diff --git a/policy-F12.patch b/policy-F12.patch
index bc6042d..66d4b73 100644
--- a/policy-F12.patch
+++ b/policy-F12.patch
@@ -1376,9 +1376,24 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kismet_manage_log(tmpreaper_t)
')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.6.28/policy/modules/admin/usermanage.if
+--- nsaserefpolicy/policy/modules/admin/usermanage.if 2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/admin/usermanage.if 2009-08-25 14:37:45.000000000 -0400
+@@ -274,6 +274,11 @@
+ usermanage_domtrans_useradd($1)
+ role $2 types useradd_t;
+
++ # Add/remove user home directories
++ userdom_manage_home_role($2, useradd_t)
++
++ seutil_run_semanage(useradd_t, $2)
++
+ optional_policy(`
+ nscd_run(useradd_t, $2)
+ ')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.6.28/policy/modules/admin/usermanage.te
--- nsaserefpolicy/policy/modules/admin/usermanage.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/admin/usermanage.te 2009-08-21 18:56:06.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/admin/usermanage.te 2009-08-25 09:31:26.000000000 -0400
@@ -209,6 +209,7 @@
files_manage_etc_files(groupadd_t)
files_relabel_etc_files(groupadd_t)
@@ -1439,7 +1454,19 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
init_use_fds(useradd_t)
init_rw_utmp(useradd_t)
-@@ -521,6 +518,12 @@
+@@ -494,10 +491,7 @@
+
+ userdom_use_unpriv_users_fds(useradd_t)
+ # Add/remove user home directories
+-userdom_manage_user_home_content_dirs(useradd_t)
+-userdom_manage_user_home_content_files(useradd_t)
+-userdom_home_filetrans_user_home_dir(useradd_t)
+-userdom_user_home_dir_filetrans_user_home_content(useradd_t, notdevfile_class_set)
++userdom_manage_home_role(system_r, useradd_t)
+
+ mta_manage_spool(useradd_t)
+
+@@ -521,6 +515,12 @@
')
optional_policy(`
@@ -1519,6 +1546,32 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+optional_policy(`
+ nscd_socket_use(calamaris_t)
+')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cdrecord.te serefpolicy-3.6.28/policy/modules/apps/cdrecord.te
+--- nsaserefpolicy/policy/modules/apps/cdrecord.te 2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/apps/cdrecord.te 2009-08-25 15:56:57.000000000 -0400
+@@ -28,12 +28,13 @@
+ #
+
+ allow cdrecord_t self:capability { ipc_lock sys_nice setuid dac_override sys_rawio };
+-allow cdrecord_t self:process { getsched setsched sigkill };
++allow cdrecord_t self:process { getcap getsched setsched sigkill };
+ allow cdrecord_t self:unix_dgram_socket create_socket_perms;
+ allow cdrecord_t self:unix_stream_socket create_stream_socket_perms;
+
+ # allow searching for cdrom-drive
+ dev_list_all_dev_nodes(cdrecord_t)
++dev_read_sysfs(cdrecord_t)
+
+ domain_interactive_fd(cdrecord_t)
+ domain_use_interactive_fds(cdrecord_t)
+@@ -44,6 +45,7 @@
+ term_list_ptys(cdrecord_t)
+
+ # allow cdrecord to write the CD
++storage_raw_read_removable_device(cdrecord_t)
+ storage_raw_write_removable_device(cdrecord_t)
+ storage_write_scsi_generic(cdrecord_t)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.6.28/policy/modules/apps/cpufreqselector.te
--- nsaserefpolicy/policy/modules/apps/cpufreqselector.te 2009-07-28 13:28:33.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/apps/cpufreqselector.te 2009-08-21 18:56:06.000000000 -0400
@@ -3538,20 +3591,32 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+term_use_ptmx(ptchown_t)
+
+miscfiles_read_localization(ptchown_t)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.6.28/policy/modules/apps/pulseaudio.if
+--- nsaserefpolicy/policy/modules/apps/pulseaudio.if 2009-07-23 14:11:04.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.if 2009-08-25 15:59:29.000000000 -0400
