##
@@ -11090,7 +10948,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- kerberos_use(httpd_t)
- kerberos_read_kdc_config(httpd_t)
+ dbus_system_bus_client_template(httpd, httpd_t)
-+ tunable_policy(`allow_httpd_dbus_avahi',`
++ tunable_policy(`httpd_dbus_avahi',`
+ avahi_dbus_chat(httpd_t)
+ ')
+')
@@ -11424,17 +11282,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+manage_dirs_pattern(httpd_t,httpdcontent,httpd_rw_content)
+manage_files_pattern(httpd_t,httpdcontent,httpd_rw_content)
+manage_lnk_files_pattern(httpd_t,httpdcontent,httpd_rw_content)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.fc serefpolicy-3.5.11/policy/modules/services/arpwatch.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.fc serefpolicy-3.5.12/policy/modules/services/arpwatch.fc
--- nsaserefpolicy/policy/modules/services/arpwatch.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/arpwatch.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/arpwatch.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,3 +1,4 @@
+/etc/rc\.d/init\.d/arpwatch -- gen_context(system_u:object_r:arpwatch_initrc_exec_t,s0)
#
# /usr
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.if serefpolicy-3.5.11/policy/modules/services/arpwatch.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.if serefpolicy-3.5.12/policy/modules/services/arpwatch.if
--- nsaserefpolicy/policy/modules/services/arpwatch.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/arpwatch.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/arpwatch.if 2008-10-10 16:08:15.000000000 -0400
@@ -90,3 +90,45 @@
dontaudit $1 arpwatch_t:packet_socket { read write };
@@ -11481,9 +11339,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ files_list_pids($1)
+ admin_pattern($1, arpwatch_var_run_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.te serefpolicy-3.5.11/policy/modules/services/arpwatch.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.te serefpolicy-3.5.12/policy/modules/services/arpwatch.te
--- nsaserefpolicy/policy/modules/services/arpwatch.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/arpwatch.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/arpwatch.te 2008-10-10 16:08:15.000000000 -0400
@@ -13,6 +13,9 @@
type arpwatch_data_t;
files_type(arpwatch_data_t)
@@ -11494,18 +11352,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
type arpwatch_tmp_t;
files_tmp_file(arpwatch_tmp_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.fc serefpolicy-3.5.11/policy/modules/services/asterisk.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.fc serefpolicy-3.5.12/policy/modules/services/asterisk.fc
--- nsaserefpolicy/policy/modules/services/asterisk.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/asterisk.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/asterisk.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,4 +1,5 @@
/etc/asterisk(/.*)? gen_context(system_u:object_r:asterisk_etc_t,s0)
+/etc/rc\.d/init\.d/asterisk -- gen_context(system_u:object_r:asterisk_initrc_exec_t,s0)
/usr/sbin/asterisk -- gen_context(system_u:object_r:asterisk_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.if serefpolicy-3.5.11/policy/modules/services/asterisk.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.if serefpolicy-3.5.12/policy/modules/services/asterisk.if
--- nsaserefpolicy/policy/modules/services/asterisk.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/asterisk.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/asterisk.if 2008-10-10 16:08:15.000000000 -0400
@@ -1 +1,54 @@
## Asterisk IP telephony server
+
@@ -11561,9 +11419,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ admin_pattern($1, asterisk_var_run_t)
+')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.te serefpolicy-3.5.11/policy/modules/services/asterisk.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.te serefpolicy-3.5.12/policy/modules/services/asterisk.te
--- nsaserefpolicy/policy/modules/services/asterisk.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/asterisk.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/asterisk.te 2008-10-10 16:08:15.000000000 -0400
@@ -13,6 +13,9 @@
type asterisk_etc_t;
files_config_file(asterisk_etc_t)
@@ -11574,18 +11432,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
type asterisk_log_t;
logging_log_file(asterisk_log_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.fc serefpolicy-3.5.11/policy/modules/services/audioentropy.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.fc serefpolicy-3.5.12/policy/modules/services/audioentropy.fc
--- nsaserefpolicy/policy/modules/services/audioentropy.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/audioentropy.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/audioentropy.fc 2008-10-10 16:08:15.000000000 -0400
@@ -2,3 +2,5 @@
# /usr
#
/usr/sbin/audio-entropyd -- gen_context(system_u:object_r:entropyd_exec_t,s0)
+
+/var/run/audio-entropyd\.pid -- gen_context(system_u:object_r:entropyd_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.5.11/policy/modules/services/audioentropy.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.5.12/policy/modules/services/audioentropy.te
--- nsaserefpolicy/policy/modules/services/audioentropy.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/audioentropy.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/audioentropy.te 2008-10-10 16:08:15.000000000 -0400
@@ -35,6 +35,7 @@
dev_read_rand(entropyd_t)
dev_write_rand(entropyd_t)
@@ -11594,9 +11452,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
fs_getattr_all_fs(entropyd_t)
fs_search_auto_mountpoints(entropyd_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.5.11/policy/modules/services/automount.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.5.12/policy/modules/services/automount.te
--- nsaserefpolicy/policy/modules/services/automount.te 2008-10-08 19:00:27.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/automount.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/automount.te 2008-10-10 16:08:15.000000000 -0400
@@ -71,6 +71,7 @@
files_mounton_all_mountpoints(automount_t)
files_mount_all_file_type_fs(automount_t)
@@ -11622,9 +11480,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kerberos_read_config(automount_t)
kerberos_dontaudit_write_config(automount_t)
')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.fc serefpolicy-3.5.11/policy/modules/services/avahi.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.fc serefpolicy-3.5.12/policy/modules/services/avahi.fc
--- nsaserefpolicy/policy/modules/services/avahi.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/avahi.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/avahi.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,5 +1,9 @@
+/etc/rc\.d/init\.d/avahi.* -- gen_context(system_u:object_r:avahi_initrc_exec_t,s0)
@@ -11635,9 +11493,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/run/avahi-daemon(/.*)? gen_context(system_u:object_r:avahi_var_run_t,s0)
+
+/usr/lib/avahi-autoipd(/.*) gen_context(system_u:object_r:avahi_var_lib_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.if serefpolicy-3.5.11/policy/modules/services/avahi.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.if serefpolicy-3.5.12/policy/modules/services/avahi.if
--- nsaserefpolicy/policy/modules/services/avahi.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/avahi.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/avahi.if 2008-10-10 16:08:15.000000000 -0400
@@ -2,6 +2,84 @@
########################################
@@ -11762,9 +11620,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ files_list_pids($1)
+ admin_pattern($1, avahi_var_run_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.5.11/policy/modules/services/avahi.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.5.12/policy/modules/services/avahi.te
--- nsaserefpolicy/policy/modules/services/avahi.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/avahi.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/avahi.te 2008-10-10 16:08:15.000000000 -0400
@@ -10,6 +10,12 @@
type avahi_exec_t;
init_daemon_domain(avahi_t, avahi_exec_t)
@@ -11814,18 +11672,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.5.11/policy/modules/services/bind.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.5.12/policy/modules/services/bind.fc
--- nsaserefpolicy/policy/modules/services/bind.fc 2008-09-24 09:07:28.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/bind.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/bind.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,4 +1,4 @@
-/etc/rc.d/init.d/named -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/named -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
/etc/rndc.* -- gen_context(system_u:object_r:named_conf_t,s0)
/etc/rndc\.key -- gen_context(system_u:object_r:dnssec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.if serefpolicy-3.5.11/policy/modules/services/bind.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.if serefpolicy-3.5.12/policy/modules/services/bind.if
--- nsaserefpolicy/policy/modules/services/bind.if 2008-09-24 09:07:28.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/bind.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/bind.if 2008-10-10 16:08:15.000000000 -0400
@@ -257,6 +257,25 @@
########################################
@@ -11903,9 +11761,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ files_list_pids($1)
+ admin_pattern($1, named_var_run_t)
')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.5.11/policy/modules/services/bind.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.5.12/policy/modules/services/bind.te
--- nsaserefpolicy/policy/modules/services/bind.te 2008-09-24 09:07:28.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/bind.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/bind.te 2008-10-10 16:08:15.000000000 -0400
@@ -249,6 +249,8 @@
sysnet_read_config(ndc_t)
sysnet_dns_name_resolve(ndc_t)
@@ -11915,22 +11773,28 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# for /etc/rndc.key
ifdef(`distro_redhat',`
allow ndc_t named_conf_t:dir search;
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.te serefpolicy-3.5.11/policy/modules/services/bitlbee.te
---- nsaserefpolicy/policy/modules/services/bitlbee.te 2008-10-08 19:00:27.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/bitlbee.te 2008-10-08 20:36:17.000000000 -0400
-@@ -66,6 +66,9 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.te serefpolicy-3.5.12/policy/modules/services/bitlbee.te
+--- nsaserefpolicy/policy/modules/services/bitlbee.te 2008-10-10 15:53:03.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/bitlbee.te 2008-10-10 16:08:15.000000000 -0400
+@@ -1,5 +1,5 @@
+
+-policy_module(bitlbee, 1.0.2)
++policy_module(bitlbee, 1.0.1)
+
+ ########################################
+ #
+@@ -65,7 +65,7 @@
+ # and to MSNP (MSN Messenger) servers:
corenet_tcp_connect_msnp_port(bitlbee_t)
corenet_tcp_sendrecv_msnp_port(bitlbee_t)
-
-+corenet_tcp_connect_http_port(bitlbee_t)
-+corenet_tcp_sendrecv_http_port(bitlbee_t)
+-# MSN can use passport auth, which is over http:
+
- dev_read_rand(bitlbee_t)
- dev_read_urand(bitlbee_t)
+ corenet_tcp_connect_http_port(bitlbee_t)
+ corenet_tcp_sendrecv_http_port(bitlbee_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.fc serefpolicy-3.5.11/policy/modules/services/bluetooth.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.fc serefpolicy-3.5.12/policy/modules/services/bluetooth.fc
--- nsaserefpolicy/policy/modules/services/bluetooth.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/bluetooth.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/bluetooth.fc 2008-10-10 16:08:15.000000000 -0400
@@ -3,6 +3,9 @@
#
/etc/bluetooth(/.*)? gen_context(system_u:object_r:bluetooth_conf_t,s0)
