diff --git a/policy-F15.patch b/policy-F15.patch
index e1c2673..e08515a 100644
--- a/policy-F15.patch
+++ b/policy-F15.patch
@@ -3957,7 +3957,7 @@ index 9a6d67d..b0c1197 100644
## mozilla over dbus.
## </summary>
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
-index cbf4bec..9024e9a 100644
+index cbf4bec..62796d8 100644
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -25,6 +25,7 @@ files_config_file(mozilla_conf_t)
@@ -4030,7 +4030,7 @@ index cbf4bec..9024e9a 100644
pulseaudio_exec(mozilla_t)
pulseaudio_stream_connect(mozilla_t)
pulseaudio_manage_home_files(mozilla_t)
-@@ -266,3 +291,128 @@ optional_policy(`
+@@ -266,3 +291,129 @@ optional_policy(`
optional_policy(`
thunderbird_domtrans(mozilla_t)
')
@@ -4101,6 +4101,7 @@ index cbf4bec..9024e9a 100644
+
+miscfiles_read_localization(mozilla_plugin_t)
+miscfiles_read_fonts(mozilla_plugin_t)
++miscfiles_dontaudit_setattr_fonts_dirs(mozilla_plugin_t)
+
+sysnet_dns_name_resolve(mozilla_plugin_t)
+
@@ -7385,10 +7386,21 @@ index 82842a0..369c3b5 100644
dbus_system_bus_client($1_wm_t)
dbus_session_bus_client($1_wm_t)
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
-index 34c9d01..94ec653 100644
+index 34c9d01..4842e56 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
-@@ -128,8 +128,8 @@ ifdef(`distro_debian',`
+@@ -72,7 +72,9 @@ ifdef(`distro_redhat',`
+ /etc/kde/shutdown(/.*)? gen_context(system_u:object_r:bin_t,s0)
+
+ /etc/mail/make -- gen_context(system_u:object_r:bin_t,s0)
+-/etc/mgetty\+sendfax/new_fax -- gen_context(system_u:object_r:bin_t,s0)
++/etc/mcelog/cache-error-trigger -- gen_context(system_u:object_r:bin_t,s0)
++/etc/mcelog/triggers(/.*)? gen_context(system_u:object_r:bin_t,s0)
++etc/mgetty\+sendfax/new_fax -- gen_context(system_u:object_r:bin_t,s0)
+
+ /etc/netplug\.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
+
+@@ -128,8 +130,8 @@ ifdef(`distro_debian',`
/lib/readahead(/.*)? gen_context(system_u:object_r:bin_t,s0)
/lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0)
@@ -7398,7 +7410,7 @@ index 34c9d01..94ec653 100644
/lib/udev/scsi_id -- gen_context(system_u:object_r:bin_t,s0)
/lib/upstart(/.*)? gen_context(system_u:object_r:bin_t,s0)
-@@ -307,6 +307,7 @@ ifdef(`distro_redhat', `
+@@ -307,6 +309,7 @@ ifdef(`distro_redhat', `
/usr/lib64/.*/program(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib/bluetooth(/.*)? -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib64/bluetooth(/.*)? -- gen_context(system_u:object_r:bin_t,s0)
@@ -13273,7 +13285,7 @@ index 9e39aa5..3bfac20 100644
+/var/run/dirsrv/admin-serv.* gen_context(system_u:object_r:httpd_var_run_t,s0)
+/opt/dirsrv/var/run/dirsrv/dsgw/cookies(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
diff --git a/policy/modules/services/apache.if b/policy/modules/services/apache.if
-index c9e1a44..ef353c7 100644
+index c9e1a44..1a1ba36 100644
--- a/policy/modules/services/apache.if
+++ b/policy/modules/services/apache.if
@@ -13,17 +13,13 @@
@@ -13541,7 +13553,7 @@ index c9e1a44..ef353c7 100644
## Apache cache.
## </summary>
## <param name="domain">
-@@ -544,6 +580,27 @@ interface(`apache_delete_cache_files',`
+@@ -544,6 +580,26 @@ interface(`apache_delete_cache_files',`
########################################
## <summary>
@@ -13553,7 +13565,6 @@ index c9e1a44..ef353c7 100644
+## Domain allowed access.