+@@ -141,5 +141,6 @@
+ ')
+
+ allow $1 pulseaudio_t:process signull;
++ allow pulseaudio_t $1:process signull;
+ allow $1 pulseaudio_t:unix_stream_socket connectto;
+ ')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te
--- nsaserefpolicy/policy/modules/apps/pulseaudio.te 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te 2009-08-22 07:48:07.000000000 -0400
-@@ -22,6 +22,9 @@
++++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te 2009-08-26 08:11:55.000000000 -0400
+@@ -22,7 +22,11 @@
allow pulseaudio_t self:unix_dgram_socket { sendto create_socket_perms };
allow pulseaudio_t self:tcp_socket create_stream_socket_perms;
allow pulseaudio_t self:udp_socket create_socket_perms;
+allow pulseaudio_t self:netlink_kobject_uevent_socket create_socket_perms;
-+
-+can_exec(pulseaudio_t, pulseaudio_exec_t)
++can_exec(pulseaudio_t, pulseaudio_exec_t)
++
++kernel_read_system_state(pulseaudio_t)
kernel_read_kernel_sysctls(pulseaudio_t)
-@@ -47,6 +50,7 @@
+ corecmd_exec_bin(pulseaudio_t)
+@@ -47,6 +51,7 @@
fs_rw_anon_inodefs_files(pulseaudio_t)
fs_getattr_tmpfs(pulseaudio_t)
@@ -3559,7 +3624,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
term_use_all_user_ttys(pulseaudio_t)
term_use_all_user_ptys(pulseaudio_t)
-@@ -78,6 +82,15 @@
+@@ -78,6 +83,15 @@
policykit_domtrans_auth(pulseaudio_t)
policykit_read_lib(pulseaudio_t)
policykit_read_reload(pulseaudio_t)
@@ -3575,7 +3640,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-@@ -85,8 +98,7 @@
+@@ -85,8 +99,7 @@
')
optional_policy(`
@@ -4620,8 +4685,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-/opt/picasa/wine/bin/wine -- gen_context(system_u:object_r:wine_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.6.28/policy/modules/apps/wine.if
--- nsaserefpolicy/policy/modules/apps/wine.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/apps/wine.if 2009-08-21 18:56:07.000000000 -0400
-@@ -43,3 +43,63 @@
++++ serefpolicy-3.6.28/policy/modules/apps/wine.if 2009-08-25 15:59:59.000000000 -0400
+@@ -43,3 +43,62 @@
wine_domtrans($1)
role $2 types wine_t;
')
@@ -4683,11 +4748,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ relabel_dirs_pattern($2, wine_home_t, wine_home_t)
+ relabel_files_pattern($2, wine_home_t, wine_home_t)
+ relabel_lnk_files_pattern($2, wine_home_t, wine_home_t)
-+
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.6.28/policy/modules/apps/wine.te
--- nsaserefpolicy/policy/modules/apps/wine.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/apps/wine.te 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/apps/wine.te 2009-08-25 16:00:27.000000000 -0400
@@ -9,20 +9,35 @@
type wine_t;
type wine_exec_t;
@@ -4933,7 +4997,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.28/policy/modules/kernel/devices.if
--- nsaserefpolicy/policy/modules/kernel/devices.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-24 08:40:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-25 15:58:11.000000000 -0400
@@ -1655,6 +1655,78 @@
########################################
@@ -5954,7 +6018,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/dev/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.6.28/policy/modules/kernel/filesystem.if
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/filesystem.if 2009-08-24 08:48:26.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/filesystem.if 2009-08-24 09:57:00.000000000 -0400
@@ -1537,6 +1537,24 @@
########################################
@@ -6377,6 +6441,29 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ fs_type($1)
+ mls_trusted_object($1)
+')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.6.28/policy/modules/kernel/storage.fc