@@ -11946,9 +11810,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/lib/bluetooth(/.*)? gen_context(system_u:object_r:bluetooth_var_lib_t,s0)
/var/run/sdp -s gen_context(system_u:object_r:bluetooth_var_run_t,s0)
+/var/run/bluetoothd_address gen_context(system_u:object_r:bluetooth_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.if serefpolicy-3.5.11/policy/modules/services/bluetooth.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.if serefpolicy-3.5.12/policy/modules/services/bluetooth.if
--- nsaserefpolicy/policy/modules/services/bluetooth.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/bluetooth.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/bluetooth.if 2008-10-10 16:08:15.000000000 -0400
@@ -226,3 +226,56 @@
dontaudit $1 bluetooth_helper_domain:dir search;
dontaudit $1 bluetooth_helper_domain:file { read getattr };
@@ -12006,9 +11870,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ files_list_pids($1)
+ admin_pattern($1, bluetooth_var_run_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.5.11/policy/modules/services/bluetooth.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.5.12/policy/modules/services/bluetooth.te
--- nsaserefpolicy/policy/modules/services/bluetooth.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/bluetooth.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/bluetooth.te 2008-10-10 16:08:15.000000000 -0400
@@ -20,6 +20,9 @@
type bluetooth_helper_exec_t;
application_executable_file(bluetooth_helper_exec_t)
@@ -12083,9 +11947,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.fc serefpolicy-3.5.11/policy/modules/services/clamav.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.fc serefpolicy-3.5.12/policy/modules/services/clamav.fc
--- nsaserefpolicy/policy/modules/services/clamav.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/clamav.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/clamav.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,20 +1,22 @@
/etc/clamav(/.*)? gen_context(system_u:object_r:clamd_etc_t,s0)
+/etc/rc\.d/init\.d/clamd-wrapper -- gen_context(system_u:object_r:clamd_initrc_exec_t,s0)
@@ -12114,9 +11978,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/log/clamd.* gen_context(system_u:object_r:clamd_var_log_t,s0)
/var/spool/amavisd/clamd\.sock -s gen_context(system_u:object_r:clamd_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.if serefpolicy-3.5.11/policy/modules/services/clamav.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.if serefpolicy-3.5.12/policy/modules/services/clamav.if
--- nsaserefpolicy/policy/modules/services/clamav.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/clamav.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/clamav.if 2008-10-10 16:08:15.000000000 -0400
@@ -38,6 +38,27 @@
########################################
@@ -12233,9 +12097,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ admin_pattern($1, freshclam_var_log_t)
+')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.5.11/policy/modules/services/clamav.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.5.12/policy/modules/services/clamav.te
--- nsaserefpolicy/policy/modules/services/clamav.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/clamav.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/clamav.te 2008-10-10 16:08:15.000000000 -0400
@@ -13,7 +13,10 @@
# configuration files
@@ -12325,9 +12189,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+optional_policy(`
+ mailscanner_manage_spool(clamscan_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.fc serefpolicy-3.5.11/policy/modules/services/consolekit.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.fc serefpolicy-3.5.12/policy/modules/services/consolekit.fc
--- nsaserefpolicy/policy/modules/services/consolekit.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/consolekit.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/consolekit.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,3 +1,6 @@
/usr/sbin/console-kit-daemon -- gen_context(system_u:object_r:consolekit_exec_t,s0)
@@ -12335,9 +12199,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/run/ConsoleKit(/.*)? -- gen_context(system_u:object_r:consolekit_var_run_t,s0)
+
+/var/log/ConsoleKit(/.*)? gen_context(system_u:object_r:consolekit_log_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.if serefpolicy-3.5.11/policy/modules/services/consolekit.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.if serefpolicy-3.5.12/policy/modules/services/consolekit.if
--- nsaserefpolicy/policy/modules/services/consolekit.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/consolekit.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/consolekit.if 2008-10-10 16:08:15.000000000 -0400
@@ -38,3 +38,24 @@
allow $1 consolekit_t:dbus send_msg;
allow consolekit_t $1:dbus send_msg;
@@ -12363,9 +12227,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.5.11/policy/modules/services/consolekit.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.5.12/policy/modules/services/consolekit.te
--- nsaserefpolicy/policy/modules/services/consolekit.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/consolekit.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/consolekit.te 2008-10-10 16:08:15.000000000 -0400
@@ -13,6 +13,9 @@
type consolekit_var_run_t;
files_pid_file(consolekit_var_run_t)
@@ -12479,9 +12343,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ fs_dontaudit_rw_cifs_files(consolekit_t)
+')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.fc serefpolicy-3.5.11/policy/modules/services/courier.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.fc serefpolicy-3.5.12/policy/modules/services/courier.fc
--- nsaserefpolicy/policy/modules/services/courier.fc 2008-08-14 13:08:27.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/courier.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/courier.fc 2008-10-10 16:08:15.000000000 -0400
@@ -19,5 +19,5 @@
/var/lib/courier(/.*)? -- gen_context(system_u:object_r:courier_var_lib_t,s0)
@@ -12489,9 +12353,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-
/var/spool/courier(/.*)? gen_context(system_u:object_r:courier_spool_t,s0)
+/var/spool/authdaemon(/.*)? gen_context(system_u:object_r:courier_spool_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.5.11/policy/modules/services/courier.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.5.12/policy/modules/services/courier.te
--- nsaserefpolicy/policy/modules/services/courier.te 2008-09-12 10:48:05.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/courier.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/courier.te 2008-10-10 16:08:15.000000000 -0400
@@ -10,6 +10,7 @@
type courier_etc_t;
@@ -12510,9 +12374,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
#
# Calendar (PCP) local policy
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.5.11/policy/modules/services/cron.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.5.12/policy/modules/services/cron.fc
--- nsaserefpolicy/policy/modules/services/cron.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/cron.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/cron.fc 2008-10-10 16:08:15.000000000 -0400
@@ -17,6 +17,8 @@
/var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0)
/var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0)
@@ -12529,9 +12393,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0)
+
+/var/lib/glpi/files(/.*)? gen_context(system_u:object_r:cron_var_lib_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.5.11/policy/modules/services/cron.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.5.12/policy/modules/services/cron.if
--- nsaserefpolicy/policy/modules/services/cron.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/cron.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/cron.if 2008-10-10 16:08:15.000000000 -0400
@@ -35,39 +35,24 @@
#
template(`cron_per_role_template',`
@@ -12881,9 +12745,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+ read_files_pattern($1, system_crond_var_lib_t, system_crond_var_lib_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.5.11/policy/modules/services/cron.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.5.12/policy/modules/services/cron.te
--- nsaserefpolicy/policy/modules/services/cron.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/cron.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/cron.te 2008-10-10 16:08:15.000000000 -0400
@@ -12,14 +12,6 @@
##
@@ -13155,9 +13019,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ userdom_priveleged_home_dir_manager(system_crond_t)
')
-') dnl end TODO
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.5.11/policy/modules/services/cups.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.5.12/policy/modules/services/cups.fc
--- nsaserefpolicy/policy/modules/services/cups.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/cups.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/cups.fc 2008-10-10 16:08:15.000000000 -0400
@@ -8,24 +8,33 @@
/etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
/etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
@@ -13224,9 +13088,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/usr/local/linuxprinter/ppd(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+
+/usr/lib/cups/backend/cups-pdf -- gen_context(system_u:object_r:cups_pdf_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.if serefpolicy-3.5.11/policy/modules/services/cups.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.if serefpolicy-3.5.12/policy/modules/services/cups.if
--- nsaserefpolicy/policy/modules/services/cups.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/cups.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/cups.if 2008-10-10 16:08:15.000000000 -0400
@@ -20,6 +20,30 @@
########################################
@@ -13352,9 +13216,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ admin_pattern($1, hplip_var_run_t)
+')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.5.11/policy/modules/services/cups.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.5.12/policy/modules/services/cups.te
--- nsaserefpolicy/policy/modules/services/cups.te 2008-09-03 07:59:15.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/cups.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/cups.te 2008-10-10 16:08:15.000000000 -0400
@@ -20,6 +20,12 @@
type cupsd_etc_t;
files_config_file(cupsd_etc_t)
@@ -13745,9 +13609,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+sysadm_dontaudit_read_home_content_files(cups_pdf_t)
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.fc serefpolicy-3.5.11/policy/modules/services/cvs.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.fc serefpolicy-3.5.12/policy/modules/services/cvs.fc
--- nsaserefpolicy/policy/modules/services/cvs.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/cvs.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/cvs.fc 2008-10-10 16:08:15.000000000 -0400
@@ -5,3 +5,6 @@
/var/cvs(/.*)? gen_context(system_u:object_r:cvs_data_t,s0)
@@ -13755,9 +13619,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+#CVSWeb file context
+/usr/share/cvsweb/cvsweb\.cgi -- gen_context(system_u:object_r:httpd_cvs_script_exec_t,s0)
+/var/www/cgi-bin/cvsweb\.cgi -- gen_context(system_u:object_r:httpd_cvs_script_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.if serefpolicy-3.5.11/policy/modules/services/cvs.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.if serefpolicy-3.5.12/policy/modules/services/cvs.if
--- nsaserefpolicy/policy/modules/services/cvs.if 2008-09-24 09:07:28.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/cvs.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/cvs.if 2008-10-10 16:08:15.000000000 -0400
@@ -69,4 +69,13 @@
