_kernel_sysctls(ipsec_mgmt_t)
kernel_getattr_core_if(ipsec_mgmt_t)
kernel_getattr_message_if(ipsec_mgmt_t)
@@ -59798,73 +55080,25 @@ index 98d6081..e46bdda 100644
files_read_kernel_symbol_table(ipsec_mgmt_t)
files_getattr_kernel_modules(ipsec_mgmt_t)
-@@ -258,7 +272,7 @@ dev_read_urand(ipsec_mgmt_t)
-
- domain_use_interactive_fds(ipsec_mgmt_t)
- # denials when ps tries to search /proc. Do not audit these denials.
--domain_dontaudit_list_all_domains_state(ipsec_mgmt_t)
-+domain_dontaudit_read_all_domains_state(ipsec_mgmt_t)
- # suppress audit messages about unnecessary socket access
- # cjp: this seems excessive
- domain_dontaudit_rw_all_udp_sockets(ipsec_mgmt_t)
-@@ -276,8 +290,11 @@ fs_getattr_xattr_fs(ipsec_mgmt_t)
+@@ -277,7 +290,7 @@ fs_getattr_xattr_fs(ipsec_mgmt_t)
fs_list_tmpfs(ipsec_mgmt_t)
term_use_console(ipsec_mgmt_t)
-term_dontaudit_getattr_unallocated_ttys(ipsec_mgmt_t)
+term_use_all_inherited_terms(ipsec_mgmt_t)
-+auth_dontaudit_read_login_records(ipsec_mgmt_t)
-+
-+init_read_utmp(ipsec_mgmt_t)
- init_use_script_ptys(ipsec_mgmt_t)
- init_exec_script_files(ipsec_mgmt_t)
- init_use_fds(ipsec_mgmt_t)
-@@ -287,19 +304,40 @@ logging_send_syslog_msg(ipsec_mgmt_t)
-
- miscfiles_read_localization(ipsec_mgmt_t)
-
--modutils_domtrans_insmod(ipsec_mgmt_t)
--
- seutil_dontaudit_search_config(ipsec_mgmt_t)
+ auth_dontaudit_read_login_records(ipsec_mgmt_t)
-+sysnet_manage_config(ipsec_mgmt_t)
+@@ -297,7 +310,7 @@ sysnet_manage_config(ipsec_mgmt_t)
sysnet_domtrans_ifconfig(ipsec_mgmt_t)
-+sysnet_etc_filetrans_config(ipsec_mgmt_t)
+ sysnet_etc_filetrans_config(ipsec_mgmt_t)
-userdom_use_user_terminals(ipsec_mgmt_t)
+userdom_use_inherited_user_terminals(ipsec_mgmt_t)
optional_policy(`
consoletype_exec(ipsec_mgmt_t)
- ')
-
- optional_policy(`
-+ hostname_exec(ipsec_mgmt_t)
-+')
-+
-+optional_policy(`
-+ dbus_system_bus_client(ipsec_mgmt_t)
-+ dbus_connect_system_bus(ipsec_mgmt_t)
-+
-+ optional_policy(`
-+ networkmanager_dbus_chat(ipsec_mgmt_t)
-+ ')
-+')
-+
-+optional_policy(`
-+ iptables_domtrans(ipsec_mgmt_t)
-+')
-+
-+optional_policy(`
-+ modutils_domtrans_insmod(ipsec_mgmt_t)
-+')
-+
-+optional_policy(`
- nscd_socket_use(ipsec_mgmt_t)
- ')
-
-@@ -352,12 +390,12 @@ corecmd_exec_shell(racoon_t)
+@@ -377,12 +390,12 @@ corecmd_exec_shell(racoon_t)
corecmd_exec_bin(racoon_t)
corenet_all_recvfrom_unlabeled(racoon_t)
@@ -59883,7 +55117,7 @@ index 98d6081..e46bdda 100644
corenet_udp_bind_isakmp_port(racoon_t)
corenet_udp_bind_ipsecnat_port(racoon_t)
-@@ -386,6 +424,8 @@ miscfiles_read_localization(racoon_t)
+@@ -411,6 +424,8 @@ miscfiles_read_localization(racoon_t)
sysnet_exec_ifconfig(racoon_t)
@@ -59892,15 +55126,7 @@ index 98d6081..e46bdda 100644
auth_can_read_shadow_passwords(racoon_t)
tunable_policy(`racoon_read_shadow',`
auth_tunable_read_shadow(racoon_t)
-@@ -412,6 +452,7 @@ domain_ipsec_setcontext_all_domains(setkey_t)
- files_read_etc_files(setkey_t)
-
- init_dontaudit_use_fds(setkey_t)
-+init_read_script_tmp_files(setkey_t)
-
- # allow setkey to set the context for ipsec SAs and policy.
- corenet_setcontext_all_spds(setkey_t)
-@@ -422,5 +463,6 @@ miscfiles_read_localization(setkey_t)
+@@ -448,5 +463,6 @@ miscfiles_read_localization(setkey_t)
seutil_read_config(setkey_t)
@@ -59909,48 +55135,29 @@ index 98d6081..e46bdda 100644
+userdom_read_user_tmp_files(setkey_t)
diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
-index 13f62a6..fd99a6e 100644
+index 05fb364..2538de7 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
-@@ -1,12 +1,19 @@
+@@ -1,7 +1,5 @@
/etc/rc\.d/init\.d/ip6?tables -- gen_context(system_u:object_r:iptables_initrc_exec_t,s0)
+-/etc/rc\.d/init\.d/ebtables -- gen_context(system_u:object_r:iptables_initrc_exec_t,s0)
-/etc/sysconfig/ip6?tables.* -- gen_context(system_u:object_r:iptables_conf_t,s0)
-/etc/sysconfig/system-config-firewall.* -- gen_context(system_u:object_r:iptables_conf_t,s0)
+/etc/rc\.d/init\.d/ebtables -- gen_context(system_u:object_r:iptables_initrc_exec_t,s0)
- /sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
- /sbin/ip6?tables -- gen_context(system_u:object_r:iptables_exec_t,s0)
- /sbin/ip6?tables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
- /sbin/ip6?tables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
-
-+/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0)
-+/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
-+
-+/sbin/ipvsadm -- gen_context(system_u:object_r:iptables_exec_t,s0)
-+/sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
-+/sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
-+
-+
- /usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
- /usr/sbin/iptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
- /usr/sbin/iptables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
-diff --git a/policy/modules/system/iptables.if b/policy/modules/system/iptables.if
-index 5c94dfe..59bfb17 100644
---- a/policy/modules/system/iptables.if
-+++ b/policy/modules/system/iptables.if
-@@ -17,6 +17,10 @@ interface(`iptables_domtrans',`
-
- corecmd_search_bin($1)
- domtrans_pattern($1, iptables_exec_t, iptables_t)
-+
-+ ifdef(`hide_broken_symptoms', `
-+ dontaudit iptables_t $1:socket_class_set { read write };
-+ ')
- ')
-
- ########################################
+ /sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0)
+ /sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
+@@ -12,8 +10,3 @@
+ /sbin/ipvsadm -- gen_context(system_u:object_r:iptables_exec_t,s0)
+ /sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
+ /sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
+-
+-/usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
+-/usr/sbin/iptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
+-/usr/sbin/iptables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
+-/usr/sbin/iptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te
-index a3fdcb3..66f2959 100644
+index f3e1b57..a7b2adc 100644
--- a/policy/modules/system/iptables.te
+++ b/policy/modules/system/iptables.te
@@ -13,9 +13,6 @@ role system_r types iptables_t;
@@ -59963,12 +55170,8 @@ index a3fdcb3..66f2959 100644
type iptables_tmp_t;
files_tmp_file(iptables_tmp_t)
-@@ -31,10 +28,12 @@ allow iptables_t self:capability { dac_read_search dac_override net_admin net_ra
- dontaudit iptables_t self:capability sys_tty_config;
- allow iptables_t self:fifo_file rw_fifo_file_perms;
- allow iptables_t self:process { sigchld sigkill sigstop signull signal };
-+# needed by ipvsadm
-+allow iptables_t self:netlink_socket create_socket_perms;
+@@ -34,8 +31,8 @@ allow iptables_t self:process { sigchld sigkill sigstop signull signal };
+ allow iptables_t self:netlink_socket create_socket_perms;
allow iptables_t self:rawip_socket create_socket_perms;
-manage_files_pattern(iptables_t, iptables_conf_t, iptables_conf_t)
@@ -59978,15 +55181,7 @@ index a3fdcb3..66f2959 100644
manage_files_pattern(iptables_t, iptables_var_run_t, iptables_var_run_t)
files_pid_filetrans(iptables_t, iptables_var_run_t, file)
-@@ -52,10 +51,17 @@ kernel_read_kernel_sysctls(iptables_t)
- kernel_read_modprobe_sysctls(iptables_t)
- kernel_use_fds(iptables_t)
-
-+# needed by ipvsadm
-+corecmd_exec_bin(iptables_t)
-+corecmd_exec_shell(iptables_t)
-+
- corenet_relabelto_all_packets(iptables_t)
+@@ -61,6 +58,9 @@ corenet_relabelto_all_packets(iptables_t)
corenet_dontaudit_rw_tun_tap_dev(iptables_t)
dev_read_sysfs(iptables_t)
@@ -59996,7 +55191,7 @@ index a3fdcb3..66f2959 100644
fs_getattr_xattr_fs(iptables_t)
fs_search_auto_mountpoints(iptables_t)
-@@ -64,11 +70,13 @@ fs_list_inotifyfs(iptables_t)
+@@ -69,11 +69,13 @@ fs_list_inotifyfs(iptables_t)
mls_file_read_all_levels(iptables_t)
term_dontaudit_use_console(iptables_t)
@@ -60011,7 +55206,7 @@ index a3fdcb3..66f2959 100644
auth_use_nsswitch(iptables_t)
-@@ -77,6 +85,7 @@ init_use_script_ptys(iptables_t)
+@@ -82,6 +84,7 @@ init_use_script_ptys(iptables_t)
# to allow rules to be saved on reboot:
init_rw_script_tmp_files(iptables_t)
init_rw_script_stream_sockets(iptables_t)
@@ -60019,7 +55214,7 @@ index a3fdcb3..66f2959 100644
logging_send_syslog_msg(iptables_t)
-@@ -85,11 +94,13 @@ miscfiles_read_localization(iptables_t)
+@@ -90,7 +93,7 @@ miscfiles_read_localization(iptables_t)
sysnet_domtrans_ifconfig(iptables_t)
sysnet_dns_name_resolve(iptables_t)
@@ -60027,6 +55222,9 @@ index a3fdcb3..66f2959 100644
+userdom_use_inherited_user_terminals(iptables_t)
userdom_use_all_users_fds(iptables_t)
+ ifdef(`hide_broken_symptoms',`
+@@ -99,6 +102,8 @@ ifdef(`hide_broken_symptoms',`
+
optional_policy(`
fail2ban_append_log(iptables_t)
+ fail2ban_dontaudit_leaks(iptables_t)
@@ -60034,7 +55232,7 @@ index a3fdcb3..66f2959 100644
')
optional_policy(`
-@@ -112,6 +123,7 @@ optional_policy(`
+@@ -121,6 +126,7 @@ optional_policy(`
optional_policy(`
psad_rw_tmp_files(iptables_t)
@@ -60042,65 +55240,19 @@ index a3fdcb3..66f2959 100644