+## </summary>
+## </param>
-+## <rolecap/>
+#
+interface(`apache_search_config',`
+ gen_require(`
@@ -13569,7 +13580,7 @@ index c9e1a44..ef353c7 100644
## Allow the specified domain to read
## apache configuration files.
## </summary>
-@@ -694,7 +751,7 @@ interface(`apache_dontaudit_append_log',`
+@@ -694,7 +750,7 @@ interface(`apache_dontaudit_append_log',`
type httpd_log_t;
')
@@ -13578,7 +13589,7 @@ index c9e1a44..ef353c7 100644
')
########################################
-@@ -740,6 +797,25 @@ interface(`apache_dontaudit_search_modules',`
+@@ -740,6 +796,25 @@ interface(`apache_dontaudit_search_modules',`
########################################
## <summary>
@@ -13604,7 +13615,7 @@ index c9e1a44..ef353c7 100644
## Allow the specified domain to list
## the contents of the apache modules
## directory.
-@@ -756,6 +832,7 @@ interface(`apache_list_modules',`
+@@ -756,6 +831,7 @@ interface(`apache_list_modules',`
')
allow $1 httpd_modules_t:dir list_dir_perms;
@@ -13612,7 +13623,7 @@ index c9e1a44..ef353c7 100644
')
########################################
-@@ -814,6 +891,7 @@ interface(`apache_list_sys_content',`
+@@ -814,6 +890,7 @@ interface(`apache_list_sys_content',`
')
list_dirs_pattern($1, httpd_sys_content_t, httpd_sys_content_t)
@@ -13620,7 +13631,7 @@ index c9e1a44..ef353c7 100644
files_search_var($1)
')
-@@ -841,6 +919,74 @@ interface(`apache_manage_sys_content',`
+@@ -841,6 +918,74 @@ interface(`apache_manage_sys_content',`
manage_lnk_files_pattern($1, httpd_sys_content_t, httpd_sys_content_t)
')
@@ -13695,7 +13706,7 @@ index c9e1a44..ef353c7 100644
########################################
## <summary>
## Execute all web scripts in the system
-@@ -857,7 +1003,11 @@ interface(`apache_manage_sys_content',`
+@@ -857,7 +1002,11 @@ interface(`apache_manage_sys_content',`
interface(`apache_domtrans_sys_script',`
gen_require(`
attribute httpdcontent;
@@ -13708,7 +13719,7 @@ index c9e1a44..ef353c7 100644
')
tunable_policy(`httpd_enable_cgi && httpd_unified',`
-@@ -916,9 +1066,10 @@ interface(`apache_domtrans_all_scripts',`
+@@ -916,9 +1065,10 @@ interface(`apache_domtrans_all_scripts',`
## </param>
## <param name="role">
## <summary>
@@ -13720,7 +13731,7 @@ index c9e1a44..ef353c7 100644
#
interface(`apache_run_all_scripts',`
gen_require(`
-@@ -945,7 +1096,7 @@ interface(`apache_read_squirrelmail_data',`
+@@ -945,7 +1095,7 @@ interface(`apache_read_squirrelmail_data',`
type httpd_squirrelmail_t;
')
@@ -13729,7 +13740,7 @@ index c9e1a44..ef353c7 100644
')
########################################
-@@ -1086,6 +1237,25 @@ interface(`apache_read_tmp_files',`
+@@ -1086,6 +1236,25 @@ interface(`apache_read_tmp_files',`
read_files_pattern($1, httpd_tmp_t, httpd_tmp_t)
')
@@ -13755,7 +13766,7 @@ index c9e1a44..ef353c7 100644
########################################
## <summary>
## Dontaudit attempts to write
-@@ -1102,7 +1272,7 @@ interface(`apache_dontaudit_write_tmp_files',`
+@@ -1102,7 +1271,7 @@ interface(`apache_dontaudit_write_tmp_files',`
type httpd_tmp_t;
')
@@ -13764,7 +13775,7 @@ index c9e1a44..ef353c7 100644
')
########################################
-@@ -1165,17 +1335,14 @@ interface(`apache_cgi_domain',`
+@@ -1165,17 +1334,14 @@ interface(`apache_cgi_domain',`
#
interface(`apache_admin',`
gen_require(`
@@ -13786,7 +13797,7 @@ index c9e1a44..ef353c7 100644
ps_process_pattern($1, httpd_t)
init_labeled_script_domtrans($1, httpd_initrc_exec_t)
-@@ -1186,10 +1353,10 @@ interface(`apache_admin',`
+@@ -1186,10 +1352,10 @@ interface(`apache_admin',`
