##
@@ -9675,34 +9298,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
########################################
#
# Samba net local policy
-@@ -146,7 +151,6 @@
- allow samba_net_t self:unix_stream_socket create_stream_socket_perms;
- allow samba_net_t self:udp_socket create_socket_perms;
- allow samba_net_t self:tcp_socket create_socket_perms;
--allow samba_net_t self:netlink_route_socket r_netlink_socket_perms;
-
- allow samba_net_t samba_etc_t:file read_file_perms;
-
-@@ -183,6 +187,8 @@
-
- files_read_etc_files(samba_net_t)
-
-+auth_use_nsswitch(samba_net_t)
-+
- libs_use_ld_so(samba_net_t)
- libs_use_shared_libs(samba_net_t)
-
-@@ -190,8 +196,7 @@
+@@ -191,16 +196,14 @@
miscfiles_read_localization(samba_net_t)
--sysnet_read_config(samba_net_t)
--sysnet_use_ldap(samba_net_t)
+samba_read_var_files(samba_net_t)
-
++
userdom_dontaudit_search_sysadm_home_dirs(samba_net_t)
-@@ -199,10 +204,6 @@
+ optional_policy(`
kerberos_use(samba_net_t)
')
@@ -9713,7 +9317,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
########################################
#
# smbd Local policy
-@@ -217,19 +218,16 @@
+@@ -215,7 +218,7 @@
allow smbd_t self:msgq create_msgq_perms;
allow smbd_t self:sem create_sem_perms;
allow smbd_t self:shm create_shm_perms;
@@ -9722,8 +9326,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
allow smbd_t self:tcp_socket create_stream_socket_perms;
allow smbd_t self:udp_socket create_socket_perms;
allow smbd_t self:unix_dgram_socket { create_socket_perms sendto };
- allow smbd_t self:unix_stream_socket { create_stream_socket_perms connectto };
--allow smbd_t self:netlink_route_socket r_netlink_socket_perms;
+@@ -223,10 +226,8 @@
allow smbd_t samba_etc_t:file { rw_file_perms setattr };
@@ -9736,7 +9339,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
allow smbd_t samba_net_tmp_t:file getattr;
-@@ -256,7 +254,7 @@
+@@ -253,7 +254,7 @@
manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t)
files_pid_filetrans(smbd_t,smbd_var_run_t,file)
@@ -9745,7 +9348,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
kernel_getattr_core_if(smbd_t)
kernel_getattr_message_if(smbd_t)
-@@ -298,6 +296,7 @@
+@@ -295,6 +296,7 @@
auth_use_nsswitch(smbd_t)
auth_domtrans_chk_passwd(smbd_t)
@@ -9753,16 +9356,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
domain_use_interactive_fds(smbd_t)
domain_dontaudit_list_all_domains_state(smbd_t)
-@@ -321,8 +320,6 @@
- miscfiles_read_localization(smbd_t)
- miscfiles_read_public_files(smbd_t)
-
--sysnet_read_config(smbd_t)
--
- userdom_dontaudit_search_sysadm_home_dirs(smbd_t)
- userdom_dontaudit_use_unpriv_user_fds(smbd_t)
- userdom_use_unpriv_users_fds(smbd_t)
-@@ -347,6 +344,17 @@
+@@ -342,6 +344,17 @@
tunable_policy(`samba_share_nfs',`
fs_manage_nfs_dirs(smbd_t)
fs_manage_nfs_files(smbd_t)
@@ -9780,7 +9374,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
')
optional_policy(`
-@@ -398,7 +406,7 @@
+@@ -393,7 +406,7 @@
allow nmbd_t self:msgq create_msgq_perms;
allow nmbd_t self:sem create_sem_perms;
allow nmbd_t self:shm create_shm_perms;
@@ -9789,7 +9383,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
allow nmbd_t self:tcp_socket create_stream_socket_perms;
allow nmbd_t self:udp_socket create_socket_perms;
allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto };
-@@ -410,8 +418,7 @@
+@@ -405,8 +418,7 @@
read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t)
manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t)
@@ -9799,7 +9393,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
read_files_pattern(nmbd_t,samba_log_t,samba_log_t)
create_files_pattern(nmbd_t,samba_log_t,samba_log_t)
-@@ -446,6 +453,7 @@
+@@ -441,6 +453,7 @@
dev_getattr_mtrr_dev(nmbd_t)
fs_getattr_all_fs(nmbd_t)
@@ -9807,34 +9401,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
fs_search_auto_mountpoints(nmbd_t)
domain_use_interactive_fds(nmbd_t)
-@@ -454,6 +462,8 @@
- files_read_etc_files(nmbd_t)
- files_list_var_lib(nmbd_t)
-
-+auth_use_nsswitch(nmbd_t)
-+
- libs_use_ld_so(nmbd_t)
- libs_use_shared_libs(nmbd_t)
-
-@@ -462,17 +472,11 @@
-
- miscfiles_read_localization(nmbd_t)
-
--sysnet_read_config(nmbd_t)
--
- userdom_dontaudit_search_sysadm_home_dirs(nmbd_t)
- userdom_dontaudit_use_unpriv_user_fds(nmbd_t)
- userdom_use_unpriv_users_fds(nmbd_t)
-
- optional_policy(`
-- nis_use_ypbind(nmbd_t)
--')
--
--optional_policy(`
- seutil_sigchld_newrole(nmbd_t)
- ')
-
-@@ -533,6 +537,7 @@
+@@ -524,6 +537,7 @@
storage_raw_write_fixed_disk(smbmount_t)
term_list_ptys(smbmount_t)
@@ -9842,34 +9409,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
corecmd_list_bin(smbmount_t)
-@@ -542,6 +547,8 @@
- files_etc_filetrans_etc_runtime(smbmount_t,file)
- files_read_etc_files(smbmount_t)
+@@ -548,28 +562,37 @@
-+auth_use_nsswitch(smbmount_t)
-+
- miscfiles_read_localization(smbmount_t)
-
- mount_use_fds(smbmount_t)
-@@ -553,16 +560,10 @@
-
- logging_search_logs(smbmount_t)
-
--sysnet_read_config(smbmount_t)
--
userdom_use_all_users_fds(smbmount_t)
- optional_policy(`
-- nis_use_ypbind(smbmount_t)
--')
--
--optional_policy(`
-- nscd_socket_use(smbmount_t)
++optional_policy(`
+ cups_read_rw_config(smbmount_t)
- ')
-
++')
++
########################################
-@@ -570,24 +571,28 @@
+ #
# SWAT Local policy
#
@@ -9881,7 +9430,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
allow swat_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
allow swat_t self:tcp_socket create_stream_socket_perms;
allow swat_t self:udp_socket create_socket_perms;
--allow swat_t self:netlink_route_socket r_netlink_socket_perms;
-allow swat_t nmbd_exec_t:file { execute read };
+allow swat_t self:unix_stream_socket connectto;
@@ -9906,7 +9454,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
allow swat_t smbd_var_run_t:file read;
manage_dirs_pattern(swat_t,swat_tmp_t,swat_tmp_t)
-@@ -597,7 +602,9 @@
+@@ -579,7 +602,9 @@
manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t)
files_pid_filetrans(swat_t,swat_var_run_t,file)
@@ -9917,7 +9465,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
kernel_read_kernel_sysctls(swat_t)
kernel_read_system_state(swat_t)
-@@ -622,23 +629,25 @@
+@@ -604,18 +629,21 @@
dev_read_urand(swat_t)
@@ -9929,7 +9477,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
auth_domtrans_chk_passwd(swat_t)
+auth_domtrans_upd_passwd(swat_t)
-+auth_use_nsswitch(swat_t)
+ auth_use_nsswitch(swat_t)
libs_use_ld_so(swat_t)
libs_use_shared_libs(swat_t)
@@ -9939,25 +9487,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
logging_search_logs(swat_t)
miscfiles_read_localization(swat_t)
-
--sysnet_read_config(swat_t)
--
- optional_policy(`
- cups_read_rw_config(swat_t)
- cups_stream_connect(swat_t)
-@@ -652,13 +661,16 @@
+@@ -633,6 +661,17 @@
kerberos_use(swat_t)
')
--optional_policy(`
-- nis_use_ypbind(swat_t)
--')
+init_read_utmp(swat_t)
+init_dontaudit_write_utmp(swat_t)
-
--optional_policy(`
-- nscd_socket_use(swat_t)
--')
++
+manage_dirs_pattern(swat_t,samba_log_t,samba_log_t)
+create_files_pattern(swat_t,samba_log_t,samba_log_t)
+
@@ -9965,18 +9501,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
+
+manage_files_pattern(swat_t,samba_var_t,samba_var_t)
+files_list_var_lib(swat_t)
-
++
########################################
#
-@@ -672,7 +684,6 @@
- allow winbind_t self:fifo_file { read write };
- allow winbind_t self:unix_dgram_socket create_socket_perms;
- allow winbind_t self:unix_stream_socket create_stream_socket_perms;
--allow winbind_t self:netlink_route_socket r_netlink_socket_perms;
- allow winbind_t self:tcp_socket create_stream_socket_perms;
- allow winbind_t self:udp_socket create_socket_perms;
-
-@@ -709,6 +720,8 @@
+ # Winbind local policy
+@@ -681,6 +720,8 @@
manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t)
files_pid_filetrans(winbind_t,winbind_var_run_t,file)
@@ -9985,27 +9514,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
kernel_read_kernel_sysctls(winbind_t)
kernel_list_proc(winbind_t)
kernel_read_proc_symlinks(winbind_t)
-@@ -733,7 +746,9 @@
- fs_getattr_all_fs(winbind_t)
+@@ -706,6 +747,7 @@
fs_search_auto_mountpoints(winbind_t)
-+auth_use_nsswitch(winbind_t)
auth_domtrans_chk_passwd(winbind_t)
+auth_domtrans_upd_passwd(winbind_t)
+ auth_use_nsswitch(winbind_t)
domain_use_interactive_fds(winbind_t)
-
-@@ -746,9 +761,6 @@
-
- miscfiles_read_localization(winbind_t)
-
--sysnet_read_config(winbind_t)
--sysnet_dns_name_resolve(winbind_t)
--
- userdom_dontaudit_use_unpriv_user_fds(winbind_t)
- userdom_dontaudit_search_sysadm_home_dirs(winbind_t)
- userdom_priveleged_home_dir_manager(winbind_t)
-@@ -758,10 +770,6 @@
+@@ -728,10 +770,6 @@
')
optional_policy(`
@@ -10016,7 +9533,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
seutil_sigchld_newrole(winbind_t)
')
-@@ -790,6 +798,8 @@
+@@ -760,6 +798,8 @@
domain_use_interactive_fds(winbind_helper_t)
@@ -10025,15 +9542,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
libs_use_ld_so(winbind_helper_t)
libs_use_shared_libs(winbind_helper_t)
-@@ -804,6 +814,7 @@
+@@ -768,12 +808,9 @@
+ miscfiles_read_localization(winbind_helper_t)
+
optional_policy(`
+- nscd_socket_use(winbind_helper_t)
+-')
+-
+-optional_policy(`
squid_read_log(winbind_helper_t)
squid_append_log(winbind_helper_t)
+ squid_rw_stream_sockets(winbind_helper_t)
')
########################################
-@@ -828,3 +839,37 @@
+@@ -798,3 +835,37 @@
domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t)
')
')
@@ -10071,9 +9594,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
+allow winbind_t smbcontrol_t:process signal;
+
+allow smbcontrol_t nmbd_var_run_t:file { read lock };
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.2.1/policy/modules/services/sasl.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.2.2/policy/modules/services/sasl.te
--- nsaserefpolicy/policy/modules/services/sasl.te 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/sasl.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/sasl.te 2007-12-04 11:11:03.000000000 -0500
@@ -64,6 +64,7 @@
selinux_compute_access_vector(saslauthd_t)
@@ -10093,9 +9616,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl
seutil_sigchld_newrole(saslauthd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.2.1/policy/modules/services/sendmail.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.2.2/policy/modules/services/sendmail.if
--- nsaserefpolicy/policy/modules/services/sendmail.if 2007-08-27 13:57:20.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/sendmail.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/sendmail.if 2007-12-04 11:11:03.000000000 -0500
@@ -149,3 +149,85 @@
logging_log_filetrans($1,sendmail_log_t,file)
@@ -10182,9 +9705,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
+ role $2 types unconfined_sendmail_t;
+ allow unconfined_sendmail_t $3:chr_file rw_file_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.2.1/policy/modules/services/sendmail.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.2.2/policy/modules/services/sendmail.te
--- nsaserefpolicy/policy/modules/services/sendmail.te 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/sendmail.te 2007-12-01 07:43:47.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/sendmail.te 2007-12-04 11:11:03.000000000 -0500
@@ -20,19 +20,22 @@
mta_mailserver_delivery(sendmail_t)
