diff --git a/.cvsignore b/.cvsignore
index 4db517c..99c09d4 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -182,3 +182,4 @@ serefpolicy-3.6.23.tgz
 serefpolicy-3.6.24.tgz
 serefpolicy-3.6.25.tgz
 serefpolicy-3.6.26.tgz
+serefpolicy-3.6.27.tgz
diff --git a/booleans-targeted.conf b/booleans-targeted.conf
index e42b66c..4e32b2e 100644
--- a/booleans-targeted.conf
+++ b/booleans-targeted.conf
@@ -122,6 +122,10 @@ nfs_export_all_rw = true
 # 
 nfs_export_all_ro = true
 
+## Allow openvpn to read home directories
+## 
+openvpn_enable_homedirs = true
+
 # Allow pppd to load kernel modules for certain modems
 # 
 pppd_can_insmod = false
diff --git a/nsadiff b/nsadiff
index 7cd31df..1baef24 100755
--- a/nsadiff
+++ b/nsadiff
@@ -1 +1 @@
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy serefpolicy-3.6.26 > /tmp/diff
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy serefpolicy-3.6.27 > /tmp/diff
diff --git a/policy-F12.patch b/policy-F12.patch
index 8bf919a..96b3187 100644
--- a/policy-F12.patch
+++ b/policy-F12.patch
@@ -1,6 +1,6 @@
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_contexts serefpolicy-3.6.26/config/appconfig-mcs/default_contexts
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_contexts serefpolicy-3.6.27/config/appconfig-mcs/default_contexts
 --- nsaserefpolicy/config/appconfig-mcs/default_contexts	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/config/appconfig-mcs/default_contexts	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mcs/default_contexts	2009-08-14 16:51:06.000000000 -0400
 @@ -1,15 +1,6 @@
 -system_r:crond_t:s0		user_r:cronjob_t:s0 staff_r:cronjob_t:s0 sysadm_r:cronjob_t:s0 system_r:cronjob_t:s0 unconfined_r:unconfined_cronjob_t:s0
 -system_r:local_login_t:s0	user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
@@ -22,15 +22,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/con
 -user_r:user_su_t:s0		user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
 -user_r:user_sudo_t:s0		sysadm_r:sysadm_t:s0 user_r:user_t:s0
 +system_r:xdm_t:s0		user_r:user_t:s0
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/failsafe_context serefpolicy-3.6.26/config/appconfig-mcs/failsafe_context
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/failsafe_context serefpolicy-3.6.27/config/appconfig-mcs/failsafe_context
 --- nsaserefpolicy/config/appconfig-mcs/failsafe_context	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/config/appconfig-mcs/failsafe_context	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mcs/failsafe_context	2009-08-14 16:51:06.000000000 -0400
 @@ -1 +1 @@
 -sysadm_r:sysadm_t:s0
 +system_r:unconfined_t:s0
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_default_contexts serefpolicy-3.6.26/config/appconfig-mcs/root_default_contexts
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_default_contexts serefpolicy-3.6.27/config/appconfig-mcs/root_default_contexts
 --- nsaserefpolicy/config/appconfig-mcs/root_default_contexts	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/config/appconfig-mcs/root_default_contexts	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mcs/root_default_contexts	2009-08-14 16:51:06.000000000 -0400
 @@ -1,11 +1,7 @@
 -system_r:crond_t:s0		unconfined_r:unconfined_t:s0 sysadm_r:cronjob_t:s0 staff_r:cronjob_t:s0 user_r:cronjob_t:s0
 +system_r:crond_t:s0		unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
@@ -45,9 +45,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/con
  #
 -#system_r:sshd_t:s0		unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
 +system_r:sshd_t:s0		unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/securetty_types serefpolicy-3.6.26/config/appconfig-mcs/securetty_types
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/securetty_types serefpolicy-3.6.27/config/appconfig-mcs/securetty_types
 --- nsaserefpolicy/config/appconfig-mcs/securetty_types	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/config/appconfig-mcs/securetty_types	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mcs/securetty_types	2009-08-14 16:51:06.000000000 -0400
 @@ -1 +1,6 @@
 +auditadm_tty_device_t
 +secadm_tty_device_t
@@ -55,18 +55,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/con
 +sysadm_tty_device_t
 +unconfined_tty_device_t
  user_tty_device_t
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/seusers serefpolicy-3.6.26/config/appconfig-mcs/seusers
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/seusers serefpolicy-3.6.27/config/appconfig-mcs/seusers
 --- nsaserefpolicy/config/appconfig-mcs/seusers	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/config/appconfig-mcs/seusers	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mcs/seusers	2009-08-14 16:51:06.000000000 -0400
 @@ -1,3 +1,3 @@
  system_u:system_u:s0-mcs_systemhigh
 -root:root:s0-mcs_systemhigh
 -__default__:user_u:s0
 +root:unconfined_u:s0-mcs_systemhigh
 +__default__:unconfined_u:s0-mcs_systemhigh
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts serefpolicy-3.6.26/config/appconfig-mcs/staff_u_default_contexts
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts serefpolicy-3.6.27/config/appconfig-mcs/staff_u_default_contexts
 --- nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/config/appconfig-mcs/staff_u_default_contexts	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mcs/staff_u_default_contexts	2009-08-14 16:51:06.000000000 -0400
 @@ -1,10 +1,12 @@
  system_r:local_login_t:s0	staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
  system_r:remote_login_t:s0	staff_r:staff_t:s0
@@ -81,9 +81,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/con
  sysadm_r:sysadm_su_t:s0		sysadm_r:sysadm_t:s0 
  sysadm_r:sysadm_sudo_t:s0	sysadm_r:sysadm_t:s0
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/unconfined_u_default_contexts serefpolicy-3.6.26/config/appconfig-mcs/unconfined_u_default_contexts
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/unconfined_u_default_contexts serefpolicy-3.6.27/config/appconfig-mcs/unconfined_u_default_contexts
 --- nsaserefpolicy/config/appconfig-mcs/unconfined_u_default_contexts	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/config/appconfig-mcs/unconfined_u_default_contexts	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mcs/unconfined_u_default_contexts	2009-08-14 16:51:06.000000000 -0400
 @@ -1,4 +1,4 @@
 -system_r:crond_t:s0		unconfined_r:unconfined_t:s0 unconfined_r:unconfined_cronjob_t:s0
 +system_r:crond_t:s0		unconfined_r:unconfined_t:s0
@@ -97,15 +97,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/con
 +system_r:initrc_su_t:s0		unconfined_r:unconfined_t:s0
 +unconfined_r:unconfined_t:s0	unconfined_r:unconfined_t:s0
  system_r:xdm_t:s0		unconfined_r:unconfined_t:s0
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/userhelper_context serefpolicy-3.6.26/config/appconfig-mcs/userhelper_context
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/userhelper_context serefpolicy-3.6.27/config/appconfig-mcs/userhelper_context
 --- nsaserefpolicy/config/appconfig-mcs/userhelper_context	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/config/appconfig-mcs/userhelper_context	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mcs/userhelper_context	2009-08-14 16:51:06.000000000 -0400
 @@ -1 +1 @@
 -system_u:sysadm_r:sysadm_t:s0
 +system_u:system_r:unconfined_t:s0	
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts serefpolicy-3.6.26/config/appconfig-mcs/user_u_default_contexts
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts serefpolicy-3.6.27/config/appconfig-mcs/user_u_default_contexts
 --- nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/config/appconfig-mcs/user_u_default_contexts	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mcs/user_u_default_contexts	2009-08-14 16:51:06.000000000 -0400
 @@ -1,8 +1,9 @@
  system_r:local_login_t:s0	user_r:user_t:s0
  system_r:remote_login_t:s0	user_r:user_t:s0
@@ -118,20 +118,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/con
 -
 +system_r:initrc_su_t:s0		user_r:user_t:s0
 +user_r:user_t:s0		user_r:user_t:s0
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/virtual_domain_context serefpolicy-3.6.26/config/appconfig-mcs/virtual_domain_context
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/virtual_domain_context serefpolicy-3.6.27/config/appconfig-mcs/virtual_domain_context
 --- nsaserefpolicy/config/appconfig-mcs/virtual_domain_context	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/config/appconfig-mcs/virtual_domain_context	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mcs/virtual_domain_context	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1 @@
 +system_u:system_r:svirt_t:s0
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/virtual_image_context serefpolicy-3.6.26/config/appconfig-mcs/virtual_image_context
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/virtual_image_context serefpolicy-3.6.27/config/appconfig-mcs/virtual_image_context
 --- nsaserefpolicy/config/appconfig-mcs/virtual_image_context	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/config/appconfig-mcs/virtual_image_context	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mcs/virtual_image_context	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,2 @@
 +system_u:object_r:svirt_image_t:s0
 +system_u:object_r:virt_content_t:s0
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default_contexts serefpolicy-3.6.26/config/appconfig-mls/default_contexts
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default_contexts serefpolicy-3.6.27/config/appconfig-mls/default_contexts
 --- nsaserefpolicy/config/appconfig-mls/default_contexts	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/config/appconfig-mls/default_contexts	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mls/default_contexts	2009-08-14 16:51:06.000000000 -0400
 @@ -1,15 +1,6 @@
 -system_r:crond_t:s0		user_r:cronjob_t:s0 staff_r:cronjob_t:s0 sysadm_r:cronjob_t:s0 system_r:cronjob_t:s0 unconfined_r:unconfined_cronjob_t:s0
 -system_r:local_login_t:s0	user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
@@ -153,9 +153,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/con
 -user_r:user_su_t:s0		user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
 -user_r:user_sudo_t:s0		sysadm_r:sysadm_t:s0 user_r:user_t:s0
 +system_r:xdm_t:s0		user_r:user_t:s0
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/root_default_contexts serefpolicy-3.6.26/config/appconfig-mls/root_default_contexts
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/root_default_contexts serefpolicy-3.6.27/config/appconfig-mls/root_default_contexts
 --- nsaserefpolicy/config/appconfig-mls/root_default_contexts	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/config/appconfig-mls/root_default_contexts	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mls/root_default_contexts	2009-08-14 16:51:06.000000000 -0400
 @@ -1,11 +1,11 @@
 -system_r:crond_t:s0		unconfined_r:unconfined_t:s0 sysadm_r:cronjob_t:s0 staff_r:cronjob_t:s0 user_r:cronjob_t:s0
 -system_r:local_login_t:s0	unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
@@ -174,20 +174,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/con
  #
 -#system_r:sshd_t:s0		unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
 +#system_r:sshd_t:s0		sysadm_r:sysadm_t:s0 staff_r:staff_t:s0
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/virtual_domain_context serefpolicy-3.6.26/config/appconfig-mls/virtual_domain_context
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/virtual_domain_context serefpolicy-3.6.27/config/appconfig-mls/virtual_domain_context
 --- nsaserefpolicy/config/appconfig-mls/virtual_domain_context	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/config/appconfig-mls/virtual_domain_context	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mls/virtual_domain_context	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1 @@
 +system_u:system_r:qemu_t:s0
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/virtual_image_context serefpolicy-3.6.26/config/appconfig-mls/virtual_image_context
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/virtual_image_context serefpolicy-3.6.27/config/appconfig-mls/virtual_image_context
 --- nsaserefpolicy/config/appconfig-mls/virtual_image_context	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/config/appconfig-mls/virtual_image_context	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-mls/virtual_image_context	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,2 @@
 +system_u:object_r:virt_image_t:s0
 +system_u:object_r:virt_content_t:s0
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/securetty_types serefpolicy-3.6.26/config/appconfig-standard/securetty_types
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/securetty_types serefpolicy-3.6.27/config/appconfig-standard/securetty_types
 --- nsaserefpolicy/config/appconfig-standard/securetty_types	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/config/appconfig-standard/securetty_types	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/config/appconfig-standard/securetty_types	2009-08-14 16:51:06.000000000 -0400
 @@ -1 +1,6 @@
 +auditadm_tty_device_t
 +secadm_tty_device_t
@@ -195,10 +195,31 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/con
 +sysadm_tty_device_t
 +unconfined_tty_device_t
  user_tty_device_t
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.6.26/Makefile
---- nsaserefpolicy/Makefile	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/Makefile	2009-07-30 15:34:52.000000000 -0400
-@@ -241,7 +241,7 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.6.27/Makefile
+--- nsaserefpolicy/Makefile	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/Makefile	2009-08-14 16:51:06.000000000 -0400
+@@ -102,8 +102,6 @@
+ comment_move_decl := $(SED) -r -f $(support)/comment_move_decl.sed
+ gennetfilter := $(PYTHON) -E $(support)/gennetfilter.py
+ m4iferror := $(support)/iferror.m4
+-m4divert := $(support)/divert.m4
+-m4undivert := $(support)/undivert.m4
+ # use our own genhomedircon to make sure we have a known usable one,
+ # so policycoreutils updates are not required (RHEL4)
+ genhomedircon := $(PYTHON) -E $(support)/genhomedircon
+@@ -233,18 +231,17 @@
+ 
+ CTAGS ?= ctags
+ 
+-m4support := $(m4divert) $(wildcard $(poldir)/support/*.spt)
++m4support := $(wildcard $(poldir)/support/*.spt)
+ ifdef LOCAL_ROOT
+ m4support += $(wildcard $(local_poldir)/support/*.spt)
+ endif
+-m4support += $(m4undivert)
+ 
+ appconf := config/appconfig-$(TYPE)
+ seusers := $(appconf)/seusers
  appdir := $(contextpath)
  user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts)
  user_default_contexts_names := $(addprefix $(contextpath)/users/,$(subst _default_contexts,,$(notdir $(user_default_contexts))))
@@ -207,9 +228,126 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/Mak
  net_contexts := $(builddir)net_contexts
  
  all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.6.26/policy/global_tunables
+@@ -303,8 +300,7 @@
+ off_mods += $(filter-out $(base_mods) $(mod_mods) $(off_mods),$(notdir $(detected_mods)))
+ 
+ # filesystems to be used in labeling targets
+-filesystems = $(shell mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]|btrfs| xfs| jfs).*rw/{print $$3}';)
+-fs_names := "btrfs ext2 ext3 ext4 xfs jfs"
++filesystems = $(shell mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs| jfs).*rw/{print $$3}';)
+ 
+ ########################################
+ #
+@@ -533,7 +529,7 @@
+ 
+ $(appdir)/%: $(appconf)/%
+ 	@mkdir -p $(appdir)
+-	$(verbose) $(M4) $(M4PARAM) $(m4support) $< > $@
++	$(verbose) $(INSTALL) -m 644 $< $@
+ 
+ ########################################
+ #
+@@ -605,7 +601,7 @@
+ # Filesystem labeling
+ #
+ checklabels:
+-	@echo "Checking labels on filesystem types: $(fs_names)"
++	@echo "Checking labels on filesystem types: ext2 ext3 xfs jfs"
+ 	@if test -z "$(filesystems)"; then \
+ 		echo "No filesystems with extended attributes found!" ;\
+ 		false ;\
+@@ -613,7 +609,7 @@
+ 	$(verbose) $(SETFILES) -v -n $(fcpath) $(filesystems)
+ 
+ restorelabels:
+-	@echo "Restoring labels on filesystem types: $(fs_names)"
++	@echo "Restoring labels on filesystem types: ext2 ext3 xfs jfs"
+ 	@if test -z "$(filesystems)"; then \
+ 		echo "No filesystems with extended attributes found!" ;\
+ 		false ;\
+@@ -621,7 +617,7 @@
+ 	$(verbose) $(SETFILES) -v $(fcpath) $(filesystems)
+ 
+ relabel:
+-	@echo "Relabeling filesystem types: $(fs_names)"
++	@echo "Relabeling filesystem types: ext2 ext3 xfs jfs"
+ 	@if test -z "$(filesystems)"; then \
+ 		echo "No filesystems with extended attributes found!" ;\
+ 		false ;\
+@@ -629,7 +625,7 @@
+ 	$(verbose) $(SETFILES) $(fcpath) $(filesystems)
+ 
+ resetlabels:
+-	@echo "Resetting labels on filesystem types: $(fs_names)"
++	@echo "Resetting labels on filesystem types: ext2 ext3 xfs jfs"
+ 	@if test -z "$(filesystems)"; then \
+ 		echo "No filesystems with extended attributes found!" ;\
+ 		false ;\
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/rsync_selinux.8 serefpolicy-3.6.27/man/man8/rsync_selinux.8
+--- nsaserefpolicy/man/man8/rsync_selinux.8	2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.6.27/man/man8/rsync_selinux.8	2009-08-18 08:30:56.000000000 -0400
+@@ -21,10 +21,18 @@
+ .TP
+ chcon -t public_content_t /var/rsync
+ .TP
+-If you want to make this permanant, i.e. survive a relabel, you must add an entry to the file_contexts.local file.
+-.EX
+-/etc/selinux/POLICYTYPE/contexts/files/file_contexts.local
+-/var/rsync(/.*)? system_u:object_r:public_content_t
++.TP
++To make this change permanent (survive a relabel), use the semanage command to add the change to file context configuration:
++.TP
++semanage fcontext -a -t public_content_t "/var/rsync(/.*)?"
++.TP
++This command adds the following entry to /etc/selinux/POLICYTYPE/contexts/files/file_contexts.local:
++.TP
++/var/rsync(/.*)? system_u:object_r:publix_content_t:s0
++.TP
++Run the restorecon command to apply the changes:
++.TP
++restorecon -R -v /var/rsync/
+ .EE
+ 
+ .SH SHARING FILES
+@@ -41,4 +49,4 @@
+ This manual page was written by Dan Walsh <dwalsh@redhat.com>.
+ 
+ .SH "SEE ALSO"
+-selinux(8), rsync(1), chcon(1), setsebool(8)
++selinux(8), rsync(1), chcon(1), setsebool(8), semanage(8)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/samba_selinux.8 serefpolicy-3.6.27/man/man8/samba_selinux.8
+--- nsaserefpolicy/man/man8/samba_selinux.8	2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.6.27/man/man8/samba_selinux.8	2009-08-18 08:31:04.000000000 -0400
+@@ -20,7 +20,7 @@
+ .TP
+ This command adds the following entry to /etc/selinux/POLICYTYPE/contexts/files/file_contexts.local:
+ .TP
+-/var/eng(/.*)? system_u:object_r:samba_share_t
++/var/eng(/.*)? system_u:object_r:samba_share_t:s0
+ .TP
+ Run the restorecon command to apply the changes:
+ .TP
+@@ -53,4 +53,4 @@
+ This manual page was written by Dan Walsh <dwalsh@redhat.com>.
+ 
+ .SH "SEE ALSO"
+-selinux(8), samba(7), chcon(1), setsebool(8)
++selinux(8), samba(7), chcon(1), setsebool(8), semanage(8)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.6.27/policy/flask/access_vectors
+--- nsaserefpolicy/policy/flask/access_vectors	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/flask/access_vectors	2009-08-14 16:51:06.000000000 -0400
+@@ -544,8 +544,6 @@
+ 	set_property
+ 	add
+ 	remove
+-	create
+-	destroy
+ }
+ 
+ class x_server
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.6.27/policy/global_tunables
 --- nsaserefpolicy/policy/global_tunables	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/global_tunables	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/global_tunables	2009-08-14 16:51:06.000000000 -0400
 @@ -61,15 +61,6 @@
  
  ## <desc>
@@ -245,9 +383,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +## </desc>
 +gen_tunable(mmap_low_allowed, false)
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mcs serefpolicy-3.6.26/policy/mcs
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mcs serefpolicy-3.6.27/policy/mcs
 --- nsaserefpolicy/policy/mcs	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/mcs	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/mcs	2009-08-14 16:51:06.000000000 -0400
 @@ -66,8 +66,8 @@
  #
  # Note that getattr on files is always permitted.
@@ -281,9 +419,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  mlsconstrain process { transition dyntransition }
  	(( h1 dom h2 ) or ( t1 == mcssetcats ));
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.6.26/policy/modules/admin/anaconda.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.6.27/policy/modules/admin/anaconda.te
 --- nsaserefpolicy/policy/modules/admin/anaconda.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/anaconda.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/anaconda.te	2009-08-14 16:51:06.000000000 -0400
 @@ -31,6 +31,7 @@
  modutils_domtrans_insmod(anaconda_t)
  
@@ -292,9 +430,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  userdom_user_home_dir_filetrans_user_home_content(anaconda_t, { dir file lnk_file fifo_file sock_file })
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/certwatch.te serefpolicy-3.6.26/policy/modules/admin/certwatch.te
---- nsaserefpolicy/policy/modules/admin/certwatch.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/certwatch.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/certwatch.te serefpolicy-3.6.27/policy/modules/admin/certwatch.te
+--- nsaserefpolicy/policy/modules/admin/certwatch.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/certwatch.te	2009-08-14 16:51:06.000000000 -0400
 @@ -36,6 +36,7 @@
  miscfiles_read_localization(certwatch_t)
  
@@ -303,17 +441,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  optional_policy(`
  	apache_exec_modules(certwatch_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.fc serefpolicy-3.6.26/policy/modules/admin/dmesg.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.fc serefpolicy-3.6.27/policy/modules/admin/dmesg.fc
 --- nsaserefpolicy/policy/modules/admin/dmesg.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/dmesg.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/dmesg.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,2 +1,4 @@
  
  /bin/dmesg		--		gen_context(system_u:object_r:dmesg_exec_t,s0)
 +
 +/usr/sbin/mcelog	--		gen_context(system_u:object_r:dmesg_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-3.6.26/policy/modules/admin/dmesg.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-3.6.27/policy/modules/admin/dmesg.te
 --- nsaserefpolicy/policy/modules/admin/dmesg.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/dmesg.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/dmesg.te	2009-08-14 16:51:06.000000000 -0400
 @@ -9,6 +9,7 @@
  type dmesg_t;
  type dmesg_exec_t;
@@ -348,9 +486,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # for when /usr is not mounted:
  files_dontaudit_search_isid_type_dirs(dmesg_t)
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.if serefpolicy-3.6.26/policy/modules/admin/kismet.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.if serefpolicy-3.6.27/policy/modules/admin/kismet.if
 --- nsaserefpolicy/policy/modules/admin/kismet.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/kismet.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/kismet.if	2009-08-14 16:51:06.000000000 -0400
 @@ -16,6 +16,7 @@
  	')
  
@@ -359,9 +497,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  ########################################
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.te serefpolicy-3.6.26/policy/modules/admin/kismet.te
---- nsaserefpolicy/policy/modules/admin/kismet.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/kismet.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.te serefpolicy-3.6.27/policy/modules/admin/kismet.te
+--- nsaserefpolicy/policy/modules/admin/kismet.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/kismet.te	2009-08-14 16:51:06.000000000 -0400
 @@ -17,6 +17,9 @@
  type kismet_tmp_t;
  files_tmp_file(kismet_tmp_t)
@@ -404,9 +542,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +		networkmanager_dbus_chat(kismet_t)
 +	')
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.6.26/policy/modules/admin/logrotate.te
---- nsaserefpolicy/policy/modules/admin/logrotate.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/logrotate.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.6.27/policy/modules/admin/logrotate.te
+--- nsaserefpolicy/policy/modules/admin/logrotate.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/logrotate.te	2009-08-14 16:51:06.000000000 -0400
 @@ -32,7 +32,7 @@
  # Change ownership on log files.
  allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner sys_resource sys_nice };
@@ -449,18 +587,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	slrnpull_manage_spool(logrotate_t)
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.6.26/policy/modules/admin/logwatch.te
---- nsaserefpolicy/policy/modules/admin/logwatch.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/logwatch.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.6.27/policy/modules/admin/logwatch.te
+--- nsaserefpolicy/policy/modules/admin/logwatch.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/logwatch.te	2009-08-14 16:51:06.000000000 -0400
 @@ -136,4 +136,5 @@
  
  optional_policy(`
  	samba_read_log(logwatch_t)
 +	samba_read_share_files(logwatch_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te serefpolicy-3.6.26/policy/modules/admin/mrtg.te
---- nsaserefpolicy/policy/modules/admin/mrtg.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/mrtg.te	2009-08-11 14:24:37.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te serefpolicy-3.6.27/policy/modules/admin/mrtg.te
+--- nsaserefpolicy/policy/modules/admin/mrtg.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/mrtg.te	2009-08-14 16:51:06.000000000 -0400
 @@ -116,6 +116,9 @@
  userdom_use_user_terminals(mrtg_t)
  userdom_dontaudit_read_user_home_content_files(mrtg_t)
@@ -482,9 +620,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	seutil_sigchld_newrole(mrtg_t)
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.if serefpolicy-3.6.26/policy/modules/admin/prelink.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.if serefpolicy-3.6.27/policy/modules/admin/prelink.if
 --- nsaserefpolicy/policy/modules/admin/prelink.if	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/prelink.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/prelink.if	2009-08-14 16:51:06.000000000 -0400
 @@ -140,3 +140,22 @@
  	files_search_var_lib($1)
  	manage_files_pattern($1, prelink_var_lib_t, prelink_var_lib_t)
@@ -508,9 +646,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	files_search_var_lib($1)
 +	relabelfrom_files_pattern($1, prelink_var_lib_t, prelink_var_lib_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.6.26/policy/modules/admin/readahead.te
---- nsaserefpolicy/policy/modules/admin/readahead.te	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/readahead.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.6.27/policy/modules/admin/readahead.te
+--- nsaserefpolicy/policy/modules/admin/readahead.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/readahead.te	2009-08-14 16:51:06.000000000 -0400
 @@ -54,7 +54,10 @@
  files_dontaudit_getattr_all_sockets(readahead_t)
  files_list_non_security(readahead_t)
@@ -522,9 +660,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  fs_getattr_all_fs(readahead_t)
  fs_search_auto_mountpoints(readahead_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.6.26/policy/modules/admin/rpm.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.6.27/policy/modules/admin/rpm.fc
 --- nsaserefpolicy/policy/modules/admin/rpm.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/rpm.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/rpm.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -4,14 +4,12 @@
  
  /usr/bin/yum 			--	gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -566,9 +704,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # SuSE
  ifdef(`distro_suse', `
  /usr/bin/online_update		--	gen_context(system_u:object_r:rpm_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.6.26/policy/modules/admin/rpm.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.6.27/policy/modules/admin/rpm.if
 --- nsaserefpolicy/policy/modules/admin/rpm.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/rpm.if	2009-08-13 15:26:27.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/rpm.if	2009-08-14 16:51:06.000000000 -0400
 @@ -66,6 +66,11 @@
  	rpm_domtrans($1)
  	role $2 types rpm_t;
@@ -792,9 +930,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	allow $1 rpm_t:process signull;
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.6.26/policy/modules/admin/rpm.te
---- nsaserefpolicy/policy/modules/admin/rpm.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/rpm.te	2009-08-12 15:12:20.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.6.27/policy/modules/admin/rpm.te
+--- nsaserefpolicy/policy/modules/admin/rpm.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/rpm.te	2009-08-14 16:51:06.000000000 -0400
 @@ -31,11 +31,15 @@
  files_type(rpm_var_lib_t)
  typealias rpm_var_lib_t alias var_lib_rpm_t;
@@ -1021,9 +1159,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  	optional_policy(`
  		java_domtrans_unconfined(rpm_script_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.6.26/policy/modules/admin/sudo.if
---- nsaserefpolicy/policy/modules/admin/sudo.if	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/sudo.if	2009-08-05 07:57:19.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.6.27/policy/modules/admin/sudo.if
+--- nsaserefpolicy/policy/modules/admin/sudo.if	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/sudo.if	2009-08-14 16:51:06.000000000 -0400
 @@ -66,8 +66,8 @@
  	allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms;
  	allow $1_sudo_t self:unix_dgram_socket sendto;
@@ -1034,15 +1172,54 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  	# Enter this derived domain from the user domain
  	domtrans_pattern($3, sudo_exec_t, $1_sudo_t)
-@@ -102,7 +102,7 @@
- 	auth_use_nsswitch($1_sudo_t)
+@@ -83,25 +83,10 @@
+ 	kernel_read_system_state($1_sudo_t)
+ 	kernel_link_key($1_sudo_t)
  
- 	corecmd_read_bin_symlinks($1_sudo_t)
+-	corecmd_read_bin_symlinks($1_sudo_t)
 -	corecmd_getattr_all_executables($1_sudo_t)
+-
+ 	dev_read_urand($1_sudo_t)
+ 	dev_rw_generic_usb_dev($1_sudo_t)
+ 	dev_read_sysfs($1_sudo_t)
+ 
+-	domain_use_interactive_fds($1_sudo_t)
+-	domain_sigchld_interactive_fds($1_sudo_t)
+-	domain_getattr_all_entry_files($1_sudo_t)
+-
+-	files_read_etc_files($1_sudo_t)
+-	files_read_var_files($1_sudo_t)
+-	files_read_usr_symlinks($1_sudo_t)
+-	files_getattr_usr_files($1_sudo_t)
+-	# for some PAM modules and for cwd
+-	files_dontaudit_search_home($1_sudo_t)
+-	files_list_tmp($1_sudo_t)
+-
+ 	fs_search_auto_mountpoints($1_sudo_t)
+ 	fs_getattr_xattr_fs($1_sudo_t)
+ 
+@@ -116,6 +101,21 @@
+ 	auth_manage_pam_pid($1_sudo_t)
+ 	auth_use_nsswitch($1_sudo_t)
+ 
++	corecmd_read_bin_symlinks($1_sudo_t)
 +	corecmd_exec_all_executables($1_sudo_t)
++
++	domain_use_interactive_fds($1_sudo_t)
++	domain_sigchld_interactive_fds($1_sudo_t)
++	domain_getattr_all_entry_files($1_sudo_t)
++
++	files_read_etc_files($1_sudo_t)
++	files_read_var_files($1_sudo_t)
++	files_read_usr_symlinks($1_sudo_t)
++	files_getattr_usr_files($1_sudo_t)
++	# for some PAM modules and for cwd
++	files_dontaudit_search_home($1_sudo_t)
++	files_list_tmp($1_sudo_t)
++
+ 	init_rw_utmp($1_sudo_t)
  
- 	domain_use_interactive_fds($1_sudo_t)
- 	domain_sigchld_interactive_fds($1_sudo_t)
+ 	logging_send_audit_msgs($1_sudo_t)
 @@ -132,9 +132,11 @@
  	userdom_manage_user_tmp_files($1_sudo_t)
  	userdom_manage_user_tmp_symlinks($1_sudo_t)
@@ -1068,9 +1245,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  ########################################
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.6.26/policy/modules/admin/tmpreaper.te
---- nsaserefpolicy/policy/modules/admin/tmpreaper.te	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/tmpreaper.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.6.27/policy/modules/admin/tmpreaper.te
+--- nsaserefpolicy/policy/modules/admin/tmpreaper.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/tmpreaper.te	2009-08-14 16:51:06.000000000 -0400
 @@ -52,6 +52,10 @@
  ')
  
