diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index deac5d9..4279e15 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -5423,7 +5423,7 @@ index 8e0f9cd..b9f45b9 100644
define(`create_packet_interfaces',``
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
-index 4edc40d..836d056 100644
+index 4edc40d..dc853a1 100644
--- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in
@@ -5,6 +5,7 @@ policy_module(corenetwork, 1.18.4)
@@ -5509,7 +5509,7 @@ index 4edc40d..836d056 100644
network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0)
network_port(audit, tcp,60,s0)
network_port(auth, tcp,113,s0)
-@@ -96,18 +118,18 @@ network_port(boinc, tcp,31416,s0)
+@@ -96,19 +118,19 @@ network_port(boinc, tcp,31416,s0)
network_port(boinc_client, tcp,1043,s0, udp,1034,s0)
network_port(biff) # no defined portcon
network_port(certmaster, tcp,51235,s0)
@@ -5527,9 +5527,11 @@ index 4edc40d..836d056 100644
network_port(condor, tcp,9618,s0, udp,9618,s0)
network_port(couchdb, tcp,5984,s0, udp,5984,s0)
-network_port(cslistener, tcp,9000,s0, udp,9000,s0)
- network_port(ctdb, tcp,4379,s0, udp,4397,s0)
+-network_port(ctdb, tcp,4379,s0, udp,4397,s0)
++network_port(ctdb, tcp,4379,s0, udp,4379,s0)
network_port(cvs, tcp,2401,s0, udp,2401,s0)
network_port(cyphesis, tcp,6767,s0, tcp,6769,s0, tcp,6780-6799,s0, udp,32771,s0)
+ network_port(daap, tcp,3689,s0, udp,3689,s0)
@@ -119,19 +141,26 @@ network_port(dhcpc, udp,68,s0, tcp,68,s0, udp,546,s0, tcp, 546,s0, udp,5546,s0,
network_port(dhcpd, udp,67,s0, udp,547,s0, tcp, 547,s0, udp,548,s0, tcp, 548,s0, tcp,647,s0, udp,647,s0, tcp,847,s0, udp,847,s0, tcp,7911,s0)
network_port(dict, tcp,2628,s0)
@@ -5555,7 +5557,7 @@ index 4edc40d..836d056 100644
network_port(git, tcp,9418,s0, udp,9418,s0)
+network_port(glance, tcp,9292,s0, udp,9292,s0)
network_port(glance_registry, tcp,9191,s0, udp,9191,s0)
-+network_port(gluster, tcp,24007,s0, tcp, 38465-38469,s0)
++network_port(gluster, tcp,24007-24027,s0, tcp, 38465-38469,s0)
network_port(gopher, tcp,70,s0, udp,70,s0)
network_port(gpsd, tcp,2947,s0)
network_port(hadoop_datanode, tcp,50010,s0)
@@ -5915,7 +5917,7 @@ index b31c054..17e11e0 100644
+/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
+/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
-index 76f285e..48504fe 100644
+index 76f285e..b708d28 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',`
@@ -6807,6 +6809,24 @@ index 76f285e..48504fe 100644
')
########################################
+@@ -3399,7 +3756,7 @@ interface(`dev_dontaudit_read_rand',`
+
+ ########################################
+ ##
+-## Do not audit attempts to append to random
++## Do not audit attempts to append to the random
+ ## number generator devices (e.g., /dev/random)
+ ##
+ ##
+@@ -3413,7 +3770,7 @@ interface(`dev_dontaudit_append_rand',`
+ type random_device_t;
+ ')
+
+- dontaudit $1 random_device_t:chr_file append_chr_file_perms;
++ dontaudit $1 random_device_t:chr_file { append };
+ ')
+
+ ########################################
@@ -3855,7 +4212,7 @@ interface(`dev_getattr_sysfs_dirs',`
########################################
@@ -8733,7 +8753,7 @@ index 6a1e4d1..84e8030 100644
+ dontaudit $1 domain:dir_file_class_set audit_access;
')
diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
-index cf04cb5..5a40b38 100644
+index cf04cb5..c8fc903 100644
--- a/policy/modules/kernel/domain.te
+++ b/policy/modules/kernel/domain.te
@@ -4,6 +4,29 @@ policy_module(domain, 1.11.0)
@@ -8870,7 +8890,7 @@ index cf04cb5..5a40b38 100644
# Create/access any System V IPC objects.
allow unconfined_domain_type domain:{ sem msgq shm } *;
-@@ -166,5 +231,297 @@ allow unconfined_domain_type domain:lnk_file { read_lnk_file_perms ioctl lock };
+@@ -166,5 +231,298 @@ allow unconfined_domain_type domain:lnk_file { read_lnk_file_perms ioctl lock };
# act on all domains keys
allow unconfined_domain_type domain:key *;
@@ -9041,6 +9061,7 @@ index cf04cb5..5a40b38 100644
+ systemd_login_undefined(unconfined_domain_type)
+ systemd_filetrans_named_content(named_filetrans_domain)
+ systemd_filetrans_named_hostname(named_filetrans_domain)
++ systemd_filetrans_home_content(named_filetrans_domain)
+')
+
+optional_policy(`
@@ -24647,7 +24668,7 @@ index 28ad538..ebe81bf 100644
-/var/run/user(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
/var/(db|lib|adm)/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
-index 3efd5b6..362b3af 100644
+index 3efd5b6..eb629f0 100644
--- a/policy/modules/system/authlogin.if
+++ b/policy/modules/system/authlogin.if
@@ -23,11 +23,17 @@ interface(`auth_role',`
@@ -24845,7 +24866,32 @@ index 3efd5b6..362b3af 100644
')
########################################
-@@ -448,6 +486,25 @@ interface(`auth_run_chk_passwd',`
+@@ -428,6 +466,24 @@ interface(`auth_domtrans_chkpwd',`
+
+ ########################################
+ ##
++## Execute chkpwd in the caller domain.
++##
++##
++##
++## Domain allowed to transition.
++##
++##
++#
++interface(`auth_exec_chkpwd',`
++ gen_require(`
++ type chkpwd_exec_t;
++ ')
++
++ allow $1 chkpwd_exec_t:file execute;
++')
++
++########################################
++##
+ ## Execute chkpwd programs in the chkpwd domain.
+ ##
+ ##
+@@ -448,6 +504,25 @@ interface(`auth_run_chk_passwd',`
auth_domtrans_chk_passwd($1)
role $2 types chkpwd_t;
@@ -24871,7 +24917,7 @@ index 3efd5b6..362b3af 100644
')
########################################
-@@ -467,7 +524,6 @@ interface(`auth_domtrans_upd_passwd',`
+@@ -467,7 +542,6 @@ interface(`auth_domtrans_upd_passwd',`
domtrans_pattern($1, updpwd_exec_t, updpwd_t)
auth_dontaudit_read_shadow($1)
@@ -24879,7 +24925,7 @@ index 3efd5b6..362b3af 100644
')
########################################
-@@ -664,6 +720,10 @@ interface(`auth_manage_shadow',`
+@@ -664,6 +738,10 @@ interface(`auth_manage_shadow',`
allow $1 shadow_t:file manage_file_perms;
typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords;
@@ -24890,7 +24936,7 @@ index 3efd5b6..362b3af 100644
')
#######################################
-@@ -763,7 +823,50 @@ interface(`auth_rw_faillog',`
+@@ -763,7 +841,50 @@ interface(`auth_rw_faillog',`
')
logging_search_logs($1)
@@ -24942,7 +24988,7 @@ index 3efd5b6..362b3af 100644
')
#######################################
-@@ -824,9 +927,29 @@ interface(`auth_rw_lastlog',`
+@@ -824,9 +945,29 @@ interface(`auth_rw_lastlog',`
allow $1 lastlog_t:file { rw_file_perms lock setattr };
')
@@ -24973,7 +25019,7 @@ index 3efd5b6..362b3af 100644
##
##
##
-@@ -834,12 +957,27 @@ interface(`auth_rw_lastlog',`
+@@ -834,12 +975,27 @@ interface(`auth_rw_lastlog',`
##
##
#
@@ -25004,7 +25050,7 @@ index 3efd5b6..362b3af 100644
')
########################################
-@@ -854,15 +992,15 @@ interface(`auth_domtrans_pam',`
+@@ -854,15 +1010,15 @@ interface(`auth_domtrans_pam',`
#
interface(`auth_signal_pam',`
gen_require(`
@@ -25023,7 +25069,7 @@ index 3efd5b6..362b3af 100644
##
##
##
-@@ -875,13 +1013,33 @@ interface(`auth_signal_pam',`
+@@ -875,13 +1031,33 @@ interface(`auth_signal_pam',`
##
##
#
@@ -25061,7 +25107,7 @@ index 3efd5b6..362b3af 100644
')
########################################
-@@ -959,9 +1117,30 @@ interface(`auth_manage_var_auth',`
+@@ -959,9 +1135,30 @@ interface(`auth_manage_var_auth',`
')
files_search_var($1)
@@ -25095,7 +25141,7 @@ index 3efd5b6..362b3af 100644
')
########################################
-@@ -1040,6 +1219,10 @@ interface(`auth_manage_pam_pid',`
+@@ -1040,6 +1237,10 @@ interface(`auth_manage_pam_pid',`
files_search_pids($1)
allow $1 pam_var_run_t:dir manage_dir_perms;
allow $1 pam_var_run_t:file manage_file_perms;
@@ -25106,7 +25152,7 @@ index 3efd5b6..362b3af 100644
')
########################################
-@@ -1176,6 +1359,7 @@ interface(`auth_manage_pam_console_data',`
+@@ -1176,6 +1377,7 @@ interface(`auth_manage_pam_console_data',`
files_search_pids($1)
manage_files_pattern($1, pam_var_console_t, pam_var_console_t)
manage_lnk_files_pattern($1, pam_var_console_t, pam_var_console_t)
@@ -25114,7 +25160,7 @@ index 3efd5b6..362b3af 100644
')