+--- nsaserefpolicy/policy/modules/kernel/storage.fc 2009-07-29 15:15:33.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/storage.fc 2009-08-24 10:07:26.000000000 -0400
+@@ -28,6 +28,7 @@
+ /dev/megadev.* -c gen_context(system_u:object_r:removable_device_t,s0)
+ /dev/mmcblk.* -b gen_context(system_u:object_r:removable_device_t,s0)
+ /dev/mspblk.* -b gen_context(system_u:object_r:removable_device_t,s0)
++/dev/mtd.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+ /dev/nb[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+ /dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0)
+ /dev/p[fg][0-3] -b gen_context(system_u:object_r:removable_device_t,s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.6.28/policy/modules/kernel/storage.if
+--- nsaserefpolicy/policy/modules/kernel/storage.if 2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/storage.if 2009-08-25 15:56:31.000000000 -0400
+@@ -529,7 +529,7 @@
+
+ ')
+
+- dontaudit $1 removable_device_t:blk_file { getattr ioctl read };
++ dontaudit $1 removable_device_t:blk_file read_blk_file_perms;
+ ')
+
+ ########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.6.28/policy/modules/kernel/terminal.fc
--- nsaserefpolicy/policy/modules/kernel/terminal.fc 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/kernel/terminal.fc 2009-08-21 18:56:07.000000000 -0400
@@ -7680,8 +7767,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te
--- nsaserefpolicy/policy/modules/roles/unconfineduser.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te 2009-08-21 18:56:07.000000000 -0400
-@@ -0,0 +1,391 @@
++++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te 2009-08-25 09:40:01.000000000 -0400
+@@ -0,0 +1,392 @@
+policy_module(unconfineduser, 1.0.0)
+
+########################################
@@ -7937,9 +8024,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ portmap_run_helper(unconfined_t, unconfined_r)
+')
+
-+optional_policy(`
-+ ppp_run(unconfined_t, unconfined_r)
-+')
++#optional_policy(`
++# ppp_run(unconfined_t, unconfined_r)
++#')
+
+optional_policy(`
+ qemu_role_notrans(unconfined_r, unconfined_t)
@@ -8012,6 +8099,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+allow unconfined_execmem_t self:process { execstack execmem };
+unconfined_domain_noaudit(unconfined_execmem_t)
+allow unconfined_execmem_t unconfined_t:process transition;
++rpm_transition_script(unconfined_execmem_t)
+
+optional_policy(`
+ init_dbus_chat_script(unconfined_execmem_t)
@@ -8548,6 +8636,28 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+permissive abrt_t;
+
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.fc serefpolicy-3.6.28/policy/modules/services/afs.fc
+--- nsaserefpolicy/policy/modules/services/afs.fc 2009-07-23 14:11:04.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/afs.fc 2009-08-24 10:21:30.000000000 -0400
+@@ -25,6 +25,7 @@
+ /usr/vice/etc/afsd -- gen_context(system_u:object_r:afs_exec_t,s0)
+
+ /var/cache/afs(/.*)? gen_context(system_u:object_r:afs_cache_t,s0)
++/usr/vice/cache(/.*)? gen_context(system_u:object_r:afs_cache_t,s0)
+
+ /vicepa gen_context(system_u:object_r:afs_files_t,s0)
+ /vicepb gen_context(system_u:object_r:afs_files_t,s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.te serefpolicy-3.6.28/policy/modules/services/afs.te
+--- nsaserefpolicy/policy/modules/services/afs.te 2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/afs.te 2009-08-24 09:19:56.000000000 -0400
+@@ -83,6 +83,7 @@
+
+ files_mounton_mnt(afs_t)
+ files_read_etc_files(afs_t)
++files_read_usr_files(afs_t)
+ files_rw_etc_runtime_files(afs_t)
+
+ fs_getattr_xattr_fs(afs_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.6.28/policy/modules/services/amavis.te