mta_mailserver_sender(sendmail_t)
@@ -10302,9 +9825,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
-dontaudit sendmail_t admin_tty_type:chr_file { getattr ioctl };
-') dnl end TODO
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.2.1/policy/modules/services/setroubleshoot.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.2.2/policy/modules/services/setroubleshoot.te
--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-10-29 07:52:49.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/setroubleshoot.te 2007-12-02 19:04:59.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/setroubleshoot.te 2007-12-04 11:11:03.000000000 -0500
@@ -27,8 +27,8 @@
# setroubleshootd local policy
#
@@ -10343,9 +9866,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.2.1/policy/modules/services/snmp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.2.2/policy/modules/services/snmp.te
--- nsaserefpolicy/policy/modules/services/snmp.te 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/snmp.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/snmp.te 2007-12-04 11:11:03.000000000 -0500
@@ -81,8 +81,7 @@
files_read_usr_files(snmpd_t)
files_read_etc_runtime_files(snmpd_t)
@@ -10356,9 +9879,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp
fs_getattr_all_dirs(snmpd_t)
fs_getattr_all_fs(snmpd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.fc serefpolicy-3.2.1/policy/modules/services/soundserver.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.fc serefpolicy-3.2.2/policy/modules/services/soundserver.fc
--- nsaserefpolicy/policy/modules/services/soundserver.fc 2006-11-16 17:15:20.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/services/soundserver.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/soundserver.fc 2007-12-04 11:11:03.000000000 -0500
@@ -1,5 +1,3 @@
-/etc/nas(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0)
-/etc/yiff(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0)
@@ -10372,9 +9895,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun
+/var/run/nasd(/.*)? gen_context(system_u:object_r:soundd_var_run_t,s0)
+
/var/state/yiff(/.*)? gen_context(system_u:object_r:soundd_state_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.te serefpolicy-3.2.1/policy/modules/services/soundserver.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.te serefpolicy-3.2.2/policy/modules/services/soundserver.te
--- nsaserefpolicy/policy/modules/services/soundserver.te 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/soundserver.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/soundserver.te 2007-12-04 11:11:03.000000000 -0500
@@ -10,9 +10,6 @@
type soundd_exec_t;
init_daemon_domain(soundd_t,soundd_exec_t)
@@ -10435,18 +9958,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun
seutil_sigchld_newrole(soundd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.2.1/policy/modules/services/spamassassin.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.2.2/policy/modules/services/spamassassin.fc
--- nsaserefpolicy/policy/modules/services/spamassassin.fc 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/spamassassin.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/spamassassin.fc 2007-12-04 11:11:03.000000000 -0500
@@ -1,4 +1,4 @@
-HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:ROLE_spamassassin_home_t,s0)
+HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:user_spamassassin_home_t,s0)
/usr/bin/sa-learn -- gen_context(system_u:object_r:spamc_exec_t,s0)
/usr/bin/spamassassin -- gen_context(system_u:object_r:spamassassin_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.2.1/policy/modules/services/spamassassin.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.2.2/policy/modules/services/spamassassin.if
--- nsaserefpolicy/policy/modules/services/spamassassin.if 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/spamassassin.if 2007-12-01 07:44:50.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/spamassassin.if 2007-12-04 11:11:03.000000000 -0500
@@ -38,6 +38,8 @@
gen_require(`
type spamc_exec_t, spamassassin_exec_t;
@@ -10572,9 +10095,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
+
+ stream_connect_pattern($1,spamd_var_run_t,spamd_var_run_t,spamd_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.2.1/policy/modules/services/spamassassin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.2.2/policy/modules/services/spamassassin.te
--- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/spamassassin.te 2007-12-01 07:44:33.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/spamassassin.te 2007-12-04 11:11:03.000000000 -0500
@@ -44,6 +44,15 @@
type spamassassin_exec_t;
application_executable_file(spamassassin_exec_t)
@@ -10617,18 +10140,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
fs_manage_cifs_files(spamd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.2.1/policy/modules/services/squid.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.2.2/policy/modules/services/squid.fc
--- nsaserefpolicy/policy/modules/services/squid.fc 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/services/squid.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/squid.fc 2007-12-04 11:11:03.000000000 -0500
@@ -12,3 +12,5 @@
/var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0)
/var/spool/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0)
+/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
+/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-3.2.1/policy/modules/services/squid.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-3.2.2/policy/modules/services/squid.if
--- nsaserefpolicy/policy/modules/services/squid.if 2007-05-07 10:32:44.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/squid.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/squid.if 2007-12-04 11:11:03.000000000 -0500
@@ -131,3 +131,22 @@
interface(`squid_use',`
refpolicywarn(`$0($*) has been deprecated.')
@@ -10652,9 +10175,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
+
+ allow $1 squid_t:unix_stream_socket { getattr read write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.2.1/policy/modules/services/squid.te
---- nsaserefpolicy/policy/modules/services/squid.te 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/squid.te 2007-11-30 11:23:56.000000000 -0500
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.2.2/policy/modules/services/squid.te
+--- nsaserefpolicy/policy/modules/services/squid.te 2007-12-04 11:02:50.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/squid.te 2007-12-04 11:51:47.000000000 -0500
@@ -36,7 +36,7 @@
# Local policy
#
@@ -10681,7 +10204,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
selinux_dontaudit_getattr_dir(squid_t)
-@@ -149,11 +152,7 @@
+@@ -148,11 +151,7 @@
')
optional_policy(`
@@ -10694,7 +10217,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
')
optional_policy(`
-@@ -176,7 +175,12 @@
+@@ -167,7 +166,12 @@
udev_read_db(squid_t)
')
@@ -10711,18 +10234,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
+ corenet_all_recvfrom_unlabeled(httpd_squid_script_t)
+ corenet_all_recvfrom_netlabel(httpd_squid_script_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.fc serefpolicy-3.2.1/policy/modules/services/ssh.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.fc serefpolicy-3.2.2/policy/modules/services/ssh.fc
--- nsaserefpolicy/policy/modules/services/ssh.fc 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/ssh.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/ssh.fc 2007-12-04 11:11:03.000000000 -0500
@@ -1,4 +1,4 @@
-HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ROLE_home_ssh_t,s0)
+HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:user_ssh_home_t,s0)
/etc/ssh/primes -- gen_context(system_u:object_r:sshd_key_t,s0)
/etc/ssh/ssh_host_key -- gen_context(system_u:object_r:sshd_key_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.2.1/policy/modules/services/ssh.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.2.2/policy/modules/services/ssh.if
--- nsaserefpolicy/policy/modules/services/ssh.if 2007-07-23 10:20:13.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/ssh.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/ssh.if 2007-12-04 11:11:03.000000000 -0500
@@ -36,6 +36,7 @@
gen_require(`
attribute ssh_server;
@@ -10882,9 +10405,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
dontaudit $1 sshd_key_t:file { getattr read };
')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.2.1/policy/modules/services/ssh.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.2.2/policy/modules/services/ssh.te
--- nsaserefpolicy/policy/modules/services/ssh.te 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/ssh.te 2007-11-30 11:38:23.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/ssh.te 2007-12-04 11:11:03.000000000 -0500
@@ -24,7 +24,7 @@
# Type for the ssh-agent executable.
@@ -10941,43 +10464,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
unconfined_shell_domtrans(sshd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stunnel.te serefpolicy-3.2.1/policy/modules/services/stunnel.te
---- nsaserefpolicy/policy/modules/services/stunnel.te 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/stunnel.te 2007-11-30 11:23:56.000000000 -0500
-@@ -68,6 +68,8 @@
-
- fs_getattr_all_fs(stunnel_t)
-
-+auth_use_nsswitch(stunnel_t)
-+
- libs_use_ld_so(stunnel_t)
- libs_use_shared_libs(stunnel_t)
-
-@@ -112,14 +114,6 @@
- optional_policy(`
- kerberos_use(stunnel_t)
- ')
--
-- optional_policy(`
-- nis_use_ypbind(stunnel_t)
-- ')
--
-- optional_policy(`
-- nscd_socket_use(stunnel_t)
-- ')
- ')
-
- # hack since this port has no interfaces since it doesnt
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/telnet.te serefpolicy-3.2.1/policy/modules/services/telnet.te
---- nsaserefpolicy/policy/modules/services/telnet.te 2007-07-16 14:09:46.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/telnet.te 2007-11-30 11:23:56.000000000 -0500
-@@ -32,12 +32,13 @@
- allow telnetd_t self:udp_socket create_socket_perms;
- # for identd; cjp: this should probably only be inetd_child rules?
- allow telnetd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
--allow telnetd_t self:netlink_route_socket r_netlink_socket_perms;
- allow telnetd_t self:capability { setuid setgid };
-
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/telnet.te serefpolicy-3.2.2/policy/modules/services/telnet.te
+--- nsaserefpolicy/policy/modules/services/telnet.te 2007-12-04 11:02:50.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/telnet.te 2007-12-04 11:44:45.000000000 -0500
+@@ -37,6 +37,8 @@
allow telnetd_t telnetd_devpts_t:chr_file { rw_chr_file_perms setattr };
term_create_pty(telnetd_t,telnetd_devpts_t)
@@ -10986,12 +10476,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/teln
manage_dirs_pattern(telnetd_t,telnetd_tmp_t,telnetd_tmp_t)
manage_files_pattern(telnetd_t,telnetd_tmp_t,telnetd_tmp_t)
files_tmp_filetrans(telnetd_t, telnetd_tmp_t, { file dir })
-@@ -62,10 +63,12 @@
-
- fs_getattr_xattr_fs(telnetd_t)
-
-+auth_use_nsswitch(telnetd_t)
- auth_rw_login_records(telnetd_t)
+@@ -66,6 +68,7 @@
corecmd_search_bin(telnetd_t)
@@ -10999,13 +10484,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/teln
files_read_etc_files(telnetd_t)
files_read_etc_runtime_files(telnetd_t)