apache_manage_all_content($1)
miscfiles_manage_public_files($1)
@@ -13799,7 +13810,7 @@ index c9e1a44..ef353c7 100644
admin_pattern($1, httpd_log_t)
admin_pattern($1, httpd_modules_t)
-@@ -1200,14 +1367,43 @@ interface(`apache_admin',`
+@@ -1200,14 +1366,43 @@ interface(`apache_admin',`
admin_pattern($1, httpd_var_run_t)
files_pid_filetrans($1, httpd_var_run_t, file)
@@ -13849,7 +13860,7 @@ index c9e1a44..ef353c7 100644
+ dontaudit $1 httpd_tmp_t:file { read write };
')
diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
-index 08dfa0c..973fdf0 100644
+index 08dfa0c..84e9bea 100644
--- a/policy/modules/services/apache.te
+++ b/policy/modules/services/apache.te
@@ -18,130 +18,195 @@ policy_module(apache, 2.2.0)
@@ -14453,18 +14464,19 @@ index 08dfa0c..973fdf0 100644
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
')
-@@ -603,6 +800,10 @@ optional_policy(`
+@@ -603,6 +800,11 @@ optional_policy(`
yam_read_content(httpd_t)
')
+optional_policy(`
+ zarafa_stream_connect_server(httpd_t)
++ zarafa_search_config(httpd_t)
+')
+
########################################
#
# Apache helper local policy
-@@ -618,6 +819,10 @@ logging_send_syslog_msg(httpd_helper_t)
+@@ -618,6 +820,10 @@ logging_send_syslog_msg(httpd_helper_t)
userdom_use_user_terminals(httpd_helper_t)
@@ -14475,7 +14487,7 @@ index 08dfa0c..973fdf0 100644
########################################
#
# Apache PHP script local policy
-@@ -654,28 +859,27 @@ libs_exec_lib_files(httpd_php_t)
+@@ -654,28 +860,27 @@ libs_exec_lib_files(httpd_php_t)
userdom_use_unpriv_users_fds(httpd_php_t)
tunable_policy(`httpd_can_network_connect_db',`
@@ -14516,7 +14528,7 @@ index 08dfa0c..973fdf0 100644
')
########################################
-@@ -699,17 +903,22 @@ manage_dirs_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t)
+@@ -699,17 +904,22 @@ manage_dirs_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t)
manage_files_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t)
files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir })
@@ -14542,7 +14554,7 @@ index 08dfa0c..973fdf0 100644
files_read_etc_files(httpd_suexec_t)
files_read_usr_files(httpd_suexec_t)
-@@ -740,10 +949,20 @@ tunable_policy(`httpd_can_network_connect',`
+@@ -740,10 +950,20 @@ tunable_policy(`httpd_can_network_connect',`
corenet_sendrecv_all_client_packets(httpd_suexec_t)
')
@@ -14564,7 +14576,7 @@ index 08dfa0c..973fdf0 100644
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -769,6 +988,25 @@ optional_policy(`
+@@ -769,6 +989,25 @@ optional_policy(`
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
')
@@ -14590,7 +14602,7 @@ index 08dfa0c..973fdf0 100644
########################################
#
# Apache system script local policy
-@@ -792,9 +1030,13 @@ kernel_read_kernel_sysctls(httpd_sys_script_t)
+@@ -792,9 +1031,13 @@ kernel_read_kernel_sysctls(httpd_sys_script_t)
files_search_var_lib(httpd_sys_script_t)
files_search_spool(httpd_sys_script_t)
@@ -14604,7 +14616,7 @@ index 08dfa0c..973fdf0 100644
ifdef(`distro_redhat',`
allow httpd_sys_script_t httpd_log_t:file append_file_perms;
')
-@@ -803,6 +1045,33 @@ tunable_policy(`httpd_can_sendmail',`
+@@ -803,6 +1046,33 @@ tunable_policy(`httpd_can_sendmail',`
mta_send_mail(httpd_sys_script_t)
')
@@ -14638,7 +14650,7 @@ index 08dfa0c..973fdf0 100644
tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms;
allow httpd_sys_script_t self:udp_socket create_socket_perms;
-@@ -822,7 +1091,7 @@ tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