#######################################
-@@ -1576,6 +1760,25 @@ interface(`auth_setattr_login_records',`
+@@ -1576,6 +1778,25 @@ interface(`auth_setattr_login_records',`
########################################
##
@@ -25140,7 +25186,7 @@ index 3efd5b6..362b3af 100644
## Read login records files (/var/log/wtmp).
##
##
-@@ -1726,24 +1929,7 @@ interface(`auth_manage_login_records',`
+@@ -1726,24 +1947,7 @@ interface(`auth_manage_login_records',`
logging_rw_generic_log_dirs($1)
allow $1 wtmp_t:file manage_file_perms;
@@ -25166,7 +25212,7 @@ index 3efd5b6..362b3af 100644
')
########################################
-@@ -1767,11 +1953,13 @@ interface(`auth_relabel_login_records',`
+@@ -1767,11 +1971,13 @@ interface(`auth_relabel_login_records',`
##
#
interface(`auth_use_nsswitch',`
@@ -25183,7 +25229,7 @@ index 3efd5b6..362b3af 100644
')
########################################
-@@ -1805,3 +1993,241 @@ interface(`auth_unconfined',`
+@@ -1805,3 +2011,241 @@ interface(`auth_unconfined',`
typeattribute $1 can_write_shadow_passwords;
typeattribute $1 can_relabelto_shadow_passwords;
')
@@ -29101,7 +29147,7 @@ index dd3be8d..c4fe08b 100644
+ allow direct_run_init direct_init_entry:file { getattr open read execute };
+')
diff --git a/policy/modules/system/ipsec.fc b/policy/modules/system/ipsec.fc
-index 662e79b..3cbc35d 100644
+index 662e79b..97f750e 100644
--- a/policy/modules/system/ipsec.fc
+++ b/policy/modules/system/ipsec.fc
@@ -1,14 +1,21 @@
@@ -29128,7 +29174,7 @@ index 662e79b..3cbc35d 100644
/sbin/setkey -- gen_context(system_u:object_r:setkey_exec_t,s0)
-@@ -26,12 +33,15 @@
+@@ -26,16 +33,22 @@
/usr/libexec/ipsec/pluto -- gen_context(system_u:object_r:ipsec_exec_t,s0)
/usr/libexec/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0)
/usr/libexec/nm-openswan-service -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
@@ -29144,8 +29190,9 @@ index 662e79b..3cbc35d 100644
/var/log/pluto\.log -- gen_context(system_u:object_r:ipsec_log_t,s0)
-@@ -39,3 +49,5 @@
+ /var/racoon(/.*)? gen_context(system_u:object_r:ipsec_var_run_t,s0)
++/var/run/charon.* -- gen_context(system_u:object_r:ipsec_var_run_t,s0)
/var/run/pluto(/.*)? gen_context(system_u:object_r:ipsec_var_run_t,s0)
/var/run/racoon\.pid -- gen_context(system_u:object_r:ipsec_var_run_t,s0)
+/var/run/pluto/ipsec\.info -- gen_context(system_u:object_r:ipsec_mgmt_var_run_t, s0)
@@ -31584,7 +31631,7 @@ index 39ea221..a55b140 100644
+
+logging_stream_connect_syslog(syslog_client_type)
diff --git a/policy/modules/system/lvm.fc b/policy/modules/system/lvm.fc
-index 879bb1e..5aa4eeb 100644
+index 879bb1e..b250b3e 100644
--- a/policy/modules/system/lvm.fc
+++ b/policy/modules/system/lvm.fc
@@ -23,28 +23,35 @@ ifdef(`distro_gentoo',`
@@ -31624,13 +31671,14 @@ index 879bb1e..5aa4eeb 100644
/sbin/lvmiopversion -- gen_context(system_u:object_r:lvm_exec_t,s0)
/sbin/lvmsadc -- gen_context(system_u:object_r:lvm_exec_t,s0)
/sbin/lvmsar -- gen_context(system_u:object_r:lvm_exec_t,s0)
-@@ -88,8 +95,71 @@ ifdef(`distro_gentoo',`
+@@ -88,8 +95,72 @@ ifdef(`distro_gentoo',`
#
# /usr
#
-/usr/sbin/clvmd -- gen_context(system_u:object_r:clvmd_exec_t,s0)
-/usr/sbin/lvm -- gen_context(system_u:object_r:lvm_exec_t,s0)
+/usr/lib/systemd/generator/lvm.* gen_context(system_u:object_r:lvm_unit_file_t,s0)
++/usr/lib/systemd/system/lvm2.*\.service gen_context(system_u:object_r:lvm_unit_file_t,s0)
+
+/usr/sbin/clvmd -- gen_context(system_u:object_r:clvmd_exec_t,s0)
+/usr/sbin/cryptsetup -- gen_context(system_u:object_r:lvm_exec_t,s0)
@@ -31698,7 +31746,7 @@ index 879bb1e..5aa4eeb 100644
#
# /var
-@@ -97,5 +167,8 @@ ifdef(`distro_gentoo',`
+@@ -97,5 +168,8 @@ ifdef(`distro_gentoo',`
/var/cache/multipathd(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0)
/var/lib/multipath(/.*)? gen_context(system_u:object_r:lvm_var_lib_t,s0)
/var/lock/lvm(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0)
@@ -35946,10 +35994,10 @@ index 0000000..e9f1096
+/var/run/initramfs(/.*)? <>
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
new file mode 100644
-index 0000000..5e5f8f9
+index 0000000..7e80d22
--- /dev/null
+++ b/policy/modules/system/systemd.if
-@@ -0,0 +1,1375 @@
+@@ -0,0 +1,1373 @@
+## SELinux policy for systemd components
+
+######################################
@@ -36292,8 +36340,10 @@ index 0000000..5e5f8f9
+interface(`systemd_write_inherited_logind_sessions_pipes',`
+ gen_require(`
+ type systemd_logind_sessions_t;
++ type systemd_logind_t;
+ ')
+
++ allow $1 systemd_logind_t:fd use;
+ allow $1 systemd_logind_sessions_t:fifo_file write;
+')
+
@@ -36968,10 +37018,6 @@ index 0000000..5e5f8f9
+ init_named_pid_filetrans($1, systemd_passwd_var_run_t, dir, "ask-password")
+ files_etc_filetrans($1, hostname_etc_t, file, "hostname" )
+ files_etc_filetrans($1, hostname_etc_t, file, "machine-info" )
-+
-+ #optional_policy (`
-+ #gnome_data_filetrans($1, systemd_home_t, dir, "systemd")
-+ #')
+')
+
+########################################
@@ -37327,10 +37373,10 @@ index 0000000..5e5f8f9
+')
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644
-index 0000000..1d407bf
+index 0000000..666a9eb
--- /dev/null
+++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,642 @@
+@@ -0,0 +1,648 @@
+policy_module(systemd, 1.0.0)
+
+#######################################
@@ -37382,6 +37428,9 @@ index 0000000..1d407bf
+type systemd_unit_file_t;
+systemd_unit_file(systemd_unit_file_t)
+
++type systemd_runtime_unit_file_t;
++systemd_unit_file(systemd_runtime_unit_file_t)
++
+type power_unit_file_t;
+systemd_unit_file(power_unit_file_t)
+
@@ -37795,6 +37844,7 @@ index 0000000..1d407bf
+dev_write_kmsg(systemd_localed_t)
+
+init_dbus_chat(systemd_localed_t)
++init_reload_services(systemd_localed_t)
+
+logging_stream_connect_syslog(systemd_localed_t)
+logging_send_syslog_msg(systemd_localed_t)
@@ -37865,7 +37915,6 @@ index 0000000..1d407bf
+corenet_tcp_connect_time_port(systemd_timedated_t)
+
+dev_rw_realtime_clock(systemd_timedated_t)
-+dev_read_urand(systemd_timedated_t)
+dev_write_kmsg(systemd_timedated_t)
+dev_read_sysfs(systemd_timedated_t)
+
@@ -37956,6 +38005,9 @@ index 0000000..1d407bf
+# Common rules for systemd domains
+#
+allow systemd_domain self:process { setfscreate signal_perms };
++
++dev_read_urand(systemd_domain)
++
+files_read_etc_files(systemd_domain)
+files_read_etc_runtime_files(systemd_domain)
+files_read_usr_files(systemd_domain)
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 49eb805..334efee 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -7045,7 +7045,7 @@ index f3c0aba..b6afc90 100644
+ allow $1 apcupsd_unit_file_t:service all_service_perms;
')
diff --git a/apcupsd.te b/apcupsd.te
-index b236327..ea24c5d 100644
+index b236327..3128e78 100644
--- a/apcupsd.te
+++ b/apcupsd.te
@@ -24,6 +24,9 @@ files_tmp_file(apcupsd_tmp_t)
@@ -7102,7 +7102,7 @@ index b236327..ea24c5d 100644
+init_telinit(apcupsd_t)
-miscfiles_read_localization(apcupsd_t)
-+auth_read_passwd(apcupsd_t)
++auth_use_nsswitch(apcupsd_t)
+
+logging_send_syslog_msg(apcupsd_t)
@@ -16602,8 +16602,21 @@ index 28e1b86..f871609 100644
+ openshift_dontaudit_rw_inherited_fifo_files(crontab_domain)
+ openshift_transition(system_cronjob_t)
')
+diff --git a/ctdb.fc b/ctdb.fc
+index 8401fe6..507804b 100644
+--- a/ctdb.fc
++++ b/ctdb.fc
+@@ -2,6 +2,8 @@
+
+ /usr/sbin/ctdbd -- gen_context(system_u:object_r:ctdbd_exec_t,s0)
+
++/var/ctdb(/.*)? gen_context(system_u:object_r:ctdbd_var_t,s0)
++
+ /var/lib/ctdbd(/.*)? gen_context(system_u:object_r:ctdbd_var_lib_t,s0)
+
+ /var/log/ctdb\.log.* -- gen_context(system_u:object_r:ctdbd_log_t,s0)
diff --git a/ctdb.if b/ctdb.if
-index b25b01d..4f7d237 100644
+index b25b01d..e99c5c6 100644
--- a/ctdb.if
+++ b/ctdb.if
@@ -1,9 +1,144 @@
@@ -16686,9 +16699,11 @@ index b25b01d..4f7d237 100644
+ logging_search_logs($1)
+ append_files_pattern($1, ctdbd_log_t, ctdbd_log_t)
+')
-+
-+########################################
-+##
+
+ ########################################
+ ##
+-## Create, read, write, and delete
+-## ctdbd lib files.