# for identd; cjp: this should probably only be inetd_child rules?
-@@ -80,27 +83,26 @@
+@@ -80,17 +83,26 @@
miscfiles_read_localization(telnetd_t)
-seutil_dontaudit_search_config(telnetd_t)
--
--sysnet_read_config(telnetd_t)
+seutil_read_config(telnetd_t)
remotelogin_domtrans(telnetd_t)
@@ -11019,68 +10502,30 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/teln
+ kerberos_manage_host_rcache(telnetd_t)
')
--optional_policy(`
-- nis_use_ypbind(telnetd_t)
+-ifdef(`TODO',`
+-# Allow krb5 telnetd to use fork and open /dev/tty for use
+-allow telnetd_t userpty_type:chr_file setattr;
+tunable_policy(`use_nfs_home_dirs',`
+ fs_manage_nfs_dirs(telnetd_t)
+ fs_manage_nfs_files(telnetd_t)
')
-
--optional_policy(`
-- nscd_socket_use(telnetd_t)
++
+tunable_policy(`use_samba_home_dirs',`
+ fs_manage_cifs_dirs(telnetd_t)
+ fs_manage_cifs_files(telnetd_t)
- ')
-
--ifdef(`TODO',`
--# Allow krb5 telnetd to use fork and open /dev/tty for use
--allow telnetd_t userpty_type:chr_file setattr;
--')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.fc serefpolicy-3.2.1/policy/modules/services/tftp.fc
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.fc serefpolicy-3.2.2/policy/modules/services/tftp.fc
--- nsaserefpolicy/policy/modules/services/tftp.fc 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/services/tftp.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/tftp.fc 2007-12-04 11:11:03.000000000 -0500
@@ -4,3 +4,4 @@
/tftpboot -d gen_context(system_u:object_r:tftpdir_t,s0)
/tftpboot/.* gen_context(system_u:object_r:tftpdir_t,s0)
+/var/lib/tftp(/.*)? gen_context(system_u:object_r:tftpdir_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp.te serefpolicy-3.2.1/policy/modules/services/uucp.te
---- nsaserefpolicy/policy/modules/services/uucp.te 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/uucp.te 2007-11-30 11:23:56.000000000 -0500
-@@ -88,6 +88,8 @@
- files_search_home(uucpd_t)
- files_search_spool(uucpd_t)
-
-+auth_use_nsswitch(uucpd_t)
-+
- libs_use_ld_so(uucpd_t)
- libs_use_shared_libs(uucpd_t)
-
-@@ -95,20 +97,10 @@
-
- miscfiles_read_localization(uucpd_t)
-
--sysnet_read_config(uucpd_t)
--
- optional_policy(`
- kerberos_use(uucpd_t)
- ')
-
--optional_policy(`
-- nis_use_ypbind(uucpd_t)
--')
--
--optional_policy(`
-- nscd_socket_use(uucpd_t)
--')
--
- ########################################
- #
- # UUX Local policy
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.2.1/policy/modules/services/uwimap.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.2.2/policy/modules/services/uwimap.te
--- nsaserefpolicy/policy/modules/services/uwimap.te 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/uwimap.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/uwimap.te 2007-12-04 11:11:03.000000000 -0500
@@ -64,6 +64,7 @@
fs_search_auto_mountpoints(imapd_t)
@@ -11089,20 +10534,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwim
libs_use_ld_so(imapd_t)
libs_use_shared_libs(imapd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.2.1/policy/modules/services/w3c.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.2.2/policy/modules/services/w3c.fc
--- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/services/w3c.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/w3c.fc 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1,2 @@
+/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0)
+/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.2.1/policy/modules/services/w3c.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.2.2/policy/modules/services/w3c.if
--- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/services/w3c.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/w3c.if 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1 @@
+## W3C
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.2.1/policy/modules/services/w3c.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.2.2/policy/modules/services/w3c.te
--- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/services/w3c.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/w3c.te 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1,14 @@
+policy_module(w3c,1.2.1)
+
@@ -11118,9 +10563,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.
+corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t)
+
+miscfiles_read_certs(httpd_w3c_validator_script_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.2.1/policy/modules/services/xserver.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.2.2/policy/modules/services/xserver.fc
--- nsaserefpolicy/policy/modules/services/xserver.fc 2007-10-15 16:11:05.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/xserver.fc 2007-11-30 11:27:15.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/xserver.fc 2007-12-04 11:11:03.000000000 -0500
@@ -1,13 +1,13 @@
#
# HOME_DIR
@@ -11187,18 +10632,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
ifdef(`distro_suse',`
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.2.1/policy/modules/services/xserver.if
---- nsaserefpolicy/policy/modules/services/xserver.if 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/xserver.if 2007-11-30 11:23:56.000000000 -0500
-@@ -58,7 +58,6 @@
- allow $1_xserver_t self:msg { send receive };
- allow $1_xserver_t self:unix_dgram_socket { create_socket_perms sendto };
- allow $1_xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
-- allow $1_xserver_t self:netlink_route_socket r_netlink_socket_perms;
- allow $1_xserver_t self:tcp_socket create_stream_socket_perms;
- allow $1_xserver_t self:udp_socket create_socket_perms;
-
-@@ -116,8 +115,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.2.2/policy/modules/services/xserver.if
+--- nsaserefpolicy/policy/modules/services/xserver.if 2007-12-04 11:02:50.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/xserver.if 2007-12-04 12:04:16.000000000 -0500
+@@ -115,8 +115,7 @@
dev_rw_agp($1_xserver_t)
dev_rw_framebuffer($1_xserver_t)
dev_manage_dri_dev($1_xserver_t)
@@ -11208,7 +10645,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
# raw memory access is needed if not using the frame buffer
dev_read_raw_memory($1_xserver_t)
dev_wx_raw_memory($1_xserver_t)
-@@ -126,8 +124,12 @@
+@@ -125,8 +124,12 @@
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev($1_xserver_t)
dev_rwx_zero($1_xserver_t)
@@ -11221,15 +10658,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
files_read_etc_files($1_xserver_t)
files_read_etc_runtime_files($1_xserver_t)
-@@ -141,10 +143,16 @@
+@@ -140,12 +143,16 @@
fs_getattr_xattr_fs($1_xserver_t)
fs_search_nfs($1_xserver_t)
fs_search_auto_mountpoints($1_xserver_t)
- fs_search_ramfs($1_xserver_t)
+ fs_manage_ramfs_files($1_xserver_t)
+ fs_list_inotifyfs($1_xserver_t)
-+
-+ auth_use_nsswitch($1_xserver_t)
+
+ auth_use_nsswitch($1_xserver_t)
init_getpgid($1_xserver_t)
@@ -11239,31 +10676,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
term_setattr_unallocated_ttys($1_xserver_t)
term_use_unallocated_ttys($1_xserver_t)
-@@ -160,8 +168,6 @@
-
- seutil_dontaudit_search_config($1_xserver_t)
-
-- sysnet_read_config($1_xserver_t)
--
- ifndef(`distro_redhat',`
- allow $1_xserver_t self:process { execmem execheap execstack };
- ')
-@@ -179,14 +185,6 @@
- ')
-
- optional_policy(`
-- nis_use_ypbind($1_xserver_t)
-- ')
--
-- optional_policy(`
-- nscd_socket_use($1_xserver_t)
-- ')
--
-- optional_policy(`
- rhgb_getpgid($1_xserver_t)
- rhgb_signal($1_xserver_t)
- ')
-@@ -241,39 +239,26 @@
+@@ -232,39 +239,26 @@
# Declarations
#
@@ -11310,7 +10723,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
##############################
#
# $1_xserver_t Local policy
-@@ -281,12 +266,15 @@
+@@ -272,12 +266,15 @@
domtrans_pattern($1_xserver_t, xauth_exec_t, $1_xauth_t)
@@ -11327,7 +10740,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
manage_dirs_pattern($2,$1_fonts_t,$1_fonts_t)
manage_files_pattern($2,$1_fonts_t,$1_fonts_t)
-@@ -316,6 +304,7 @@
+@@ -307,6 +304,7 @@
userdom_use_user_ttys($1,$1_xserver_t)
userdom_setattr_user_ttys($1,$1_xserver_t)
userdom_rw_user_tmpfs_files($1,$1_xserver_t)
@@ -11335,7 +10748,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
xserver_use_user_fonts($1,$1_xserver_t)
xserver_rw_xdm_tmp_files($1_xauth_t)
-@@ -339,12 +328,12 @@
+@@ -330,12 +328,12 @@
allow $1_xauth_t self:process signal;
allow $1_xauth_t self:unix_stream_socket create_stream_socket_perms;
@@ -11353,7 +10766,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
domtrans_pattern($2, xauth_exec_t, $1_xauth_t)
-@@ -353,12 +342,6 @@
+@@ -344,12 +342,6 @@
# allow ps to show xauth
ps_process_pattern($2,$1_xauth_t)
@@ -11366,7 +10779,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
domain_use_interactive_fds($1_xauth_t)
files_read_etc_files($1_xauth_t)
-@@ -387,6 +370,14 @@
+@@ -378,6 +370,14 @@
')
optional_policy(`
@@ -11378,10 +10791,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
+ ')
+
+ optional_policy(`
- nis_use_ypbind($1_xauth_t)
- ')
-
-@@ -403,16 +394,16 @@
+ ssh_sigchld($1_xauth_t)
+ ssh_read_pipes($1_xauth_t)
+ ssh_dontaudit_rw_tcp_sockets($1_xauth_t)
+@@ -390,16 +390,16 @@
domtrans_pattern($2, iceauth_exec_t, $1_iceauth_t)
@@ -11403,7 +10816,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
fs_search_auto_mountpoints($1_iceauth_t)
-@@ -536,17 +527,15 @@
+@@ -523,17 +523,15 @@
template(`xserver_user_client_template',`
gen_require(`
@@ -11427,7 +10840,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
# for when /tmp/.X11-unix is created by the system
allow $2 xdm_t:fd use;
-@@ -555,25 +544,51 @@
+@@ -542,25 +540,51 @@
allow $2 xdm_tmp_t:sock_file { read write };
dontaudit $2 xdm_t:tcp_socket { read write };
@@ -11487,7 +10900,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
')
')
-@@ -626,6 +641,24 @@
+@@ -613,6 +637,24 @@
########################################
##
@@ -11512,7 +10925,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
## Transition to a user Xauthority domain.
##
##
-@@ -659,6 +692,73 @@
+@@ -646,6 +688,73 @@
########################################
##
@@ -11586,7 +10999,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
## Transition to a user Xauthority domain.
##
##
-@@ -684,10 +784,10 @@
+@@ -671,10 +780,10 @@
#
template(`xserver_user_home_dir_filetrans_user_xauth',`
gen_require(`
@@ -11599,7 +11012,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
')
########################################
-@@ -873,6 +973,25 @@
+@@ -760,7 +869,7 @@
+ type xconsole_device_t;
+ ')
+
+- allow $1 xconsole_device_t:fifo_file rw_fifo_file_perms;
++ allow $1 xconsole_device_t:fifo_file { getattr read write };
+ ')
+
+ ########################################
+@@ -860,6 +969,25 @@
########################################
##
@@ -11625,7 +11047,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
## Read xdm-writable configuration files.
##
##
-@@ -927,6 +1046,7 @@
+@@ -914,6 +1042,7 @@
files_search_tmp($1)
allow $1 xdm_tmp_t:dir list_dir_perms;
create_sock_files_pattern($1,xdm_tmp_t,xdm_tmp_t)
@@ -11633,7 +11055,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
')