domain_system_change_exemption($1)
role_transition $2 cvs_initrc_exec_t system_r;
@@ -13772,9 +13636,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ admin_pattern($1, cvs_var_run_t)
')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.5.11/policy/modules/services/cvs.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.5.12/policy/modules/services/cvs.te
--- nsaserefpolicy/policy/modules/services/cvs.te 2008-09-24 09:07:28.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/cvs.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/cvs.te 2008-10-10 16:08:15.000000000 -0400
@@ -99,7 +99,17 @@
')
@@ -13794,17 +13658,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+manage_dirs_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
+manage_files_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
+files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir })
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.fc serefpolicy-3.5.11/policy/modules/services/cyrus.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.fc serefpolicy-3.5.12/policy/modules/services/cyrus.fc
--- nsaserefpolicy/policy/modules/services/cyrus.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/cyrus.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/cyrus.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,3 +1,4 @@
+/etc/rc\.d/init\.d/cyrus -- gen_context(system_u:object_r:cyrus_initrc_exec_t,s0)
/usr/lib(64)?/cyrus-imapd/cyrus-master -- gen_context(system_u:object_r:cyrus_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.if serefpolicy-3.5.11/policy/modules/services/cyrus.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.if serefpolicy-3.5.12/policy/modules/services/cyrus.if
--- nsaserefpolicy/policy/modules/services/cyrus.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/cyrus.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/cyrus.if 2008-10-10 16:08:15.000000000 -0400
@@ -39,3 +39,47 @@
files_search_var_lib($1)
stream_connect_pattern($1, cyrus_var_lib_t, cyrus_var_lib_t, cyrus_t)
@@ -13853,9 +13717,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-3.5.11/policy/modules/services/cyrus.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-3.5.12/policy/modules/services/cyrus.te
--- nsaserefpolicy/policy/modules/services/cyrus.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/cyrus.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/cyrus.te 2008-10-10 16:08:15.000000000 -0400
@@ -10,6 +10,9 @@
type cyrus_exec_t;
init_daemon_domain(cyrus_t, cyrus_exec_t)
@@ -13875,9 +13739,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.5.11/policy/modules/services/dbus.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.5.12/policy/modules/services/dbus.fc
--- nsaserefpolicy/policy/modules/services/dbus.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dbus.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dbus.fc 2008-10-10 16:08:15.000000000 -0400
@@ -4,6 +4,9 @@
/usr/bin/dbus-daemon(-1)? -- gen_context(system_u:object_r:system_dbusd_exec_t,s0)
/bin/dbus-daemon -- gen_context(system_u:object_r:system_dbusd_exec_t,s0)
@@ -13888,9 +13752,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/lib/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_lib_t,s0)
/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.5.11/policy/modules/services/dbus.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.5.12/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dbus.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dbus.if 2008-10-10 16:08:15.000000000 -0400
@@ -53,6 +53,7 @@
gen_require(`
type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t;
@@ -14189,9 +14053,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow $1 system_dbusd_t:tcp_socket { read write };
+ allow $1 system_dbusd_t:fd use;
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.5.11/policy/modules/services/dbus.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.5.12/policy/modules/services/dbus.te
--- nsaserefpolicy/policy/modules/services/dbus.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dbus.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dbus.te 2008-10-10 16:08:15.000000000 -0400
@@ -9,9 +9,10 @@
#
# Delcarations
@@ -14313,9 +14177,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ xserver_rw_xdm_xserver_shm(unconfined_dbusd_t)
+ ')
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.if serefpolicy-3.5.11/policy/modules/services/dcc.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.if serefpolicy-3.5.12/policy/modules/services/dcc.if
--- nsaserefpolicy/policy/modules/services/dcc.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dcc.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dcc.if 2008-10-10 16:08:15.000000000 -0400
@@ -72,6 +72,24 @@
########################################
@@ -14341,9 +14205,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Execute dcc_client in the dcc_client domain, and
## allow the specified role the dcc_client domain.
##
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.te serefpolicy-3.5.11/policy/modules/services/dcc.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.te serefpolicy-3.5.12/policy/modules/services/dcc.te
--- nsaserefpolicy/policy/modules/services/dcc.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dcc.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dcc.te 2008-10-10 16:08:15.000000000 -0400
@@ -105,6 +105,8 @@
files_read_etc_files(cdcc_t)
files_read_etc_runtime_files(cdcc_t)
@@ -14513,17 +14377,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
seutil_sigchld_newrole(dccm_t)
')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.fc serefpolicy-3.5.11/policy/modules/services/dhcp.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.fc serefpolicy-3.5.12/policy/modules/services/dhcp.fc
--- nsaserefpolicy/policy/modules/services/dhcp.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dhcp.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dhcp.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,3 +1,4 @@
+/etc/rc\.d/init\.d/dhcpd -- gen_context(system_u:object_r:dhcpd_initrc_exec_t,s0)
/usr/sbin/dhcpd.* -- gen_context(system_u:object_r:dhcpd_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.if serefpolicy-3.5.11/policy/modules/services/dhcp.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.if serefpolicy-3.5.12/policy/modules/services/dhcp.if
--- nsaserefpolicy/policy/modules/services/dhcp.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dhcp.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dhcp.if 2008-10-10 16:08:15.000000000 -0400
@@ -19,3 +19,63 @@
sysnet_search_dhcp_state($1)
allow $1 dhcpd_state_t:file setattr;
@@ -14588,9 +14452,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ files_list_pids($1)
+ admin_pattern($1, dhcpd_var_run_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.5.11/policy/modules/services/dhcp.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.5.12/policy/modules/services/dhcp.te
--- nsaserefpolicy/policy/modules/services/dhcp.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dhcp.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dhcp.te 2008-10-10 16:08:15.000000000 -0400
@@ -10,6 +10,9 @@
type dhcpd_exec_t;
init_daemon_domain(dhcpd_t, dhcpd_exec_t)
@@ -14656,9 +14520,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
seutil_sigchld_newrole(dhcpd_t)
')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.fc serefpolicy-3.5.11/policy/modules/services/dnsmasq.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.fc serefpolicy-3.5.12/policy/modules/services/dnsmasq.fc
--- nsaserefpolicy/policy/modules/services/dnsmasq.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dnsmasq.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dnsmasq.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,4 +1,7 @@
+/etc/rc\.d/init\.d/dnsmasq -- gen_context(system_u:object_r:dnsmasq_initrc_exec_t,s0)
+
@@ -14667,9 +14531,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/lib/misc/dnsmasq\.leases -- gen_context(system_u:object_r:dnsmasq_lease_t,s0)
+/var/lib/dnsmasq(/.*)? gen_context(system_u:object_r:dnsmasq_lease_t,s0)
/var/run/dnsmasq\.pid -- gen_context(system_u:object_r:dnsmasq_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.if serefpolicy-3.5.11/policy/modules/services/dnsmasq.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.if serefpolicy-3.5.12/policy/modules/services/dnsmasq.if
--- nsaserefpolicy/policy/modules/services/dnsmasq.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dnsmasq.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dnsmasq.if 2008-10-10 16:08:15.000000000 -0400
@@ -1 +1,117 @@
## dnsmasq DNS forwarder and DHCP server
+
@@ -14788,9 +14652,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ files_list_pids($1)
+ admin_pattern($1, dnsmasq_var_run_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.5.11/policy/modules/services/dnsmasq.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.5.12/policy/modules/services/dnsmasq.te
--- nsaserefpolicy/policy/modules/services/dnsmasq.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dnsmasq.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dnsmasq.te 2008-10-10 16:08:15.000000000 -0400
@@ -10,6 +10,9 @@
type dnsmasq_exec_t;
init_daemon_domain(dnsmasq_t, dnsmasq_exec_t)
@@ -14837,9 +14701,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+optional_policy(`
+ virt_manage_lib_files(dnsmasq_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.5.11/policy/modules/services/dovecot.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.5.12/policy/modules/services/dovecot.fc
--- nsaserefpolicy/policy/modules/services/dovecot.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dovecot.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dovecot.fc 2008-10-10 16:08:15.000000000 -0400
@@ -6,6 +6,7 @@
/etc/dovecot\.passwd.* gen_context(system_u:object_r:dovecot_passwd_t,s0)
@@ -14877,9 +14741,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/log/dovecot\.log.* gen_context(system_u:object_r:dovecot_var_log_t,s0)
+/var/spool/dovecot(/.*)? gen_context(system_u:object_r:dovecot_spool_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.5.11/policy/modules/services/dovecot.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.5.12/policy/modules/services/dovecot.if
--- nsaserefpolicy/policy/modules/services/dovecot.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dovecot.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dovecot.if 2008-10-10 16:08:15.000000000 -0400
@@ -21,7 +21,46 @@
########################################
@@ -14989,9 +14853,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.5.11/policy/modules/services/dovecot.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.5.12/policy/modules/services/dovecot.te
--- nsaserefpolicy/policy/modules/services/dovecot.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/dovecot.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/dovecot.te 2008-10-10 16:08:15.000000000 -0400
@@ -15,12 +15,21 @@
domain_entry_file(dovecot_auth_t, dovecot_auth_exec_t)
role system_r types dovecot_auth_t;
@@ -15161,9 +15025,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ mta_manage_spool(dovecot_deliver_t)
')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.if serefpolicy-3.5.11/policy/modules/services/exim.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.if serefpolicy-3.5.12/policy/modules/services/exim.if
--- nsaserefpolicy/policy/modules/services/exim.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/exim.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/exim.if 2008-10-10 16:08:15.000000000 -0400
@@ -97,6 +97,26 @@
########################################
@@ -15215,9 +15079,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ manage_dirs_pattern($1, exim_spool_t, exim_spool_t)
