diff --git a/booleans-targeted.conf b/booleans-targeted.conf
index c08c7a9..8662f82 100644
--- a/booleans-targeted.conf
+++ b/booleans-targeted.conf
@@ -245,7 +245,7 @@ allow_nsplugin_execmem=true
# Allow unconfined domain to transition to confined domain
#
-allow_unconfined_nsplugin_transition=true
+allow_unconfined_nsplugin_transition=false
# System uses init upstart program
#
diff --git a/policy-F12.patch b/policy-F12.patch
index 6c82550..41a9d6c 100644
--- a/policy-F12.patch
+++ b/policy-F12.patch
@@ -12909,7 +12909,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.6.32/policy/modules/services/networkmanager.te
--- nsaserefpolicy/policy/modules/services/networkmanager.te 2009-08-14 13:14:31.000000000 -0700
-+++ serefpolicy-3.6.32/policy/modules/services/networkmanager.te 2009-09-21 19:37:35.000000000 -0700
++++ serefpolicy-3.6.32/policy/modules/services/networkmanager.te 2009-09-24 17:38:43.000000000 -0700
@@ -19,6 +19,9 @@
type NetworkManager_tmp_t;
files_tmp_file(NetworkManager_tmp_t)
@@ -12951,16 +12951,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_dirs_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
-@@ -63,6 +70,8 @@
+@@ -63,6 +70,9 @@
kernel_read_network_state(NetworkManager_t)
kernel_read_kernel_sysctls(NetworkManager_t)
kernel_load_module(NetworkManager_t)
++kernel_request_load_module(NetworkManager_t)
+kernel_read_debugfs(NetworkManager_t)
+kernel_rw_net_sysctls(NetworkManager_t)
corenet_all_recvfrom_unlabeled(NetworkManager_t)
corenet_all_recvfrom_netlabel(NetworkManager_t)
-@@ -81,13 +90,18 @@
+@@ -81,13 +91,18 @@
corenet_sendrecv_isakmp_server_packets(NetworkManager_t)
corenet_sendrecv_dhcpc_server_packets(NetworkManager_t)
corenet_sendrecv_all_client_packets(NetworkManager_t)
@@ -12979,7 +12980,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
mls_file_read_all_levels(NetworkManager_t)
-@@ -98,15 +112,20 @@
+@@ -98,15 +113,20 @@
domain_use_interactive_fds(NetworkManager_t)
domain_read_confined_domains_state(NetworkManager_t)
@@ -13001,7 +13002,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_send_syslog_msg(NetworkManager_t)
miscfiles_read_localization(NetworkManager_t)
-@@ -116,25 +135,40 @@
+@@ -116,25 +136,40 @@
seutil_read_config(NetworkManager_t)
@@ -13049,7 +13050,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-@@ -146,8 +180,25 @@
+@@ -146,8 +181,25 @@
')
optional_policy(`
@@ -13077,7 +13078,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-@@ -155,23 +206,51 @@
+@@ -155,23 +207,51 @@
')
optional_policy(`
@@ -13131,7 +13132,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-@@ -179,12 +258,15 @@
+@@ -179,12 +259,15 @@
')
optional_policy(`
@@ -15843,7 +15844,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.6.32/policy/modules/services/rpc.if
--- nsaserefpolicy/policy/modules/services/rpc.if 2009-07-14 11:19:57.000000000 -0700
-+++ serefpolicy-3.6.32/policy/modules/services/rpc.if 2009-09-16 07:03:09.000000000 -0700
++++ serefpolicy-3.6.32/policy/modules/services/rpc.if 2009-09-25 07:42:34.000000000 -0700
@@ -54,7 +54,7 @@
allow $1_t self:unix_dgram_socket create_socket_perms;
allow $1_t self:unix_stream_socket create_stream_socket_perms;
@@ -15853,7 +15854,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_dirs_pattern($1_t, var_lib_nfs_t, var_lib_nfs_t)