')
optional_policy(`
-@@ -124,6 +136,8 @@ optional_policy(`
-
+@@ -134,6 +140,7 @@ optional_policy(`
optional_policy(`
+ shorewall_read_tmp_files(iptables_t)
shorewall_rw_lib_files(iptables_t)
+ shorewall_read_tmp_files(iptables_t)
-+ shorewall_read_config(iptables_t)
+ shorewall_read_config(iptables_t)
')
- optional_policy(`
-diff --git a/policy/modules/system/iscsi.if b/policy/modules/system/iscsi.if
-index 663a47b..ad0b864 100644
---- a/policy/modules/system/iscsi.if
-+++ b/policy/modules/system/iscsi.if
-@@ -56,3 +56,21 @@ interface(`iscsi_read_lib_files',`
- allow $1 iscsi_var_lib_t:dir list_dir_perms;
- files_search_var_lib($1)
- ')
-+
-+########################################
-+## <summary>
-+## Manage iscsid sempaphores.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`iscsi_manage_semaphores',`
-+ gen_require(`
-+ type iscsid_t;
-+ ')
-+
-+ allow $1 iscsid_t:sem create_sem_perms;
-+')
diff --git a/policy/modules/system/iscsi.te b/policy/modules/system/iscsi.te
-index 1d1c399..b8f623a 100644
+index ddbd8be..ac8e814 100644
--- a/policy/modules/system/iscsi.te
+++ b/policy/modules/system/iscsi.te
-@@ -31,6 +31,7 @@ files_pid_file(iscsi_var_run_t)
- #
-
- allow iscsid_t self:capability { dac_override ipc_lock net_admin net_raw sys_admin sys_nice sys_resource };
-+dontaudit iscsid_t self:capability { sys_ptrace };
- allow iscsid_t self:process { setrlimit setsched signal };
- allow iscsid_t self:fifo_file rw_fifo_file_perms;
- allow iscsid_t self:unix_stream_socket { create_stream_socket_perms connectto };
-@@ -44,8 +45,9 @@ allow iscsid_t self:tcp_socket create_stream_socket_perms;
-
- can_exec(iscsid_t, iscsid_exec_t)
-
-+manage_dirs_pattern(iscsid_t, iscsi_lock_t, iscsi_lock_t)
- manage_files_pattern(iscsid_t, iscsi_lock_t, iscsi_lock_t)
--files_lock_filetrans(iscsid_t, iscsi_lock_t, file)
-+files_lock_filetrans(iscsid_t, iscsi_lock_t, { dir file })
-
- manage_files_pattern(iscsid_t, iscsi_log_t, iscsi_log_t)
- logging_log_filetrans(iscsid_t, iscsi_log_t, file)
-@@ -64,6 +66,7 @@ files_pid_filetrans(iscsid_t, iscsi_var_run_t, file)
+@@ -66,6 +66,7 @@ files_pid_filetrans(iscsid_t, iscsi_var_run_t, file)
kernel_read_network_state(iscsid_t)
kernel_read_system_state(iscsid_t)
@@ -60108,7 +55260,7 @@ index 1d1c399..b8f623a 100644
corenet_all_recvfrom_unlabeled(iscsid_t)
corenet_all_recvfrom_netlabel(iscsid_t)
-@@ -76,6 +79,8 @@ corenet_tcp_connect_isns_port(iscsid_t)
+@@ -78,6 +79,8 @@ corenet_tcp_connect_isns_port(iscsid_t)
dev_rw_sysfs(iscsid_t)
dev_rw_userio_dev(iscsid_t)
@@ -60117,15 +55269,8 @@ index 1d1c399..b8f623a 100644
domain_use_interactive_fds(iscsid_t)
domain_dontaudit_read_all_domains_state(iscsid_t)
-@@ -91,5 +96,5 @@ logging_send_syslog_msg(iscsid_t)
- miscfiles_read_localization(iscsid_t)
-
- optional_policy(`
-- tgtd_rw_semaphores(iscsid_t)
-+ tgtd_manage_semaphores(iscsid_t)
- ')
diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc
-index 9df8c4d..98b8d89 100644
+index 560dc48..98b8d89 100644
--- a/policy/modules/system/libraries.fc
+++ b/policy/modules/system/libraries.fc
@@ -37,17 +37,12 @@ ifdef(`distro_redhat',`
@@ -60154,15 +55299,7 @@ index 9df8c4d..98b8d89 100644
/opt/(.*/)?java/.+\.jar -- gen_context(system_u:object_r:lib_t,s0)
/opt/(.*/)?jre.*/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/opt/(.*/)?jre/.+\.jar -- gen_context(system_u:object_r:lib_t,s0)
-@@ -90,6 +84,7 @@ ifdef(`distro_gentoo',`
- ')
-
- ifdef(`distro_redhat',`
-+/opt/Adobe.*/libcurl\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /opt/Adobe(/.*?)/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /opt/Adobe/Reader.?/Reader/intellinux/plug_ins/.*\.api -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /opt/Adobe/Reader.?/Reader/intellinux/SPPlugins/.*\.ap[il] -- gen_context(system_u:object_r:lib_t,s0)
-@@ -118,64 +113,62 @@ ifdef(`distro_redhat',`
+@@ -119,64 +113,62 @@ ifdef(`distro_redhat',`
/usr/(.*/)?java/.+\.jsa -- gen_context(system_u:object_r:lib_t,s0)
/usr/(.*/)?lib(/.*)? gen_context(system_u:object_r:lib_t,s0)
@@ -60261,7 +55398,7 @@ index 9df8c4d..98b8d89 100644
')
ifdef(`distro_gentoo',`
-@@ -194,94 +187,92 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_t
+@@ -195,7 +187,6 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_t
/usr/lib/allegro/(.*/)?alleg-vga\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/firefox-[^/]*/extensions(/.*)?/libqfaservices.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/firefox-[^/]*/plugins/nppdf.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -60269,9 +55406,7 @@ index 9df8c4d..98b8d89 100644
/usr/lib/libFLAC\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/libfglrx_gamma\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/mozilla/plugins/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
--/usr/lib/maxima/[^/]+/binary-gcl/maxima -- gen_context(system_u:object_r:textrel_shlib_t,s0)
--/usr/lib64/maxima/[^/]+/binary-gcl/maxima -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /usr/lib/mozilla/plugins/libvlcplugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+@@ -203,86 +194,85 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_t
/usr/lib/nx/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/nx/libjpeg\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/VBoxVMM\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -60279,6 +55414,7 @@ index 9df8c4d..98b8d89 100644
-
-/usr/lib(64)?/libstdc\+\+\.so\.2\.7\.2\.8 -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/lib(64)?/libg\+\+\.so\.2\.7\.2\.8 -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/libgpac\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/lib(64)?/libglide3\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/lib(64)?/libglide3-v[0-9]*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/lib(64)?/helix/plugins/[^/]*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -60339,6 +55475,7 @@ index 9df8c4d..98b8d89 100644
-/usr/lib(64)?/ladspa/sc3_1427\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/lib(64)?/ladspa/sc4_1882\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/lib(64)?/ladspa/se4_1883\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/sane/libsane-epkowa\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/lib(64)?/ocaml/stublibs/dllnums\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib/ladspa/analogue_osc_1416\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib/ladspa/bandpass_a_iir_1893\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -60412,22 +55549,17 @@ index 9df8c4d..98b8d89 100644
/usr/(local/)?Adobe/(.*/)?intellinux/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/(local/)?Adobe/(.*/)?intellinux/sidecars/* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -302,13 +293,7 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te
+@@ -303,8 +293,7 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te
/usr/lib/acroread/(.*/)?lib/[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/acroread/.+\.api -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/acroread/(.*/)?ADMPlugin\.apl -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/lib/.*/program(/.*)?\.so gen_context(system_u:object_r:lib_t,s0)
-/usr/lib64/.*/program(/.*)?\.so gen_context(system_u:object_r:lib_t,s0)
--/usr/lib(64)?/pgsql/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
--/usr/lib(64)?/pgsql/test/regress/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
--
--/usr/share/hplip/prnt/plugins(/.*)? gen_context(system_u:object_r:lib_t,s0)
--/usr/share/squeezeboxserver/CPAN/arch/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib/.*/program(/.*)?\.so gen_context(system_u:object_r:lib_t,s0)
') dnl end distro_redhat
#
-@@ -316,17 +301,152 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te
+@@ -312,17 +301,152 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te
#
/var/cache/ldconfig(/.*)? gen_context(system_u:object_r:ldconfig_cache_t,s0)
@@ -60587,37 +55719,10 @@ index 9df8c4d..98b8d89 100644
+/opt/google/picasa/.*\.yti -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/opt/google/talkplugin/.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
diff --git a/policy/modules/system/libraries.if b/policy/modules/system/libraries.if
-index d97d16d..ed84884 100644
+index 808ba93..ed84884 100644
--- a/policy/modules/system/libraries.if
+++ b/policy/modules/system/libraries.if
-@@ -46,6 +46,26 @@ interface(`libs_run_ldconfig',`
-
- ########################################
- ## <summary>
-+## Execute ldconfig in the caller domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`libs_exec_ldconfig',`
-+ gen_require(`
-+ type ldconfig_exec_t;
-+ ')
-+
-+ corecmd_search_bin($1)
-+ can_exec($1, ldconfig_exec_t)
-+')
-+
-+########################################
-+## <summary>
- ## Use the dynamic link/loader for automatic loading
- ## of shared libraries.