+ files_search_spool($1)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.5.11/policy/modules/services/exim.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.5.12/policy/modules/services/exim.te
--- nsaserefpolicy/policy/modules/services/exim.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/exim.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/exim.te 2008-10-10 16:08:15.000000000 -0400
@@ -21,9 +21,20 @@
##
gen_tunable(exim_manage_user_files, false)
@@ -15385,9 +15249,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ spamassassin_exec(exim_t)
+ spamassassin_exec_client(exim_t)
')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetchmail.if serefpolicy-3.5.11/policy/modules/services/fetchmail.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetchmail.if serefpolicy-3.5.12/policy/modules/services/fetchmail.if
--- nsaserefpolicy/policy/modules/services/fetchmail.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/fetchmail.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/fetchmail.if 2008-10-10 16:08:15.000000000 -0400
@@ -21,10 +21,10 @@
ps_process_pattern($1, fetchmail_t)
@@ -15402,9 +15266,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- manage_files_pattern($1, fetchmail_var_run_t, fetchmail_var_run_t)
+ admin_pattern($1, fetchmail_var_run_t)
')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetchmail.te serefpolicy-3.5.11/policy/modules/services/fetchmail.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetchmail.te serefpolicy-3.5.12/policy/modules/services/fetchmail.te
--- nsaserefpolicy/policy/modules/services/fetchmail.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/fetchmail.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/fetchmail.te 2008-10-10 16:08:15.000000000 -0400
@@ -91,6 +91,10 @@
')
@@ -15416,9 +15280,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
seutil_sigchld_newrole(fetchmail_t)
')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.5.11/policy/modules/services/ftp.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.5.12/policy/modules/services/ftp.te
--- nsaserefpolicy/policy/modules/services/ftp.te 2008-10-08 19:00:26.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/ftp.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/ftp.te 2008-10-10 16:08:15.000000000 -0400
@@ -226,6 +226,11 @@
userdom_manage_all_users_home_content_dirs(ftpd_t)
userdom_manage_all_users_home_content_files(ftpd_t)
@@ -15457,15 +15321,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
seutil_sigchld_newrole(ftpd_t)
')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.fc serefpolicy-3.5.11/policy/modules/services/gamin.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.fc serefpolicy-3.5.12/policy/modules/services/gamin.fc
--- nsaserefpolicy/policy/modules/services/gamin.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/gamin.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/gamin.fc 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,2 @@
+
+/usr/libexec/gam_server -- gen_context(system_u:object_r:gamin_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.if serefpolicy-3.5.11/policy/modules/services/gamin.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.if serefpolicy-3.5.12/policy/modules/services/gamin.if
--- nsaserefpolicy/policy/modules/services/gamin.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/gamin.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/gamin.if 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,57 @@
+
+## policy for gamin
@@ -15524,9 +15388,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+ allow $1 gamin_t:unix_stream_socket connectto;
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.te serefpolicy-3.5.11/policy/modules/services/gamin.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.te serefpolicy-3.5.12/policy/modules/services/gamin.te
--- nsaserefpolicy/policy/modules/services/gamin.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/gamin.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/gamin.te 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,39 @@
+policy_module(gamin, 1.0.0)
+
@@ -15567,16 +15431,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+miscfiles_read_localization(gamin_t)
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.fc serefpolicy-3.5.11/policy/modules/services/gnomeclock.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.fc serefpolicy-3.5.12/policy/modules/services/gnomeclock.fc
--- nsaserefpolicy/policy/modules/services/gnomeclock.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/gnomeclock.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/gnomeclock.fc 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,3 @@
+
+/usr/libexec/gnome-clock-applet-mechanism -- gen_context(system_u:object_r:gnomeclock_exec_t,s0)
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.if serefpolicy-3.5.11/policy/modules/services/gnomeclock.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.if serefpolicy-3.5.12/policy/modules/services/gnomeclock.if
--- nsaserefpolicy/policy/modules/services/gnomeclock.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/gnomeclock.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/gnomeclock.if 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,75 @@
+
+## policy for gnomeclock
@@ -15653,9 +15517,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow $1 gnomeclock_t:dbus send_msg;
+ allow gnomeclock_t $1:dbus send_msg;
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.te serefpolicy-3.5.11/policy/modules/services/gnomeclock.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.te serefpolicy-3.5.12/policy/modules/services/gnomeclock.te
--- nsaserefpolicy/policy/modules/services/gnomeclock.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/gnomeclock.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/gnomeclock.te 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,55 @@
+policy_module(gnomeclock, 1.0.0)
+########################################
@@ -15712,9 +15576,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ polkit_read_lib(gnomeclock_t)
+')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.5.11/policy/modules/services/hal.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.5.12/policy/modules/services/hal.fc
--- nsaserefpolicy/policy/modules/services/hal.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/hal.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/hal.fc 2008-10-10 16:08:15.000000000 -0400
@@ -9,6 +9,7 @@
/usr/libexec/hal-system-sonypic -- gen_context(system_u:object_r:hald_sonypic_exec_t,s0)
/usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0)
@@ -15732,9 +15596,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/run/hald(/.*)? gen_context(system_u:object_r:hald_var_run_t,s0)
/var/run/haldaemon\.pid -- gen_context(system_u:object_r:hald_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.5.11/policy/modules/services/hal.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.5.12/policy/modules/services/hal.if
--- nsaserefpolicy/policy/modules/services/hal.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/hal.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/hal.if 2008-10-10 16:08:15.000000000 -0400
@@ -302,3 +302,42 @@
files_search_pids($1)
allow $1 hald_var_run_t:file rw_file_perms;
@@ -15778,9 +15642,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ read_lnk_files_pattern($1, hald_t, hald_t)
+ dontaudit $1 hald_t:process ptrace;
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.5.11/policy/modules/services/hal.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.5.12/policy/modules/services/hal.te
--- nsaserefpolicy/policy/modules/services/hal.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/hal.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/hal.te 2008-10-10 16:08:15.000000000 -0400
@@ -49,6 +49,9 @@
type hald_var_lib_t;
files_type(hald_var_lib_t)
@@ -15889,9 +15753,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Should be removed when this is fixed
-#cron_read_system_job_lib_files(hald_t)
+cron_read_system_job_lib_files(hald_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.fc serefpolicy-3.5.11/policy/modules/services/inetd.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.fc serefpolicy-3.5.12/policy/modules/services/inetd.fc
--- nsaserefpolicy/policy/modules/services/inetd.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/inetd.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/inetd.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,6 +1,8 @@
/usr/sbin/identd -- gen_context(system_u:object_r:inetd_child_exec_t,s0)
@@ -15901,9 +15765,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/usr/sbin/inetd -- gen_context(system_u:object_r:inetd_exec_t,s0)
/usr/sbin/rlinetd -- gen_context(system_u:object_r:inetd_exec_t,s0)
/usr/sbin/xinetd -- gen_context(system_u:object_r:inetd_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.5.11/policy/modules/services/inetd.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.5.12/policy/modules/services/inetd.te
--- nsaserefpolicy/policy/modules/services/inetd.te 2008-09-03 07:59:15.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/inetd.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/inetd.te 2008-10-10 16:08:15.000000000 -0400
@@ -136,6 +136,7 @@
domain_use_interactive_fds(inetd_t)
@@ -15920,471 +15784,27 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
auth_use_nsswitch(inetd_child_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.fc serefpolicy-3.5.11/policy/modules/services/kerberos.fc
---- nsaserefpolicy/policy/modules/services/kerberos.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/kerberos.fc 2008-10-08 21:20:50.000000000 -0400
-@@ -4,15 +4,24 @@
- /etc/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_conf_t,s0)
- /etc/krb5kdc/kadm5\.keytab -- gen_context(system_u:object_r:krb5_keytab_t,s0)
- /etc/krb5kdc/principal.* gen_context(system_u:object_r:krb5kdc_principal_t,s0)
-+/etc/rc\.d/init\.d/kadmind -- gen_context(system_u:object_r:kerberos_initrc_exec_t,s0)
-+/etc/rc\.d/init\.d/krb524d -- gen_context(system_u:object_r:kerberos_initrc_exec_t,s0)
-+/etc/rc\.d/init\.d/kpropd -- gen_context(system_u:object_r:kerberos_initrc_exec_t,s0)
-+/etc/rc\.d/init\.d/krb5kdc -- gen_context(system_u:object_r:kerberos_initrc_exec_t,s0)
-
- /usr/(local/)?(kerberos/)?sbin/krb5kdc -- gen_context(system_u:object_r:krb5kdc_exec_t,s0)
- /usr/(local/)?(kerberos/)?sbin/kadmind -- gen_context(system_u:object_r:kadmind_exec_t,s0)
-+/usr/kerberos/sbin/kadmin\.local -- gen_context(system_u:object_r:kadmind_exec_t,s0)
-
- /usr/local/var/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_conf_t,s0)
- /usr/local/var/krb5kdc/principal.* gen_context(system_u:object_r:krb5kdc_principal_t,s0)
-
- /var/kerberos/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_conf_t,s0)
- /var/kerberos/krb5kdc/principal.* gen_context(system_u:object_r:krb5kdc_principal_t,s0)
-+/var/kerberos/krb5kdc/from_master.* gen_context(system_u:object_r:krb5kdc_lock_t,s0)
-+/var/kerberos/krb5kdc/principal\.ok gen_context(system_u:object_r:krb5kdc_lock_t,s0)
-
- /var/log/krb5kdc\.log gen_context(system_u:object_r:krb5kdc_log_t,s0)
- /var/log/kadmin(d)?\.log gen_context(system_u:object_r:kadmind_log_t,s0)
-+
-+/var/tmp/host_0 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-3.5.11/policy/modules/services/kerberos.if
---- nsaserefpolicy/policy/modules/services/kerberos.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/kerberos.if 2008-10-09 07:56:36.000000000 -0400
-@@ -23,6 +23,43 @@
-
- ########################################
- ##
-+## Execute a kadmind_exec_t in the current domain
-+##
-+##
-+##
-+## Domain allowed to transition.