+## Manage ctdbd log files
+##
+##
@@ -16745,11 +16760,9 @@ index b25b01d..4f7d237 100644
+ files_search_var_lib($1)
+ read_files_pattern($1, ctdbd_var_lib_t, ctdbd_var_lib_t)
+')
-
- ########################################
- ##
--## Create, read, write, and delete
--## ctdbd lib files.
++
++########################################
++##
+## Manage ctdbd lib files.
##
##
@@ -16767,15 +16780,35 @@ index b25b01d..4f7d237 100644
##
-## Connect to ctdbd with a unix
-## domain stream socket.
-+## Manage ctdbd lib directories.
++## Manage ctdbd lib files.
##
##
##
-@@ -31,19 +165,58 @@ interface(`ctdbd_manage_lib_files',`
+@@ -31,19 +165,77 @@ interface(`ctdbd_manage_lib_files',`
##
##
#
-interface(`ctdbd_stream_connect',`
++interface(`ctdbd_manage_var_files',`
+ gen_require(`
+- type ctdbd_t, ctdbd_var_run_t, ctdbd_tmp_t;
++ type ctdbd_var_t;
++ ')
++
++ files_search_var_lib($1)
++ manage_files_pattern($1, ctdbd_var_t, ctdbd_var_t)
++')
++
++########################################
++##
++## Manage ctdbd lib directories.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
+interface(`ctdbd_manage_lib_dirs',`
+ gen_require(`
+ type ctdbd_var_lib_t;
@@ -16796,8 +16829,7 @@ index b25b01d..4f7d237 100644
+##
+#
+interface(`ctdbd_read_pid_files',`
- gen_require(`
-- type ctdbd_t, ctdbd_var_run_t, ctdbd_tmp_t;
++ gen_require(`
+ type ctdbd_var_run_t;
')
@@ -16835,7 +16867,7 @@ index b25b01d..4f7d237 100644
##
##
##
-@@ -57,16 +230,19 @@ interface(`ctdbd_stream_connect',`
+@@ -57,16 +249,19 @@ interface(`ctdbd_stream_connect',`
##
##
#
@@ -16859,7 +16891,7 @@ index b25b01d..4f7d237 100644
domain_system_change_exemption($1)
role_transition $2 ctdbd_initrc_exec_t system_r;
allow $2 system_r;
-@@ -74,12 +250,10 @@ interface(`ctdb_admin',`
+@@ -74,12 +269,10 @@ interface(`ctdb_admin',`
logging_search_logs($1)
admin_pattern($1, ctdbd_log_t)
@@ -16874,10 +16906,44 @@ index b25b01d..4f7d237 100644
')
+
diff --git a/ctdb.te b/ctdb.te
-index 6ce66e7..f2a7a61 100644
+index 6ce66e7..f8e9ecc 100644
--- a/ctdb.te
+++ b/ctdb.te
-@@ -75,6 +75,7 @@ corenet_tcp_bind_generic_node(ctdbd_t)
+@@ -24,6 +24,9 @@ files_tmp_file(ctdbd_tmp_t)
+ type ctdbd_var_lib_t;
+ files_type(ctdbd_var_lib_t)
+
++type ctdbd_var_t;
++files_type(ctdbd_var_t)
++
+ type ctdbd_var_run_t;
+ files_pid_file(ctdbd_var_run_t)
+
+@@ -33,6 +36,7 @@ files_pid_file(ctdbd_var_run_t)
+ #
+
+ allow ctdbd_t self:capability { chown ipc_lock net_admin net_raw sys_nice };
++allow ctdbd_t self:capability2 block_suspend;
+ allow ctdbd_t self:process { setpgid signal_perms setsched };
+ allow ctdbd_t self:fifo_file rw_fifo_file_perms;
+ allow ctdbd_t self:unix_stream_socket { accept connectto listen };
+@@ -59,6 +63,11 @@ manage_dirs_pattern(ctdbd_t, ctdbd_var_lib_t, ctdbd_var_lib_t)
+ manage_files_pattern(ctdbd_t, ctdbd_var_lib_t, ctdbd_var_lib_t)
+ files_var_lib_filetrans(ctdbd_t, ctdbd_var_lib_t, dir)
+
++manage_dirs_pattern(ctdbd_t, ctdbd_var_t, ctdbd_var_t)
++manage_files_pattern(ctdbd_t, ctdbd_var_t, ctdbd_var_t)
++manage_lnk_files_pattern(ctdbd_t, ctdbd_var_t, ctdbd_var_t)
++files_var_filetrans(ctdbd_t, ctdbd_var_t, dir, "ctdb")
++
+ manage_dirs_pattern(ctdbd_t, ctdbd_var_run_t, ctdbd_var_run_t)
+ manage_files_pattern(ctdbd_t, ctdbd_var_run_t, ctdbd_var_run_t)
+ files_pid_filetrans(ctdbd_t, ctdbd_var_run_t, dir)
+@@ -72,9 +81,11 @@ corenet_all_recvfrom_netlabel(ctdbd_t)
+ corenet_tcp_sendrecv_generic_if(ctdbd_t)
+ corenet_tcp_sendrecv_generic_node(ctdbd_t)
+ corenet_tcp_bind_generic_node(ctdbd_t)
++corenet_udp_bind_generic_node(ctdbd_t)
corenet_sendrecv_ctdb_server_packets(ctdbd_t)
corenet_tcp_bind_ctdb_port(ctdbd_t)
@@ -16885,20 +16951,22 @@ index 6ce66e7..f2a7a61 100644
corenet_tcp_sendrecv_ctdb_port(ctdbd_t)
corecmd_exec_bin(ctdbd_t)
-@@ -85,12 +86,10 @@ dev_read_urand(ctdbd_t)
+@@ -85,12 +96,12 @@ dev_read_urand(ctdbd_t)
domain_dontaudit_read_all_domains_state(ctdbd_t)
-files_read_etc_files(ctdbd_t)
files_search_all_mountpoints(ctdbd_t)
++auth_read_passwd(ctdbd_t)
++
logging_send_syslog_msg(ctdbd_t)
-miscfiles_read_localization(ctdbd_t)
miscfiles_read_public_files(ctdbd_t)
optional_policy(`
-@@ -109,6 +108,7 @@ optional_policy(`
+@@ -109,6 +120,7 @@ optional_policy(`
samba_initrc_domtrans(ctdbd_t)
samba_domtrans_net(ctdbd_t)
samba_rw_var_files(ctdbd_t)
@@ -25513,10 +25581,10 @@ index 0000000..1ed97fe
+
diff --git a/glusterd.te b/glusterd.te
new file mode 100644
-index 0000000..a19c35c
+index 0000000..dd418db
--- /dev/null
+++ b/glusterd.te
-@@ -0,0 +1,170 @@
+@@ -0,0 +1,185 @@
+policy_module(glusterfs, 1.0.1)
+
+##
@@ -25574,7 +25642,8 @@ index 0000000..a19c35c
+# Local policy
+#
+
-+allow glusterd_t self:capability { sys_admin sys_resource dac_override chown dac_read_search fowner setuid net_admin };
++allow glusterd_t self:capability { sys_admin sys_resource dac_override chown dac_read_search fowner fsetid kill setgid setuid net_admin };
++
+allow glusterd_t self:capability2 block_suspend;
+allow glusterd_t self:process { getcap setcap setrlimit signal_perms };
+allow glusterd_t self:fifo_file rw_fifo_file_perms;
@@ -25603,6 +25672,7 @@ index 0000000..a19c35c
+
+manage_dirs_pattern(glusterd_t, glusterd_var_lib_t, glusterd_var_lib_t)
+manage_files_pattern(glusterd_t, glusterd_var_lib_t, glusterd_var_lib_t)
++#manage_sock_files_pattern(glusterd_t, glusterd_var_lib_t, glusterd_var_lib_t)
+files_var_lib_filetrans(glusterd_t, glusterd_var_lib_t, dir)
+
+can_exec(glusterd_t, glusterd_exec_t)
@@ -25641,7 +25711,9 @@ index 0000000..a19c35c
+corenet_udp_bind_ipp_port(glusterd_t)
+
+corenet_sendrecv_all_client_packets(glusterd_t)
++corenet_tcp_bind_all_unreserved_ports(glusterd_t)
+corenet_tcp_connect_all_unreserved_ports(glusterd_t)
++corenet_tcp_connect_ssh_port(glusterd_t)
+
+dev_read_sysfs(glusterd_t)
+dev_read_urand(glusterd_t)
@@ -25662,6 +25734,7 @@ index 0000000..a19c35c
+fs_getattr_all_fs(glusterd_t)
+
+logging_send_syslog_msg(glusterd_t)
++libs_exec_ldconfig(glusterd_t)
+