- ## </summary>
-@@ -187,6 +207,23 @@ interface(`libs_search_lib',`
+@@ -207,6 +207,23 @@ interface(`libs_search_lib',`
allow $1 lib_t:dir search_dir_perms;
')
@@ -60641,7 +55746,32 @@ index d97d16d..ed84884 100644
########################################
## <summary>
-@@ -383,7 +420,7 @@ interface(`libs_manage_shared_libs',`
+@@ -253,24 +270,6 @@ interface(`libs_manage_lib_dirs',`
+
+ ########################################
+ ## <summary>
+-## dontaudit attempts to setattr on library files
+-## </summary>
+-## <param name="domain">
+-## <summary>
+-## Domain to not audit.
+-## </summary>
+-## </param>
+-#
+-interface(`libs_dontaudit_setattr_lib_files',`
+- gen_require(`
+- type lib_t;
+- ')
+-
+- dontaudit $1 lib_t:file setattr;
+-')
+-
+-########################################
+-## <summary>
+ ## Read files in the library directories, such
+ ## as static libraries.
+ ## </summary>
+@@ -421,7 +420,7 @@ interface(`libs_manage_shared_libs',`
type lib_t, textrel_shlib_t;
')
@@ -60650,7 +55780,7 @@ index d97d16d..ed84884 100644
')
########################################
-@@ -402,9 +439,9 @@ interface(`libs_use_shared_libs',`
+@@ -440,9 +439,9 @@ interface(`libs_use_shared_libs',`
')
files_search_usr($1)
@@ -60663,7 +55793,7 @@ index d97d16d..ed84884 100644
allow $1 textrel_shlib_t:file execmod;
')
-@@ -445,7 +482,7 @@ interface(`libs_relabel_shared_libs',`
+@@ -483,7 +482,7 @@ interface(`libs_relabel_shared_libs',`
type lib_t, textrel_shlib_t;
')
@@ -60673,7 +55803,7 @@ index d97d16d..ed84884 100644
########################################
diff --git a/policy/modules/system/libraries.te b/policy/modules/system/libraries.te
-index bf416a4..91f5506 100644
+index e5836d3..1db2eab 100644
--- a/policy/modules/system/libraries.te
+++ b/policy/modules/system/libraries.te
@@ -61,7 +61,7 @@ allow ldconfig_t self:capability { dac_override sys_chroot };
@@ -60737,16 +55867,8 @@ index bf416a4..91f5506 100644
+# unconfined_domain(ldconfig_t)
+#')
+
-diff --git a/policy/modules/system/locallogin.fc b/policy/modules/system/locallogin.fc
-index 7570583..be6a81b 100644
---- a/policy/modules/system/locallogin.fc
-+++ b/policy/modules/system/locallogin.fc
-@@ -1,2 +1,3 @@
-
- /sbin/sulogin -- gen_context(system_u:object_r:sulogin_exec_t,s0)
-+/sbin/sushell -- gen_context(system_u:object_r:sulogin_exec_t,s0)
diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
-index 2b7e5f3..76b4ce1 100644
+index a0b379d..77f0e09 100644
--- a/policy/modules/system/locallogin.te
+++ b/policy/modules/system/locallogin.te
@@ -32,9 +32,8 @@ role system_r types sulogin_t;
@@ -60791,28 +55913,7 @@ index 2b7e5f3..76b4ce1 100644
optional_policy(`
alsa_domtrans(local_login_t)
')
-@@ -185,7 +193,7 @@ optional_policy(`
- ')
-
- optional_policy(`
-- unconfined_domain(local_login_t)
-+ unconfined_shell_domtrans(local_login_t)
- ')
-
- optional_policy(`
-@@ -202,9 +210,10 @@ optional_policy(`
- # Sulogin local policy
- #
-
-+allow sulogin_t self:capability dac_override;
- allow sulogin_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
- allow sulogin_t self:fd use;
--allow sulogin_t self:fifo_file rw_file_perms;
-+allow sulogin_t self:fifo_file rw_fifo_file_perms;
- allow sulogin_t self:unix_dgram_socket create_socket_perms;
- allow sulogin_t self:unix_stream_socket create_stream_socket_perms;
- allow sulogin_t self:unix_dgram_socket sendto;
-@@ -224,6 +233,7 @@ files_read_etc_files(sulogin_t)
+@@ -225,6 +233,7 @@ files_read_etc_files(sulogin_t)
files_dontaudit_search_isid_type_dirs(sulogin_t)
auth_read_shadow(sulogin_t)
@@ -60820,7 +55921,7 @@ index 2b7e5f3..76b4ce1 100644
init_getpgid_script(sulogin_t)
-@@ -237,14 +247,23 @@ userdom_use_unpriv_users_fds(sulogin_t)
+@@ -238,14 +247,23 @@ userdom_use_unpriv_users_fds(sulogin_t)
userdom_search_user_home_dirs(sulogin_t)
userdom_use_user_ptys(sulogin_t)
@@ -60846,7 +55947,7 @@ index 2b7e5f3..76b4ce1 100644
init_getpgid(sulogin_t)
', `
allow sulogin_t self:process setexec;
-@@ -255,11 +274,3 @@ ifdef(`sulogin_no_pam', `
+@@ -256,11 +274,3 @@ ifdef(`sulogin_no_pam', `
selinux_compute_relabel_context(sulogin_t)
selinux_compute_user_contexts(sulogin_t)
')
@@ -60859,7 +55960,7 @@ index 2b7e5f3..76b4ce1 100644
- nscd_socket_use(sulogin_t)
-')
diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
-index 571599b..ddaf246 100644
+index 02f4c97..cd16709 100644
--- a/policy/modules/system/logging.fc
+++ b/policy/modules/system/logging.fc
@@ -17,6 +17,13 @@
@@ -60876,64 +55977,26 @@ index 571599b..ddaf246 100644
/usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/usr/sbin/metalog -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/usr/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
-@@ -25,6 +32,7 @@
- /usr/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
-
- /var/lib/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0)
-+/var/lib/r?syslog(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0)
- /var/lib/syslog-ng.persist -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
-
- ifdef(`distro_suse', `
-@@ -37,13 +45,14 @@ ifdef(`distro_suse', `
+@@ -38,7 +45,7 @@ ifdef(`distro_suse', `
/var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
/var/log/.* gen_context(system_u:object_r:var_log_t,s0)
+-/var/log/boot\.log -- gen_context(system_u:object_r:var_log_t,mls_systemhigh)
+/var/log/boot\.log -- gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/messages[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/secure[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/cron[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
- /var/log/maillog[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
- /var/log/spooler[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
- /var/log/audit(/.*)? gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
--/var/log/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,s0)
-+/var/log/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
-
- ifndef(`distro_gentoo',`
- /var/log/audit\.log -- gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
-@@ -54,18 +63,25 @@ ifdef(`distro_redhat',`
- /var/named/chroot/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
- ')
-
--/var/run/audit_events -s gen_context(system_u:object_r:auditd_var_run_t,s0)
--/var/run/audispd_events -s gen_context(system_u:object_r:audisp_var_run_t,s0)
--/var/run/auditd\.pid -- gen_context(system_u:object_r:auditd_var_run_t,s0)
--/var/run/auditd_sock -s gen_context(system_u:object_r:auditd_var_run_t,s0)
-+/var/run/audit_events -s gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh)
-+/var/run/audispd_events -s gen_context(system_u:object_r:audisp_var_run_t,mls_systemhigh)
-+/var/run/auditd\.pid -- gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh)
-+/var/run/auditd_sock -s gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh)
- /var/run/klogd\.pid -- gen_context(system_u:object_r:klogd_var_run_t,s0)
- /var/run/log -s gen_context(system_u:object_r:devlog_t,s0)
- /var/run/metalog\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,s0)
--/var/run/syslogd\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,s0)
-+/var/run/syslogd\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
-+/var/run/syslog-ng.ctl -- gen_context(system_u:object_r:syslogd_var_run_t,s0)
-+/var/run/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,s0)
-
- /var/spool/bacula/log(/.*)? gen_context(system_u:object_r:var_log_t,s0)
- /var/spool/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0)
--/var/spool/plymouth/boot.log gen_context(system_u:object_r:var_log_t,s0)
-+/var/spool/plymouth/boot\.log gen_context(system_u:object_r:var_log_t,mls_systemhigh)
+@@ -73,4 +80,8 @@ ifdef(`distro_redhat',`
+ /var/spool/plymouth/boot\.log gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/spool/rsyslog(/.*)? gen_context(system_u:object_r:var_log_t,s0)
-+/var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh)
-+
-+/var/stockmaniac/templates_cache(/.*)? gen_context(system_u:object_r:var_log_t,s0)
++/var/stockmaniac/templates_cache(/.*)? gen_context(system_u:object_r:var_log_t,s0)
++
/var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
+
+/var/webmin(/.*)? gen_context(system_u:object_r:var_log_t,s0)
diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
-index c7cfb62..ee89659 100644
+index 831b909..57064ad 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -545,6 +545,44 @@ interface(`logging_send_syslog_msg',`
@@ -60981,7 +56044,7 @@ index c7cfb62..ee89659 100644
## Read the auditd configuration files.
## </summary>
## <param name="domain">
-@@ -715,7 +753,44 @@ interface(`logging_append_all_logs',`
+@@ -734,7 +772,25 @@ interface(`logging_append_all_logs',`
')
files_search_var($1)
@@ -61005,29 +56068,10 @@ index c7cfb62..ee89659 100644
+ ')
+
+ allow $1 logfile:file { getattr append ioctl lock };
-+')
-+
-+########################################
-+## <summary>
-+## Set attributes on all log dirs.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`logging_setattr_all_log_dirs',`
-+ gen_require(`
-+ attribute logfile;
-+ ')
-+
-+ allow $1 logfile:dir setattr;
')
########################################
-@@ -798,7 +873,7 @@ interface(`logging_manage_all_logs',`
+@@ -817,7 +873,7 @@ interface(`logging_manage_all_logs',`
files_search_var($1)
manage_files_pattern($1, logfile, logfile)
@@ -61036,7 +56080,7 @@ index c7cfb62..ee89659 100644
')