-+##
-+##
-+#
-+interface(`kerberos_exec_kadmind',`
-+ gen_require(`
-+ type kadmind_exec_t;
-+ ')
-+
-+ can_exec($1,kadmind_exec_t)
-+')
-+
-+########################################
-+##
-+## Execute a domain transition to run kpropd.
-+##
-+##
-+##
-+## Domain allowed to transition.
-+##
-+##
-+#
-+interface(`kerberos_domtrans_kpropd',`
-+ gen_require(`
-+ type kpropd_t;
-+ type kpropd_exec_t;
-+ ')
-+
-+ domtrans_pattern($1, kpropd_exec_t, kpropd_t)
-+')
-+
-+########################################
-+##
- ## Use kerberos services
- ##
- ##
-@@ -42,7 +79,14 @@
- dontaudit $1 krb5kdc_conf_t:dir list_dir_perms;
- dontaudit $1 krb5kdc_conf_t:file rw_file_perms;
-
-+ #kerberos libraries are attempting to set the correct file context
-+ dontaudit $1 self:process setfscreate;
-+ selinux_dontaudit_validate_context($1)
-+ seutil_dontaudit_read_file_contexts($1)
-+
- tunable_policy(`allow_kerberos',`
-+ fs_rw_tmpfs_files($1)
-+
- allow $1 self:tcp_socket create_socket_perms;
- allow $1 self:udp_socket create_socket_perms;
-
-@@ -60,11 +104,7 @@
- corenet_tcp_connect_ocsp_port($1)
- corenet_sendrecv_kerberos_client_packets($1)
- corenet_sendrecv_ocsp_client_packets($1)
--
-- sysnet_read_config($1)
-- sysnet_dns_name_resolve($1)
- ')
--
- optional_policy(`
- tunable_policy(`allow_kerberos',`
- pcscd_stream_connect($1)
-@@ -153,6 +193,32 @@
-
- ########################################
- ##
-+## Create a derived type for kerberos keytab
-+##
-+##
-+##
-+## The prefix to be used for deriving type names.
-+##
-+##
-+##
-+##
-+## Domain allowed access.
-+##
-+##
-+#
-+template(`kerberos_keytab_template',`
-+
-+ type $1_keytab_t;
-+ files_type($1_keytab_t)
-+
-+ allow $2 $1_keytab_t:file read_file_perms;
-+
-+ kerberos_read_keytab($2)
-+ kerberos_use($2)
-+')
-+
-+########################################
-+##
- ## Read the kerberos kdc configuration file (/etc/krb5kdc.conf).
- ##
- ##
-@@ -168,6 +234,123 @@
- ')
-
- files_search_etc($1)
-- allow $1 krb5kdc_conf_t:file read_file_perms;
-+ read_files_pattern($1, krb5kdc_conf_t, krb5kdc_conf_t)
-+')
-
-+########################################
-+##
-+## Read the kerberos kdc configuration file (/etc/krb5kdc.conf).
-+##
-+##
-+##
-+## Domain allowed access.
-+##
-+##
-+##
-+#
-+interface(`kerberos_manage_host_rcache',`
-+ gen_require(`
-+ type krb5_host_rcache_t;
-+ ')
-+
-+ tunable_policy(`allow_kerberos',`
-+ files_search_tmp($1)
-+ allow $1 self:process setfscreate;
-+ selinux_validate_context($1)
-+ seutil_read_file_contexts($1)
-+ allow $1 krb5_host_rcache_t:file manage_file_perms;
-+ ')
-+ # creates files as system_u no matter what the selinux user
-+ domain_obj_id_change_exemption($1)
- ')
-+
-+########################################
-+##
-+## Connect to krb524 service
-+##
-+##
-+##
-+## Domain allowed access.
-+##
-+##
-+#
-+interface(`kerberos_524_connect',`
-+ tunable_policy(`allow_kerberos',`
-+ allow $1 self:udp_socket create_socket_perms;
-+ corenet_all_recvfrom_unlabeled($1)
-+ corenet_udp_sendrecv_all_if($1)
-+ corenet_udp_sendrecv_all_nodes($1)
-+ corenet_udp_sendrecv_kerberos_master_port($1)
-+ corenet_udp_bind_all_nodes($1)
-+ ')
-+')
-+
-+########################################
-+##
-+## All of the rules required to administrate
-+## an kerberos environment
-+##
-+##
-+##
-+## Domain allowed access.
-+##
-+##
-+##
-+##
-+## The role to be allowed to manage the kerberos domain.
-+##
-+##
-+##
-+#
-+interface(`kerberos_admin',`
-+ gen_require(`
-+ type kadmind_t, krb5kdc_t, kerberos_initrc_exec_t;
-+ type kadmind_log_t, kadmind_tmp_t, kadmind_var_run_t;
-+ type krb5_conf_t, krb5_keytab_t, krb5kdc_conf_t;
-+ type krb5kdc_principal_t, krb5kdc_tmp_t;
-+ type krb5kdc_var_run_t, krb5_host_rcache_t;
-+ type kadmind_spool_t, kadmind_var_lib_t, kpropd_t;
-+ ')
-+
-+ allow $1 kadmind_t:process { ptrace signal_perms };
-+ ps_process_pattern($1, kadmind_t)
-+
-+ allow $1 krb5kdc_t:process { ptrace signal_perms };
-+ ps_process_pattern($1, krb5kdc_t)
-+
-+ allow $1 kpropd_t:process { ptrace signal_perms };
-+ ps_process_pattern($1, kpropd_t)
-+
-+ init_labeled_script_domtrans($1, kerberos_initrc_exec_t)
-+ domain_system_change_exemption($1)
-+ role_transition $2 kerberos_initrc_exec_t system_r;
-+ allow $2 system_r;
-+
-+ logging_list_logs($1)
-+ admin_pattern($1, kadmind_log_t)
-+
-+ files_list_spool($1)
-+ admin_pattern($1, kadmind_spool_t)
-+
-+ files_list_tmp($1)
-+ admin_pattern($1, kadmind_tmp_t)
-+
-+ files_list_var_lib($1)
-+ admin_pattern($1, kadmind_var_lib_t)
-+
-+ files_list_pids($1)
-+ admin_pattern($1, kadmind_var_run_t)
-+
-+ admin_pattern($1, krb5_conf_t)
-+
-+ admin_pattern($1, krb5_host_rcache_t)
-+
-+ admin_pattern($1, krb5_keytab_t)
-+
-+ admin_pattern($1, krb5kdc_principal_t)
-+
-+ admin_pattern($1, krb5kdc_tmp_t)
-+
-+ admin_pattern($1, krb5kdc_var_run_t)
-+')
-+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.5.11/policy/modules/services/kerberos.te
---- nsaserefpolicy/policy/modules/services/kerberos.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/kerberos.te 2008-10-08 20:36:17.000000000 -0400
-@@ -16,6 +16,7 @@
- type kadmind_t;
- type kadmind_exec_t;
- init_daemon_domain(kadmind_t, kadmind_exec_t)
-+domain_obj_id_change_exemption(kadmind_t)
-
- type kadmind_log_t;
- logging_log_file(kadmind_log_t)
-@@ -37,6 +38,9 @@
- type krb5kdc_conf_t;
- files_type(krb5kdc_conf_t)
-
-+type krb5kdc_lock_t;
-+files_type(krb5kdc_lock_t)
-+
- # types for KDC principal file(s)
- type krb5kdc_principal_t;
- files_type(krb5kdc_principal_t)
-@@ -44,6 +48,7 @@
- type krb5kdc_t;
- type krb5kdc_exec_t;
- init_daemon_domain(krb5kdc_t, krb5kdc_exec_t)
-+domain_obj_id_change_exemption(krb5kdc_t)
-
- type krb5kdc_log_t;
- logging_log_file(krb5kdc_log_t)
-@@ -54,6 +59,16 @@
- type krb5kdc_var_run_t;
- files_pid_file(krb5kdc_var_run_t)
-
-+type krb5_host_rcache_t;
-+files_tmp_file(krb5_host_rcache_t)
-+
-+type kerberos_initrc_exec_t;
-+init_script_file(kerberos_initrc_exec_t)
-+
-+type kpropd_t;
-+type kpropd_exec_t;
-+init_daemon_domain(kpropd_t, kpropd_exec_t)
-+
- ########################################
- #
- # kadmind local policy
-@@ -62,7 +77,7 @@
- # Use capabilities. Surplus capabilities may be allowed.