manage_files_pattern($1_t, var_lib_nfs_t, var_lib_nfs_t)
-@@ -109,6 +109,10 @@
+@@ -99,6 +99,7 @@
+ files_read_etc_runtime_files($1_t)
+ files_search_var($1_t)
+ files_search_var_lib($1_t)
++ files_list_home($1_t)
+
+ auth_use_nsswitch($1_t)
+
+@@ -109,6 +110,10 @@
userdom_dontaudit_use_unpriv_user_fds($1_t)
optional_policy(`
@@ -15866,7 +15875,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.6.32/policy/modules/services/rpc.te
--- nsaserefpolicy/policy/modules/services/rpc.te 2009-08-14 13:14:31.000000000 -0700
-+++ serefpolicy-3.6.32/policy/modules/services/rpc.te 2009-09-16 07:03:09.000000000 -0700
++++ serefpolicy-3.6.32/policy/modules/services/rpc.te 2009-09-25 07:42:43.000000000 -0700
+@@ -53,7 +53,7 @@
+ # RPC local policy
+ #
+
+-allow rpcd_t self:capability { chown dac_override setgid setuid };
++allow rpcd_t self:capability { sys_admin chown dac_override setgid setuid };
+ allow rpcd_t self:fifo_file rw_fifo_file_perms;
+
+ allow rpcd_t rpcd_var_run_t:dir setattr;
@@ -91,6 +91,8 @@
seutil_dontaudit_search_config(rpcd_t)
@@ -19016,7 +19034,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_connect_http_port(httpd_w3c_validator_script_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.6.32/policy/modules/services/xserver.fc
--- nsaserefpolicy/policy/modules/services/xserver.fc 2009-07-14 11:19:57.000000000 -0700
-+++ serefpolicy-3.6.32/policy/modules/services/xserver.fc 2009-09-16 07:03:09.000000000 -0700
++++ serefpolicy-3.6.32/policy/modules/services/xserver.fc 2009-09-25 07:58:35.000000000 -0700
@@ -3,12 +3,17 @@
#
HOME_DIR/\.fonts\.conf -- gen_context(system_u:object_r:user_fonts_config_t,s0)
@@ -19028,7 +19046,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
HOME_DIR/\.xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
+HOME_DIR/\.xsession-errors.* -- gen_context(system_u:object_r:xdm_home_t,s0)
-+HOME_DIR/\.dmrc -- gen_context(system_u:object_r:xdm_home_t,s0)
++HOME_DIR/\.dmrc.* -- gen_context(system_u:object_r:xdm_home_t,s0)
+/root/\.Xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
+/root/\.xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
@@ -23546,8 +23564,36 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/etc/share/selinux/mls(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.6.32/policy/modules/system/selinuxutil.if
--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2009-07-14 11:19:57.000000000 -0700
-+++ serefpolicy-3.6.32/policy/modules/system/selinuxutil.if 2009-09-16 07:03:09.000000000 -0700
-@@ -535,6 +535,53 @@
++++ serefpolicy-3.6.32/policy/modules/system/selinuxutil.if 2009-09-24 20:11:24.000000000 -0700
+@@ -351,6 +351,27 @@
+
+ ########################################
+ ##
++## Execute restorecond in the caller domain.
++##
++##
++##
++## Domain allowed access.
++##
++##
++##
++#
++interface(`seutil_exec_restorecond',`
++ gen_require(`
++ type restorecond_exec_t;
++ ')
++
++ files_search_usr($1)
++ corecmd_search_bin($1)
++ can_exec($1, restorecond_exec_t)
++')
++
++########################################
++##
+ ## Execute run_init in the run_init domain.
+ ##
+ ##
+@@ -535,6 +556,53 @@
########################################
##
@@ -23601,7 +23647,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Execute setfiles in the caller domain.