########################################
-@@ -824,6 +899,44 @@ interface(`logging_read_generic_logs',`
+@@ -843,6 +899,44 @@ interface(`logging_read_generic_logs',`
########################################
## <summary>
@@ -61081,7 +56125,7 @@ index c7cfb62..ee89659 100644
## Write generic log files.
## </summary>
## <param name="domain">
-@@ -971,6 +1084,7 @@ interface(`logging_admin_syslog',`
+@@ -990,6 +1084,7 @@ interface(`logging_admin_syslog',`
type syslogd_initrc_exec_t;
')
@@ -61089,7 +56133,7 @@ index c7cfb62..ee89659 100644
allow $1 syslogd_t:process { ptrace signal_perms };
allow $1 klogd_t:process { ptrace signal_perms };
ps_process_pattern($1, syslogd_t)
-@@ -996,6 +1110,8 @@ interface(`logging_admin_syslog',`
+@@ -1015,6 +1110,8 @@ interface(`logging_admin_syslog',`
manage_files_pattern($1, syslogd_var_run_t, syslogd_var_run_t)
logging_manage_all_logs($1)
@@ -61099,28 +56143,18 @@ index c7cfb62..ee89659 100644
init_labeled_script_domtrans($1, syslogd_initrc_exec_t)
domain_system_change_exemption($1)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 9b5a9ed..41ee997 100644
+index b6ec597..7354066 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
-@@ -19,6 +19,11 @@ type auditd_log_t;
- files_security_file(auditd_log_t)
+@@ -20,6 +20,7 @@ files_security_file(auditd_log_t)
files_security_mountpoint(auditd_log_t)
-+type audit_spool_t;
+ type audit_spool_t;
+files_type(audit_spool_t)
-+files_security_file(audit_spool_t)
-+files_security_mountpoint(audit_spool_t)
-+
- type auditd_t;
- type auditd_exec_t;
- init_daemon_domain(auditd_t, auditd_exec_t)
-@@ -55,11 +60,12 @@ type klogd_var_run_t;
- files_pid_file(klogd_var_run_t)
-
- type syslog_conf_t;
--files_type(syslog_conf_t)
-+files_config_file(syslog_conf_t)
+ files_security_file(audit_spool_t)
+ files_security_mountpoint(audit_spool_t)
+@@ -64,6 +65,7 @@ files_config_file(syslog_conf_t)
type syslogd_t;
type syslogd_exec_t;
init_daemon_domain(syslogd_t, syslogd_exec_t)
@@ -61128,7 +56162,7 @@ index 9b5a9ed..41ee997 100644
type syslogd_initrc_exec_t;
init_script_file(syslogd_initrc_exec_t)
-@@ -107,7 +113,7 @@ domain_use_interactive_fds(auditctl_t)
+@@ -111,7 +113,7 @@ domain_use_interactive_fds(auditctl_t)
mls_file_read_all_levels(auditctl_t)
@@ -61137,7 +56171,7 @@ index 9b5a9ed..41ee997 100644
init_dontaudit_use_fds(auditctl_t)
-@@ -179,16 +185,19 @@ logging_send_syslog_msg(auditd_t)
+@@ -183,16 +185,19 @@ logging_send_syslog_msg(auditd_t)
logging_domtrans_dispatcher(auditd_t)
logging_signal_dispatcher(auditd_t)
@@ -61158,14 +56192,7 @@ index 9b5a9ed..41ee997 100644
userdom_dontaudit_use_unpriv_user_fds(auditd_t)
userdom_dontaudit_search_user_home_dirs(auditd_t)
-@@ -226,15 +235,24 @@ allow audisp_t auditd_t:unix_stream_socket rw_socket_perms;
- manage_sock_files_pattern(audisp_t, audisp_var_run_t, audisp_var_run_t)
- files_pid_filetrans(audisp_t, audisp_var_run_t, sock_file)
-
-+kernel_read_system_state(audisp_t)
-+
- corecmd_exec_bin(audisp_t)
- corecmd_exec_shell(audisp_t)
+@@ -237,10 +242,17 @@ corecmd_exec_shell(audisp_t)
domain_use_interactive_fds(audisp_t)
@@ -61183,7 +56210,7 @@ index 9b5a9ed..41ee997 100644
logging_send_syslog_msg(audisp_t)
-@@ -244,14 +262,26 @@ sysnet_dns_name_resolve(audisp_t)
+@@ -250,6 +262,10 @@ sysnet_dns_name_resolve(audisp_t)
optional_policy(`
dbus_system_bus_client(audisp_t)
@@ -61194,35 +56221,18 @@ index 9b5a9ed..41ee997 100644
')
########################################
- #
- # Audit remote logger local policy
- #
--
-+allow audisp_remote_t self:capability { setuid setpcap };
-+allow audisp_remote_t self:process { getcap setcap };
- allow audisp_remote_t self:tcp_socket create_socket_perms;
-+allow audisp_remote_t var_log_t:dir search_dir_perms;
-+
-+manage_dirs_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
-+manage_files_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
-+files_spool_filetrans(audisp_remote_t, audit_spool_t, { dir file })
-+
-+corecmd_exec_bin(audisp_remote_t)
-
- corenet_all_recvfrom_unlabeled(audisp_remote_t)
- corenet_all_recvfrom_netlabel(audisp_remote_t)
-@@ -265,10 +295,20 @@ corenet_sendrecv_audit_client_packets(audisp_remote_t)
+@@ -280,11 +296,20 @@ corenet_sendrecv_audit_client_packets(audisp_remote_t)
files_read_etc_files(audisp_remote_t)
+mls_socket_write_all_levels(audisp_remote_t)
+
logging_send_syslog_msg(audisp_remote_t)
-+logging_send_audit_msgs(audisp_remote_t)
-+
+ logging_send_audit_msgs(audisp_remote_t)
+
+auth_use_nsswitch(audisp_remote_t)
+auth_append_login_records(audisp_remote_t)
-
++
miscfiles_read_localization(audisp_remote_t)
+init_telinit(audisp_remote_t)
@@ -61232,7 +56242,7 @@ index 9b5a9ed..41ee997 100644
sysnet_dns_name_resolve(audisp_remote_t)
########################################
-@@ -338,11 +378,12 @@ optional_policy(`
+@@ -354,11 +379,12 @@ optional_policy(`
# chown fsetid for syslog-ng
# sys_admin for the integrated klog of syslog-ng and metalog
# cjp: why net_admin!
@@ -61243,11 +56253,11 @@ index 9b5a9ed..41ee997 100644
# setpgid for metalog
# setrlimit for syslog-ng
-allow syslogd_t self:process { signal_perms setpgid setrlimit };
-+allow syslogd_t self:process { signal_perms setpgid setsched setrlimit setcap getcap };
++allow syslogd_t self:process { signal_perms getcap setcap setpgid setsched setrlimit };
# receive messages to be logged
allow syslogd_t self:unix_dgram_socket create_socket_perms;
allow syslogd_t self:unix_stream_socket create_stream_socket_perms;
-@@ -360,6 +401,7 @@ files_pid_filetrans(syslogd_t, devlog_t, sock_file)
+@@ -376,6 +402,7 @@ files_pid_filetrans(syslogd_t, devlog_t, sock_file)
# create/append log files.
manage_files_pattern(syslogd_t, var_log_t, var_log_t)
rw_fifo_files_pattern(syslogd_t, var_log_t, var_log_t)
@@ -61255,7 +56265,7 @@ index 9b5a9ed..41ee997 100644
# Allow access for syslog-ng
allow syslogd_t var_log_t:dir { create setattr };
-@@ -369,9 +411,15 @@ manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
+@@ -385,9 +412,15 @@ manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
manage_files_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
files_tmp_filetrans(syslogd_t, syslogd_tmp_t, { dir file })
@@ -61271,7 +56281,7 @@ index 9b5a9ed..41ee997 100644
# manage pid file
manage_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t)
files_pid_filetrans(syslogd_t, syslogd_var_run_t, file)
-@@ -412,8 +460,13 @@ corenet_sendrecv_mysqld_client_packets(syslogd_t)
+@@ -428,8 +461,13 @@ corenet_sendrecv_mysqld_client_packets(syslogd_t)
dev_filetrans(syslogd_t, devlog_t, sock_file)
dev_read_sysfs(syslogd_t)
@@ -61285,7 +56295,7 @@ index 9b5a9ed..41ee997 100644
files_read_etc_files(syslogd_t)
files_read_usr_files(syslogd_t)
-@@ -432,6 +485,7 @@ term_write_console(syslogd_t)
+@@ -448,6 +486,7 @@ term_write_console(syslogd_t)
# Allow syslog to a terminal
term_write_unallocated_ttys(syslogd_t)
@@ -61293,7 +56303,7 @@ index 9b5a9ed..41ee997 100644
# for sending messages to logged in users
init_read_utmp(syslogd_t)
init_dontaudit_write_utmp(syslogd_t)
-@@ -480,6 +534,10 @@ optional_policy(`
+@@ -496,6 +535,10 @@ optional_policy(`
')
optional_policy(`
@@ -61304,7 +56314,7 @@ index 9b5a9ed..41ee997 100644
postgresql_stream_connect(syslogd_t)
')
-@@ -488,6 +546,10 @@ optional_policy(`
+@@ -504,6 +547,10 @@ optional_policy(`
')
optional_policy(`
@@ -62627,10 +57637,10 @@ index ed9c70d..b961d53 100644
/sbin/mdadm -- gen_context(system_u:object_r:mdadm_exec_t,s0)
/sbin/mdmpd -- gen_context(system_u:object_r:mdadm_exec_t,s0)
diff --git a/policy/modules/system/raid.if b/policy/modules/system/raid.if
-index c817fda..8bcb1fd 100644
+index b1a85b5..db0d815 100644
--- a/policy/modules/system/raid.if
+++ b/policy/modules/system/raid.if
-@@ -21,6 +21,24 @@ interface(`raid_domtrans_mdadm',`
+@@ -47,6 +47,24 @@ interface(`raid_run_mdadm',`
########################################