+@@ -822,7 +1092,7 @@ tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
')
tunable_policy(`httpd_enable_homedirs',`
@@ -14647,7 +14659,7 @@ index 08dfa0c..973fdf0 100644
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -830,6 +1099,20 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
+@@ -830,6 +1100,20 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
fs_read_nfs_symlinks(httpd_sys_script_t)
')
@@ -14668,7 +14680,7 @@ index 08dfa0c..973fdf0 100644
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_sys_script_t)
fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -842,10 +1125,20 @@ optional_policy(`
+@@ -842,10 +1126,20 @@ optional_policy(`
optional_policy(`
mysql_stream_connect(httpd_sys_script_t)
mysql_rw_db_sockets(httpd_sys_script_t)
@@ -14689,7 +14701,7 @@ index 08dfa0c..973fdf0 100644
')
########################################
-@@ -891,11 +1184,21 @@ optional_policy(`
+@@ -891,11 +1185,21 @@ optional_policy(`
tunable_policy(`httpd_enable_cgi && httpd_unified',`
allow httpd_user_script_t httpdcontent:file entrypoint;
@@ -18812,6 +18824,55 @@ index 0a1a61b..da508f4 100644
')
allow $1 ddclient_t:process { ptrace signal_perms };
+diff --git a/policy/modules/services/ddclient.te b/policy/modules/services/ddclient.te
+index 24ba98a..0910356 100644
+--- a/policy/modules/services/ddclient.te
++++ b/policy/modules/services/ddclient.te
+@@ -18,6 +18,9 @@ init_script_file(ddclient_initrc_exec_t)
+ type ddclient_log_t;
+ logging_log_file(ddclient_log_t)
+
++type ddclient_tmp_t;
++files_tmp_file(ddclient_tmp_t)
++
+ type ddclient_var_t;
+ files_type(ddclient_var_t)
+
+@@ -37,12 +40,16 @@ allow ddclient_t self:process signal_perms;
+ allow ddclient_t self:fifo_file rw_fifo_file_perms;
+ allow ddclient_t self:tcp_socket create_socket_perms;
+ allow ddclient_t self:udp_socket create_socket_perms;
++allow ddclient_t self:netlink_route_socket r_netlink_socket_perms;
+
+ allow ddclient_t ddclient_etc_t:file read_file_perms;
+
+ allow ddclient_t ddclient_log_t:file manage_file_perms;
+ logging_log_filetrans(ddclient_t, ddclient_log_t, file)
+
++manage_files_pattern(ddclient_t, ddclient_tmp_t, ddclient_tmp_t)
++files_tmp_filetrans(ddclient_t, ddclient_tmp_t, { file })
++
+ manage_dirs_pattern(ddclient_t, ddclient_var_t, ddclient_var_t)
+ manage_files_pattern(ddclient_t, ddclient_var_t, ddclient_var_t)
+ manage_lnk_files_pattern(ddclient_t, ddclient_var_t, ddclient_var_t)
+@@ -74,6 +81,8 @@ corenet_tcp_sendrecv_generic_node(ddclient_t)
+ corenet_udp_sendrecv_generic_node(ddclient_t)
+ corenet_tcp_sendrecv_all_ports(ddclient_t)
+ corenet_udp_sendrecv_all_ports(ddclient_t)
++corenet_tcp_bind_generic_node(ddclient_t)
++corenet_udp_bind_generic_node(ddclient_t)
+ corenet_tcp_connect_all_ports(ddclient_t)
+ corenet_sendrecv_all_client_packets(ddclient_t)
+
+@@ -89,6 +98,8 @@ files_read_usr_files(ddclient_t)
+ fs_getattr_all_fs(ddclient_t)
+ fs_search_auto_mountpoints(ddclient_t)
+
++mta_send_mail(ddclient_t)
++
+ logging_send_syslog_msg(ddclient_t)
+
+ miscfiles_read_localization(ddclient_t)
diff --git a/policy/modules/services/denyhosts.if b/policy/modules/services/denyhosts.if
index 567865f..9c9e65c 100644
--- a/policy/modules/services/denyhosts.if
@@ -21686,10 +21747,19 @@ index a627b34..c899c61 100644
optional_policy(`
seutil_sigchld_newrole(gpm_t)
diff --git a/policy/modules/services/gpsd.te b/policy/modules/services/gpsd.te
-index 03742d8..7b9c543 100644
+index 03742d8..2a87d1e 100644