########################################
-@@ -987,6 +1107,37 @@
+@@ -974,6 +1103,37 @@
########################################
##
@@ -11671,7 +11093,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
## Make an X session script an entrypoint for the specified domain.
##
##
-@@ -1136,7 +1287,7 @@
+@@ -1123,7 +1283,7 @@
type xdm_xserver_tmp_t;
')
@@ -11680,7 +11102,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
')
########################################
-@@ -1325,3 +1476,45 @@
+@@ -1312,3 +1472,45 @@
files_search_tmp($1)
stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t)
')
@@ -11726,9 +11148,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
+
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.2.1/policy/modules/services/xserver.te
---- nsaserefpolicy/policy/modules/services/xserver.te 2007-10-15 16:11:05.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/services/xserver.te 2007-12-03 19:02:05.000000000 -0500
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.2.2/policy/modules/services/xserver.te
+--- nsaserefpolicy/policy/modules/services/xserver.te 2007-12-04 11:02:50.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/services/xserver.te 2007-12-04 11:11:03.000000000 -0500
@@ -16,6 +16,13 @@
##
@@ -12059,9 +11481,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
-#
-allow pam_t xdm_t:fifo_file { getattr ioctl write };
-') dnl end TODO
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.2.1/policy/modules/system/authlogin.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.2.2/policy/modules/system/authlogin.fc
--- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-10-29 18:02:31.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/authlogin.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/authlogin.fc 2007-12-04 11:11:03.000000000 -0500
@@ -41,3 +41,6 @@
/var/run/console(/.*)? gen_context(system_u:object_r:pam_var_console_t,s0)
@@ -12069,9 +11491,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+/var/lib/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
+
+/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.2.1/policy/modules/system/authlogin.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.2.2/policy/modules/system/authlogin.if
--- nsaserefpolicy/policy/modules/system/authlogin.if 2007-11-29 13:29:35.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/authlogin.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/authlogin.if 2007-12-04 11:11:03.000000000 -0500
@@ -169,6 +169,7 @@
interface(`auth_login_pgm_domain',`
gen_require(`
@@ -12250,9 +11672,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+ read_files_pattern($1, auth_cache_t, auth_cache_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.2.1/policy/modules/system/authlogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.2.2/policy/modules/system/authlogin.te
--- nsaserefpolicy/policy/modules/system/authlogin.te 2007-10-29 18:02:31.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/authlogin.te 2007-12-03 18:47:11.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/authlogin.te 2007-12-04 11:11:03.000000000 -0500
@@ -59,6 +59,9 @@
type utempter_exec_t;
application_domain(utempter_t,utempter_exec_t)
@@ -12320,9 +11742,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
xserver_use_xdm_fds(utempter_t)
xserver_rw_xdm_pipes(utempter_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.2.1/policy/modules/system/fstools.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.2.2/policy/modules/system/fstools.fc
--- nsaserefpolicy/policy/modules/system/fstools.fc 2007-09-26 12:15:01.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/fstools.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/fstools.fc 2007-12-04 11:11:03.000000000 -0500
@@ -1,4 +1,3 @@
-/sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -12336,9 +11758,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.2.1/policy/modules/system/fstools.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.2.2/policy/modules/system/fstools.if
--- nsaserefpolicy/policy/modules/system/fstools.if 2007-08-22 17:33:53.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/fstools.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/fstools.if 2007-12-04 11:11:03.000000000 -0500
@@ -142,3 +142,20 @@
allow $1 swapfile_t:file getattr;
@@ -12360,9 +11782,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
+ ')
+ fs_manage_nfs_files(fsadm_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.2.1/policy/modules/system/fstools.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.2.2/policy/modules/system/fstools.te
--- nsaserefpolicy/policy/modules/system/fstools.te 2007-10-12 08:56:08.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/fstools.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/fstools.te 2007-12-04 11:11:03.000000000 -0500
@@ -109,8 +109,7 @@
term_use_console(fsadm_t)
@@ -12379,9 +11801,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
xen_append_log(fsadm_t)
+ xen_rw_image_files(fsadm_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.2.1/policy/modules/system/getty.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.2.2/policy/modules/system/getty.te
--- nsaserefpolicy/policy/modules/system/getty.te 2007-10-12 08:56:08.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/getty.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/getty.te 2007-12-04 11:11:03.000000000 -0500
@@ -33,7 +33,8 @@
#
@@ -12392,9 +11814,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.
dontaudit getty_t self:capability sys_tty_config;
allow getty_t self:process { getpgid setpgid getsession signal_perms };
allow getty_t self:fifo_file rw_fifo_file_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.2.1/policy/modules/system/hostname.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.2.2/policy/modules/system/hostname.te
--- nsaserefpolicy/policy/modules/system/hostname.te 2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/hostname.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/hostname.te 2007-12-04 11:11:03.000000000 -0500
@@ -8,7 +8,9 @@
type hostname_t;
@@ -12418,9 +11840,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna
+optional_policy(`
+ unconfined_dontaudit_rw_pipes(hostname_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplug.te serefpolicy-3.2.1/policy/modules/system/hotplug.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplug.te serefpolicy-3.2.2/policy/modules/system/hotplug.te
--- nsaserefpolicy/policy/modules/system/hotplug.te 2007-10-12 08:56:08.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/hotplug.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/hotplug.te 2007-12-04 11:11:03.000000000 -0500
@@ -179,6 +179,7 @@
sysnet_read_dhcpc_pid(hotplug_t)
sysnet_rw_dhcp_config(hotplug_t)
@@ -12429,9 +11851,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplu
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.2.1/policy/modules/system/init.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.2.2/policy/modules/system/init.if
--- nsaserefpolicy/policy/modules/system/init.if 2007-10-29 18:02:31.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/init.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/init.if 2007-12-04 11:11:03.000000000 -0500
@@ -211,6 +211,13 @@
kernel_dontaudit_use_fds($1)
')
@@ -12673,9 +12095,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
+ domain_entry_file(initrc_t,$1)
+
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.2.1/policy/modules/system/init.te
---- nsaserefpolicy/policy/modules/system/init.te 2007-10-29 07:52:50.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/init.te 2007-11-30 15:05:52.000000000 -0500
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.2.2/policy/modules/system/init.te
+--- nsaserefpolicy/policy/modules/system/init.te 2007-12-04 11:02:50.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/init.te 2007-12-04 11:46:20.000000000 -0500
@@ -10,6 +10,20 @@
# Declarations
#
@@ -12753,12 +12175,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
dontaudit initrc_t self:capability sys_module; # sysctl is triggering this
allow initrc_t self:passwd rootok;
-@@ -196,15 +212,13 @@
- allow initrc_t self:tcp_socket create_stream_socket_perms;
- allow initrc_t self:udp_socket create_socket_perms;
- allow initrc_t self:fifo_file rw_file_perms;
--allow initrc_t self:netlink_route_socket r_netlink_socket_perms;
-
+@@ -200,10 +216,9 @@
allow initrc_t initrc_devpts_t:chr_file rw_term_perms;
term_create_pty(initrc_t,initrc_devpts_t)
@@ -12771,7 +12188,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
manage_dirs_pattern(initrc_t,initrc_state_t,initrc_state_t)
manage_files_pattern(initrc_t,initrc_state_t,initrc_state_t)
-@@ -283,7 +297,6 @@
+@@ -282,7 +297,6 @@
mls_process_read_up(initrc_t)
mls_process_write_down(initrc_t)
mls_rangetrans_source(initrc_t)
@@ -12779,16 +12196,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
selinux_get_enforce_mode(initrc_t)
-@@ -365,7 +378,7 @@
-
- seutil_read_config(initrc_t)
-
--sysnet_read_config(initrc_t)
-+auth_use_nsswitch(initrc_t)
-
- userdom_read_all_users_home_content_files(initrc_t)
- # Allow access to the sysadm TTYs. Note that this will give access to the
-@@ -496,6 +509,31 @@
+@@ -495,6 +509,31 @@
')
')
@@ -12820,7 +12228,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
optional_policy(`
amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t)
-@@ -631,12 +669,6 @@
+@@ -630,12 +669,6 @@
mta_read_config(initrc_t)
mta_dontaudit_read_spool_symlinks(initrc_t)
')
@@ -12833,23 +12241,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
optional_policy(`
ifdef(`distro_redhat',`
-@@ -648,15 +680,10 @@
- ')
-
- optional_policy(`
-- nis_use_ypbind(initrc_t)
- nis_list_var_yp(initrc_t)
- ')
-
- optional_policy(`
-- nscd_socket_use(initrc_t)
--')
--
--optional_policy(`
- openvpn_read_config(initrc_t)
- ')
-
-@@ -702,6 +729,9 @@
+@@ -696,6 +729,9 @@
# why is this needed:
rpm_manage_db(initrc_t)
@@ -12859,7 +12251,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
')
optional_policy(`
-@@ -749,6 +779,10 @@
+@@ -743,6 +779,10 @@
')
optional_policy(`
@@ -12870,9 +12262,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
vmware_read_system_config(initrc_t)
vmware_append_system_config(initrc_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.2.1/policy/modules/system/libraries.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.2.2/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2007-10-12 08:56:08.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/libraries.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/libraries.fc 2007-12-04 11:11:03.000000000 -0500
@@ -65,11 +65,15 @@
/opt/(.*/)?java/.+\.jar -- gen_context(system_u:object_r:lib_t,s0)
/opt/(.*/)?jre.*/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -12949,9 +12341,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
+/usr/lib/firefox-[^/]*/plugins/nppdf.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/opt/Adobe/Reader8/Reader/intellinux/plug_ins/.*\.api -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.2.1/policy/modules/system/libraries.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.2.2/policy/modules/system/libraries.te
--- nsaserefpolicy/policy/modules/system/libraries.te 2007-10-12 08:56:08.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/libraries.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/libraries.te 2007-12-04 11:11:03.000000000 -0500
@@ -23,6 +23,9 @@
init_system_domain(ldconfig_t,ldconfig_exec_t)
role system_r types ldconfig_t;
@@ -13004,9 +12396,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
+ # smart package manager needs the following for the same reason
+ rpm_rw_tmp_files(ldconfig_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.2.1/policy/modules/system/locallogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.2.2/policy/modules/system/locallogin.te
--- nsaserefpolicy/policy/modules/system/locallogin.te 2007-10-29 07:52:50.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/locallogin.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/locallogin.te 2007-12-04 11:11:03.000000000 -0500
@@ -25,7 +25,6 @@
domain_role_change_exemption(sulogin_t)
domain_interactive_fd(sulogin_t)
@@ -13044,9 +12436,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.2.1/policy/modules/system/logging.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.2.2/policy/modules/system/logging.fc
--- nsaserefpolicy/policy/modules/system/logging.fc 2007-11-06 09:18:37.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/logging.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/logging.fc 2007-12-04 11:11:03.000000000 -0500
@@ -29,6 +29,11 @@
/var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
@@ -13075,9 +12467,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+
+/etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_script_exec_t,s0)
+/etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.2.1/policy/modules/system/logging.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.2.2/policy/modules/system/logging.if
--- nsaserefpolicy/policy/modules/system/logging.if 2007-11-06 09:51:43.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/logging.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/logging.if 2007-12-04 11:11:03.000000000 -0500
@@ -577,6 +577,8 @@
files_search_var($1)
manage_files_pattern($1,logfile,logfile)
@@ -13174,9 +12566,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+ init_script_domtrans_spec($1,auditd_script_exec_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.2.1/policy/modules/system/logging.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.2.2/policy/modules/system/logging.te
--- nsaserefpolicy/policy/modules/system/logging.te 2007-11-06 09:18:37.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/logging.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/logging.te 2007-12-04 11:11:03.000000000 -0500
@@ -61,6 +61,12 @@
logging_log_file(var_log_t)
files_mountpoint(var_log_t)
@@ -13198,9 +12590,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
domain_use_interactive_fds(klogd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.2.1/policy/modules/system/lvm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.2.2/policy/modules/system/lvm.fc
--- nsaserefpolicy/policy/modules/system/lvm.fc 2007-10-12 08:56:08.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/lvm.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/lvm.fc 2007-12-04 11:11:03.000000000 -0500
@@ -15,6 +15,7 @@
#
/etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0)
@@ -13209,9 +12601,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc
/etc/lvm/archive(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0)
/etc/lvm/backup(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0)
/etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.2.1/policy/modules/system/lvm.te
---- nsaserefpolicy/policy/modules/system/lvm.te 2007-10-12 08:56:08.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/lvm.te 2007-11-30 11:23:56.000000000 -0500
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.2.2/policy/modules/system/lvm.te
+--- nsaserefpolicy/policy/modules/system/lvm.te 2007-12-04 11:02:50.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/lvm.te 2007-12-04 11:46:49.000000000 -0500
@@ -44,9 +44,9 @@
# Cluster LVM daemon local policy
#
@@ -13224,7 +12616,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
dontaudit clvmd_t self:process ptrace;
allow clvmd_t self:socket create_socket_perms;
allow clvmd_t self:fifo_file rw_fifo_file_perms;
-@@ -54,11 +54,15 @@
+@@ -54,6 +54,8 @@
allow clvmd_t self:tcp_socket create_stream_socket_perms;
allow clvmd_t self:udp_socket create_socket_perms;
@@ -13233,14 +12625,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
manage_files_pattern(clvmd_t,clvmd_var_run_t,clvmd_var_run_t)
files_pid_filetrans(clvmd_t,clvmd_var_run_t,file)
- read_files_pattern(clvmd_t,lvm_metadata_t,lvm_metadata_t)
-
-+auth_use_nsswitch(clvmd_t)
-+
- kernel_read_kernel_sysctls(clvmd_t)
- kernel_read_system_state(clvmd_t)
- kernel_list_proc(clvmd_t)
-@@ -85,10 +89,15 @@
+@@ -85,10 +87,15 @@
corenet_sendrecv_generic_server_packets(clvmd_t)
dev_read_sysfs(clvmd_t)
@@ -13256,7 +12641,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
files_read_etc_files(clvmd_t)
files_list_usr(clvmd_t)
-@@ -99,9 +108,12 @@
+@@ -99,9 +106,12 @@
fs_dontaudit_read_removable_files(clvmd_t)
storage_dontaudit_getattr_removable_dev(clvmd_t)
@@ -13268,31 +12653,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
+storage_relabel_fixed_disk(clvmd_t)
storage_raw_read_fixed_disk(clvmd_t)
- libs_use_ld_so(clvmd_t)
-@@ -113,8 +125,9 @@
+ auth_use_nsswitch(clvmd_t)
+@@ -115,6 +125,9 @@
seutil_dontaudit_search_config(clvmd_t)
seutil_sigchld_newrole(clvmd_t)
--
--sysnet_read_config(clvmd_t)
+seutil_read_config(clvmd_t)
+seutil_read_file_contexts(clvmd_t)
+seutil_search_default_contexts(clvmd_t)
userdom_dontaudit_use_unpriv_user_fds(clvmd_t)
userdom_dontaudit_search_sysadm_home_dirs(clvmd_t)
-@@ -131,10 +144,6 @@
- ')
-
- optional_policy(`
-- nis_use_ypbind(clvmd_t)
--')
--
--optional_policy(`
- ricci_dontaudit_rw_modcluster_pipes(clvmd_t)
- ricci_dontaudit_use_modcluster_fds(clvmd_t)
- ')
-@@ -150,7 +159,8 @@
+@@ -146,7 +159,8 @@
# DAC overrides and mknod for modifying /dev entries (vgmknodes)
# rawio needed for dmraid
@@ -13302,7 +12674,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
dontaudit lvm_t self:capability sys_tty_config;
allow lvm_t self:process { sigchld sigkill sigstop signull signal };