## <summary>
@@ -62656,7 +57666,7 @@ index c817fda..8bcb1fd 100644
## </summary>
## <desc>
diff --git a/policy/modules/system/raid.te b/policy/modules/system/raid.te
-index 73cc8cf..020e663 100644
+index a19ecea..4e2ef36 100644
--- a/policy/modules/system/raid.te
+++ b/policy/modules/system/raid.te
@@ -10,11 +10,9 @@ type mdadm_exec_t;
@@ -63984,10 +58994,10 @@ index ff80d0a..95e705c 100644
+ role_transition $1 dhcpc_exec_t system_r;
+')
diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
-index df32316..7307991 100644
+index 34d0ec5..0cdb0be 100644
--- a/policy/modules/system/sysnetwork.te
+++ b/policy/modules/system/sysnetwork.te
-@@ -5,6 +5,13 @@ policy_module(sysnetwork, 1.11.1)
+@@ -5,6 +5,13 @@ policy_module(sysnetwork, 1.11.2)
# Declarations
#
@@ -64148,7 +59158,15 @@ index df32316..7307991 100644
')
optional_policy(`
-@@ -276,8 +320,11 @@ dev_read_urand(ifconfig_t)
+@@ -255,6 +299,7 @@ allow ifconfig_t self:msgq create_msgq_perms;
+ allow ifconfig_t self:msg { send receive };
+ # Create UDP sockets, necessary when called from dhcpc
+ allow ifconfig_t self:udp_socket create_socket_perms;
++allow ifconfig_t self:appletalk_socket create_socket_perms;
+ # for /sbin/ip
+ allow ifconfig_t self:packet_socket create_socket_perms;
+ allow ifconfig_t self:netlink_route_socket create_netlink_socket_perms;
+@@ -276,8 +321,11 @@ dev_read_urand(ifconfig_t)
domain_use_interactive_fds(ifconfig_t)
@@ -64160,7 +59178,7 @@ index df32316..7307991 100644
fs_getattr_xattr_fs(ifconfig_t)
fs_search_auto_mountpoints(ifconfig_t)
-@@ -301,11 +348,12 @@ logging_send_syslog_msg(ifconfig_t)
+@@ -301,11 +349,12 @@ logging_send_syslog_msg(ifconfig_t)
miscfiles_read_localization(ifconfig_t)
@@ -64175,7 +59193,7 @@ index df32316..7307991 100644
userdom_use_all_users_fds(ifconfig_t)
ifdef(`distro_ubuntu',`
-@@ -314,7 +362,14 @@ ifdef(`distro_ubuntu',`
+@@ -314,7 +363,14 @@ ifdef(`distro_ubuntu',`
')
')
@@ -64190,7 +59208,7 @@ index df32316..7307991 100644
optional_policy(`
dev_dontaudit_rw_cardmgr(ifconfig_t)
')
-@@ -325,12 +380,31 @@ ifdef(`hide_broken_symptoms',`
+@@ -325,8 +381,14 @@ ifdef(`hide_broken_symptoms',`
')
optional_policy(`
@@ -64205,11 +59223,10 @@ index df32316..7307991 100644
')
optional_policy(`
- ipsec_write_pid(ifconfig_t)
-+ ipsec_setcontext_default_spd(ifconfig_t)
-+')
-+
-+optional_policy(`
+@@ -335,6 +397,18 @@ optional_policy(`
+ ')
+
+ optional_policy(`
+ kdump_dontaudit_read_config(ifconfig_t)
+')
+
@@ -64219,10 +59236,13 @@ index df32316..7307991 100644
+
+optional_policy(`
+ netutils_domtrans(dhcpc_t)
++')
++
++optional_policy(`
+ nis_use_ypbind(ifconfig_t)
')
- optional_policy(`
-@@ -355,3 +429,9 @@ optional_policy(`
+@@ -356,3 +430,9 @@ optional_policy(`
xen_append_log(ifconfig_t)
xen_dontaudit_rw_unix_stream_sockets(ifconfig_t)
')
@@ -64508,7 +59528,7 @@ index 0000000..c59c37c
+')
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644
-index 0000000..747aa58
+index 0000000..9e2eaf0
--- /dev/null
+++ b/policy/modules/system/systemd.te
@@ -0,0 +1,191 @@
@@ -64627,7 +59647,7 @@ index 0000000..747aa58
+files_relabelfrom_tmp_files(systemd_tmpfiles_t)
+files_relabel_all_tmp_dirs(systemd_tmpfiles_t)
+files_relabel_all_tmp_files(systemd_tmpfiles_t)
-+files_list_lost_found_dirs(systemd_tmpfiles_t)
++files_list_lost_found(systemd_tmpfiles_t)
+
+init_dgram_send(systemd_tmpfiles_t)
+
@@ -65894,7 +60914,7 @@ index db75976..392d1ee 100644
+HOME_DIR/\.gvfs(/.*)? <<none>>
+HOME_DIR/\.debug(/.*)? <<none>>
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
-index 28b88de..240fa6c 100644
+index 4b2878a..b0955cf 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -30,8 +30,9 @@ template(`userdom_base_user_template',`
@@ -66039,15 +61059,15 @@ index 28b88de..240fa6c 100644
+ storage_rw_fuse($1_usertype)
+
+ auth_use_nsswitch($1_usertype)
-+
+
+- libs_exec_ld_so($1_t)
+ init_stream_connect($1_usertype)
+ # The library functions always try to open read-write first,
+ # then fall back to read-only if it fails.
+ init_dontaudit_rw_utmp($1_usertype)
+
+ libs_exec_ld_so($1_usertype)
-
-- libs_exec_ld_so($1_t)
++
+ logging_send_audit_msgs($1_t)
miscfiles_read_localization($1_t)
@@ -66373,6 +61393,17 @@ index 28b88de..240fa6c 100644
xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
xserver_xsession_entry_type($1_t)
+@@ -462,8 +548,8 @@ template(`userdom_change_password_template',`
+ ')
+
+ optional_policy(`
+- usermanage_run_chfn($1_t, $1_r)
+- usermanage_run_passwd($1_t, $1_r)
++ usermanage_run_chfn($1_t,$1_r)
++ usermanage_run_passwd($1_t,$1_r)
+ ')
+ ')
+
@@ -490,7 +576,7 @@ template(`userdom_common_user_template',`
attribute unpriv_userdomain;
')
@@ -66404,27 +61435,27 @@ index 28b88de..240fa6c 100644
+ kernel_get_sysvipc_info($1_usertype)
# Find CDROM devices:
- kernel_read_device_sysctls($1_t)
+-
+- corecmd_exec_bin($1_t)
+ kernel_read_device_sysctls($1_usertype)
+ kernel_request_load_module($1_usertype)
-- corecmd_exec_bin($1_t)
+- corenet_udp_bind_generic_node($1_t)
+- corenet_udp_bind_generic_port($1_t)
+ corenet_udp_bind_generic_node($1_usertype)
+ corenet_udp_bind_generic_port($1_usertype)
-- corenet_udp_bind_generic_node($1_t)
-- corenet_udp_bind_generic_port($1_t)
+- dev_read_rand($1_t)
+- dev_write_sound($1_t)
+- dev_read_sound($1_t)
+- dev_read_sound_mixer($1_t)
+- dev_write_sound_mixer($1_t)
+ dev_read_rand($1_usertype)
+ dev_write_sound($1_usertype)
+ dev_read_sound($1_usertype)
+ dev_read_sound_mixer($1_usertype)
+ dev_write_sound_mixer($1_usertype)
-- dev_read_rand($1_t)
-- dev_write_sound($1_t)
-- dev_read_sound($1_t)
-- dev_read_sound_mixer($1_t)
-- dev_write_sound_mixer($1_t)
--
- files_exec_etc_files($1_t)
- files_search_locks($1_t)
+ files_exec_etc_files($1_usertype)
@@ -66448,10 +61479,10 @@ index 28b88de..240fa6c 100644
+ fs_read_noxattr_fs_files($1_usertype)
+ fs_read_noxattr_fs_symlinks($1_usertype)
+ fs_rw_cgroup_files($1_usertype)
-+
-+ application_getattr_socket($1_usertype)
- fs_rw_cgroup_files($1_t)
++ application_getattr_socket($1_usertype)
++
+ logging_send_syslog_msg($1_usertype)
+ logging_send_audit_msgs($1_usertype)
+ selinux_get_enforce_mode($1_usertype)
@@ -66477,18 +61508,21 @@ index 28b88de..240fa6c 100644
- auth_use_nsswitch($1_t)
- auth_read_login_records($1_t)
- auth_search_pam_console_data($1_t)
+- auth_run_pam($1_t, $1_r)
+- auth_run_utempter($1_t, $1_r)
+ auth_read_login_records($1_usertype)
- auth_run_pam($1_t,$1_r)
- auth_run_utempter($1_t,$1_r)
++ auth_run_pam($1_t,$1_r)
++ auth_run_utempter($1_t,$1_r)
- init_read_utmp($1_t)
+ init_read_utmp($1_usertype)
- seutil_read_file_contexts($1_t)
- seutil_read_default_contexts($1_t)
+- seutil_run_newrole($1_t, $1_r)
+ seutil_read_file_contexts($1_usertype)
+ seutil_read_default_contexts($1_usertype)
- seutil_run_newrole($1_t,$1_r)
++ seutil_run_newrole($1_t,$1_r)
seutil_exec_checkpolicy($1_t)
- seutil_exec_setfiles($1_t)
+ seutil_exec_setfiles($1_usertype)
@@ -66545,85 +61579,85 @@ index 28b88de..240fa6c 100644
+ optional_policy(`
+ policykit_dbus_chat($1_usertype)
+ ')
-+
-+ optional_policy(`
-+ bluetooth_dbus_chat($1_usertype)
-+ ')
-+
-+ optional_policy(`
-+ consolekit_dbus_chat($1_usertype)
-+ consolekit_read_log($1_usertype)
-+ ')
-+
-+ optional_policy(`
-+ devicekit_dbus_chat($1_usertype)
-+ devicekit_dbus_chat_power($1_usertype)
-+ devicekit_dbus_chat_disk($1_usertype)
-+ ')
-+
-+ optional_policy(`
-+ evolution_dbus_chat($1_usertype)
-+ evolution_alarm_dbus_chat($1_usertype)
-+ ')
-+
-+ optional_policy(`
-+ gnome_dbus_chat_gconfdefault($1_usertype)
-+ ')
optional_policy(`
- bluetooth_dbus_chat($1_t)
-+ hal_dbus_chat($1_usertype)
++ bluetooth_dbus_chat($1_usertype)
')
optional_policy(`
- evolution_dbus_chat($1_t)
- evolution_alarm_dbus_chat($1_t)
-+ kde_dbus_chat_backlighthelper($1_usertype)
++ consolekit_dbus_chat($1_usertype)
++ consolekit_read_log($1_usertype)
')