@@ -1082,9 +1259,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	kismet_manage_log(tmpreaper_t)
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.6.26/policy/modules/admin/usermanage.te
---- nsaserefpolicy/policy/modules/admin/usermanage.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/usermanage.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.6.27/policy/modules/admin/usermanage.te
+--- nsaserefpolicy/policy/modules/admin/usermanage.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/usermanage.te	2009-08-14 16:51:06.000000000 -0400
 @@ -209,6 +209,7 @@
  files_manage_etc_files(groupadd_t)
  files_relabel_etc_files(groupadd_t)
@@ -1093,7 +1270,24 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  # Execute /usr/bin/{passwd, chfn, chsh} and /usr/sbin/{useradd, vipw}.
  corecmd_exec_bin(groupadd_t)
-@@ -326,6 +327,7 @@
+@@ -218,14 +219,11 @@
+ 
+ miscfiles_read_localization(groupadd_t)
+ 
+-auth_domtrans_chk_passwd(groupadd_t)
+-auth_rw_lastlog(groupadd_t)
+-auth_use_nsswitch(groupadd_t)
+-# these may be unnecessary due to the above
+-# domtrans_chk_passwd() call.
+ auth_manage_shadow(groupadd_t)
+ auth_relabel_shadow(groupadd_t)
+ auth_etc_filetrans_shadow(groupadd_t)
++auth_rw_lastlog(groupadd_t)
++auth_use_nsswitch(groupadd_t)
+ 
+ seutil_read_config(groupadd_t)
+ 
+@@ -329,6 +327,7 @@
  # user generally runs this from their home directory, so do not audit a search
  # on user home dir
  userdom_dontaudit_search_user_home_content(passwd_t)
@@ -1101,7 +1295,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  optional_policy(`
  	nscd_domtrans(passwd_t)
-@@ -443,6 +445,7 @@
+@@ -446,6 +445,7 @@
  corecmd_exec_bin(useradd_t)
  
  domain_use_interactive_fds(useradd_t)
@@ -1109,7 +1303,26 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  files_manage_etc_files(useradd_t)
  files_search_var_lib(useradd_t)
-@@ -515,6 +518,12 @@
+@@ -468,15 +468,12 @@
+ term_use_all_user_ttys(useradd_t)
+ term_use_all_user_ptys(useradd_t)
+ 
+-auth_domtrans_chk_passwd(useradd_t)
+-auth_rw_lastlog(useradd_t)
+-auth_rw_faillog(useradd_t)
+-auth_use_nsswitch(useradd_t)
+-# these may be unnecessary due to the above
+-# domtrans_chk_passwd() call.
+ auth_manage_shadow(useradd_t)
+ auth_relabel_shadow(useradd_t)
+ auth_etc_filetrans_shadow(useradd_t)
++auth_rw_lastlog(useradd_t)
++auth_rw_faillog(useradd_t)
++auth_use_nsswitch(useradd_t)
+ 
+ init_use_fds(useradd_t)
+ init_rw_utmp(useradd_t)
+@@ -521,6 +518,12 @@
  ')
  
  optional_policy(`
@@ -1122,9 +1335,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	rpm_use_fds(useradd_t)
  	rpm_rw_pipes(useradd_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.6.26/policy/modules/admin/vbetool.te
---- nsaserefpolicy/policy/modules/admin/vbetool.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/admin/vbetool.te	2009-08-13 15:29:00.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.6.27/policy/modules/admin/vbetool.te
+--- nsaserefpolicy/policy/modules/admin/vbetool.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/admin/vbetool.te	2009-08-14 16:51:06.000000000 -0400
 @@ -15,15 +15,20 @@
  # Local policy
  #
@@ -1157,9 +1370,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	xserver_exec_pid(vbetool_t)
 +	xserver_write_pid(vbetool_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.te serefpolicy-3.6.26/policy/modules/apps/awstats.te
---- nsaserefpolicy/policy/modules/apps/awstats.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/awstats.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.te serefpolicy-3.6.27/policy/modules/apps/awstats.te
+--- nsaserefpolicy/policy/modules/apps/awstats.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/awstats.te	2009-08-14 16:51:06.000000000 -0400
 @@ -51,6 +51,8 @@
  
  libs_read_lib_files(awstats_t)
@@ -1169,9 +1382,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  miscfiles_read_localization(awstats_t)
  
  sysnet_dns_name_resolve(awstats_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/calamaris.te serefpolicy-3.6.26/policy/modules/apps/calamaris.te
---- nsaserefpolicy/policy/modules/apps/calamaris.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/calamaris.te	2009-08-05 16:42:44.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/calamaris.te serefpolicy-3.6.27/policy/modules/apps/calamaris.te
+--- nsaserefpolicy/policy/modules/apps/calamaris.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/calamaris.te	2009-08-14 16:51:06.000000000 -0400
 @@ -84,3 +84,7 @@
  optional_policy(`
  	nis_use_ypbind(calamaris_t)
@@ -1180,9 +1393,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
 +	nscd_socket_use(calamaris_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.6.26/policy/modules/apps/cpufreqselector.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.6.27/policy/modules/apps/cpufreqselector.te
 --- nsaserefpolicy/policy/modules/apps/cpufreqselector.te	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/cpufreqselector.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/cpufreqselector.te	2009-08-14 16:51:06.000000000 -0400
 @@ -8,7 +8,8 @@
  
  type cpufreqselector_t;
@@ -1201,17 +1414,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	policykit_domtrans_auth(cpufreqselector_t)
  	policykit_read_lib(cpufreqselector_t)
  	policykit_read_reload(cpufreqselector_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.fc serefpolicy-3.6.26/policy/modules/apps/gitosis.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.fc serefpolicy-3.6.27/policy/modules/apps/gitosis.fc
 --- nsaserefpolicy/policy/modules/apps/gitosis.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/gitosis.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/gitosis.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,4 @@
 +
 +/usr/bin/gitosis-serve			--        gen_context(system_u:object_r:gitosis_exec_t,s0)
 +
 +/var/lib/gitosis(/.*)?                            gen_context(system_u:object_r:gitosis_var_lib_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.if serefpolicy-3.6.26/policy/modules/apps/gitosis.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.if serefpolicy-3.6.27/policy/modules/apps/gitosis.if
 --- nsaserefpolicy/policy/modules/apps/gitosis.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/gitosis.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/gitosis.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,96 @@
 +## <summary>gitosis interface</summary>
 +
@@ -1309,9 +1522,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +        manage_lnk_files_pattern($1, gitosis_var_lib_t, gitosis_var_lib_t)
 +	manage_dirs_pattern($1, gitosis_var_lib_t, gitosis_var_lib_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.te serefpolicy-3.6.26/policy/modules/apps/gitosis.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.te serefpolicy-3.6.27/policy/modules/apps/gitosis.te
 --- nsaserefpolicy/policy/modules/apps/gitosis.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/gitosis.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/gitosis.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,36 @@
 +policy_module(gitosis,1.0.0)
 +
@@ -1349,9 +1562,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +files_search_var_lib(gitosis_t)
 +
 +miscfiles_read_localization(gitosis_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.6.26/policy/modules/apps/gnome.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.6.27/policy/modules/apps/gnome.fc
 --- nsaserefpolicy/policy/modules/apps/gnome.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/gnome.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/gnome.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,8 +1,16 @@
 -HOME_DIR/\.config/gtk-.*	gen_context(system_u:object_r:gnome_home_t,s0)
 +HOME_DIR/\.config(/.*)?		gen_context(system_u:object_r:gnome_home_t,s0)
@@ -1371,9 +1584,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/usr/libexec/gconf-defaults-mechanism	    	--      gen_context(system_u:object_r:gconfdefaultsm_exec_t,s0)
 +
 +/usr/libexec/gnome-system-monitor-mechanism 	--      gen_context(system_u:object_r:gnomesystemmm_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.6.26/policy/modules/apps/gnome.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.6.27/policy/modules/apps/gnome.if
 --- nsaserefpolicy/policy/modules/apps/gnome.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/gnome.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/gnome.if	2009-08-14 16:51:06.000000000 -0400
 @@ -89,5 +89,175 @@
  
  	allow $1 gnome_home_t:dir manage_dir_perms;
@@ -1550,9 +1763,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	# Connect to pulseaudit server
 +	stream_connect_pattern($1, gnome_home_t, gnome_home_t, $2)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.6.26/policy/modules/apps/gnome.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.6.27/policy/modules/apps/gnome.te
 --- nsaserefpolicy/policy/modules/apps/gnome.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/gnome.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/gnome.te	2009-08-14 16:51:06.000000000 -0400
 @@ -9,16 +9,18 @@
  attribute gnomedomain;
  
@@ -1674,9 +1887,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 +
 +permissive gnomesystemmm_t;
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.6.26/policy/modules/apps/gpg.te
---- nsaserefpolicy/policy/modules/apps/gpg.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/gpg.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.6.27/policy/modules/apps/gpg.te
+--- nsaserefpolicy/policy/modules/apps/gpg.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/gpg.te	2009-08-14 16:51:06.000000000 -0400
 @@ -159,6 +159,19 @@
  	xserver_rw_xdm_pipes(gpg_t)
  ')
@@ -1704,9 +1917,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -	xserver_stream_connect(gpg_pinentry_t)
 +	xserver_common_app(gpg_pinentry_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.6.26/policy/modules/apps/java.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.6.27/policy/modules/apps/java.fc
 --- nsaserefpolicy/policy/modules/apps/java.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/java.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/java.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -2,15 +2,16 @@
  # /opt
  #
@@ -1741,9 +1954,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +/usr/bin/octave-[^/]*  	--	gen_context(system_u:object_r:java_exec_t,s0)
 +/usr/lib/opera(/.*)?/opera	--	gen_context(system_u:object_r:java_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.6.26/policy/modules/apps/java.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.6.27/policy/modules/apps/java.if
 --- nsaserefpolicy/policy/modules/apps/java.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/java.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/java.if	2009-08-14 16:51:06.000000000 -0400
 @@ -30,6 +30,7 @@
  
  	allow java_t $2:unix_stream_socket connectto;
@@ -1884,9 +2097,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +		xserver_role($1_r, $1_java_t)
 +	')
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.6.26/policy/modules/apps/java.te
---- nsaserefpolicy/policy/modules/apps/java.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/java.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.6.27/policy/modules/apps/java.te
+--- nsaserefpolicy/policy/modules/apps/java.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/java.te	2009-08-14 16:51:06.000000000 -0400
 @@ -20,6 +20,8 @@
  typealias java_t alias { staff_javaplugin_t user_javaplugin_t sysadm_javaplugin_t };
  typealias java_t alias { auditadm_javaplugin_t secadm_javaplugin_t };
@@ -1949,21 +2162,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	')
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.fc serefpolicy-3.6.26/policy/modules/apps/kdumpgui.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.fc serefpolicy-3.6.27/policy/modules/apps/kdumpgui.fc
 --- nsaserefpolicy/policy/modules/apps/kdumpgui.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/kdumpgui.fc	2009-08-10 09:44:30.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/kdumpgui.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,2 @@
 +
 +/usr/share/system-config-kdump/system-config-kdump-backend.py -- gen_context(system_u:object_r:kdumpgui_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.if serefpolicy-3.6.26/policy/modules/apps/kdumpgui.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.if serefpolicy-3.6.27/policy/modules/apps/kdumpgui.if
 --- nsaserefpolicy/policy/modules/apps/kdumpgui.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/kdumpgui.if	2009-08-10 09:44:30.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/kdumpgui.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,2 @@
 +## <summary>system-config-kdump policy</summary>
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.te serefpolicy-3.6.26/policy/modules/apps/kdumpgui.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.te serefpolicy-3.6.27/policy/modules/apps/kdumpgui.te
 --- nsaserefpolicy/policy/modules/apps/kdumpgui.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/kdumpgui.te	2009-08-10 09:44:30.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/kdumpgui.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,64 @@
 +policy_module(kdumpgui,1.0.0)
 +
@@ -2029,15 +2242,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +permissive kdumpgui_t;
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.fc serefpolicy-3.6.26/policy/modules/apps/livecd.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.fc serefpolicy-3.6.27/policy/modules/apps/livecd.fc
 --- nsaserefpolicy/policy/modules/apps/livecd.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/livecd.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/livecd.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,2 @@
 +
 +/usr/bin/livecd-creator	--	gen_context(system_u:object_r:livecd_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.if serefpolicy-3.6.26/policy/modules/apps/livecd.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.if serefpolicy-3.6.27/policy/modules/apps/livecd.if
 --- nsaserefpolicy/policy/modules/apps/livecd.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/livecd.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/livecd.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,50 @@
 +
 +## <summary>policy for livecd</summary>
@@ -2089,9 +2302,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	seutil_run_setfiles_mac(livecd_t, $2)
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.te serefpolicy-3.6.26/policy/modules/apps/livecd.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.te serefpolicy-3.6.27/policy/modules/apps/livecd.te
 --- nsaserefpolicy/policy/modules/apps/livecd.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/livecd.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/livecd.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,26 @@
 +policy_module(livecd, 1.0.0)
 +
@@ -2119,9 +2332,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 +
 +seutil_domtrans_setfiles_mac(livecd_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.6.26/policy/modules/apps/mono.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.6.27/policy/modules/apps/mono.if
 --- nsaserefpolicy/policy/modules/apps/mono.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/mono.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/mono.if	2009-08-14 16:51:06.000000000 -0400
 @@ -21,6 +21,105 @@
  
  ########################################
@@ -2237,9 +2450,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	')
  
  	corecmd_search_bin($1)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.6.26/policy/modules/apps/mono.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.6.27/policy/modules/apps/mono.te
 --- nsaserefpolicy/policy/modules/apps/mono.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/mono.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/mono.te	2009-08-14 16:51:06.000000000 -0400
 @@ -15,7 +15,7 @@
  # Local policy
  #
@@ -2263,9 +2476,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
 +	xserver_rw_shm(mono_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.6.26/policy/modules/apps/mozilla.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.fc serefpolicy-3.6.27/policy/modules/apps/mozilla.fc
+--- nsaserefpolicy/policy/modules/apps/mozilla.fc	2009-07-28 13:28:33.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/mozilla.fc	2009-08-14 16:51:06.000000000 -0400
+@@ -1,6 +1,7 @@
+ HOME_DIR/\.galeon(/.*)?			gen_context(system_u:object_r:mozilla_home_t,s0)
+ HOME_DIR/\.java(/.*)?			gen_context(system_u:object_r:mozilla_home_t,s0)
+ HOME_DIR/\.mozilla(/.*)?		gen_context(system_u:object_r:mozilla_home_t,s0)
++HOME_DIR/\.thunderbird(/.*)?		gen_context(system_u:object_r:mozilla_home_t,s0)
+ HOME_DIR/\.netscape(/.*)?		gen_context(system_u:object_r:mozilla_home_t,s0)
+ HOME_DIR/\.phoenix(/.*)?		gen_context(system_u:object_r:mozilla_home_t,s0)
+ 
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.6.27/policy/modules/apps/mozilla.if
 --- nsaserefpolicy/policy/modules/apps/mozilla.if	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/mozilla.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/mozilla.if	2009-08-14 16:51:06.000000000 -0400
 @@ -45,6 +45,18 @@
  	relabel_dirs_pattern($2, mozilla_home_t, mozilla_home_t)
  	relabel_files_pattern($2, mozilla_home_t, mozilla_home_t)
@@ -2293,9 +2517,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	userdom_search_user_home_dirs($1)
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.6.26/policy/modules/apps/mozilla.te
---- nsaserefpolicy/policy/modules/apps/mozilla.te	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/mozilla.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.6.27/policy/modules/apps/mozilla.te
+--- nsaserefpolicy/policy/modules/apps/mozilla.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/mozilla.te	2009-08-14 16:51:06.000000000 -0400
 @@ -59,6 +59,7 @@
  manage_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
  manage_lnk_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
@@ -2370,9 +2594,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
  	thunderbird_domtrans(mozilla_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.fc serefpolicy-3.6.26/policy/modules/apps/nsplugin.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.fc serefpolicy-3.6.27/policy/modules/apps/nsplugin.fc
 --- nsaserefpolicy/policy/modules/apps/nsplugin.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/nsplugin.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/nsplugin.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,12 @@
 +HOME_DIR/\.adobe(/.*)?			gen_context(system_u:object_r:nsplugin_home_t,s0)
 +HOME_DIR/\.macromedia(/.*)?		gen_context(system_u:object_r:nsplugin_home_t,s0)
@@ -2386,9 +2610,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/usr/lib(64)?/nspluginwrapper/npviewer.bin	--	gen_context(system_u:object_r:nsplugin_exec_t,s0)
 +/usr/lib(64)?/nspluginwrapper/plugin-config	--	gen_context(system_u:object_r:nsplugin_config_exec_t,s0)
 +/usr/lib(64)?/mozilla/plugins-wrapped(/.*)?			gen_context(system_u:object_r:nsplugin_rw_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.if serefpolicy-3.6.26/policy/modules/apps/nsplugin.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.if serefpolicy-3.6.27/policy/modules/apps/nsplugin.if
 --- nsaserefpolicy/policy/modules/apps/nsplugin.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/nsplugin.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/nsplugin.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,313 @@
 +
 +## <summary>policy for nsplugin</summary>
@@ -2703,9 +2927,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +	allow $1 nsplugin_home_t:fifo_file rw_fifo_file_perms; 
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.6.26/policy/modules/apps/nsplugin.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.6.27/policy/modules/apps/nsplugin.te
 --- nsaserefpolicy/policy/modules/apps/nsplugin.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/nsplugin.te	2009-08-13 14:58:45.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/nsplugin.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,286 @@
 +
 +policy_module(nsplugin, 1.0.0)
@@ -2993,16 +3217,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 +
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.fc serefpolicy-3.6.26/policy/modules/apps/openoffice.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.fc serefpolicy-3.6.27/policy/modules/apps/openoffice.fc
 --- nsaserefpolicy/policy/modules/apps/openoffice.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/openoffice.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/openoffice.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,3 @@
 +/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0)
 +/usr/lib64/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0)
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.if serefpolicy-3.6.26/policy/modules/apps/openoffice.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.if serefpolicy-3.6.27/policy/modules/apps/openoffice.if
 --- nsaserefpolicy/policy/modules/apps/openoffice.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/openoffice.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/openoffice.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,93 @@
 +## <summary>Openoffice</summary>
 +
@@ -3097,9 +3321,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +		xserver_common_x_domain_template($1, $1_openoffice_t)
 +	')
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.te serefpolicy-3.6.26/policy/modules/apps/openoffice.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.te serefpolicy-3.6.27/policy/modules/apps/openoffice.te
 --- nsaserefpolicy/policy/modules/apps/openoffice.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/openoffice.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/openoffice.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,14 @@
 +
 +policy_module(openoffice, 1.0.0)
@@ -3115,15 +3339,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ptchown.fc serefpolicy-3.6.26/policy/modules/apps/ptchown.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ptchown.fc serefpolicy-3.6.27/policy/modules/apps/ptchown.fc
 --- nsaserefpolicy/policy/modules/apps/ptchown.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/ptchown.fc	2009-08-12 14:48:50.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/ptchown.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,2 @@
 +
 +/usr/libexec/pt_chown	--	gen_context(system_u:object_r:ptchown_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ptchown.if serefpolicy-3.6.26/policy/modules/apps/ptchown.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ptchown.if serefpolicy-3.6.27/policy/modules/apps/ptchown.if
 --- nsaserefpolicy/policy/modules/apps/ptchown.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/ptchown.if	2009-08-12 14:51:46.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/ptchown.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,22 @@
 +
 +## <summary>helper function for grantpt(3), changes ownship and permissions of pseudotty</summary>
@@ -3147,9 +3371,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	domtrans_pattern($1,ptchown_exec_t,ptchown_t)
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ptchown.te serefpolicy-3.6.26/policy/modules/apps/ptchown.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ptchown.te serefpolicy-3.6.27/policy/modules/apps/ptchown.te
 --- nsaserefpolicy/policy/modules/apps/ptchown.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/ptchown.te	2009-08-13 17:39:44.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/ptchown.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,38 @@
 +policy_module(ptchown,1.0.0)
 +
@@ -3189,9 +3413,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +term_setattr_all_user_ptys(ptchown_t)
 +
 +miscfiles_read_localization(ptchown_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.26/policy/modules/apps/pulseaudio.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.27/policy/modules/apps/pulseaudio.te
 --- nsaserefpolicy/policy/modules/apps/pulseaudio.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/pulseaudio.te	2009-08-13 15:27:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/pulseaudio.te	2009-08-14 16:51:06.000000000 -0400
 @@ -22,6 +22,7 @@
  allow pulseaudio_t self:unix_dgram_socket { sendto create_socket_perms };
  allow pulseaudio_t self:tcp_socket create_stream_socket_perms;
@@ -3226,17 +3450,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	xserver_common_app(pulseaudio_t)
  ')
 -
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.fc serefpolicy-3.6.26/policy/modules/apps/qemu.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.fc serefpolicy-3.6.27/policy/modules/apps/qemu.fc
 --- nsaserefpolicy/policy/modules/apps/qemu.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/qemu.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/qemu.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,2 +1,2 @@
 -/usr/bin/qemu	--	gen_context(system_u:object_r:qemu_exec_t,s0)
 -/usr/bin/qemu-kvm --	gen_context(system_u:object_r:qemu_exec_t,s0)
 +/usr/bin/qemu.*	--	gen_context(system_u:object_r:qemu_exec_t,s0)
 +/usr/libexec/qemu.*	--	gen_context(system_u:object_r:qemu_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.if serefpolicy-3.6.26/policy/modules/apps/qemu.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.if serefpolicy-3.6.27/policy/modules/apps/qemu.if
 --- nsaserefpolicy/policy/modules/apps/qemu.if	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/qemu.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/qemu.if	2009-08-14 16:51:06.000000000 -0400
 @@ -40,6 +40,93 @@
  
  	qemu_domtrans($1)
@@ -3543,9 +3767,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +	manage_files_pattern($1, qemu_tmp_t, qemu_tmp_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.te serefpolicy-3.6.26/policy/modules/apps/qemu.te
---- nsaserefpolicy/policy/modules/apps/qemu.te	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/qemu.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.te serefpolicy-3.6.27/policy/modules/apps/qemu.te
+--- nsaserefpolicy/policy/modules/apps/qemu.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/qemu.te	2009-08-14 16:51:06.000000000 -0400
 @@ -13,15 +13,46 @@
  ## </desc>
  gen_tunable(qemu_full_network, false)
@@ -3653,20 +3877,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	role unconfined_r types qemu_unconfined_t;
  	allow qemu_unconfined_t self:process { execstack execmem };
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.fc serefpolicy-3.6.26/policy/modules/apps/sambagui.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.fc serefpolicy-3.6.27/policy/modules/apps/sambagui.fc
 --- nsaserefpolicy/policy/modules/apps/sambagui.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/sambagui.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/sambagui.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1 @@
 +/usr/share/system-config-samba/system-config-samba-mechanism.py -- gen_context(system_u:object_r:sambagui_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.if serefpolicy-3.6.26/policy/modules/apps/sambagui.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.if serefpolicy-3.6.27/policy/modules/apps/sambagui.if
 --- nsaserefpolicy/policy/modules/apps/sambagui.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/sambagui.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/sambagui.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,2 @@
 +## <summary>system-config-samba policy</summary>
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.te serefpolicy-3.6.26/policy/modules/apps/sambagui.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.te serefpolicy-3.6.27/policy/modules/apps/sambagui.te
 --- nsaserefpolicy/policy/modules/apps/sambagui.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/sambagui.te	2009-08-13 09:46:37.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/sambagui.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,55 @@
 +policy_module(sambagui,1.0.0)
 +
@@ -3723,14 +3947,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
 +	policykit_dbus_chat(sambagui_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.fc serefpolicy-3.6.26/policy/modules/apps/sandbox.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.fc serefpolicy-3.6.27/policy/modules/apps/sandbox.fc
 --- nsaserefpolicy/policy/modules/apps/sandbox.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/sandbox.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/sandbox.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1 @@
 +# No types are sandbox_exec_t
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.if serefpolicy-3.6.26/policy/modules/apps/sandbox.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.if serefpolicy-3.6.27/policy/modules/apps/sandbox.if
 --- nsaserefpolicy/policy/modules/apps/sandbox.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/sandbox.if	2009-08-13 09:52:58.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/sandbox.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,143 @@
 +
 +## <summary>policy for sandbox</summary>
@@ -3875,9 +4099,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +	allow $1 sandbox_xserver_tmpfs_t:file rw_file_perms;
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.te serefpolicy-3.6.26/policy/modules/apps/sandbox.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.te serefpolicy-3.6.27/policy/modules/apps/sandbox.te
 --- nsaserefpolicy/policy/modules/apps/sandbox.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/apps/sandbox.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/sandbox.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,274 @@
 +policy_module(sandbox,1.0.0)
 +dbus_stub()
@@ -4153,9 +4377,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
 +	hal_dbus_chat(sandbox_net_client_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/screen.if serefpolicy-3.6.26/policy/modules/apps/screen.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/screen.if serefpolicy-3.6.27/policy/modules/apps/screen.if
 --- nsaserefpolicy/policy/modules/apps/screen.if	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/screen.if	2009-08-05 16:33:49.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/screen.if	2009-08-14 16:51:06.000000000 -0400
 @@ -61,6 +61,8 @@
  	manage_fifo_files_pattern($1_screen_t, screen_dir_t, screen_var_run_t)
  	manage_dirs_pattern($1_screen_t, screen_dir_t, screen_dir_t)
@@ -4198,9 +4422,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +         manage_lnk_files_pattern($1,screen_var_run_t,screen_var_run_t)
 +         manage_fifo_files_pattern($1,screen_var_run_t,screen_var_run_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.6.26/policy/modules/apps/vmware.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.6.27/policy/modules/apps/vmware.fc
 --- nsaserefpolicy/policy/modules/apps/vmware.fc	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/vmware.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/vmware.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -18,6 +18,7 @@
  /usr/bin/vmnet-natd		--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
  /usr/bin/vmnet-netifup		--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
@@ -4209,9 +4433,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /usr/bin/vmware-nmbd		--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
  /usr/bin/vmware-ping		--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
  /usr/bin/vmware-smbd		--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.6.26/policy/modules/apps/vmware.te
---- nsaserefpolicy/policy/modules/apps/vmware.te	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/vmware.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.6.27/policy/modules/apps/vmware.te
+--- nsaserefpolicy/policy/modules/apps/vmware.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/vmware.te	2009-08-14 16:51:06.000000000 -0400
 @@ -157,6 +157,7 @@
  optional_policy(`
  	xserver_read_tmp_files(vmware_host_t)
@@ -4220,9 +4444,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  ifdef(`TODO',`
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/webalizer.te serefpolicy-3.6.26/policy/modules/apps/webalizer.te
---- nsaserefpolicy/policy/modules/apps/webalizer.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/webalizer.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/webalizer.te serefpolicy-3.6.27/policy/modules/apps/webalizer.te
+--- nsaserefpolicy/policy/modules/apps/webalizer.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/webalizer.te	2009-08-14 16:51:06.000000000 -0400
 @@ -69,7 +69,6 @@
  fs_search_auto_mountpoints(webalizer_t)
  fs_getattr_xattr_fs(webalizer_t)
@@ -4231,9 +4455,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  files_read_etc_files(webalizer_t)
  files_read_etc_runtime_files(webalizer_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.fc serefpolicy-3.6.26/policy/modules/apps/wine.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.fc serefpolicy-3.6.27/policy/modules/apps/wine.fc
 --- nsaserefpolicy/policy/modules/apps/wine.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/wine.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/wine.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,4 +1,21 @@
 -/usr/bin/wine			--	gen_context(system_u:object_r:wine_exec_t,s0)
 +/usr/bin/wine.*			--	gen_context(system_u:object_r:wine_exec_t,s0)
@@ -4259,9 +4483,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
 -/opt/cxoffice/bin/wine		--	gen_context(system_u:object_r:wine_exec_t,s0)
 -/opt/picasa/wine/bin/wine	--	gen_context(system_u:object_r:wine_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.6.26/policy/modules/apps/wine.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.6.27/policy/modules/apps/wine.if
 --- nsaserefpolicy/policy/modules/apps/wine.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/wine.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/wine.if	2009-08-14 16:51:06.000000000 -0400
 @@ -43,3 +43,63 @@
  	wine_domtrans($1)
  	role $2 types wine_t;
@@ -4326,9 +4550,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	relabel_lnk_files_pattern($2, wine_home_t, wine_home_t)
 +
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.6.26/policy/modules/apps/wine.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.6.27/policy/modules/apps/wine.te
 --- nsaserefpolicy/policy/modules/apps/wine.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/apps/wine.te	2009-08-07 06:43:34.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/apps/wine.te	2009-08-14 16:51:06.000000000 -0400
 @@ -9,20 +9,35 @@
  type wine_t;
  type wine_exec_t;
@@ -4369,9 +4593,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +        xserver_common_app(wine_t)
 +	xserver_rw_shm(wine_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.6.26/policy/modules/kernel/corecommands.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.6.27/policy/modules/kernel/corecommands.fc
 --- nsaserefpolicy/policy/modules/kernel/corecommands.fc	2009-07-30 13:09:10.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/corecommands.fc	2009-08-11 14:58:11.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/corecommands.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -125,6 +125,7 @@
  /sbin/.*				gen_context(system_u:object_r:bin_t,s0)
  /sbin/mkfs\.cramfs		--	gen_context(system_u:object_r:bin_t,s0)
@@ -4412,9 +4636,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/usr/lib(64)?/rpm/rpmv		-- 	gen_context(system_u:object_r:bin_t,s0)
 +
 +/usr/lib(64)?/gimp/.*/plug-ins(/.*)?  gen_context(system_u:object_r:bin_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-3.6.26/policy/modules/kernel/corecommands.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-3.6.27/policy/modules/kernel/corecommands.if
 --- nsaserefpolicy/policy/modules/kernel/corecommands.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/corecommands.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/corecommands.if	2009-08-14 16:51:06.000000000 -0400
 @@ -893,6 +893,7 @@
  
  	read_lnk_files_pattern($1, bin_t, bin_t)
@@ -4423,9 +4647,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  ########################################
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.6.26/policy/modules/kernel/corenetwork.te.in
---- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/corenetwork.te.in	2009-08-11 14:24:37.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.6.27/policy/modules/kernel/corenetwork.te.in
+--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/corenetwork.te.in	2009-08-14 16:51:06.000000000 -0400
 @@ -65,6 +65,7 @@
  type server_packet_t, packet_type, server_packet_type;
  
@@ -4533,9 +4757,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # network_node examples:
  #network_node(lo, s0 - mls_systemhigh, 127.0.0.1, 255.255.255.255)
  #network_node(multicast, s0 - mls_systemhigh, ff00::, ff00::)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.6.26/policy/modules/kernel/devices.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.6.27/policy/modules/kernel/devices.fc
 --- nsaserefpolicy/policy/modules/kernel/devices.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/devices.fc	2009-08-13 15:24:04.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/devices.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -47,8 +47,10 @@
  /dev/kmem		-c	gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
  /dev/kmsg		-c	gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
@@ -4564,9 +4788,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /dev/usb/dc2xx.*	-c	gen_context(system_u:object_r:scanner_device_t,s0)
  /dev/usb/lp.*		-c	gen_context(system_u:object_r:printer_device_t,s0)
  /dev/usb/mdc800.*	-c	gen_context(system_u:object_r:scanner_device_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.26/policy/modules/kernel/devices.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.27/policy/modules/kernel/devices.if
 --- nsaserefpolicy/policy/modules/kernel/devices.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/devices.if	2009-08-13 15:36:14.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/devices.if	2009-08-14 16:51:06.000000000 -0400
 @@ -1655,6 +1655,78 @@
  
  ########################################
@@ -4759,9 +4983,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	Read and write Xen devices.
  ## </summary>
  ## <param name="domain">
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.6.26/policy/modules/kernel/devices.te
---- nsaserefpolicy/policy/modules/kernel/devices.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/devices.te	2009-08-03 06:30:00.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.6.27/policy/modules/kernel/devices.te
+--- nsaserefpolicy/policy/modules/kernel/devices.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/devices.te	2009-08-14 16:51:06.000000000 -0400
 @@ -84,6 +84,13 @@
  dev_node(kmsg_device_t)
  