+miscfiles_read_localization(glusterd_t)
+miscfiles_read_public_files(glusterd_t)
@@ -25669,6 +25742,7 @@ index 0000000..a19c35c
+userdom_manage_user_home_dirs(glusterd_t)
+userdom_filetrans_home_content(glusterd_t)
+
++mount_domtrans(glusterd_t)
+tunable_policy(`gluster_anon_write',`
+ miscfiles_manage_public_files(glusterd_t)
+')
@@ -25686,6 +25760,15 @@ index 0000000..a19c35c
+
+optional_policy(`
+ rpc_domtrans_rpcd(glusterd_t)
++ rpc_kill_rpcd(glusterd_t)
++')
++
++optional_policy(`
++ rsync_exec(glusterd_t)
++')
++
++optional_policy(`
++ ssh_exec(glusterd_t)
+')
diff --git a/glusterfs.fc b/glusterfs.fc
deleted file mode 100644
@@ -29579,10 +29662,10 @@ index 0000000..3ce0ac0
+')
diff --git a/gssproxy.te b/gssproxy.te
new file mode 100644
-index 0000000..80179fe
+index 0000000..5044e7b
--- /dev/null
+++ b/gssproxy.te
-@@ -0,0 +1,65 @@
+@@ -0,0 +1,66 @@
+policy_module(gssproxy, 1.0.0)
+
+########################################
@@ -29642,6 +29725,7 @@ index 0000000..80179fe
+
+optional_policy(`
+ kerberos_use(gssproxy_t)
++ kerberos_filetrans_named_content(gssproxy_t)
+')
+
+optional_policy(`
@@ -29917,10 +30001,10 @@ index 0000000..17c3627
+')
diff --git a/hypervkvp.te b/hypervkvp.te
new file mode 100644
-index 0000000..d6703c3
+index 0000000..d2ad022
--- /dev/null
+++ b/hypervkvp.te
-@@ -0,0 +1,60 @@
+@@ -0,0 +1,59 @@
+policy_module(hypervkvp, 1.0.0)
+
+########################################
@@ -29955,18 +30039,17 @@ index 0000000..d6703c3
+# hyperv domain local policy
+#
+
++allow hyperv_domain self:capability net_admin;
++allow hyperv_domain self:netlink_socket create_socket_perms;
++
+allow hyperv_domain self:fifo_file rw_fifo_file_perms;
+allow hyperv_domain self:unix_stream_socket create_stream_socket_perms;
+
-+
+########################################
+#
+# hypervkvp local policy
+#
+
-+allow hypervkvp_t self:capability net_admin;
-+allow hypervkvp_t self:netlink_socket create_socket_perms;
-+
+manage_dirs_pattern(hypervkvp_t, hypervkvp_var_lib_t, hypervkvp_var_lib_t)
+manage_files_pattern(hypervkvp_t, hypervkvp_var_lib_t, hypervkvp_var_lib_t)
+files_var_lib_filetrans(hypervkvp_t, hypervkvp_var_lib_t, dir)
@@ -39226,8 +39309,292 @@ index 4462c0e..84944d1 100644
sysnet_dns_name_resolve(monopd_t)
userdom_dontaudit_use_unpriv_user_fds(monopd_t)
+diff --git a/motion.fc b/motion.fc
+new file mode 100644
+index 0000000..7415106
+--- /dev/null
++++ b/motion.fc
+@@ -0,0 +1,9 @@
++/usr/bin/motion -- gen_context(system_u:object_r:motion_exec_t,s0)
++
++/usr/lib/systemd/system/motion.* -- gen_context(system_u:object_r:motion_unit_file_t,s0)
++
++/var/log/motion\.log.* -- gen_context(system_u:object_r:motion_log_t,s0)
++
++/var/run/motion\.pid -- gen_context(system_u:object_r:motion_var_run_t,s0)
++
++/var/motion(/.*)? gen_context(system_u:object_r:motion_data_t,s0)
+diff --git a/motion.if b/motion.if
+new file mode 100644
+index 0000000..1b1b04c
+--- /dev/null
++++ b/motion.if
+@@ -0,0 +1,193 @@
++
++## Detect motion using a video4linux device
++
++########################################
++##
++## Execute TEMPLATE in the motion domain.
++##
++##
++##
++## Domain allowed to transition.
++##
++##
++#
++interface(`motion_domtrans',`
++ gen_require(`
++ type motion_t, motion_exec_t;
++ ')
++
++ corecmd_search_bin($1)
++ domtrans_pattern($1, motion_exec_t, motion_t)
++')
++########################################
++##
++## Read motion's log files.
++##
++##
++##
++## Domain allowed access.
++##
++##
++##
++#
++interface(`motion_read_log',`
++ gen_require(`
++ type motion_log_t;
++ ')
++
++ logging_search_logs($1)
++ read_files_pattern($1, motion_log_t, motion_log_t)
++')
++
++########################################
++##
++## Append to motion log files.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`motion_append_log',`
++ gen_require(`
++ type motion_log_t;
++ ')
++
++ logging_search_logs($1)
++ append_files_pattern($1, motion_log_t, motion_log_t)
++')
++
++########################################
++##
++## Manage motion log files
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`motion_manage_log',`
++ gen_require(`
++ type motion_log_t;
++ ')
++
++ logging_search_logs($1)
++ manage_dirs_pattern($1, motion_log_t, motion_log_t)
++ manage_files_pattern($1, motion_log_t, motion_log_t)
++ manage_lnk_files_pattern($1, motion_log_t, motion_log_t)
++')
++
++########################################
++##
++## Manage motion pid files
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`motion_manage_pid',`
++ gen_require(`
++ type motion_var_run_t;
++ ')
++
++ manage_dirs_pattern($1, motion_var_run_t, motion_var_run_t)
++ manage_files_pattern($1, motion_var_run_t, motion_var_run_t)
++')
++
++########################################
++##
++## Manage motion data files
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`motion_manage_data',`
++ gen_require(`
++ type motion_data_t;
++ ')
++
++ manage_dirs_pattern($1, motion_data_t, motion_data_t)
++ manage_files_pattern($1, motion_data_t, motion_data_t)
++')
++
++########################################
++##
++## Execute motion server in the motion domain.
++##
++##
++##
++## Domain allowed to transition.
++##
++##
++#
++interface(`motion_systemctl',`
++ gen_require(`
++ type motion_t;
++ type motion_unit_file_t;
++ ')
++
++ systemd_exec_systemctl($1)
++ systemd_read_fifo_file_password_run($1)
++ allow $1 motion_unit_file_t:file read_file_perms;
++ allow $1 motion_unit_file_t:service manage_service_perms;
++
++ ps_process_pattern($1, motion_t)
++')
++
++########################################
++##
++## Manage all motion files.
++##
++##
++##
++## Domain allowed to transition.
++##
++##
++#
++interface(`motion_manage_all_files',`
++
++ motion_manage_log($1)
++ motion_manage_pid($1)
++ motion_manage_data($1)
++')
++
++########################################
++##
++## All of the rules required to administrate
++## an motion environment
++##
++##
++##
++## Domain allowed access.