optional_policy(`
- cups_dbus_chat_config($1_t)
-+ modemmanager_dbus_chat($1_usertype)
++ devicekit_dbus_chat($1_usertype)
++ devicekit_dbus_chat_power($1_usertype)
++ devicekit_dbus_chat_disk($1_usertype)
')
optional_policy(`
- hal_dbus_chat($1_t)
-+ networkmanager_dbus_chat($1_usertype)
-+ networkmanager_read_lib_files($1_usertype)
++ evolution_dbus_chat($1_usertype)
++ evolution_alarm_dbus_chat($1_usertype)
')
optional_policy(`
- networkmanager_dbus_chat($1_t)
-+ vpn_dbus_chat($1_usertype)
++ gnome_dbus_chat_gconfdefault($1_usertype)
')
++
++ optional_policy(`
++ hal_dbus_chat($1_usertype)
++ ')
++
++ optional_policy(`
++ kde_dbus_chat_backlighthelper($1_usertype)
++ ')
++
++ optional_policy(`
++ modemmanager_dbus_chat($1_usertype)
++ ')
++
++ optional_policy(`
++ networkmanager_dbus_chat($1_usertype)
++ networkmanager_read_lib_files($1_usertype)
++ ')
++
++ optional_policy(`
++ vpn_dbus_chat($1_usertype)
++ ')
++ ')
++
++ optional_policy(`
++ git_session_role($1_r, $1_usertype)
++ ')
++
++ optional_policy(`
++ inetd_use_fds($1_usertype)
++ inetd_rw_tcp_sockets($1_usertype)
')
optional_policy(`
- inetd_use_fds($1_t)
- inetd_rw_tcp_sockets($1_t)
-+ git_session_role($1_r, $1_usertype)
++ inn_read_config($1_usertype)
++ inn_read_news_lib($1_usertype)
++ inn_read_news_spool($1_usertype)
')
optional_policy(`
- inn_read_config($1_t)
- inn_read_news_lib($1_t)
- inn_read_news_spool($1_t)
-+ inetd_use_fds($1_usertype)
-+ inetd_rw_tcp_sockets($1_usertype)
++ lircd_stream_connect($1_usertype)
')
optional_policy(`
- locate_read_lib_files($1_t)
-+ inn_read_config($1_usertype)
-+ inn_read_news_lib($1_usertype)
-+ inn_read_news_spool($1_usertype)
-+ ')
-+
-+ optional_policy(`
-+ lircd_stream_connect($1_usertype)
-+ ')
-+
-+ optional_policy(`
+ locate_read_lib_files($1_usertype)
')
@@ -66672,35 +61706,35 @@ index 28b88de..240fa6c 100644
optional_policy(`
- resmgr_stream_connect($1_t)
+ resmgr_stream_connect($1_usertype)
-+ ')
-+
-+ optional_policy(`
-+ rpc_dontaudit_getattr_exports($1_usertype)
-+ rpc_manage_nfs_rw_content($1_usertype)
')
optional_policy(`
- rpc_dontaudit_getattr_exports($1_t)
- rpc_manage_nfs_rw_content($1_t)
-+ rpcbind_stream_connect($1_usertype)
++ rpc_dontaudit_getattr_exports($1_usertype)
++ rpc_manage_nfs_rw_content($1_usertype)
')
optional_policy(`
- samba_stream_connect_winbind($1_t)
-+ samba_stream_connect_winbind($1_usertype)
++ rpcbind_stream_connect($1_usertype)
')
optional_policy(`
- slrnpull_search_spool($1_t)
-+ sandbox_transition($1_usertype, $1_r)
++ samba_stream_connect_winbind($1_usertype)
')
optional_policy(`
-- usernetctl_run($1_t,$1_r)
-+ seunshare_role_template($1, $1_r, $1_t)
+- usernetctl_run($1_t, $1_r)
++ sandbox_transition($1_usertype, $1_r)
')
+
+ optional_policy(`
++ seunshare_role_template($1, $1_r, $1_t)
++ ')
++
++ optional_policy(`
+ slrnpull_search_spool($1_usertype)
+ ')
+
@@ -66713,17 +61747,17 @@ index 28b88de..240fa6c 100644
- userdom_manage_home_role($1_r, $1_t)
+ userdom_manage_home_role($1_r, $1_usertype)
++
++ userdom_manage_tmp_role($1_r, $1_usertype)
++ userdom_manage_tmpfs_role($1_r, $1_usertype)
- userdom_manage_tmp_role($1_r, $1_t)
- userdom_manage_tmpfs_role($1_r, $1_t)
-+ userdom_manage_tmp_role($1_r, $1_usertype)
-+ userdom_manage_tmpfs_role($1_r, $1_usertype)
++ ifelse(`$1',`unconfined',`',`
++ gen_tunable(allow_$1_exec_content, true)
- userdom_exec_user_tmp_files($1_t)
- userdom_exec_user_home_content_files($1_t)
-+ ifelse(`$1',`unconfined',`',`
-+ gen_tunable(allow_$1_exec_content, true)
-+
+ tunable_policy(`allow_$1_exec_content',`
+ userdom_exec_user_tmp_files($1_usertype)
+ userdom_exec_user_home_content_files($1_usertype)
@@ -66739,7 +61773,7 @@ index 28b88de..240fa6c 100644
userdom_change_password_template($1)
-@@ -736,72 +908,71 @@ template(`userdom_login_user_template', `
+@@ -736,72 +908,76 @@ template(`userdom_login_user_template', `
allow $1_t self:context contains;
@@ -66783,11 +61817,12 @@ index 28b88de..240fa6c 100644
auth_dontaudit_write_login_records($1_t)
+ auth_rw_cache($1_t)
-- application_exec_all($1_t)
+ application_exec_all($1_t)
-
-- # The library functions always try to open read-write first,
-- # then fall back to read-only if it fails.
-- init_dontaudit_rw_utmp($1_t)
+ # The library functions always try to open read-write first,
+ # then fall back to read-only if it fails.
+ init_dontaudit_rw_utmp($1_t)
++
# Stop warnings about access to /dev/console
- init_dontaudit_use_fds($1_t)
- init_dontaudit_use_script_fds($1_t)
@@ -66809,46 +61844,46 @@ index 28b88de..240fa6c 100644
- seutil_read_config($1_t)
+ seutil_read_config($1_usertype)
-+
-+ optional_policy(`
-+ cups_read_config($1_usertype)
-+ cups_stream_connect($1_usertype)
-+ cups_stream_connect_ptal($1_usertype)
-+ ')
optional_policy(`
- cups_read_config($1_t)
- cups_stream_connect($1_t)
- cups_stream_connect_ptal($1_t)
-+ kerberos_use($1_usertype)
-+ kerberos_filetrans_home_content($1_usertype)
++ cups_read_config($1_usertype)
++ cups_stream_connect($1_usertype)
++ cups_stream_connect_ptal($1_usertype)
')
optional_policy(`
- kerberos_use($1_t)
-+ mta_dontaudit_read_spool_symlinks($1_usertype)
++ kerberos_use($1_usertype)
++ kerberos_filetrans_home_content($1_usertype)
')
optional_policy(`
- mta_dontaudit_read_spool_symlinks($1_t)
-+ quota_dontaudit_getattr_db($1_usertype)
++ mta_dontaudit_read_spool_symlinks($1_usertype)
')
optional_policy(`
- quota_dontaudit_getattr_db($1_t)
-+ rpm_read_db($1_usertype)
-+ rpm_dontaudit_manage_db($1_usertype)
-+ rpm_read_cache($1_usertype)
++ quota_dontaudit_getattr_db($1_usertype)
')
optional_policy(`
- rpm_read_db($1_t)
- rpm_dontaudit_manage_db($1_t)
++ rpm_read_db($1_usertype)
++ rpm_dontaudit_manage_db($1_usertype)
++ rpm_read_cache($1_usertype)
++ ')
++
++ optional_policy(`
+ oddjob_run_mkhomedir($1_t, $1_r)
')
')
-@@ -833,6 +1004,9 @@ template(`userdom_restricted_user_template',`
+@@ -833,6 +1009,9 @@ template(`userdom_restricted_user_template',`
typeattribute $1_t unpriv_userdomain;
domain_interactive_fd($1_t)
@@ -66858,7 +61893,7 @@ index 28b88de..240fa6c 100644
##############################
#
# Local policy
-@@ -874,45 +1048,118 @@ template(`userdom_restricted_xwindows_user_template',`
+@@ -874,45 +1053,118 @@ template(`userdom_restricted_xwindows_user_template',`
#
auth_role($1_r, $1_t)
@@ -66918,7 +61953,7 @@ index 28b88de..240fa6c 100644
+ gnome_read_usr_config($1_usertype)
+ gnome_role_gkeyringd($1, $1_r, $1_t)
+ # cjp: telepathy F15 bugs
-+ telepathy_dbus_session_role($1_r, $1_t, $1)
++ telepathy_role($1_r, $1_t, $1)
')
optional_policy(`
@@ -66988,7 +62023,7 @@ index 28b88de..240fa6c 100644
')
')
-@@ -947,7 +1194,7 @@ template(`userdom_unpriv_user_template', `
+@@ -947,7 +1199,7 @@ template(`userdom_unpriv_user_template', `
#
# Inherit rules for ordinary users.
@@ -66997,7 +62032,7 @@ index 28b88de..240fa6c 100644
userdom_common_user_template($1)
##############################
-@@ -956,54 +1203,83 @@ template(`userdom_unpriv_user_template', `
+@@ -956,12 +1208,15 @@ template(`userdom_unpriv_user_template', `
#
# port access is audited even if dac would not have allowed it, so dontaudit it here
@@ -67006,25 +62041,18 @@ index 28b88de..240fa6c 100644
# Need the following rule to allow users to run vpnc
corenet_tcp_bind_xserver_port($1_t)
+ corenet_tcp_bind_generic_node($1_usertype)
++
++ storage_rw_fuse($1_t)
-- files_exec_usr_files($1_t)
+ files_exec_usr_files($1_t)
- # cjp: why?
-- files_read_kernel_symbol_table($1_t)
--
-- ifndef(`enable_mls',`
-- fs_exec_noxattr($1_t)
--
-- tunable_policy(`user_rw_noexattrfile',`
-- fs_manage_noxattr_fs_files($1_t)
-- fs_manage_noxattr_fs_dirs($1_t)
-- # Write floppies
-- storage_raw_read_removable_device($1_t)
-- storage_raw_write_removable_device($1_t)
-- ',`
-- storage_raw_read_removable_device($1_t)
-- ')
-- ')
-+ storage_rw_fuse($1_t)
++ # cjp: why?