##
##
-@@ -680,6 +727,7 @@
+@@ -680,6 +748,7 @@
')
files_search_etc($1)
@@ -23609,7 +23655,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_files_pattern($1, selinux_config_t, selinux_config_t)
read_lnk_files_pattern($1, selinux_config_t, selinux_config_t)
')
-@@ -999,6 +1047,26 @@
+@@ -999,6 +1068,26 @@
########################################
##
@@ -23636,7 +23682,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Execute semanage in the semanage domain, and
## allow the specified role the semanage domain,
## and use the caller's terminal.
-@@ -1010,7 +1078,7 @@
+@@ -1010,7 +1099,7 @@
##
##
##
@@ -23645,7 +23691,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
##
##
-@@ -1028,6 +1096,33 @@
+@@ -1028,6 +1117,33 @@
########################################
##
@@ -23679,7 +23725,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Full management of the semanage
## module store.
##
-@@ -1139,3 +1234,194 @@
+@@ -1139,3 +1255,194 @@
selinux_dontaudit_get_fs_mount($1)
seutil_dontaudit_read_config($1)
')
@@ -25608,7 +25654,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+HOME_DIR/\.gvfs(/.*)? <>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.32/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-08-31 10:30:04.000000000 -0700
-+++ serefpolicy-3.6.32/policy/modules/system/userdomain.if 2009-09-21 05:24:59.000000000 -0700
++++ serefpolicy-3.6.32/policy/modules/system/userdomain.if 2009-09-24 20:12:04.000000000 -0700
@@ -30,8 +30,9 @@
')
@@ -26055,7 +26101,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##############################
#
-@@ -508,182 +515,208 @@
+@@ -508,182 +515,209 @@
# evolution and gnome-session try to create a netlink socket
dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
@@ -26160,6 +26206,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
seutil_exec_checkpolicy($1_t)
- seutil_exec_setfiles($1_t)
+ seutil_exec_setfiles($1_usertype)
++ seutil_exec_restorecond($1_usertype)
# for when the network connection is killed
# this is needed when a login role can change
# to this one.
@@ -26337,7 +26384,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
#######################################
-@@ -711,13 +744,26 @@
+@@ -711,13 +745,26 @@
userdom_base_user_template($1)
@@ -26369,7 +26416,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_change_password_template($1)
-@@ -735,70 +781,71 @@
+@@ -735,70 +782,71 @@
allow $1_t self:context contains;
@@ -26474,7 +26521,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
')
-@@ -835,6 +882,32 @@
+@@ -835,6 +883,32 @@
# Local policy
#
@@ -26507,7 +26554,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
loadkeys_run($1_t,$1_r)
')
-@@ -865,51 +938,81 @@
+@@ -865,51 +939,81 @@
userdom_restricted_user_template($1)
@@ -26602,7 +26649,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
')
-@@ -943,8 +1046,8 @@
+@@ -943,8 +1047,8 @@
# Declarations
#
@@ -26612,7 +26659,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_common_user_template($1)
##############################
-@@ -953,11 +1056,12 @@
+@@ -953,11 +1057,12 @@
#
# port access is audited even if dac would not have allowed it, so dontaudit it here
@@ -26627,7 +26674,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# cjp: why?
files_read_kernel_symbol_table($1_t)
-@@ -975,36 +1079,53 @@
+@@ -975,36 +1080,53 @@
')
')
@@ -26695,7 +26742,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
')
-@@ -1040,7 +1161,7 @@
+@@ -1040,7 +1162,7 @@
template(`userdom_admin_user_template',`
gen_require(`
attribute admindomain;