@@ -4802,9 +5026,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  type xen_device_t;
  dev_node(xen_device_t)
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.6.26/policy/modules/kernel/domain.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.6.27/policy/modules/kernel/domain.if
 --- nsaserefpolicy/policy/modules/kernel/domain.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/domain.if	2009-08-05 08:03:44.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/domain.if	2009-08-14 16:51:06.000000000 -0400
 @@ -44,34 +44,6 @@
  interface(`domain_type',`
  	# start with basic domain
@@ -4985,10 +5209,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +	allow $1 unconfined_domain_type:process signal;
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.6.26/policy/modules/kernel/domain.te
---- nsaserefpolicy/policy/modules/kernel/domain.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/domain.te	2009-08-05 07:21:34.000000000 -0400
-@@ -5,6 +5,13 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.6.27/policy/modules/kernel/domain.te
+--- nsaserefpolicy/policy/modules/kernel/domain.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/domain.te	2009-08-14 16:51:06.000000000 -0400
+@@ -1,10 +1,17 @@
+ 
+-policy_module(domain, 1.7.0)
++policy_module(domain, 1.6.1)
+ 
+ ########################################
  #
  # Declarations
  #
@@ -5126,9 +5355,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	userdom_relabelto_user_home_dirs(polydomain)
 +	userdom_relabelto_user_home_files(polydomain)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.6.26/policy/modules/kernel/files.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.6.27/policy/modules/kernel/files.fc
 --- nsaserefpolicy/policy/modules/kernel/files.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/files.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/files.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -18,6 +18,7 @@
  /fsckoptions 		--	gen_context(system_u:object_r:etc_runtime_t,s0)
  /halt			--	gen_context(system_u:object_r:etc_runtime_t,s0)
@@ -5146,9 +5375,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /var/lib(/.*)?			gen_context(system_u:object_r:var_lib_t,s0)
  
  /var/lib/nfs/rpc_pipefs(/.*)?	<<none>>
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.6.26/policy/modules/kernel/files.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.6.27/policy/modules/kernel/files.if
 --- nsaserefpolicy/policy/modules/kernel/files.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/files.if	2009-08-13 18:17:55.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/files.if	2009-08-14 16:51:06.000000000 -0400
 @@ -110,6 +110,11 @@
  ## </param>
  #
@@ -5521,9 +5750,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	')
 +	allow $1 file_type:file entrypoint;
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.6.26/policy/modules/kernel/files.te
---- nsaserefpolicy/policy/modules/kernel/files.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/files.te	2009-08-12 14:53:21.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.6.27/policy/modules/kernel/files.te
+--- nsaserefpolicy/policy/modules/kernel/files.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/files.te	2009-08-14 16:51:06.000000000 -0400
 @@ -42,6 +42,7 @@
  #
  type boot_t;
@@ -5551,15 +5780,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  ########################################
  #
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.fc serefpolicy-3.6.26/policy/modules/kernel/filesystem.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.fc serefpolicy-3.6.27/policy/modules/kernel/filesystem.fc
 --- nsaserefpolicy/policy/modules/kernel/filesystem.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/filesystem.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/filesystem.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1 +1 @@
 -# This module currently does not have any file contexts.
 +/dev/shm		-d	gen_context(system_u:object_r:tmpfs_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.6.26/policy/modules/kernel/filesystem.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.6.27/policy/modules/kernel/filesystem.if
 --- nsaserefpolicy/policy/modules/kernel/filesystem.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/filesystem.if	2009-08-13 15:46:05.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/filesystem.if	2009-08-14 16:51:06.000000000 -0400
 @@ -1537,6 +1537,24 @@
  
  ########################################
@@ -5634,9 +5863,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	dontaudit $1 cifs_t:dir list_dir_perms;
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.6.26/policy/modules/kernel/filesystem.te
---- nsaserefpolicy/policy/modules/kernel/filesystem.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/filesystem.te	2009-08-12 11:10:36.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.6.27/policy/modules/kernel/filesystem.te
+--- nsaserefpolicy/policy/modules/kernel/filesystem.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/filesystem.te	2009-08-14 16:51:06.000000000 -0400
 @@ -93,7 +93,7 @@
  type hugetlbfs_t;
  fs_type(hugetlbfs_t)
@@ -5646,9 +5875,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  type ibmasmfs_t;
  fs_type(ibmasmfs_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.6.26/policy/modules/kernel/kernel.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.6.27/policy/modules/kernel/kernel.if
 --- nsaserefpolicy/policy/modules/kernel/kernel.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/kernel.if	2009-08-10 11:43:18.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/kernel.if	2009-08-14 16:51:06.000000000 -0400
 @@ -1807,7 +1807,7 @@
  	')
  
@@ -5706,9 +5935,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +	allow $1 kernel_t:unix_stream_socket connectto;
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.6.26/policy/modules/kernel/kernel.te
---- nsaserefpolicy/policy/modules/kernel/kernel.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/kernel.te	2009-08-13 18:32:39.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.6.27/policy/modules/kernel/kernel.te
+--- nsaserefpolicy/policy/modules/kernel/kernel.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/kernel.te	2009-08-14 16:51:06.000000000 -0400
 @@ -63,6 +63,15 @@
  genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0)
  
@@ -5790,9 +6019,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow kern_unconfined unlabeled_t:process ~{ transition dyntransition execmem execstack execheap };
 +
 +files_boot(kernel_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.6.26/policy/modules/kernel/selinux.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.6.27/policy/modules/kernel/selinux.if
 --- nsaserefpolicy/policy/modules/kernel/selinux.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/selinux.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/selinux.if	2009-08-14 16:51:06.000000000 -0400
 @@ -40,7 +40,7 @@
  
  	# because of this statement, any module which
@@ -5850,9 +6079,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	fs_type($1)
 +	mls_trusted_object($1)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.6.26/policy/modules/kernel/terminal.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.6.27/policy/modules/kernel/terminal.fc
 --- nsaserefpolicy/policy/modules/kernel/terminal.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/terminal.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/terminal.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -13,6 +13,7 @@
  /dev/ip2[^/]*		-c	gen_context(system_u:object_r:tty_device_t,s0)
  /dev/isdn.*		-c	gen_context(system_u:object_r:tty_device_t,s0)
@@ -5861,9 +6090,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /dev/rfcomm[0-9]+	-c	gen_context(system_u:object_r:tty_device_t,s0)
  /dev/slamr[0-9]+	-c	gen_context(system_u:object_r:tty_device_t,s0)
  /dev/tty		-c	gen_context(system_u:object_r:devtty_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.6.26/policy/modules/kernel/terminal.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.6.27/policy/modules/kernel/terminal.if
 --- nsaserefpolicy/policy/modules/kernel/terminal.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/terminal.if	2009-08-12 14:54:39.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/terminal.if	2009-08-14 16:51:06.000000000 -0400
 @@ -173,7 +173,7 @@
  
  	dev_list_all_dev_nodes($1)
@@ -5935,9 +6164,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ########################################
  ## <summary>
  ##	Read and write the controlling
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.6.26/policy/modules/kernel/terminal.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.6.27/policy/modules/kernel/terminal.te
 --- nsaserefpolicy/policy/modules/kernel/terminal.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/kernel/terminal.te	2009-08-11 14:33:58.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/kernel/terminal.te	2009-08-14 16:51:06.000000000 -0400
 @@ -44,6 +44,7 @@
  type ptmx_t;
  dev_node(ptmx_t)
@@ -5946,9 +6175,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  #
  # tty_device_t is the type of /dev/*tty*
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/guest.te serefpolicy-3.6.26/policy/modules/roles/guest.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/guest.te serefpolicy-3.6.27/policy/modules/roles/guest.te
 --- nsaserefpolicy/policy/modules/roles/guest.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/roles/guest.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/roles/guest.te	2009-08-14 16:51:06.000000000 -0400
 @@ -16,7 +16,11 @@
  #
  
@@ -5963,9 +6192,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 +
 +gen_user(guest_u, user, guest_r, s0, s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.te serefpolicy-3.6.26/policy/modules/roles/staff.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.te serefpolicy-3.6.27/policy/modules/roles/staff.te
 --- nsaserefpolicy/policy/modules/roles/staff.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/roles/staff.te	2009-08-07 06:42:40.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/roles/staff.te	2009-08-14 16:51:06.000000000 -0400
 @@ -15,156 +15,109 @@
  # Local policy
  #
@@ -6161,9 +6390,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -	xserver_role(staff_r, staff_t)
 +	virt_stream_connect(staff_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.te serefpolicy-3.6.26/policy/modules/roles/sysadm.te
---- nsaserefpolicy/policy/modules/roles/sysadm.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/roles/sysadm.te	2009-08-10 10:28:13.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.te serefpolicy-3.6.27/policy/modules/roles/sysadm.te
+--- nsaserefpolicy/policy/modules/roles/sysadm.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/roles/sysadm.te	2009-08-14 16:51:06.000000000 -0400
 @@ -15,7 +15,7 @@
  
  role sysadm_r;
@@ -6467,9 +6696,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +init_script_role_transition(sysadm_r)
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.fc serefpolicy-3.6.26/policy/modules/roles/unconfineduser.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.fc serefpolicy-3.6.27/policy/modules/roles/unconfineduser.fc
 --- nsaserefpolicy/policy/modules/roles/unconfineduser.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/roles/unconfineduser.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/roles/unconfineduser.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,37 @@
 +# Add programs here which should not be confined by SELinux
 +# e.g.:
@@ -6508,9 +6737,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +/opt/real/(.*/)?realplay\.bin --	gen_context(system_u:object_r:execmem_exec_t,s0)
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.if serefpolicy-3.6.26/policy/modules/roles/unconfineduser.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.if serefpolicy-3.6.27/policy/modules/roles/unconfineduser.if
 --- nsaserefpolicy/policy/modules/roles/unconfineduser.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/roles/unconfineduser.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/roles/unconfineduser.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,638 @@
 +## <summary>Unconfiend user role</summary>
 +
@@ -7150,9 +7379,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +	allow $1 unconfined_r;
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.6.26/policy/modules/roles/unconfineduser.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.6.27/policy/modules/roles/unconfineduser.te
 --- nsaserefpolicy/policy/modules/roles/unconfineduser.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/roles/unconfineduser.te	2009-08-06 07:58:58.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/roles/unconfineduser.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,395 @@
 +policy_module(unconfineduser, 1.0.0)
 +
@@ -7549,9 +7778,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +#
 +
 +gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unprivuser.te serefpolicy-3.6.26/policy/modules/roles/unprivuser.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unprivuser.te serefpolicy-3.6.27/policy/modules/roles/unprivuser.te
 --- nsaserefpolicy/policy/modules/roles/unprivuser.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/roles/unprivuser.te	2009-08-07 06:42:14.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/roles/unprivuser.te	2009-08-14 16:51:06.000000000 -0400
 @@ -14,142 +14,21 @@
  userdom_unpriv_user_template(user)
  
@@ -7700,19 +7929,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -	xserver_role(user_r, user_t)
 +	setroubleshoot_dontaudit_stream_connect(user_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/webadm.te serefpolicy-3.6.26/policy/modules/roles/webadm.te
---- nsaserefpolicy/policy/modules/roles/webadm.te	2009-07-28 15:51:13.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/roles/webadm.te	2009-07-30 15:33:08.000000000 -0400
-@@ -1,5 +1,5 @@
- 
--policy_module(webadm, 1.0.1)
-+policy_module(webadm, 1.0.0)
- 
- ########################################
- #
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/xguest.te serefpolicy-3.6.26/policy/modules/roles/xguest.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/xguest.te serefpolicy-3.6.27/policy/modules/roles/xguest.te
 --- nsaserefpolicy/policy/modules/roles/xguest.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/roles/xguest.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/roles/xguest.te	2009-08-14 16:51:06.000000000 -0400
 @@ -36,11 +36,17 @@
  # Local policy
  #
@@ -7759,9 +7978,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
 -#gen_user(xguest_u,, xguest_r, s0, s0)
 +gen_user(xguest_u, user, xguest_r, s0, s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.6.26/policy/modules/services/amavis.te
---- nsaserefpolicy/policy/modules/services/amavis.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/amavis.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.6.27/policy/modules/services/amavis.te
+--- nsaserefpolicy/policy/modules/services/amavis.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/amavis.te	2009-08-14 16:51:06.000000000 -0400
 @@ -103,6 +103,8 @@
  kernel_dontaudit_read_proc_symlinks(amavis_t)
  kernel_dontaudit_read_system_state(amavis_t)
@@ -7771,9 +7990,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # find perl
  corecmd_exec_bin(amavis_t)
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.6.26/policy/modules/services/apache.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.6.27/policy/modules/services/apache.fc
 --- nsaserefpolicy/policy/modules/services/apache.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/apache.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/apache.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,12 +1,13 @@
 -HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0)
 +HOME_DIR/((www)|(web)|(public_html)|(public_git))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0)
@@ -7867,9 +8086,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/var/www/svn(/.*)?			gen_context(system_u:object_r:httpd_sys_script_rw_t,s0)
 +/var/www/svn/hooks(/.*)?		gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
 +/var/www/svn/conf(/.*)?			gen_context(system_u:object_r:httpd_sys_content_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.6.26/policy/modules/services/apache.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.6.27/policy/modules/services/apache.if
 --- nsaserefpolicy/policy/modules/services/apache.if	2009-07-28 15:51:13.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/apache.if	2009-08-10 10:52:44.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/apache.if	2009-08-14 16:51:06.000000000 -0400
 @@ -13,21 +13,16 @@
  #
  template(`apache_content_template',`
@@ -8369,9 +8588,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	')
 +	typeattribute $1  httpd_rw_content;
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.6.26/policy/modules/services/apache.te
---- nsaserefpolicy/policy/modules/services/apache.te	2009-07-28 15:51:13.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/apache.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.6.27/policy/modules/services/apache.te
+--- nsaserefpolicy/policy/modules/services/apache.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/apache.te	2009-08-14 16:51:06.000000000 -0400
 @@ -19,6 +19,8 @@
  # Declarations
  #
@@ -9125,9 +9344,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +typealias httpd_sys_script_t      alias httpd_fastcgi_script_t;
 +typealias httpd_var_run_t         alias httpd_fastcgi_var_run_t;
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apm.te serefpolicy-3.6.26/policy/modules/services/apm.te
---- nsaserefpolicy/policy/modules/services/apm.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/apm.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apm.te serefpolicy-3.6.27/policy/modules/services/apm.te
+--- nsaserefpolicy/policy/modules/services/apm.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/apm.te	2009-08-14 16:51:06.000000000 -0400
 @@ -60,7 +60,7 @@
  # mknod: controlling an orderly resume of PCMCIA requires creating device
  # nodes 254,{0,1,2} for some reason.
@@ -9137,9 +9356,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow apmd_t self:process { signal_perms getsession };
  allow apmd_t self:fifo_file rw_fifo_file_perms;
  allow apmd_t self:unix_dgram_socket create_socket_perms;
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.6.26/policy/modules/services/automount.te
---- nsaserefpolicy/policy/modules/services/automount.te	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/automount.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.6.27/policy/modules/services/automount.te
+--- nsaserefpolicy/policy/modules/services/automount.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/automount.te	2009-08-14 16:51:06.000000000 -0400
 @@ -129,6 +129,7 @@
  fs_unmount_autofs(automount_t)
  fs_mount_autofs(automount_t)
@@ -9148,9 +9367,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  storage_rw_fuse(automount_t)
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.if serefpolicy-3.6.26/policy/modules/services/bind.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.if serefpolicy-3.6.27/policy/modules/services/bind.if
 --- nsaserefpolicy/policy/modules/services/bind.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/bind.if	2009-08-12 15:14:43.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/bind.if	2009-08-14 16:51:06.000000000 -0400
 @@ -287,6 +287,25 @@
  
  ########################################
@@ -9177,9 +9396,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	All of the rules required to administrate 
  ##	an bind environment
  ## </summary>
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.6.26/policy/modules/services/bluetooth.te
---- nsaserefpolicy/policy/modules/services/bluetooth.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/bluetooth.te	2009-08-03 06:30:22.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.6.27/policy/modules/services/bluetooth.te
+--- nsaserefpolicy/policy/modules/services/bluetooth.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/bluetooth.te	2009-08-14 16:51:06.000000000 -0400
 @@ -64,6 +64,7 @@
  allow bluetooth_t self:unix_stream_socket { connectto create_stream_socket_perms };
  allow bluetooth_t self:tcp_socket create_stream_socket_perms;
@@ -9207,9 +9426,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  		pulseaudio_dbus_chat(bluetooth_t)
  	')
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmaster.te serefpolicy-3.6.26/policy/modules/services/certmaster.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmaster.te serefpolicy-3.6.27/policy/modules/services/certmaster.te
 --- nsaserefpolicy/policy/modules/services/certmaster.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/certmaster.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/certmaster.te	2009-08-14 16:51:06.000000000 -0400
 @@ -30,7 +30,7 @@
  # certmaster local policy 
  #
@@ -9219,9 +9438,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow certmaster_t self:tcp_socket create_stream_socket_perms;
  
  # config files
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.6.26/policy/modules/services/clamav.te
---- nsaserefpolicy/policy/modules/services/clamav.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/clamav.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.6.27/policy/modules/services/clamav.te
+--- nsaserefpolicy/policy/modules/services/clamav.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/clamav.te	2009-08-14 16:51:06.000000000 -0400
 @@ -117,9 +117,9 @@
  
  logging_send_syslog_msg(clamd_t)
@@ -9256,9 +9475,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
  	apache_read_sys_content(clamscan_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.if serefpolicy-3.6.26/policy/modules/services/consolekit.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.if serefpolicy-3.6.27/policy/modules/services/consolekit.if
 --- nsaserefpolicy/policy/modules/services/consolekit.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/consolekit.if	2009-08-13 15:40:37.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/consolekit.if	2009-08-14 16:51:06.000000000 -0400
 @@ -57,3 +57,42 @@
  	read_files_pattern($1, consolekit_log_t, consolekit_log_t)
  	files_search_pids($1)
@@ -9302,9 +9521,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	read_files_pattern($1, consolekit_var_run_t, consolekit_var_run_t)
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.6.26/policy/modules/services/consolekit.te
---- nsaserefpolicy/policy/modules/services/consolekit.te	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/consolekit.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.6.27/policy/modules/services/consolekit.te
+--- nsaserefpolicy/policy/modules/services/consolekit.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/consolekit.te	2009-08-14 16:51:06.000000000 -0400
 @@ -62,12 +62,15 @@
  
  init_telinit(consolekit_t)
@@ -9363,9 +9582,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	unconfined_stream_connect(consolekit_t)
  ')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.if serefpolicy-3.6.26/policy/modules/services/courier.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.if serefpolicy-3.6.27/policy/modules/services/courier.if
 --- nsaserefpolicy/policy/modules/services/courier.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/courier.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/courier.if	2009-08-14 16:51:06.000000000 -0400
 @@ -179,6 +179,24 @@
  
  ########################################
@@ -9391,9 +9610,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	Read and write to courier spool pipes.
  ## </summary>
  ## <param name="domain">
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.6.26/policy/modules/services/courier.te
---- nsaserefpolicy/policy/modules/services/courier.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/courier.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.6.27/policy/modules/services/courier.te
+--- nsaserefpolicy/policy/modules/services/courier.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/courier.te	2009-08-14 16:51:06.000000000 -0400
 @@ -10,6 +10,7 @@
  
  type courier_etc_t;
@@ -9402,9 +9621,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  courier_domain_template(pcp)
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.6.26/policy/modules/services/cron.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.6.27/policy/modules/services/cron.fc
 --- nsaserefpolicy/policy/modules/services/cron.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/cron.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/cron.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,3 +1,4 @@
 +/etc/rc\.d/init\.d/atd		--	gen_context(system_u:object_r:crond_initrc_exec_t,s0)
  
@@ -9436,9 +9655,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/var/lib/glpi/files(/.*)?		gen_context(system_u:object_r:cron_var_lib_t,s0)
 +
 +/var/log/mcelog.*		--	gen_context(system_u:object_r:cron_log_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.6.26/policy/modules/services/cron.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.6.27/policy/modules/services/cron.if
 --- nsaserefpolicy/policy/modules/services/cron.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/cron.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/cron.if	2009-08-14 16:51:06.000000000 -0400
 @@ -12,6 +12,10 @@
  ## </param>
  #
@@ -9740,9 +9959,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	init_labeled_script_domtrans($1, crond_initrc_exec_t)
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.6.26/policy/modules/services/cron.te
---- nsaserefpolicy/policy/modules/services/cron.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/cron.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.6.27/policy/modules/services/cron.te
+--- nsaserefpolicy/policy/modules/services/cron.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/cron.te	2009-08-14 16:51:06.000000000 -0400
 @@ -38,6 +38,10 @@
  type cron_var_lib_t;
  files_type(cron_var_lib_t)
@@ -9784,7 +10003,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  type system_cronjob_lock_t alias system_crond_lock_t;
  files_lock_file(system_cronjob_lock_t)
-@@ -98,11 +109,18 @@
+@@ -95,15 +106,21 @@
+ 
+ type unconfined_cronjob_t;
+ domain_type(unconfined_cronjob_t)
+-domain_cron_exemption_target(unconfined_cronjob_t)
  
  # Type of user crontabs once moved to cron spool.
  type user_cron_spool_t, cron_spool_type;
@@ -9804,7 +10027,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ########################################
  #
  # Admin crontab local policy
-@@ -130,7 +148,7 @@
+@@ -131,7 +148,7 @@
  # Cron daemon local policy
  #
  
@@ -9813,7 +10036,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  dontaudit crond_t self:capability { sys_resource sys_tty_config };
  allow crond_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
  allow crond_t self:process { setexec setfscreate };
-@@ -146,20 +164,23 @@
+@@ -147,20 +164,23 @@
  allow crond_t self:msg { send receive };
  allow crond_t self:key { search write link };
  
@@ -9842,7 +10065,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  kernel_search_key(crond_t)
  
  dev_read_sysfs(crond_t)
-@@ -174,6 +195,7 @@
+@@ -175,6 +195,7 @@
  
  fs_getattr_all_fs(crond_t)
  fs_search_auto_mountpoints(crond_t)
@@ -9850,7 +10073,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  # need auth_chkpwd to check for locked accounts.
  auth_domtrans_chk_passwd(crond_t)
-@@ -183,7 +205,11 @@
+@@ -184,7 +205,11 @@
  corecmd_read_bin_symlinks(crond_t)
  
  domain_use_interactive_fds(crond_t)
@@ -9862,7 +10085,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  files_read_etc_files(crond_t)
  files_read_generic_spool(crond_t)
  files_list_usr(crond_t)
-@@ -192,10 +218,15 @@
+@@ -193,10 +218,15 @@
  files_search_default(crond_t)
  
  init_rw_utmp(crond_t)
@@ -9878,7 +10101,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  seutil_read_config(crond_t)
  seutil_read_default_contexts(crond_t)
-@@ -208,6 +239,7 @@
+@@ -209,6 +239,7 @@
  userdom_list_user_home_dirs(crond_t)
  
  mta_send_mail(crond_t)
@@ -9886,7 +10109,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  ifdef(`distro_debian',`
  	# pam_limits is used
-@@ -227,21 +259,45 @@
+@@ -228,21 +259,45 @@
  	')
  ')
  
@@ -9933,7 +10156,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -268,8 +324,8 @@
+@@ -269,8 +324,8 @@
  # System cron process domain
  #
  
@@ -9944,7 +10167,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow system_cronjob_t self:fifo_file rw_fifo_file_perms;
  allow system_cronjob_t self:passwd rootok;
  
-@@ -283,7 +339,14 @@
+@@ -284,7 +339,14 @@
  allow system_cronjob_t cron_var_lib_t:file manage_file_perms;
  files_var_lib_filetrans(system_cronjob_t, cron_var_lib_t, file)
  
@@ -9959,7 +10182,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # The entrypoint interface is not used as this is not
  # a regular entrypoint.  Since crontab files are
  # not directly executed, crond must ensure that
-@@ -303,6 +366,7 @@
+@@ -304,6 +366,7 @@
  allow system_cronjob_t crond_t:fd use;
  allow system_cronjob_t crond_t:fifo_file rw_file_perms;
  allow system_cronjob_t crond_t:process sigchld;
@@ -9967,7 +10190,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  # Write /var/lock/makewhatis.lock.
  allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
-@@ -314,9 +378,13 @@
+@@ -315,9 +378,13 @@
  filetrans_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t, { file lnk_file })
  files_tmp_filetrans(system_cronjob_t, system_cronjob_tmp_t, file)
  
@@ -9982,7 +10205,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  kernel_read_kernel_sysctls(system_cronjob_t)
  kernel_read_system_state(system_cronjob_t)
-@@ -370,7 +438,8 @@
+@@ -371,7 +438,8 @@
  init_read_utmp(system_cronjob_t)
  init_dontaudit_rw_utmp(system_cronjob_t)
  # prelink tells init to restart it self, we either need to allow or dontaudit
@@ -9992,7 +10215,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  auth_use_nsswitch(system_cronjob_t)
  
-@@ -378,6 +447,7 @@
+@@ -379,6 +447,7 @@
  libs_exec_ld_so(system_cronjob_t)
  
  logging_read_generic_logs(system_cronjob_t)
@@ -10000,7 +10223,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  logging_send_syslog_msg(system_cronjob_t)
  
  miscfiles_read_localization(system_cronjob_t)
-@@ -418,6 +488,10 @@
+@@ -419,6 +488,10 @@
  ')
  
  optional_policy(`
@@ -10011,7 +10234,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	ftp_read_log(system_cronjob_t)
  ')
  
-@@ -428,11 +502,20 @@
+@@ -429,11 +502,20 @@
  ')
  
  optional_policy(`
@@ -10032,7 +10255,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -444,9 +527,11 @@
+@@ -445,9 +527,11 @@
  ')	
  
  optional_policy(`
@@ -10046,7 +10269,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -460,8 +545,7 @@
+@@ -461,8 +545,7 @@
  ')
  
  optional_policy(`
@@ -10056,7 +10279,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -469,24 +553,17 @@
+@@ -470,24 +553,17 @@
  ')
  
  optional_policy(`
@@ -10084,7 +10307,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow cronjob_t self:process { signal_perms setsched };
  allow cronjob_t self:fifo_file rw_fifo_file_perms;
  allow cronjob_t self:unix_stream_socket create_stream_socket_perms;
-@@ -570,6 +647,9 @@
+@@ -571,6 +647,9 @@
  userdom_manage_user_home_content_sockets(cronjob_t)
  #userdom_user_home_dir_filetrans_user_home_content(cronjob_t, notdevfile_class_set)
  
@@ -10094,9 +10317,23 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  tunable_policy(`fcron_crond', `
  	allow crond_t user_cron_spool_t:file manage_file_perms;
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.6.26/policy/modules/services/cups.fc
+@@ -590,13 +669,5 @@
+ #
+ 
+ optional_policy(`
+-	# Permit a transition from the crond_t domain to this domain.
+-	# The transition is requested explicitly by the modified crond 
+-	# via setexeccon.  There is no way to set up an automatic
+-	# transition, since crontabs are configuration files, not executables.
+-	allow crond_t unconfined_cronjob_t:process transition;
+-	dontaudit crond_t unconfined_cronjob_t:process { noatsecure siginh rlimitinh };
+-	allow crond_t unconfined_cronjob_t:fd use;
+-
+ 	unconfined_domain(unconfined_cronjob_t)
+ ')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.6.27/policy/modules/services/cups.fc
 --- nsaserefpolicy/policy/modules/services/cups.fc	2009-07-28 15:51:13.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/cups.fc	2009-08-10 13:19:57.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/cups.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -13,10 +13,14 @@
  /etc/cups/certs/.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
  /etc/rc\.d/init\.d/cups	--	gen_context(system_u:object_r:cupsd_initrc_exec_t,s0)
@@ -10121,18 +10358,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /var/log/cups(/.*)?		gen_context(system_u:object_r:cupsd_log_t,s0)
  /var/log/turboprint.*		gen_context(system_u:object_r:cupsd_log_t,s0)
  
-@@ -62,3 +69,8 @@
+@@ -61,4 +67,10 @@
+ /var/run/hp.*\.port	--	gen_context(system_u:object_r:hplip_var_run_t,s0)
  /var/run/ptal-printd(/.*)?	gen_context(system_u:object_r:ptal_var_run_t,s0)
  /var/run/ptal-mlcd(/.*)?	gen_context(system_u:object_r:ptal_var_run_t,s0)
++/var/run/udev-configure-printer(/.*)? 	gen_context(system_u:object_r:cupsd_config_var_run_t,s0)
  /var/turboprint(/.*)?		gen_context(system_u:object_r:cupsd_var_run_t,s0)
 +
 +/usr/local/Brother/(.*/)?inf(/.*)?      gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 +/usr/local/Printer/(.*/)?inf(/.*)?      gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 +
 +/usr/local/linuxprinter/ppd(/.*)?      gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.6.26/policy/modules/services/cups.te
---- nsaserefpolicy/policy/modules/services/cups.te	2009-07-28 15:51:13.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/cups.te	2009-08-10 13:25:05.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.6.27/policy/modules/services/cups.te
+--- nsaserefpolicy/policy/modules/services/cups.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/cups.te	2009-08-14 16:51:06.000000000 -0400
 @@ -23,6 +23,9 @@
  type cupsd_initrc_exec_t;
  init_script_file(cupsd_initrc_exec_t)
@@ -10208,18 +10447,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  manage_fifo_files_pattern(hplip_t, hplip_tmp_t, hplip_tmp_t)
  files_tmp_filetrans(hplip_t, hplip_tmp_t, fifo_file )
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.6.26/policy/modules/services/cvs.te
---- nsaserefpolicy/policy/modules/services/cvs.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/cvs.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.6.27/policy/modules/services/cvs.te
+--- nsaserefpolicy/policy/modules/services/cvs.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/cvs.te	2009-08-14 16:51:06.000000000 -0400
 @@ -112,4 +112,5 @@
  	read_files_pattern(httpd_cvs_script_t, cvs_data_t, cvs_data_t)
  	manage_dirs_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
  	manage_files_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
 +	files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir })
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.26/policy/modules/services/dbus.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.27/policy/modules/services/dbus.if
 --- nsaserefpolicy/policy/modules/services/dbus.if	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/dbus.if	2009-08-12 16:08:16.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/dbus.if	2009-08-14 16:51:06.000000000 -0400
 @@ -42,8 +42,10 @@
  	gen_require(`
  		class dbus { send_msg acquire_svc };
@@ -10311,9 +10550,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	for service (acquire_svc).
  ## </summary>
  ## <param name="domain">
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.6.26/policy/modules/services/dbus.te
---- nsaserefpolicy/policy/modules/services/dbus.te	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/dbus.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.6.27/policy/modules/services/dbus.te
+--- nsaserefpolicy/policy/modules/services/dbus.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/dbus.te	2009-08-14 16:51:06.000000000 -0400
 @@ -86,6 +86,7 @@
  dev_read_sysfs(system_dbusd_t)
  
@@ -10366,9 +10605,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow dbusd_unconfined session_bus_type:dbus all_dbus_perms;
 +allow dbusd_unconfined dbusd_unconfined:dbus all_dbus_perms;
 +allow session_bus_type dbusd_unconfined:dbus send_msg;
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.te serefpolicy-3.6.26/policy/modules/services/dcc.te
---- nsaserefpolicy/policy/modules/services/dcc.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/dcc.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.te serefpolicy-3.6.27/policy/modules/services/dcc.te
+--- nsaserefpolicy/policy/modules/services/dcc.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/dcc.te	2009-08-14 16:51:06.000000000 -0400
 @@ -130,11 +130,13 @@
  