--- a/policy/modules/services/gpsd.te
+++ b/policy/modules/services/gpsd.te
-@@ -56,6 +56,10 @@ logging_send_syslog_msg(gpsd_t)
+@@ -46,6 +46,8 @@ corenet_tcp_sendrecv_all_ports(gpsd_t)
+ corenet_tcp_bind_all_nodes(gpsd_t)
+ corenet_tcp_bind_gpsd_port(gpsd_t)
+
++dev_read_sysfs(gpsd_t)
++
+ term_use_unallocated_ttys(gpsd_t)
+ term_setattr_unallocated_ttys(gpsd_t)
+
+@@ -56,6 +58,10 @@ logging_send_syslog_msg(gpsd_t)
miscfiles_read_localization(gpsd_t)
optional_policy(`
@@ -24631,7 +24701,7 @@ index 343cee3..2f948ad 100644
+ ')
+')
diff --git a/policy/modules/services/mta.te b/policy/modules/services/mta.te
-index 64268e4..1acd149 100644
+index 64268e4..6543734 100644
--- a/policy/modules/services/mta.te
+++ b/policy/modules/services/mta.te
@@ -20,8 +20,8 @@ files_type(etc_aliases_t)
@@ -24645,13 +24715,14 @@ index 64268e4..1acd149 100644
type mqueue_spool_t;
files_mountpoint(mqueue_spool_t)
-@@ -50,22 +50,9 @@ ubac_constrained(user_mail_tmp_t)
+@@ -50,22 +50,11 @@ ubac_constrained(user_mail_tmp_t)
# newalias required this, not sure if it is needed in 'if' file
allow system_mail_t self:capability { dac_override fowner };
-allow system_mail_t self:fifo_file rw_fifo_file_perms;
--
+
-read_files_pattern(system_mail_t, etc_mail_t, etc_mail_t)
++allow system_mail_t mail_home_t:file manage_file_perms;
read_files_pattern(system_mail_t, mailcontent_type, mailcontent_type)
@@ -24668,7 +24739,7 @@ index 64268e4..1acd149 100644
dev_read_sysfs(system_mail_t)
dev_read_rand(system_mail_t)
dev_read_urand(system_mail_t)
-@@ -82,6 +69,10 @@ init_use_script_ptys(system_mail_t)
+@@ -82,6 +71,10 @@ init_use_script_ptys(system_mail_t)
userdom_use_user_terminals(system_mail_t)
userdom_dontaudit_search_user_home_dirs(system_mail_t)
@@ -24679,7 +24750,7 @@ index 64268e4..1acd149 100644
optional_policy(`
apache_read_squirrelmail_data(system_mail_t)
-@@ -92,17 +83,28 @@ optional_policy(`
+@@ -92,17 +85,28 @@ optional_policy(`
apache_dontaudit_rw_stream_sockets(system_mail_t)
apache_dontaudit_rw_tcp_sockets(system_mail_t)
apache_dontaudit_rw_sys_script_stream_sockets(system_mail_t)
@@ -24709,7 +24780,7 @@ index 64268e4..1acd149 100644
clamav_stream_connect(system_mail_t)
clamav_append_log(system_mail_t)
')
-@@ -111,6 +113,8 @@ optional_policy(`
+@@ -111,6 +115,8 @@ optional_policy(`
cron_read_system_job_tmp_files(system_mail_t)
cron_dontaudit_write_pipes(system_mail_t)
cron_rw_system_job_stream_sockets(system_mail_t)
@@ -24718,7 +24789,7 @@ index 64268e4..1acd149 100644
')
optional_policy(`
-@@ -124,12 +128,8 @@ optional_policy(`
+@@ -124,12 +130,8 @@ optional_policy(`
')
optional_policy(`
@@ -24732,7 +24803,7 @@ index 64268e4..1acd149 100644
')
optional_policy(`
-@@ -146,6 +146,10 @@ optional_policy(`
+@@ -146,6 +148,10 @@ optional_policy(`
')
optional_policy(`
@@ -24743,7 +24814,7 @@ index 64268e4..1acd149 100644
nagios_read_tmp_files(system_mail_t)
')
-@@ -158,18 +162,6 @@ optional_policy(`
+@@ -158,18 +164,6 @@ optional_policy(`
files_etc_filetrans(system_mail_t, etc_aliases_t, { file lnk_file sock_file fifo_file })
domain_use_interactive_fds(system_mail_t)
@@ -24762,7 +24833,7 @@ index 64268e4..1acd149 100644
')
optional_policy(`
-@@ -189,6 +181,10 @@ optional_policy(`
+@@ -189,6 +183,10 @@ optional_policy(`
')
optional_policy(`
@@ -24773,7 +24844,7 @@ index 64268e4..1acd149 100644
smartmon_read_tmp_files(system_mail_t)
')
-@@ -199,7 +195,7 @@ optional_policy(`
+@@ -199,7 +197,7 @@ optional_policy(`
arpwatch_search_data(mailserver_delivery)