@@ -26704,7 +26751,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
##############################
-@@ -1049,8 +1170,7 @@
+@@ -1049,8 +1171,7 @@
#
# Inherit rules for ordinary users.
@@ -26714,7 +26761,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domain_obj_id_change_exemption($1_t)
role system_r types $1_t;
-@@ -1075,6 +1195,9 @@
+@@ -1075,6 +1196,9 @@
# Skip authentication when pam_rootok is specified.
allow $1_t self:passwd rootok;
@@ -26724,7 +26771,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
kernel_getattr_message_if($1_t)
-@@ -1089,6 +1212,7 @@
+@@ -1089,6 +1213,7 @@
kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t)
@@ -26732,7 +26779,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels
-@@ -1096,8 +1220,6 @@
+@@ -1096,8 +1221,6 @@
dev_getattr_generic_blk_files($1_t)
dev_getattr_generic_chr_files($1_t)
@@ -26741,7 +26788,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Allow MAKEDEV to work
dev_create_all_blk_files($1_t)
dev_create_all_chr_files($1_t)
-@@ -1124,6 +1246,8 @@
+@@ -1124,6 +1247,8 @@
files_exec_usr_src_files($1_t)
fs_getattr_all_fs($1_t)
@@ -26750,7 +26797,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
fs_set_all_quotas($1_t)
fs_exec_noxattr($1_t)
-@@ -1152,20 +1276,6 @@
+@@ -1152,20 +1277,6 @@
# But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t)
@@ -26771,7 +26818,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
postgresql_unconfined($1_t)
')
-@@ -1211,6 +1321,7 @@
+@@ -1211,6 +1322,7 @@
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@@ -26779,7 +26826,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
-@@ -1276,11 +1387,15 @@
+@@ -1276,11 +1388,15 @@
interface(`userdom_user_home_content',`
gen_require(`
type user_home_t;
@@ -26795,7 +26842,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1391,12 +1506,13 @@
+@@ -1391,12 +1507,13 @@
')
allow $1 user_home_dir_t:dir search_dir_perms;
@@ -26810,7 +26857,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
##
##
-@@ -1429,6 +1545,14 @@
+@@ -1429,6 +1546,14 @@
allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1)
@@ -26825,7 +26872,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1444,9 +1568,11 @@
+@@ -1444,9 +1569,11 @@
interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
type user_home_dir_t;
@@ -26837,7 +26884,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1503,6 +1629,25 @@
+@@ -1503,6 +1630,25 @@
allow $1 user_home_dir_t:dir relabelto;
')
@@ -26863,7 +26910,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
##
## Create directories in the home dir root with
-@@ -1577,6 +1722,8 @@
+@@ -1577,6 +1723,8 @@
')
dontaudit $1 user_home_t:dir search_dir_perms;
@@ -26872,7 +26919,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1670,6 +1817,7 @@
+@@ -1670,6 +1818,7 @@
type user_home_dir_t, user_home_t;
')
@@ -26880,7 +26927,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
files_search_home($1)
')
-@@ -1797,19 +1945,32 @@
+@@ -1797,19 +1946,32 @@
#
interface(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -26920,7 +26967,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1844,6 +2005,7 @@
+@@ -1844,6 +2006,7 @@
interface(`userdom_manage_user_home_content_files',`
gen_require(`
type user_home_dir_t, user_home_t;
@@ -26928,7 +26975,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
manage_files_pattern($1, user_home_t, user_home_t)
-@@ -2391,27 +2553,7 @@
+@@ -2391,27 +2554,7 @@
########################################
##
@@ -26957,7 +27004,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
##
##
-@@ -2765,11 +2907,32 @@
+@@ -2765,11 +2908,32 @@
#
interface(`userdom_search_user_home_content',`
gen_require(`
@@ -26992,7 +27039,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2897,7 +3060,25 @@
+@@ -2897,7 +3061,25 @@
type user_tmp_t;
')
@@ -27019,7 +27066,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2934,6 +3115,7 @@
+@@ -2934,6 +3116,7 @@
')
read_files_pattern($1, userdomain, userdomain)
@@ -27027,7 +27074,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_search_proc($1)
')
-@@ -3064,3 +3246,559 @@
+@@ -3064,3 +3247,559 @@
allow $1 userdomain:dbus send_msg;
')
diff --git a/policygentool b/policygentool
index bbdfa97..117f4fa 100644
--- a/policygentool
+++ b/policygentool
@@ -1,297 +1,3 @@
-#! /usr/bin/env python
-# Copyright (C) 2006 Red Hat
-# see file 'COPYING' for use and warranty information
-#
-# policygentool is a tool for the initial generation of SELinux policy
-#
-# This program is free software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License as
-# published by the Free Software Foundation; either version 2 of
-# the License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
-# 02111-1307 USA
-#
-#
-import os, sys, getopt
-import re
-
-########################### Interface File #############################
-interface="""\
-## policy for TEMPLATETYPE
-
-########################################
-##
-## Execute a domain transition to run TEMPLATETYPE.