+ files_read_kernel_symbol_table($1_t)
+
+ ifndef(`enable_mls',`
+@@ -978,32 +1233,76 @@ template(`userdom_unpriv_user_template', `
+ ')
+ ')
- tunable_policy(`user_dmesg',`
- kernel_read_ring_buffer($1_t)
@@ -67052,12 +62080,14 @@ index 28b88de..240fa6c 100644
')
optional_policy(`
-- netutils_run_ping_cond($1_t,$1_r)
-- netutils_run_traceroute_cond($1_t,$1_r)
+- netutils_run_ping_cond($1_t, $1_r)
+- netutils_run_traceroute_cond($1_t, $1_r)
+ cdrecord_role($1_r, $1_t)
-+ ')
-+
-+ optional_policy(`
+ ')
+
+- # Run pppd in pppd_t by default for user
+ optional_policy(`
+- ppp_run_cond($1_t, $1_r)
+ cron_role($1_r, $1_t)
+ ')
+
@@ -67083,21 +62113,19 @@ index 28b88de..240fa6c 100644
+
+ optional_policy(`
+ java_role_template($1, $1_r, $1_t)
- ')
-
-- # Run pppd in pppd_t by default for user
- optional_policy(`
-- ppp_run_cond($1_t,$1_r)
++ ')
++
++ optional_policy(`
+ mono_role_template($1, $1_r, $1_t)
++ ')
++
++ optional_policy(`
++ mount_run_fusermount($1_t, $1_r)
++ mount_read_pid_files($1_t)
')
optional_policy(`
- setroubleshoot_stream_connect($1_t)
-+ mount_run_fusermount($1_t, $1_r)
-+ mount_read_pid_files($1_t)
-+ ')
-+
-+ optional_policy(`
+ wine_role_template($1, $1_r, $1_t)
+ ')
+
@@ -67111,7 +62139,7 @@ index 28b88de..240fa6c 100644
')
')
-@@ -1039,7 +1315,7 @@ template(`userdom_unpriv_user_template', `
+@@ -1039,7 +1338,7 @@ template(`userdom_unpriv_user_template', `
template(`userdom_admin_user_template',`
gen_require(`
attribute admindomain;
@@ -67120,7 +62148,7 @@ index 28b88de..240fa6c 100644
')
##############################
-@@ -1066,6 +1342,7 @@ template(`userdom_admin_user_template',`
+@@ -1066,6 +1365,7 @@ template(`userdom_admin_user_template',`
#
allow $1_t self:capability ~{ sys_module audit_control audit_write };
@@ -67128,7 +62156,7 @@ index 28b88de..240fa6c 100644
allow $1_t self:process { setexec setfscreate };
allow $1_t self:netlink_audit_socket nlmsg_readpriv;
allow $1_t self:tun_socket create;
-@@ -1074,6 +1351,9 @@ template(`userdom_admin_user_template',`
+@@ -1074,6 +1374,9 @@ template(`userdom_admin_user_template',`
# Skip authentication when pam_rootok is specified.
allow $1_t self:passwd rootok;
@@ -67138,7 +62166,7 @@ index 28b88de..240fa6c 100644
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
kernel_getattr_message_if($1_t)
-@@ -1088,6 +1368,7 @@ template(`userdom_admin_user_template',`
+@@ -1088,6 +1391,7 @@ template(`userdom_admin_user_template',`
kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t)
@@ -67146,7 +62174,7 @@ index 28b88de..240fa6c 100644
corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels
-@@ -1105,10 +1386,13 @@ template(`userdom_admin_user_template',`
+@@ -1105,10 +1409,13 @@ template(`userdom_admin_user_template',`
dev_rename_all_blk_files($1_t)
dev_rename_all_chr_files($1_t)
dev_create_generic_symlinks($1_t)
@@ -67160,7 +62188,7 @@ index 28b88de..240fa6c 100644
domain_dontaudit_ptrace_all_domains($1_t)
# signal all domains:
domain_kill_all_domains($1_t)
-@@ -1119,17 +1403,22 @@ template(`userdom_admin_user_template',`
+@@ -1119,17 +1426,22 @@ template(`userdom_admin_user_template',`
domain_sigchld_all_domains($1_t)
# for lsof
domain_getattr_all_sockets($1_t)
@@ -67184,7 +62212,7 @@ index 28b88de..240fa6c 100644
auth_getattr_shadow($1_t)
# Manage almost all files
-@@ -1141,7 +1430,10 @@ template(`userdom_admin_user_template',`
+@@ -1141,7 +1453,10 @@ template(`userdom_admin_user_template',`
logging_send_syslog_msg($1_t)
@@ -67196,7 +62224,7 @@ index 28b88de..240fa6c 100644
# The following rule is temporary until such time that a complete
# policy management infrastructure is in place so that an administrator
-@@ -1210,6 +1502,8 @@ template(`userdom_security_admin_template',`
+@@ -1210,6 +1525,8 @@ template(`userdom_security_admin_template',`
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@@ -67205,7 +62233,7 @@ index 28b88de..240fa6c 100644
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
-@@ -1222,6 +1516,7 @@ template(`userdom_security_admin_template',`
+@@ -1222,6 +1539,7 @@ template(`userdom_security_admin_template',`
selinux_set_enforce_mode($1)
selinux_set_all_booleans($1)
selinux_set_parameters($1)
@@ -67213,17 +62241,20 @@ index 28b88de..240fa6c 100644
auth_relabel_all_files_except_shadow($1)
auth_relabel_shadow($1)
-@@ -1234,11 +1529,22 @@ template(`userdom_security_admin_template',`
+@@ -1234,13 +1552,24 @@ template(`userdom_security_admin_template',`
logging_read_audit_config($1)
seutil_manage_bin_policy($1)
+- seutil_run_checkpolicy($1, $2)
+- seutil_run_loadpolicy($1, $2)
+- seutil_run_semanage($1, $2)
+ seutil_manage_default_contexts($1)
+ seutil_manage_file_contexts($1)
+ seutil_manage_module_store($1)
+ seutil_manage_config($1)
- seutil_run_checkpolicy($1,$2)
- seutil_run_loadpolicy($1,$2)
- seutil_run_semanage($1,$2)
++ seutil_run_checkpolicy($1,$2)
++ seutil_run_loadpolicy($1,$2)
++ seutil_run_semanage($1,$2)
+ seutil_run_setsebool($1,$2)
seutil_run_setfiles($1, $2)
@@ -67234,9 +62265,28 @@ index 28b88de..240fa6c 100644
+ seutil_manage_config($1)
+
optional_policy(`
- aide_run($1,$2)
+- aide_run($1, $2)
++ aide_run($1,$2)
')
-@@ -1279,54 +1585,66 @@ template(`userdom_security_admin_template',`
+
+ optional_policy(`
+@@ -1251,12 +1580,12 @@ template(`userdom_security_admin_template',`
+ dmesg_exec($1)
+ ')
+
+- optional_policy(`
+- ipsec_run_setkey($1, $2)
++ optional_policy(`
++ ipsec_run_setkey($1,$2)
+ ')
+
+ optional_policy(`
+- netlabel_run_mgmt($1, $2)
++ netlabel_run_mgmt($1,$2)
+ ')
+
+ optional_policy(`
+@@ -1279,54 +1608,66 @@ template(`userdom_security_admin_template',`
interface(`userdom_user_home_content',`
gen_require(`
type user_home_t;
@@ -67318,7 +62368,7 @@ index 28b88de..240fa6c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1334,9 +1652,46 @@ interface(`userdom_setattr_user_ptys',`
+@@ -1334,12 +1675,49 @@ interface(`userdom_setattr_user_ptys',`
## </summary>
## </param>
#
@@ -67327,8 +62377,9 @@ index 28b88de..240fa6c 100644
gen_require(`
- type user_devpts_t;
+ attribute admindomain;
-+ ')
-+
+ ')
+
+- term_create_pty($1, user_devpts_t)
+ allow $1 admindomain:tun_socket relabelfrom;
+ allow $1 self:tun_socket relabelto;
+')
@@ -67364,10 +62415,13 @@ index 28b88de..240fa6c 100644
+interface(`userdom_create_user_pty',`
+ gen_require(`
+ type user_devpts_t;
- ')
++ ')
++
++ term_create_pty($1, user_devpts_t)
+ ')
- term_create_pty($1, user_devpts_t)
-@@ -1395,6 +1750,7 @@ interface(`userdom_search_user_home_dirs',`
+ ########################################
+@@ -1395,6 +1773,7 @@ interface(`userdom_search_user_home_dirs',`
')
allow $1 user_home_dir_t:dir search_dir_perms;
@@ -67375,7 +62429,7 @@ index 28b88de..240fa6c 100644
files_search_home($1)
')
-@@ -1441,6 +1797,14 @@ interface(`userdom_list_user_home_dirs',`
+@@ -1441,6 +1820,14 @@ interface(`userdom_list_user_home_dirs',`
allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1)
@@ -67390,7 +62444,7 @@ index 28b88de..240fa6c 100644
')
########################################
-@@ -1456,9 +1820,11 @@ interface(`userdom_list_user_home_dirs',`
+@@ -1456,9 +1843,11 @@ interface(`userdom_list_user_home_dirs',`
interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
type user_home_dir_t;
@@ -67402,7 +62456,7 @@ index 28b88de..240fa6c 100644
')
########################################
-@@ -1515,6 +1881,42 @@ interface(`userdom_relabelto_user_home_dirs',`
+@@ -1515,6 +1904,42 @@ interface(`userdom_relabelto_user_home_dirs',`
allow $1 user_home_dir_t:dir relabelto;
')
@@ -67445,7 +62499,7 @@ index 28b88de..240fa6c 100644
########################################
## <summary>
## Create directories in the home dir root with
-@@ -1589,6 +1991,8 @@ interface(`userdom_dontaudit_search_user_home_content',`
+@@ -1589,6 +2014,8 @@ interface(`userdom_dontaudit_search_user_home_content',`
')
dontaudit $1 user_home_t:dir search_dir_perms;
@@ -67454,7 +62508,7 @@ index 28b88de..240fa6c 100644
')
########################################
-@@ -1603,10 +2007,12 @@ interface(`userdom_dontaudit_search_user_home_content',`
+@@ -1603,10 +2030,12 @@ interface(`userdom_dontaudit_search_user_home_content',`
#
interface(`userdom_list_user_home_content',`
gen_require(`
@@ -67469,7 +62523,7 @@ index 28b88de..240fa6c 100644
')