# LVM will complain a lot if it cannot set its priority.
-@@ -160,7 +170,8 @@
+@@ -156,7 +170,8 @@
allow lvm_t self:unix_dgram_socket create_socket_perms;
allow lvm_t self:netlink_kobject_uevent_socket create_socket_perms;
@@ -13312,7 +12684,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
manage_dirs_pattern(lvm_t,lvm_tmp_t,lvm_tmp_t)
manage_files_pattern(lvm_t,lvm_tmp_t,lvm_tmp_t)
-@@ -192,6 +203,7 @@
+@@ -188,6 +203,7 @@
manage_files_pattern(lvm_t,lvm_metadata_t,lvm_metadata_t)
filetrans_pattern(lvm_t,lvm_etc_t,lvm_metadata_t,file)
files_etc_filetrans(lvm_t,lvm_metadata_t,file)
@@ -13320,7 +12692,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
kernel_read_system_state(lvm_t)
kernel_read_kernel_sysctls(lvm_t)
-@@ -208,7 +220,6 @@
+@@ -204,7 +220,6 @@
selinux_compute_user_contexts(lvm_t)
dev_create_generic_chr_files(lvm_t)
@@ -13328,7 +12700,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
dev_read_rand(lvm_t)
dev_read_urand(lvm_t)
dev_rw_lvm_control(lvm_t)
-@@ -228,6 +239,8 @@
+@@ -224,6 +239,8 @@
dev_dontaudit_getattr_generic_blk_files(lvm_t)
dev_dontaudit_getattr_generic_pipes(lvm_t)
dev_create_generic_dirs(lvm_t)
@@ -13337,7 +12709,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
fs_getattr_xattr_fs(lvm_t)
fs_search_auto_mountpoints(lvm_t)
-@@ -246,6 +259,7 @@
+@@ -242,6 +259,7 @@
storage_dev_filetrans_fixed_disk(lvm_t)
# Access raw devices and old /dev/lvm (c 109,0). Is this needed?
storage_manage_fixed_disk(lvm_t)
@@ -13345,7 +12717,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
term_getattr_all_user_ttys(lvm_t)
term_list_ptys(lvm_t)
-@@ -254,6 +268,7 @@
+@@ -250,6 +268,7 @@
domain_use_interactive_fds(lvm_t)
@@ -13353,7 +12725,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
files_read_etc_files(lvm_t)
files_read_etc_runtime_files(lvm_t)
# for when /usr is not mounted:
-@@ -275,6 +290,8 @@
+@@ -271,6 +290,8 @@
seutil_search_default_contexts(lvm_t)
seutil_sigchld_newrole(lvm_t)
@@ -13362,7 +12734,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
ifdef(`distro_redhat',`
# this is from the initrd:
files_rw_isid_type_dirs(lvm_t)
-@@ -293,5 +310,14 @@
+@@ -289,5 +310,14 @@
')
optional_policy(`
@@ -13377,9 +12749,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
+ xen_append_log(lvm_t)
+ xen_dontaudit_rw_unix_stream_sockets(lvm_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.if serefpolicy-3.2.1/policy/modules/system/modutils.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.if serefpolicy-3.2.2/policy/modules/system/modutils.if
--- nsaserefpolicy/policy/modules/system/modutils.if 2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/modutils.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/modutils.if 2007-12-04 11:11:03.000000000 -0500
@@ -66,6 +66,25 @@
########################################
@@ -13406,9 +12778,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
## Unconditionally execute insmod in the insmod domain.
##
##
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.2.1/policy/modules/system/modutils.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.2.2/policy/modules/system/modutils.te
--- nsaserefpolicy/policy/modules/system/modutils.te 2007-10-12 08:56:08.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/modutils.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/modutils.te 2007-12-04 11:11:03.000000000 -0500
@@ -42,7 +42,7 @@
# insmod local policy
#
@@ -13511,17 +12883,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.2.1/policy/modules/system/mount.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.2.2/policy/modules/system/mount.fc
--- nsaserefpolicy/policy/modules/system/mount.fc 2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/mount.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/mount.fc 2007-12-04 11:11:03.000000000 -0500
@@ -1,4 +1,2 @@
/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
-
-/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.2.1/policy/modules/system/mount.te
---- nsaserefpolicy/policy/modules/system/mount.te 2007-10-12 08:56:08.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/mount.te 2007-11-30 11:24:14.000000000 -0500
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.2.2/policy/modules/system/mount.te
+--- nsaserefpolicy/policy/modules/system/mount.te 2007-12-04 11:02:50.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/mount.te 2007-12-04 11:47:14.000000000 -0500
@@ -8,7 +8,7 @@
##
@@ -13553,7 +12925,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
########################################
#
-@@ -36,21 +37,24 @@
+@@ -36,20 +37,22 @@
#
# setuid/setgid needed to mount cifs
@@ -13561,18 +12933,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
+allow mount_t self:capability { fsetid ipc_lock sys_rawio sys_resource sys_admin dac_override chown sys_tty_config setuid setgid };
allow mount_t mount_loopback_t:file read_file_perms;
--allow mount_t self:netlink_route_socket r_netlink_socket_perms;
allow mount_t mount_tmp_t:file manage_file_perms;
allow mount_t mount_tmp_t:dir manage_dir_perms;
+files_tmp_filetrans(mount_t,mount_tmp_t,{ file dir })
--can_exec(mount_t, mount_exec_t)
-+auth_use_nsswitch(mount_t)
+ can_exec(mount_t, mount_exec_t)
-files_tmp_filetrans(mount_t,mount_tmp_t,{ file dir })
-+can_exec(mount_t, mount_exec_t)
-
+-
+# In order to mount reiserfs_t
+kernel_list_unlabeled(mount_t)
kernel_read_system_state(mount_t)
@@ -13582,7 +12951,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
dev_getattr_all_blk_files(mount_t)
dev_list_all_dev_nodes(mount_t)
-@@ -63,6 +67,7 @@
+@@ -62,6 +65,7 @@
storage_raw_write_fixed_disk(mount_t)
storage_raw_read_removable_device(mount_t)
storage_raw_write_removable_device(mount_t)
@@ -13590,31 +12959,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
fs_getattr_xattr_fs(mount_t)
fs_getattr_cifs(mount_t)
-@@ -101,6 +106,8 @@
+@@ -100,6 +104,8 @@
init_use_fds(mount_t)
init_use_script_ptys(mount_t)
init_dontaudit_getattr_initctl(mount_t)
+init_stream_connect_script(mount_t)
+init_rw_script_stream_sockets(mount_t)
- libs_use_ld_so(mount_t)
- libs_use_shared_libs(mount_t)
-@@ -159,13 +166,9 @@
+ auth_use_nsswitch(mount_t)
+@@ -161,6 +167,8 @@
fs_search_rpc(mount_t)
-- sysnet_dns_name_resolve(mount_t)
--
rpc_stub(mount_t)
-
-- optional_policy(`
-- nis_use_ypbind(mount_t)
-- ')
++
+ rpc_domtrans_rpcd(mount_t)
')
optional_policy(`
-@@ -189,10 +192,6 @@
+@@ -184,10 +192,6 @@
samba_domtrans_smbmount(mount_t)
')
@@ -13625,7 +12988,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
########################################
#
# Unconfined mount local policy
-@@ -201,4 +200,26 @@
+@@ -196,4 +200,26 @@
optional_policy(`
files_etc_filetrans_etc_runtime(unconfined_mount_t,file)
unconfined_domain(unconfined_mount_t)
@@ -13652,9 +13015,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
+ hal_rw_pipes(mount_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.2.1/policy/modules/system/raid.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.2.2/policy/modules/system/raid.te
--- nsaserefpolicy/policy/modules/system/raid.te 2007-10-12 08:56:08.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/raid.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/raid.te 2007-12-04 11:11:03.000000000 -0500
@@ -19,7 +19,7 @@
# Local policy
#
@@ -13680,9 +13043,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t
+optional_policy(`
+ unconfined_domain(mdadm_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.2.1/policy/modules/system/selinuxutil.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.2.2/policy/modules/system/selinuxutil.fc
--- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/selinuxutil.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/selinuxutil.fc 2007-12-04 11:11:03.000000000 -0500
@@ -38,7 +38,7 @@
/usr/sbin/restorecond -- gen_context(system_u:object_r:restorecond_exec_t,s0)
/usr/sbin/run_init -- gen_context(system_u:object_r:run_init_exec_t,s0)
@@ -13692,9 +13055,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
/usr/sbin/semanage -- gen_context(system_u:object_r:semanage_exec_t,s0)
/usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.2.1/policy/modules/system/selinuxutil.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.2.2/policy/modules/system/selinuxutil.if
--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-11-29 13:29:35.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/selinuxutil.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/selinuxutil.if 2007-12-04 11:11:03.000000000 -0500
@@ -215,8 +215,6 @@
seutil_domtrans_newrole($1)
role $2 types newrole_t;
@@ -13976,9 +13339,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
+ rpm_dontaudit_rw_pipes($1)
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.2.1/policy/modules/system/selinuxutil.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.2.2/policy/modules/system/selinuxutil.te
--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-11-29 13:29:35.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/selinuxutil.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/selinuxutil.te 2007-12-04 11:47:51.000000000 -0500
@@ -75,7 +75,6 @@
type restorecond_exec_t;
init_daemon_domain(restorecond_t,restorecond_exec_t)
@@ -14051,15 +13414,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
logging_send_syslog_msg(newrole_t)
miscfiles_read_localization(newrole_t)
-@@ -299,6 +300,8 @@
- allow restorecond_t restorecond_var_run_t:file manage_file_perms;
- files_pid_filetrans(restorecond_t,restorecond_var_run_t, file)
+@@ -318,6 +319,8 @@
+ auth_read_all_files_except_shadow(restorecond_t)
+ auth_use_nsswitch(restorecond_t)
+auth_use_nsswitch(restorecond_t)
+
- kernel_use_fds(restorecond_t)
- kernel_rw_pipes(restorecond_t)
- kernel_read_system_state(restorecond_t)
+ libs_use_ld_so(restorecond_t)
+ libs_use_shared_libs(restorecond_t)
+
@@ -329,6 +332,8 @@
seutil_libselinux_linked(restorecond_t)
@@ -14267,9 +13630,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
optional_policy(`
hotplug_use_fds(setfiles_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.fc serefpolicy-3.2.1/policy/modules/system/sysnetwork.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.fc serefpolicy-3.2.2/policy/modules/system/sysnetwork.fc
--- nsaserefpolicy/policy/modules/system/sysnetwork.fc 2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/sysnetwork.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/sysnetwork.fc 2007-12-04 11:11:03.000000000 -0500
@@ -52,8 +52,7 @@
/var/lib/dhcpcd(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0)
/var/lib/dhclient(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0)
@@ -14280,9 +13643,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
ifdef(`distro_gentoo',`
/var/lib/dhcpc(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.2.1/policy/modules/system/sysnetwork.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.2.2/policy/modules/system/sysnetwork.if
--- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-16 14:09:49.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/sysnetwork.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/sysnetwork.if 2007-12-04 11:11:03.000000000 -0500
@@ -145,6 +145,25 @@
########################################
@@ -14353,9 +13716,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
+ dontaudit $1 dhcpc_t:fd use;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.2.1/policy/modules/system/sysnetwork.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.2.2/policy/modules/system/sysnetwork.te
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-10-29 07:52:50.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/sysnetwork.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/sysnetwork.te 2007-12-04 11:11:03.000000000 -0500
@@ -45,7 +45,7 @@
dontaudit dhcpc_t self:capability sys_tty_config;
# for access("/etc/bashrc", X_OK) on Red Hat
@@ -14486,10 +13849,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
kernel_read_xen_state(ifconfig_t)
kernel_write_xen_state(ifconfig_t)
xen_append_log(ifconfig_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.2.1/policy/modules/system/udev.te
---- nsaserefpolicy/policy/modules/system/udev.te 2007-11-15 13:40:14.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/udev.te 2007-11-30 11:23:56.000000000 -0500
-@@ -186,6 +186,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.2.2/policy/modules/system/udev.te
+--- nsaserefpolicy/policy/modules/system/udev.te 2007-12-04 11:02:50.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/udev.te 2007-12-04 11:11:03.000000000 -0500
+@@ -96,9 +96,6 @@
+ dev_delete_generic_files(udev_t)
+ dev_search_usbfs(udev_t)
+ dev_relabel_all_dev_nodes(udev_t)
+-# udev_node.c/node_symlink() symlink labels are explicitly
+-# preserved, instead of short circuiting the relabel
+-dev_relabel_generic_symlinks(udev_t)
+
+ domain_read_all_domains_state(udev_t)
+ domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these
+@@ -189,6 +186,7 @@
optional_policy(`
alsa_domtrans(udev_t)
@@ -14497,19 +13870,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
alsa_read_rw_config(udev_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.2.1/policy/modules/system/unconfined.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.2.2/policy/modules/system/unconfined.fc
--- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-10-12 08:56:08.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/unconfined.fc 2007-12-03 13:36:12.000000000 -0500
-@@ -10,3 +10,6 @@
++++ serefpolicy-3.2.2/policy/modules/system/unconfined.fc 2007-12-04 11:30:32.000000000 -0500
+@@ -10,3 +10,7 @@
/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
/usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
+/usr/bin/rhythmbox -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
+/usr/bin/sbcl -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
+/usr/bin/mock -- gen_context(system_u:object_r:unconfined_notrans_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.2.1/policy/modules/system/unconfined.if
++/usr/bin/livecd-creator -- gen_context(system_u:object_r:unconfined_notrans_exec_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.2.2/policy/modules/system/unconfined.if
--- nsaserefpolicy/policy/modules/system/unconfined.if 2007-11-16 15:30:49.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/unconfined.if 2007-12-03 13:19:33.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/unconfined.if 2007-12-04 11:11:03.000000000 -0500
@@ -12,14 +12,13 @@
#
interface(`unconfined_domain_noaudit',`
@@ -14757,9 +14131,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
- allow $1 unconfined_tmp_t:file { getattr write append };
+ allow $1 unconfined_t:process getpgid;
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.2.1/policy/modules/system/unconfined.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.2.2/policy/modules/system/unconfined.te
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-11-16 15:30:49.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/unconfined.te 2007-12-03 13:35:11.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/unconfined.te 2007-12-04 11:11:03.000000000 -0500
@@ -9,32 +9,46 @@
# usage in this module of types created by these
# calls is not correct, however we dont currently
@@ -14986,9 +14360,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
+allow unconfined_notrans_t self:process { execstack execmem };
+unconfined_domain_noaudit(unconfined_notrans_t)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.2.1/policy/modules/system/userdomain.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.2.2/policy/modules/system/userdomain.fc
--- nsaserefpolicy/policy/modules/system/userdomain.fc 2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/userdomain.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/userdomain.fc 2007-12-04 11:11:03.000000000 -0500
@@ -1,4 +1,5 @@
-HOME_DIR -d gen_context(system_u:object_r:ROLE_home_dir_t,s0-mls_systemhigh)
-HOME_DIR/.+ gen_context(system_u:object_r:ROLE_home_t,s0)
@@ -14999,9 +14373,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
+/tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
+/root(/.*) gen_context(system_u:object_r:admin_home_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.2.1/policy/modules/system/userdomain.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.2.2/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-11-29 13:29:35.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/userdomain.if 2007-12-01 08:14:44.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/userdomain.if 2007-12-04 11:57:51.000000000 -0500
@@ -29,8 +29,9 @@
')
@@ -15013,7 +14387,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
domain_type($1_t)
corecmd_shell_entry_type($1_t)
corecmd_bin_entry_type($1_t)
-@@ -45,66 +46,72 @@
+@@ -45,66 +46,70 @@
type $1_tty_device_t;
term_user_tty($1_t,$1_tty_device_t)
@@ -15113,6 +14487,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
- libs_use_ld_so($1_t)
- libs_use_shared_libs($1_t)
- libs_exec_ld_so($1_t)
+-
+- miscfiles_read_localization($1_t)
+- miscfiles_read_certs($1_t)
+ files_dontaudit_list_non_security($1_usertype)
+ files_dontaudit_getattr_non_security_files($1_usertype)
+ files_dontaudit_getattr_non_security_symlinks($1_usertype)
@@ -15128,17 +14505,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ libs_use_shared_libs($1_usertype)
+ libs_exec_ld_so($1_usertype)
-- miscfiles_read_localization($1_t)
-- miscfiles_read_certs($1_t)
+- sysnet_read_config($1_t)
+ miscfiles_read_localization($1_usertype)
+ miscfiles_read_certs($1_usertype)
-- sysnet_read_config($1_t)
-+ sysnet_read_config($1_usertype)
-
tunable_policy(`allow_execmem',`
# Allow loading DSOs that require executable stack.
-@@ -115,6 +122,10 @@
+@@ -115,6 +120,10 @@
# Allow making the stack executable via mprotect.
allow $1_t self:process execstack;
')
@@ -15149,7 +14522,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
#######################################
-@@ -141,33 +152,13 @@
+@@ -141,33 +150,13 @@
#
template(`userdom_ro_home_template',`
gen_require(`
@@ -15188,7 +14561,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
##############################
#
-@@ -175,13 +166,13 @@
+@@ -175,13 +164,13 @@
#
# read-only home directory
@@ -15209,7 +14582,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
files_list_home($1_t)
tunable_policy(`use_nfs_home_dirs',`
-@@ -231,30 +222,14 @@
+@@ -231,30 +220,14 @@
#
template(`userdom_manage_home_template',`
gen_require(`
@@ -15246,7 +14619,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
##############################
#
-@@ -262,43 +237,43 @@
+@@ -262,43 +235,43 @@
#
# full control of the home directory
@@ -15318,7 +14691,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
')
-@@ -316,14 +291,20 @@
+@@ -316,14 +289,20 @@
##
#
template(`userdom_exec_home_template',`
@@ -15344,7 +14717,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
')
-@@ -341,11 +322,10 @@
+@@ -341,11 +320,10 @@
##
#
template(`userdom_poly_home_template',`
@@ -15360,7 +14733,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
#######################################
-@@ -369,18 +349,18 @@
+@@ -369,18 +347,18 @@
#
template(`userdom_manage_tmp_template',`
gen_require(`
@@ -15389,7 +14762,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
#######################################
-@@ -396,7 +376,13 @@
+@@ -396,7 +374,13 @@
##
#
template(`userdom_exec_tmp_template',`
@@ -15404,7 +14777,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
#######################################
-@@ -510,10 +496,6 @@
+@@ -510,10 +494,6 @@
##
#
template(`userdom_exec_generic_pgms_template',`
@@ -15415,7 +14788,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
corecmd_exec_bin($1_t)
')
-@@ -531,9 +513,6 @@
+@@ -531,9 +511,6 @@
##
#
template(`userdom_basic_networking_template',`
@@ -15425,7 +14798,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
allow $1_t self:tcp_socket create_stream_socket_perms;
allow $1_t self:udp_socket create_socket_perms;
-@@ -548,10 +527,6 @@
+@@ -548,10 +525,6 @@
corenet_udp_sendrecv_all_ports($1_t)
corenet_tcp_connect_all_ports($1_t)
corenet_sendrecv_all_client_packets($1_t)
@@ -15436,7 +14809,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
#######################################
-@@ -568,30 +543,29 @@
+@@ -568,30 +541,29 @@
#
template(`userdom_xwindows_client_template',`
gen_require(`
@@ -15483,7 +14856,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
#######################################
-@@ -728,7 +702,6 @@
+@@ -728,7 +700,6 @@
# for eject
storage_getattr_fixed_disk_dev($1_t)
@@ -15491,7 +14864,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
auth_read_login_records($1_t)
auth_search_pam_console_data($1_t)
auth_run_pam($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
-@@ -758,10 +731,6 @@
+@@ -758,10 +729,6 @@
dev_read_mouse($1_t)
')
@@ -15502,7 +14875,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
optional_policy(`
alsa_read_rw_config($1_t)
')
-@@ -783,20 +752,20 @@
+@@ -783,20 +750,20 @@
')
optional_policy(`
@@ -15528,7 +14901,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
')
-@@ -824,11 +793,18 @@
+@@ -824,11 +791,18 @@
mta_rw_spool($1_t)
')
@@ -15551,7 +14924,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
optional_policy(`
-@@ -842,13 +818,6 @@
+@@ -842,13 +816,6 @@
')
optional_policy(`
@@ -15565,7 +14938,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
resmgr_stream_connect($1_t)
')
-@@ -889,6 +858,8 @@
+@@ -889,6 +856,8 @@
##
#
template(`userdom_login_user_template', `
@@ -15574,7 +14947,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
userdom_base_user_template($1)
userdom_manage_home_template($1)
-@@ -917,26 +888,26 @@
+@@ -917,26 +886,26 @@
allow $1_t self:context contains;
@@ -15615,7 +14988,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
auth_dontaudit_write_login_records($1_t)