-##
-##
-##
-## Domain allowed to transition.
-##
-##
-#
-interface(`TEMPLATETYPE_domtrans',`
- gen_require(`
- type TEMPLATETYPE_t, TEMPLATETYPE_exec_t;
- ')
-
- domain_auto_trans($1,TEMPLATETYPE_exec_t,TEMPLATETYPE_t)
-
- allow TEMPLATETYPE_t $1:fd use;
- allow TEMPLATETYPE_t $1:fifo_file rw_file_perms;
- allow TEMPLATETYPE_t $1:process sigchld;
-')
-"""
-
-########################### Type Enforcement File #############################
-te="""\
-policy_module(TEMPLATETYPE,1.0.0)
-
-########################################
-#
-# Declarations
-#
-
-type TEMPLATETYPE_t;
-type TEMPLATETYPE_exec_t;
-domain_type(TEMPLATETYPE_t)
-init_daemon_domain(TEMPLATETYPE_t, TEMPLATETYPE_exec_t)
-"""
-te_logfile="""
-# log files
-type TEMPLATETYPE_var_log_t;
-logging_log_file(TEMPLATETYPE_var_log_t)
-"""
-te_pidfile="""
-# pid files
-type TEMPLATETYPE_var_run_t;
-files_pid_file(TEMPLATETYPE_var_run_t)
-"""
-te_libfile="""
-# var/lib files
-type TEMPLATETYPE_var_lib_t;
-files_type(TEMPLATETYPE_var_lib_t)
-"""
-te_sep="""
-########################################
-#
-# TEMPLATETYPE local policy
-#
-# Check in /etc/selinux/refpolicy/include for macros to use instead of allow rules.
-
-# Some common macros (you might be able to remove some)
-files_read_etc_files(TEMPLATETYPE_t)
-libs_use_ld_so(TEMPLATETYPE_t)
-libs_use_shared_libs(TEMPLATETYPE_t)
-miscfiles_read_localization(TEMPLATETYPE_t)
-## internal communication is often done using fifo and unix sockets.
-allow TEMPLATETYPE_t self:fifo_file { read write };
-allow TEMPLATETYPE_t self:unix_stream_socket create_stream_socket_perms;
-"""
-te_pidfile2="""
-# pid file
-allow TEMPLATETYPE_t TEMPLATETYPE_var_run_t:file manage_file_perms;
-allow TEMPLATETYPE_t TEMPLATETYPE_var_run_t:sock_file manage_file_perms;
-allow TEMPLATETYPE_t TEMPLATETYPE_var_run_t:dir rw_dir_perms;
-files_pid_filetrans(TEMPLATETYPE_t,TEMPLATETYPE_var_run_t, { file sock_file })
-"""
-te_logfile2="""
-# log files
-allow TEMPLATETYPE_t TEMPLATETYPE_var_log_t:file create_file_perms;
-allow TEMPLATETYPE_t TEMPLATETYPE_var_log_t:sock_file create_file_perms;
-allow TEMPLATETYPE_t TEMPLATETYPE_var_log_t:dir { rw_dir_perms setattr };
-logging_log_filetrans(TEMPLATETYPE_t,TEMPLATETYPE_var_log_t,{ sock_file file dir })
-"""
-te_libfile2="""
-# var/lib files for TEMPLATETYPE
-allow TEMPLATETYPE_t TEMPLATETYPE_var_lib_t:file create_file_perms;
-allow TEMPLATETYPE_t TEMPLATETYPE_var_lib_t:sock_file create_file_perms;
-allow TEMPLATETYPE_t TEMPLATETYPE_var_lib_t:dir create_dir_perms;
-files_var_lib_filetrans(TEMPLATETYPE_t,TEMPLATETYPE_var_lib_t, { file dir sock_file })
-"""
-te_network2="""
-## Networking basics (adjust to your needs!)