arpwatch_manage_tmp_files(mta_user_agent)
@@ -24782,7 +24853,7 @@ index 64268e4..1acd149 100644
arpwatch_dontaudit_rw_packet_sockets(mta_user_agent)
')
-@@ -220,7 +216,8 @@ append_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t)
+@@ -220,7 +218,8 @@ append_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t)
create_lnk_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t)
read_lnk_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t)
@@ -24792,7 +24863,7 @@ index 64268e4..1acd149 100644
read_files_pattern(mailserver_delivery, system_mail_tmp_t, system_mail_tmp_t)
-@@ -249,11 +246,16 @@ optional_policy(`
+@@ -249,11 +248,16 @@ optional_policy(`
mailman_read_data_symlinks(mailserver_delivery)
')
@@ -24809,7 +24880,7 @@ index 64268e4..1acd149 100644
domain_use_interactive_fds(user_mail_t)
userdom_use_user_terminals(user_mail_t)
-@@ -292,3 +294,44 @@ optional_policy(`
+@@ -292,3 +296,44 @@ optional_policy(`
postfix_read_config(user_mail_t)
postfix_list_spool(user_mail_t)
')
@@ -24955,7 +25026,7 @@ index c358d8f..92c9dca 100644
allow $1 munin_t:process { ptrace signal_perms };
diff --git a/policy/modules/services/munin.te b/policy/modules/services/munin.te
-index f17583b..6f8b0fd 100644
+index f17583b..0dc6344 100644
--- a/policy/modules/services/munin.te
+++ b/policy/modules/services/munin.te
@@ -5,6 +5,8 @@ policy_module(munin, 1.8.0)
@@ -25105,7 +25176,7 @@ index f17583b..6f8b0fd 100644
dev_read_sysfs(system_munin_plugin_t)
dev_read_urand(system_munin_plugin_t)
-@@ -313,3 +317,29 @@ init_read_utmp(system_munin_plugin_t)
+@@ -313,3 +317,30 @@ init_read_utmp(system_munin_plugin_t)
sysnet_exec_ifconfig(system_munin_plugin_t)
term_getattr_unallocated_ttys(system_munin_plugin_t)
@@ -25129,6 +25200,7 @@ index f17583b..6f8b0fd 100644
+corecmd_exec_bin(munin_plugin_domain)
+corecmd_exec_shell(munin_plugin_domain)
+
++files_search_var_lib(munin_plugin_domain)
+files_read_etc_files(munin_plugin_domain)
+files_read_usr_files(munin_plugin_domain)
+
@@ -25189,7 +25261,7 @@ index e9c0982..4d3b208 100644
admin_pattern($1, mysqld_tmp_t)
')
diff --git a/policy/modules/services/mysql.te b/policy/modules/services/mysql.te
-index 0a0d63c..086df22 100644
+index 0a0d63c..d02b476 100644
--- a/policy/modules/services/mysql.te
+++ b/policy/modules/services/mysql.te
@@ -6,9 +6,9 @@ policy_module(mysql, 1.12.0)
@@ -25257,8 +25329,17 @@ index 0a0d63c..086df22 100644
files_read_etc_files(mysqld_safe_t)
files_read_usr_files(mysqld_safe_t)
files_dontaudit_getattr_all_dirs(mysqld_safe_t)
+@@ -183,6 +186,8 @@ logging_log_filetrans(mysqld_safe_t, mysqld_log_t, file)
+
+ hostname_exec(mysqld_safe_t)
+
++logging_send_syslog_msg(mysqld_safe_t)
++
+ miscfiles_read_localization(mysqld_safe_t)
+
+ mysql_manage_db_files(mysqld_safe_t)
diff --git a/policy/modules/services/nagios.if b/policy/modules/services/nagios.if
-index 8581040..89e1edf 100644
+index 8581040..f54b3b8 100644
--- a/policy/modules/services/nagios.if
+++ b/policy/modules/services/nagios.if
@@ -12,10 +12,8 @@
@@ -25281,7 +25362,16 @@ index 8581040..89e1edf 100644
# needed by command.cfg
domtrans_pattern(nagios_t, nagios_$1_plugin_exec_t, nagios_$1_plugin_t)
-@@ -49,7 +48,6 @@ template(`nagios_plugin_template',`
+@@ -36,6 +35,8 @@ template(`nagios_plugin_template',`
+ dontaudit nagios_$1_plugin_t nrpe_t:tcp_socket { read write };
+ dontaudit nagios_$1_plugin_t nagios_log_t:file { read write };
+
++ files_read_usr_files(nagios_$1_plugin_t)
++
+ miscfiles_read_localization(nagios_$1_plugin_t)
+ ')