-@@ -944,43 +915,43 @@
+@@ -944,43 +913,43 @@
# The library functions always try to open read-write first,
# then fall back to read-only if it fails.
@@ -15677,7 +15050,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
')
-@@ -1014,9 +985,6 @@
+@@ -1014,9 +983,6 @@
domain_interactive_fd($1_t)
typeattribute $1_devpts_t user_ptynode;
@@ -15687,7 +15060,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
typeattribute $1_tty_device_t user_ttynode;
##############################
-@@ -1025,12 +993,12 @@
+@@ -1025,12 +991,12 @@
#
# privileged home directory writers
@@ -15706,7 +15079,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
optional_policy(`
loadkeys_run($1_t,$1_r,$1_tty_device_t)
-@@ -1070,14 +1038,14 @@
+@@ -1070,14 +1036,14 @@
#
authlogin_per_role_template($1, $1_t, $1_r)
@@ -15726,7 +15099,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
logging_dontaudit_send_audit_msgs($1_t)
# Need to to this just so screensaver will work. Should be moved to screensaver domain
-@@ -1085,19 +1053,18 @@
+@@ -1085,19 +1051,18 @@
selinux_get_enforce_mode($1_t)
optional_policy(`
@@ -15751,7 +15124,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
')
-@@ -1109,9 +1076,11 @@
+@@ -1109,9 +1074,11 @@
mono_per_role_template($1, $1_t, $1_r)
')
@@ -15766,7 +15139,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
#######################################
-@@ -1121,10 +1090,10 @@
+@@ -1121,10 +1088,10 @@
##
##
##
@@ -15781,7 +15154,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## This template creates a user domain, types, and
## rules for the user's tty, pty, home directories,
## tmp, and tmpfs files.
-@@ -1187,12 +1156,11 @@
+@@ -1187,12 +1154,11 @@
# and may change other protocols
tunable_policy(`user_tcp_server',`
corenet_tcp_bind_all_nodes($1_t)
@@ -15796,7 +15169,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
# Run pppd in pppd_t by default for user
-@@ -1278,8 +1246,6 @@
+@@ -1278,8 +1244,6 @@
# Manipulate other users crontab.
allow $1_t self:passwd crontab;
@@ -15805,7 +15178,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
kernel_getattr_message_if($1_t)
-@@ -1416,6 +1382,7 @@
+@@ -1416,6 +1380,7 @@
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@@ -15813,7 +15186,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
-@@ -1781,10 +1748,14 @@
+@@ -1781,10 +1746,14 @@
template(`userdom_user_home_content',`
gen_require(`
attribute $1_file_type;
@@ -15829,7 +15202,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1880,11 +1851,11 @@
+@@ -1880,11 +1849,11 @@
#
template(`userdom_search_user_home_dirs',`
gen_require(`
@@ -15843,7 +15216,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1914,11 +1885,11 @@
+@@ -1914,11 +1883,11 @@
#
template(`userdom_list_user_home_dirs',`
gen_require(`
@@ -15857,7 +15230,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1962,12 +1933,12 @@
+@@ -1962,12 +1931,12 @@
#
template(`userdom_user_home_domtrans',`
gen_require(`
@@ -15873,7 +15246,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1997,10 +1968,10 @@
+@@ -1997,10 +1966,10 @@
#
template(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
@@ -15886,7 +15259,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2032,11 +2003,47 @@
+@@ -2032,11 +2001,47 @@
#
template(`userdom_manage_user_home_content_dirs',`
gen_require(`
@@ -15936,7 +15309,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2068,10 +2075,10 @@
+@@ -2068,10 +2073,10 @@
#
template(`userdom_dontaudit_setattr_user_home_content_files',`
gen_require(`
@@ -15949,7 +15322,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2101,11 +2108,11 @@
+@@ -2101,11 +2106,11 @@
#
template(`userdom_read_user_home_content_files',`
gen_require(`
@@ -15963,7 +15336,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2135,11 +2142,11 @@
+@@ -2135,11 +2140,11 @@
#
template(`userdom_dontaudit_read_user_home_content_files',`
gen_require(`
@@ -15978,7 +15351,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2169,10 +2176,10 @@
+@@ -2169,10 +2174,10 @@
#
template(`userdom_dontaudit_write_user_home_content_files',`
gen_require(`
@@ -15991,7 +15364,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2202,11 +2209,11 @@
+@@ -2202,11 +2207,11 @@
#
template(`userdom_read_user_home_content_symlinks',`
gen_require(`
@@ -16005,7 +15378,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2236,11 +2243,11 @@
+@@ -2236,11 +2241,11 @@
#
template(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -16019,7 +15392,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2270,10 +2277,10 @@
+@@ -2270,10 +2275,10 @@
#
template(`userdom_dontaudit_exec_user_home_content_files',`
gen_require(`
@@ -16032,7 +15405,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2305,12 +2312,12 @@
+@@ -2305,12 +2310,12 @@
#
template(`userdom_manage_user_home_content_files',`
gen_require(`
@@ -16048,7 +15421,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2342,10 +2349,10 @@
+@@ -2342,10 +2347,10 @@
#
template(`userdom_dontaudit_manage_user_home_content_dirs',`
gen_require(`
@@ -16061,7 +15434,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2377,12 +2384,12 @@
+@@ -2377,12 +2382,12 @@
#
template(`userdom_manage_user_home_content_symlinks',`
gen_require(`
@@ -16077,7 +15450,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2414,12 +2421,12 @@
+@@ -2414,12 +2419,12 @@
#
template(`userdom_manage_user_home_content_pipes',`
gen_require(`
@@ -16093,7 +15466,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2451,12 +2458,12 @@
+@@ -2451,12 +2456,12 @@
#
template(`userdom_manage_user_home_content_sockets',`
gen_require(`
@@ -16109,7 +15482,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2501,11 +2508,11 @@
+@@ -2501,11 +2506,11 @@
#
template(`userdom_user_home_dir_filetrans',`
gen_require(`
@@ -16123,7 +15496,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2550,11 +2557,11 @@
+@@ -2550,11 +2555,11 @@
#
template(`userdom_user_home_content_filetrans',`
gen_require(`
@@ -16137,7 +15510,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2594,11 +2601,11 @@
+@@ -2594,11 +2599,11 @@
#
template(`userdom_user_home_dir_filetrans_user_home_content',`
gen_require(`
@@ -16151,7 +15524,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2628,11 +2635,11 @@
+@@ -2628,11 +2633,11 @@
#
template(`userdom_write_user_tmp_sockets',`
gen_require(`
@@ -16165,7 +15538,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2662,11 +2669,11 @@
+@@ -2662,11 +2667,11 @@
#
template(`userdom_list_user_tmp',`
gen_require(`
@@ -16179,7 +15552,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2698,10 +2705,10 @@
+@@ -2698,10 +2703,10 @@
#
template(`userdom_dontaudit_list_user_tmp',`
gen_require(`
@@ -16192,7 +15565,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2733,10 +2740,10 @@
+@@ -2733,10 +2738,10 @@
#
template(`userdom_dontaudit_manage_user_tmp_dirs',`
gen_require(`
@@ -16205,7 +15578,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2766,12 +2773,12 @@
+@@ -2766,12 +2771,12 @@
#
template(`userdom_read_user_tmp_files',`
gen_require(`
@@ -16221,7 +15594,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2803,10 +2810,10 @@
+@@ -2803,10 +2808,10 @@
#
template(`userdom_dontaudit_read_user_tmp_files',`
gen_require(`
@@ -16234,14 +15607,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2838,10 +2845,48 @@
+@@ -2838,10 +2843,48 @@
#
template(`userdom_dontaudit_append_user_tmp_files',`
gen_require(`
- type $1_tmp_t;
+ type user_tmp_t;
-+ ')
-+
+ ')
+
+- dontaudit $2 $1_tmp_t:file append;
+ dontaudit $2 user_tmp_t:file append;
+')
+
@@ -16258,9 +15632,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+interface(`userdom_unlink_unpriv_users_tmp_files',`
+ gen_require(`
+ attribute user_tmpfile;
- ')
-
-- dontaudit $2 $1_tmp_t:file append;
++ ')
++
+ files_delete_tmp_dir_entry($1)
+ allow $1 user_tmpfile:file unlink;
+')
@@ -16285,7 +15658,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2871,12 +2916,12 @@
+@@ -2871,12 +2914,12 @@
#
template(`userdom_rw_user_tmp_files',`
gen_require(`
@@ -16301,7 +15674,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2908,10 +2953,10 @@
+@@ -2908,10 +2951,10 @@
#
template(`userdom_dontaudit_manage_user_tmp_files',`
gen_require(`
@@ -16314,7 +15687,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2943,12 +2988,12 @@
+@@ -2943,12 +2986,12 @@
#
template(`userdom_read_user_tmp_symlinks',`
gen_require(`
@@ -16330,7 +15703,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2980,11 +3025,11 @@
+@@ -2980,11 +3023,11 @@
#
template(`userdom_manage_user_tmp_dirs',`
gen_require(`
@@ -16344,7 +15717,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -3016,11 +3061,11 @@
+@@ -3016,11 +3059,11 @@
#
template(`userdom_manage_user_tmp_files',`
gen_require(`
@@ -16358,7 +15731,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -3052,11 +3097,11 @@
+@@ -3052,11 +3095,11 @@
#
template(`userdom_manage_user_tmp_symlinks',`
gen_require(`
@@ -16372,7 +15745,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -3088,11 +3133,11 @@
+@@ -3088,11 +3131,11 @@
#
template(`userdom_manage_user_tmp_pipes',`
gen_require(`
@@ -16386,7 +15759,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -3124,11 +3169,11 @@
+@@ -3124,11 +3167,11 @@
#
template(`userdom_manage_user_tmp_sockets',`
gen_require(`
@@ -16400,7 +15773,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -3173,10 +3218,10 @@
+@@ -3173,10 +3216,10 @@
#
template(`userdom_user_tmp_filetrans',`
gen_require(`
@@ -16413,7 +15786,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
files_search_tmp($2)
')
-@@ -3217,10 +3262,10 @@
+@@ -3217,10 +3260,10 @@
#
template(`userdom_tmp_filetrans_user_tmp',`
gen_require(`
@@ -16426,7 +15799,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4225,11 +4270,11 @@
+@@ -4225,11 +4268,11 @@
#
interface(`userdom_search_staff_home_dirs',`
gen_require(`
@@ -16440,7 +15813,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4245,10 +4290,10 @@
+@@ -4245,10 +4288,10 @@
#
interface(`userdom_dontaudit_search_staff_home_dirs',`
gen_require(`
@@ -16453,7 +15826,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4264,11 +4309,11 @@
+@@ -4264,11 +4307,11 @@
#
interface(`userdom_manage_staff_home_dirs',`
gen_require(`
@@ -16467,7 +15840,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4283,11 +4328,11 @@
+@@ -4283,11 +4326,11 @@
#
interface(`userdom_relabelto_staff_home_dirs',`
gen_require(`
@@ -16481,7 +15854,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4303,10 +4348,10 @@
+@@ -4303,10 +4346,10 @@
#
interface(`userdom_dontaudit_append_staff_home_content_files',`
gen_require(`
@@ -16494,7 +15867,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4321,13 +4366,13 @@
+@@ -4321,13 +4364,13 @@
#
interface(`userdom_read_staff_home_content_files',`
gen_require(`
@@ -16512,7 +15885,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4525,10 +4570,10 @@
+@@ -4525,10 +4568,10 @@
#
interface(`userdom_getattr_sysadm_home_dirs',`
gen_require(`
@@ -16525,7 +15898,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4545,10 +4590,10 @@
+@@ -4545,10 +4588,10 @@
#
interface(`userdom_dontaudit_getattr_sysadm_home_dirs',`
gen_require(`
@@ -16538,7 +15911,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4563,10 +4608,10 @@
+@@ -4563,10 +4606,10 @@
#
interface(`userdom_search_sysadm_home_dirs',`
gen_require(`
@@ -16551,7 +15924,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4582,10 +4627,10 @@
+@@ -4582,10 +4625,10 @@
#
interface(`userdom_dontaudit_search_sysadm_home_dirs',`
gen_require(`
@@ -16564,7 +15937,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4600,10 +4645,10 @@
+@@ -4600,10 +4643,10 @@
#
interface(`userdom_list_sysadm_home_dirs',`
gen_require(`
@@ -16577,7 +15950,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4619,10 +4664,10 @@
+@@ -4619,10 +4662,10 @@
#
interface(`userdom_dontaudit_list_sysadm_home_dirs',`
gen_require(`
@@ -16590,7 +15963,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4638,12 +4683,11 @@
+@@ -4638,12 +4681,11 @@
#
interface(`userdom_dontaudit_read_sysadm_home_content_files',`
gen_require(`
@@ -16606,7 +15979,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4670,10 +4714,10 @@
+@@ -4670,10 +4712,10 @@
#
interface(`userdom_sysadm_home_dir_filetrans',`
gen_require(`
@@ -16619,7 +15992,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4688,10 +4732,10 @@
+@@ -4688,10 +4730,10 @@
#
interface(`userdom_search_sysadm_home_content_dirs',`
gen_require(`
@@ -16632,7 +16005,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4706,13 +4750,13 @@
+@@ -4706,13 +4748,13 @@
#
interface(`userdom_read_sysadm_home_content_files',`
gen_require(`
@@ -16650,7 +16023,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4748,11 +4792,29 @@
+@@ -4748,11 +4790,29 @@
#
interface(`userdom_search_all_users_home_dirs',`
gen_require(`
@@ -16681,7 +16054,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4772,6 +4834,14 @@
+@@ -4772,6 +4832,14 @@
files_list_home($1)
allow $1 home_dir_type:dir list_dir_perms;
@@ -16696,7 +16069,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -5109,7 +5179,7 @@
+@@ -5109,7 +5177,7 @@
#
interface(`userdom_relabelto_generic_user_home_dirs',`
gen_require(`
@@ -16705,7 +16078,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
files_search_home($1)
-@@ -5298,6 +5368,28 @@
+@@ -5298,6 +5366,28 @@
########################################
##
@@ -16734,7 +16107,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Create, read, write, and delete directories in