- allow kadmind_t self:capability { setuid setgid chown fowner dac_override sys_nice };
- dontaudit kadmind_t self:capability sys_tty_config;
--allow kadmind_t self:process signal_perms;
-+allow kadmind_t self:process { setfscreate signal_perms };
- allow kadmind_t self:netlink_route_socket r_netlink_socket_perms;
- allow kadmind_t self:unix_dgram_socket { connect create write };
- allow kadmind_t self:tcp_socket connected_stream_socket_perms;
-@@ -77,7 +92,9 @@
- read_files_pattern(kadmind_t, krb5kdc_conf_t, krb5kdc_conf_t)
- dontaudit kadmind_t krb5kdc_conf_t:file { write setattr };
-
--allow kadmind_t krb5kdc_principal_t:file { getattr lock read write setattr };
-+allow kadmind_t krb5kdc_principal_t:file manage_file_perms;
-+filetrans_pattern(kadmind_t, krb5kdc_conf_t, krb5kdc_principal_t, file)
-+allow kadmind_t krb5kdc_lock_t:file { rw_file_perms setattr };
-
- can_exec(kadmind_t, kadmind_exec_t)
-
-@@ -91,6 +108,7 @@
- kernel_read_kernel_sysctls(kadmind_t)
- kernel_list_proc(kadmind_t)
- kernel_read_proc_symlinks(kadmind_t)
-+kernel_read_system_state(kadmind_t)
-
- corenet_all_recvfrom_unlabeled(kadmind_t)
- corenet_all_recvfrom_netlabel(kadmind_t)
-@@ -118,6 +136,12 @@
- domain_use_interactive_fds(kadmind_t)
-
- files_read_etc_files(kadmind_t)
-+files_read_usr_symlinks(kadmind_t)
-+files_read_usr_files(kadmind_t)
-+files_read_var_files(kadmind_t)
-+
-+selinux_validate_context(kadmind_t)
-+seutil_read_file_contexts(kadmind_t)
-
- libs_use_ld_so(kadmind_t)
- libs_use_shared_libs(kadmind_t)
-@@ -127,9 +151,9 @@
- miscfiles_read_localization(kadmind_t)
-
- sysnet_read_config(kadmind_t)
-+sysnet_use_ldap(kadmind_t)
-
- userdom_dontaudit_use_unpriv_user_fds(kadmind_t)
--
- sysadm_dontaudit_search_home_dirs(kadmind_t)
-
- optional_policy(`
-@@ -138,6 +162,7 @@
-
- optional_policy(`
- seutil_sigchld_newrole(kadmind_t)
-+ seutil_read_file_contexts(kadmind_t)
- ')
-
- optional_policy(`
-@@ -152,7 +177,7 @@
- # Use capabilities. Surplus capabilities may be allowed.
- allow krb5kdc_t self:capability { setuid setgid net_admin chown fowner dac_override sys_nice };
- dontaudit krb5kdc_t self:capability sys_tty_config;
--allow krb5kdc_t self:process { setsched getsched signal_perms };
-+allow krb5kdc_t self:process { setfscreate setsched getsched signal_perms };
- allow krb5kdc_t self:netlink_route_socket r_netlink_socket_perms;
- allow krb5kdc_t self:tcp_socket create_stream_socket_perms;
- allow krb5kdc_t self:udp_socket create_socket_perms;
-@@ -166,6 +191,8 @@
- read_files_pattern(krb5kdc_t, krb5kdc_conf_t, krb5kdc_conf_t)
- dontaudit krb5kdc_t krb5kdc_conf_t:file write;
-
-+allow krb5kdc_t krb5kdc_lock_t:file { rw_file_perms setattr };
-+
- allow krb5kdc_t krb5kdc_log_t:file manage_file_perms;
- logging_log_filetrans(krb5kdc_t, krb5kdc_log_t, file)
-
-@@ -216,6 +243,9 @@
- files_read_usr_symlinks(krb5kdc_t)
- files_read_var_files(krb5kdc_t)
-
-+selinux_validate_context(krb5kdc_t)
-+seutil_read_file_contexts(krb5kdc_t)
-+
- libs_use_ld_so(krb5kdc_t)
- libs_use_shared_libs(krb5kdc_t)
-
-@@ -224,9 +254,9 @@
- miscfiles_read_localization(krb5kdc_t)
-
- sysnet_read_config(krb5kdc_t)
-+sysnet_use_ldap(krb5kdc_t)
-
- userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t)
--
- sysadm_dontaudit_search_home_dirs(krb5kdc_t)
-
- optional_policy(`
-@@ -235,8 +265,49 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.5.12/policy/modules/services/kerberos.te
+--- nsaserefpolicy/policy/modules/services/kerberos.te 2008-10-10 15:53:03.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/kerberos.te 2008-10-10 16:08:56.000000000 -0400
+@@ -298,6 +298,7 @@
+ corenet_tcp_sendrecv_all_nodes(kpropd_t)
+ corenet_tcp_sendrecv_all_ports(kpropd_t)
+ corenet_tcp_bind_all_nodes(kpropd_t)
++corenet_tcp_bind_kprop_port(kpropd_t)
- optional_policy(`
- seutil_sigchld_newrole(krb5kdc_t)
-+ seutil_read_file_contexts(krb5kdc_t)
- ')
+ dev_read_urand(kpropd_t)
- optional_policy(`
- udev_read_db(krb5kdc_t)
- ')
-+
-+########################################
-+#
-+# kpropd local policy
-+#
-+
-+allow kpropd_t self:capability net_bind_service;
-+allow kpropd_t self:fifo_file rw_file_perms;
-+allow kpropd_t self:unix_stream_socket create_stream_socket_perms;
-+allow kpropd_t self:tcp_socket create_stream_socket_perms;
-+
-+allow kpropd_t krb5_host_rcache_t:file rw_file_perms;
-+allow kpropd_t krb5_keytab_t:file read_file_perms;
-+
-+manage_files_pattern(kpropd_t, krb5kdc_conf_t, krb5kdc_principal_t)
-+
-+corecmd_exec_bin(kpropd_t)
-+
-+corenet_all_recvfrom_unlabeled(kpropd_t)
-+corenet_tcp_sendrecv_all_if(kpropd_t)
-+corenet_tcp_sendrecv_all_nodes(kpropd_t)
-+corenet_tcp_sendrecv_all_ports(kpropd_t)
-+corenet_tcp_bind_all_nodes(kpropd_t)
-+corenet_tcp_bind_kprop_port(kpropd_t)
-+
-+files_read_etc_files(kpropd_t)
-+files_search_tmp(kpropd_t)
-+
-+dev_read_urand(kpropd_t)
-+
-+libs_use_ld_so(kpropd_t)
-+libs_use_shared_libs(kpropd_t)
-+
-+logging_send_syslog_msg(kpropd_t)
-+
-+miscfiles_read_localization(kpropd_t)
-+
-+sysnet_dns_name_resolve(kpropd_t)
-+
-+kerberos_use(kpropd_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.fc serefpolicy-3.5.11/policy/modules/services/kerneloops.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.fc serefpolicy-3.5.12/policy/modules/services/kerneloops.fc
--- nsaserefpolicy/policy/modules/services/kerneloops.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/kerneloops.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/kerneloops.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1 +1,3 @@
+/etc/rc\.d/init\.d/kerneloops -- gen_context(system_u:object_r:kerneloops_initrc_exec_t,s0)
+
/usr/sbin/kerneloops -- gen_context(system_u:object_r:kerneloops_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.if serefpolicy-3.5.11/policy/modules/services/kerneloops.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.if serefpolicy-3.5.12/policy/modules/services/kerneloops.if
--- nsaserefpolicy/policy/modules/services/kerneloops.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/kerneloops.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/kerneloops.if 2008-10-10 16:08:15.000000000 -0400
@@ -71,13 +71,25 @@
## Domain allowed access.
##
@@ -16411,9 +15831,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow $2 system_r;
+
')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.te serefpolicy-3.5.11/policy/modules/services/kerneloops.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.te serefpolicy-3.5.12/policy/modules/services/kerneloops.te
--- nsaserefpolicy/policy/modules/services/kerneloops.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/kerneloops.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/kerneloops.te 2008-10-10 16:08:15.000000000 -0400
@@ -10,13 +10,16 @@
type kerneloops_exec_t;
init_daemon_domain(kerneloops_t, kerneloops_exec_t)
@@ -16441,9 +15861,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_all_recvfrom_unlabeled(kerneloops_t)
corenet_all_recvfrom_netlabel(kerneloops_t)
corenet_tcp_sendrecv_all_if(kerneloops_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.te serefpolicy-3.5.11/policy/modules/services/ldap.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.te serefpolicy-3.5.12/policy/modules/services/ldap.te
--- nsaserefpolicy/policy/modules/services/ldap.te 2008-10-08 19:00:27.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/ldap.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/ldap.te 2008-10-10 16:08:15.000000000 -0400
@@ -121,7 +121,7 @@
sysadm_dontaudit_search_home_dirs(slapd_t)
@@ -16453,9 +15873,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.fc serefpolicy-3.5.11/policy/modules/services/lpd.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.fc serefpolicy-3.5.12/policy/modules/services/lpd.fc
--- nsaserefpolicy/policy/modules/services/lpd.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/lpd.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/lpd.fc 2008-10-10 16:08:15.000000000 -0400
@@ -22,11 +22,14 @@
/usr/sbin/lpinfo -- gen_context(system_u:object_r:lpr_exec_t,s0)
/usr/sbin/lpmove -- gen_context(system_u:object_r:lpr_exec_t,s0)
@@ -16471,17 +15891,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/spool/cups-pdf(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh)
/var/spool/lpd(/.*)? gen_context(system_u:object_r:print_spool_t,s0)
/var/run/lprng(/.*)? gen_context(system_u:object_r:lpd_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.fc serefpolicy-3.5.11/policy/modules/services/mailman.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.fc serefpolicy-3.5.12/policy/modules/services/mailman.fc
--- nsaserefpolicy/policy/modules/services/mailman.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/mailman.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/mailman.fc 2008-10-10 16:08:15.000000000 -0400
@@ -31,3 +31,4 @@
/var/lock/mailman(/.*)? gen_context(system_u:object_r:mailman_lock_t,s0)
/var/spool/mailman(/.*)? gen_context(system_u:object_r:mailman_data_t,s0)
')
+/usr/lib/mailman/mail/mailman -- gen_context(system_u:object_r:mailman_mail_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-3.5.11/policy/modules/services/mailman.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-3.5.12/policy/modules/services/mailman.if
--- nsaserefpolicy/policy/modules/services/mailman.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/mailman.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/mailman.if 2008-10-10 16:08:15.000000000 -0400
@@ -31,6 +31,12 @@
allow mailman_$1_t self:tcp_socket create_stream_socket_perms;
allow mailman_$1_t self:udp_socket create_socket_perms;
@@ -16529,9 +15949,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Append to mailman logs.