+
+@@ -49,7 +50,6 @@ template(`nagios_plugin_template',`
## Domain to not audit.
## </summary>
## </param>
@@ -25289,7 +25379,7 @@ index 8581040..89e1edf 100644
#
interface(`nagios_dontaudit_rw_pipes',`
gen_require(`
-@@ -159,6 +157,26 @@ interface(`nagios_read_tmp_files',`
+@@ -159,6 +159,26 @@ interface(`nagios_read_tmp_files',`
########################################
## <summary>
@@ -25316,7 +25406,7 @@ index 8581040..89e1edf 100644
## Execute the nagios NRPE with
## a domain transition.
## </summary>
-@@ -195,11 +213,9 @@ interface(`nagios_domtrans_nrpe',`
+@@ -195,11 +215,9 @@ interface(`nagios_domtrans_nrpe',`
#
interface(`nagios_admin',`
gen_require(`
@@ -25537,7 +25627,7 @@ index 2324d9e..8069487 100644
+ append_files_pattern($1, NetworkManager_log_t, NetworkManager_log_t)
+')
diff --git a/policy/modules/services/networkmanager.te b/policy/modules/services/networkmanager.te
-index 0619395..4898ef8 100644
+index 0619395..5428249 100644
--- a/policy/modules/services/networkmanager.te
+++ b/policy/modules/services/networkmanager.te
@@ -12,6 +12,12 @@ init_daemon_domain(NetworkManager_t, NetworkManager_exec_t)
@@ -25640,10 +25730,14 @@ index 0619395..4898ef8 100644
optional_policy(`
consolekit_dbus_chat(NetworkManager_t)
')
-@@ -202,6 +230,13 @@ optional_policy(`
+@@ -202,6 +230,17 @@ optional_policy(`
')
optional_policy(`
++ gnome_dontaudit_search_config(NetworkManager_t)
++')
++
++optional_policy(`
+ ipsec_domtrans_mgmt(NetworkManager_t)
+ ipsec_kill_mgmt(NetworkManager_t)
+ ipsec_signal_mgmt(NetworkManager_t)
@@ -25654,7 +25748,7 @@ index 0619395..4898ef8 100644
iptables_domtrans(NetworkManager_t)
')
-@@ -219,6 +254,7 @@ optional_policy(`
+@@ -219,6 +258,7 @@ optional_policy(`
')
optional_policy(`
@@ -25662,7 +25756,7 @@ index 0619395..4898ef8 100644
openvpn_domtrans(NetworkManager_t)
openvpn_kill(NetworkManager_t)
openvpn_signal(NetworkManager_t)
-@@ -263,6 +299,7 @@ optional_policy(`
+@@ -263,6 +303,7 @@ optional_policy(`
vpn_kill(NetworkManager_t)
vpn_signal(NetworkManager_t)
vpn_signull(NetworkManager_t)
@@ -32577,10 +32671,15 @@ index e30bb63..6e627d6 100644
+ can_exec(smbd_t, samba_unconfined_script_exec_t)
')
diff --git a/policy/modules/services/sasl.if b/policy/modules/services/sasl.if
-index f1aea88..c3ffa9d 100644
+index f1aea88..a5a75a8 100644
--- a/policy/modules/services/sasl.if
+++ b/policy/modules/services/sasl.if
-@@ -42,7 +42,7 @@ interface(`sasl_admin',`
+@@ -38,11 +38,11 @@ interface(`sasl_connect',`
+ #
+ interface(`sasl_admin',`
+ gen_require(`
+- type saslauthd_t, saslauthd_tmp_t, saslauthd_var_run_t;
++ type saslauthd_t, saslauthd_var_run_t;
type saslauthd_initrc_exec_t;
')
@@ -32589,6 +32688,16 @@ index f1aea88..c3ffa9d 100644
ps_process_pattern($1, saslauthd_t)
init_labeled_script_domtrans($1, saslauthd_initrc_exec_t)
+@@ -50,9 +50,6 @@ interface(`sasl_admin',`
+ role_transition $2 saslauthd_initrc_exec_t system_r;
+ allow $2 system_r;
+
+- files_list_tmp($1)
+- admin_pattern($1, saslauthd_tmp_t)
+-
+ files_list_pids($1)
+ admin_pattern($1, saslauthd_var_run_t)
+ ')
diff --git a/policy/modules/services/sasl.te b/policy/modules/services/sasl.te
index 22184ad..d87a3f0 100644
--- a/policy/modules/services/sasl.te
@@ -39095,10 +39204,10 @@ index 0000000..56cb5af
+/var/run/zarafa-monitor\.pid -- gen_context(system_u:object_r:zarafa_monitor_var_run_t,s0)
diff --git a/policy/modules/services/zarafa.if b/policy/modules/services/zarafa.if
new file mode 100644
-index 0000000..4f2dde8
+index 0000000..8a909f5
--- /dev/null
+++ b/policy/modules/services/zarafa.if
-@@ -0,0 +1,102 @@
+@@ -0,0 +1,122 @@
+## <summary>policy for zarafa services</summary>
+
+######################################
@@ -39201,6 +39310,26 @@ index 0000000..4f2dde8
+ files_search_var_lib($1)
+ stream_connect_pattern($1, zarafa_server_var_run_t, zarafa_server_var_run_t, zarafa_server_t)
+')
++
++######################################
++## <summary>
++## Allow the specified domain to search
++## zarafa configuration dirs.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`zarafa_search_config',`
++ gen_require(`
++ type zarafa_etc_t;
++ ')
++
++ files_search_etc($1)
++ allow $1 zarafa_etc_t:dir search_dir_perms;
++')
diff --git a/policy/modules/services/zarafa.te b/policy/modules/services/zarafa.te
new file mode 100644
index 0000000..3ce4d86
@@ -43010,14 +43139,16 @@ index 72c746e..e3d06fd 100644
+/var/cache/davfs2(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0)
+/var/run/davfs2(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0)
diff --git a/policy/modules/system/mount.if b/policy/modules/system/mount.if
-index 8b5c196..3490497 100644
+index 8b5c196..b195f9d 100644
--- a/policy/modules/system/mount.if
+++ b/policy/modules/system/mount.if
-@@ -16,6 +16,14 @@ interface(`mount_domtrans',`
+@@ -16,6 +16,16 @@ interface(`mount_domtrans',`
')
domtrans_pattern($1, mount_exec_t, mount_t)
+ mount_domtrans_fusermount($1)
++
++ ps_process_pattern(mount_t, $1)
+
+ifdef(`hide_broken_symptoms', `
+ dontaudit mount_t $1:unix_stream_socket { read write };
@@ -43028,7 +43159,7 @@ index 8b5c196..3490497 100644
')
########################################
-@@ -45,12 +53,58 @@ interface(`mount_run',`
+@@ -45,12 +55,58 @@ interface(`mount_run',`
role $2 types mount_t;
optional_policy(`
@@ -43088,7 +43219,7 @@ index 8b5c196..3490497 100644
## Execute mount in the caller domain.
## </summary>
## <param name="domain">
-@@ -84,9 +138,11 @@ interface(`mount_exec',`
+@@ -84,9 +140,11 @@ interface(`mount_exec',`
interface(`mount_signal',`
gen_require(`
type mount_t;
@@ -43100,7 +43231,7 @@ index 8b5c196..3490497 100644
')
########################################
-@@ -95,7 +151,7 @@ interface(`mount_signal',`
+@@ -95,7 +153,7 @@ interface(`mount_signal',`
## </summary>
## <param name="domain">
## <summary>
@@ -43109,7 +43240,7 @@ index 8b5c196..3490497 100644
## </summary>
## </param>
#
-@@ -176,4 +232,109 @@ interface(`mount_run_unconfined',`
+@@ -176,4 +234,109 @@ interface(`mount_run_unconfined',`
mount_domtrans_unconfined($1)
role $2 types unconfined_mount_t;
diff --git a/selinux-policy.spec b/selinux-policy.spec
index b1d9393..7dc2435 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -21,7 +21,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.9.8
-Release: 6%{?dist}
+Release: 7%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -471,6 +471,16 @@ exit 0
%endif
%changelog
+* Mon Nov 15 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.8-7
+- Allow nagios plugins to read usr files
+- Allow mysqld-safe to send system log messages
+- Fixes fpr ddclient policy
+- Fix sasl_admin interface
+- Allow apache to search zarafa config
+- Allow munin plugins to search /var/lib directory
+- Allow gpsd to read sysfs_t
+- Fix labels on /etc/mcelog/triggers to bin_t
+
* Fri Nov 12 2010 Dan Walsh <dwalsh@redhat.com> 3.9.8-6
- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t
- Allow saslauthd_t to create krb5_host_rcache_t files in /tmp