## unprivileged users home directories.
##
-@@ -5503,6 +5595,24 @@
+@@ -5503,6 +5593,24 @@
########################################
##
@@ -16759,7 +16132,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Read and write unprivileged user ttys.
##
##
-@@ -5668,6 +5778,24 @@
+@@ -5668,6 +5776,24 @@
########################################
##
@@ -16784,7 +16157,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Send a dbus message to all user domains.
##
##
-@@ -5698,3 +5826,277 @@
+@@ -5698,3 +5824,277 @@
interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.')
')
@@ -17062,9 +16435,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ files_tmp_filetrans($2, user_tmp_t, $3)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.2.1/policy/modules/system/userdomain.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.2.2/policy/modules/system/userdomain.te
--- nsaserefpolicy/policy/modules/system/userdomain.te 2007-11-29 13:29:35.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/userdomain.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/userdomain.te 2007-12-04 11:11:03.000000000 -0500
@@ -17,20 +17,13 @@
##
@@ -17238,14 +16611,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ netutils_run_traceroute_cond(staff_t,staff_r,{ staff_tty_device_t staff_devpts_t })
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.fc serefpolicy-3.2.1/policy/modules/system/virt.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.fc serefpolicy-3.2.2/policy/modules/system/virt.fc
--- nsaserefpolicy/policy/modules/system/virt.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/virt.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/virt.fc 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1 @@
+/var/lib/libvirt(/.*)? gen_context(system_u:object_r:virt_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.2.1/policy/modules/system/virt.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.2.2/policy/modules/system/virt.if
--- nsaserefpolicy/policy/modules/system/virt.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/virt.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/virt.if 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1,78 @@
+## Virtualization
+
@@ -17325,16 +16698,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.i
+ files_list_var_lib($1)
+ manage_files_pattern($1,virt_var_lib_t,virt_var_lib_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.2.1/policy/modules/system/virt.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.2.2/policy/modules/system/virt.te
--- nsaserefpolicy/policy/modules/system/virt.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/system/virt.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/virt.te 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1,3 @@
+# var/lib files
+type virt_var_lib_t;
+files_type(virt_var_lib_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.2.1/policy/modules/system/xen.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.2.2/policy/modules/system/xen.if
--- nsaserefpolicy/policy/modules/system/xen.if 2007-06-21 09:32:04.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/xen.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/xen.if 2007-12-04 11:11:03.000000000 -0500
@@ -191,3 +191,24 @@
domtrans_pattern($1,xm_exec_t,xm_t)
@@ -17360,9 +16733,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if
+ allow $1 xend_var_lib_t:dir search_dir_perms;
+ rw_files_pattern($1,xen_image_t,xen_image_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.2.1/policy/modules/system/xen.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.2.2/policy/modules/system/xen.te
--- nsaserefpolicy/policy/modules/system/xen.te 2007-10-12 08:56:08.000000000 -0400
-+++ serefpolicy-3.2.1/policy/modules/system/xen.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/system/xen.te 2007-12-04 11:11:03.000000000 -0500
@@ -6,6 +6,13 @@
# Declarations
#
@@ -17547,37 +16920,37 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
+ fs_read_nfs_symlinks(xend_t)
+ fstools_manage_nfs(xend_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.2.1/policy/modules/users/guest.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.2.2/policy/modules/users/guest.fc
--- nsaserefpolicy/policy/modules/users/guest.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/users/guest.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/users/guest.fc 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1 @@
+# No guest file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.2.1/policy/modules/users/guest.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.2.2/policy/modules/users/guest.if
--- nsaserefpolicy/policy/modules/users/guest.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/users/guest.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/users/guest.if 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1 @@
+## Policy for guest user
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.2.1/policy/modules/users/guest.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.2.2/policy/modules/users/guest.te
--- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/users/guest.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/users/guest.te 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1,4 @@
+policy_module(guest,1.0.1)
+userdom_restricted_user_template(guest)
+userdom_restricted_user_template(gadmin)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.2.1/policy/modules/users/logadm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.2.2/policy/modules/users/logadm.fc
--- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/users/logadm.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/users/logadm.fc 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1 @@
+# No logadm file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.2.1/policy/modules/users/logadm.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.2.2/policy/modules/users/logadm.if
--- nsaserefpolicy/policy/modules/users/logadm.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/users/logadm.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/users/logadm.if 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1 @@
+## Policy for logadm user
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.2.1/policy/modules/users/logadm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.2.2/policy/modules/users/logadm.te
--- nsaserefpolicy/policy/modules/users/logadm.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/users/logadm.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/users/logadm.te 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1,11 @@
+policy_module(logadm,1.0.0)
+
@@ -17590,24 +16963,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.
+allow logadm_t self:capability { dac_override dac_read_search kill sys_ptrace sys_nice };
+
+logging_admin(logadm_t, logadm_r, { logadm_devpts_t logadm_tty_device_t })
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.2.1/policy/modules/users/metadata.xml
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.2.2/policy/modules/users/metadata.xml
--- nsaserefpolicy/policy/modules/users/metadata.xml 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/users/metadata.xml 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/users/metadata.xml 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1 @@
+Policy modules for users
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.2.1/policy/modules/users/webadm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.2.2/policy/modules/users/webadm.fc
--- nsaserefpolicy/policy/modules/users/webadm.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/users/webadm.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/users/webadm.fc 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1 @@
+# No webadm file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.2.1/policy/modules/users/webadm.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.2.2/policy/modules/users/webadm.if
--- nsaserefpolicy/policy/modules/users/webadm.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/users/webadm.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/users/webadm.if 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1 @@
+## Policy for webadm user
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.2.1/policy/modules/users/webadm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.2.2/policy/modules/users/webadm.te
--- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/users/webadm.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/users/webadm.te 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1,42 @@
+policy_module(webadm,1.0.0)
+
@@ -17651,19 +17024,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.
+')
+allow gadmin_t webadm_t:process transition;
+allow webadm_t gadmin_t:dir getattr;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.fc serefpolicy-3.2.1/policy/modules/users/xguest.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.fc serefpolicy-3.2.2/policy/modules/users/xguest.fc
--- nsaserefpolicy/policy/modules/users/xguest.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/users/xguest.fc 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/users/xguest.fc 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1 @@
+# No xguest file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.if serefpolicy-3.2.1/policy/modules/users/xguest.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.if serefpolicy-3.2.2/policy/modules/users/xguest.if
--- nsaserefpolicy/policy/modules/users/xguest.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/users/xguest.if 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/users/xguest.if 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1 @@
+## Policy for xguest user
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.te serefpolicy-3.2.1/policy/modules/users/xguest.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.te serefpolicy-3.2.2/policy/modules/users/xguest.te
--- nsaserefpolicy/policy/modules/users/xguest.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.1/policy/modules/users/xguest.te 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/modules/users/xguest.te 2007-12-04 11:11:03.000000000 -0500
@@ -0,0 +1,55 @@
+policy_module(xguest,1.0.1)
+
@@ -17720,9 +17093,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.
+ bluetooth_dbus_chat(xguest_t)
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.2.1/policy/support/obj_perm_sets.spt
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.2.2/policy/support/obj_perm_sets.spt
--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-10-12 08:56:09.000000000 -0400
-+++ serefpolicy-3.2.1/policy/support/obj_perm_sets.spt 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/support/obj_perm_sets.spt 2007-12-04 11:11:03.000000000 -0500
@@ -204,7 +204,7 @@
define(`getattr_file_perms',`{ getattr }')
define(`setattr_file_perms',`{ setattr }')
@@ -17746,9 +17119,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
+define(`all_association_perms', `{ sendto recvfrom setcontext polmatch } ')
+
+define(`manage_key_perms', `{ create link read search setattr view write } ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.2.1/policy/users
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.2.2/policy/users
--- nsaserefpolicy/policy/users 2007-10-12 08:56:09.000000000 -0400
-+++ serefpolicy-3.2.1/policy/users 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/policy/users 2007-12-04 11:11:03.000000000 -0500
@@ -16,7 +16,7 @@
# and a user process should never be assigned the system user
# identity.
@@ -17783,9 +17156,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.2
- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
-')
+gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.monolithic serefpolicy-3.2.1/Rules.monolithic
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.monolithic serefpolicy-3.2.2/Rules.monolithic
--- nsaserefpolicy/Rules.monolithic 2007-11-20 06:55:20.000000000 -0500
-+++ serefpolicy-3.2.1/Rules.monolithic 2007-11-30 11:23:56.000000000 -0500
++++ serefpolicy-3.2.2/Rules.monolithic 2007-12-04 11:11:03.000000000 -0500
@@ -96,7 +96,7 @@
#
# Load the binary policy
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 49c7b42..0396173 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -16,8 +16,8 @@
%define CHECKPOLICYVER 2.0.3-1
Summary: SELinux policy configuration
Name: selinux-policy
-Version: 3.2.1
-Release: 3%{?dist}
+Version: 3.2.2
+Release: 1%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -167,7 +167,7 @@ fi;
%description
SELinux Reference Policy - modular.
-Based off of reference policy: Checked out revision 2530.
+Based off of reference policy: Checked out revision 2541.
%build
@@ -379,6 +379,10 @@ exit 0
%endif
%changelog
+* Tue Dec 4 2007 Dan Walsh 3.2.2-1
+- Update to upstreamddddddddddddd
+- Allow httpd_sys_script_t to search users homedirs
+
* Mon Dec 3 2007 Dan Walsh 3.2.1-3
- Allow rpm_script to transition to unconfined_execmem_t
@@ -388,7 +392,7 @@ exit 0
* Wed Nov 28 2007 Dan Walsh 3.1.2-2
- Remove user specific crond_t
-* Mon Nov 19 2007 Dan Walsh 3.1.2-1
+* Mon Nov 19 2007 Dan Walsh 3.1.2-1
- Merge with upstream
- Allow xsever to read hwdata_t
- Allow login programs to setkeycreate