  # Access files in /var/dcc. The map file can be updated
@@ -10395,9 +10634,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	spamassassin_read_spamd_tmp_files(dcc_client_t)
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ddclient.if serefpolicy-3.6.26/policy/modules/services/ddclient.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ddclient.if serefpolicy-3.6.27/policy/modules/services/ddclient.if
 --- nsaserefpolicy/policy/modules/services/ddclient.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/ddclient.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/ddclient.if	2009-08-14 16:51:06.000000000 -0400
 @@ -21,6 +21,31 @@
  
  ########################################
@@ -10430,18 +10669,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	All of the rules required to administrate 
  ##	an ddclient environment
  ## </summary>
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.fc serefpolicy-3.6.26/policy/modules/services/devicekit.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.fc serefpolicy-3.6.27/policy/modules/services/devicekit.fc
 --- nsaserefpolicy/policy/modules/services/devicekit.fc	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/devicekit.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/devicekit.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -5,4 +5,4 @@
  /var/lib/DeviceKit-.*			gen_context(system_u:object_r:devicekit_var_lib_t,s0)
  
  /var/run/devkit(/.*)?			gen_context(system_u:object_r:devicekit_var_run_t,s0)
 -/var/run/DeviceKit-disk(/.*)?		gen_context(system_u:object_r:devicekit_var_run_t,s0)
 +/var/run/DeviceKit-disks(/.*)?		gen_context(system_u:object_r:devicekit_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.if serefpolicy-3.6.26/policy/modules/services/devicekit.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.if serefpolicy-3.6.27/policy/modules/services/devicekit.if
 --- nsaserefpolicy/policy/modules/services/devicekit.if	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/devicekit.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/devicekit.if	2009-08-14 16:51:06.000000000 -0400
 @@ -139,6 +139,26 @@
  
  ########################################
@@ -10478,9 +10717,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	')
  
  	allow $1 devicekit_t:process { ptrace signal_perms getattr };
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.26/policy/modules/services/devicekit.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.27/policy/modules/services/devicekit.te
 --- nsaserefpolicy/policy/modules/services/devicekit.te	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/devicekit.te	2009-08-13 09:46:15.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/devicekit.te	2009-08-14 16:51:06.000000000 -0400
 @@ -36,12 +36,15 @@
  manage_dirs_pattern(devicekit_t, devicekit_var_run_t, devicekit_var_run_t)
  manage_files_pattern(devicekit_t, devicekit_var_run_t, devicekit_var_run_t)
@@ -10654,9 +10893,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
  	vbetool_domtrans(devicekit_power_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.6.26/policy/modules/services/dnsmasq.te
---- nsaserefpolicy/policy/modules/services/dnsmasq.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/dnsmasq.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.6.27/policy/modules/services/dnsmasq.te
+--- nsaserefpolicy/policy/modules/services/dnsmasq.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/dnsmasq.te	2009-08-14 16:51:06.000000000 -0400
 @@ -83,6 +83,14 @@
  userdom_dontaudit_search_user_home_dirs(dnsmasq_t)
  
@@ -10672,9 +10911,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	seutil_sigchld_newrole(dnsmasq_t)
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.6.26/policy/modules/services/dovecot.te
---- nsaserefpolicy/policy/modules/services/dovecot.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/dovecot.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.6.27/policy/modules/services/dovecot.te
+--- nsaserefpolicy/policy/modules/services/dovecot.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/dovecot.te	2009-08-14 16:51:06.000000000 -0400
 @@ -103,6 +103,7 @@
  dev_read_urand(dovecot_t)
  
@@ -10699,9 +10938,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ########################################
  #
  # dovecot deliver local policy
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.6.26/policy/modules/services/exim.te
---- nsaserefpolicy/policy/modules/services/exim.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/exim.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.6.27/policy/modules/services/exim.te
+--- nsaserefpolicy/policy/modules/services/exim.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/exim.te	2009-08-14 16:51:06.000000000 -0400
 @@ -191,6 +191,10 @@
  ')
  
@@ -10713,9 +10952,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	spamassassin_exec(exim_t)
  	spamassassin_exec_client(exim_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetchmail.te serefpolicy-3.6.26/policy/modules/services/fetchmail.te
---- nsaserefpolicy/policy/modules/services/fetchmail.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/fetchmail.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetchmail.te serefpolicy-3.6.27/policy/modules/services/fetchmail.te
+--- nsaserefpolicy/policy/modules/services/fetchmail.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/fetchmail.te	2009-08-14 16:51:06.000000000 -0400
 @@ -47,6 +47,8 @@
  kernel_read_proc_symlinks(fetchmail_t)
  kernel_dontaudit_read_system_state(fetchmail_t)
@@ -10725,9 +10964,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  corenet_all_recvfrom_unlabeled(fetchmail_t)
  corenet_all_recvfrom_netlabel(fetchmail_t)
  corenet_tcp_sendrecv_generic_if(fetchmail_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fprintd.te serefpolicy-3.6.26/policy/modules/services/fprintd.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fprintd.te serefpolicy-3.6.27/policy/modules/services/fprintd.te
 --- nsaserefpolicy/policy/modules/services/fprintd.te	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/fprintd.te	2009-08-13 12:03:17.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/fprintd.te	2009-08-14 16:51:06.000000000 -0400
 @@ -37,6 +37,8 @@
  files_read_etc_files(fprintd_t)
  files_read_usr_files(fprintd_t)
@@ -10745,9 +10984,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	policykit_domtrans_auth(fprintd_t)
  ')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.6.26/policy/modules/services/ftp.te
---- nsaserefpolicy/policy/modules/services/ftp.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/ftp.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.6.27/policy/modules/services/ftp.te
+--- nsaserefpolicy/policy/modules/services/ftp.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/ftp.te	2009-08-14 16:51:06.000000000 -0400
 @@ -41,6 +41,13 @@
  
  ## <desc>
@@ -10849,16 +11088,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	seutil_sigchld_newrole(ftpd_t)
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.fc serefpolicy-3.6.26/policy/modules/services/gnomeclock.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.fc serefpolicy-3.6.27/policy/modules/services/gnomeclock.fc
 --- nsaserefpolicy/policy/modules/services/gnomeclock.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/gnomeclock.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/gnomeclock.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,3 @@
 +
 +/usr/libexec/gnome-clock-applet-mechanism	--	gen_context(system_u:object_r:gnomeclock_exec_t,s0)
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.if serefpolicy-3.6.26/policy/modules/services/gnomeclock.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.if serefpolicy-3.6.27/policy/modules/services/gnomeclock.if
 --- nsaserefpolicy/policy/modules/services/gnomeclock.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/gnomeclock.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/gnomeclock.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,69 @@
 +
 +## <summary>policy for gnomeclock</summary>
@@ -10929,9 +11168,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	allow $1 gnomeclock_t:dbus send_msg;
 +	allow gnomeclock_t $1:dbus send_msg;
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.te serefpolicy-3.6.26/policy/modules/services/gnomeclock.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.te serefpolicy-3.6.27/policy/modules/services/gnomeclock.te
 --- nsaserefpolicy/policy/modules/services/gnomeclock.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/gnomeclock.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/gnomeclock.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,50 @@
 +policy_module(gnomeclock, 1.0.0)
 +########################################
@@ -10983,9 +11222,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	policykit_read_reload(gnomeclock_t)
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.fc serefpolicy-3.6.26/policy/modules/services/gpsd.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.fc serefpolicy-3.6.27/policy/modules/services/gpsd.fc
 --- nsaserefpolicy/policy/modules/services/gpsd.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/gpsd.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/gpsd.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1 +1,6 @@
 +/etc/rc\.d/init\.d/gpsd         --      gen_context(system_u:object_r:gpsd_initrc_exec_t,s0)
 +
@@ -10993,9 +11232,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +/var/run/gpsd\.pid               --      gen_context(system_u:object_r:gpsd_var_run_t,s0)
 +/var/run/gpsd\.sock              -s      gen_context(system_u:object_r:gpsd_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.if serefpolicy-3.6.26/policy/modules/services/gpsd.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.if serefpolicy-3.6.27/policy/modules/services/gpsd.if
 --- nsaserefpolicy/policy/modules/services/gpsd.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/gpsd.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/gpsd.if	2009-08-14 16:51:06.000000000 -0400
 @@ -33,11 +33,6 @@
  ##	The role to be allowed the gpsd domain.
  ##	</summary>
@@ -11041,9 +11280,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +        rw_files_pattern($1, gpsd_tmpfs_t, gpsd_tmpfs_t)
 +        read_lnk_files_pattern($1, gpsd_tmpfs_t, gpsd_tmpfs_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.te serefpolicy-3.6.26/policy/modules/services/gpsd.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.te serefpolicy-3.6.27/policy/modules/services/gpsd.te
 --- nsaserefpolicy/policy/modules/services/gpsd.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/gpsd.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/gpsd.te	2009-08-14 16:51:06.000000000 -0400
 @@ -11,9 +11,15 @@
  application_domain(gpsd_t, gpsd_exec_t)
  init_daemon_domain(gpsd_t, gpsd_exec_t)
@@ -11078,9 +11317,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -	ntpd_rw_shm(gpsd_t)
 +	ntp_rw_shm(gpsd_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.6.26/policy/modules/services/hal.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.6.27/policy/modules/services/hal.fc
 --- nsaserefpolicy/policy/modules/services/hal.fc	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/hal.fc	2009-08-06 08:14:20.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/hal.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -26,6 +26,7 @@
  /var/run/pm(/.*)?				gen_context(system_u:object_r:hald_var_run_t,s0)
  /var/run/pm-utils(/.*)?				gen_context(system_u:object_r:hald_var_run_t,s0)
@@ -11089,9 +11328,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  ifdef(`distro_gentoo',`
  /var/lib/cache/hald(/.*)?			gen_context(system_u:object_r:hald_cache_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.6.26/policy/modules/services/hal.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.6.27/policy/modules/services/hal.if
 --- nsaserefpolicy/policy/modules/services/hal.if	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/hal.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/hal.if	2009-08-14 16:51:06.000000000 -0400
 @@ -413,3 +413,21 @@
  	files_search_pids($1)
  	manage_files_pattern($1, hald_var_run_t, hald_var_run_t)
@@ -11114,9 +11353,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +	dontaudit $1 hald_t:unix_dgram_socket { read write };
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.6.26/policy/modules/services/hal.te
---- nsaserefpolicy/policy/modules/services/hal.te	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/hal.te	2009-08-13 12:00:48.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.6.27/policy/modules/services/hal.te
+--- nsaserefpolicy/policy/modules/services/hal.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/hal.te	2009-08-14 16:51:06.000000000 -0400
 @@ -55,6 +55,9 @@
  type hald_var_lib_t;
  files_type(hald_var_lib_t)
@@ -11260,17 +11499,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
 +	dbus_system_bus_client(hald_dccm_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hddtemp.fc serefpolicy-3.6.26/policy/modules/services/hddtemp.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hddtemp.fc serefpolicy-3.6.27/policy/modules/services/hddtemp.fc
 --- nsaserefpolicy/policy/modules/services/hddtemp.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/hddtemp.fc	2009-08-11 14:24:37.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/hddtemp.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,4 @@
 +
 +/etc/rc\.d/init\.d/hddtemp      --      gen_context(system_u:object_r:hddtemp_initrc_exec_t,s0)
 +
 +/usr/sbin/hddtemp             	--      gen_context(system_u:object_r:hddtemp_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hddtemp.if serefpolicy-3.6.26/policy/modules/services/hddtemp.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hddtemp.if serefpolicy-3.6.27/policy/modules/services/hddtemp.if
 --- nsaserefpolicy/policy/modules/services/hddtemp.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/hddtemp.if	2009-08-11 14:26:32.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/hddtemp.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,38 @@
 +## <summary>hddtemp hard disk temperature tool running as a daemon</summary>
 +
@@ -11310,9 +11549,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +        can_exec($1, hddtemp_exec_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hddtemp.te serefpolicy-3.6.26/policy/modules/services/hddtemp.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hddtemp.te serefpolicy-3.6.27/policy/modules/services/hddtemp.te
 --- nsaserefpolicy/policy/modules/services/hddtemp.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/hddtemp.te	2009-08-11 14:24:37.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/hddtemp.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,40 @@
 +policy_module(hddtemp,1.0.0)
 +
@@ -11354,9 +11593,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +permissive hddtemp_t;
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.6.26/policy/modules/services/kerberos.te
---- nsaserefpolicy/policy/modules/services/kerberos.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/kerberos.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.6.27/policy/modules/services/kerberos.te
+--- nsaserefpolicy/policy/modules/services/kerberos.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/kerberos.te	2009-08-14 16:51:06.000000000 -0400
 @@ -277,6 +277,8 @@
  #
  
@@ -11396,9 +11635,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  sysnet_dns_name_resolve(kpropd_t)
  
  kerberos_use(kpropd_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ktalk.te serefpolicy-3.6.26/policy/modules/services/ktalk.te
---- nsaserefpolicy/policy/modules/services/ktalk.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/ktalk.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ktalk.te serefpolicy-3.6.27/policy/modules/services/ktalk.te
+--- nsaserefpolicy/policy/modules/services/ktalk.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/ktalk.te	2009-08-14 16:51:06.000000000 -0400
 @@ -69,6 +69,7 @@
  files_read_etc_files(ktalkd_t)
  
@@ -11407,9 +11646,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  auth_use_nsswitch(ktalkd_t)
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lircd.te serefpolicy-3.6.26/policy/modules/services/lircd.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lircd.te serefpolicy-3.6.27/policy/modules/services/lircd.te
 --- nsaserefpolicy/policy/modules/services/lircd.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/lircd.te	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/lircd.te	2009-08-14 16:51:06.000000000 -0400
 @@ -42,7 +42,18 @@
  # /dev/lircd socket
  manage_sock_files_pattern(lircd_t, lircd_sock_t, lircd_sock_t)
@@ -11429,9 +11668,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
  miscfiles_read_localization(lircd_t)
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.6.26/policy/modules/services/mailman.te
---- nsaserefpolicy/policy/modules/services/mailman.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/mailman.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.6.27/policy/modules/services/mailman.te
+--- nsaserefpolicy/policy/modules/services/mailman.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/mailman.te	2009-08-14 16:51:06.000000000 -0400
 @@ -78,6 +78,10 @@
  mta_dontaudit_rw_queue(mailman_mail_t)
  
@@ -11443,9 +11682,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	cron_read_pipes(mailman_mail_t)
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/memcached.te serefpolicy-3.6.26/policy/modules/services/memcached.te
---- nsaserefpolicy/policy/modules/services/memcached.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/memcached.te	2009-07-30 15:33:08.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/memcached.te serefpolicy-3.6.27/policy/modules/services/memcached.te
+--- nsaserefpolicy/policy/modules/services/memcached.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/memcached.te	2009-08-14 16:51:06.000000000 -0400
 @@ -44,6 +44,8 @@
  
  files_read_etc_files(memcached_t)
@@ -11455,15 +11694,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  miscfiles_read_localization(memcached_t)
  
  sysnet_dns_name_resolve(memcached_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.fc serefpolicy-3.6.26/policy/modules/services/modemmanager.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.fc serefpolicy-3.6.27/policy/modules/services/modemmanager.fc
 --- nsaserefpolicy/policy/modules/services/modemmanager.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/modemmanager.fc	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/modemmanager.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,2 @@
 +
 +/usr/sbin/modem-manager	--	gen_context(system_u:object_r:ModemManager_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.if serefpolicy-3.6.26/policy/modules/services/modemmanager.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.if serefpolicy-3.6.27/policy/modules/services/modemmanager.if
 --- nsaserefpolicy/policy/modules/services/modemmanager.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/modemmanager.if	2009-07-30 15:33:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/modemmanager.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,43 @@
 +
 +## <summary>policy for ModemManager</summary>
@@ -11508,9 +11747,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	allow $1 ModemManager_t:dbus send_msg;
 +	allow ModemManager_t $1:dbus send_msg;
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.te serefpolicy-3.6.26/policy/modules/services/modemmanager.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.te serefpolicy-3.6.27/policy/modules/services/modemmanager.te
 --- nsaserefpolicy/policy/modules/services/modemmanager.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/modemmanager.te	2009-08-05 15:31:50.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/modemmanager.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,46 @@
 +policy_module(ModemManager,1.0.0)
 +
@@ -11558,18 +11797,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 +
 +permissive ModemManager_t;
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.6.26/policy/modules/services/mta.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.6.27/policy/modules/services/mta.fc
 --- nsaserefpolicy/policy/modules/services/mta.fc	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/mta.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/mta.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -26,3 +26,5 @@
  /var/spool/imap(/.*)?		gen_context(system_u:object_r:mail_spool_t,s0)
  /var/spool/(client)?mqueue(/.*)? gen_context(system_u:object_r:mqueue_spool_t,s0)
  /var/spool/mail(/.*)?		gen_context(system_u:object_r:mail_spool_t,s0)
 +HOME_DIR/\.forward	--	gen_context(system_u:object_r:mail_forward_t,s0)
 +/root/\.forward		--	gen_context(system_u:object_r:mail_forward_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.6.26/policy/modules/services/mta.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.6.27/policy/modules/services/mta.if
 --- nsaserefpolicy/policy/modules/services/mta.if	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/mta.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/mta.if	2009-08-14 16:51:06.000000000 -0400
 @@ -311,6 +311,7 @@
  	allow $1 mail_spool_t:dir list_dir_perms;
  	create_files_pattern($1, mail_spool_t, mail_spool_t)
@@ -11603,9 +11842,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	read_lnk_files_pattern($1, mail_spool_t, mail_spool_t)
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.6.26/policy/modules/services/mta.te
---- nsaserefpolicy/policy/modules/services/mta.te	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/mta.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.6.27/policy/modules/services/mta.te
+--- nsaserefpolicy/policy/modules/services/mta.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/mta.te	2009-08-14 16:51:06.000000000 -0400
 @@ -27,6 +27,9 @@
  type mail_spool_t;
  files_mountpoint(mail_spool_t)
@@ -11719,9 +11958,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ########################################
  #
  # User send mail local policy
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.fc serefpolicy-3.6.26/policy/modules/services/munin.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.fc serefpolicy-3.6.27/policy/modules/services/munin.fc
 --- nsaserefpolicy/policy/modules/services/munin.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/munin.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/munin.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -9,3 +9,6 @@
  /var/lib/munin(/.*)?			gen_context(system_u:object_r:munin_var_lib_t,s0)
  /var/log/munin.*			gen_context(system_u:object_r:munin_log_t,s0)
@@ -11729,9 +11968,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/var/www/html/munin(/.*)?		gen_context(system_u:object_r:httpd_munin_content_t,s0)
 +/var/www/html/munin/cgi(/.*)?		gen_context(system_u:object_r:httpd_munin_script_exec_t,s0)
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.te serefpolicy-3.6.26/policy/modules/services/munin.te
---- nsaserefpolicy/policy/modules/services/munin.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/munin.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.te serefpolicy-3.6.27/policy/modules/services/munin.te
+--- nsaserefpolicy/policy/modules/services/munin.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/munin.te	2009-08-14 16:51:06.000000000 -0400
 @@ -33,7 +33,7 @@
  # Local policy
  #
@@ -11749,9 +11988,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.6.26/policy/modules/services/mysql.te
---- nsaserefpolicy/policy/modules/services/mysql.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/mysql.te	2009-08-03 08:06:57.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.6.27/policy/modules/services/mysql.te
+--- nsaserefpolicy/policy/modules/services/mysql.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/mysql.te	2009-08-14 16:51:06.000000000 -0400
 @@ -136,7 +136,12 @@
  
  domtrans_pattern(mysqld_safe_t, mysqld_exec_t, mysqld_t)
@@ -11774,9 +12013,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  mysql_read_config(mysqld_safe_t)
  mysql_search_pid_files(mysqld_safe_t)
  mysql_write_log(mysqld_safe_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.6.26/policy/modules/services/nagios.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.6.27/policy/modules/services/nagios.fc
 --- nsaserefpolicy/policy/modules/services/nagios.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/nagios.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/nagios.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,16 +1,21 @@
  /etc/nagios(/.*)?			gen_context(system_u:object_r:nagios_etc_t,s0)
  /etc/nagios/nrpe\.cfg		--	gen_context(system_u:object_r:nrpe_etc_t,s0)
@@ -11802,9 +12041,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
 +/usr/lib(64)?/cgi-bin/nagios(/.+)?	gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0)
 +/usr/lib(64)?/nagios/cgi-bin(/.*)?	gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.6.26/policy/modules/services/nagios.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.6.27/policy/modules/services/nagios.if
 --- nsaserefpolicy/policy/modules/services/nagios.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/nagios.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/nagios.if	2009-08-14 16:51:06.000000000 -0400
 @@ -64,7 +64,7 @@
  
  ########################################
@@ -11904,9 +12143,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +	admin_pattern($1, nrpe_etc_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.6.26/policy/modules/services/nagios.te
---- nsaserefpolicy/policy/modules/services/nagios.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/nagios.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.6.27/policy/modules/services/nagios.te
+--- nsaserefpolicy/policy/modules/services/nagios.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/nagios.te	2009-08-14 16:51:06.000000000 -0400
 @@ -10,13 +10,12 @@
  type nagios_exec_t;
  init_daemon_domain(nagios_t, nagios_exec_t)
@@ -12002,9 +12241,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  ########################################
  #
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.6.26/policy/modules/services/networkmanager.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.6.27/policy/modules/services/networkmanager.fc
 --- nsaserefpolicy/policy/modules/services/networkmanager.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/networkmanager.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/networkmanager.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,12 +1,25 @@
 +/etc/rc\.d/init\.d/wicd		--	gen_context(system_u:object_r:NetworkManager_initrc_exec_t, s0)
 +/etc/NetworkManager/dispatcher\.d(/.*)	gen_context(system_u:object_r:NetworkManager_initrc_exec_t,s0)
@@ -12031,9 +12270,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /var/run/wpa_supplicant-global	-s	gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
 +/var/run/nm-dhclient.*			gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.6.26/policy/modules/services/networkmanager.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.6.27/policy/modules/services/networkmanager.if
 --- nsaserefpolicy/policy/modules/services/networkmanager.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/networkmanager.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/networkmanager.if	2009-08-14 16:51:06.000000000 -0400
 @@ -118,6 +118,24 @@
  
  ########################################
@@ -12090,9 +12329,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	role $2 types NetworkManager_t;
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.6.26/policy/modules/services/networkmanager.te
---- nsaserefpolicy/policy/modules/services/networkmanager.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/networkmanager.te	2009-08-10 11:32:36.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.6.27/policy/modules/services/networkmanager.te
+--- nsaserefpolicy/policy/modules/services/networkmanager.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/networkmanager.te	2009-08-14 16:51:06.000000000 -0400
 @@ -19,6 +19,9 @@
  type NetworkManager_tmp_t;
  files_tmp_file(NetworkManager_tmp_t)
@@ -12330,9 +12569,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  ########################################
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.6.26/policy/modules/services/nis.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.6.27/policy/modules/services/nis.fc
 --- nsaserefpolicy/policy/modules/services/nis.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/nis.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/nis.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,4 +1,7 @@
 -
 +/etc/rc\.d/init\.d/ypbind	--	gen_context(system_u:object_r:ypbind_initrc_exec_t,s0)
@@ -12342,9 +12581,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /etc/ypserv\.conf	--	gen_context(system_u:object_r:ypserv_conf_t,s0)
  
  /sbin/ypbind		--	gen_context(system_u:object_r:ypbind_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.6.26/policy/modules/services/nis.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.6.27/policy/modules/services/nis.if
 --- nsaserefpolicy/policy/modules/services/nis.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/nis.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/nis.if	2009-08-14 16:51:06.000000000 -0400
 @@ -28,7 +28,7 @@
  		type var_yp_t;
  	')
@@ -12486,9 +12725,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	role $2 types ypbind_t;
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.6.26/policy/modules/services/nis.te
---- nsaserefpolicy/policy/modules/services/nis.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/nis.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.6.27/policy/modules/services/nis.te
+--- nsaserefpolicy/policy/modules/services/nis.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/nis.te	2009-08-14 16:51:06.000000000 -0400
 @@ -13,6 +13,9 @@
  type ypbind_exec_t;
  init_daemon_domain(ypbind_t, ypbind_exec_t)
@@ -12538,9 +12777,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  corenet_tcp_bind_all_rpc_ports(ypxfr_t)
  corenet_udp_bind_all_rpc_ports(ypxfr_t)
  corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.6.26/policy/modules/services/nscd.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.6.27/policy/modules/services/nscd.if
 --- nsaserefpolicy/policy/modules/services/nscd.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/nscd.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/nscd.if	2009-08-14 16:51:06.000000000 -0400
 @@ -236,6 +236,24 @@
  
  ########################################
@@ -12566,9 +12805,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	All of the rules required to administrate 
  ##	an nscd environment
  ## </summary>
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.6.26/policy/modules/services/nscd.te
---- nsaserefpolicy/policy/modules/services/nscd.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/nscd.te	2009-07-31 07:01:44.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.6.27/policy/modules/services/nscd.te
+--- nsaserefpolicy/policy/modules/services/nscd.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/nscd.te	2009-08-14 16:51:06.000000000 -0400
 @@ -65,6 +65,7 @@
  
  fs_getattr_all_fs(nscd_t)
@@ -12598,17 +12837,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	samba_read_config(nscd_t)
 +	samba_read_var_files(nscd_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nslcd.fc serefpolicy-3.6.26/policy/modules/services/nslcd.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nslcd.fc serefpolicy-3.6.27/policy/modules/services/nslcd.fc
 --- nsaserefpolicy/policy/modules/services/nslcd.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/nslcd.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/nslcd.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,4 @@
 +/usr/sbin/nslcd	--	gen_context(system_u:object_r:nslcd_exec_t,s0)
 +/etc/nss-ldapd.conf	--	gen_context(system_u:object_r:nslcd_conf_t,s0)
 +/etc/rc\.d/init\.d/nslcd	--	gen_context(system_u:object_r:nslcd_initrc_exec_t,s0)
 +/var/run/nslcd(/.*)?			gen_context(system_u:object_r:nslcd_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nslcd.if serefpolicy-3.6.26/policy/modules/services/nslcd.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nslcd.if serefpolicy-3.6.27/policy/modules/services/nslcd.if
 --- nsaserefpolicy/policy/modules/services/nslcd.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/nslcd.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/nslcd.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,142 @@
 +
 +## <summary>policy for nslcd</summary>
@@ -12752,9 +12991,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	nslcd_manage_var_run($1)
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nslcd.te serefpolicy-3.6.26/policy/modules/services/nslcd.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nslcd.te serefpolicy-3.6.27/policy/modules/services/nslcd.te
 --- nsaserefpolicy/policy/modules/services/nslcd.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/nslcd.te	2009-08-13 09:51:48.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/nslcd.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,48 @@
 +policy_module(nslcd,1.0.0)
 +
@@ -12804,9 +13043,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +auth_use_nsswitch(nslcd_t)
 +
 +logging_send_syslog_msg(nslcd_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.if serefpolicy-3.6.26/policy/modules/services/ntp.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.if serefpolicy-3.6.27/policy/modules/services/ntp.if
 --- nsaserefpolicy/policy/modules/services/ntp.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/ntp.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/ntp.if	2009-08-14 16:51:06.000000000 -0400
 @@ -37,6 +37,32 @@
  
  ########################################
@@ -12874,9 +13113,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	All of the rules required to administrate 
  ##	an ntp environment
  ## </summary>
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.6.26/policy/modules/services/ntp.te
---- nsaserefpolicy/policy/modules/services/ntp.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/ntp.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.6.27/policy/modules/services/ntp.te
+--- nsaserefpolicy/policy/modules/services/ntp.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/ntp.te	2009-08-14 16:51:06.000000000 -0400
 @@ -41,10 +41,11 @@
  
  # sys_resource and setrlimit is for locking memory
@@ -12915,9 +13154,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.te serefpolicy-3.6.26/policy/modules/services/nx.te
---- nsaserefpolicy/policy/modules/services/nx.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/nx.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.te serefpolicy-3.6.27/policy/modules/services/nx.te
+--- nsaserefpolicy/policy/modules/services/nx.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/nx.te	2009-08-14 16:51:06.000000000 -0400
 @@ -25,6 +25,9 @@
  type nx_server_var_run_t;
  files_pid_file(nx_server_var_run_t)
@@ -12938,9 +13177,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  kernel_read_system_state(nx_server_t)
  kernel_read_kernel_sysctls(nx_server_t)
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.if serefpolicy-3.6.26/policy/modules/services/oddjob.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.if serefpolicy-3.6.27/policy/modules/services/oddjob.if
 --- nsaserefpolicy/policy/modules/services/oddjob.if	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/oddjob.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/oddjob.if	2009-08-14 16:51:06.000000000 -0400
 @@ -44,6 +44,7 @@
  	')
  