-sysnet_dns_name_resolve(TEMPLATETYPE_t)
-corenet_tcp_sendrecv_all_if(TEMPLATETYPE_t)
-corenet_tcp_sendrecv_all_nodes(TEMPLATETYPE_t)
-corenet_tcp_sendrecv_all_ports(TEMPLATETYPE_t)
-corenet_non_ipsec_sendrecv(TEMPLATETYPE_t)
-corenet_tcp_connect_http_port(TEMPLATETYPE_t)
-#corenet_tcp_connect_all_ports(TEMPLATETYPE_t)
-## if it is a network daemon, consider these:
-#corenet_tcp_bind_all_ports(TEMPLATETYPE_t)
-#corenet_tcp_bind_all_nodes(TEMPLATETYPE_t)
-allow TEMPLATETYPE_t self:tcp_socket { listen accept };
-"""
-te_initsc2="""
-# Init script handling
-init_use_fds(TEMPLATETYPE_t)
-init_use_script_ptys(TEMPLATETYPE_t)
-domain_use_interactive_fds(TEMPLATETYPE_t)
-"""
-
-########################### File Context ##################################
-fc="""\
-# TEMPLATETYPE executable will have:
-# label: system_u:object_r:TEMPLATETYPE_exec_t
-# MLS sensitivity: s0
-# MCS categories:
-
-EXECUTABLE -- gen_context(system_u:object_r:TEMPLATETYPE_exec_t,s0)
-"""
-fc_pidfile="""\
-FILENAME gen_context(system_u:object_r:TEMPLATETYPE_var_run_t,s0)
-"""
-fc_logfile="""\
-FILENAME gen_context(system_u:object_r:TEMPLATETYPE_var_log_t,s0)
-"""
-fc_libfile="""\
-FILENAME gen_context(system_u:object_r:TEMPLATETYPE_var_lib_t,s0)
-"""
-def errorExit(error):
- sys.stderr.write("%s: " % sys.argv[0])
- sys.stderr.write("%s\n" % error)
- sys.stderr.flush()
- sys.exit(1)
-
-
-def write_te_file(module, pidfile, logfile, libfile, network, initsc):
- file="%s.te" % module
- newte=re.sub("TEMPLATETYPE", module, te)
- if libfile:
- newte= newte + re.sub("TEMPLATETYPE", module, te_libfile)
- if logfile:
- newte= newte + re.sub("TEMPLATETYPE", module, te_logfile)
- if pidfile:
- newte= newte + re.sub("TEMPLATETYPE", module, te_pidfile)
- newte= newte + re.sub("TEMPLATETYPE", module, te_sep)
- if libfile:
- newte= newte + re.sub("TEMPLATETYPE", module, te_libfile2)
- if logfile:
- newte= newte + re.sub("TEMPLATETYPE", module, te_logfile2)
- if pidfile:
- newte= newte + re.sub("TEMPLATETYPE", module, te_pidfile2)
- if network:
- newte= newte + re.sub("TEMPLATETYPE", module, te_network2)
- if initsc:
- newte= newte + re.sub("TEMPLATETYPE", module, te_initsc2)
- if os.path.exists(file):
- errorExit("%s already exists" % file)
- fd = open(file, 'w')
- fd.write(newte)
- fd.close()
-
-def write_if_file(module):
- file="%s.if" % module
- newif=re.sub("TEMPLATETYPE", module, interface)
- if os.path.exists(file):
- errorExit("%s already exists" % file)
- fd = open(file, 'w')
- fd.write(newif)
- fd.close()
-
-def write_fc_file(module, executable, pidfile, logfile, libfile):
- file="%s.fc" % module
- temp=re.sub("TEMPLATETYPE", module, fc)
- newfc=re.sub("EXECUTABLE", executable, temp)
- if pidfile:
- temp=re.sub("TEMPLATETYPE", module, fc_pidfile)
- newfc=newfc + re.sub("FILENAME", pidfile, temp)
- if logfile:
- temp=re.sub("TEMPLATETYPE", module, fc_logfile)
- newfc=newfc + re.sub("FILENAME", logfile, temp)
- if libfile:
- temp=re.sub("TEMPLATETYPE", module, fc_libfile)
- newfc=newfc + re.sub("FILENAME", libfile, temp)
- if os.path.exists(file):
- errorExit("%s already exists" % file)
- fd = open(file, 'w')
- fd.write(newfc)
- fd.close()
-