++##
++##
++##
++#
++interface(`motion_admin',`
++ gen_require(`
++ type motion_t;
++ type motion_log_t;
++ type motion_unit_file_t;
++ ')
++
++ allow $1 motion_t:process { ptrace signal_perms };
++ ps_process_pattern($1, motion_t)
++
++ logging_search_logs($1)
++ admin_pattern($1, motion_log_t)
++
++ motion_systemctl($1)
++ admin_pattern($1, motion_unit_file_t)
++ allow $1 motion_unit_file_t:service all_service_perms;
++ optional_policy(`
++ systemd_passwd_agent_exec($1)
++ systemd_read_fifo_file_passwd_run($1)
++ ')
++')
+diff --git a/motion.te b/motion.te
+new file mode 100644
+index 0000000..b694afc
+--- /dev/null
++++ b/motion.te
+@@ -0,0 +1,64 @@
++policy_module(motion, 1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type motion_t;
++type motion_exec_t;
++init_daemon_domain(motion_t, motion_exec_t)
++
++type motion_log_t;
++logging_log_file(motion_log_t)
++
++type motion_unit_file_t;
++systemd_unit_file(motion_unit_file_t)
++
++type motion_var_run_t;
++files_pid_file(motion_var_run_t)
++
++type motion_data_t;
++files_type(motion_data_t)
++
++########################################
++#
++# motion local policy
++#
++allow motion_t self:udp_socket { create connect getattr };
++allow motion_t self:tcp_socket { bind create setopt listen };
++allow motion_t self:netlink_route_socket r_netlink_socket_perms;
++
++manage_dirs_pattern(motion_t, motion_log_t, motion_log_t)
++manage_files_pattern(motion_t, motion_log_t, motion_log_t)
++logging_log_filetrans(motion_t, motion_log_t, { dir file })
++
++manage_dirs_pattern(motion_t, motion_var_run_t, motion_var_run_t)
++manage_files_pattern(motion_t, motion_var_run_t, motion_var_run_t)
++files_pid_filetrans(motion_t, motion_var_run_t, { dir file })
++
++manage_dirs_pattern(motion_t, motion_data_t, motion_data_t)
++manage_files_pattern(motion_t, motion_data_t, motion_data_t)
++files_var_filetrans(motion_t, motion_data_t, { dir file })
++
++corenet_tcp_bind_http_cache_port(motion_t)
++corenet_tcp_bind_transproxy_port(motion_t)
++corenet_tcp_connect_http_port(motion_t)
++corenet_tcp_bind_generic_node(motion_t)
++
++dev_read_video_dev(motion_t)
++dev_write_video_dev(motion_t)
++
++domain_use_interactive_fds(motion_t)
++
++logging_send_syslog_msg(motion_t)
++
++sysnet_read_config(motion_t)
++
++userdom_home_manager(motion_t)
++
++optional_policy(`
++ zoneminder_domtrans(motion_t)
++ zoneminder_manage_lib_files(motion_t)
++')
++
diff --git a/mozilla.fc b/mozilla.fc
-index 6ffaba2..adf8fe5 100644
+index 6ffaba2..2c1c0e0 100644
--- a/mozilla.fc
+++ b/mozilla.fc
@@ -1,38 +1,68 @@
@@ -39268,14 +39635,14 @@ index 6ffaba2..adf8fe5 100644
+HOME_DIR/\.grl-podcasts(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.icedteaplugin(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.icedtea(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
++HOME_DIR/\.juniper_networks(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.lyx(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.quakelive(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.spicec(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.texlive2012(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.ICAClient(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
-+HOME_DIR/.IBMERS(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
++HOME_DIR/\.IBMERS(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/zimbrauserdata(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
-+
+#
+# /bin
+#
@@ -39289,7 +39656,7 @@ index 6ffaba2..adf8fe5 100644
-/usr/bin/netscape -- gen_context(system_u:object_r:mozilla_exec_t,s0)
-/usr/bin/nspluginscan -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
-/usr/bin/nspluginviewer -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
--
+
-/usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0)
-/usr/lib/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0)
-/usr/lib/firefox[^/]*/mozilla-.* -- gen_context(system_u:object_r:mozilla_exec_t,s0)
@@ -39300,7 +39667,6 @@ index 6ffaba2..adf8fe5 100644
-/usr/lib/mozilla/plugins-wrapped(/.*)? gen_context(system_u:object_r:mozilla_plugin_rw_t,s0)
-/usr/lib/netscape/base-4/wrapper -- gen_context(system_u:object_r:mozilla_exec_t,s0)
-/usr/lib/netscape/.+/communicator/communicator-smotif\.real -- gen_context(system_u:object_r:mozilla_exec_t,s0)
-+
+ifdef(`distro_redhat',`
+/usr/bin/nspluginscan -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
+/usr/bin/nspluginviewer -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
@@ -39334,7 +39700,7 @@ index 6ffaba2..adf8fe5 100644
+/usr/lib/nspluginwrapper/plugin-config -- gen_context(system_u:object_r:mozilla_plugin_config_exec_t,s0)
+')
diff --git a/mozilla.if b/mozilla.if
-index 6194b80..37abdbe 100644
+index 6194b80..1e67988 100644
--- a/mozilla.if
+++ b/mozilla.if
@@ -1,146 +1,75 @@
@@ -40025,7 +40391,7 @@ index 6194b80..37abdbe 100644
##
##
##
-@@ -530,45 +499,54 @@ interface(`mozilla_plugin_delete_tmpfs_files',`
+@@ -530,45 +499,55 @@ interface(`mozilla_plugin_delete_tmpfs_files',`
##
##
#
@@ -40097,6 +40463,7 @@ index 6194b80..37abdbe 100644
+ userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".texlive2012")
+ userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".ICAClient")
+ userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, "zimbrauserdata")
++ userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".juniper_networks")
+ userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".lyx")
+ userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".IBMERS")
+ userdom_user_home_dir_filetrans($1, mozilla_home_t, file, ".gnashpluginrc")
@@ -40105,7 +40472,7 @@ index 6194b80..37abdbe 100644
')
+
diff --git a/mozilla.te b/mozilla.te
-index 6a306ee..628bc55 100644
+index 6a306ee..2356e2b 100644
--- a/mozilla.te
+++ b/mozilla.te
@@ -1,4 +1,4 @@
@@ -40549,7 +40916,7 @@ index 6a306ee..628bc55 100644
')
optional_policy(`
-@@ -300,259 +324,234 @@ optional_policy(`
+@@ -300,259 +324,235 @@ optional_policy(`
########################################
#
@@ -40736,6 +41103,7 @@ index 6a306ee..628bc55 100644
+corenet_dontaudit_udp_bind_ssdp_port(mozilla_plugin_t)
-dev_read_generic_usb_dev(mozilla_plugin_t)
++dev_dontaudit_append_rand(mozilla_plugin_t)
dev_read_rand(mozilla_plugin_t)
-dev_read_realtime_clock(mozilla_plugin_t)
-dev_read_sound(mozilla_plugin_t)
@@ -40935,7 +41303,7 @@ index 6a306ee..628bc55 100644
')
optional_policy(`
-@@ -560,7 +559,7 @@ optional_policy(`
+@@ -560,7 +560,7 @@ optional_policy(`
')
optional_policy(`
@@ -40944,7 +41312,7 @@ index 6a306ee..628bc55 100644
')
optional_policy(`
-@@ -568,108 +567,128 @@ optional_policy(`
+@@ -568,108 +568,128 @@ optional_policy(`
')
optional_policy(`
@@ -45301,7 +45669,7 @@ index 0641e97..d7d9a79 100644
+ admin_pattern($1, nrpe_etc_t)
')
diff --git a/nagios.te b/nagios.te
-index 44ad3b7..e5b268b 100644
+index 44ad3b7..a0488ea 100644
--- a/nagios.te
+++ b/nagios.te
@@ -27,7 +27,7 @@ type nagios_var_run_t;
@@ -45331,13 +45699,14 @@ index 44ad3b7..e5b268b 100644
type nrpe_t;
type nrpe_exec_t;
init_daemon_domain(nrpe_t, nrpe_exec_t)
-@@ -63,19 +67,20 @@ files_pid_file(nrpe_var_run_t)
+@@ -63,19 +67,21 @@ files_pid_file(nrpe_var_run_t)
allow nagios_plugin_domain self:fifo_file rw_fifo_file_perms;
+allow nrpe_t nagios_plugin_domain:process { signal sigkill };
+
+allow nagios_t nagios_plugin_domain:process signal_perms;
++allow nagios_plugin_domain nagios_t:process signal_perms;