--- nsaserefpolicy/policy/modules/services/amavis.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/amavis.te 2009-08-21 18:56:07.000000000 -0400
@@ -11132,7 +11242,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.28/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/dbus.if 2009-08-23 12:50:58.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/dbus.if 2009-08-25 16:33:22.000000000 -0400
@@ -42,8 +42,10 @@
gen_require(`
class dbus { send_msg acquire_svc };
@@ -11251,11 +11361,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+#
+interface(`dbus_manage_lib_files',`
+ gen_require(`
-+ type system_dbus_var_lib_t;
++ type system_dbusd_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
-+ manage_files_pattern($1, system_dbus_var_lib_t, system_dbus_var_lib_t)
++ manage_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.6.28/policy/modules/services/dbus.te
@@ -15127,7 +15237,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.6.28/policy/modules/services/ppp.te
--- nsaserefpolicy/policy/modules/services/ppp.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/ppp.te 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/ppp.te 2009-08-24 09:25:42.000000000 -0400
@@ -193,6 +193,8 @@
optional_policy(`
@@ -15137,6 +15247,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
+@@ -216,7 +218,7 @@
+ # PPTP Local policy
+ #
+
+-allow pptp_t self:capability { net_raw net_admin };
++allow pptp_t self:capability { dac_override dac_read_search net_raw net_admin };
+ dontaudit pptp_t self:capability sys_tty_config;
+ allow pptp_t self:process signal;
+ allow pptp_t self:fifo_file rw_fifo_file_perms;
@@ -295,6 +297,14 @@
')
@@ -15935,7 +16054,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.28/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/samba.te 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/samba.te 2009-08-25 09:18:50.000000000 -0400
@@ -66,6 +66,13 @@
## </desc>
gen_tunable(samba_share_nfs, false)
@@ -15978,7 +16097,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Allow samba to list mnt_t for potential mounted dirs
files_list_mnt(smbd_t)
-@@ -341,6 +352,8 @@
+@@ -338,9 +349,12 @@
+
+ userdom_use_unpriv_users_fds(smbd_t)
+ userdom_dontaudit_search_user_home_dirs(smbd_t)
++userdom_signal_all_users(smbd_t)
usermanage_read_crack_db(smbd_t)
@@ -15987,7 +16110,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
ifdef(`hide_broken_symptoms', `
files_dontaudit_getattr_default_dirs(smbd_t)
files_dontaudit_getattr_boot_dirs(smbd_t)
-@@ -352,19 +365,19 @@
+@@ -352,19 +366,19 @@
')
tunable_policy(`samba_domain_controller',`
@@ -16013,7 +16136,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
# Support Samba sharing of NFS mount points
-@@ -376,6 +389,15 @@
+@@ -376,6 +390,15 @@
fs_manage_nfs_named_sockets(smbd_t)
')
@@ -16029,7 +16152,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
cups_read_rw_config(smbd_t)
cups_stream_connect(smbd_t)
-@@ -391,6 +413,11 @@
+@@ -391,6 +414,11 @@
')
optional_policy(`
@@ -16041,7 +16164,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
rpc_search_nfs_state_data(smbd_t)
')
-@@ -405,13 +432,15 @@
+@@ -405,13 +433,15 @@
tunable_policy(`samba_create_home_dirs',`
allow smbd_t self:capability chown;
userdom_create_user_home_dirs(smbd_t)
@@ -16058,7 +16181,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
auth_read_all_files_except_shadow(nmbd_t)
')
-@@ -420,8 +449,8 @@
+@@ -420,8 +450,8 @@
auth_manage_all_files_except_shadow(smbd_t)
fs_read_noxattr_fs_files(nmbd_t)
auth_manage_all_files_except_shadow(nmbd_t)
@@ -16068,7 +16191,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
#
-@@ -525,6 +554,7 @@