##
##
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.5.11/policy/modules/services/mailman.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.5.12/policy/modules/services/mailman.te
--- nsaserefpolicy/policy/modules/services/mailman.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/mailman.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/mailman.te 2008-10-10 16:08:15.000000000 -0400
@@ -53,10 +53,9 @@
apache_use_fds(mailman_cgi_t)
apache_dontaudit_append_log(mailman_cgi_t)
@@ -16585,15 +16005,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
cron_system_entry(mailman_queue_t, mailman_queue_exec_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.5.11/policy/modules/services/mailscanner.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.5.12/policy/modules/services/mailscanner.fc
--- nsaserefpolicy/policy/modules/services/mailscanner.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/mailscanner.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/mailscanner.fc 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,2 @@
+/var/spool/MailScanner(/.*)? gen_context(system_u:object_r:mailscanner_spool_t,s0)
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.5.11/policy/modules/services/mailscanner.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.5.12/policy/modules/services/mailscanner.if
--- nsaserefpolicy/policy/modules/services/mailscanner.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/mailscanner.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/mailscanner.if 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,59 @@
+## Anti-Virus and Anti-Spam Filter
+
@@ -16654,36 +16074,27 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ files_search_spool($1)
+ manage_files_pattern($1, mailscanner_spool_t, mailscanner_spool_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.5.11/policy/modules/services/mailscanner.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.5.12/policy/modules/services/mailscanner.te
--- nsaserefpolicy/policy/modules/services/mailscanner.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/mailscanner.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/mailscanner.te 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,5 @@
+
+policy_module(mailscanner, 1.0.0)
+
+type mailscanner_spool_t;
+files_type(mailscanner_spool_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/memcached.te serefpolicy-3.5.11/policy/modules/services/memcached.te
---- nsaserefpolicy/policy/modules/services/memcached.te 2008-10-08 19:00:27.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/memcached.te 2008-10-08 20:36:17.000000000 -0400
-@@ -35,6 +35,8 @@
- corenet_tcp_sendrecv_all_nodes(memcached_t)
- corenet_tcp_sendrecv_all_ports(memcached_t)
- corenet_tcp_bind_all_nodes(memcached_t)
-+corenet_tcp_bind_memcache_port(memcached_t)
-+corenet_udp_bind_memcache_port(memcached_t)
-
- manage_dirs_pattern(memcached_t, memcached_var_run_t, memcached_var_run_t)
- manage_files_pattern(memcached_t, memcached_var_run_t, memcached_var_run_t)
-@@ -48,3 +50,5 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/memcached.te serefpolicy-3.5.12/policy/modules/services/memcached.te
+--- nsaserefpolicy/policy/modules/services/memcached.te 2008-10-10 15:53:03.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/memcached.te 2008-10-10 16:08:15.000000000 -0400
+@@ -50,3 +50,5 @@
miscfiles_read_localization(memcached_t)
sysnet_dns_name_resolve(memcached_t)
+
+permissive memcached_t;
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.5.11/policy/modules/services/mta.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.5.12/policy/modules/services/mta.fc
--- nsaserefpolicy/policy/modules/services/mta.fc 2008-09-12 10:48:05.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/mta.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/mta.fc 2008-10-10 16:08:15.000000000 -0400
@@ -22,7 +22,3 @@
/var/spool/imap(/.*)? gen_context(system_u:object_r:mail_spool_t,s0)
/var/spool/(client)?mqueue(/.*)? gen_context(system_u:object_r:mqueue_spool_t,s0)
@@ -16692,9 +16103,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-#ifdef(`postfix.te', `', `
-#/var/spool/postfix(/.*)? gen_context(system_u:object_r:mail_spool_t,s0)
-#')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.5.11/policy/modules/services/mta.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.5.12/policy/modules/services/mta.if
--- nsaserefpolicy/policy/modules/services/mta.if 2008-09-12 10:48:05.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/mta.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/mta.if 2008-10-10 16:08:15.000000000 -0400
@@ -133,6 +133,15 @@
sendmail_create_log($1_mail_t)
')
@@ -16815,9 +16226,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Create, read, write, and delete
## mail queue files.
##
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.5.11/policy/modules/services/mta.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.5.12/policy/modules/services/mta.te
--- nsaserefpolicy/policy/modules/services/mta.te 2008-09-12 10:48:05.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/mta.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/mta.te 2008-10-10 16:08:15.000000000 -0400
@@ -39,34 +39,50 @@
#
@@ -16950,9 +16361,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
# why is mail delivered to a directory of type arpwatch_data_t?
arpwatch_search_data(mailserver_delivery)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.fc serefpolicy-3.5.11/policy/modules/services/munin.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.fc serefpolicy-3.5.12/policy/modules/services/munin.fc
--- nsaserefpolicy/policy/modules/services/munin.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/munin.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/munin.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,4 +1,5 @@
/etc/munin(/.*)? gen_context(system_u:object_r:munin_etc_t,s0)
+/etc/rc\.d/init\.d/munin-node -- gen_context(system_u:object_r:munin_initrc_exec_t,s0)
@@ -16970,9 +16381,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/www/html/munin(/.*)? gen_context(system_u:object_r:httpd_munin_content_t,s0)
+/var/www/html/munin/cgi(/.*)? gen_context(system_u:object_r:httpd_munin_script_exec_t,s0)
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.if serefpolicy-3.5.11/policy/modules/services/munin.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.if serefpolicy-3.5.12/policy/modules/services/munin.if
--- nsaserefpolicy/policy/modules/services/munin.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/munin.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/munin.if 2008-10-10 16:08:15.000000000 -0400
@@ -80,3 +80,76 @@
dontaudit $1 munin_var_lib_t:dir search_dir_perms;
@@ -17050,9 +16461,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ admin_pattern($1, httpd_munin_content_t)
+')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.te serefpolicy-3.5.11/policy/modules/services/munin.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.te serefpolicy-3.5.12/policy/modules/services/munin.te
--- nsaserefpolicy/policy/modules/services/munin.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/munin.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/munin.te 2008-10-10 16:08:15.000000000 -0400
@@ -13,6 +13,9 @@
type munin_etc_t alias lrrd_etc_t;
files_config_file(munin_etc_t)
@@ -17180,9 +16591,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+manage_dirs_pattern(munin_t, httpd_munin_content_t, httpd_munin_content_t)
+manage_files_pattern(munin_t, httpd_munin_content_t, httpd_munin_content_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.fc serefpolicy-3.5.11/policy/modules/services/mysql.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.fc serefpolicy-3.5.12/policy/modules/services/mysql.fc
--- nsaserefpolicy/policy/modules/services/mysql.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/mysql.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/mysql.fc 2008-10-10 16:08:15.000000000 -0400
@@ -5,6 +5,7 @@
#
/etc/my\.cnf -- gen_context(system_u:object_r:mysqld_etc_t,s0)
@@ -17191,9 +16602,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
#
# /usr
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.if serefpolicy-3.5.11/policy/modules/services/mysql.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.if serefpolicy-3.5.12/policy/modules/services/mysql.if
--- nsaserefpolicy/policy/modules/services/mysql.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/mysql.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/mysql.if 2008-10-10 16:08:15.000000000 -0400
@@ -53,9 +53,11 @@
interface(`mysql_stream_connect',`
gen_require(`
@@ -17254,9 +16665,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+ admin_pattern($1, mysqld_tmp_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.5.11/policy/modules/services/mysql.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.5.12/policy/modules/services/mysql.te
--- nsaserefpolicy/policy/modules/services/mysql.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/mysql.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/mysql.te 2008-10-10 16:08:15.000000000 -0400
@@ -19,6 +19,9 @@
type mysqld_etc_t alias etc_mysqld_t;
files_config_file(mysqld_etc_t)
@@ -17285,9 +16696,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domain_use_interactive_fds(mysqld_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.5.11/policy/modules/services/nagios.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.5.12/policy/modules/services/nagios.fc
--- nsaserefpolicy/policy/modules/services/nagios.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/nagios.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/nagios.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,16 +1,19 @@
/etc/nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0)
/etc/nagios/nrpe\.cfg -- gen_context(system_u:object_r:nrpe_etc_t,s0)
@@ -17312,9 +16723,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
+/usr/lib(64)?/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0)
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.5.11/policy/modules/services/nagios.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.5.12/policy/modules/services/nagios.if
--- nsaserefpolicy/policy/modules/services/nagios.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/nagios.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/nagios.if 2008-10-10 16:08:15.000000000 -0400
@@ -44,7 +44,7 @@
########################################
@@ -17395,9 +16806,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+ admin_pattern($1, nrpe_etc_t)
')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.5.11/policy/modules/services/nagios.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.5.12/policy/modules/services/nagios.te
--- nsaserefpolicy/policy/modules/services/nagios.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/nagios.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/nagios.te 2008-10-10 16:08:15.000000000 -0400
@@ -10,13 +10,12 @@
type nagios_exec_t;
init_daemon_domain(nagios_t, nagios_exec_t)
@@ -17496,9 +16907,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
#
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.5.11/policy/modules/services/networkmanager.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.5.12/policy/modules/services/networkmanager.fc
--- nsaserefpolicy/policy/modules/services/networkmanager.fc 2008-09-24 09:07:28.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/networkmanager.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/networkmanager.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,8 +1,12 @@
+/etc/NetworkManager/dispatcher\.d(/.*) gen_context(system_u:object_r:NetworkManager_initrc_exec_t,s0)
+
@@ -17517,9 +16928,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
/var/run/wpa_supplicant-global -s gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
+/var/run/nm-dhclient.* gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.5.11/policy/modules/services/networkmanager.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.5.12/policy/modules/services/networkmanager.if
--- nsaserefpolicy/policy/modules/services/networkmanager.if 2008-09-11 11:28:34.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/networkmanager.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/networkmanager.if 2008-10-10 16:08:15.000000000 -0400
@@ -118,6 +118,24 @@
########################################
@@ -17545,9 +16956,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Read NetworkManager PID files.