@@ -12949,9 +13188,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  ########################################
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.6.26/policy/modules/services/openvpn.te
---- nsaserefpolicy/policy/modules/services/openvpn.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/openvpn.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.6.27/policy/modules/services/openvpn.te
+--- nsaserefpolicy/policy/modules/services/openvpn.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/openvpn.te	2009-08-14 16:51:06.000000000 -0400
 @@ -86,6 +86,7 @@
  corenet_udp_bind_openvpn_port(openvpn_t)
  corenet_tcp_connect_openvpn_port(openvpn_t)
@@ -12960,9 +13199,26 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  corenet_rw_tun_tap_dev(openvpn_t)
  corenet_sendrecv_openvpn_server_packets(openvpn_t)
  corenet_sendrecv_openvpn_client_packets(openvpn_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-3.6.26/policy/modules/services/pcscd.te
---- nsaserefpolicy/policy/modules/services/pcscd.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/pcscd.te	2009-07-30 15:33:09.000000000 -0400
+@@ -114,6 +115,16 @@
+ 	userdom_read_user_home_content_files(openvpn_t)
+ ')
+ 
++tunable_policy(`openvpn_enable_homedirs && use_nfs_home_dirs',`
++        fs_read_nfs_files(openvpn_t)
++        fs_read_nfs_symlinks(openvpn_t)
++')  
++
++tunable_policy(`openvpn_enable_homedirs && use_samba_home_dirs',`
++        fs_read_cifs_files(openvpn_t)
++        fs_read_cifs_symlinks(openvpn_t)
++')  
++
+ optional_policy(`
+ 	daemontools_service_domain(openvpn_t, openvpn_exec_t)
+ ')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-3.6.27/policy/modules/services/pcscd.te
+--- nsaserefpolicy/policy/modules/services/pcscd.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/pcscd.te	2009-08-14 16:51:06.000000000 -0400
 @@ -29,6 +29,7 @@
  
  manage_dirs_pattern(pcscd_t, pcscd_var_run_t, pcscd_var_run_t)
@@ -12980,9 +13236,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  term_use_unallocated_ttys(pcscd_t)
  term_dontaudit_getattr_pty_dirs(pcscd_t)
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.6.26/policy/modules/services/pegasus.te
---- nsaserefpolicy/policy/modules/services/pegasus.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/pegasus.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.6.27/policy/modules/services/pegasus.te
+--- nsaserefpolicy/policy/modules/services/pegasus.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/pegasus.te	2009-08-14 16:51:06.000000000 -0400
 @@ -30,7 +30,7 @@
  # Local policy
  #
@@ -13054,9 +13310,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	xen_stream_connect(pegasus_t)
 +	xen_stream_connect_xenstore(pegasus_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.fc serefpolicy-3.6.26/policy/modules/services/policykit.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.fc serefpolicy-3.6.27/policy/modules/services/policykit.fc
 --- nsaserefpolicy/policy/modules/services/policykit.fc	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/policykit.fc	2009-08-13 15:56:23.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/policykit.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,10 +1,13 @@
  /usr/libexec/polkit-read-auth-helper	--	gen_context(system_u:object_r:policykit_auth_exec_t,s0)
  /usr/libexec/polkit-grant-helper.*	--	gen_context(system_u:object_r:policykit_grant_exec_t,s0)
@@ -13072,9 +13328,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /var/lib/PolicyKit-public(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
  /var/run/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_run_t,s0)
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.if serefpolicy-3.6.26/policy/modules/services/policykit.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.if serefpolicy-3.6.27/policy/modules/services/policykit.if
 --- nsaserefpolicy/policy/modules/services/policykit.if	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/policykit.if	2009-08-03 06:44:10.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/policykit.if	2009-08-14 16:51:06.000000000 -0400
 @@ -17,6 +17,8 @@
  		class dbus send_msg;
  	')
@@ -13149,9 +13405,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +	allow $1 policykit_auth_t:process signal;
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.6.26/policy/modules/services/policykit.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.6.27/policy/modules/services/policykit.te
 --- nsaserefpolicy/policy/modules/services/policykit.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/policykit.te	2009-08-11 14:14:45.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/policykit.te	2009-08-14 16:51:06.000000000 -0400
 @@ -38,9 +38,10 @@
  
  allow policykit_t self:capability { setgid setuid };
@@ -13279,9 +13535,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow policykit_resolve_t self:unix_dgram_socket create_socket_perms;
  allow policykit_resolve_t self:unix_stream_socket create_stream_socket_perms;
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.6.26/policy/modules/services/postfix.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.6.27/policy/modules/services/postfix.fc
 --- nsaserefpolicy/policy/modules/services/postfix.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/postfix.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/postfix.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -29,12 +29,10 @@
  /usr/lib/postfix/smtpd	--	gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
  /usr/lib/postfix/bounce	--	gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
@@ -13295,9 +13551,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /usr/sbin/postdrop	--	gen_context(system_u:object_r:postfix_postdrop_exec_t,s0)
  /usr/sbin/postfix	--	gen_context(system_u:object_r:postfix_master_exec_t,s0)
  /usr/sbin/postkick	--	gen_context(system_u:object_r:postfix_master_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.6.26/policy/modules/services/postfix.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.6.27/policy/modules/services/postfix.if
 --- nsaserefpolicy/policy/modules/services/postfix.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/postfix.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/postfix.if	2009-08-14 16:51:06.000000000 -0400
 @@ -46,6 +46,7 @@
  
  	allow postfix_$1_t postfix_etc_t:dir list_dir_perms;
@@ -13544,10 +13800,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	role $2 types postfix_postdrop_t;
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.6.26/policy/modules/services/postfix.te
---- nsaserefpolicy/policy/modules/services/postfix.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/postfix.te	2009-07-30 15:33:09.000000000 -0400
-@@ -6,6 +6,15 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.6.27/policy/modules/services/postfix.te
+--- nsaserefpolicy/policy/modules/services/postfix.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/postfix.te	2009-08-14 16:51:06.000000000 -0400
+@@ -1,11 +1,20 @@
+ 
+-policy_module(postfix, 1.11.0)
++policy_module(postfix, 1.10.3)
+ 
+ ########################################
+ #
  # Declarations
  #
  
@@ -13926,9 +14188,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +userdom_manage_user_home_content(postfix_virtual_t)
 +userdom_home_filetrans_user_home_dir(postfix_virtual_t)
 +userdom_user_home_dir_filetrans_user_home_content(postfix_virtual_t, {file dir })
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.fc serefpolicy-3.6.26/policy/modules/services/postgresql.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.fc serefpolicy-3.6.27/policy/modules/services/postgresql.fc
 --- nsaserefpolicy/policy/modules/services/postgresql.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/postgresql.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/postgresql.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -2,6 +2,7 @@
  # /etc
  #
@@ -13937,9 +14199,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  #
  # /usr
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.6.26/policy/modules/services/postgresql.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.6.27/policy/modules/services/postgresql.if
 --- nsaserefpolicy/policy/modules/services/postgresql.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/postgresql.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/postgresql.if	2009-08-14 16:51:06.000000000 -0400
 @@ -384,3 +384,46 @@
  
  	typeattribute $1 sepgsql_unconfined_type;
@@ -13987,9 +14249,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +	admin_pattern($1, postgresql_tmp_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.6.26/policy/modules/services/postgresql.te
---- nsaserefpolicy/policy/modules/services/postgresql.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/postgresql.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.6.27/policy/modules/services/postgresql.te
+--- nsaserefpolicy/policy/modules/services/postgresql.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/postgresql.te	2009-08-14 16:51:06.000000000 -0400
 @@ -32,6 +32,9 @@
  type postgresql_etc_t;
  files_config_file(postgresql_etc_t)
@@ -14028,9 +14290,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  miscfiles_read_localization(postgresql_t)
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.if serefpolicy-3.6.26/policy/modules/services/ppp.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.if serefpolicy-3.6.27/policy/modules/services/ppp.if
 --- nsaserefpolicy/policy/modules/services/ppp.if	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/ppp.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/ppp.if	2009-08-14 16:51:06.000000000 -0400
 @@ -177,10 +177,16 @@
  interface(`ppp_run',`
  	gen_require(`
@@ -14048,9 +14310,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  ########################################
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.6.26/policy/modules/services/ppp.te
---- nsaserefpolicy/policy/modules/services/ppp.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/ppp.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.6.27/policy/modules/services/ppp.te
+--- nsaserefpolicy/policy/modules/services/ppp.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/ppp.te	2009-08-14 16:51:06.000000000 -0400
 @@ -193,6 +193,8 @@
  
  optional_policy(`
@@ -14060,20 +14322,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -268,11 +270,11 @@
- corenet_tcp_connect_all_reserved_ports(pptp_t)
- corenet_sendrecv_generic_client_packets(pptp_t)
- 
--files_read_etc_files(pptp_t)
--
- fs_getattr_all_fs(pptp_t)
- fs_search_auto_mountpoints(pptp_t)
- 
-+files_read_etc_files(pptp_t)
-+
- term_ioctl_generic_ptys(pptp_t)
- term_search_ptys(pptp_t)
- term_use_ptmx(pptp_t)
 @@ -295,6 +297,14 @@
  ')
  
@@ -14089,9 +14337,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	hostname_exec(pptp_t)
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/privoxy.te serefpolicy-3.6.26/policy/modules/services/privoxy.te
---- nsaserefpolicy/policy/modules/services/privoxy.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/privoxy.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/privoxy.te serefpolicy-3.6.27/policy/modules/services/privoxy.te
+--- nsaserefpolicy/policy/modules/services/privoxy.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/privoxy.te	2009-08-14 16:51:06.000000000 -0400
 @@ -47,9 +47,8 @@
  manage_files_pattern(privoxy_t, privoxy_var_run_t, privoxy_var_run_t)
  files_pid_filetrans(privoxy_t, privoxy_var_run_t, file)
@@ -14103,9 +14351,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  corenet_all_recvfrom_unlabeled(privoxy_t)
  corenet_all_recvfrom_netlabel(privoxy_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.6.26/policy/modules/services/procmail.te
---- nsaserefpolicy/policy/modules/services/procmail.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/procmail.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.6.27/policy/modules/services/procmail.te
+--- nsaserefpolicy/policy/modules/services/procmail.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/procmail.te	2009-08-14 16:51:06.000000000 -0400
 @@ -22,7 +22,7 @@
  # Local policy
  #
@@ -14153,9 +14401,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.fc serefpolicy-3.6.26/policy/modules/services/pyzor.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.fc serefpolicy-3.6.27/policy/modules/services/pyzor.fc
 --- nsaserefpolicy/policy/modules/services/pyzor.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/pyzor.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/pyzor.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,6 +1,10 @@
  /etc/pyzor(/.*)?		gen_context(system_u:object_r:pyzor_etc_t, s0)
 +/etc/rc\.d/init\.d/pyzord	--	gen_context(system_u:object_r:pyzord_initrc_exec_t,s0)
@@ -14167,9 +14415,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  /usr/bin/pyzor		--	gen_context(system_u:object_r:pyzor_exec_t,s0)
  /usr/bin/pyzord		--	gen_context(system_u:object_r:pyzord_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.6.26/policy/modules/services/pyzor.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.6.27/policy/modules/services/pyzor.if
 --- nsaserefpolicy/policy/modules/services/pyzor.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/pyzor.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/pyzor.if	2009-08-14 16:51:06.000000000 -0400
 @@ -88,3 +88,50 @@
  	corecmd_search_bin($1)
  	can_exec($1, pyzor_exec_t)
@@ -14221,10 +14469,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 +
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.6.26/policy/modules/services/pyzor.te
---- nsaserefpolicy/policy/modules/services/pyzor.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/pyzor.te	2009-07-30 15:33:09.000000000 -0400
-@@ -6,6 +6,38 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.6.27/policy/modules/services/pyzor.te
+--- nsaserefpolicy/policy/modules/services/pyzor.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/pyzor.te	2009-08-14 16:51:06.000000000 -0400
+@@ -1,11 +1,43 @@
+ 
+-policy_module(pyzor, 2.1.0)
++policy_module(pyzor, 2.0.2)
+ 
+ ########################################
+ #
  # Declarations
  #
  
@@ -14288,17 +14542,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  userdom_dontaudit_search_user_home_dirs(pyzor_t)
  
  optional_policy(`
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.fc serefpolicy-3.6.26/policy/modules/services/razor.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.fc serefpolicy-3.6.27/policy/modules/services/razor.fc
 --- nsaserefpolicy/policy/modules/services/razor.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/razor.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/razor.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,3 +1,4 @@
 +/root/\.razor(/.*)?		gen_context(system_u:object_r:razor_home_t,s0)
  HOME_DIR/\.razor(/.*)?		gen_context(system_u:object_r:razor_home_t,s0)
  
  /etc/razor(/.*)?		gen_context(system_u:object_r:razor_etc_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.if serefpolicy-3.6.26/policy/modules/services/razor.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.if serefpolicy-3.6.27/policy/modules/services/razor.if
 --- nsaserefpolicy/policy/modules/services/razor.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/razor.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/razor.if	2009-08-14 16:51:06.000000000 -0400
 @@ -157,3 +157,45 @@
  
  	domtrans_pattern($1, razor_exec_t, razor_t)
@@ -14345,10 +14599,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	read_files_pattern($1, razor_var_lib_t, razor_var_lib_t)
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.te serefpolicy-3.6.26/policy/modules/services/razor.te
---- nsaserefpolicy/policy/modules/services/razor.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/razor.te	2009-07-30 15:33:09.000000000 -0400
-@@ -6,6 +6,32 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.te serefpolicy-3.6.27/policy/modules/services/razor.te
+--- nsaserefpolicy/policy/modules/services/razor.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/razor.te	2009-08-14 16:51:06.000000000 -0400
+@@ -1,11 +1,37 @@
+ 
+-policy_module(razor, 2.1.0)
++policy_module(razor, 2.0.1)
+ 
+ ########################################
+ #
  # Declarations
  #
  
@@ -14399,9 +14659,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 +
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.6.26/policy/modules/services/ricci.te
---- nsaserefpolicy/policy/modules/services/ricci.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/ricci.te	2009-08-03 07:21:27.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.6.27/policy/modules/services/ricci.te
+--- nsaserefpolicy/policy/modules/services/ricci.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/ricci.te	2009-08-14 16:51:06.000000000 -0400
 @@ -264,6 +264,7 @@
  allow ricci_modclusterd_t self:socket create_socket_perms;
  
@@ -14421,9 +14681,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  storage_raw_read_fixed_disk(ricci_modstorage_t)
  
  term_dontaudit_use_console(ricci_modstorage_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-3.6.26/policy/modules/services/rpcbind.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-3.6.27/policy/modules/services/rpcbind.if
 --- nsaserefpolicy/policy/modules/services/rpcbind.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/rpcbind.if	2009-08-04 06:47:08.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/rpcbind.if	2009-08-14 16:51:06.000000000 -0400
 @@ -97,6 +97,26 @@
  
  ########################################
@@ -14451,9 +14711,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	All of the rules required to administrate 
  ##	an rpcbind environment
  ## </summary>
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.6.26/policy/modules/services/rpc.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.6.27/policy/modules/services/rpc.if
 --- nsaserefpolicy/policy/modules/services/rpc.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/rpc.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/rpc.if	2009-08-14 16:51:06.000000000 -0400
 @@ -54,7 +54,7 @@
  	allow $1_t self:unix_dgram_socket create_socket_perms;
  	allow $1_t self:unix_stream_socket create_stream_socket_perms;
@@ -14474,9 +14734,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  		seutil_sigchld_newrole($1_t)
  	')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.6.26/policy/modules/services/rpc.te
---- nsaserefpolicy/policy/modules/services/rpc.te	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/rpc.te	2009-08-05 17:22:27.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.6.27/policy/modules/services/rpc.te
+--- nsaserefpolicy/policy/modules/services/rpc.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/rpc.te	2009-08-14 16:51:06.000000000 -0400
 @@ -91,6 +91,8 @@
  
  seutil_dontaudit_search_config(rpcd_t)
@@ -14524,9 +14784,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  auth_use_nsswitch(gssd_t)
  auth_manage_cache(gssd_t) 
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.6.26/policy/modules/services/rsync.te
---- nsaserefpolicy/policy/modules/services/rsync.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/rsync.te	2009-08-12 07:48:31.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.6.27/policy/modules/services/rsync.te
+--- nsaserefpolicy/policy/modules/services/rsync.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/rsync.te	2009-08-14 16:51:06.000000000 -0400
 @@ -8,6 +8,13 @@
  
  ## <desc>
@@ -14569,15 +14829,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 +
  auth_can_read_shadow_passwords(rsync_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtkit_daemon.fc serefpolicy-3.6.26/policy/modules/services/rtkit_daemon.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtkit_daemon.fc serefpolicy-3.6.27/policy/modules/services/rtkit_daemon.fc
 --- nsaserefpolicy/policy/modules/services/rtkit_daemon.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/rtkit_daemon.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/rtkit_daemon.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,2 @@
 +
 +/usr/libexec/rtkit-daemon	--	gen_context(system_u:object_r:rtkit_daemon_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtkit_daemon.if serefpolicy-3.6.26/policy/modules/services/rtkit_daemon.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtkit_daemon.if serefpolicy-3.6.27/policy/modules/services/rtkit_daemon.if
 --- nsaserefpolicy/policy/modules/services/rtkit_daemon.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/rtkit_daemon.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/rtkit_daemon.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,64 @@
 +
 +## <summary>policy for rtkit_daemon</summary>
@@ -14643,9 +14903,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	allow rtkit_daemon_t $1:process { getsched setsched };
 +	rtkit_daemon_dbus_chat($1)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtkit_daemon.te serefpolicy-3.6.26/policy/modules/services/rtkit_daemon.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtkit_daemon.te serefpolicy-3.6.27/policy/modules/services/rtkit_daemon.te
 --- nsaserefpolicy/policy/modules/services/rtkit_daemon.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/rtkit_daemon.te	2009-08-07 07:36:54.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/rtkit_daemon.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,38 @@
 +policy_module(rtkit_daemon,1.0.0)
 +
@@ -14685,9 +14945,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
 +        policykit_dbus_chat(rtkit_daemon_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.6.26/policy/modules/services/samba.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.6.27/policy/modules/services/samba.fc
 --- nsaserefpolicy/policy/modules/services/samba.fc	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/samba.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/samba.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -51,3 +51,7 @@
  /var/run/winbindd(/.*)?			gen_context(system_u:object_r:winbind_var_run_t,s0)
  
@@ -14696,9 +14956,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +ifndef(`enable_mls',`
 +/var/lib/samba/scripts(/.*)?		gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.6.26/policy/modules/services/samba.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.6.27/policy/modules/services/samba.if
 --- nsaserefpolicy/policy/modules/services/samba.if	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/samba.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/samba.if	2009-08-14 16:51:06.000000000 -0400
 @@ -62,6 +62,25 @@
  
  ########################################
@@ -14871,9 +15131,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	admin_pattern($1, winbind_var_run_t)
 +	admin_pattern($1, samba_unconfined_script_exec_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.26/policy/modules/services/samba.te
---- nsaserefpolicy/policy/modules/services/samba.te	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/samba.te	2009-08-13 18:18:57.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.27/policy/modules/services/samba.te
+--- nsaserefpolicy/policy/modules/services/samba.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/samba.te	2009-08-14 16:51:06.000000000 -0400
 @@ -66,6 +66,13 @@
  ## </desc>
  gen_tunable(samba_share_nfs, false)
@@ -15081,9 +15341,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +',`
 +	can_exec(smbd_t, samba_unconfined_script_exec_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.6.26/policy/modules/services/sasl.te
---- nsaserefpolicy/policy/modules/services/sasl.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/sasl.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.6.27/policy/modules/services/sasl.te
+--- nsaserefpolicy/policy/modules/services/sasl.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/sasl.te	2009-08-14 16:51:06.000000000 -0400
 @@ -31,7 +31,7 @@
  # Local policy
  #
@@ -15146,9 +15406,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	seutil_sigchld_newrole(saslauthd_t)
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.6.26/policy/modules/services/sendmail.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.6.27/policy/modules/services/sendmail.if
 --- nsaserefpolicy/policy/modules/services/sendmail.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/sendmail.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/sendmail.if	2009-08-14 16:51:06.000000000 -0400
 @@ -59,20 +59,20 @@
  
  ########################################
@@ -15321,9 +15581,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +	allow $1 sendmail_t:fifo_file rw_fifo_file_perms; 
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.6.26/policy/modules/services/sendmail.te
---- nsaserefpolicy/policy/modules/services/sendmail.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/sendmail.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.6.27/policy/modules/services/sendmail.te
+--- nsaserefpolicy/policy/modules/services/sendmail.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/sendmail.te	2009-08-14 16:51:06.000000000 -0400
 @@ -20,13 +20,17 @@
  mta_mailserver_delivery(sendmail_t)
  mta_mailserver_sender(sendmail_t)
@@ -15499,18 +15759,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
 -dontaudit sendmail_t admin_tty_type:chr_file { getattr ioctl };
 -') dnl end TODO
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.fc serefpolicy-3.6.26/policy/modules/services/setroubleshoot.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.fc serefpolicy-3.6.27/policy/modules/services/setroubleshoot.fc
 --- nsaserefpolicy/policy/modules/services/setroubleshoot.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/setroubleshoot.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/setroubleshoot.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -5,3 +5,5 @@
  /var/log/setroubleshoot(/.*)?		gen_context(system_u:object_r:setroubleshoot_var_log_t,s0)
  
  /var/lib/setroubleshoot(/.*)?		gen_context(system_u:object_r:setroubleshoot_var_lib_t,s0)
 +
 +/usr/share/setroubleshoot/SetroubleshootFixit\.py* 	--	gen_context(system_u:object_r:setroubleshoot_fixit_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.6.26/policy/modules/services/setroubleshoot.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.6.27/policy/modules/services/setroubleshoot.if
 --- nsaserefpolicy/policy/modules/services/setroubleshoot.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/setroubleshoot.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/setroubleshoot.if	2009-08-14 16:51:06.000000000 -0400
 @@ -16,8 +16,8 @@
  	')
  
@@ -15587,9 +15847,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	files_list_pids($1)
 +	admin_pattern($1, setroubleshoot_var_run_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.6.26/policy/modules/services/setroubleshoot.te
---- nsaserefpolicy/policy/modules/services/setroubleshoot.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/setroubleshoot.te	2009-08-05 08:03:58.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.6.27/policy/modules/services/setroubleshoot.te
+--- nsaserefpolicy/policy/modules/services/setroubleshoot.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/setroubleshoot.te	2009-08-14 16:51:06.000000000 -0400
 @@ -22,13 +22,19 @@
  type setroubleshoot_var_run_t;
  files_pid_file(setroubleshoot_var_run_t)
@@ -15708,9 +15968,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 +
 +permissive setroubleshoot_fixit_t;
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/shorewall.fc serefpolicy-3.6.26/policy/modules/services/shorewall.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/shorewall.fc serefpolicy-3.6.27/policy/modules/services/shorewall.fc
 --- nsaserefpolicy/policy/modules/services/shorewall.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/shorewall.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/shorewall.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,12 @@
 +
 +/etc/rc\.d/init\.d/shorewall        	--      gen_context(system_u:object_r:shorewall_initrc_exec_t,s0)
@@ -15724,9 +15984,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +/var/lib/shorewall(/.*)?			gen_context(system_u:object_r:shorewall_var_lib_t,s0)
 +/var/lib/shorewall-lite(/.*)?           	gen_context(system_u:object_r:shorewall_var_lib_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/shorewall.if serefpolicy-3.6.26/policy/modules/services/shorewall.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/shorewall.if serefpolicy-3.6.27/policy/modules/services/shorewall.if
 --- nsaserefpolicy/policy/modules/services/shorewall.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/shorewall.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/shorewall.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,166 @@
 +## <summary>policy for shorewall</summary>
 +
@@ -15894,9 +16154,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +        admin_pattern($1, shorewall_tmp_t)
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/shorewall.te serefpolicy-3.6.26/policy/modules/services/shorewall.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/shorewall.te serefpolicy-3.6.27/policy/modules/services/shorewall.te
 --- nsaserefpolicy/policy/modules/services/shorewall.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/services/shorewall.te	2009-08-13 09:47:21.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/shorewall.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,95 @@
 +policy_module(shorewall,1.0.0)
 +
@@ -15993,9 +16253,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
 +	ulogd_search_log(shorewall_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.6.26/policy/modules/services/smartmon.te
---- nsaserefpolicy/policy/modules/services/smartmon.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/smartmon.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.6.27/policy/modules/services/smartmon.te
+--- nsaserefpolicy/policy/modules/services/smartmon.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/smartmon.te	2009-08-14 16:51:06.000000000 -0400
 @@ -19,6 +19,10 @@
  type fsdaemon_tmp_t;
  files_tmp_file(fsdaemon_tmp_t)
@@ -16053,9 +16313,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.6.26/policy/modules/services/spamassassin.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.6.27/policy/modules/services/spamassassin.fc
 --- nsaserefpolicy/policy/modules/services/spamassassin.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/spamassassin.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/spamassassin.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,15 +1,25 @@
 -HOME_DIR/\.spamassassin(/.*)?	gen_context(system_u:object_r:spamassassin_home_t,s0)
 +HOME_DIR/\.spamassassin(/.*)?	gen_context(system_u:object_r:spamc_home_t,s0)
@@ -16084,9 +16344,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /var/spool/spamd(/.*)?		gen_context(system_u:object_r:spamd_spool_t,s0)
 +/var/spool/MD-Quarantine(/.*)?	gen_context(system_u:object_r:spamd_spool_t,s0)
 +/var/spool/MIMEDefang(/.*)?	gen_context(system_u:object_r:spamd_spool_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.6.26/policy/modules/services/spamassassin.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.6.27/policy/modules/services/spamassassin.if
 --- nsaserefpolicy/policy/modules/services/spamassassin.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/spamassassin.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/spamassassin.if	2009-08-14 16:51:06.000000000 -0400
 @@ -111,6 +111,7 @@
  	')
  
@@ -16173,9 +16433,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	files_list_pids($1)
 +	admin_pattern($1, spamd_var_run_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.6.26/policy/modules/services/spamassassin.te
---- nsaserefpolicy/policy/modules/services/spamassassin.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/spamassassin.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.6.27/policy/modules/services/spamassassin.te
+--- nsaserefpolicy/policy/modules/services/spamassassin.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/spamassassin.te	2009-08-14 16:51:06.000000000 -0400
 @@ -20,6 +20,35 @@
  ## </desc>
  gen_tunable(spamd_enable_home_dirs, true)
@@ -16468,9 +16728,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
  	udev_read_db(spamd_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.6.26/policy/modules/services/squid.te
---- nsaserefpolicy/policy/modules/services/squid.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/squid.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.6.27/policy/modules/services/squid.te
+--- nsaserefpolicy/policy/modules/services/squid.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/squid.te	2009-08-14 16:51:06.000000000 -0400
 @@ -118,6 +118,8 @@
  
  fs_getattr_all_fs(squid_t)
@@ -16489,18 +16749,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -#squid requires the following when run in diskd mode, the recommended setting
 -allow squid_t tmpfs_t:file { read write };
 -') dnl end TODO
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.fc serefpolicy-3.6.26/policy/modules/services/ssh.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.fc serefpolicy-3.6.27/policy/modules/services/ssh.fc
 --- nsaserefpolicy/policy/modules/services/ssh.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/ssh.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/ssh.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -14,3 +14,5 @@
  /usr/sbin/sshd			--	gen_context(system_u:object_r:sshd_exec_t,s0)
  
  /var/run/sshd\.init\.pid	--	gen_context(system_u:object_r:sshd_var_run_t,s0)
 +
 +/root/\.ssh(/.*)?			gen_context(system_u:object_r:home_ssh_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.6.26/policy/modules/services/ssh.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.6.27/policy/modules/services/ssh.if
 --- nsaserefpolicy/policy/modules/services/ssh.if	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/ssh.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/ssh.if	2009-08-14 16:51:06.000000000 -0400
 @@ -36,6 +36,7 @@
  	gen_require(`
  		attribute ssh_server;
@@ -16801,9 +17061,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	read_lnk_files_pattern($1, home_ssh_t, home_ssh_t)
 +	userdom_search_user_home_dirs($1)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.6.26/policy/modules/services/ssh.te
---- nsaserefpolicy/policy/modules/services/ssh.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/ssh.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.6.27/policy/modules/services/ssh.te
+--- nsaserefpolicy/policy/modules/services/ssh.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/ssh.te	2009-08-14 16:51:06.000000000 -0400
 @@ -41,6 +41,9 @@
  files_tmp_file(sshd_tmp_t)
  files_poly_parent(sshd_tmp_t)
@@ -16975,18 +17235,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	seutil_sigchld_newrole(ssh_keygen_t)
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.fc serefpolicy-3.6.26/policy/modules/services/sssd.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.fc serefpolicy-3.6.27/policy/modules/services/sssd.fc
 --- nsaserefpolicy/policy/modules/services/sssd.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/sssd.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/sssd.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,4 +1,4 @@
 -/etc/rc.d/init.d/sssd	--	gen_context(system_u:object_r:sssd_initrc_exec_t,s0)
 +/etc/rc\.d/init\.d/sssd	--	gen_context(system_u:object_r:sssd_initrc_exec_t,s0)
  
  /usr/sbin/sssd		--	gen_context(system_u:object_r:sssd_exec_t,s0)
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.if serefpolicy-3.6.26/policy/modules/services/sssd.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.if serefpolicy-3.6.27/policy/modules/services/sssd.if
 --- nsaserefpolicy/policy/modules/services/sssd.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/sssd.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/sssd.if	2009-08-14 16:51:06.000000000 -0400
 @@ -12,12 +12,32 @@
  #
  interface(`sssd_domtrans',`
@@ -17049,9 +17309,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	Send and receive messages from
  ##	sssd over dbus.
  ## </summary>
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.6.26/policy/modules/services/sysstat.te
---- nsaserefpolicy/policy/modules/services/sysstat.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/sysstat.te	2009-08-05 17:06:04.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.6.27/policy/modules/services/sysstat.te
+--- nsaserefpolicy/policy/modules/services/sysstat.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/sysstat.te	2009-08-14 16:51:06.000000000 -0400
 @@ -19,7 +19,7 @@
  # Local policy
  #
@@ -17061,9 +17321,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  dontaudit sysstat_t self:capability sys_admin;
  allow sysstat_t self:fifo_file rw_fifo_file_perms;
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp.te serefpolicy-3.6.26/policy/modules/services/uucp.te
---- nsaserefpolicy/policy/modules/services/uucp.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/uucp.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp.te serefpolicy-3.6.27/policy/modules/services/uucp.te
+--- nsaserefpolicy/policy/modules/services/uucp.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/uucp.te	2009-08-14 16:51:06.000000000 -0400
 @@ -95,6 +95,8 @@
  files_search_home(uucpd_t)
  files_search_spool(uucpd_t)
@@ -17081,9 +17341,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.fc serefpolicy-3.6.26/policy/modules/services/virt.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.fc serefpolicy-3.6.27/policy/modules/services/virt.fc
 --- nsaserefpolicy/policy/modules/services/virt.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/virt.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/virt.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -8,5 +8,16 @@
  
  /var/lib/libvirt(/.*)?		gen_context(system_u:object_r:virt_var_lib_t,s0)
@@ -17101,9 +17361,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/var/cache/libvirt(/.*)?	gen_context(system_u:object_r:svirt_cache_t,s0)
 +
 +/var/run/libvirt/qemu(/.*)? 	gen_context(system_u:object_r:svirt_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.6.26/policy/modules/services/virt.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.6.27/policy/modules/services/virt.if
 --- nsaserefpolicy/policy/modules/services/virt.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/virt.if	2009-08-13 15:24:46.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/virt.if	2009-08-14 16:51:06.000000000 -0400
 @@ -103,7 +103,7 @@
  
  ########################################
@@ -17279,9 +17539,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	manage_files_pattern($1, svirt_cache_t, svirt_cache_t)
 +	manage_lnk_files_pattern($1, svirt_cache_t, svirt_cache_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.26/policy/modules/services/virt.te
---- nsaserefpolicy/policy/modules/services/virt.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/virt.te	2009-08-13 16:49:58.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.27/policy/modules/services/virt.te
+--- nsaserefpolicy/policy/modules/services/virt.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/virt.te	2009-08-14 16:51:06.000000000 -0400
 @@ -20,6 +20,28 @@
  ## </desc>
  gen_tunable(virt_use_samba, false)
@@ -17661,9 +17921,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	virt_read_content(virt_domain)
 +	virt_stream_connect(virt_domain)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.6.26/policy/modules/services/w3c.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.6.27/policy/modules/services/w3c.te
 --- nsaserefpolicy/policy/modules/services/w3c.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/w3c.te	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/w3c.te	2009-08-14 16:51:06.000000000 -0400
 @@ -8,11 +8,18 @@
  
  apache_content_template(w3c_validator)
@@ -17683,9 +17943,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  corenet_tcp_connect_ftp_port(httpd_w3c_validator_script_t)
  corenet_tcp_sendrecv_ftp_port(httpd_w3c_validator_script_t)
  corenet_tcp_connect_http_port(httpd_w3c_validator_script_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.6.26/policy/modules/services/xserver.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.6.27/policy/modules/services/xserver.fc
 --- nsaserefpolicy/policy/modules/services/xserver.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/xserver.fc	2009-08-13 13:40:39.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/xserver.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -3,12 +3,17 @@
  #
  HOME_DIR/\.fonts\.conf	--	gen_context(system_u:object_r:user_fonts_config_t,s0)
@@ -17757,9 +18017,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  ifdef(`distro_suse',`
  /var/lib/pam_devperm/:0	--	gen_context(system_u:object_r:xdm_var_lib_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.6.26/policy/modules/services/xserver.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.6.27/policy/modules/services/xserver.if
 --- nsaserefpolicy/policy/modules/services/xserver.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/xserver.if	2009-08-11 14:14:49.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/xserver.if	2009-08-14 16:51:06.000000000 -0400
 @@ -90,7 +90,7 @@
  	allow $2 xauth_home_t:file manage_file_perms;
  	allow $2 xauth_home_t:file { relabelfrom relabelto };
@@ -18453,9 +18713,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	allow xdm_t $1:dbus send_msg;
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.26/policy/modules/services/xserver.te
---- nsaserefpolicy/policy/modules/services/xserver.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/services/xserver.te	2009-08-03 06:43:20.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.27/policy/modules/services/xserver.te
+--- nsaserefpolicy/policy/modules/services/xserver.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/services/xserver.te	2009-08-14 16:51:06.000000000 -0400
 @@ -34,6 +34,13 @@
  