-def gen_policy(module, executable, pidfile, logfile, libfile, initsc, network):
- write_te_file(module, pidfile, logfile, libfile, initsc, network)
- write_if_file(module)
- write_fc_file(module, executable, pidfile, logfile, libfile)
-
-if __name__ == '__main__':
- def usage(message = ""):
- print '%s ModuleName Executable' % sys.argv[0]
- sys.exit(1)
-
- if len(sys.argv) != 3:
- usage()
-
- print """\n
-This tool generate three files for policy development, A Type Enforcement (te)
-file, a File Context (fc), and a Interface File(if). Most of the policy rules
-will be written in the te file. Use the File Context file to associate file
-paths with security context. Use the interface rules to allow other protected
-domains to interact with the newly defined domains.
-
-After generating these files use the /usr/share/selinux/devel/Makefile to
-compile your policy package. Then use the semodule tool to load it.
-
-# /usr/share/selinux/devel/policygentool myapp /usr/bin/myapp
-# make -f /usr/share/selinux/devel/Makefile
-# semodule -i myapp.pp
-# restorecon -R -v /usr/bin/myapp "all files defined in myapp.fc"
-
-Now you can turn on permissive mode, start your application and avc messages
-will be generated. You can use audit2allow to help translate the avc messages
-into policy.
-
-# setenforce 0
-# service myapp start
-# audit2allow -R -i /var/log/audit/audit.log
-
-Return to continue:"""
- sys.stdin.readline().rstrip()
-
- print 'If the module uses pidfiles, what is the pidfile called?'
- pidfile = sys.stdin.readline().rstrip()
- if pidfile == "":
- pidfile = None
- print 'If the module uses logfiles, where are they stored?'
- logfile = sys.stdin.readline().rstrip()
- if logfile == "":
- logfile = None
- print 'If the module has var/lib files, where are they stored?'
- libfile = sys.stdin.readline().rstrip()
- if libfile == "":
- libfile = None
- print 'Does the module have a init script? [yN]'
- initsc = sys.stdin.readline().rstrip()
- if initsc == "" or initsc == "n" or initsc == "N":
- initsc = False
- elif initsc == "y" or initsc == "Y":
- initsc = True
- else:
- raise "Please answer with 'y' or 'n'!"
- print 'Does the module use the network? [yN]'
- network = sys.stdin.readline().rstrip()
- if network == "" or network == "n" or network == "N":
- network = False
- elif network == "y" or network == "Y":
- network = True
- else:
- raise "Please answer with 'y' or 'n'!"
-
- gen_policy(
- module=sys.argv[1],
- executable=sys.argv[2],
- pidfile=pidfile,
- logfile=logfile,
- libfile=libfile,
- initsc=initsc,
- network=network
- )
-
-
+#!/bin/sh
+echo "$0 is no longer supported, better tools exist for creating policy"
+echo "Please use /usr/bin/sepolgen, slide or polgengui to generate policy"
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 4189670..31bd863 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.6.32
-Release: 10%{?dist}
+Release: 11%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -448,6 +448,9 @@ exit 0
%endif
%changelog
+* Thu Sep 24 2009 Dan Walsh 3.6.32-11
+- Allow users to exec restorecond
+
* Tue Sep 21 2009 Dan Walsh 3.6.32-10
- Allow sendmail to request kernel modules load