+
+# cjp: leaked file descriptor
dontaudit nagios_plugin_domain nrpe_t:tcp_socket { read write };
@@ -45359,7 +45728,7 @@ index 44ad3b7..e5b268b 100644
########################################
#
-@@ -96,11 +101,13 @@ allow nagios_t nagios_etc_t:dir list_dir_perms;
+@@ -96,11 +102,13 @@ allow nagios_t nagios_etc_t:dir list_dir_perms;
allow nagios_t nagios_etc_t:file read_file_perms;
allow nagios_t nagios_etc_t:lnk_file read_lnk_file_perms;
@@ -45378,7 +45747,7 @@ index 44ad3b7..e5b268b 100644
manage_dirs_pattern(nagios_t, nagios_tmp_t, nagios_tmp_t)
manage_files_pattern(nagios_t, nagios_tmp_t, nagios_tmp_t)
-@@ -110,7 +117,8 @@ manage_files_pattern(nagios_t, nagios_var_run_t, nagios_var_run_t)
+@@ -110,7 +118,8 @@ manage_files_pattern(nagios_t, nagios_var_run_t, nagios_var_run_t)
files_pid_filetrans(nagios_t, nagios_var_run_t, file)
manage_fifo_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t)
@@ -45388,7 +45757,7 @@ index 44ad3b7..e5b268b 100644
manage_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
manage_fifo_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
-@@ -123,7 +131,6 @@ kernel_read_software_raid_state(nagios_t)
+@@ -123,7 +132,6 @@ kernel_read_software_raid_state(nagios_t)
corecmd_exec_bin(nagios_t)
corecmd_exec_shell(nagios_t)
@@ -45396,7 +45765,7 @@ index 44ad3b7..e5b268b 100644
corenet_all_recvfrom_netlabel(nagios_t)
corenet_tcp_sendrecv_generic_if(nagios_t)
corenet_tcp_sendrecv_generic_node(nagios_t)
-@@ -143,7 +150,6 @@ domain_read_all_domains_state(nagios_t)
+@@ -143,7 +151,6 @@ domain_read_all_domains_state(nagios_t)
files_read_etc_runtime_files(nagios_t)
files_read_kernel_symbol_table(nagios_t)
@@ -45404,7 +45773,7 @@ index 44ad3b7..e5b268b 100644
files_search_spool(nagios_t)
fs_getattr_all_fs(nagios_t)
-@@ -153,8 +159,6 @@ auth_use_nsswitch(nagios_t)
+@@ -153,8 +160,6 @@ auth_use_nsswitch(nagios_t)
logging_send_syslog_msg(nagios_t)
@@ -45413,7 +45782,7 @@ index 44ad3b7..e5b268b 100644
userdom_dontaudit_use_unpriv_user_fds(nagios_t)
userdom_dontaudit_search_user_home_dirs(nagios_t)
-@@ -178,6 +182,7 @@ optional_policy(`
+@@ -178,6 +183,7 @@ optional_policy(`
#
# CGI local policy
#
@@ -45421,7 +45790,7 @@ index 44ad3b7..e5b268b 100644
optional_policy(`
apache_content_template(nagios)
typealias httpd_nagios_script_t alias nagios_cgi_t;
-@@ -229,9 +234,9 @@ files_pid_filetrans(nrpe_t, nrpe_var_run_t, file)
+@@ -229,9 +235,9 @@ files_pid_filetrans(nrpe_t, nrpe_var_run_t, file)
domtrans_pattern(nrpe_t, nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t)
@@ -45432,7 +45801,7 @@ index 44ad3b7..e5b268b 100644
corecmd_exec_bin(nrpe_t)
corecmd_exec_shell(nrpe_t)
-@@ -252,8 +257,8 @@ dev_read_urand(nrpe_t)
+@@ -252,8 +258,8 @@ dev_read_urand(nrpe_t)
domain_use_interactive_fds(nrpe_t)
domain_read_all_domains_state(nrpe_t)
@@ -45442,7 +45811,7 @@ index 44ad3b7..e5b268b 100644
fs_getattr_all_fs(nrpe_t)
fs_search_auto_mountpoints(nrpe_t)
-@@ -262,8 +267,6 @@ auth_use_nsswitch(nrpe_t)
+@@ -262,8 +268,6 @@ auth_use_nsswitch(nrpe_t)
logging_send_syslog_msg(nrpe_t)
@@ -45451,7 +45820,7 @@ index 44ad3b7..e5b268b 100644
userdom_dontaudit_use_unpriv_user_fds(nrpe_t)
optional_policy(`
-@@ -310,15 +313,15 @@ files_getattr_all_file_type_fs(nagios_admin_plugin_t)
+@@ -310,15 +314,15 @@ files_getattr_all_file_type_fs(nagios_admin_plugin_t)
#
allow nagios_mail_plugin_t self:capability { setuid setgid dac_override };
@@ -45470,7 +45839,7 @@ index 44ad3b7..e5b268b 100644
logging_send_syslog_msg(nagios_mail_plugin_t)
sysnet_dns_name_resolve(nagios_mail_plugin_t)
-@@ -345,6 +348,9 @@ allow nagios_checkdisk_plugin_t self:capability { sys_admin sys_rawio };
+@@ -345,6 +349,9 @@ allow nagios_checkdisk_plugin_t self:capability { sys_admin sys_rawio };
kernel_read_software_raid_state(nagios_checkdisk_plugin_t)
@@ -45480,7 +45849,7 @@ index 44ad3b7..e5b268b 100644
files_getattr_all_mountpoints(nagios_checkdisk_plugin_t)
files_read_etc_runtime_files(nagios_checkdisk_plugin_t)
-@@ -357,9 +363,11 @@ storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t)
+@@ -357,9 +364,11 @@ storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t)
# Services local policy
#
@@ -45494,15 +45863,19 @@ index 44ad3b7..e5b268b 100644
corecmd_exec_bin(nagios_services_plugin_t)
-@@ -391,6 +399,7 @@ optional_policy(`
+@@ -391,6 +400,11 @@ optional_policy(`
optional_policy(`
mysql_stream_connect(nagios_services_plugin_t)
+ mysql_read_config(nagios_services_plugin_t)
++')
++
++optional_policy(`
++ postgresql_stream_connect(nagios_services_plugin_t)
')
optional_policy(`
-@@ -411,6 +420,7 @@ manage_files_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_
+@@ -411,6 +425,7 @@ manage_files_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_
manage_dirs_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_system_plugin_tmp_t)
files_tmp_filetrans(nagios_system_plugin_t, nagios_system_plugin_tmp_t, { dir file })
@@ -45510,7 +45883,7 @@ index 44ad3b7..e5b268b 100644
kernel_read_kernel_sysctls(nagios_system_plugin_t)
corecmd_exec_bin(nagios_system_plugin_t)
-@@ -420,10 +430,10 @@ dev_read_sysfs(nagios_system_plugin_t)
+@@ -420,10 +435,10 @@ dev_read_sysfs(nagios_system_plugin_t)
domain_read_all_domains_state(nagios_system_plugin_t)
@@ -45523,7 +45896,7 @@ index 44ad3b7..e5b268b 100644
optional_policy(`
init_read_utmp(nagios_system_plugin_t)
')
-@@ -442,11 +452,44 @@ corecmd_exec_shell(nagios_eventhandler_plugin_t)
+@@ -442,11 +457,44 @@ corecmd_exec_shell(nagios_eventhandler_plugin_t)
init_domtrans_script(nagios_eventhandler_plugin_t)
@@ -57795,7 +58168,7 @@ index ae27bb7..d00f6ba 100644
+ allow $1 polipo_unit_file_t:service all_service_perms;
')
diff --git a/polipo.te b/polipo.te
-index 316d53a..388d659 100644
+index 316d53a..35d9018 100644
--- a/polipo.te
+++ b/polipo.te
@@ -1,4 +1,4 @@
@@ -57871,7 +58244,7 @@ index 316d53a..388d659 100644
type polipo_cache_t;
files_type(polipo_cache_t)
-@@ -56,112 +63,96 @@ files_type(polipo_cache_t)
+@@ -56,112 +63,97 @@ files_type(polipo_cache_t)
type polipo_log_t;
logging_log_file(polipo_log_t)
@@ -57925,6 +58298,7 @@ index 316d53a..388d659 100644
+corenet_sendrecv_http_cache_server_packets(polipo_daemon)
+corenet_tcp_connect_http_port(polipo_daemon)
+corenet_tcp_connect_tor_port(polipo_daemon)
++corenet_tcp_connect_flash_port(polipo_daemon)
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(polipo_session_t)
@@ -72875,7 +73249,7 @@ index a6fb30c..b0c22f7 100644
+/var/run/rpc\.statd\.pid -- gen_context(system_u:object_r:rpcd_var_run_t,s0)
+
diff --git a/rpc.if b/rpc.if
-index 3bd6446..8bde316 100644
+index 3bd6446..eec0a35 100644
--- a/rpc.if
+++ b/rpc.if
@@ -1,4 +1,4 @@
@@ -73075,7 +73449,7 @@ index 3bd6446..8bde316 100644
##
##
##
-@@ -167,120 +239,108 @@ interface(`rpc_initrc_domtrans_nfsd',`
+@@ -167,120 +239,126 @@ interface(`rpc_initrc_domtrans_nfsd',`
##
##
#
@@ -73089,29 +73463,36 @@ index 3bd6446..8bde316 100644
- corecmd_search_bin($1)
- domtrans_pattern($1, rpcd_exec_t, rpcd_t)
--')
+ systemd_exec_systemctl($1)
+ allow $1 nfsd_unit_file_t:file read_file_perms;
+ allow $1 nfsd_unit_file_t:service manage_service_perms;
++
++ ps_process_pattern($1, nfsd_t)
+ ')
-#######################################
--##
++########################################
+ ##
-## Execute rpcd init scripts in
-## the initrc domain.
--##
--##
--##
++## Send kill signals to rpcd.
+ ##
+ ##
+ ##
-## Domain allowed to transition.
--##
--##
--#
++## Domain allowed access.