+@@ -525,6 +555,7 @@
allow smbcontrol_t winbind_t:process { signal signull };
@@ -16076,7 +16199,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
samba_read_config(smbcontrol_t)
samba_rw_var_files(smbcontrol_t)
samba_search_var(smbcontrol_t)
-@@ -638,6 +668,10 @@
+@@ -638,6 +669,10 @@
allow swat_t smbd_var_run_t:file { lock unlink };
@@ -16087,7 +16210,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
rw_files_pattern(swat_t, samba_etc_t, samba_etc_t)
read_lnk_files_pattern(swat_t, samba_etc_t, samba_etc_t)
-@@ -713,12 +747,23 @@
+@@ -713,12 +748,23 @@
kerberos_use(swat_t)
')
@@ -16112,7 +16235,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dontaudit winbind_t self:capability sys_tty_config;
allow winbind_t self:process { signal_perms getsched setsched };
allow winbind_t self:fifo_file rw_fifo_file_perms;
-@@ -866,6 +911,16 @@
+@@ -866,6 +912,16 @@
#
optional_policy(`
@@ -16129,7 +16252,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
type samba_unconfined_script_t;
type samba_unconfined_script_exec_t;
domain_type(samba_unconfined_script_t)
-@@ -876,9 +931,12 @@
+@@ -876,9 +932,12 @@
allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms;
allow smbd_t samba_unconfined_script_exec_t:file ioctl;
@@ -23809,8 +23932,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.6.28/policy/modules/system/raid.te
--- nsaserefpolicy/policy/modules/system/raid.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/raid.te 2009-08-21 18:56:07.000000000 -0400
-@@ -32,10 +32,6 @@
++++ serefpolicy-3.6.28/policy/modules/system/raid.te 2009-08-25 15:58:45.000000000 -0400
+@@ -32,11 +32,6 @@
kernel_rw_software_raid_state(mdadm_t)
kernel_getattr_core_if(mdadm_t)
@@ -23818,18 +23941,22 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-corecmd_exec_bin(mdadm_t)
-corecmd_exec_shell(mdadm_t)
-
- dev_read_sysfs(mdadm_t)
+-dev_read_sysfs(mdadm_t)
# Ignore attempts to read every device file
dev_dontaudit_getattr_all_blk_files(mdadm_t)
-@@ -45,24 +41,28 @@
+ dev_dontaudit_getattr_all_chr_files(mdadm_t)
+@@ -44,25 +39,31 @@
+ dev_dontaudit_getattr_generic_chr_files(mdadm_t)
dev_dontaudit_getattr_generic_blk_files(mdadm_t)
dev_read_realtime_clock(mdadm_t)
-
+-
-domain_use_interactive_fds(mdadm_t)
-
-files_read_etc_files(mdadm_t)
-files_read_etc_runtime_files(mdadm_t)
--
++dev_read_raw_memory(mdadm_t)
++dev_read_sysfs(mdadm_t)
+
fs_search_auto_mountpoints(mdadm_t)
fs_dontaudit_list_tmpfs(mdadm_t)
@@ -23902,7 +24029,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/etc/share/selinux/mls(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.6.28/policy/modules/system/selinuxutil.if
--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/selinuxutil.if 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/selinuxutil.if 2009-08-25 15:30:03.000000000 -0400
@@ -535,6 +535,53 @@
########################################
@@ -26012,7 +26139,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+HOME_DIR/\.gvfs(/.*)? <<none>>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.28/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-24 08:49:32.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-25 09:28:37.000000000 -0400
@@ -30,8 +30,9 @@
')
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 32514b1..b8cb1eb 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.6.28
-Release: 6%{?dist}
+Release: 7%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -475,6 +475,9 @@ exit 0
%endif
%changelog
+* Tue Aug 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-7
+- Fixes for cdrecord, mdadm, and others
+
* Sat Aug 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-6
- Add capability setting to dhcpc and gpm