########################################
-@@ -1649,6 +2055,43 @@ interface(`userdom_delete_user_home_content_dirs',`
+@@ -1649,6 +2078,43 @@ interface(`userdom_delete_user_home_content_dirs',`
########################################
## <summary>
@@ -67513,7 +62567,7 @@ index 28b88de..240fa6c 100644
## Do not audit attempts to set the
## attributes of user home files.
## </summary>
-@@ -1668,6 +2111,25 @@ interface(`userdom_dontaudit_setattr_user_home_content_files',`
+@@ -1668,6 +2134,25 @@ interface(`userdom_dontaudit_setattr_user_home_content_files',`
########################################
## <summary>
@@ -67539,7 +62593,7 @@ index 28b88de..240fa6c 100644
## Mmap user home files.
## </summary>
## <param name="domain">
-@@ -1700,12 +2162,32 @@ interface(`userdom_read_user_home_content_files',`
+@@ -1700,12 +2185,32 @@ interface(`userdom_read_user_home_content_files',`
type user_home_dir_t, user_home_t;
')
@@ -67572,7 +62626,7 @@ index 28b88de..240fa6c 100644
## Do not audit attempts to read user home files.
## </summary>
## <param name="domain">
-@@ -1716,11 +2198,14 @@ interface(`userdom_read_user_home_content_files',`
+@@ -1716,11 +2221,14 @@ interface(`userdom_read_user_home_content_files',`
#
interface(`userdom_dontaudit_read_user_home_content_files',`
gen_require(`
@@ -67590,7 +62644,7 @@ index 28b88de..240fa6c 100644
')
########################################
-@@ -1779,6 +2264,60 @@ interface(`userdom_delete_user_home_content_files',`
+@@ -1779,6 +2287,60 @@ interface(`userdom_delete_user_home_content_files',`
########################################
## <summary>
@@ -67651,7 +62705,7 @@ index 28b88de..240fa6c 100644
## Do not audit attempts to write user home files.
## </summary>
## <param name="domain">
-@@ -1810,8 +2349,7 @@ interface(`userdom_read_user_home_content_symlinks',`
+@@ -1810,8 +2372,7 @@ interface(`userdom_read_user_home_content_symlinks',`
type user_home_dir_t, user_home_t;
')
@@ -67661,7 +62715,7 @@ index 28b88de..240fa6c 100644
')
########################################
-@@ -1827,20 +2365,14 @@ interface(`userdom_read_user_home_content_symlinks',`
+@@ -1827,20 +2388,14 @@ interface(`userdom_read_user_home_content_symlinks',`
#
interface(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -67686,7 +62740,7 @@ index 28b88de..240fa6c 100644
########################################
## <summary>
-@@ -1941,6 +2473,24 @@ interface(`userdom_delete_user_home_content_symlinks',`
+@@ -1941,6 +2496,24 @@ interface(`userdom_delete_user_home_content_symlinks',`
########################################
## <summary>
@@ -67711,7 +62765,7 @@ index 28b88de..240fa6c 100644
## Create, read, write, and delete named pipes
## in a user home subdirectory.
## </summary>
-@@ -2008,7 +2558,7 @@ interface(`userdom_user_home_dir_filetrans',`
+@@ -2008,7 +2581,7 @@ interface(`userdom_user_home_dir_filetrans',`
type user_home_dir_t;
')
@@ -67720,7 +62774,7 @@ index 28b88de..240fa6c 100644
files_search_home($1)
')
-@@ -2182,7 +2732,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
+@@ -2182,7 +2755,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
type user_tmp_t;
')
@@ -67729,7 +62783,7 @@ index 28b88de..240fa6c 100644
')
########################################
-@@ -2435,13 +2985,14 @@ interface(`userdom_read_user_tmpfs_files',`
+@@ -2435,13 +3008,14 @@ interface(`userdom_read_user_tmpfs_files',`
')
read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
@@ -67745,7 +62799,7 @@ index 28b88de..240fa6c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2462,26 +3013,6 @@ interface(`userdom_rw_user_tmpfs_files',`
+@@ -2462,26 +3036,6 @@ interface(`userdom_rw_user_tmpfs_files',`
########################################
## <summary>
@@ -67772,7 +62826,7 @@ index 28b88de..240fa6c 100644
## Get the attributes of a user domain tty.
## </summary>
## <param name="domain">
-@@ -2572,7 +3103,7 @@ interface(`userdom_use_user_ttys',`
+@@ -2572,7 +3126,7 @@ interface(`userdom_use_user_ttys',`
########################################
## <summary>
@@ -67781,7 +62835,7 @@ index 28b88de..240fa6c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2580,70 +3111,138 @@ interface(`userdom_use_user_ttys',`
+@@ -2580,70 +3134,138 @@ interface(`userdom_use_user_ttys',`
## </summary>
## </param>
#
@@ -67853,9 +62907,8 @@ index 28b88de..240fa6c 100644
gen_require(`
- type user_tty_device_t, user_devpts_t;
+ type user_devpts_t;
- ')
-
-- dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
++ ')
++
+ allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
+')
+
@@ -67922,9 +62975,9 @@ index 28b88de..240fa6c 100644
+interface(`userdom_dontaudit_use_user_terminals',`
+ gen_require(`
+ type user_tty_device_t, user_devpts_t;
-+ ')
-+
-+ dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
+ ')
+
+ dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
dontaudit $1 user_devpts_t:chr_file rw_term_perms;
')
@@ -67950,7 +63003,58 @@ index 28b88de..240fa6c 100644
########################################
## <summary>
## Execute a shell in all user domains. This
-@@ -2815,7 +3414,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
+@@ -2736,24 +3358,6 @@ interface(`userdom_xsession_spec_domtrans_unpriv_users',`
+ allow unpriv_userdomain $1:process sigchld;
+ ')
+
+-#######################################
+-## <summary>
+-## Read and write unpriviledged user SysV sempaphores.
+-## </summary>
+-## <param name="domain">
+-## <summary>
+-## Domain allowed access.
+-## </summary>
+-## </param>
+-#
+-interface(`userdom_rw_unpriv_user_semaphores',`
+- gen_require(`
+- attribute unpriv_userdomain;
+- ')
+-
+- allow $1 unpriv_userdomain:sem rw_sem_perms;
+-')
+-
+ ########################################
+ ## <summary>
+ ## Manage unpriviledged user SysV sempaphores.
+@@ -2772,25 +3376,6 @@ interface(`userdom_manage_unpriv_user_semaphores',`
+ allow $1 unpriv_userdomain:sem create_sem_perms;
+ ')
+
+-#######################################
+-## <summary>
+-## Read and write unpriviledged user SysV shared
+-## memory segments.
+-## </summary>
+-## <param name="domain">
+-## <summary>
+-## Domain allowed access.
+-## </summary>
+-## </param>
+-#
+-interface(`userdom_rw_unpriv_user_shared_mem',`
+- gen_require(`
+- attribute unpriv_userdomain;
+- ')
+-
+- allow $1 unpriv_userdomain:shm rw_shm_perms;
+-')
+-
+ ########################################
+ ## <summary>
+ ## Manage unpriviledged user SysV shared
+@@ -2852,7 +3437,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
domain_entry_file_spec_domtrans($1, unpriv_userdomain)
allow unpriv_userdomain $1:fd use;
@@ -67959,7 +63063,7 @@ index 28b88de..240fa6c 100644
allow unpriv_userdomain $1:process sigchld;
')
-@@ -2831,11 +3430,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
+@@ -2868,29 +3453,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
#
interface(`userdom_search_user_home_content',`
gen_require(`
@@ -67970,12 +63074,30 @@ index 28b88de..240fa6c 100644
files_list_home($1)
- allow $1 { user_home_dir_t user_home_t }:dir search_dir_perms;
+-')
+-
+-########################################
+-## <summary>
+-## Send signull to unprivileged user domains.
+-## </summary>
+-## <param name="domain">
+-## <summary>
+-## Domain allowed access.
+-## </summary>
+-## </param>
+-#
+-interface(`userdom_signull_unpriv_users',`
+- gen_require(`
+- attribute unpriv_userdomain;
+- ')
+-
+- allow $1 unpriv_userdomain:process signull;
+ allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
+ allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
')
########################################
-@@ -2917,7 +3518,7 @@ interface(`userdom_dontaudit_use_user_ptys',`
+@@ -2972,7 +3541,7 @@ interface(`userdom_dontaudit_use_user_ptys',`
type user_devpts_t;
')
@@ -67984,7 +63106,7 @@ index 28b88de..240fa6c 100644
')
########################################
-@@ -2972,7 +3573,45 @@ interface(`userdom_write_user_tmp_files',`
+@@ -3027,7 +3596,45 @@ interface(`userdom_write_user_tmp_files',`
type user_tmp_t;
')
@@ -68031,7 +63153,7 @@ index 28b88de..240fa6c 100644
')
########################################
-@@ -3009,6 +3648,7 @@ interface(`userdom_read_all_users_state',`
+@@ -3064,6 +3671,7 @@ interface(`userdom_read_all_users_state',`
')
read_files_pattern($1, userdomain, userdomain)
@@ -68039,7 +63161,7 @@ index 28b88de..240fa6c 100644
kernel_search_proc($1)
')
-@@ -3087,6 +3727,24 @@ interface(`userdom_signal_all_users',`
+@@ -3142,6 +3750,24 @@ interface(`userdom_signal_all_users',`
########################################
## <summary>
@@ -68064,7 +63186,7 @@ index 28b88de..240fa6c 100644
## Send a SIGCHLD signal to all user domains.
## </summary>
## <param name="domain">
-@@ -3139,3 +3797,1058 @@ interface(`userdom_dbus_send_all_users',`
+@@ -3194,3 +3820,1075 @@ interface(`userdom_dbus_send_all_users',`
allow $1 userdomain:dbus send_msg;
')
@@ -69123,11 +64245,28 @@ index 28b88de..240fa6c 100644
+ dontaudit $1 user_tmp_type:file read_file_perms;
+')
+
++#######################################
++## <summary>
++## Read and write unpriviledged user SysV sempaphores.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`userdom_rw_unpriv_user_semaphores',`
++ gen_require(`
++ attribute unpriv_userdomain;
++ ')
++
++ allow $1 unpriv_userdomain:sem rw_sem_perms;
++')
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
-index df29ca1..54e3feb 100644
+index 9b4a930..6bdf7f7 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
-@@ -7,7 +7,7 @@ policy_module(userdomain, 4.5.0)
+@@ -7,7 +7,7 @@ policy_module(userdomain, 4.5.2)
## <desc>
## <p>