+ ##
+ ##
+ #
-interface(`rpc_initrc_domtrans_rpcd',`
-- gen_require(`
++interface(`rpc_kill_rpcd',`
+ gen_require(`
- type rpcd_initrc_exec_t;
-- ')
--
++ type rpcd_t;
+ ')
+
- init_labeled_script_domtrans($1, rpcd_initrc_exec_t)
-+ ps_process_pattern($1, nfsd_t)
++ allow $1 rpcd_t:process sigkill;
')
########################################
@@ -73238,7 +73619,7 @@ index 3bd6446..8bde316 100644
##
##
##
-@@ -312,7 +372,7 @@ interface(`rpc_udp_send_nfs',`
+@@ -312,7 +390,7 @@ interface(`rpc_udp_send_nfs',`
########################################
##
@@ -73247,7 +73628,7 @@ index 3bd6446..8bde316 100644
##
##
##
-@@ -326,12 +386,12 @@ interface(`rpc_search_nfs_state_data',`
+@@ -326,12 +404,12 @@ interface(`rpc_search_nfs_state_data',`
')
files_search_var_lib($1)
@@ -73262,7 +73643,7 @@ index 3bd6446..8bde316 100644
##
##
##
-@@ -339,19 +399,18 @@ interface(`rpc_search_nfs_state_data',`
+@@ -339,19 +417,18 @@ interface(`rpc_search_nfs_state_data',`
##
##
#
@@ -73285,7 +73666,7 @@ index 3bd6446..8bde316 100644
##
##
##
-@@ -359,62 +418,31 @@ interface(`rpc_read_nfs_state_data',`
+@@ -359,62 +436,31 @@ interface(`rpc_read_nfs_state_data',`
##
##
#
@@ -76782,7 +77163,7 @@ index aee75af..a6bab06 100644
+ allow $1 samba_unit_file_t:service all_service_perms;
')
diff --git a/samba.te b/samba.te
-index 57c034b..b1c78f8 100644
+index 57c034b..b2225a3 100644
--- a/samba.te
+++ b/samba.te
@@ -1,4 +1,4 @@
@@ -77094,10 +77475,10 @@ index 57c034b..b1c78f8 100644
+allow smbd_t self:udp_socket create_socket_perms;
+allow smbd_t self:unix_dgram_socket { create_socket_perms sendto };
+allow smbd_t self:unix_stream_socket { create_stream_socket_perms connectto };
-+
-+allow smbd_t nmbd_t:process { signal signull };
-allow smbd_t { swat_t winbind_t smbcontrol_t nmbd_t }:process { signal signull };
++allow smbd_t nmbd_t:process { signal signull };
++
+allow smbd_t nmbd_var_run_t:file rw_file_perms;
+stream_connect_pattern(smbd_t, nmbd_var_run_t, nmbd_var_run_t, nmbd_t)
@@ -77318,7 +77699,15 @@ index 57c034b..b1c78f8 100644
optional_policy(`
ccs_read_config(smbd_t)
')
-@@ -473,6 +459,11 @@ optional_policy(`
+@@ -460,6 +446,7 @@ optional_policy(`
+ optional_policy(`
+ ctdbd_stream_connect(smbd_t)
+ ctdbd_manage_lib_files(smbd_t)
++ ctdbd_manage_var_files(smbd_t)
+ ')
+
+ optional_policy(`
+@@ -473,6 +460,11 @@ optional_policy(`
')
optional_policy(`
@@ -77330,7 +77719,7 @@ index 57c034b..b1c78f8 100644
lpd_exec_lpr(smbd_t)
')
-@@ -493,9 +484,33 @@ optional_policy(`
+@@ -493,9 +485,33 @@ optional_policy(`
udev_read_db(smbd_t)
')
@@ -77365,7 +77754,7 @@ index 57c034b..b1c78f8 100644
#
dontaudit nmbd_t self:capability sys_tty_config;
-@@ -506,9 +521,11 @@ allow nmbd_t self:msg { send receive };
+@@ -506,9 +522,11 @@ allow nmbd_t self:msg { send receive };
allow nmbd_t self:msgq create_msgq_perms;
allow nmbd_t self:sem create_sem_perms;
allow nmbd_t self:shm create_shm_perms;
@@ -77380,7 +77769,7 @@ index 57c034b..b1c78f8 100644
manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t)
manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t)
-@@ -520,20 +537,15 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
+@@ -520,20 +538,15 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t)
@@ -77404,7 +77793,7 @@ index 57c034b..b1c78f8 100644
kernel_getattr_core_if(nmbd_t)
kernel_getattr_message_if(nmbd_t)
-@@ -542,52 +554,40 @@ kernel_read_network_state(nmbd_t)
+@@ -542,52 +555,40 @@ kernel_read_network_state(nmbd_t)
kernel_read_software_raid_state(nmbd_t)
kernel_read_system_state(nmbd_t)
@@ -77469,7 +77858,7 @@ index 57c034b..b1c78f8 100644
')
optional_policy(`
-@@ -600,19 +600,26 @@ optional_policy(`
+@@ -600,19 +601,26 @@ optional_policy(`
########################################
#
@@ -77501,7 +77890,7 @@ index 57c034b..b1c78f8 100644
samba_search_var(smbcontrol_t)
samba_read_winbind_pid(smbcontrol_t)
-@@ -620,16 +627,12 @@ domain_use_interactive_fds(smbcontrol_t)
+@@ -620,16 +628,12 @@ domain_use_interactive_fds(smbcontrol_t)
dev_read_urand(smbcontrol_t)
@@ -77519,7 +77908,7 @@ index 57c034b..b1c78f8 100644
optional_policy(`
ctdbd_stream_connect(smbcontrol_t)
-@@ -637,22 +640,23 @@ optional_policy(`
+@@ -637,22 +641,23 @@ optional_policy(`
########################################
#
@@ -77551,7 +77940,7 @@ index 57c034b..b1c78f8 100644
allow smbmount_t samba_secrets_t:file manage_file_perms;
-@@ -661,26 +665,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t)
+@@ -661,26 +666,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t)
manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t)
files_var_filetrans(smbmount_t, samba_var_t, dir, "samba")
@@ -77587,7 +77976,7 @@ index 57c034b..b1c78f8 100644
fs_getattr_cifs(smbmount_t)
fs_mount_cifs(smbmount_t)
-@@ -692,58 +692,77 @@ fs_read_cifs_files(smbmount_t)
+@@ -692,58 +693,77 @@ fs_read_cifs_files(smbmount_t)
storage_raw_read_fixed_disk(smbmount_t)
storage_raw_write_fixed_disk(smbmount_t)
@@ -77679,7 +78068,7 @@ index 57c034b..b1c78f8 100644
manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t)
manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t)
-@@ -752,17 +771,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir })
+@@ -752,17 +772,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir })
manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t)
files_pid_filetrans(swat_t, swat_var_run_t, file)
@@ -77703,7 +78092,7 @@ index 57c034b..b1c78f8 100644
kernel_read_kernel_sysctls(swat_t)
kernel_read_system_state(swat_t)
-@@ -770,36 +785,25 @@ kernel_read_network_state(swat_t)
+@@ -770,36 +786,25 @@ kernel_read_network_state(swat_t)
corecmd_search_bin(swat_t)
@@ -77746,7 +78135,7 @@ index 57c034b..b1c78f8 100644
auth_domtrans_chk_passwd(swat_t)
auth_use_nsswitch(swat_t)
-@@ -811,10 +815,11 @@ logging_send_syslog_msg(swat_t)
+@@ -811,10 +816,11 @@ logging_send_syslog_msg(swat_t)
logging_send_audit_msgs(swat_t)
logging_search_logs(swat_t)
@@ -77760,7 +78149,7 @@ index 57c034b..b1c78f8 100644
optional_policy(`
cups_read_rw_config(swat_t)
cups_stream_connect(swat_t)
-@@ -834,16 +839,19 @@ optional_policy(`
+@@ -834,16 +840,19 @@ optional_policy(`
#
allow winbind_t self:capability { dac_override ipc_lock setuid sys_nice };
@@ -77784,7 +78173,7 @@ index 57c034b..b1c78f8 100644
allow winbind_t samba_etc_t:dir list_dir_perms;
read_files_pattern(winbind_t, samba_etc_t, samba_etc_t)
-@@ -853,9 +861,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t)
+@@ -853,9 +862,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t)
filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file)
manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t)
@@ -77795,7 +78184,7 @@ index 57c034b..b1c78f8 100644
manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t)
manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t)
-@@ -866,23 +872,21 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba")
+@@ -866,23 +873,21 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba")
rw_files_pattern(winbind_t, smbd_tmp_t, smbd_tmp_t)
@@ -77825,7 +78214,7 @@ index 57c034b..b1c78f8 100644
manage_sock_files_pattern(winbind_t, smbd_var_run_t, smbd_var_run_t)
kernel_read_network_state(winbind_t)
-@@ -891,13 +895,17 @@ kernel_read_system_state(winbind_t)
+@@ -891,13 +896,17 @@ kernel_read_system_state(winbind_t)
corecmd_exec_bin(winbind_t)
@@ -77846,7 +78235,7 @@ index 57c034b..b1c78f8 100644
corenet_tcp_connect_smbd_port(winbind_t)
corenet_tcp_connect_epmap_port(winbind_t)
corenet_tcp_connect_all_unreserved_ports(winbind_t)
-@@ -905,10 +913,6 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t)
+@@ -905,10 +914,6 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t)
dev_read_sysfs(winbind_t)
dev_read_urand(winbind_t)
@@ -77857,7 +78246,7 @@ index 57c034b..b1c78f8 100644
fs_getattr_all_fs(winbind_t)
fs_search_auto_mountpoints(winbind_t)
-@@ -917,18 +921,24 @@ auth_domtrans_chk_passwd(winbind_t)
+@@ -917,26 +922,39 @@ auth_domtrans_chk_passwd(winbind_t)
auth_use_nsswitch(winbind_t)
auth_manage_cache(winbind_t)