  ## <desc>
@@ -18577,30 +18837,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # type for /var/lib/xkb
  type xkb_var_lib_t;
  files_type(xkb_var_lib_t)
-@@ -189,7 +212,7 @@
- type xserver_t;
- type xserver_exec_t;
- typealias xserver_t alias { user_xserver_t staff_xserver_t sysadm_xserver_t };
--typealias xserver_t alias { auditadm_xserver_t secadm_xserver_t };
-+typealias xserver_t alias { auditadm_xserver_t secadm_xserver_t xdm_xserver_t };
- xserver_object_types_template(xdm)
- xserver_common_x_domain_template(xdm, xdm_t)
- init_system_domain(xserver_t, xserver_exec_t)
-@@ -197,12 +220,12 @@
- 
- type xserver_tmp_t;
- typealias xserver_tmp_t alias { user_xserver_tmp_t staff_xserver_tmp_t sysadm_xserver_tmp_t };
--typealias xserver_tmp_t alias { auditadm_xserver_tmp_t secadm_xserver_tmp_t };
-+typealias xserver_tmp_t alias { auditadm_xserver_tmp_t secadm_xserver_tmp_t xdm_xserver_tmp_t };
- files_tmp_file(xserver_tmp_t)
+@@ -202,8 +225,8 @@
  ubac_constrained(xserver_tmp_t)
  
  type xserver_tmpfs_t;
 -typealias xserver_tmpfs_t alias { user_xserver_tmpfs_t staff_xserver_tmpfs_t sysadm_xserver_tmpfs_t };
+-typealias xserver_tmpfs_t alias { auditadm_xserver_tmpfs_t secadm_xserver_tmpfs_t xdm_xserver_tmpfs_t };
 +typealias xserver_tmpfs_t alias { user_xserver_tmpfs_t staff_xserver_tmpfs_t sysadm_xserver_tmpfs_t xguest_xserver_tmpfs_t unconfined_xserver_tmpfs_t xdm_xserver_tmpfs_t };
- typealias xserver_tmpfs_t alias { auditadm_xserver_tmpfs_t secadm_xserver_tmpfs_t };
++typealias xserver_tmpfs_t alias { auditadm_xserver_tmpfs_t secadm_xserver_tmpfs_t };
  files_tmpfs_file(xserver_tmpfs_t)
  ubac_constrained(xserver_tmpfs_t)
+ 
 @@ -250,19 +273,21 @@
  # Xauth local policy
  #
@@ -19190,9 +19437,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -#
 -allow xdm_t user_home_type:file unlink;
 -') dnl end TODO
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.6.26/policy/modules/system/application.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.6.27/policy/modules/system/application.if
 --- nsaserefpolicy/policy/modules/system/application.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/application.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/application.if	2009-08-14 16:51:06.000000000 -0400
 @@ -2,7 +2,7 @@
  
  ########################################
@@ -19224,9 +19471,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +	allow $1 application_domain_type:process signull;
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.6.26/policy/modules/system/application.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.6.27/policy/modules/system/application.te
 --- nsaserefpolicy/policy/modules/system/application.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/application.te	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/application.te	2009-08-14 16:51:06.000000000 -0400
 @@ -7,7 +7,18 @@
  # Executables to be run by user
  attribute application_exec_type;
@@ -19246,9 +19493,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	sudo_sigchld(application_domain_type)
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.6.26/policy/modules/system/authlogin.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.6.27/policy/modules/system/authlogin.fc
 --- nsaserefpolicy/policy/modules/system/authlogin.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/authlogin.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/authlogin.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -7,12 +7,10 @@
  /etc/passwd\.lock	--	gen_context(system_u:object_r:shadow_t,s0)
  /etc/shadow.*		--	gen_context(system_u:object_r:shadow_t,s0)
@@ -19274,9 +19521,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /var/run/sudo(/.*)?		gen_context(system_u:object_r:pam_var_run_t,s0)
 +/var/run/pam_ssh(/.*)?		gen_context(system_u:object_r:var_auth_t,s0)
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.6.26/policy/modules/system/authlogin.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.6.27/policy/modules/system/authlogin.if
 --- nsaserefpolicy/policy/modules/system/authlogin.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/authlogin.if	2009-08-04 06:42:06.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/authlogin.if	2009-08-14 16:51:06.000000000 -0400
 @@ -40,17 +40,76 @@
  ##	</summary>
  ## </param>
@@ -19584,9 +19831,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	')
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.6.26/policy/modules/system/authlogin.te
---- nsaserefpolicy/policy/modules/system/authlogin.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/authlogin.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.6.27/policy/modules/system/authlogin.te
+--- nsaserefpolicy/policy/modules/system/authlogin.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/authlogin.te	2009-08-14 16:51:06.000000000 -0400
 @@ -125,9 +125,18 @@
  ')
  
@@ -19606,9 +19853,106 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ########################################
  #
  # PAM local policy
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.6.26/policy/modules/system/fstools.fc
+@@ -159,8 +168,6 @@
+ 
+ kernel_read_system_state(pam_t)
+ 
+-files_read_etc_files(pam_t)
+-
+ fs_search_auto_mountpoints(pam_t)
+ 
+ miscfiles_read_localization(pam_t)
+@@ -170,6 +177,8 @@
+ 
+ init_dontaudit_rw_utmp(pam_t)
+ 
++files_read_etc_files(pam_t)
++
+ logging_send_syslog_msg(pam_t)
+ 
+ ifdef(`distro_ubuntu',`
+@@ -231,17 +240,6 @@
+ dev_setattr_xserver_misc_dev(pam_console_t)
+ dev_read_urand(pam_console_t)
+ 
+-files_read_etc_files(pam_console_t)
+-files_search_pids(pam_console_t)
+-files_list_mnt(pam_console_t)
+-files_dontaudit_search_isid_type_dirs(pam_console_t)
+-# read /etc/mtab
+-files_read_etc_runtime_files(pam_console_t)
+-
+-fs_list_auto_mountpoints(pam_console_t)
+-fs_list_noxattr_fs(pam_console_t)
+-fs_getattr_all_fs(pam_console_t)
+-
+ mls_file_read_all_levels(pam_console_t)
+ mls_file_write_all_levels(pam_console_t)
+ 
+@@ -264,6 +262,17 @@
+ 
+ domain_use_interactive_fds(pam_console_t)
+ 
++files_read_etc_files(pam_console_t)
++files_search_pids(pam_console_t)
++files_list_mnt(pam_console_t)
++files_dontaudit_search_isid_type_dirs(pam_console_t)
++# read /etc/mtab
++files_read_etc_runtime_files(pam_console_t)
++
++fs_list_auto_mountpoints(pam_console_t)
++fs_list_noxattr_fs(pam_console_t)
++fs_getattr_all_fs(pam_console_t)
++
+ init_use_fds(pam_console_t)
+ init_use_script_ptys(pam_console_t)
+ 
+@@ -352,8 +361,6 @@
+ 
+ dev_read_urand(utempter_t)
+ 
+-files_read_etc_files(utempter_t)
+-
+ term_getattr_all_user_ttys(utempter_t)
+ term_getattr_all_user_ptys(utempter_t)
+ term_dontaudit_use_all_user_ttys(utempter_t)
+@@ -362,6 +369,8 @@
+ 
+ init_rw_utmp(utempter_t)
+ 
++files_read_etc_files(utempter_t)
++
+ domain_use_interactive_fds(utempter_t)
+ 
+ logging_search_logs(utempter_t)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-3.6.27/policy/modules/system/clock.te
+--- nsaserefpolicy/policy/modules/system/clock.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/clock.te	2009-08-14 16:51:06.000000000 -0400
+@@ -38,10 +38,6 @@
+ dev_read_sysfs(hwclock_t)
+ dev_rw_realtime_clock(hwclock_t)
+ 
+-files_read_etc_files(hwclock_t)
+-# for when /usr is not mounted:
+-files_dontaudit_search_isid_type_dirs(hwclock_t)
+-
+ fs_getattr_xattr_fs(hwclock_t)
+ fs_search_auto_mountpoints(hwclock_t)
+ 
+@@ -55,6 +51,10 @@
+ init_use_fds(hwclock_t)
+ init_use_script_ptys(hwclock_t)
+ 
++files_read_etc_files(hwclock_t)
++# for when /usr is not mounted:
++files_dontaudit_search_isid_type_dirs(hwclock_t)
++
+ logging_send_audit_msgs(hwclock_t)
+ logging_send_syslog_msg(hwclock_t)
+ 
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.6.27/policy/modules/system/fstools.fc
 --- nsaserefpolicy/policy/modules/system/fstools.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/fstools.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/fstools.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,4 +1,3 @@
 -/sbin/badblocks		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/blkid		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -19622,21 +19966,99 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /sbin/parted		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/partprobe		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/partx		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.6.26/policy/modules/system/fstools.te
---- nsaserefpolicy/policy/modules/system/fstools.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/fstools.te	2009-07-30 15:33:09.000000000 -0400
-@@ -97,6 +97,10 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.6.27/policy/modules/system/fstools.te
+--- nsaserefpolicy/policy/modules/system/fstools.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/fstools.te	2009-08-14 16:51:06.000000000 -0400
+@@ -65,13 +65,7 @@
+ kernel_rw_unlabeled_dirs(fsadm_t)
+ kernel_rw_unlabeled_blk_files(fsadm_t)
+ 
+-corecmd_exec_bin(fsadm_t)
+-#RedHat bug #201164
+-corecmd_exec_shell(fsadm_t)
+-# cjp: these are probably not needed:
+-corecmd_read_bin_files(fsadm_t)
+-corecmd_read_bin_pipes(fsadm_t)
+-corecmd_read_bin_sockets(fsadm_t)
++files_getattr_boot_dirs(fsadm_t)
+ 
+ dev_getattr_all_chr_files(fsadm_t)
+ dev_dontaudit_getattr_all_blk_files(fsadm_t)
+@@ -92,22 +86,6 @@
+ # Access to /dev/mapper/control
+ dev_rw_lvm_control(fsadm_t)
+ 
+-domain_use_interactive_fds(fsadm_t)
+-
+-files_getattr_boot_dirs(fsadm_t)
+-files_list_home(fsadm_t)
+-files_read_usr_files(fsadm_t)
+-files_read_etc_files(fsadm_t)
+-files_manage_lost_found(fsadm_t)
+-files_manage_isid_type_dirs(fsadm_t)
+-# Write to /etc/mtab.
+-files_manage_etc_runtime_files(fsadm_t)
+-files_etc_filetrans_etc_runtime(fsadm_t, file)
+-# Access to /initrd devices
+-files_rw_isid_type_dirs(fsadm_t)
+-files_rw_isid_type_blk_files(fsadm_t)
+-files_read_isid_type_files(fsadm_t)
+-
+ fs_search_auto_mountpoints(fsadm_t)
+ fs_getattr_xattr_fs(fsadm_t)
+ fs_rw_ramfs_pipes(fsadm_t)
+@@ -118,10 +96,10 @@
+ fs_search_tmpfs(fsadm_t)
  fs_getattr_tmpfs_dirs(fsadm_t)
  fs_read_tmpfs_symlinks(fsadm_t)
- 
+-# Recreate /mnt/cdrom.
+-files_manage_mnt_dirs(fsadm_t)
+-# for tune2fs
+-files_search_all(fsadm_t)
++
 +fs_manage_nfs_files(fsadm_t)
 +
 +fs_manage_cifs_files(fsadm_t)
-+
+ 
  mls_file_read_all_levels(fsadm_t)
  mls_file_write_all_levels(fsadm_t)
- 
-@@ -150,8 +154,7 @@
+@@ -135,6 +113,35 @@
+ 
+ term_use_console(fsadm_t)
+ 
++corecmd_exec_bin(fsadm_t)
++#RedHat bug #201164
++corecmd_exec_shell(fsadm_t)
++
++# cjp: these are probably not needed:
++corecmd_read_bin_files(fsadm_t)
++corecmd_read_bin_pipes(fsadm_t)
++corecmd_read_bin_sockets(fsadm_t)
++
++domain_use_interactive_fds(fsadm_t)
++
++files_list_home(fsadm_t)
++files_read_usr_files(fsadm_t)
++files_read_etc_files(fsadm_t)
++files_manage_lost_found(fsadm_t)
++files_manage_isid_type_dirs(fsadm_t)
++# Write to /etc/mtab.
++files_manage_etc_runtime_files(fsadm_t)
++files_etc_filetrans_etc_runtime(fsadm_t, file)
++# Access to /initrd devices
++files_rw_isid_type_dirs(fsadm_t)
++files_rw_isid_type_blk_files(fsadm_t)
++files_read_isid_type_files(fsadm_t)
++
++# Recreate /mnt/cdrom.
++files_manage_mnt_dirs(fsadm_t)
++# for tune2fs
++files_search_all(fsadm_t)
++
+ init_use_fds(fsadm_t)
+ init_use_script_ptys(fsadm_t)
+ init_dontaudit_getattr_initctl(fsadm_t)
+@@ -147,8 +154,7 @@
  
  seutil_read_config(fsadm_t)
  
@@ -19646,16 +20068,51 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  ifdef(`distro_redhat',`
  	optional_policy(`
-@@ -180,4 +183,6 @@
+@@ -177,4 +183,6 @@
  
  optional_policy(`
  	xen_append_log(fsadm_t)
 +	xen_rw_image_files(fsadm_t)
  ')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.6.26/policy/modules/system/hostname.te
---- nsaserefpolicy/policy/modules/system/hostname.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/hostname.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.6.27/policy/modules/system/getty.te
+--- nsaserefpolicy/policy/modules/system/getty.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/getty.te	2009-08-14 16:51:06.000000000 -0400
+@@ -59,16 +59,8 @@
+ kernel_list_proc(getty_t)
+ kernel_read_proc_symlinks(getty_t)
+ 
+-corecmd_search_bin(getty_t)
+-corecmd_read_bin_symlinks(getty_t)
+-
+ dev_read_sysfs(getty_t)
+ 
+-files_rw_generic_pids(getty_t)
+-files_read_etc_runtime_files(getty_t)
+-files_read_etc_files(getty_t)
+-files_search_spool(getty_t)
+-
+ fs_search_auto_mountpoints(getty_t)
+ # for error condition handling
+ fs_getattr_xattr_fs(getty_t)
+@@ -88,6 +80,14 @@
+ 
+ auth_rw_login_records(getty_t)
+ 
++corecmd_search_bin(getty_t)
++corecmd_read_bin_symlinks(getty_t)
++
++files_rw_generic_pids(getty_t)
++files_read_etc_runtime_files(getty_t)
++files_read_etc_files(getty_t)
++files_search_spool(getty_t)
++
+ init_rw_utmp(getty_t)
+ init_use_script_ptys(getty_t)
+ init_dontaudit_use_script_ptys(getty_t)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.6.27/policy/modules/system/hostname.te
+--- nsaserefpolicy/policy/modules/system/hostname.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/hostname.te	2009-08-14 16:51:06.000000000 -0400
 @@ -8,7 +8,9 @@
  
  type hostname_t;
@@ -19667,9 +20124,47 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  role system_r types hostname_t;
  
  ########################################
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.fc serefpolicy-3.6.26/policy/modules/system/init.fc
+@@ -27,13 +29,6 @@
+ 
+ dev_read_sysfs(hostname_t)
+ 
+-domain_use_interactive_fds(hostname_t)
+-
+-files_read_etc_files(hostname_t)
+-files_dontaudit_search_var(hostname_t)
+-# for when /usr is not mounted:
+-files_dontaudit_search_isid_type_dirs(hostname_t)
+-
+ fs_getattr_xattr_fs(hostname_t)
+ fs_search_auto_mountpoints(hostname_t)
+ fs_dontaudit_use_tmpfs_chr_dev(hostname_t)
+@@ -46,6 +41,13 @@
+ init_use_script_fds(hostname_t)
+ init_use_script_ptys(hostname_t)
+ 
++domain_use_interactive_fds(hostname_t)
++
++files_read_etc_files(hostname_t)
++files_dontaudit_search_var(hostname_t)
++# for when /usr is not mounted:
++files_dontaudit_search_isid_type_dirs(hostname_t)
++
+ logging_send_syslog_msg(hostname_t)
+ 
+ miscfiles_read_localization(hostname_t)
+@@ -59,5 +61,9 @@
+ ')
+ 
+ optional_policy(`
++	xen_append_log(hostname_t)
++')
++
++optional_policy(`
+ 	unconfined_dontaudit_rw_pipes(hostname_t)
+ ')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.fc serefpolicy-3.6.27/policy/modules/system/init.fc
 --- nsaserefpolicy/policy/modules/system/init.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/init.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/init.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -4,10 +4,10 @@
  /etc/init\.d/.*		--	gen_context(system_u:object_r:initrc_exec_t,s0)
  
@@ -19692,9 +20187,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  #
  # /var
  #
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.6.26/policy/modules/system/init.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.6.27/policy/modules/system/init.if
 --- nsaserefpolicy/policy/modules/system/init.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/init.if	2009-08-10 10:27:53.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/init.if	2009-08-14 16:51:06.000000000 -0400
 @@ -174,6 +174,7 @@
  	role system_r types $1;
  
@@ -19932,9 +20427,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	allow $1 init_t:unix_dgram_socket sendto;
 +	allow init_t $1:unix_dgram_socket sendto;
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.26/policy/modules/system/init.te
---- nsaserefpolicy/policy/modules/system/init.te	2009-07-30 09:44:08.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/init.te	2009-08-13 15:46:16.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.27/policy/modules/system/init.te
+--- nsaserefpolicy/policy/modules/system/init.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/init.te	2009-08-14 16:51:06.000000000 -0400
 @@ -17,6 +17,20 @@
  ## </desc>
  gen_tunable(init_upstart, false)
@@ -20059,7 +20554,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  files_tmp_filetrans(initrc_t, initrc_tmp_t, { file dir })
  
  init_write_initctl(initrc_t)
-@@ -249,8 +287,12 @@
+@@ -249,10 +287,12 @@
  kernel_rw_all_sysctls(initrc_t)
  # for lsof which is used by alsa shutdown:
  kernel_dontaudit_getattr_message_if(initrc_t)
@@ -20068,11 +20563,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +files_read_config_files(initrc_t)
  
  files_read_kernel_symbol_table(initrc_t)
+-
+-corecmd_exec_all_executables(initrc_t)
 +files_exec_etc_files(initrc_t)
  
  corenet_all_recvfrom_unlabeled(initrc_t)
  corenet_all_recvfrom_netlabel(initrc_t)
-@@ -270,17 +312,22 @@
+@@ -272,16 +312,62 @@
  dev_rw_sysfs(initrc_t)
  dev_list_usbfs(initrc_t)
  dev_read_framebuffer(initrc_t)
@@ -20091,21 +20588,52 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  dev_delete_generic_symlinks(initrc_t)
 +dev_getattr_all_blk_files(initrc_t)
 +dev_getattr_all_chr_files(initrc_t)
- 
++
 +fs_list_inotifyfs(initrc_t)
- fs_register_binary_executable_type(initrc_t)
- # rhgb-console writes to ramfs
- fs_write_ramfs_pipes(initrc_t)
-@@ -289,6 +336,8 @@
- fs_unmount_all_fs(initrc_t)
- fs_remount_all_fs(initrc_t)
- fs_getattr_all_fs(initrc_t)
++fs_register_binary_executable_type(initrc_t)
++# rhgb-console writes to ramfs
++fs_write_ramfs_pipes(initrc_t)
++# cjp: not sure why these are here; should use mount policy
++fs_mount_all_fs(initrc_t)
++fs_unmount_all_fs(initrc_t)
++fs_remount_all_fs(initrc_t)
++fs_getattr_all_fs(initrc_t)
 +fs_search_nfsd_fs(initrc_t)
 +fs_getattr_nfsd_files(initrc_t)
++
++# initrc_t needs to do a pidof which requires ptrace
++mcs_ptrace_all(initrc_t)
++mcs_killall(initrc_t)
++mcs_process_set_categories(initrc_t)
++
++mls_file_read_all_levels(initrc_t)
++mls_file_write_all_levels(initrc_t)
++mls_process_read_up(initrc_t)
++mls_process_write_down(initrc_t)
++mls_rangetrans_source(initrc_t)
++mls_fd_share_all_levels(initrc_t)
++
++selinux_get_enforce_mode(initrc_t)
++
++storage_getattr_fixed_disk_dev(initrc_t)
++storage_setattr_fixed_disk_dev(initrc_t)
++storage_setattr_removable_dev(initrc_t)
++
++term_use_all_terms(initrc_t)
++term_reset_tty_labels(initrc_t)
++
++auth_rw_login_records(initrc_t)
++auth_setattr_login_records(initrc_t)
++auth_rw_lastlog(initrc_t)
++auth_read_pam_pid(initrc_t)
++auth_delete_pam_pid(initrc_t)
++auth_delete_pam_console_data(initrc_t)
++
++corecmd_exec_all_executables(initrc_t)
  
- # initrc_t needs to do a pidof which requires ptrace
- mcs_ptrace_all(initrc_t)
-@@ -328,7 +377,7 @@
+ domain_kill_all_domains(initrc_t)
+ domain_signal_all_domains(initrc_t)
+@@ -291,7 +377,7 @@
  domain_sigchld_all_domains(initrc_t)
  domain_read_all_domains_state(initrc_t)
  domain_getattr_all_domains(initrc_t)
@@ -20114,7 +20642,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  domain_getsession_all_domains(initrc_t)
  domain_use_interactive_fds(initrc_t)
  # for lsof which is used by alsa shutdown:
-@@ -343,14 +392,15 @@
+@@ -306,14 +392,15 @@
  files_getattr_all_pipes(initrc_t)
  files_getattr_all_sockets(initrc_t)
  files_purge_tmp(initrc_t)
@@ -20132,7 +20660,47 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  files_exec_etc_files(initrc_t)
  files_read_usr_files(initrc_t)
  files_manage_urandom_seed(initrc_t)
-@@ -366,7 +416,9 @@
+@@ -325,47 +412,13 @@
+ files_list_default(initrc_t)
+ files_mounton_default(initrc_t)
+ 
+-fs_register_binary_executable_type(initrc_t)
+-# rhgb-console writes to ramfs
+-fs_write_ramfs_pipes(initrc_t)
+-# cjp: not sure why these are here; should use mount policy
+-fs_mount_all_fs(initrc_t)
+-fs_unmount_all_fs(initrc_t)
+-fs_remount_all_fs(initrc_t)
+-fs_getattr_all_fs(initrc_t)
+-
+-# initrc_t needs to do a pidof which requires ptrace
+-mcs_ptrace_all(initrc_t)
+-mcs_killall(initrc_t)
+-mcs_process_set_categories(initrc_t)
+-
+-mls_file_read_all_levels(initrc_t)
+-mls_file_write_all_levels(initrc_t)
+-mls_process_read_up(initrc_t)
+-mls_process_write_down(initrc_t)
+-mls_rangetrans_source(initrc_t)
+-mls_fd_share_all_levels(initrc_t)
+-
+-selinux_get_enforce_mode(initrc_t)
+-
+-storage_getattr_fixed_disk_dev(initrc_t)
+-storage_setattr_fixed_disk_dev(initrc_t)
+-storage_setattr_removable_dev(initrc_t)
+-
+-term_use_all_terms(initrc_t)
+-term_reset_tty_labels(initrc_t)
+-
+-auth_rw_login_records(initrc_t)
+-auth_setattr_login_records(initrc_t)
+-auth_rw_lastlog(initrc_t)
+-auth_read_pam_pid(initrc_t)
+-auth_delete_pam_pid(initrc_t)
+-auth_delete_pam_console_data(initrc_t)
+ auth_use_nsswitch(initrc_t)
  
  libs_rw_ld_so_cache(initrc_t)
  libs_exec_lib_files(initrc_t)
@@ -20142,7 +20710,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  logging_send_syslog_msg(initrc_t)
  logging_manage_generic_logs(initrc_t)
  logging_read_all_logs(initrc_t)
-@@ -423,8 +475,6 @@
+@@ -422,8 +475,6 @@
  	# init scripts touch this
  	clock_dontaudit_write_adjtime(initrc_t)
  
@@ -20151,7 +20719,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	# for integrated run_init to read run_init_type.
  	# happens during boot (/sbin/rc execs init scripts)
  	seutil_read_default_contexts(initrc_t)
-@@ -451,11 +501,9 @@
+@@ -450,11 +501,9 @@
  
  	# Red Hat systems seem to have a stray
  	# fd open from the initrd
@@ -20164,7 +20732,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	# These seem to be from the initrd
  	# during device initialization:
  	dev_create_generic_dirs(initrc_t)
-@@ -465,6 +513,7 @@
+@@ -464,6 +513,7 @@
  	storage_raw_read_fixed_disk(initrc_t)
  	storage_raw_write_fixed_disk(initrc_t)
  
@@ -20172,7 +20740,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	files_create_boot_flag(initrc_t)
  	files_rw_boot_symlinks(initrc_t)
  	# wants to read /.fonts directory
-@@ -498,6 +547,7 @@
+@@ -497,6 +547,7 @@
  	optional_policy(`
  		#for /etc/rc.d/init.d/nfs to create /etc/exports
  		rpc_write_exports(initrc_t)
@@ -20180,7 +20748,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	')
  
  	optional_policy(`
-@@ -516,6 +566,33 @@
+@@ -515,6 +566,33 @@
  	')
  ')
  
@@ -20214,7 +20782,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  optional_policy(`
  	amavis_search_lib(initrc_t)
  	amavis_setattr_pid_files(initrc_t)
-@@ -570,6 +647,10 @@
+@@ -569,6 +647,10 @@
  	dbus_read_config(initrc_t)
  
  	optional_policy(`
@@ -20225,7 +20793,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  		networkmanager_dbus_chat(initrc_t)
  	')
  ')
-@@ -591,6 +672,10 @@
+@@ -590,6 +672,10 @@
  ')
  
  optional_policy(`
@@ -20236,7 +20804,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	dev_read_usbfs(initrc_t)
  
  	# init scripts run /etc/hotplug/usb.rc
-@@ -647,20 +732,20 @@
+@@ -646,20 +732,20 @@
  ')
  
  optional_policy(`
@@ -20263,7 +20831,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  optional_policy(`
  	ifdef(`distro_redhat',`
-@@ -669,6 +754,7 @@
+@@ -668,6 +754,7 @@
  
  	mysql_stream_connect(initrc_t)
  	mysql_write_log(initrc_t)
@@ -20271,7 +20839,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -697,7 +783,6 @@
+@@ -696,7 +783,6 @@
  ')
  
  optional_policy(`
@@ -20279,7 +20847,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	fs_write_ramfs_sockets(initrc_t)
  	fs_search_ramfs(initrc_t)
  
-@@ -719,8 +804,6 @@
+@@ -718,8 +804,6 @@
  	# bash tries ioctl for some reason
  	files_dontaudit_ioctl_all_pids(initrc_t)
  
@@ -20288,7 +20856,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -733,10 +816,12 @@
+@@ -732,10 +816,12 @@
  	squid_manage_logs(initrc_t)
  ')
  
@@ -20301,7 +20869,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  optional_policy(`
  	ssh_dontaudit_read_server_keys(initrc_t)
-@@ -755,6 +840,15 @@
+@@ -754,6 +840,15 @@
  ')
  
  optional_policy(`
@@ -20317,7 +20885,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	unconfined_domain(initrc_t)
  
  	ifdef(`distro_redhat',`
-@@ -765,6 +859,13 @@
+@@ -764,6 +859,13 @@
  	optional_policy(`
  		mono_domtrans(initrc_t)
  	')
@@ -20331,7 +20899,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -790,3 +891,31 @@
+@@ -789,3 +891,31 @@
  optional_policy(`
  	zebra_read_config(initrc_t)
  ')
@@ -20363,18 +20931,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
 +	fail2ban_read_lib_files(daemon)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.fc serefpolicy-3.6.26/policy/modules/system/ipsec.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.fc serefpolicy-3.6.27/policy/modules/system/ipsec.fc
 --- nsaserefpolicy/policy/modules/system/ipsec.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/ipsec.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/ipsec.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,3 +1,5 @@
 +/etc/rc\.d/init\.d/ipsec	--	gen_context(system_u:object_r:ipsec_initrc_exec_t,s0)
 +
  /etc/ipsec\.secrets		--	gen_context(system_u:object_r:ipsec_key_file_t,s0)
  /etc/ipsec\.conf		--	gen_context(system_u:object_r:ipsec_conf_file_t,s0)
  /etc/racoon/psk\.txt		--	gen_context(system_u:object_r:ipsec_key_file_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.6.26/policy/modules/system/ipsec.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.6.27/policy/modules/system/ipsec.if
 --- nsaserefpolicy/policy/modules/system/ipsec.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/ipsec.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/ipsec.if	2009-08-14 16:51:06.000000000 -0400
 @@ -229,3 +229,28 @@
  	ipsec_domtrans_setkey($1)
  	role $2 types setkey_t;
@@ -20404,9 +20972,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	ipsec_domtrans_racoon($1)
 +	role $2 types racoon_t;
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.6.26/policy/modules/system/ipsec.te
---- nsaserefpolicy/policy/modules/system/ipsec.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/ipsec.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.6.27/policy/modules/system/ipsec.te
+--- nsaserefpolicy/policy/modules/system/ipsec.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/ipsec.te	2009-08-14 16:51:06.000000000 -0400
 @@ -15,6 +15,9 @@
  type ipsec_conf_file_t;
  files_type(ipsec_conf_file_t)
@@ -20453,15 +21021,48 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # a shell script, we need to find a way to make things work without
  # letting all sorts of stuff possibly be run...
  # so try flipping back into the ipsec_mgmt_t domain
-@@ -127,6 +132,8 @@
- domain_use_interactive_fds(ipsec_t)
+@@ -95,9 +100,6 @@
+ kernel_getattr_core_if(ipsec_t)
+ kernel_getattr_message_if(ipsec_t)
+ 
+-corecmd_exec_shell(ipsec_t)
+-corecmd_exec_bin(ipsec_t)
+-
+ # Pluto needs network access
+ corenet_all_recvfrom_unlabeled(ipsec_t)
+ corenet_tcp_sendrecv_all_if(ipsec_t)
+@@ -118,21 +120,26 @@
+ dev_read_rand(ipsec_t)
+ dev_read_urand(ipsec_t)
  
- files_read_etc_files(ipsec_t)
+-domain_use_interactive_fds(ipsec_t)
+-
+-files_read_etc_files(ipsec_t)
+-
+ fs_getattr_all_fs(ipsec_t)
+ fs_search_auto_mountpoints(ipsec_t)
+ 
+ term_use_console(ipsec_t)
+ term_dontaudit_use_all_user_ttys(ipsec_t)
+ 
+-auth_use_nsswitch(ipsec_t)
++corecmd_exec_shell(ipsec_t)
++corecmd_exec_bin(ipsec_t)
++
++domain_use_interactive_fds(ipsec_t)
++
++files_read_etc_files(ipsec_t)
 +files_read_usr_files(ipsec_t)
 +files_list_tmp(ipsec_t)
  
  init_use_fds(ipsec_t)
  init_use_script_ptys(ipsec_t)
+ 
++auth_use_nsswitch(ipsec_t)
++
+ logging_send_syslog_msg(ipsec_t)
+ 
+ miscfiles_read_localization(ipsec_t)
 @@ -154,12 +161,12 @@
  #
  
@@ -20477,6 +21078,44 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  allow ipsec_mgmt_t ipsec_mgmt_lock_t:file manage_file_perms;
  files_lock_filetrans(ipsec_mgmt_t, ipsec_mgmt_lock_t, file)
+@@ -209,15 +216,21 @@
+ files_read_kernel_symbol_table(ipsec_mgmt_t)
+ files_getattr_kernel_modules(ipsec_mgmt_t)
+ 
++dev_read_rand(ipsec_mgmt_t)
++dev_read_urand(ipsec_mgmt_t)
++
++fs_getattr_xattr_fs(ipsec_mgmt_t)
++fs_list_tmpfs(ipsec_mgmt_t)
++
++term_use_console(ipsec_mgmt_t)
++term_dontaudit_getattr_unallocated_ttys(ipsec_mgmt_t)
++
+ # the default updown script wants to run route
+ # the ipsec wrapper wants to run /usr/bin/logger (should we put
+ # it in its own domain?)
+ corecmd_exec_bin(ipsec_mgmt_t)
+ corecmd_exec_shell(ipsec_mgmt_t)
+ 
+-dev_read_rand(ipsec_mgmt_t)
+-dev_read_urand(ipsec_mgmt_t)
+-
+ domain_use_interactive_fds(ipsec_mgmt_t)
+ # denials when ps tries to search /proc. Do not audit these denials.
+ domain_dontaudit_list_all_domains_state(ipsec_mgmt_t)
+@@ -232,12 +245,6 @@
+ files_dontaudit_getattr_default_dirs(ipsec_mgmt_t)
+ files_dontaudit_getattr_default_files(ipsec_mgmt_t)
+ 
+-fs_getattr_xattr_fs(ipsec_mgmt_t)
+-fs_list_tmpfs(ipsec_mgmt_t)
+-
+-term_use_console(ipsec_mgmt_t)
+-term_dontaudit_getattr_unallocated_ttys(ipsec_mgmt_t)
+-
+ init_use_script_ptys(ipsec_mgmt_t)
+ init_exec_script_files(ipsec_mgmt_t)
+ init_use_fds(ipsec_mgmt_t)
 @@ -280,6 +287,7 @@
  allow racoon_t self:netlink_selinux_socket { bind create read };
  allow racoon_t self:udp_socket create_socket_perms;
@@ -20499,6 +21138,19 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  corenet_all_recvfrom_unlabeled(racoon_t)
  corenet_tcp_sendrecv_all_if(racoon_t)
  corenet_udp_sendrecv_all_if(racoon_t)
+@@ -317,10 +332,10 @@
+ # allow racoon to use avc_has_perm to check context on proposed SA
+ selinux_compute_access_vector(racoon_t)
+ 
+-auth_use_nsswitch(racoon_t)
+-
+ ipsec_setcontext_default_spd(racoon_t)
+ 
++auth_use_nsswitch(racoon_t)
++
+ locallogin_use_fds(racoon_t)
+ 
+ logging_send_syslog_msg(racoon_t)
 @@ -347,6 +362,7 @@
  files_read_etc_files(setkey_t)
  
@@ -20507,9 +21159,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  # allow setkey to set the context for ipsec SAs and policy.
  ipsec_setcontext_default_spd(setkey_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.fc serefpolicy-3.6.26/policy/modules/system/iptables.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.fc serefpolicy-3.6.27/policy/modules/system/iptables.fc
 --- nsaserefpolicy/policy/modules/system/iptables.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/iptables.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/iptables.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,9 +1,10 @@
 -/sbin/ip6tables.*	--	gen_context(system_u:object_r:iptables_exec_t,s0)
  /sbin/ipchains.*	--	gen_context(system_u:object_r:iptables_exec_t,s0)
@@ -20526,9 +21178,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/usr/sbin/iptables-multi 	--	gen_context(system_u:object_r:iptables_exec_t,s0)
  
 -/var/lib/shorewall(/.*)? --	gen_context(system_u:object_r:iptables_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.6.26/policy/modules/system/iptables.te
---- nsaserefpolicy/policy/modules/system/iptables.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/iptables.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.6.27/policy/modules/system/iptables.te
+--- nsaserefpolicy/policy/modules/system/iptables.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/iptables.te	2009-08-14 16:51:06.000000000 -0400
 @@ -53,6 +53,7 @@
  mls_file_read_all_levels(iptables_t)
  
@@ -20548,9 +21200,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	rhgb_dontaudit_use_ptys(iptables_t)
  ')
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.if serefpolicy-3.6.26/policy/modules/system/iscsi.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.if serefpolicy-3.6.27/policy/modules/system/iscsi.if
 --- nsaserefpolicy/policy/modules/system/iscsi.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/iscsi.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/iscsi.if	2009-08-14 16:51:06.000000000 -0400
 @@ -17,3 +17,43 @@
  
  	domtrans_pattern($1, iscsid_exec_t, iscsid_t)
@@ -20595,9 +21247,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	stream_connect_pattern($1,iscsi_var_lib_t,iscsi_var_lib_t,iscsid_t)
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.6.26/policy/modules/system/iscsi.te
---- nsaserefpolicy/policy/modules/system/iscsi.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/iscsi.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.6.27/policy/modules/system/iscsi.te
+--- nsaserefpolicy/policy/modules/system/iscsi.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/iscsi.te	2009-08-14 16:51:06.000000000 -0400
 @@ -55,6 +55,7 @@
  files_pid_filetrans(iscsid_t, iscsi_var_run_t, file)
  
@@ -20621,9 +21273,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
 -sysnet_dns_name_resolve(iscsid_t)
 +miscfiles_read_localization(iscsid_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.fc serefpolicy-3.6.26/policy/modules/system/kdump.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.fc serefpolicy-3.6.27/policy/modules/system/kdump.fc
 --- nsaserefpolicy/policy/modules/system/kdump.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/system/kdump.fc	2009-08-10 09:44:25.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/kdump.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,8 @@
 +
 +/etc/rc\.d/init\.d/kdump        --      gen_context(system_u:object_r:kdump_initrc_exec_t,s0)
@@ -20633,9 +21285,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +/etc/kdump\.conf                --      gen_context(system_u:object_r:kdump_etc_t,s0)
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.if serefpolicy-3.6.26/policy/modules/system/kdump.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.if serefpolicy-3.6.27/policy/modules/system/kdump.if
 --- nsaserefpolicy/policy/modules/system/kdump.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/system/kdump.if	2009-08-10 09:47:15.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/kdump.if	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,111 @@
 +## <summary>kdump is kernel crash dumping mechanism</summary>
 +
@@ -20748,9 +21400,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +        files_search_etc($1)
 +        admin_pattern($1, kdump_etc_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.te serefpolicy-3.6.26/policy/modules/system/kdump.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.te serefpolicy-3.6.27/policy/modules/system/kdump.te
 --- nsaserefpolicy/policy/modules/system/kdump.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.26/policy/modules/system/kdump.te	2009-08-10 09:44:25.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/kdump.te	2009-08-14 16:51:06.000000000 -0400
 @@ -0,0 +1,38 @@
 +policy_module(kdump,1.0.0)
 +
@@ -20790,9 +21442,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +permissive kdump_t;
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.6.26/policy/modules/system/libraries.fc
---- nsaserefpolicy/policy/modules/system/libraries.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/libraries.fc	2009-08-10 11:54:48.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.6.27/policy/modules/system/libraries.fc
+--- nsaserefpolicy/policy/modules/system/libraries.fc	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/libraries.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -60,12 +60,15 @@
  #
  # /opt
@@ -20961,17 +21613,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  # Jai, Sun Microsystems (Jpackage SPRM)
  /usr/lib(64)?/libmlib_jai\.so		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -268,6 +254,9 @@
+@@ -268,8 +254,8 @@
  /usr/lib(64)?/vmware/lib(/.*)?/HConfig\.so --	gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib(64)?/vmware/(.*/)?VmPerl\.so	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
  
+-# RPM Fusion, refpolicy ticket #48
+-/usr/lib(64)?/libavfilter.*\.so(\.[^/]*)* --	gen_context(system_u:object_r:textrel_shlib_t,s0)
 +/usr/lib(64)?/(virtualbox(-ose)?/)?(components/)?VBox.*\.so	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 +/usr/lib(64)?/virtualbox/.*\.so	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
-+
+ 
  # Java, Sun Microsystems (JPackage SRPM)
  /usr/(.*/)?jre.*/.*\.so(\.[^/]*)* --	gen_context(system_u:object_r:textrel_shlib_t,s0)
- /usr/local/(.*/)?jre.*/.*\.so(\.[^/]*)* --	gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -292,6 +281,8 @@
+@@ -295,6 +281,8 @@
  /usr/lib/acroread/(.*/)?lib/[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib/acroread/.+\.api		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib/acroread/(.*/)?ADMPlugin\.apl	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -20980,7 +21633,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ') dnl end distro_redhat
  
  #
-@@ -304,10 +295,91 @@
+@@ -307,10 +295,91 @@
  
  /var/mailman/pythonlib(/.*)?/.+\.so(\..*)? --	gen_context(system_u:object_r:lib_t,s0)
  
@@ -21072,9 +21725,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/usr/lib(64)?/xorg/modules/extensions/libglx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 +/usr/x11R6/lib/modules/extensions/libglx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.if serefpolicy-3.6.26/policy/modules/system/libraries.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.if serefpolicy-3.6.27/policy/modules/system/libraries.if
 --- nsaserefpolicy/policy/modules/system/libraries.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/libraries.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/libraries.if	2009-08-14 16:51:06.000000000 -0400
 @@ -247,7 +247,7 @@
  		type lib_t;
  	')
@@ -21093,9 +21746,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	allow $1 lib_t:dir list_dir_perms;
  	read_lnk_files_pattern($1, lib_t, { lib_t textrel_shlib_t })
  	mmap_files_pattern($1, lib_t, { lib_t textrel_shlib_t })
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.6.26/policy/modules/system/libraries.te
---- nsaserefpolicy/policy/modules/system/libraries.te	2009-07-30 09:44:08.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/libraries.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.6.27/policy/modules/system/libraries.te
+--- nsaserefpolicy/policy/modules/system/libraries.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/libraries.te	2009-08-14 16:51:06.000000000 -0400
 @@ -58,11 +58,11 @@
  # ldconfig local policy
  #
@@ -21149,10 +21802,23 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
 +	unconfined_domain(ldconfig_t) 
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.6.26/policy/modules/system/locallogin.te
---- nsaserefpolicy/policy/modules/system/locallogin.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/locallogin.te	2009-07-30 15:33:09.000000000 -0400
-@@ -67,6 +67,7 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.6.27/policy/modules/system/locallogin.te
+--- nsaserefpolicy/policy/modules/system/locallogin.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/locallogin.te	2009-08-14 16:51:06.000000000 -0400
+@@ -61,19 +61,13 @@
+ kernel_search_key(local_login_t)
+ kernel_link_key(local_login_t)
+ 
+-corecmd_list_bin(local_login_t)
+-corecmd_read_bin_symlinks(local_login_t)
+-# cjp: these are probably not needed:
+-corecmd_read_bin_files(local_login_t)
+-corecmd_read_bin_pipes(local_login_t)
+-corecmd_read_bin_sockets(local_login_t)
+-
+ dev_setattr_mouse_dev(local_login_t)
+ dev_getattr_mouse_dev(local_login_t)
+ dev_getattr_power_mgmt_dev(local_login_t)
  dev_setattr_power_mgmt_dev(local_login_t)
  dev_getattr_sound_dev(local_login_t)
  dev_setattr_sound_dev(local_login_t)
@@ -21160,6 +21826,55 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  dev_dontaudit_getattr_apm_bios_dev(local_login_t)
  dev_dontaudit_setattr_apm_bios_dev(local_login_t)
  dev_dontaudit_read_framebuffer(local_login_t)
+@@ -91,20 +85,6 @@
+ dev_dontaudit_getattr_video_dev(local_login_t)
+ dev_dontaudit_setattr_video_dev(local_login_t)
+ 
+-domain_read_all_entry_files(local_login_t)
+-
+-files_read_etc_files(local_login_t)
+-files_read_etc_runtime_files(local_login_t)
+-files_read_usr_files(local_login_t)
+-files_list_mnt(local_login_t)
+-files_list_world_readable(local_login_t)
+-files_read_world_readable_files(local_login_t)
+-files_read_world_readable_symlinks(local_login_t)
+-files_read_world_readable_pipes(local_login_t)
+-files_read_world_readable_sockets(local_login_t)
+-# for when /var/mail is a symlink
+-files_read_var_symlinks(local_login_t)
+-
+ fs_search_auto_mountpoints(local_login_t)
+ 
+ storage_dontaudit_getattr_fixed_disk_dev(local_login_t)
+@@ -125,6 +105,27 @@
+ auth_manage_pam_console_data(local_login_t)
+ auth_domtrans_pam_console(local_login_t)
+ 
++corecmd_list_bin(local_login_t)
++corecmd_read_bin_symlinks(local_login_t)
++# cjp: these are probably not needed:
++corecmd_read_bin_files(local_login_t)
++corecmd_read_bin_pipes(local_login_t)
++corecmd_read_bin_sockets(local_login_t)
++
++domain_read_all_entry_files(local_login_t)
++
++files_read_etc_files(local_login_t)
++files_read_etc_runtime_files(local_login_t)
++files_read_usr_files(local_login_t)
++files_list_mnt(local_login_t)
++files_list_world_readable(local_login_t)
++files_read_world_readable_files(local_login_t)
++files_read_world_readable_symlinks(local_login_t)
++files_read_world_readable_pipes(local_login_t)
++files_read_world_readable_sockets(local_login_t)
++# for when /var/mail is a symlink
++files_read_var_symlinks(local_login_t)
++
+ init_dontaudit_use_fds(local_login_t)
+ 
+ miscfiles_read_localization(local_login_t)
 @@ -152,6 +153,11 @@
  	fs_read_cifs_symlinks(local_login_t)
  ')
@@ -21189,12 +21904,22 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow sulogin_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
  allow sulogin_t self:fd use;
  allow sulogin_t self:fifo_file rw_file_perms;
-@@ -227,17 +234,28 @@
+@@ -219,8 +226,6 @@
+ # because file systems are not mounted:
+ files_dontaudit_search_isid_type_dirs(sulogin_t)
+ 
+-auth_read_shadow(sulogin_t)
+-
+ init_getpgid_script(sulogin_t)
+ 
+ logging_send_syslog_msg(sulogin_t)
+@@ -228,16 +233,29 @@
+ seutil_read_config(sulogin_t)
  seutil_read_default_contexts(sulogin_t)
  
- auth_read_shadow(sulogin_t)
++auth_read_shadow(sulogin_t)
 +auth_use_nsswitch(sulogin_t)
- 
++
  userdom_use_unpriv_users_fds(sulogin_t)
  
  userdom_search_user_home_dirs(sulogin_t)
@@ -21230,9 +21955,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -optional_policy(`
 -	nscd_socket_use(sulogin_t)
 -')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.6.26/policy/modules/system/logging.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.6.27/policy/modules/system/logging.fc
 --- nsaserefpolicy/policy/modules/system/logging.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/logging.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/logging.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -53,15 +53,18 @@
  /var/named/chroot/var/log -d	gen_context(system_u:object_r:var_log_t,s0)
  ')
@@ -21256,9 +21981,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  /var/tinydns/log/main(/.*)?	gen_context(system_u:object_r:var_log_t,s0)
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.6.26/policy/modules/system/logging.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.6.27/policy/modules/system/logging.if
 --- nsaserefpolicy/policy/modules/system/logging.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/logging.if	2009-08-12 15:17:48.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/logging.if	2009-08-14 16:51:06.000000000 -0400
 @@ -623,7 +623,7 @@
  	')
  
@@ -21277,9 +22002,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  ########################################
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.6.26/policy/modules/system/logging.te
---- nsaserefpolicy/policy/modules/system/logging.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/logging.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.6.27/policy/modules/system/logging.te
+--- nsaserefpolicy/policy/modules/system/logging.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/logging.te	2009-08-14 16:51:06.000000000 -0400
 @@ -126,7 +126,7 @@
  allow auditd_t self:process { signal_perms setpgid setsched };
  allow auditd_t self:file rw_file_perms;
@@ -21372,9 +22097,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow syslogd_t self:udp_socket create_socket_perms;
  allow syslogd_t self:tcp_socket create_stream_socket_perms;
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.6.26/policy/modules/system/lvm.te
---- nsaserefpolicy/policy/modules/system/lvm.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/lvm.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.6.27/policy/modules/system/lvm.te
+--- nsaserefpolicy/policy/modules/system/lvm.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/lvm.te	2009-08-14 16:51:06.000000000 -0400
 @@ -10,6 +10,9 @@
  type clvmd_exec_t;
  init_daemon_domain(clvmd_t, clvmd_exec_t)
@@ -21402,31 +22127,56 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow lvm_t self:unix_dgram_socket create_socket_perms;
  allow lvm_t self:netlink_kobject_uevent_socket create_socket_perms;
  
-@@ -214,6 +218,7 @@
+@@ -214,9 +218,14 @@
  # it has no reason to need this
  kernel_dontaudit_getattr_core_if(lvm_t)
  kernel_use_fds(lvm_t)
 +kernel_search_debugfs(lvm_t)
  
- selinux_get_fs_mount(lvm_t)
- selinux_validate_context(lvm_t)
-@@ -243,6 +248,7 @@
+-corecmd_exec_bin(lvm_t)
+-corecmd_exec_shell(lvm_t)
++selinux_get_fs_mount(lvm_t)
++selinux_validate_context(lvm_t)
++selinux_compute_access_vector(lvm_t)
++selinux_compute_create_context(lvm_t)
++selinux_compute_relabel_context(lvm_t)
++selinux_compute_user_contexts(lvm_t)
+ 
+ dev_create_generic_chr_files(lvm_t)
+ dev_delete_generic_dirs(lvm_t)
+@@ -239,15 +248,7 @@
  dev_dontaudit_getattr_generic_blk_files(lvm_t)
  dev_dontaudit_getattr_generic_pipes(lvm_t)
  dev_create_generic_dirs(lvm_t)
+-
+-domain_use_interactive_fds(lvm_t)
+-domain_read_all_domains_state(lvm_t)
+-
+-files_read_usr_files(lvm_t)
+-files_read_etc_files(lvm_t)
+-files_read_etc_runtime_files(lvm_t)
+-# for when /usr is not mounted:
+-files_dontaudit_search_isid_type_dirs(lvm_t)
 +dev_rw_generic_files(lvm_t)
  
  fs_getattr_xattr_fs(lvm_t)
  fs_search_auto_mountpoints(lvm_t)
-@@ -250,6 +256,7 @@
+@@ -255,13 +256,7 @@
  fs_read_tmpfs_symlinks(lvm_t)
  fs_dontaudit_read_removable_files(lvm_t)
  fs_dontaudit_getattr_tmpfs_files(lvm_t)
+-
+-selinux_get_fs_mount(lvm_t)
+-selinux_validate_context(lvm_t)
+-selinux_compute_access_vector(lvm_t)
+-selinux_compute_create_context(lvm_t)
+-selinux_compute_relabel_context(lvm_t)
+-selinux_compute_user_contexts(lvm_t)
 +fs_rw_anon_inodefs_files(lvm_t)
  
  storage_relabel_fixed_disk(lvm_t)
  storage_dontaudit_read_removable_device(lvm_t)
-@@ -261,6 +268,10 @@
+@@ -273,10 +268,28 @@
  storage_dev_filetrans_fixed_disk(lvm_t)
  # Access raw devices and old /dev/lvm (c 109,0).  Is this needed?
  storage_manage_fixed_disk(lvm_t)
@@ -21434,13 +22184,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +mls_file_write_to_clearance(lvm_t)
 +
 +term_use_all_terms(lvm_t)
- 
- corecmd_exec_bin(lvm_t)
- corecmd_exec_shell(lvm_t)
-@@ -273,10 +284,12 @@
- files_read_etc_runtime_files(lvm_t)
- # for when /usr is not mounted:
- files_dontaudit_search_isid_type_dirs(lvm_t)
++
++corecmd_exec_bin(lvm_t)
++corecmd_exec_shell(lvm_t)
++
++domain_use_interactive_fds(lvm_t)
++domain_read_all_domains_state(lvm_t)
++
++files_read_usr_files(lvm_t)
++files_read_etc_files(lvm_t)
++files_read_etc_runtime_files(lvm_t)
++# for when /usr is not mounted:
++files_dontaudit_search_isid_type_dirs(lvm_t)
 +files_dontaudit_getattr_tmpfs_files(lvm_t)
  
  init_use_fds(lvm_t)
@@ -21461,9 +22216,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  optional_policy(`
  	modutils_domtrans_insmod(lvm_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.6.26/policy/modules/system/miscfiles.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.6.27/policy/modules/system/miscfiles.if
 --- nsaserefpolicy/policy/modules/system/miscfiles.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/miscfiles.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/miscfiles.if	2009-08-14 16:51:06.000000000 -0400
 @@ -87,6 +87,25 @@
  
  ########################################
@@ -21490,10 +22245,62 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	Do not audit attempts to write fonts.
  ## </summary>
  ## <param name="domain">
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.6.26/policy/modules/system/modutils.te
---- nsaserefpolicy/policy/modules/system/modutils.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/modutils.te	2009-07-30 15:33:09.000000000 -0400
-@@ -42,7 +42,7 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.6.27/policy/modules/system/modutils.te
+--- nsaserefpolicy/policy/modules/system/modutils.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/modutils.te	2009-08-14 16:51:06.000000000 -0400
+@@ -39,59 +39,10 @@
+ 
+ ########################################
+ #
+-# depmod local policy
+-#
+-
+-can_exec(depmod_t, depmod_exec_t)
+-
+-# Read conf.modules.
+-allow depmod_t modules_conf_t:file read_file_perms;
+-
+-allow depmod_t modules_dep_t:file manage_file_perms;
+-files_kernel_modules_filetrans(depmod_t, modules_dep_t, file)
+-
+-kernel_read_system_state(depmod_t)
+-
+-corecmd_search_bin(depmod_t)
+-
+-domain_use_interactive_fds(depmod_t)
+-
+-files_read_kernel_symbol_table(depmod_t)
+-files_read_kernel_modules(depmod_t)
+-files_read_etc_runtime_files(depmod_t)
+-files_read_etc_files(depmod_t)
+-files_read_usr_src_files(depmod_t)
+-files_list_usr(depmod_t)
+-
+-fs_getattr_xattr_fs(depmod_t)
+-
+-term_use_console(depmod_t)
+-
+-init_use_fds(depmod_t)
+-init_use_script_fds(depmod_t)
+-init_use_script_ptys(depmod_t)
+-
+-userdom_use_user_terminals(depmod_t)
+-# Read System.map from home directories.
+-files_list_home(depmod_t)
+-userdom_read_user_home_content_files(depmod_t)
+-
+-ifdef(`distro_ubuntu',`
+-	optional_policy(`
+-		unconfined_domain(depmod_t)
+-	')
+-')
+-
+-optional_policy(`
+-	rpm_rw_pipes(depmod_t)
+-')
+-
+-########################################
+-#
  # insmod local policy
  #
  
@@ -21502,7 +22309,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
  
  allow insmod_t self:udp_socket create_socket_perms; 
-@@ -55,6 +55,7 @@
+@@ -104,6 +55,7 @@
  
  kernel_load_module(insmod_t)
  kernel_read_system_state(insmod_t)
@@ -21510,15 +22317,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  kernel_write_proc_files(insmod_t)
  kernel_mount_debugfs(insmod_t)
  kernel_mount_kvmfs(insmod_t)
-@@ -63,6 +64,7 @@
+@@ -112,9 +64,11 @@
  kernel_read_kernel_sysctls(insmod_t)
  kernel_rw_kernel_sysctl(insmod_t)
  kernel_read_hotplug_sysctls(insmod_t)
 +kernel_setsched(insmod_t)
  
- files_read_kernel_modules(insmod_t)
- # for locking: (cjp: ????)
-@@ -76,11 +78,10 @@
+-corecmd_exec_bin(insmod_t)
+-corecmd_exec_shell(insmod_t)
++files_read_kernel_modules(insmod_t)
++# for locking: (cjp: ????)
++files_write_kernel_modules(insmod_t)
+ 
+ dev_rw_sysfs(insmod_t)
+ dev_search_usbfs(insmod_t)
+@@ -124,14 +78,17 @@
  dev_read_sound(insmod_t)
  dev_write_sound(insmod_t)
  dev_rw_apm_bios(insmod_t)
@@ -21526,13 +22339,30 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -# and it also transitions to mount
 -dev_mount_usbfs(insmod_t)
 +dev_create_generic_chr_files(insmod_t)
- 
- fs_getattr_xattr_fs(insmod_t)
++
++fs_getattr_xattr_fs(insmod_t)
 +fs_dontaudit_use_tmpfs_chr_dev(insmod_t)
++
++corecmd_exec_bin(insmod_t)
++corecmd_exec_shell(insmod_t)
+ 
+ domain_signal_all_domains(insmod_t)
+ domain_use_interactive_fds(insmod_t)
  
- corecmd_exec_bin(insmod_t)
- corecmd_exec_shell(insmod_t)
-@@ -101,6 +102,8 @@
+-files_read_kernel_modules(insmod_t)
+ files_read_etc_runtime_files(insmod_t)
+ files_read_etc_files(insmod_t)
+ files_read_usr_files(insmod_t)
+@@ -140,15 +97,13 @@
+ files_dontaudit_search_pids(insmod_t)
+ # for when /var is not mounted early in the boot:
+ files_dontaudit_search_isid_type_dirs(insmod_t)
+-# for locking: (cjp: ????)
+-files_write_kernel_modules(insmod_t)
+-
+-fs_getattr_xattr_fs(insmod_t)
+ 
+ init_rw_initctl(insmod_t)
  init_use_fds(insmod_t)
  init_use_script_fds(insmod_t)
  init_use_script_ptys(insmod_t)
@@ -21541,7 +22371,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  logging_send_syslog_msg(insmod_t)
  logging_search_logs(insmod_t)
-@@ -109,19 +112,30 @@
+@@ -157,19 +112,30 @@
  
  seutil_read_file_contexts(insmod_t)
  
@@ -21575,31 +22405,107 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	hotplug_search_config(insmod_t)
  ')
  
-@@ -184,6 +198,7 @@
- 
- files_read_kernel_symbol_table(depmod_t)
- files_read_kernel_modules(depmod_t)
-+files_delete_kernel_modules(depmod_t)
- 
- fs_getattr_xattr_fs(depmod_t)
- 
-@@ -214,7 +229,13 @@
+@@ -215,6 +181,63 @@
+ 	xserver_getattr_log(insmod_t)
  ')
  
- optional_policy(`
++########################################
++#
++# depmod local policy
++#
++
++can_exec(depmod_t, depmod_exec_t)
++
++# Read conf.modules.
++allow depmod_t modules_conf_t:file read_file_perms;
++
++allow depmod_t modules_dep_t:file manage_file_perms;
++files_kernel_modules_filetrans(depmod_t, modules_dep_t, file)
++
++kernel_read_system_state(depmod_t)
++
++files_read_kernel_symbol_table(depmod_t)
++files_read_kernel_modules(depmod_t)
++files_delete_kernel_modules(depmod_t)
++
++fs_getattr_xattr_fs(depmod_t)
++
++term_use_console(depmod_t)
++
++corecmd_search_bin(depmod_t)
++
++domain_use_interactive_fds(depmod_t)
++
++init_use_fds(depmod_t)
++init_use_script_fds(depmod_t)
++init_use_script_ptys(depmod_t)
++
++files_read_etc_runtime_files(depmod_t)
++files_read_etc_files(depmod_t)
++files_read_usr_src_files(depmod_t)
++files_list_usr(depmod_t)
++
++userdom_use_user_terminals(depmod_t)
++# Read System.map from home directories.
++files_list_home(depmod_t)
++userdom_read_user_home_content_files(depmod_t)
++
++ifdef(`distro_ubuntu',`
++	optional_policy(`
++		unconfined_domain(depmod_t)
++	')
++')
++
++optional_policy(`
 +	# Read System.map from home directories.
 +	unconfined_domain(depmod_t)
 +')
 +
 +optional_policy(`
- 	rpm_rw_pipes(depmod_t)
++	rpm_rw_pipes(depmod_t)
 +	rpm_manage_script_tmp_files(depmod_t)
- ')
- 
++')
++
  #################################
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.6.26/policy/modules/system/mount.fc
+ #
+ # update-modules local policy
+@@ -246,17 +269,8 @@
+ kernel_read_kernel_sysctls(update_modules_t)
+ kernel_read_system_state(update_modules_t)
+ 
+-corecmd_exec_bin(update_modules_t)
+-corecmd_exec_shell(update_modules_t)
+-
+ dev_read_urand(update_modules_t)
+ 
+-domain_use_interactive_fds(update_modules_t)
+-
+-files_read_etc_runtime_files(update_modules_t)
+-files_read_etc_files(update_modules_t)
+-files_exec_etc_files(update_modules_t)
+-
+ fs_getattr_xattr_fs(update_modules_t)
+ 
+ term_use_console(update_modules_t)
+@@ -265,6 +279,15 @@
+ init_use_script_fds(update_modules_t)
+ init_use_script_ptys(update_modules_t)
+ 
++domain_use_interactive_fds(update_modules_t)
++
++files_read_etc_runtime_files(update_modules_t)
++files_read_etc_files(update_modules_t)
++files_exec_etc_files(update_modules_t)
++
++corecmd_exec_bin(update_modules_t)
++corecmd_exec_shell(update_modules_t)
++
+ logging_send_syslog_msg(update_modules_t)
+ 
+ miscfiles_read_localization(update_modules_t)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.6.27/policy/modules/system/mount.fc
 --- nsaserefpolicy/policy/modules/system/mount.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/mount.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/mount.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,4 +1,9 @@
  /bin/mount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
  /bin/umount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
@@ -21611,9 +22517,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +/var/cache/davfs2(/.*)?		gen_context(system_u:object_r:mount_var_run_t,s0)
 +/var/run/davfs2(/.*)?		gen_context(system_u:object_r:mount_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.6.26/policy/modules/system/mount.te
---- nsaserefpolicy/policy/modules/system/mount.te	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/mount.te	2009-08-10 10:06:05.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.6.27/policy/modules/system/mount.te
+--- nsaserefpolicy/policy/modules/system/mount.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/mount.te	2009-08-14 16:51:06.000000000 -0400
 @@ -18,8 +18,12 @@
  init_system_domain(mount_t, mount_exec_t)
  role system_r types mount_t;
@@ -21651,7 +22557,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  allow mount_t mount_loopback_t:file read_file_perms;
  
-@@ -47,12 +59,26 @@
+@@ -47,21 +59,56 @@
  
  files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
  
@@ -21666,6 +22572,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +kernel_read_network_state(mount_t)
  kernel_read_kernel_sysctls(mount_t)
  kernel_dontaudit_getattr_core_if(mount_t)
+-
+-# required for mount.smbfs
+-corecmd_exec_bin(mount_t)
 +kernel_search_debugfs(mount_t)
 +kernel_setsched(mount_t)
 +kernel_use_fds(mount_t)
@@ -21678,38 +22587,37 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  dev_rw_lvm_control(mount_t)
  dev_dontaudit_getattr_all_chr_files(mount_t)
  dev_dontaudit_getattr_memory_dev(mount_t)
-@@ -62,16 +88,19 @@
- storage_raw_write_fixed_disk(mount_t)
- storage_raw_read_removable_device(mount_t)
- storage_raw_write_removable_device(mount_t)
-+storage_rw_fuse(mount_t)
+ dev_getattr_sound_dev(mount_t)
  
--fs_getattr_xattr_fs(mount_t)
--fs_getattr_cifs(mount_t)
++storage_raw_read_fixed_disk(mount_t)
++storage_raw_write_fixed_disk(mount_t)
++storage_raw_read_removable_device(mount_t)
++storage_raw_write_removable_device(mount_t)
++storage_rw_fuse(mount_t)
++
 +fs_list_all(mount_t)
 +fs_getattr_all_fs(mount_t)
- fs_mount_all_fs(mount_t)
- fs_unmount_all_fs(mount_t)
- fs_remount_all_fs(mount_t)
- fs_relabelfrom_all_fs(mount_t)
--fs_list_auto_mountpoints(mount_t)
- fs_rw_tmpfs_chr_files(mount_t)
++fs_mount_all_fs(mount_t)
++fs_unmount_all_fs(mount_t)
++fs_remount_all_fs(mount_t)
++fs_relabelfrom_all_fs(mount_t)
++fs_rw_tmpfs_chr_files(mount_t)
 +fs_manage_tmpfs_dirs(mount_t)
- fs_read_tmpfs_symlinks(mount_t)
++fs_read_tmpfs_symlinks(mount_t)
 +fs_read_fusefs_files(mount_t)
 +fs_manage_nfs_dirs(mount_t)
- 
- term_use_all_terms(mount_t)
- 
-@@ -79,6 +108,7 @@
- corecmd_exec_bin(mount_t)
- 
++
++term_use_all_terms(mount_t)
++
++# required for mount.smbfs
++corecmd_exec_bin(mount_t)
++
  domain_use_interactive_fds(mount_t)
 +domain_dontaudit_search_all_domains_state(mount_t)
  
  files_search_all(mount_t)
  files_read_etc_files(mount_t)
-@@ -87,7 +117,7 @@
+@@ -70,7 +117,7 @@
  files_mounton_all_mountpoints(mount_t)
  files_unmount_rootfs(mount_t)
  # These rules need to be generalized.  Only admin, initrc should have it:
@@ -21718,16 +22626,52 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  files_mount_all_file_type_fs(mount_t)
  files_unmount_all_file_type_fs(mount_t)
  # for when /etc/mtab loses its type
-@@ -100,6 +130,8 @@
+@@ -80,43 +127,28 @@
+ files_read_usr_files(mount_t)
+ files_list_mnt(mount_t)
+ 
+-fs_getattr_xattr_fs(mount_t)
+-fs_getattr_cifs(mount_t)
+-fs_mount_all_fs(mount_t)
+-fs_unmount_all_fs(mount_t)
+-fs_remount_all_fs(mount_t)
+-fs_relabelfrom_all_fs(mount_t)
+-fs_list_auto_mountpoints(mount_t)
+-fs_rw_tmpfs_chr_files(mount_t)
+-fs_read_tmpfs_symlinks(mount_t)
+-
+-mls_file_read_all_levels(mount_t)
+-mls_file_write_all_levels(mount_t)
+-
+-selinux_get_enforce_mode(mount_t)
+-
+-storage_raw_read_fixed_disk(mount_t)
+-storage_raw_write_fixed_disk(mount_t)
+-storage_raw_read_removable_device(mount_t)
+-storage_raw_write_removable_device(mount_t)
+-
+-term_use_all_terms(mount_t)
+-
+-auth_use_nsswitch(mount_t)
+-
  init_use_fds(mount_t)
  init_use_script_ptys(mount_t)
  init_dontaudit_getattr_initctl(mount_t)
 +init_stream_connect_script(mount_t)
 +init_rw_script_stream_sockets(mount_t)
++
++auth_use_nsswitch(mount_t)
+ 
+ logging_send_syslog_msg(mount_t)
  
- auth_use_nsswitch(mount_t)
+ miscfiles_read_localization(mount_t)
  
-@@ -116,6 +148,7 @@
++mls_file_read_all_levels(mount_t)
++mls_file_write_all_levels(mount_t)
++
+ sysnet_use_portmap(mount_t)
+ 
++selinux_get_enforce_mode(mount_t)
  seutil_read_config(mount_t)
  
  userdom_use_all_users_fds(mount_t)
@@ -21735,7 +22679,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  ifdef(`distro_redhat',`
  	optional_policy(`
-@@ -131,9 +164,13 @@
+@@ -132,9 +164,13 @@
  	')
  ')
  
@@ -21750,7 +22694,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	files_mounton_non_security(mount_t)
  ')
  
-@@ -164,6 +201,8 @@
+@@ -165,6 +201,8 @@
  	fs_search_rpc(mount_t)
  
  	rpc_stub(mount_t)
@@ -21759,7 +22703,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -171,6 +210,21 @@
+@@ -172,6 +210,21 @@
  ')
  
  optional_policy(`
@@ -21781,7 +22725,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	ifdef(`hide_broken_symptoms',`
  		# for a bug in the X server
  		rhgb_dontaudit_rw_stream_sockets(mount_t)
-@@ -178,6 +232,11 @@
+@@ -179,6 +232,11 @@
  	')
  ')
  
@@ -21793,7 +22737,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # for kernel package installation
  optional_policy(`
  	rpm_rw_pipes(mount_t)
-@@ -185,6 +244,7 @@
+@@ -186,6 +244,7 @@
  
  optional_policy(`
  	samba_domtrans_smbmount(mount_t)
@@ -21801,7 +22745,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  ########################################
-@@ -194,5 +254,8 @@
+@@ -195,5 +254,8 @@
  
  optional_policy(`
  	files_etc_filetrans_etc_runtime(unconfined_mount_t, file)
@@ -21811,9 +22755,110 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	rpc_domtrans_rpcd(unconfined_mount_t)
  ')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.6.26/policy/modules/system/selinuxutil.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/pcmcia.te serefpolicy-3.6.27/policy/modules/system/pcmcia.te
+--- nsaserefpolicy/policy/modules/system/pcmcia.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/pcmcia.te	2009-08-14 16:51:06.000000000 -0400
+@@ -51,7 +51,7 @@
+ kernel_read_kernel_sysctls(cardmgr_t)
+ kernel_dontaudit_getattr_message_if(cardmgr_t)
+ 
+-corecmd_exec_all_executables(cardmgr_t)
++files_search_kernel_modules(cardmgr_t)
+ 
+ dev_read_sysfs(cardmgr_t)
+ dev_manage_cardmgr_dev(cardmgr_t)
+@@ -61,6 +61,15 @@
+ # for SSP
+ dev_read_urand(cardmgr_t)
+ 
++fs_getattr_all_fs(cardmgr_t)
++fs_search_auto_mountpoints(cardmgr_t)
++
++term_use_unallocated_ttys(cardmgr_t)
++term_getattr_all_user_ttys(cardmgr_t)
++term_dontaudit_getattr_all_user_ptys(cardmgr_t)
++
++corecmd_exec_all_executables(cardmgr_t)
++
+ domain_use_interactive_fds(cardmgr_t)
+ # Read /proc/PID directories for all domains (for fuser).
+ domain_read_confined_domains_state(cardmgr_t)
+@@ -70,7 +79,6 @@
+ domain_dontaudit_getattr_all_pipes(cardmgr_t)
+ domain_dontaudit_getattr_all_sockets(cardmgr_t)
+ 
+-files_search_kernel_modules(cardmgr_t)
+ files_list_usr(cardmgr_t)
+ files_search_home(cardmgr_t)
+ files_read_etc_runtime_files(cardmgr_t)
+@@ -85,13 +93,6 @@
+ files_dontaudit_getattr_all_pipes(cardmgr_t)
+ files_dontaudit_getattr_all_sockets(cardmgr_t)
+ 
+-fs_getattr_all_fs(cardmgr_t)
+-fs_search_auto_mountpoints(cardmgr_t)
+-
+-term_use_unallocated_ttys(cardmgr_t)
+-term_getattr_all_user_ttys(cardmgr_t)
+-term_dontaudit_getattr_all_user_ptys(cardmgr_t)
+-
+ libs_exec_ld_so(cardmgr_t)
+ libs_exec_lib_files(cardmgr_t)
+ 
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.6.27/policy/modules/system/raid.te
+--- nsaserefpolicy/policy/modules/system/raid.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/raid.te	2009-08-14 16:51:06.000000000 -0400
+@@ -32,10 +32,6 @@
+ kernel_rw_software_raid_state(mdadm_t)
+ kernel_getattr_core_if(mdadm_t)
+ 
+-# Helper program access
+-corecmd_exec_bin(mdadm_t)
+-corecmd_exec_shell(mdadm_t)
+-
+ dev_read_sysfs(mdadm_t)
+ # Ignore attempts to read every device file
+ dev_dontaudit_getattr_all_blk_files(mdadm_t)
+@@ -45,24 +41,28 @@
+ dev_dontaudit_getattr_generic_blk_files(mdadm_t)
+ dev_read_realtime_clock(mdadm_t)
+ 
+-domain_use_interactive_fds(mdadm_t)
+-
+-files_read_etc_files(mdadm_t)
+-files_read_etc_runtime_files(mdadm_t)
+-
+ fs_search_auto_mountpoints(mdadm_t)
+ fs_dontaudit_list_tmpfs(mdadm_t)
+ 
+-mls_file_read_all_levels(mdadm_t)
+-mls_file_write_all_levels(mdadm_t)
+-
+ # RAID block device access
+ storage_manage_fixed_disk(mdadm_t)
+ storage_dev_filetrans_fixed_disk(mdadm_t)
+ storage_read_scsi_generic(mdadm_t)
+ 
++mls_file_read_all_levels(mdadm_t)
++mls_file_write_all_levels(mdadm_t)
++
+ term_dontaudit_list_ptys(mdadm_t)
+ 
++# Helper program access
++corecmd_exec_bin(mdadm_t)
++corecmd_exec_shell(mdadm_t)
++
++domain_use_interactive_fds(mdadm_t)
++
++files_read_etc_files(mdadm_t)
++files_read_etc_runtime_files(mdadm_t)
++
+ init_dontaudit_getattr_initctl(mdadm_t)
+ 
+ logging_send_syslog_msg(mdadm_t)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.6.27/policy/modules/system/selinuxutil.fc
 --- nsaserefpolicy/policy/modules/system/selinuxutil.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/selinuxutil.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/selinuxutil.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -6,13 +6,13 @@
  /etc/selinux(/.*)?			gen_context(system_u:object_r:selinux_config_t,s0)
  /etc/selinux/([^/]*/)?contexts(/.*)?	gen_context(system_u:object_r:default_context_t,s0)
@@ -21852,9 +22897,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +/etc/share/selinux/targeted(/.*)?	gen_context(system_u:object_r:semanage_store_t,s0)
 +/etc/share/selinux/mls(/.*)?		gen_context(system_u:object_r:semanage_store_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.6.26/policy/modules/system/selinuxutil.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.6.27/policy/modules/system/selinuxutil.if
 --- nsaserefpolicy/policy/modules/system/selinuxutil.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/selinuxutil.if	2009-07-30 15:35:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/selinuxutil.if	2009-08-14 16:51:06.000000000 -0400
 @@ -535,6 +535,53 @@
  
  ########################################
@@ -22182,9 +23227,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	hotplug_use_fds($1)
 +')
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.6.26/policy/modules/system/selinuxutil.te
---- nsaserefpolicy/policy/modules/system/selinuxutil.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/selinuxutil.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.6.27/policy/modules/system/selinuxutil.te
+--- nsaserefpolicy/policy/modules/system/selinuxutil.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/selinuxutil.te	2009-08-14 16:51:06.000000000 -0400
 @@ -23,6 +23,9 @@
  type selinux_config_t;
  files_type(selinux_config_t)
@@ -22544,9 +23589,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -	hotplug_use_fds(setfiles_t)
 +	unconfined_domain(setfiles_mac_t)
  ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/setrans.if serefpolicy-3.6.26/policy/modules/system/setrans.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/setrans.if serefpolicy-3.6.27/policy/modules/system/setrans.if
 --- nsaserefpolicy/policy/modules/system/setrans.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/setrans.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/setrans.if	2009-08-14 16:51:06.000000000 -0400
 @@ -21,3 +21,23 @@
  	stream_connect_pattern($1, setrans_var_run_t, setrans_var_run_t, setrans_t)
  	files_list_pids($1)
@@ -22571,9 +23616,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	init_labeled_script_domtrans($1, setrans_initrc_exec_t)
 +')
 +
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.fc serefpolicy-3.6.26/policy/modules/system/sysnetwork.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.fc serefpolicy-3.6.27/policy/modules/system/sysnetwork.fc
 --- nsaserefpolicy/policy/modules/system/sysnetwork.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/sysnetwork.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/sysnetwork.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -11,15 +11,20 @@
  /etc/dhclient-script	--	gen_context(system_u:object_r:dhcp_etc_t,s0)
  /etc/dhcpc.*			gen_context(system_u:object_r:dhcp_etc_t,s0)
@@ -22602,9 +23647,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
 +
 +/etc/firestarter/firestarter\.sh gen_context(system_u:object_r:dhcpc_helper_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.6.26/policy/modules/system/sysnetwork.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.6.27/policy/modules/system/sysnetwork.if
 --- nsaserefpolicy/policy/modules/system/sysnetwork.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/sysnetwork.if	2009-08-13 12:00:25.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/sysnetwork.if	2009-08-14 16:51:06.000000000 -0400
 @@ -43,6 +43,39 @@
  
  	sysnet_domtrans_dhcpc($1)
@@ -22782,9 +23827,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +	role_transition $1 dhcpc_exec_t system_r;
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.6.26/policy/modules/system/sysnetwork.te
---- nsaserefpolicy/policy/modules/system/sysnetwork.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/sysnetwork.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.6.27/policy/modules/system/sysnetwork.te
+--- nsaserefpolicy/policy/modules/system/sysnetwork.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/sysnetwork.te	2009-08-14 16:51:06.000000000 -0400
 @@ -20,6 +20,9 @@
  init_daemon_domain(dhcpc_t, dhcpc_exec_t)
  role system_r types dhcpc_t;
@@ -22832,21 +23877,53 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  files_etc_filetrans(dhcpc_t, net_conf_t, file)
  
  # create temp files
-@@ -115,11 +121,13 @@
- corecmd_exec_bin(dhcpc_t)
- corecmd_exec_shell(dhcpc_t)
+@@ -83,9 +89,6 @@
+ kernel_read_kernel_sysctls(dhcpc_t)
+ kernel_use_fds(dhcpc_t)
  
-+domain_obj_id_change_exemption(dhcpc_t)
- domain_use_interactive_fds(dhcpc_t)
+-corecmd_exec_bin(dhcpc_t)
+-corecmd_exec_shell(dhcpc_t)
+-
+ corenet_all_recvfrom_unlabeled(dhcpc_t)
+ corenet_all_recvfrom_netlabel(dhcpc_t)
+ corenet_tcp_sendrecv_all_if(dhcpc_t)
+@@ -107,15 +110,6 @@
+ # for SSP:
+ dev_read_urand(dhcpc_t)
+ 
+-domain_use_interactive_fds(dhcpc_t)
 -domain_dontaudit_list_all_domains_state(dhcpc_t)
-+domain_dontaudit_read_all_domains_state(dhcpc_t)
+-
+-files_read_etc_files(dhcpc_t)
+-files_read_etc_runtime_files(dhcpc_t)
+-files_search_home(dhcpc_t)
+-files_search_var_lib(dhcpc_t)
+-files_dontaudit_search_locks(dhcpc_t)
+-
+ fs_getattr_all_fs(dhcpc_t)
+ fs_search_auto_mountpoints(dhcpc_t)
+ 
+@@ -124,6 +118,20 @@
+ term_dontaudit_use_unallocated_ttys(dhcpc_t)
+ term_dontaudit_use_generic_ptys(dhcpc_t)
  
- files_read_etc_files(dhcpc_t)
- files_read_etc_runtime_files(dhcpc_t)
++corecmd_exec_bin(dhcpc_t)
++corecmd_exec_shell(dhcpc_t)
++
++domain_obj_id_change_exemption(dhcpc_t)
++domain_use_interactive_fds(dhcpc_t)
++domain_dontaudit_read_all_domains_state(dhcpc_t)
++
++files_read_etc_files(dhcpc_t)
++files_read_etc_runtime_files(dhcpc_t)
 +files_read_usr_files(dhcpc_t)
- files_search_home(dhcpc_t)
- files_search_var_lib(dhcpc_t)
- files_dontaudit_search_locks(dhcpc_t)
++files_search_home(dhcpc_t)
++files_search_var_lib(dhcpc_t)
++files_dontaudit_search_locks(dhcpc_t)
++
+ init_rw_utmp(dhcpc_t)
+ 
+ logging_send_syslog_msg(dhcpc_t)
 @@ -183,25 +191,23 @@
  ')
  
@@ -22900,32 +23977,39 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	kernel_read_xen_state(dhcpc_t)
  	kernel_write_xen_state(dhcpc_t)
  	xen_append_log(dhcpc_t)
-@@ -236,7 +247,6 @@
+@@ -234,9 +245,9 @@
+ # Ifconfig local policy
+ #
  
- allow ifconfig_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack };
- allow ifconfig_t self:capability { net_raw net_admin sys_tty_config };
+-allow ifconfig_t self:capability { net_raw net_admin sys_tty_config };
 -dontaudit ifconfig_t self:capability sys_module;
- 
+ allow ifconfig_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack };
++allow ifconfig_t self:capability { net_raw net_admin sys_tty_config };
++
  allow ifconfig_t self:fd use;
  allow ifconfig_t self:fifo_file rw_fifo_file_perms;
-@@ -250,6 +260,7 @@
+ allow ifconfig_t self:sock_file read_sock_file_perms;
+@@ -249,8 +260,11 @@
  allow ifconfig_t self:sem create_sem_perms;
  allow ifconfig_t self:msgq create_msgq_perms;
  allow ifconfig_t self:msg { send receive };
 +allow ifconfig_t net_conf_t:file read_file_perms;
- 
++
  # Create UDP sockets, necessary when called from dhcpc
  allow ifconfig_t self:udp_socket create_socket_perms;
-@@ -259,13 +270,20 @@
++
+ # for /sbin/ip
+ allow ifconfig_t self:packet_socket create_socket_perms;
  allow ifconfig_t self:netlink_route_socket create_netlink_socket_perms;
+@@ -257,11 +271,19 @@
  allow ifconfig_t self:netlink_xfrm_socket { create_netlink_socket_perms nlmsg_read };
  allow ifconfig_t self:tcp_socket { create ioctl };
-+
+ 
 +read_files_pattern(ifconfig_t, dhcpc_state_t, dhcpc_state_t)
 +
- files_read_etc_files(ifconfig_t)
++files_read_etc_files(ifconfig_t)
 +files_read_etc_runtime_files(ifconfig_t)
- 
++
  kernel_use_fds(ifconfig_t)
  kernel_read_system_state(ifconfig_t)
  kernel_read_network_state(ifconfig_t)
@@ -22937,7 +24021,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  corenet_rw_tun_tap_dev(ifconfig_t)
  
-@@ -276,8 +294,13 @@
+@@ -269,15 +291,18 @@
+ # for IPSEC setup:
+ dev_read_urand(ifconfig_t)
+ 
+-domain_use_interactive_fds(ifconfig_t)
+-
+-files_read_etc_files(ifconfig_t)
+-
  fs_getattr_xattr_fs(ifconfig_t)
  fs_search_auto_mountpoints(ifconfig_t)
  
@@ -22948,10 +24039,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  term_dontaudit_use_all_user_ptys(ifconfig_t)
 +term_dontaudit_use_ptmx(ifconfig_t)
 +term_dontaudit_use_generic_ptys(ifconfig_t)
++
++domain_use_interactive_fds(ifconfig_t)
  
- domain_use_interactive_fds(ifconfig_t)
+ files_dontaudit_read_root_files(ifconfig_t)
  
-@@ -296,6 +319,8 @@
+@@ -294,6 +319,8 @@
  
  seutil_use_runinit_fds(ifconfig_t)
  
@@ -22960,7 +24053,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  userdom_use_user_terminals(ifconfig_t)
  userdom_use_all_users_fds(ifconfig_t)
  
-@@ -332,8 +357,21 @@
+@@ -330,8 +357,21 @@
  ')
  
  optional_policy(`
@@ -22982,9 +24075,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	hal_dontaudit_rw_dgram_sockets(dhcpc_t)
 +	hal_dontaudit_rw_pipes(ifconfig_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.fc serefpolicy-3.6.26/policy/modules/system/udev.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.fc serefpolicy-3.6.27/policy/modules/system/udev.fc
 --- nsaserefpolicy/policy/modules/system/udev.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/udev.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/udev.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -7,6 +7,9 @@
  /etc/hotplug\.d/default/udev.* -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
  
@@ -22995,9 +24088,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  /sbin/start_udev --	gen_context(system_u:object_r:udev_exec_t,s0)
  /sbin/udev	--	gen_context(system_u:object_r:udev_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.6.26/policy/modules/system/udev.te
---- nsaserefpolicy/policy/modules/system/udev.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/udev.te	2009-08-13 09:56:06.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.6.27/policy/modules/system/udev.te
+--- nsaserefpolicy/policy/modules/system/udev.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/udev.te	2009-08-14 16:51:06.000000000 -0400
 @@ -50,6 +50,7 @@
  allow udev_t self:unix_stream_socket connectto;
  allow udev_t self:netlink_kobject_uevent_socket create_socket_perms;
@@ -23107,9 +24200,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	kernel_write_xen_state(udev_t)
  	kernel_read_xen_state(udev_t)
  	xen_manage_log(udev_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.6.26/policy/modules/system/unconfined.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.6.27/policy/modules/system/unconfined.fc
 --- nsaserefpolicy/policy/modules/system/unconfined.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/unconfined.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/unconfined.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,16 +1 @@
  # Add programs here which should not be confined by SELinux
 -# e.g.:
@@ -23127,9 +24220,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -ifdef(`distro_gentoo',`
 -/usr/lib32/openoffice/program/[^/]+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
 -')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.6.26/policy/modules/system/unconfined.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.6.27/policy/modules/system/unconfined.if
 --- nsaserefpolicy/policy/modules/system/unconfined.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/unconfined.if	2009-08-13 16:47:59.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/unconfined.if	2009-08-14 16:51:06.000000000 -0400
 @@ -12,14 +12,13 @@
  #
  interface(`unconfined_domain_noaudit',`
@@ -23635,9 +24728,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -
 -	allow $1 unconfined_t:dbus acquire_svc;
 -')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.6.26/policy/modules/system/unconfined.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.6.27/policy/modules/system/unconfined.te
 --- nsaserefpolicy/policy/modules/system/unconfined.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/unconfined.te	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/unconfined.te	2009-08-14 16:51:06.000000000 -0400
 @@ -1,231 +1,9 @@
  
 -policy_module(unconfined, 3.0.0)
@@ -23872,9 +24965,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -		hal_dbus_chat(unconfined_execmem_t)
 -	')
 -')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.6.26/policy/modules/system/userdomain.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.6.27/policy/modules/system/userdomain.fc
 --- nsaserefpolicy/policy/modules/system/userdomain.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/userdomain.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/userdomain.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,4 +1,7 @@
  HOME_DIR	-d	gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
 +HOME_DIR	-l	gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
@@ -23884,9 +24977,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/root(/.*)?	 	gen_context(system_u:object_r:admin_home_t,s0)
 +/dev/shm/pulse-shm.*	gen_context(system_u:object_r:user_tmpfs_t,s0)
 +/dev/shm/mono.*		gen_context(system_u:object_r:user_tmpfs_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.26/policy/modules/system/userdomain.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.27/policy/modules/system/userdomain.if
 --- nsaserefpolicy/policy/modules/system/userdomain.if	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/userdomain.if	2009-08-12 16:13:59.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/userdomain.if	2009-08-14 16:51:06.000000000 -0400
 @@ -30,8 +30,9 @@
  	')
  
@@ -25752,9 +26845,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	allow $1 user_home_dir_t:dir search_dir_perms;
 +	files_search_home($1)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.6.26/policy/modules/system/userdomain.te
---- nsaserefpolicy/policy/modules/system/userdomain.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/userdomain.te	2009-07-30 15:33:09.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.6.27/policy/modules/system/userdomain.te
+--- nsaserefpolicy/policy/modules/system/userdomain.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/userdomain.te	2009-08-14 16:51:06.000000000 -0400
 @@ -8,13 +8,6 @@
  
  ## <desc>
@@ -25840,9 +26933,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 +
 +allow userdomain userdomain:process signull;
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc serefpolicy-3.6.26/policy/modules/system/xen.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc serefpolicy-3.6.27/policy/modules/system/xen.fc
 --- nsaserefpolicy/policy/modules/system/xen.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/xen.fc	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/xen.fc	2009-08-14 16:51:06.000000000 -0400
 @@ -1,5 +1,7 @@
  /dev/xen/tapctrl.*	-p	gen_context(system_u:object_r:xenctl_t,s0)
  
@@ -25870,9 +26963,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /var/run/xenstore\.pid	--	gen_context(system_u:object_r:xenstored_var_run_t,s0)
  /var/run/xenstored(/.*)?	gen_context(system_u:object_r:xenstored_var_run_t,s0)
  
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.6.26/policy/modules/system/xen.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.6.27/policy/modules/system/xen.if
 --- nsaserefpolicy/policy/modules/system/xen.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/xen.if	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/xen.if	2009-08-14 16:51:06.000000000 -0400
 @@ -71,6 +71,8 @@
  	')
  
@@ -25923,10 +27016,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	allow $1 xend_var_lib_t:dir search_dir_perms;
 +	rw_files_pattern($1, xen_image_t, xen_image_t)
 +')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.6.26/policy/modules/system/xen.te
---- nsaserefpolicy/policy/modules/system/xen.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/modules/system/xen.te	2009-07-30 15:41:16.000000000 -0400
-@@ -6,6 +6,13 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.6.27/policy/modules/system/xen.te
+--- nsaserefpolicy/policy/modules/system/xen.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/policy/modules/system/xen.te	2009-08-14 16:51:06.000000000 -0400
+@@ -1,11 +1,18 @@
+ 
+-policy_module(xen, 1.9.0)
++policy_module(xen, 1.8.2)
+ 
+ ########################################
+ #
  # Declarations
  #
  
@@ -26213,9 +27312,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +manage_files_pattern(evtchnd_t,evtchnd_var_run_t,evtchnd_var_run_t)
 +manage_sock_files_pattern(evtchnd_t,evtchnd_var_run_t,evtchnd_var_run_t)
 +files_pid_filetrans(evtchnd_t, evtchnd_var_run_t, { file sock_file dir })
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.6.26/policy/support/obj_perm_sets.spt
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.6.27/policy/support/obj_perm_sets.spt
 --- nsaserefpolicy/policy/support/obj_perm_sets.spt	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/support/obj_perm_sets.spt	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/support/obj_perm_sets.spt	2009-08-14 16:51:06.000000000 -0400
 @@ -201,7 +201,7 @@
  define(`setattr_file_perms',`{ setattr }')
  define(`read_file_perms',`{ getattr open read lock ioctl }')
@@ -26248,9 +27347,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +define(`all_association_perms', `{ sendto recvfrom setcontext polmatch } ')
 +
 +define(`manage_key_perms', `{ create link read search setattr view write } ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.6.26/policy/users
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.6.27/policy/users
 --- nsaserefpolicy/policy/users	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/policy/users	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/policy/users	2009-08-14 16:51:06.000000000 -0400
 @@ -25,11 +25,8 @@
  # permit any access to such users, then remove this entry.
  #
@@ -26275,9 +27374,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -	gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
 -')
 +gen_user(root, user, unconfined_r sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.6.26/Rules.modular
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.6.27/Rules.modular
 --- nsaserefpolicy/Rules.modular	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/Rules.modular	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/Rules.modular	2009-08-14 16:51:06.000000000 -0400
 @@ -73,8 +73,8 @@
  $(tmpdir)/%.mod: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf %.te
  	@echo "Compliling $(NAME) $(@F) module"
@@ -26307,9 +27406,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/Rul
  
  $(tmpdir)/all_te_files.conf: M4PARAM += -D self_contained_policy
  $(tmpdir)/all_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf $(base_te_files) $(tmpdir)/rolemap.conf
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.6.26/support/Makefile.devel
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/support/divert.m4 serefpolicy-3.6.27/support/divert.m4
+--- nsaserefpolicy/support/divert.m4	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/support/divert.m4	1969-12-31 19:00:00.000000000 -0500
+@@ -1 +0,0 @@
+-divert(`-1')
+\ No newline at end of file
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.6.27/support/Makefile.devel
 --- nsaserefpolicy/support/Makefile.devel	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.26/support/Makefile.devel	2009-07-30 15:33:09.000000000 -0400
++++ serefpolicy-3.6.27/support/Makefile.devel	2009-08-14 16:51:06.000000000 -0400
 @@ -185,8 +185,7 @@
  tmp/%.mod: $(m4support) tmp/all_interfaces.conf %.te
  	@$(EINFO) "Compiling $(NAME) $(basename $(@F)) module"
@@ -26320,3 +27425,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/sup
  	$(verbose) $(CHECKMODULE) -m $(@:.mod=.tmp) -o $@
  
  tmp/%.mod.fc: $(m4support) %.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/support/undivert.m4 serefpolicy-3.6.27/support/undivert.m4
+--- nsaserefpolicy/support/undivert.m4	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.27/support/undivert.m4	1969-12-31 19:00:00.000000000 -0500
+@@ -1 +0,0 @@
+-divert
+\ No newline at end of file
diff --git a/selinux-policy.spec b/selinux-policy.spec
index dc78601..84dfbc1 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,8 +19,8 @@
 %define CHECKPOLICYVER 2.0.16-3
 Summary: SELinux policy configuration
 Name: selinux-policy
-Version: 3.6.26
-Release: 11%{?dist}
+Version: 3.6.27
+Release: 1%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -49,7 +49,7 @@ Url: http://oss.tresys.com/repos/refpolicy/
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildArch: noarch
 BuildRequires: python gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-python >= %{POLICYCOREUTILSVER} bzip2 
-Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} libsemanage >= 2.0.14-3
+Requires(pre): policycoreutils-python >= %{POLICYCOREUTILSVER} libsemanage >= 2.0.14-3
 Requires(post): /usr/bin/bunzip2 /bin/mktemp /bin/awk
 Requires: checkpolicy >= %{CHECKPOLICYVER} m4 
 Obsoletes: selinux-policy-devel
@@ -475,6 +475,9 @@ exit 0
 %endif
 
 %changelog
+* Fri Aug 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.27-1
+- Add policycoreutils-python to pre install
+
 * Thu Aug 13 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-11
 - Make all unconfined_domains permissive so we can see what AVC's happen 
 
diff --git a/sources b/sources
index 681011f..b827ae9 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-8c707d664792b43fa6c1f1adde8cfd57  serefpolicy-3.6.26.tgz
+7539a9e100f4f48bcd47dd870e03e2c6  serefpolicy-3.6.27.tgz