##
##
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.5.11/policy/modules/services/networkmanager.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.5.12/policy/modules/services/networkmanager.te
--- nsaserefpolicy/policy/modules/services/networkmanager.te 2008-09-24 09:07:28.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/networkmanager.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/networkmanager.te 2008-10-10 16:08:15.000000000 -0400
@@ -33,9 +33,9 @@
# networkmanager will ptrace itself if gdb is installed
@@ -17742,9 +17153,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+miscfiles_read_localization(wpa_cli_t)
+
+term_dontaudit_use_console(wpa_cli_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.5.11/policy/modules/services/nis.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.5.12/policy/modules/services/nis.fc
--- nsaserefpolicy/policy/modules/services/nis.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/nis.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/nis.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,9 +1,13 @@
+/etc/rc\.d/init\.d/yppasswd -- gen_context(system_u:object_r:nis_initrc_exec_t,s0)
@@ -17759,9 +17170,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/usr/sbin/rpc\.yppasswdd -- gen_context(system_u:object_r:yppasswdd_exec_t,s0)
/usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.5.11/policy/modules/services/nis.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.5.12/policy/modules/services/nis.if
--- nsaserefpolicy/policy/modules/services/nis.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/nis.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/nis.if 2008-10-10 16:08:15.000000000 -0400
@@ -28,7 +28,7 @@
type var_yp_t;
')
@@ -17892,9 +17303,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.5.11/policy/modules/services/nis.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.5.12/policy/modules/services/nis.te
--- nsaserefpolicy/policy/modules/services/nis.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/nis.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/nis.te 2008-10-10 16:08:15.000000000 -0400
@@ -44,6 +44,9 @@
type ypxfr_exec_t;
init_daemon_domain(ypxfr_t, ypxfr_exec_t)
@@ -17963,17 +17374,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)
corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t)
corenet_tcp_connect_all_ports(ypxfr_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.fc serefpolicy-3.5.11/policy/modules/services/nscd.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.fc serefpolicy-3.5.12/policy/modules/services/nscd.fc
--- nsaserefpolicy/policy/modules/services/nscd.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/nscd.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/nscd.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,3 +1,4 @@
+/etc/rc\.d/init\.d/nscd -- gen_context(system_u:object_r:nscd_initrc_exec_t,s0)
/usr/sbin/nscd -- gen_context(system_u:object_r:nscd_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.5.11/policy/modules/services/nscd.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.5.12/policy/modules/services/nscd.if
--- nsaserefpolicy/policy/modules/services/nscd.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/nscd.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/nscd.if 2008-10-10 16:08:15.000000000 -0400
@@ -70,15 +70,14 @@
interface(`nscd_socket_use',`
gen_require(`
@@ -18053,9 +17464,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ admin_pattern($1, nscd_var_run_t)
+')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.5.11/policy/modules/services/nscd.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.5.12/policy/modules/services/nscd.te
--- nsaserefpolicy/policy/modules/services/nscd.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/nscd.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/nscd.te 2008-10-10 16:08:15.000000000 -0400
@@ -20,6 +20,9 @@
type nscd_exec_t;
init_daemon_domain(nscd_t, nscd_exec_t)
@@ -18153,9 +17564,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ samba_read_config(nscd_t)
+ samba_read_var_files(nscd_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.if serefpolicy-3.5.11/policy/modules/services/ntp.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.if serefpolicy-3.5.12/policy/modules/services/ntp.if
--- nsaserefpolicy/policy/modules/services/ntp.if 2008-10-08 19:00:27.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/ntp.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/ntp.if 2008-10-10 16:08:15.000000000 -0400
@@ -56,6 +56,24 @@
########################################
@@ -18181,9 +17592,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## All of the rules required to administrate
## an ntp environment
##
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.5.11/policy/modules/services/ntp.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.5.12/policy/modules/services/ntp.te
--- nsaserefpolicy/policy/modules/services/ntp.te 2008-10-08 19:00:27.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/ntp.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/ntp.te 2008-10-10 16:08:15.000000000 -0400
@@ -42,6 +42,7 @@
dontaudit ntpd_t self:capability { net_admin sys_tty_config fsetid sys_nice };
allow ntpd_t self:process { signal_perms getcap setcap setsched setrlimit };
@@ -18201,18 +17612,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
term_use_ptmx(ntpd_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.fc serefpolicy-3.5.11/policy/modules/services/oddjob.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.fc serefpolicy-3.5.12/policy/modules/services/oddjob.fc
--- nsaserefpolicy/policy/modules/services/oddjob.fc 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/oddjob.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/oddjob.fc 2008-10-10 16:08:15.000000000 -0400
@@ -1,4 +1,4 @@
-/usr/lib/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0)
+/usr/lib(64)?/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0)
/usr/sbin/oddjobd -- gen_context(system_u:object_r:oddjob_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.if serefpolicy-3.5.11/policy/modules/services/oddjob.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.if serefpolicy-3.5.12/policy/modules/services/oddjob.if
--- nsaserefpolicy/policy/modules/services/oddjob.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/oddjob.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/oddjob.if 2008-10-10 16:08:15.000000000 -0400
@@ -44,6 +44,7 @@
')
@@ -18256,9 +17667,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ role $2 types oddjob_mkhomedir_t;
+ dontaudit oddjob_mkhomedir_t $3:chr_file rw_term_perms;
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-3.5.11/policy/modules/services/oddjob.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-3.5.12/policy/modules/services/oddjob.te
--- nsaserefpolicy/policy/modules/services/oddjob.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/oddjob.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/oddjob.te 2008-10-10 16:08:15.000000000 -0400
@@ -10,14 +10,21 @@
type oddjob_exec_t;
domain_type(oddjob_t)
@@ -18318,9 +17729,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Add/remove user home directories
unprivuser_home_filetrans_home_dir(oddjob_mkhomedir_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.5.11/policy/modules/services/openvpn.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.5.12/policy/modules/services/openvpn.te
--- nsaserefpolicy/policy/modules/services/openvpn.te 2008-10-08 19:00:27.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/openvpn.te 2008-10-08 21:04:11.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/openvpn.te 2008-10-10 16:08:15.000000000 -0400
@@ -117,3 +117,11 @@
networkmanager_dbus_chat(openvpn_t)
@@ -18333,9 +17744,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ unconfined_use_terms(openvpn_t)
+')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pads.fc serefpolicy-3.5.11/policy/modules/services/pads.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pads.fc serefpolicy-3.5.12/policy/modules/services/pads.fc
--- nsaserefpolicy/policy/modules/services/pads.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/pads.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/pads.fc 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,12 @@
+
+/etc/pads-ether-codes -- gen_context(system_u:object_r:pads_config_t, s0)
@@ -18349,9 +17760,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/var/run/pads.pid -- gen_context(system_u:object_r:pads_var_run_t, s0)
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pads.if serefpolicy-3.5.11/policy/modules/services/pads.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pads.if serefpolicy-3.5.12/policy/modules/services/pads.if
--- nsaserefpolicy/policy/modules/services/pads.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/pads.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/pads.if 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,10 @@
+## SELinux policy for PADS daemon.
+##
@@ -18363,9 +17774,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+##
+##
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pads.te serefpolicy-3.5.11/policy/modules/services/pads.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pads.te serefpolicy-3.5.12/policy/modules/services/pads.te
--- nsaserefpolicy/policy/modules/services/pads.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/pads.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/pads.te 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,68 @@
+
+policy_module(pads, 0.0.1)
@@ -18435,9 +17846,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+optional_policy(`
+ prelude_manage_spool(pads_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-3.5.11/policy/modules/services/pcscd.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-3.5.12/policy/modules/services/pcscd.te
--- nsaserefpolicy/policy/modules/services/pcscd.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/pcscd.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/pcscd.te 2008-10-10 16:08:15.000000000 -0400
@@ -10,6 +10,7 @@
type pcscd_exec_t;
domain_type(pcscd_t)
@@ -18461,9 +17872,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
openct_stream_connect(pcscd_t)
openct_read_pid_files(pcscd_t)
openct_signull(pcscd_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.5.11/policy/modules/services/pegasus.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.5.12/policy/modules/services/pegasus.te
--- nsaserefpolicy/policy/modules/services/pegasus.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.11/policy/modules/services/pegasus.te 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/pegasus.te 2008-10-10 16:08:15.000000000 -0400
@@ -66,6 +66,7 @@
kernel_read_system_state(pegasus_t)
kernel_search_vm_sysctl(pegasus_t)
@@ -18496,9 +17907,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
sysnet_domtrans_ifconfig(pegasus_t)
userdom_dontaudit_use_unpriv_user_fds(pegasus_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.fc serefpolicy-3.5.11/policy/modules/services/polkit.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.fc serefpolicy-3.5.12/policy/modules/services/polkit.fc
--- nsaserefpolicy/policy/modules/services/polkit.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/polkit.fc 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/polkit.fc 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,9 @@
+
+/usr/libexec/polkit-read-auth-helper -- gen_context(system_u:object_r:polkit_auth_exec_t,s0)
@@ -18509,9 +17920,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/lib/PolicyKit(/.*)? gen_context(system_u:object_r:polkit_var_lib_t,s0)
+/var/run/PolicyKit(/.*)? gen_context(system_u:object_r:polkit_var_run_t,s0)
+/var/lib/PolicyKit-public(/.*)? gen_context(system_u:object_r:polkit_var_lib_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.if serefpolicy-3.5.11/policy/modules/services/polkit.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.if serefpolicy-3.5.12/policy/modules/services/polkit.if
--- nsaserefpolicy/policy/modules/services/polkit.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.11/policy/modules/services/polkit.if 2008-10-08 20:36:17.000000000 -0400
++++ serefpolicy-3.5.12/policy/modules/services/polkit.if 2008-10-10 16:08:15.000000000 -0400
@@ -0,0 +1,213 @@
+
+##