@@ -77884,20 +78273,22 @@ index 57c034b..b1c78f8 100644
optional_policy(`
ctdbd_stream_connect(winbind_t)
-@@ -936,7 +946,12 @@ optional_policy(`
- ')
-
- optional_policy(`
-+ dirsrv_stream_connect(winbind_t)
+ ctdbd_manage_lib_files(winbind_t)
++ ctdbd_manage_var_files(winbind_t)
+')
+
++
+optional_policy(`
++ dirsrv_stream_connect(winbind_t)
+ ')
+
+ optional_policy(`
kerberos_use(winbind_t)
+ kerberos_filetrans_named_content(winbind_t)
')
optional_policy(`
-@@ -952,31 +967,29 @@ optional_policy(`
+@@ -952,31 +970,29 @@ optional_policy(`
# Winbind helper local policy
#
@@ -77935,7 +78326,7 @@ index 57c034b..b1c78f8 100644
optional_policy(`
apache_append_log(winbind_helper_t)
-@@ -990,25 +1003,38 @@ optional_policy(`
+@@ -990,25 +1006,38 @@ optional_policy(`
########################################
#
@@ -97713,10 +98104,10 @@ index 46e4cd3..dea93eb 100644
+')
+
diff --git a/zarafa.fc b/zarafa.fc
-index faf99ed..fb336ae 100644
+index faf99ed..44e94fa 100644
--- a/zarafa.fc
+++ b/zarafa.fc
-@@ -1,20 +1,19 @@
+@@ -1,33 +1,34 @@
-/etc/zarafa(/.*)? gen_context(system_u:object_r:zarafa_etc_t,s0)
+/etc/zarafa(/.*)? gen_context(system_u:object_r:zarafa_etc_t,s0)
@@ -97749,8 +98140,9 @@ index faf99ed..fb336ae 100644
/var/log/zarafa/gateway\.log.* -- gen_context(system_u:object_r:zarafa_gateway_log_t,s0)
/var/log/zarafa/ical\.log.* -- gen_context(system_u:object_r:zarafa_ical_log_t,s0)
/var/log/zarafa/indexer\.log.* -- gen_context(system_u:object_r:zarafa_indexer_log_t,s0)
-@@ -22,11 +21,11 @@
+ /var/log/zarafa/monitor\.log.* -- gen_context(system_u:object_r:zarafa_monitor_log_t,s0)
/var/log/zarafa/server\.log.* -- gen_context(system_u:object_r:zarafa_server_log_t,s0)
++/var/log/zarafa/search\.log.* -- gen_context(system_u:object_r:zarafa_indexer_log_t,s0)
/var/log/zarafa/spooler\.log.* -- gen_context(system_u:object_r:zarafa_spooler_log_t,s0)
-/var/run/zarafa -s gen_context(system_u:object_r:zarafa_server_var_run_t,s0)
@@ -97764,6 +98156,8 @@ index faf99ed..fb336ae 100644
/var/run/zarafa-indexer\.pid -- gen_context(system_u:object_r:zarafa_indexer_var_run_t,s0)
/var/run/zarafa-monitor\.pid -- gen_context(system_u:object_r:zarafa_monitor_var_run_t,s0)
/var/run/zarafa-server\.pid -- gen_context(system_u:object_r:zarafa_server_var_run_t,s0)
++/var/run/zarafa-search\.pid -- gen_context(system_u:object_r:zarafa_indexer_var_run_t,s0)
+ /var/run/zarafa-spooler\.pid -- gen_context(system_u:object_r:zarafa_spooler_var_run_t,s0)
diff --git a/zarafa.if b/zarafa.if
index 36e32df..3d08962 100644
--- a/zarafa.if
@@ -98453,16 +98847,12 @@ index b0803c2..f1fa5f7 100644
+')
diff --git a/zoneminder.fc b/zoneminder.fc
new file mode 100644
-index 0000000..d8a6df1
+index 0000000..8c61505
--- /dev/null
+++ b/zoneminder.fc
-@@ -0,0 +1,26 @@
-+/etc/rc\.d/init\.d/motion -- gen_context(system_u:object_r:zoneminder_initrc_exec_t,s0)
-+
+@@ -0,0 +1,13 @@
+/etc/rc\.d/init\.d/zoneminder -- gen_context(system_u:object_r:zoneminder_initrc_exec_t,s0)
+
-+#/usr/bin/motion -- gen_context(system_u:object_r:zoneminder_exec_t,s0)
-+
+/usr/bin/zmpkg.pl -- gen_context(system_u:object_r:zoneminder_exec_t,s0)
+
+/usr/lib/systemd/system/zoneminder.* -- gen_context(system_u:object_r:zoneminder_unit_file_t,s0)
@@ -98471,24 +98861,15 @@ index 0000000..d8a6df1
+
+/var/lib/zoneminder(/.*)? gen_context(system_u:object_r:zoneminder_var_lib_t,s0)
+
-+/var/motion(/.*)? gen_context(system_u:object_r:zoneminder_var_lib_t,s0)
-+
+/var/log/zoneminder(/.*)? gen_context(system_u:object_r:zoneminder_log_t,s0)
+
-+/var/log/motion\.log.* -- gen_context(system_u:object_r:zoneminder_log_t,s0)
-+
-+/var/run/motion\.pid -- gen_context(system_u:object_r:zoneminder_var_run_t,s0)
-+
+/var/spool/zoneminder-upload(/.*)? gen_context(system_u:object_r:zoneminder_spool_t,s0)
-+
-+
-+
diff --git a/zoneminder.if b/zoneminder.if
new file mode 100644
-index 0000000..c72a70d
+index 0000000..614a979
--- /dev/null
+++ b/zoneminder.if
-@@ -0,0 +1,337 @@
+@@ -0,0 +1,354 @@
+## policy for zoneminder
+
+########################################
@@ -98666,6 +99047,23 @@ index 0000000..c72a70d
+ manage_dirs_pattern($1, zoneminder_var_lib_t, zoneminder_var_lib_t)
+')
+
++########################################
++##
++## Manage zoneminder sock_files files.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`zoneminder_manage_lib_sock_files',`
++ gen_require(`
++ type sock_var_lib_t;
++ ')
++ files_search_var_lib($1)
++ manage_sock_files_pattern($1, zoneminder_var_lib_t, zoneminder_var_lib_t)
++')
+
+########################################
+##
@@ -98828,10 +99226,10 @@ index 0000000..c72a70d
+
diff --git a/zoneminder.te b/zoneminder.te
new file mode 100644
-index 0000000..bdb821a
+index 0000000..add28f7
--- /dev/null
+++ b/zoneminder.te
-@@ -0,0 +1,174 @@
+@@ -0,0 +1,187 @@
+policy_module(zoneminder, 1.0.0)
+
+########################################
@@ -98857,6 +99255,7 @@ index 0000000..bdb821a
+
+gen_require(`
+ class passwd rootok;
++ class passwd passwd;
+ ')
+
+type zoneminder_t;
@@ -98893,6 +99292,7 @@ index 0000000..bdb821a
+allow zoneminder_t self:shm create_shm_perms;
+allow zoneminder_t self:fifo_file rw_fifo_file_perms;
+allow zoneminder_t self:unix_stream_socket { create_stream_socket_perms connectto };
++allow zoneminder_t self:netlink_selinux_socket create_socket_perms;
+
+manage_dirs_pattern(zoneminder_t, zoneminder_log_t, zoneminder_log_t)
+manage_files_pattern(zoneminder_t, zoneminder_log_t, zoneminder_log_t)
@@ -98936,6 +99336,7 @@ index 0000000..bdb821a
+dev_write_video_dev(zoneminder_t)
+
+auth_use_nsswitch(zoneminder_t)
++#auth_read_shadow(zoneminder_t) need to debug zmpkg.pl to see why is needed this rule.
+
+logging_send_syslog_msg(zoneminder_t)
+logging_send_audit_msgs(zoneminder_t)
@@ -98950,9 +99351,11 @@ index 0000000..bdb821a
+ allow zoneminder_t self:capability { setuid setgid sys_resource };
+ allow zoneminder_t self:process { setrlimit setsched };
+ allow zoneminder_t self:key write;
-+ allow zoneminder_t self:passwd rootok;
++ allow zoneminder_t self:passwd { passwd rootok };
+
+ auth_rw_lastlog(zoneminder_t)
++ auth_rw_faillog(zoneminder_t)
++ auth_exec_chkpwd(zoneminder_t)
+
+ selinux_compute_access_vector(zoneminder_t)
+
@@ -98978,6 +99381,14 @@ index 0000000..bdb821a
+ mysql_stream_connect(zoneminder_t)
+')
+
++optional_policy(`
++ fprintd_dbus_chat(zoneminder_t)
++')
++
++optional_policy(`
++ motion_manage_all_files(zoneminder_t)
++')
++
+########################################
+#
+# zoneminder cgi local policy
diff --git a/selinux-policy.spec b/selinux-policy.spec
index a46f3c5..e7a4990 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.12.1
-Release: 87%{?dist}
+Release: 88%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -571,6 +571,30 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Tue Oct 4 2013 Miroslav Grepl 3.12.1-88
+- Add auth_exec_chkpwd interface
+- Fix port definition for ctdb ports
+- Allow systemd domains to read /dev/urand
+- Dontaudit attempts for mozilla_plugin to append to /dev/random
+- Add label for /var/run/charon.*
+- Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service
+- Fix for nagios_services plugins
+- Fix some bugs in zoneminder policy
+- add type defintion for ctdbd_var_t
+- Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file
+- Allow net_admin/netlink_socket all hyperv_domain domains
+- Add labeling for zarafa-search.log and zarafa-search.pid
+- glusterd binds to random unreserved ports
+- Additional allow rules found by testing glusterfs
+- apcupsd needs to send a message to all users on the system so needs to look them up
+- Fix the label on ~/.juniper_networks
+- Dontaudit attempts for mozilla_plugin to append to /dev/random
+- Allow polipo_daemon to connect to flash ports
+- Allow gssproxy_t to create replay caches
+- Fix nscd_shm_use()
+- Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
+- Add hypervkvp_unit_file_t type
+
* Fri Oct 4 2013 Miroslav Grepl 3.12.1-87
- init reload from systemd_localed_t
- Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd