diff --git a/.cvsignore b/.cvsignore
index bd6de8f..6154046 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -115,3 +115,4 @@ serefpolicy-2.5.11.tgz
 serefpolicy-2.5.12.tgz
 serefpolicy-2.6.1.tgz
 serefpolicy-2.6.2.tgz
+serefpolicy-2.6.3.tgz
diff --git a/modules-mls.conf b/modules-mls.conf
index b11ae7b..6caaf61 100644
--- a/modules-mls.conf
+++ b/modules-mls.conf
@@ -1031,6 +1031,13 @@ aide = base
 #
 pcscd = module
 
+# Layer: service
+# Module: openct
+# 
+# Middleware framework for smart card terminals
+#
+openct = module
+
 # Layer: system
 # Module: tzdata
 #
diff --git a/modules-strict.conf b/modules-strict.conf
index 16cbabc..ece907d 100644
--- a/modules-strict.conf
+++ b/modules-strict.conf
@@ -1389,3 +1389,11 @@ apcupsd = module
 # w3c
 # 
 w3c = module
+
+# Layer: service
+# Module: openct
+# 
+# Middleware framework for smart card terminals
+#
+openct = module
+
diff --git a/modules-targeted.conf b/modules-targeted.conf
index ec6e7d0..a17d64d 100644
--- a/modules-targeted.conf
+++ b/modules-targeted.conf
@@ -829,6 +829,13 @@ openvpn = base
 #
 pcscd = module
 
+# Layer: service
+# Module: openct
+# 
+# Middleware framework for smart card terminals
+#
+openct = module
+
 # Layer: system
 # Module: pcmcia
 #
diff --git a/policy-20070501.patch b/policy-20070501.patch
index 68454a3..4543321 100644
--- a/policy-20070501.patch
+++ b/policy-20070501.patch
@@ -1,25 +1,18 @@
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/Changelog serefpolicy-2.6.2/Changelog
---- nsaserefpolicy/Changelog	2007-04-30 22:35:02.000000000 -0400
-+++ serefpolicy-2.6.2/Changelog	2007-04-30 10:52:21.000000000 -0400
-@@ -1,6 +1,3 @@
--- Patch to allow amavis to read spamassassin libraries from Dan Walsh.
--- Patch to allow slocate to getattr other filesystems and directories on those
--  filesystems from Dan Walsh.
- - Fixes for RHEL4 from the CLIP project.
- - Replace the old lrrd fc entries with munin ones.
- - Move program admin template usage out of userdom_admin_user_template() to
-@@ -8,8 +5,6 @@
-   parties.
- - Fix clockspeed_run_cli() declaration, it was incorrectly defined as a
-   template instead of an interface.
--- Added modules:
--	rwho (Nalin Dahyabhai)
- 
- * Tue Apr 17 2007 Chris PeBenito <selinux@tresys.com> - 20070417
- - Patch for sasl's use of kerberos from Dan Walsh.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-2.6.2/policy/flask/access_vectors
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-2.6.3/man/man8/ftpd_selinux.8
+--- nsaserefpolicy/man/man8/ftpd_selinux.8	2007-04-02 10:58:34.000000000 -0400
++++ serefpolicy-2.6.3/man/man8/ftpd_selinux.8	2007-05-04 12:31:34.000000000 -0400
+@@ -12,7 +12,7 @@
+ .TP
+ chcon -R -t public_content_t /var/ftp
+ .TP
+-If you want to setup a directory where you can upload files to you must label the files and directories ftpd_anon_rw_t.  So if you created a special directory /var/ftp/incoming, you would need to label the directory with the chcon tool.
++If you want to setup a directory where you can upload files to you must label the files and directories public_content_rw_t.  So if you created a special directory /var/ftp/incoming, you would need to label the directory with the chcon tool.
+ .TP
+ chcon -t public_content_rw_t /var/ftp/incoming
+ .TP
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-2.6.3/policy/flask/access_vectors
 --- nsaserefpolicy/policy/flask/access_vectors	2007-02-26 09:43:33.000000000 -0500
-+++ serefpolicy-2.6.2/policy/flask/access_vectors	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/flask/access_vectors	2007-05-04 12:31:34.000000000 -0400
 @@ -598,6 +598,8 @@
  	shmempwd
  	shmemgrp
@@ -38,9 +31,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors 
  }
  
  class key
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans serefpolicy-2.6.2/policy/global_booleans
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans serefpolicy-2.6.3/policy/global_booleans
 --- nsaserefpolicy/policy/global_booleans	2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.2/policy/global_booleans	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/global_booleans	2007-05-04 12:31:34.000000000 -0400
 @@ -4,7 +4,6 @@
  # file should be used.
  #
@@ -57,9 +50,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans seref
  
  ## <desc>
  ## <p>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-2.6.2/policy/global_tunables
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-2.6.3/policy/global_tunables
 --- nsaserefpolicy/policy/global_tunables	2007-03-26 16:24:14.000000000 -0400
-+++ serefpolicy-2.6.2/policy/global_tunables	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/global_tunables	2007-05-04 12:31:34.000000000 -0400
 @@ -102,12 +102,6 @@
  ## </desc>
  gen_tunable(use_samba_home_dirs,false)
@@ -86,9 +79,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref
 +## </desc>
 +gen_tunable(allow_console_login,false)
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.2/policy/mls
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.3/policy/mls
 --- nsaserefpolicy/policy/mls	2007-03-09 13:02:20.000000000 -0500
-+++ serefpolicy-2.6.2/policy/mls	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/mls	2007-05-04 12:31:34.000000000 -0400
 @@ -89,12 +89,14 @@
  mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton }
  	(( l1 eq l2 ) or
@@ -160,9 +153,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.2
  	 ( t2 == unlabeled_t ));
  
  mlsconstrain association { polmatch }
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-2.6.2/policy/modules/admin/acct.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-2.6.3/policy/modules/admin/acct.te
 --- nsaserefpolicy/policy/modules/admin/acct.te	2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/acct.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/acct.te	2007-05-04 12:31:34.000000000 -0400
 @@ -9,6 +9,7 @@
  type acct_t;
  type acct_exec_t;
@@ -171,25 +164,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te
  
  type acct_data_t;
  logging_log_file(acct_data_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-2.6.2/policy/modules/admin/alsa.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-2.6.3/policy/modules/admin/alsa.fc
 --- nsaserefpolicy/policy/modules/admin/alsa.fc	2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/alsa.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/alsa.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -1,4 +1,5 @@
  
  /etc/alsa/pcm(/.*)?		gen_context(system_u:object_r:alsa_etc_rw_t,s0)
 +/etc/asound(/.*)?		gen_context(system_u:object_r:alsa_etc_rw_t,s0)
  
  /usr/bin/ainit 		--	gen_context(system_u:object_r:alsa_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.fc serefpolicy-2.6.2/policy/modules/admin/amtu.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.fc serefpolicy-2.6.3/policy/modules/admin/amtu.fc
 --- nsaserefpolicy/policy/modules/admin/amtu.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/amtu.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/amtu.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -0,0 +1,3 @@
 +
 +/usr/bin/amtu    --    gen_context(system_u:object_r:amtu_exec_t,s0)
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if serefpolicy-2.6.2/policy/modules/admin/amtu.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if serefpolicy-2.6.3/policy/modules/admin/amtu.if
 --- nsaserefpolicy/policy/modules/admin/amtu.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/amtu.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/amtu.if	2007-05-04 12:31:34.000000000 -0400
 @@ -0,0 +1,53 @@
 +## <summary>
 +##	abstract Machine Test Utility 
@@ -244,9 +237,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if
 +	role $2 types amtu_t;
 +	allow amtu_t $3:chr_file rw_term_perms;
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te serefpolicy-2.6.2/policy/modules/admin/amtu.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te serefpolicy-2.6.3/policy/modules/admin/amtu.te
 --- nsaserefpolicy/policy/modules/admin/amtu.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/amtu.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/amtu.te	2007-05-04 12:31:34.000000000 -0400
 @@ -0,0 +1,57 @@
 +policy_module(amtu,1.0.23)
 +
@@ -305,9 +298,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te
 +    term_dontaudit_search_ptys(amtu_t)
 +');
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-2.6.2/policy/modules/admin/bootloader.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-2.6.3/policy/modules/admin/bootloader.te
 --- nsaserefpolicy/policy/modules/admin/bootloader.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/bootloader.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/bootloader.te	2007-05-04 12:31:34.000000000 -0400
 @@ -65,6 +65,8 @@
  files_tmp_filetrans(bootloader_t,bootloader_tmp_t,{ dir file lnk_file chr_file blk_file })
  # for tune2fs (cjp: ?)
@@ -325,9 +318,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa
  ')
  
  optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-2.6.2/policy/modules/admin/consoletype.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-2.6.3/policy/modules/admin/consoletype.te
 --- nsaserefpolicy/policy/modules/admin/consoletype.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/consoletype.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/consoletype.te	2007-05-04 12:31:34.000000000 -0400
 @@ -8,7 +8,12 @@
  
  type consoletype_t;
@@ -359,9 +352,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console
  
  domain_use_interactive_fds(consoletype_t)
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-2.6.2/policy/modules/admin/dmesg.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-2.6.3/policy/modules/admin/dmesg.te
 --- nsaserefpolicy/policy/modules/admin/dmesg.te	2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/dmesg.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/dmesg.te	2007-05-04 12:31:34.000000000 -0400
 @@ -10,6 +10,7 @@
  	type dmesg_t;
  	type dmesg_exec_t;
@@ -370,9 +363,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.t
  	role system_r types dmesg_t;
  ')
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-2.6.2/policy/modules/admin/kudzu.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-2.6.3/policy/modules/admin/kudzu.te
 --- nsaserefpolicy/policy/modules/admin/kudzu.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/kudzu.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/kudzu.te	2007-05-04 12:31:34.000000000 -0400
 @@ -21,8 +21,8 @@
  # Local policy
  #
@@ -393,9 +386,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t
  # kudzu will telinit to make init re-read
  # the inittab after configuring serial consoles
  init_telinit(kudzu_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-2.6.2/policy/modules/admin/logrotate.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-2.6.3/policy/modules/admin/logrotate.te
 --- nsaserefpolicy/policy/modules/admin/logrotate.te	2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/logrotate.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/logrotate.te	2007-05-04 12:31:34.000000000 -0400
 @@ -75,6 +75,7 @@
  mls_file_read_up(logrotate_t)
  mls_file_write_down(logrotate_t)
@@ -404,9 +397,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota
  
  selinux_get_fs_mount(logrotate_t)
  selinux_get_enforce_mode(logrotate_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-2.6.2/policy/modules/admin/logwatch.te
---- nsaserefpolicy/policy/modules/admin/logwatch.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/logwatch.te	2007-04-30 11:26:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-2.6.3/policy/modules/admin/logwatch.te
+--- nsaserefpolicy/policy/modules/admin/logwatch.te	2007-05-02 15:04:46.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/logwatch.te	2007-05-04 12:31:34.000000000 -0400
 @@ -63,6 +63,8 @@
  files_search_mnt(logwatch_t)
  files_dontaudit_search_home(logwatch_t)
@@ -416,20 +409,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc
  
  fs_getattr_all_fs(logwatch_t)
  fs_dontaudit_list_auto_mountpoints(logwatch_t)
-@@ -95,6 +97,10 @@
- ')
- 
- optional_policy(`
-+	avahi_dontaudit_search_pid(logwatch_t)
-+')
-+
-+optional_policy(`
- 	bind_read_config(logwatch_t)
- 	bind_read_zone(logwatch_t)
- ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-2.6.2/policy/modules/admin/netutils.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-2.6.3/policy/modules/admin/netutils.te
 --- nsaserefpolicy/policy/modules/admin/netutils.te	2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/netutils.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/netutils.te	2007-05-04 12:31:34.000000000 -0400
 @@ -31,6 +31,7 @@
  type traceroute_t;
  type traceroute_exec_t;
@@ -438,10 +420,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil
  role system_r types traceroute_t;
  
  ########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-2.6.2/policy/modules/admin/readahead.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-2.6.3/policy/modules/admin/readahead.te
 --- nsaserefpolicy/policy/modules/admin/readahead.te	2007-01-02 12:57:51.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/readahead.te	2007-04-30 11:26:06.000000000 -0400
-@@ -36,7 +36,7 @@
++++ serefpolicy-2.6.3/policy/modules/admin/readahead.te	2007-05-04 12:31:34.000000000 -0400
+@@ -18,7 +18,8 @@
+ # Local policy
+ #
+ 
+-dontaudit readahead_t self:capability { dac_override dac_read_search sys_tty_config };
++allow readahead_t self:capability { dac_override dac_read_search };
++dontaudit readahead_t self:capability sys_tty_config;
+ allow readahead_t self:process signal_perms;
+ 
+ manage_files_pattern(readahead_t,readahead_var_run_t,readahead_var_run_t)
+@@ -36,7 +37,7 @@
  dev_dontaudit_read_all_blk_files(readahead_t)
  dev_dontaudit_getattr_memory_dev(readahead_t)
  dev_dontaudit_getattr_nvram_dev(readahead_t)
@@ -450,7 +442,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe
  
  domain_use_interactive_fds(readahead_t)
  
-@@ -82,3 +82,7 @@
+@@ -82,3 +83,7 @@
  optional_policy(`
  	seutil_sigchld_newrole(readahead_t)
  ')
@@ -458,9 +450,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe
 +optional_policy(`
 +	logging_dontaudit_search_audit_config(readahead_t)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-2.6.2/policy/modules/admin/rpm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-2.6.3/policy/modules/admin/rpm.fc
 --- nsaserefpolicy/policy/modules/admin/rpm.fc	2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/rpm.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/rpm.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -21,6 +21,9 @@
  /usr/sbin/pup			--	gen_context(system_u:object_r:rpm_exec_t,s0)
  /usr/sbin/rhn_check		--	gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -471,37 +463,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc 
  ')
  
  /var/lib/alternatives(/.*)?		gen_context(system_u:object_r:rpm_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-2.6.2/policy/modules/admin/rpm.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-2.6.3/policy/modules/admin/rpm.if
 --- nsaserefpolicy/policy/modules/admin/rpm.if	2007-04-11 10:19:43.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/rpm.if	2007-04-30 11:26:06.000000000 -0400
-@@ -211,26 +211,6 @@
++++ serefpolicy-2.6.3/policy/modules/admin/rpm.if	2007-05-04 12:31:34.000000000 -0400
+@@ -225,8 +225,29 @@
+ 		type rpm_script_tmp_t;
+ 	')
  
- ########################################
- ## <summary>
--##	Create, read, write, and delete RPM
--##	script temporary files.
--## </summary>
--## <param name="domain">
--##	<summary>
--##	Domain allowed access.
--##	</summary>
--## </param>
--#
--interface(`rpm_manage_script_tmp_files',`
--	gen_require(`
--		type rpm_script_tmp_t;
--	')
--
 -	files_search_tmp($1)
--	manage_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
--')
--
--########################################
--## <summary>
- ##	Read the RPM package database.
- ## </summary>
- ## <param name="domain">
-@@ -290,3 +270,68 @@
++	manage_dirs_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
+ 	manage_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
++	manage_lnk_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
++')
++
++########################################
++## <summary>
++##	read, RPM
++##	script temporary files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`rpm_read_script_tmp_files',`
++	gen_require(`
++		type rpm_script_tmp_t;
++	')
++
++	read_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
++	read_lnk_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
+ ')
+ 
+ ########################################
+@@ -290,3 +311,46 @@
  	dontaudit $1 rpm_var_lib_t:file manage_file_perms;
  	dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
  ')
@@ -548,31 +544,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if 
 +
 +	dontaudit $1 rpm_tmp_t:file rw_file_perms;
 +')
-+
-+########################################
-+## <summary>
-+##	Allow domain to manage RPM Script tmp files
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain to not audit.
-+##	</summary>
-+## </param>
-+#
-+interface(`rpm_manage_script_tmp_files',`
-+	gen_require(`
-+		type rpm_script_tmp_t;
-+	')
-+
-+	manage_dirs_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
-+	manage_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
-+	manage_lnk_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
-+')
-+
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-2.6.2/policy/modules/admin/rpm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-2.6.3/policy/modules/admin/rpm.te
 --- nsaserefpolicy/policy/modules/admin/rpm.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/rpm.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/rpm.te	2007-05-04 12:31:34.000000000 -0400
 @@ -9,6 +9,8 @@
  type rpm_t;
  type rpm_exec_t;
@@ -582,9 +556,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te 
  domain_obj_id_change_exemption(rpm_t)
  domain_role_change_exemption(rpm_t)
  domain_system_change_exemption(rpm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-2.6.2/policy/modules/admin/sudo.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-2.6.3/policy/modules/admin/sudo.if
 --- nsaserefpolicy/policy/modules/admin/sudo.if	2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/sudo.if	2007-04-30 12:48:42.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/sudo.if	2007-05-04 12:31:34.000000000 -0400
 @@ -69,7 +69,6 @@
  	allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms;
  	allow $1_sudo_t self:unix_dgram_socket sendto;
@@ -631,9 +605,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
  		nis_use_ypbind($1_sudo_t)
  	')
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-2.6.2/policy/modules/admin/su.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-2.6.3/policy/modules/admin/su.if
 --- nsaserefpolicy/policy/modules/admin/su.if	2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/su.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/su.if	2007-05-04 12:31:34.000000000 -0400
 @@ -41,12 +41,11 @@
  
  	allow $2 $1_su_t:process signal;
@@ -706,9 +680,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s
  	ifdef(`TODO',`
  	allow $1_su_t $1_home_t:file manage_file_perms;
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-2.6.2/policy/modules/admin/usermanage.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-2.6.3/policy/modules/admin/usermanage.if
 --- nsaserefpolicy/policy/modules/admin/usermanage.if	2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/usermanage.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/usermanage.if	2007-05-04 12:31:34.000000000 -0400
 @@ -278,5 +278,5 @@
  		type crack_db_t;
  	')
@@ -716,9 +690,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
 -	allow $1 crack_db_t:file read_file_perms;
 +	read_files_pattern($1,crack_db_t,crack_db_t)
  ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-2.6.2/policy/modules/admin/usermanage.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-2.6.3/policy/modules/admin/usermanage.te
 --- nsaserefpolicy/policy/modules/admin/usermanage.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/usermanage.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/usermanage.te	2007-05-04 12:31:34.000000000 -0400
 @@ -184,7 +184,7 @@
  # Groupadd local policy
  #
@@ -878,18 +852,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
  	rpm_rw_pipes(useradd_t)
 +	rpm_dontaudit_rw_tmp_files(useradd_t)
  ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-2.6.2/policy/modules/admin/vbetool.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-2.6.3/policy/modules/admin/vbetool.te
 --- nsaserefpolicy/policy/modules/admin/vbetool.te	2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/vbetool.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/vbetool.te	2007-05-04 12:31:34.000000000 -0400
 @@ -32,4 +32,5 @@
  
  optional_policy(`
  	hal_rw_pid_files(vbetool_t)
 +	hal_write_log(vbetool_t)
  ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-2.6.2/policy/modules/apps/gnome.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-2.6.3/policy/modules/apps/gnome.if
 --- nsaserefpolicy/policy/modules/apps/gnome.if	2007-02-19 11:32:52.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/apps/gnome.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/apps/gnome.if	2007-05-04 12:31:34.000000000 -0400
 @@ -35,6 +35,7 @@
  template(`gnome_per_role_template',`
  	gen_require(`
@@ -943,9 +917,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
  ##	</p>
  ##	<p>
  ##	This is a templated interface, and should only
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-2.6.2/policy/modules/apps/gpg.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-2.6.3/policy/modules/apps/gpg.fc
 --- nsaserefpolicy/policy/modules/apps/gpg.fc	2006-11-16 17:15:07.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/apps/gpg.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/apps/gpg.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -7,6 +7,4 @@
  /usr/lib/gnupg/.*	--	gen_context(system_u:object_r:gpg_exec_t,s0)
  /usr/lib/gnupg/gpgkeys.* --	gen_context(system_u:object_r:gpg_helper_exec_t,s0)
@@ -953,9 +927,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc s
 -ifdef(`targeted_policy',`',`
  HOME_DIR/\.gnupg(/.+)?		gen_context(system_u:object_r:ROLE_gpg_secret_t,s0)
 -')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.if serefpolicy-2.6.2/policy/modules/apps/loadkeys.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.if serefpolicy-2.6.3/policy/modules/apps/loadkeys.if
 --- nsaserefpolicy/policy/modules/apps/loadkeys.if	2007-01-02 12:57:22.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/apps/loadkeys.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/apps/loadkeys.if	2007-05-04 12:31:34.000000000 -0400
 @@ -11,16 +11,12 @@
  ## </param>
  #
@@ -1022,9 +996,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys
  	')
 +	can_exec($1,loadkeys_exec_t)
  ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-2.6.2/policy/modules/apps/mozilla.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-2.6.3/policy/modules/apps/mozilla.if
 --- nsaserefpolicy/policy/modules/apps/mozilla.if	2007-03-26 16:24:09.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/apps/mozilla.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/apps/mozilla.if	2007-05-04 12:31:34.000000000 -0400
 @@ -150,6 +150,7 @@
  	corenet_dontaudit_tcp_bind_generic_port($1_mozilla_t)
  
@@ -1033,19 +1007,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
  	dev_write_sound($1_mozilla_t)
  	dev_read_sound($1_mozilla_t)
  	dev_dontaudit_rw_dri($1_mozilla_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-2.6.2/policy/modules/apps/slocate.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-2.6.3/policy/modules/apps/slocate.te
 --- nsaserefpolicy/policy/modules/apps/slocate.te	2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/apps/slocate.te	2007-04-30 11:26:06.000000000 -0400
-@@ -1,5 +1,5 @@
++++ serefpolicy-2.6.3/policy/modules/apps/slocate.te	2007-05-04 12:31:34.000000000 -0400
+@@ -43,7 +43,7 @@
+ files_read_etc_files(locate_t)
  
--policy_module(slocate,1.4.1)
-+policy_module(slocate,1.4.0)
+ fs_getattr_all_fs(locate_t)
+-fs_getattr_all_dirs(locate_t)
++fs_getattr_all_files(locate_t)
  
- #################################
- #
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if serefpolicy-2.6.2/policy/modules/apps/uml.if
+ libs_use_shared_libs(locate_t)
+ libs_use_ld_so(locate_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if serefpolicy-2.6.3/policy/modules/apps/uml.if
 --- nsaserefpolicy/policy/modules/apps/uml.if	2007-03-26 10:38:58.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/apps/uml.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/apps/uml.if	2007-05-04 12:31:34.000000000 -0400
 @@ -193,33 +193,6 @@
  		nis_use_ypbind($1_uml_t)
  	')
@@ -1080,9 +1056,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if s
  ')
  
  ########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-2.6.2/policy/modules/kernel/corecommands.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-2.6.3/policy/modules/kernel/corecommands.fc
 --- nsaserefpolicy/policy/modules/kernel/corecommands.fc	2007-04-11 15:52:53.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/corecommands.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/corecommands.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -36,6 +36,11 @@
  /etc/cipe/ip-up.*		--	gen_context(system_u:object_r:bin_t,s0)
  /etc/cipe/ip-down.*		--	gen_context(system_u:object_r:bin_t,s0)
@@ -1095,14 +1071,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
  /etc/hotplug/.*agent		--	gen_context(system_u:object_r:bin_t,s0)
  /etc/hotplug/.*rc		-- 	gen_context(system_u:object_r:bin_t,s0)
  /etc/hotplug/hotplug\.functions --	gen_context(system_u:object_r:bin_t,s0)
-@@ -256,3 +261,4 @@
+@@ -256,3 +261,5 @@
  ifdef(`distro_suse',`
  /var/lib/samba/bin/.+			gen_context(system_u:object_r:bin_t,s0)
  ')
 +/usr/lib/vmware-tools/sbin32(/.*)?      gen_context(system_u:object_r:bin_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-2.6.2/policy/modules/kernel/corecommands.if
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-2.6.3/policy/modules/kernel/corecommands.if
 --- nsaserefpolicy/policy/modules/kernel/corecommands.if	2007-03-26 10:38:57.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/corecommands.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/corecommands.if	2007-05-04 12:31:34.000000000 -0400
 @@ -988,3 +988,23 @@
  
  	mmap_files_pattern($1,bin_t,exec_type)
@@ -1127,16 +1104,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
 +')
 +
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-2.6.2/policy/modules/kernel/corenetwork.te.in
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-2.6.3/policy/modules/kernel/corenetwork.te.in
 --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in	2007-04-30 22:35:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/corenetwork.te.in	2007-04-30 11:26:06.000000000 -0400
-@@ -1,5 +1,5 @@
- 
--policy_module(corenetwork,1.2.7)
-+policy_module(corenetwork,1.2.6)
- 
- ########################################
- #
++++ serefpolicy-2.6.3/policy/modules/kernel/corenetwork.te.in	2007-05-04 12:31:34.000000000 -0400
 @@ -48,6 +48,11 @@
  type reserved_port_t, port_type, reserved_port_type;
  
@@ -1193,9 +1163,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
  portcon tcp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0)
  portcon udp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0)
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-2.6.2/policy/modules/kernel/devices.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-2.6.3/policy/modules/kernel/devices.fc
 --- nsaserefpolicy/policy/modules/kernel/devices.fc	2007-03-01 10:01:48.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/devices.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/devices.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -19,6 +19,7 @@
  /dev/evtchn		-c	gen_context(system_u:object_r:xen_device_t,s0)
  /dev/fb[0-9]*		-c	gen_context(system_u:object_r:framebuf_device_t,s0)
@@ -1204,9 +1174,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
  /dev/hiddev.*		-c	gen_context(system_u:object_r:usb_device_t,s0)
  /dev/hpet		-c	gen_context(system_u:object_r:clock_device_t,s0)
  /dev/hw_random		-c	gen_context(system_u:object_r:random_device_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-2.6.2/policy/modules/kernel/devices.if
+@@ -81,6 +82,8 @@
+ 
+ /dev/bus/usb/.*/[0-9]+	-c	gen_context(system_u:object_r:usb_device_t,s0)
+ 
++/dev/cmx.*		-c	gen_context(system_u:object_r:smartcard_device_t,s0)
++
+ /dev/cpu/.*		-c	gen_context(system_u:object_r:cpu_device_t,s0)
+ /dev/cpu/mtrr		-c	gen_context(system_u:object_r:mtrr_device_t,s0)
+ 
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-2.6.3/policy/modules/kernel/devices.if
 --- nsaserefpolicy/policy/modules/kernel/devices.if	2007-03-26 16:24:09.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/devices.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/devices.if	2007-05-04 12:31:34.000000000 -0400
 @@ -2729,6 +2729,24 @@
  
  ########################################
@@ -1257,9 +1236,104 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
  ##	Read and write VMWare devices.
  ## </summary>
  ## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-2.6.2/policy/modules/kernel/domain.if
+@@ -3192,3 +3228,78 @@
+ 
+ 	typeattribute $1 devices_unconfined_type;
+ ')
++
++########################################
++## <summary>
++##	Getattr on smartcard devices
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_getattr_smartcard',`
++	gen_require(`
++		type smartcard_device_t;
++	')
++
++	allow $1 smartcard_device_t:chr_file getattr;
++
++')
++
++########################################
++## <summary>
++##	dontaudit getattr on smartcard devices
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_dontaudit_getattr_smartcard',`
++	gen_require(`
++		type smartcard_device_t;
++	')
++
++	dontaudit $1 smartcard_device_t:chr_file getattr;
++
++')
++
++########################################
++## <summary>
++##	Read and write smartcard devices.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_rw_smartcard',`
++	gen_require(`
++		type device_t, smartcard_device_t;
++	')
++
++	rw_chr_files_pattern($1,device_t,smartcard_device_t)
++')
++
++########################################
++## <summary>
++##	Create, read, write, and delete smartcard devices.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_manage_smartcard',`
++	gen_require(`
++		type device_t, smartcard_device_t;
++	')
++
++	manage_chr_files_pattern($1,device_t,smartcard_device_t)
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-2.6.3/policy/modules/kernel/devices.te
+--- nsaserefpolicy/policy/modules/kernel/devices.te	2007-04-23 09:35:56.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/devices.te	2007-05-04 12:31:34.000000000 -0400
+@@ -139,6 +139,12 @@
+ #
+ # Type for sound devices and mixers
+ #
++type smartcard_device_t;
++dev_node(smartcard_device_t)
++
++#
++# Type for sound devices and mixers
++#
+ type sound_device_t;
+ dev_node(sound_device_t)
+ 
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-2.6.3/policy/modules/kernel/domain.if
 --- nsaserefpolicy/policy/modules/kernel/domain.if	2007-02-19 11:32:51.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/domain.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/domain.if	2007-05-04 12:31:34.000000000 -0400
 @@ -1254,3 +1254,21 @@
  	typeattribute $1 can_change_object_identity;
  	typeattribute $1 set_curr_context;
@@ -1282,9 +1356,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
 + 
 +	allow $1 domain:association { sendto recvfrom };
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-2.6.2/policy/modules/kernel/domain.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-2.6.3/policy/modules/kernel/domain.te
 --- nsaserefpolicy/policy/modules/kernel/domain.te	2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/domain.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/domain.te	2007-05-04 12:31:34.000000000 -0400
 @@ -6,6 +6,29 @@
  # Declarations
  #
@@ -1342,9 +1416,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
 +		ipsec_labeled(domain)
 +	')
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-2.6.2/policy/modules/kernel/files.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-2.6.3/policy/modules/kernel/files.fc
 --- nsaserefpolicy/policy/modules/kernel/files.fc	2006-11-16 17:15:04.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/files.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/files.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -54,6 +54,7 @@
  /etc/issue\.net		--	gen_context(system_u:object_r:etc_runtime_t,s0)
  /etc/localtime		-l	gen_context(system_u:object_r:etc_t,s0)
@@ -1353,9 +1427,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  /etc/motd		--	gen_context(system_u:object_r:etc_runtime_t,s0)
  /etc/nohotplug		--	gen_context(system_u:object_r:etc_runtime_t,s0)
  /etc/nologin.*		--	gen_context(system_u:object_r:etc_runtime_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.6.2/policy/modules/kernel/files.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.6.3/policy/modules/kernel/files.if
 --- nsaserefpolicy/policy/modules/kernel/files.if	2007-02-26 14:17:21.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/files.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/files.if	2007-05-04 12:31:34.000000000 -0400
 @@ -343,8 +343,7 @@
  
  ########################################
@@ -1532,10 +1606,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
 +	allow $1 root_t:dir rw_dir_perms;
 +	allow $1 root_t:file { create getattr write };
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-2.6.2/policy/modules/kernel/filesystem.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-2.6.3/policy/modules/kernel/filesystem.if
 --- nsaserefpolicy/policy/modules/kernel/filesystem.if	2007-03-26 16:24:09.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/filesystem.if	2007-04-30 11:26:06.000000000 -0400
-@@ -1291,6 +1291,26 @@
++++ serefpolicy-2.6.3/policy/modules/kernel/filesystem.if	2007-05-04 12:31:34.000000000 -0400
+@@ -1096,6 +1096,24 @@
+ 
+ ########################################
+ ## <summary>
++##	Search dosfs filesystem. 
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`fs_search_dos',`
++	gen_require(`
++		type dosfs_t;
++	')
++
++	allow $1 dosfs_t:dir search_dir_perms;
++')
++
++########################################
++## <summary>
+ ##	Read files on a DOS filesystem.
+ ## </summary>
+ ## <param name="domain">
+@@ -1291,6 +1309,26 @@
  
  ########################################
  ## <summary>
@@ -1562,7 +1661,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
  ##	Mount a NFS filesystem.
  ## </summary>
  ## <param name="domain">
-@@ -3420,3 +3440,22 @@
+@@ -3420,3 +3458,22 @@
  	relabelfrom_blk_files_pattern($1,noxattrfs,noxattrfs)
  	relabelfrom_chr_files_pattern($1,noxattrfs,noxattrfs)
  ')
@@ -1585,9 +1684,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
 +
 +        allow $1 fusefs_t:filesystem mount;
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.6.2/policy/modules/kernel/filesystem.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.6.3/policy/modules/kernel/filesystem.te
 --- nsaserefpolicy/policy/modules/kernel/filesystem.te	2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/filesystem.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/filesystem.te	2007-05-04 12:31:34.000000000 -0400
 @@ -54,17 +54,30 @@
  
  type capifs_t;
@@ -1632,10 +1731,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
  type nfsd_fs_t;
  fs_type(nfsd_fs_t)
  genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-2.6.2/policy/modules/kernel/kernel.if
---- nsaserefpolicy/policy/modules/kernel/kernel.if	2007-02-19 11:32:51.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/kernel.if	2007-04-30 11:26:06.000000000 -0400
-@@ -1830,6 +1830,26 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-2.6.3/policy/modules/kernel/kernel.if
+--- nsaserefpolicy/policy/modules/kernel/kernel.if	2007-05-02 15:04:46.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/kernel.if	2007-05-04 12:31:34.000000000 -0400
+@@ -1848,6 +1848,26 @@
  
  ########################################
  ## <summary>
@@ -1662,7 +1761,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
  ##	Do not audit attempts to list unlabeled directories.
  ## </summary>
  ## <param name="domain">
-@@ -2140,9 +2160,6 @@
+@@ -2158,9 +2178,6 @@
  	')
  
  	allow $1 unlabeled_t:association { sendto recvfrom };
@@ -1672,32 +1771,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
  ')
  
  ########################################
-@@ -2408,3 +2425,22 @@
- 
- 	typeattribute $1 kern_unconfined;
- ')
-+
-+########################################
-+## <summary>
-+##	Mount a kernel vm filesystem.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	The type of the domain mounting the filesystem.
-+##	</summary>
-+## </param>
-+#
-+interface(`kernel_mount_kvmfs',`
-+	gen_require(`
-+		type kvmfs_t;
-+	')
-+
-+	allow $1 kvmfs_t:filesystem mount;
-+')
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-2.6.2/policy/modules/kernel/kernel.te
---- nsaserefpolicy/policy/modules/kernel/kernel.te	2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/kernel.te	2007-04-30 11:26:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-2.6.3/policy/modules/kernel/kernel.te
+--- nsaserefpolicy/policy/modules/kernel/kernel.te	2007-05-02 15:04:46.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/kernel.te	2007-05-04 12:31:34.000000000 -0400
 @@ -146,6 +146,8 @@
  type unlabeled_t;
  sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
@@ -1715,9 +1791,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
  ')
  
  optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-2.6.2/policy/modules/kernel/mls.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-2.6.3/policy/modules/kernel/mls.if
 --- nsaserefpolicy/policy/modules/kernel/mls.if	2006-11-16 17:15:04.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/mls.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/mls.if	2007-05-04 12:31:34.000000000 -0400
 @@ -154,6 +154,26 @@
  ########################################
  ## <summary>
@@ -1745,9 +1821,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if
  ##	for writing to sockets at any level.
  ## </summary>
  ## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-2.6.2/policy/modules/kernel/mls.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-2.6.3/policy/modules/kernel/mls.te
 --- nsaserefpolicy/policy/modules/kernel/mls.te	2007-01-02 12:57:13.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/mls.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/mls.te	2007-05-04 12:31:34.000000000 -0400
 @@ -18,6 +18,7 @@
  attribute mlsnetreadtoclr;
  attribute mlsnetwrite;
@@ -1765,9 +1841,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te
  attribute mlstrustedobject;
  
  attribute privrangetrans;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-2.6.2/policy/modules/kernel/selinux.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-2.6.3/policy/modules/kernel/selinux.if
 --- nsaserefpolicy/policy/modules/kernel/selinux.if	2007-02-27 14:37:10.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/selinux.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/selinux.if	2007-05-04 12:31:34.000000000 -0400
 @@ -51,6 +51,44 @@
  
  ########################################
@@ -1813,9 +1889,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu
  ##	Search selinuxfs.
  ## </summary>
  ## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-2.6.2/policy/modules/kernel/storage.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-2.6.3/policy/modules/kernel/storage.if
 --- nsaserefpolicy/policy/modules/kernel/storage.if	2007-01-02 12:57:13.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/storage.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/storage.if	2007-05-04 12:31:34.000000000 -0400
 @@ -100,6 +100,7 @@
  
  	dev_list_all_dev_nodes($1)
@@ -1832,9 +1908,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag
  	typeattribute $1 fixed_disk_raw_write;
  ')
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-2.6.2/policy/modules/kernel/terminal.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-2.6.3/policy/modules/kernel/terminal.if
 --- nsaserefpolicy/policy/modules/kernel/terminal.if	2007-02-20 16:35:52.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/terminal.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/terminal.if	2007-05-04 12:31:34.000000000 -0400
 @@ -278,6 +278,25 @@
  
  ########################################
@@ -1870,9 +1946,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
  ')
  
  ########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-2.6.2/policy/modules/kernel/terminal.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-2.6.3/policy/modules/kernel/terminal.te
 --- nsaserefpolicy/policy/modules/kernel/terminal.te	2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/terminal.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/terminal.te	2007-05-04 12:31:34.000000000 -0400
 @@ -28,6 +28,7 @@
  type devpts_t;
  files_mountpoint(devpts_t)
@@ -1881,9 +1957,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
  fs_type(devpts_t)
  fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0);
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.fc serefpolicy-2.6.2/policy/modules/services/aide.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.fc serefpolicy-2.6.3/policy/modules/services/aide.fc
 --- nsaserefpolicy/policy/modules/services/aide.fc	2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/aide.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/aide.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -2,5 +2,5 @@
  
  /var/lib/aide(/.*)		gen_context(system_u:object_r:aide_db_t,mls_systemhigh)
@@ -1891,16 +1967,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide
 -/var/log/aide(/.*)?		gen_context(system_u:object_r:aide_log_t,mls_systemhigh)
  /var/log/aide.log	--	gen_context(system_u:object_r:aide_log_t,mls_systemhigh)
 +/var/log/aide(/.*)?		gen_context(system_u:object_r:aide_log_t,mls_systemhigh)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.te serefpolicy-2.6.2/policy/modules/services/aide.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.te serefpolicy-2.6.3/policy/modules/services/aide.te
 --- nsaserefpolicy/policy/modules/services/aide.te	2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/aide.te	2007-04-30 11:26:06.000000000 -0400
-@@ -1,5 +1,5 @@
- 
--policy_module(aide,1.0.1)
-+policy_module(aide,1.0.0)
- 
- ########################################
- #
++++ serefpolicy-2.6.3/policy/modules/services/aide.te	2007-05-04 12:31:34.000000000 -0400
 @@ -26,7 +26,7 @@
  
  allow aide_t self:capability { dac_override fowner };
@@ -1910,9 +1979,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide
  
  # database actions
  manage_files_pattern(aide_t,aide_db_t,aide_db_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.if serefpolicy-2.6.2/policy/modules/services/amavis.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.if serefpolicy-2.6.3/policy/modules/services/amavis.if
 --- nsaserefpolicy/policy/modules/services/amavis.if	2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/amavis.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/amavis.if	2007-05-04 12:31:34.000000000 -0400
 @@ -167,3 +167,22 @@
  	allow $1 amavis_var_run_t:file setattr;
  	files_search_pids($1)
@@ -1936,31 +2005,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav
 +	allow $1 amavis_var_run_t:file create_file_perms;
 +	files_search_pids($1)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-2.6.2/policy/modules/services/amavis.te
---- nsaserefpolicy/policy/modules/services/amavis.te	2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/amavis.te	2007-04-30 11:26:06.000000000 -0400
-@@ -1,5 +1,5 @@
- 
--policy_module(amavis,1.2.1)
-+policy_module(amavis,1.2.0)
- 
- ########################################
- #
-@@ -75,10 +75,10 @@
- files_tmp_filetrans(amavis_t,amavis_tmp_t,file)
- 
- # var/lib files for amavis
-+files_search_var_lib(amavis_t)
- manage_dirs_pattern(amavis_t,amavis_var_lib_t,amavis_var_lib_t)
- manage_files_pattern(amavis_t,amavis_var_lib_t,amavis_var_lib_t)
- manage_sock_files_pattern(amavis_t,amavis_var_lib_t,amavis_var_lib_t)
--files_search_var_lib(amavis_t)
- 
- # log files
- allow amavis_t amavis_var_log_t:dir setattr;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-2.6.2/policy/modules/services/apache.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-2.6.3/policy/modules/services/apache.fc
 --- nsaserefpolicy/policy/modules/services/apache.fc	2007-02-23 16:50:01.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/apache.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/apache.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -1,10 +1,5 @@
  # temporary hack till genhomedircon is fixed
 -ifdef(`targeted_policy',`
@@ -1992,9 +2039,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
 +#viewvc file context
 +/var/spool/viewvc(/.*)?  		gen_context(system_u:object_r:httpd_sys_script_rw_t, s0)
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-2.6.2/policy/modules/services/apache.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-2.6.3/policy/modules/services/apache.if
 --- nsaserefpolicy/policy/modules/services/apache.if	2007-04-02 10:58:34.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/apache.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/apache.if	2007-05-04 12:31:34.000000000 -0400
 @@ -18,10 +18,6 @@
  		attribute httpd_script_exec_type;
  		type httpd_t, httpd_suexec_t, httpd_log_t;
@@ -2213,9 +2260,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
 +	allow $1 httpd_bugzilla_content_t:dir search_dir_perms;
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-2.6.2/policy/modules/services/apache.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-2.6.3/policy/modules/services/apache.te
 --- nsaserefpolicy/policy/modules/services/apache.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/apache.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/apache.te	2007-05-04 12:31:34.000000000 -0400
 @@ -106,6 +106,27 @@
  ## </desc>
  gen_tunable(httpd_unified,false)
@@ -2379,9 +2426,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
 +	postgresql_stream_connect(httpd_bugzilla_script_t)
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-2.6.2/policy/modules/services/apcupsd.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-2.6.3/policy/modules/services/apcupsd.fc
 --- nsaserefpolicy/policy/modules/services/apcupsd.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/apcupsd.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/apcupsd.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -0,0 +1,9 @@
 +
 +/usr/sbin/apcupsd		--	gen_context(system_u:object_r:apcupsd_exec_t,s0)
@@ -2392,9 +2439,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
 +/var/www/apcupsd/upsfstats.cgi		--	gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
 +/var/www/apcupsd/upsimage.cgi		--	gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
 +/var/www/apcupsd/upsstats.cgi		--	gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-2.6.2/policy/modules/services/apcupsd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-2.6.3/policy/modules/services/apcupsd.if
 --- nsaserefpolicy/policy/modules/services/apcupsd.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/apcupsd.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/apcupsd.if	2007-05-04 12:31:34.000000000 -0400
 @@ -0,0 +1,108 @@
 +
 +## <summary>policy for apcupsd</summary>
@@ -2504,9 +2551,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
 +	allow httpd_apcupsd_cgi_script_t $1:fifo_file rw_file_perms;
 +	allow httpd_apcupsd_cgi_script_t $1:process sigchld;
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-2.6.2/policy/modules/services/apcupsd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-2.6.3/policy/modules/services/apcupsd.te
 --- nsaserefpolicy/policy/modules/services/apcupsd.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/apcupsd.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/apcupsd.te	2007-05-04 12:31:34.000000000 -0400
 @@ -0,0 +1,92 @@
 +policy_module(apcupsd,1.0.0)
 +
@@ -2600,9 +2647,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
 +corenet_udp_sendrecv_all_nodes(httpd_apcupsd_cgi_script_t)
 +corenet_udp_sendrecv_all_ports(httpd_apcupsd_cgi_script_t)
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-2.6.2/policy/modules/services/automount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-2.6.3/policy/modules/services/automount.te
 --- nsaserefpolicy/policy/modules/services/automount.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/automount.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/automount.te	2007-05-04 12:31:34.000000000 -0400
 @@ -69,6 +69,7 @@
  files_mounton_all_mountpoints(automount_t)
  files_mount_all_file_type_fs(automount_t)
@@ -2619,46 +2666,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto
  dev_read_urand(automount_t)
  
  domain_use_interactive_fds(automount_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.if serefpolicy-2.6.2/policy/modules/services/avahi.if
---- nsaserefpolicy/policy/modules/services/avahi.if	2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/avahi.if	2007-04-30 11:26:06.000000000 -0400
-@@ -39,3 +39,22 @@
- 	files_search_pids($1)
- 	stream_connect_pattern($1,avahi_var_run_t,avahi_var_run_t,avahi_t)
- ')
-+
-+########################################
-+## <summary>
-+##	Do not audit attempts to search the AVAHI pid directory.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`avahi_dontaudit_search_pid',`
-+	gen_require(`
-+		type avahi_var_run_t;
-+	')
-+
-+	dontaudit $1 avahi_var_run_t:dir search_dir_perms;
-+')
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-2.6.2/policy/modules/services/avahi.te
---- nsaserefpolicy/policy/modules/services/avahi.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/avahi.te	2007-04-30 11:26:06.000000000 -0400
-@@ -105,3 +105,7 @@
- optional_policy(`
- 	udev_read_db(avahi_t)
- ')
-+
-+optional_policy(`
-+	samba_stream_connect_winbind(avahi_t)
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-2.6.2/policy/modules/services/bind.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-2.6.3/policy/modules/services/bind.te
 --- nsaserefpolicy/policy/modules/services/bind.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/bind.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/bind.te	2007-05-04 12:31:34.000000000 -0400
 @@ -236,6 +236,7 @@
  corenet_tcp_sendrecv_all_nodes(ndc_t)
  corenet_tcp_sendrecv_all_ports(ndc_t)
@@ -2667,9 +2677,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind
  corenet_sendrecv_rndc_client_packets(ndc_t)
  
  fs_getattr_xattr_fs(ndc_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-2.6.2/policy/modules/services/clamav.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-2.6.3/policy/modules/services/clamav.te
 --- nsaserefpolicy/policy/modules/services/clamav.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/clamav.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/clamav.te	2007-05-04 12:31:34.000000000 -0400
 @@ -126,6 +126,7 @@
  	amavis_read_lib_files(clamd_t)
  	amavis_read_spool_files(clamd_t)
@@ -2678,36 +2688,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam
  ')
  
  ########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-2.6.2/policy/modules/services/consolekit.te
---- nsaserefpolicy/policy/modules/services/consolekit.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/consolekit.te	2007-04-30 11:26:06.000000000 -0400
-@@ -19,14 +19,13 @@
- # consolekit local policy
- #
- 
--allow consolekit_t self:capability { sys_tty_config dac_override sys_nice sys_ptrace };
-+allow consolekit_t self:capability { setuid setgid sys_tty_config dac_override sys_nice sys_ptrace };
- allow consolekit_t self:process { getsched signal };
- allow consolekit_t self:fifo_file rw_fifo_file_perms;
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-2.6.3/policy/modules/services/consolekit.te
+--- nsaserefpolicy/policy/modules/services/consolekit.te	2007-05-04 12:19:22.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/consolekit.te	2007-05-04 13:09:02.000000000 -0400
+@@ -10,7 +10,6 @@
+ type consolekit_exec_t;
+ init_daemon_domain(consolekit_t, consolekit_exec_t)
+ 
+-# pid files
+ type consolekit_var_run_t;
+ files_pid_file(consolekit_var_run_t)
+ 
+@@ -25,7 +24,6 @@
  allow consolekit_t self:unix_stream_socket create_stream_socket_perms;
-+allow consolekit_t self:unix_dgram_socket create_socket_perms;
+ allow consolekit_t self:unix_dgram_socket create_socket_perms;
  
 -# pid file
--manage_files_pattern(consolekit_t,consolekit_var_run_t,consolekit_var_run_t)
--files_pid_filetrans(consolekit_t,consolekit_var_run_t, file)
-+corecmd_exec_bin(consolekit_t)
- 
- dev_read_urand(consolekit_t)
- dev_read_sysfs(consolekit_t)
-@@ -38,18 +37,34 @@
- # needs to read /var/lib/dbus/machine-id
- files_read_var_lib_files(consolekit_t)
- 
--term_use_console(consolekit_t)
-+fs_list_inotifyfs(consolekit_t)
-+
-+kernel_read_system_state(consolekit_t)
+ manage_files_pattern(consolekit_t,consolekit_var_run_t,consolekit_var_run_t)
+ files_pid_filetrans(consolekit_t,consolekit_var_run_t, file)
  
+@@ -50,8 +48,15 @@
  libs_use_ld_so(consolekit_t)
  libs_use_shared_libs(consolekit_t)
  
@@ -2715,47 +2715,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons
 +
  miscfiles_read_localization(consolekit_t)
  
-+term_use_all_terms(consolekit_t)
-+
-+manage_files_pattern(consolekit_t,consolekit_var_run_t,consolekit_var_run_t)
-+files_pid_filetrans(consolekit_t,consolekit_var_run_t, file)
-+
- ifdef(`targeted_policy',`
--	term_dontaudit_use_unallocated_ttys(consolekit_t)
--	term_dontaudit_use_generic_ptys(consolekit_t)
-+	term_use_unallocated_ttys(consolekit_t)
-+	term_use_generic_ptys(consolekit_t)
-+	#reading .Xauthity
-+	userdom_read_generic_user_home_content_files(consolekit_t)
- ')
- 
-+# Init script handling
-+
-+domain_ptrace_all_domains(consolekit_t)
++# consolekit needs to be able to ptrace all logged in users 
++userdom_ptrace_all_users(consolekit_t)
++hal_ptrace(consolekit_t)
 +mcs_ptrace_all(consolekit_t)
 +
  optional_policy(`
  	dbus_system_bus_client_template(consolekit, consolekit_t)
  	dbus_send_system_bus(consolekit_t)
-@@ -61,3 +76,7 @@
- 		unconfined_dbus_chat(consolekit_t)
- 	')
+@@ -68,3 +73,9 @@
+ 	xserver_read_all_users_xauth(consolekit_t)
+ 	xserver_stream_connect_xdm_xserver(consolekit_t)
  ')
 +
-+optional_policy(`
-+	xserver_stream_connect_xdm_xserver(consolekit_t)
++ifdef(`targeted_policy',`
++	#reading .Xauthity
++	unconfined_ptrace(consolekit_t)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-2.6.2/policy/modules/services/cron.fc
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-2.6.3/policy/modules/services/cron.fc
 --- nsaserefpolicy/policy/modules/services/cron.fc	2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/cron.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/cron.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -45,3 +45,4 @@
  /var/spool/fcron/systab\.orig	--	gen_context(system_u:object_r:system_cron_spool_t,s0)
  /var/spool/fcron/systab		--	gen_context(system_u:object_r:system_cron_spool_t,s0)
  /var/spool/fcron/new\.systab	--	gen_context(system_u:object_r:system_cron_spool_t,s0)
 +/var/lib/misc(/.*)?			gen_context(system_u:object_r:crond_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-2.6.2/policy/modules/services/cron.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-2.6.3/policy/modules/services/cron.if
 --- nsaserefpolicy/policy/modules/services/cron.if	2007-03-26 10:39:05.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/cron.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/cron.if	2007-05-04 12:31:34.000000000 -0400
 @@ -35,6 +35,7 @@
  #
  template(`cron_per_role_template',`
@@ -2864,9 +2852,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
  
  	tunable_policy(`fcron_crond',`
  		# fcron wants an instant update of a crontab change for the administrator
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-2.6.2/policy/modules/services/cron.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-2.6.3/policy/modules/services/cron.te
 --- nsaserefpolicy/policy/modules/services/cron.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/cron.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/cron.te	2007-05-04 12:31:34.000000000 -0400
 @@ -42,6 +42,9 @@
  type cron_log_t;
  logging_log_file(cron_log_t)
@@ -3004,9 +2992,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
  		mrtg_append_create_logs(system_crond_t)
  	')
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-2.6.2/policy/modules/services/cups.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-2.6.3/policy/modules/services/cups.fc
+--- nsaserefpolicy/policy/modules/services/cups.fc	2006-11-16 17:15:21.000000000 -0500
++++ serefpolicy-2.6.3/policy/modules/services/cups.fc	2007-05-04 12:31:34.000000000 -0400
+@@ -8,6 +8,7 @@
+ /etc/cups/ppd/.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+ /etc/cups/ppds\.dat	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+ /etc/cups/printers\.conf.* --	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
++/etc/cups/subscriptions.*  --	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+ /etc/cups/certs		-d	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+ /etc/cups/certs/.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+ 
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-2.6.3/policy/modules/services/cups.te
 --- nsaserefpolicy/policy/modules/services/cups.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/cups.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/cups.te	2007-05-04 12:31:34.000000000 -0400
 @@ -93,8 +93,6 @@
  # generic socket here until appletalk socket is available in kernels
  allow cupsd_t self:socket create_socket_perms;
@@ -3058,9 +3057,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
  	seutil_sigchld_newrole(cupsd_t)
  ')
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-2.6.2/policy/modules/services/cvs.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-2.6.3/policy/modules/services/cvs.te
 --- nsaserefpolicy/policy/modules/services/cvs.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/cvs.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/cvs.te	2007-05-04 12:31:34.000000000 -0400
 @@ -16,6 +16,7 @@
  type cvs_t;
  type cvs_exec_t;
@@ -3069,9 +3068,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.
  role system_r types cvs_t;
  
  type cvs_data_t; # customizable
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-2.6.2/policy/modules/services/cyrus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-2.6.3/policy/modules/services/cyrus.te
 --- nsaserefpolicy/policy/modules/services/cyrus.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/cyrus.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/cyrus.te	2007-05-04 12:31:34.000000000 -0400
 @@ -145,6 +145,7 @@
  
  optional_policy(`
@@ -3080,9 +3079,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru
  ')
  
  optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-2.6.2/policy/modules/services/dbus.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-2.6.3/policy/modules/services/dbus.if
 --- nsaserefpolicy/policy/modules/services/dbus.if	2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/dbus.if	2007-04-30 13:30:42.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/dbus.if	2007-05-04 12:31:34.000000000 -0400
 @@ -49,6 +49,12 @@
  ## </param>
  #
@@ -3202,9 +3201,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
 +')
 +
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-2.6.2/policy/modules/services/dbus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-2.6.3/policy/modules/services/dbus.te
 --- nsaserefpolicy/policy/modules/services/dbus.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/dbus.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/dbus.te	2007-05-04 12:31:34.000000000 -0400
 @@ -40,8 +40,6 @@
  # Receive notifications of policy reloads and enforcing status changes.
  allow system_dbusd_t self:netlink_selinux_socket { create bind read };
@@ -3233,9 +3232,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  	sysnet_domtrans_dhcpc(system_dbusd_t)
  ')
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-2.6.2/policy/modules/services/dhcp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-2.6.3/policy/modules/services/dhcp.te
 --- nsaserefpolicy/policy/modules/services/dhcp.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/dhcp.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/dhcp.te	2007-05-04 12:31:34.000000000 -0400
 @@ -119,6 +119,8 @@
  	dbus_system_bus_client_template(dhcpd,dhcpd_t)
  	dbus_connect_system_bus(dhcpd_t)
@@ -3245,9 +3244,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp
  ')
  
  optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-2.6.2/policy/modules/services/djbdns.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-2.6.3/policy/modules/services/djbdns.te
 --- nsaserefpolicy/policy/modules/services/djbdns.te	2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/djbdns.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/djbdns.te	2007-05-04 12:31:34.000000000 -0400
 @@ -44,4 +44,7 @@
  libs_use_ld_so(djbdns_axfrdns_t)
  libs_use_shared_libs(djbdns_axfrdns_t)
@@ -3257,9 +3256,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbd
 +	ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-2.6.2/policy/modules/services/dovecot.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-2.6.3/policy/modules/services/dovecot.fc
 --- nsaserefpolicy/policy/modules/services/dovecot.fc	2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/dovecot.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/dovecot.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -17,10 +17,12 @@
  
  ifdef(`distro_debian', `
@@ -3273,9 +3272,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
  ')
  
  #
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-2.6.2/policy/modules/services/dovecot.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-2.6.3/policy/modules/services/dovecot.if
 --- nsaserefpolicy/policy/modules/services/dovecot.if	2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/dovecot.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/dovecot.if	2007-05-04 12:31:34.000000000 -0400
 @@ -18,3 +18,43 @@
  	manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
  	manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
@@ -3320,9 +3319,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
 +	domtrans_pattern($1,dovecot_deliver_exec_t,dovecot_deliver_t)
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-2.6.2/policy/modules/services/dovecot.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-2.6.3/policy/modules/services/dovecot.te
 --- nsaserefpolicy/policy/modules/services/dovecot.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/dovecot.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/dovecot.te	2007-05-04 12:31:34.000000000 -0400
 @@ -15,6 +15,12 @@
  domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t)
  role system_r types dovecot_auth_t;
@@ -3444,9 +3443,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
 +	term_dontaudit_use_unallocated_ttys(dovecot_deliver_t)
 +	term_dontaudit_use_generic_ptys(dovecot_deliver_t)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-2.6.2/policy/modules/services/ftp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-2.6.3/policy/modules/services/ftp.te
 --- nsaserefpolicy/policy/modules/services/ftp.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/ftp.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/ftp.te	2007-05-04 12:31:34.000000000 -0400
 @@ -223,10 +223,15 @@
  	userdom_manage_all_users_home_content_dirs(ftpd_t)
  	userdom_manage_all_users_home_content_files(ftpd_t)
@@ -3463,9 +3462,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
  ')
  
  tunable_policy(`ftp_home_dir && use_nfs_home_dirs',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-2.6.2/policy/modules/services/hal.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-2.6.3/policy/modules/services/hal.fc
 --- nsaserefpolicy/policy/modules/services/hal.fc	2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/hal.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/hal.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -8,4 +8,12 @@
  
  /var/lib/hal(/.*)?				gen_context(system_u:object_r:hald_var_lib_t,s0)
@@ -3479,10 +3478,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
 +/usr/libexec/hal-system-sonypic	 --	gen_context(system_u:object_r:hald_sonypic_exec_t,s0)
 +
 +/var/log/pm-suspend.log				gen_context(system_u:object_r:hald_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-2.6.2/policy/modules/services/hal.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-2.6.3/policy/modules/services/hal.if
 --- nsaserefpolicy/policy/modules/services/hal.if	2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/hal.if	2007-04-30 11:26:06.000000000 -0400
-@@ -208,3 +208,80 @@
++++ serefpolicy-2.6.3/policy/modules/services/hal.if	2007-05-04 13:08:40.000000000 -0400
+@@ -208,3 +208,98 @@
  	files_search_pids($1)
  	allow $1 hald_var_run_t:file rw_file_perms;
  ')
@@ -3563,9 +3562,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
 +	allow $1 hald_t:fifo_file rw_fifo_file_perms; 
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-2.6.2/policy/modules/services/hal.te
++########################################
++## <summary>
++##	Allow ptrace of hal domain
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`hal_ptrace',`
++	gen_require(`
++		type hald_t;
++	')
++
++	allow $1 hald_t:process ptrace;
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-2.6.3/policy/modules/services/hal.te
 --- nsaserefpolicy/policy/modules/services/hal.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/hal.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/hal.te	2007-05-04 12:31:34.000000000 -0400
 @@ -16,9 +16,33 @@
  type hald_var_run_t;
  files_pid_file(hald_var_run_t)
@@ -3808,9 +3825,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
 +	term_dontaudit_use_console(hald_sonypic_t)
 +	term_dontaudit_use_generic_ptys(hald_sonypic_t)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-2.6.2/policy/modules/services/inetd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-2.6.3/policy/modules/services/inetd.te
 --- nsaserefpolicy/policy/modules/services/inetd.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/inetd.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/inetd.te	2007-05-04 12:31:34.000000000 -0400
 @@ -135,8 +135,8 @@
  mls_fd_use_all_levels(inetd_t)
  mls_fd_share_all_levels(inetd_t)
@@ -3831,9 +3848,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
  files_search_home(inetd_child_t)
  
  manage_dirs_pattern(inetd_child_t,inetd_child_tmp_t,inetd_child_tmp_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-2.6.2/policy/modules/services/kerberos.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-2.6.3/policy/modules/services/kerberos.if
 --- nsaserefpolicy/policy/modules/services/kerberos.if	2007-04-10 13:21:52.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/kerberos.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/kerberos.if	2007-05-04 12:31:34.000000000 -0400
 @@ -33,43 +33,10 @@
  #
  interface(`kerberos_use',`
@@ -3980,9 +3997,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
 -
 +	allow $1 krb5_keytab_t:file read_file_perms;
  ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-2.6.2/policy/modules/services/kerberos.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-2.6.3/policy/modules/services/kerberos.te
 --- nsaserefpolicy/policy/modules/services/kerberos.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/kerberos.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/kerberos.te	2007-05-04 12:31:34.000000000 -0400
 @@ -5,6 +5,7 @@
  #
  # Declarations
@@ -4028,9 +4045,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
 +		pcscd_stream_connect(kerberosclient)
 +	')
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-2.6.2/policy/modules/services/mailman.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-2.6.3/policy/modules/services/mailman.if
 --- nsaserefpolicy/policy/modules/services/mailman.if	2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/mailman.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/mailman.if	2007-05-04 12:31:34.000000000 -0400
 @@ -275,6 +275,25 @@
  
  #######################################
@@ -4057,9 +4074,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail
  ##	Allow domain to read mailman archive files.
  ## </summary>
  ## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-2.6.2/policy/modules/services/mta.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-2.6.3/policy/modules/services/mta.if
 --- nsaserefpolicy/policy/modules/services/mta.if	2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/mta.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/mta.if	2007-05-04 12:31:34.000000000 -0400
 @@ -847,6 +847,25 @@
  	manage_files_pattern($1,mqueue_spool_t,mqueue_spool_t)
  ')
@@ -4086,9 +4103,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
  #######################################
  ## <summary>
  ##	Read sendmail binary.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-2.6.2/policy/modules/services/mta.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-2.6.3/policy/modules/services/mta.te
 --- nsaserefpolicy/policy/modules/services/mta.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/mta.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/mta.te	2007-05-04 12:31:34.000000000 -0400
 @@ -27,6 +27,7 @@
  
  type sendmail_exec_t;
@@ -4105,9 +4122,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
  
  	# apache should set close-on-exec
  	apache_dontaudit_append_log(system_mail_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.6.2/policy/modules/services/nis.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.6.3/policy/modules/services/nis.if
 --- nsaserefpolicy/policy/modules/services/nis.if	2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/nis.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/nis.if	2007-05-04 12:31:34.000000000 -0400
 @@ -48,8 +48,8 @@
  	corenet_udp_bind_all_nodes($1)
  	corenet_tcp_bind_generic_port($1)
@@ -4119,10 +4136,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
  	corenet_dontaudit_tcp_bind_all_ports($1)
  	corenet_dontaudit_udp_bind_all_ports($1)
  	corenet_tcp_connect_portmap_port($1)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-2.6.2/policy/modules/services/nis.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-2.6.3/policy/modules/services/nis.te
 --- nsaserefpolicy/policy/modules/services/nis.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/nis.te	2007-04-30 11:26:06.000000000 -0400
-@@ -258,6 +258,8 @@
++++ serefpolicy-2.6.3/policy/modules/services/nis.te	2007-05-04 12:31:34.000000000 -0400
+@@ -120,6 +120,13 @@
+ ')
+ 
+ optional_policy(`
++	dbus_system_bus_client_template(ypbind,ypbind_t)
++	dbus_connect_system_bus(ypbind_t)
++	dbus_send_system_bus(ypbind_t)
++	init_dbus_chat_script(ypbind_t)
++')
++
++optional_policy(`
+ 	seutil_sigchld_newrole(ypbind_t)
+ ')
+ 
+@@ -258,6 +265,8 @@
  corenet_udp_bind_all_nodes(ypserv_t)
  corenet_tcp_bind_reserved_port(ypserv_t)
  corenet_udp_bind_reserved_port(ypserv_t)
@@ -4131,7 +4162,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
  corenet_dontaudit_tcp_bind_all_reserved_ports(ypserv_t)
  corenet_dontaudit_udp_bind_all_reserved_ports(ypserv_t)
  corenet_sendrecv_generic_server_packets(ypserv_t)
-@@ -332,6 +334,8 @@
+@@ -332,6 +341,8 @@
  corenet_udp_bind_all_nodes(ypxfr_t)
  corenet_tcp_bind_reserved_port(ypxfr_t)
  corenet_udp_bind_reserved_port(ypxfr_t)
@@ -4140,9 +4171,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
  corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)
  corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t)
  corenet_tcp_connect_all_ports(ypxfr_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-2.6.2/policy/modules/services/nscd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-2.6.3/policy/modules/services/nscd.te
 --- nsaserefpolicy/policy/modules/services/nscd.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/nscd.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/nscd.te	2007-05-04 12:31:34.000000000 -0400
 @@ -28,14 +28,14 @@
  # Local policy
  #
@@ -4181,9 +4212,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd
 +	')
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-2.6.2/policy/modules/services/ntp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-2.6.3/policy/modules/services/ntp.te
 --- nsaserefpolicy/policy/modules/services/ntp.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/ntp.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/ntp.te	2007-05-04 12:31:34.000000000 -0400
 @@ -137,6 +137,10 @@
  ')
  
@@ -4195,9 +4226,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
  	seutil_sigchld_newrole(ntpd_t)
  ')
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-2.6.2/policy/modules/services/oddjob.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-2.6.3/policy/modules/services/oddjob.te
 --- nsaserefpolicy/policy/modules/services/oddjob.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/oddjob.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/oddjob.te	2007-05-04 12:31:34.000000000 -0400
 @@ -27,7 +27,7 @@
  # oddjob local policy
  #
@@ -4207,9 +4238,203 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj
  allow oddjob_t self:process { setexec signal };
  allow oddjob_t self:fifo_file { read write };
  allow oddjob_t self:unix_stream_socket create_stream_socket_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-2.6.2/policy/modules/services/pcscd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.fc serefpolicy-2.6.3/policy/modules/services/openct.fc
+--- nsaserefpolicy/policy/modules/services/openct.fc	2006-11-16 17:15:20.000000000 -0500
++++ serefpolicy-2.6.3/policy/modules/services/openct.fc	2007-05-04 12:31:34.000000000 -0400
+@@ -1,9 +1,3 @@
+-#
+-# /usr
+-#
+-/usr/sbin/openct-control	 --	gen_context(system_u:object_r:openct_exec_t,s0)
+ 
+-#
+-# /var
+-#
+-/var/run/openct(/.*)?		gen_context(system_u:object_r:openct_var_run_t,s0)
++/usr/sbin/ifdhandler		--	gen_context(system_u:object_r:openct_exec_t,s0)
++/var/run/openct(/.*)?			gen_context(system_u:object_r:openct_var_run_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.if serefpolicy-2.6.3/policy/modules/services/openct.if
+--- nsaserefpolicy/policy/modules/services/openct.if	2006-11-16 17:15:20.000000000 -0500
++++ serefpolicy-2.6.3/policy/modules/services/openct.if	2007-05-04 12:31:34.000000000 -0400
+@@ -1 +1,83 @@
+-## <summary>Service for handling smart card readers.</summary>
++
++## <summary>policy for openct</summary>
++
++########################################
++## <summary>
++##	Execute a domain transition to run openct.
++## </summary>
++## <param name="domain">
++## <summary>
++##	Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`openct_domtrans',`
++	gen_require(`
++		type openct_t, openct_exec_t;
++	')
++
++	domain_auto_trans($1,openct_exec_t,openct_t)
++
++	allow openct_t $1:fd use;
++	allow openct_t $1:fifo_file rw_file_perms;
++	allow openct_t $1:process sigchld;
++')
++
++########################################
++## <summary>
++##	Read openct PID files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`openct_read_pid_files',`
++	gen_require(`
++		type openct_var_run_t;
++	')
++
++	files_search_pids($1)
++	allow $1 openct_var_run_t:dir search_dir_perms;
++	allow $1 openct_var_run_t:file r_file_perms;
++')
++
++########################################
++## <summary>
++##	Connect to openct over an unix stream socket.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`openct_stream_connect',`
++	gen_require(`
++		type openct_t, openct_var_run_t;
++	')
++
++	files_search_pids($1)
++	allow $1 openct_var_run_t:dir search_dir_perms;
++	allow $1 openct_var_run_t:sock_file write;
++	allow $1 openct_t:unix_stream_socket connectto;
++')
++
++########################################
++## <summary>
++##	Send openct a null signal.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`openct_signull',`
++	gen_require(`
++		type openct_t;
++	')
++
++	allow $1 openct_t:process signull;
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-2.6.3/policy/modules/services/openct.te
+--- nsaserefpolicy/policy/modules/services/openct.te	2007-04-23 09:36:01.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/openct.te	2007-05-04 12:31:34.000000000 -0400
+@@ -1,5 +1,4 @@
+-
+-policy_module(openct,1.1.0)
++policy_module(openct,1.0.0)
+ 
+ ########################################
+ #
+@@ -8,58 +7,48 @@
+ 
+ type openct_t;
+ type openct_exec_t;
+-init_daemon_domain(openct_t,openct_exec_t)
++domain_type(openct_t)
++init_daemon_domain(openct_t, openct_exec_t)
+ 
+ type openct_var_run_t;
+ files_pid_file(openct_var_run_t)
+ 
+ ########################################
+ #
+-# Local policy
++# openct local policy
+ #
+ 
+-dontaudit openct_t self:capability sys_tty_config;
+-allow openct_t self:process signal_perms;
+-
+-manage_files_pattern(openct_t,openct_var_run_t,openct_var_run_t)
+-files_pid_filetrans(openct_t,openct_var_run_t,file)
+-
+-kernel_read_kernel_sysctls(openct_t)
+-kernel_list_proc(openct_t)
+-kernel_read_proc_symlinks(openct_t)
+-
+-dev_read_sysfs(openct_t)
+-# openct asks for this
+-dev_rw_usbfs(openct_t)
+-
++# Init script handling
++init_use_fds(openct_t)
++init_use_script_ptys(openct_t)
+ domain_use_interactive_fds(openct_t)
+ 
+-# openct asks for this
+-files_read_etc_files(openct_t)
++## internal communication is often done using fifo and unix sockets.
++allow openct_t self:fifo_file rw_file_perms;
++allow openct_t self:unix_stream_socket create_stream_socket_perms;
+ 
+-fs_getattr_all_fs(openct_t)
+-fs_search_auto_mountpoints(openct_t)
++files_read_etc_files(openct_t)
+ 
+ libs_use_ld_so(openct_t)
+ libs_use_shared_libs(openct_t)
+ 
+-logging_send_syslog_msg(openct_t)
+-
+ miscfiles_read_localization(openct_t)
+ 
+-userdom_dontaudit_use_unpriv_user_fds(openct_t)
+-userdom_dontaudit_search_sysadm_home_dirs(openct_t)
+-
+ ifdef(`targeted_policy',`
+ 	term_dontaudit_use_unallocated_ttys(openct_t)
+ 	term_dontaudit_use_generic_ptys(openct_t)
+-	files_dontaudit_read_root_files(openct_t)
+ ')
+ 
+-optional_policy(`
+-	seutil_sigchld_newrole(openct_t)
+-')
++allow openct_t openct_var_run_t:file manage_file_perms;
++allow openct_t openct_var_run_t:dir manage_dir_perms;
++allow openct_t openct_var_run_t:sock_file manage_file_perms;
++files_pid_filetrans(openct_t,openct_var_run_t, { file dir })
++
++logging_send_syslog_msg(openct_t)
++
++dev_rw_smartcard(openct_t)
++dev_search_sysfs(openct_t)
++dev_rw_generic_usb_dev(openct_t)
++
++
+ 
+-optional_policy(`
+-	udev_read_db(openct_t)
+-')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-2.6.3/policy/modules/services/pcscd.te
 --- nsaserefpolicy/policy/modules/services/pcscd.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/pcscd.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/pcscd.te	2007-05-04 12:31:34.000000000 -0400
 @@ -21,6 +21,7 @@
  #
  
@@ -4218,9 +4443,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcsc
  allow pcscd_t self:fifo_file { read write };
  allow pcscd_t self:unix_stream_socket create_stream_socket_perms;
  allow pcscd_t self:unix_dgram_socket create_socket_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-2.6.2/policy/modules/services/pegasus.if
+@@ -62,5 +63,13 @@
+ ')
+ 
+ optional_policy(`
++	openct_stream_connect(pcscd_t)
++	openct_read_pid_files(pcscd_t)
++	openct_signull(pcscd_t)
++')
++
++optional_policy(`
+ 	rpm_use_script_fds(pcscd_t)
+ ')
++
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-2.6.3/policy/modules/services/pegasus.if
 --- nsaserefpolicy/policy/modules/services/pegasus.if	2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/pegasus.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/pegasus.if	2007-05-04 12:31:34.000000000 -0400
 @@ -1 +1,19 @@
  ## <summary>The Open Group Pegasus CIM/WBEM Server.</summary>
 +
@@ -4241,9 +4480,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
 +
 +	domtrans_pattern($1,pegasus_exec_t,pegasus_t)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-2.6.2/policy/modules/services/pegasus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-2.6.3/policy/modules/services/pegasus.te
 --- nsaserefpolicy/policy/modules/services/pegasus.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/pegasus.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/pegasus.te	2007-05-04 12:31:34.000000000 -0400
 @@ -38,8 +38,6 @@
  allow pegasus_t self:unix_stream_socket create_stream_socket_perms;
  allow pegasus_t self:tcp_socket create_stream_socket_perms;
@@ -4285,9 +4524,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
  ')
  
  optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-2.6.2/policy/modules/services/postfix.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-2.6.3/policy/modules/services/postfix.if
 --- nsaserefpolicy/policy/modules/services/postfix.if	2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/postfix.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/postfix.if	2007-05-04 12:31:34.000000000 -0400
 @@ -122,6 +122,7 @@
  	allow postfix_$1_t postfix_master_t:unix_stream_socket { connectto rw_stream_socket_perms };
  	allow postfix_$1_t self:tcp_socket create_socket_perms;
@@ -4319,9 +4558,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
 +	allow $1 postfix_private_t:dir list_dir_perms;
 +	create_sock_files_pattern($1,postfix_private_t,postfix_private_t)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-2.6.2/policy/modules/services/postfix.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-2.6.3/policy/modules/services/postfix.te
 --- nsaserefpolicy/policy/modules/services/postfix.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/postfix.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/postfix.te	2007-05-04 12:31:34.000000000 -0400
 @@ -169,6 +169,8 @@
  mta_rw_aliases(postfix_master_t)
  mta_read_sendmail_bin(postfix_master_t)
@@ -4431,9 +4670,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
 +	dovecot_auth_stream_connect(postfix_smtpd_t)
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-2.6.2/policy/modules/services/ppp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-2.6.3/policy/modules/services/ppp.te
 --- nsaserefpolicy/policy/modules/services/ppp.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/ppp.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/ppp.te	2007-05-04 12:31:34.000000000 -0400
 @@ -155,7 +155,7 @@
  
  files_exec_etc_files(pppd_t)
@@ -4443,9 +4682,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.
  files_dontaudit_write_etc_files(pppd_t)
  
  # for scripts
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-2.6.2/policy/modules/services/procmail.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-2.6.3/policy/modules/services/procmail.te
 --- nsaserefpolicy/policy/modules/services/procmail.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/procmail.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/procmail.te	2007-05-04 12:31:34.000000000 -0400
 @@ -10,6 +10,7 @@
  type procmail_exec_t;
  domain_type(procmail_t)
@@ -4471,9 +4710,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc
  ')
 +
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-2.6.2/policy/modules/services/pyzor.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-2.6.3/policy/modules/services/pyzor.te
 --- nsaserefpolicy/policy/modules/services/pyzor.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/pyzor.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/pyzor.te	2007-05-04 12:31:34.000000000 -0400
 @@ -54,6 +54,11 @@
  corenet_udp_sendrecv_all_nodes(pyzor_t)
  corenet_udp_sendrecv_all_ports(pyzor_t)
@@ -4502,9 +4741,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
  	spamassassin_read_spamd_tmp_files(pyzor_t)
  ')
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-2.6.2/policy/modules/services/radius.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-2.6.3/policy/modules/services/radius.te
 --- nsaserefpolicy/policy/modules/services/radius.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/radius.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/radius.te	2007-05-04 12:31:34.000000000 -0400
 @@ -130,3 +130,7 @@
  optional_policy(`
  	udev_read_db(radiusd_t)
@@ -4513,9 +4752,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi
 +optional_policy(`
 +	samba_read_var_files(radiusd_t)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-2.6.2/policy/modules/services/rlogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-2.6.3/policy/modules/services/rlogin.te
 --- nsaserefpolicy/policy/modules/services/rlogin.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rlogin.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rlogin.te	2007-05-04 12:31:34.000000000 -0400
 @@ -64,6 +64,7 @@
  fs_search_auto_mountpoints(rlogind_t)
  
@@ -4524,9 +4763,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog
  auth_rw_login_records(rlogind_t)
  auth_use_nsswitch(rlogind_t)
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.fc serefpolicy-2.6.2/policy/modules/services/rpcbind.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.fc serefpolicy-2.6.3/policy/modules/services/rpcbind.fc
 --- nsaserefpolicy/policy/modules/services/rpcbind.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/rpcbind.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rpcbind.fc	2007-05-04 12:31:34.000000000 -0400
 @@ -0,0 +1,6 @@
 +
 +/sbin/rpcbind		--	gen_context(system_u:object_r:rpcbind_exec_t,s0)
@@ -4534,9 +4773,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
 +/var/run/rpc.statd.pid		--	gen_context(system_u:object_r:rpcbind_var_run_t,s0)
 +/var/run/rpcbind.sock		--	gen_context(system_u:object_r:rpcbind_var_run_t,s0)
 +/var/lib/rpcbind(/.*)?			gen_context(system_u:object_r:rpcbind_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-2.6.2/policy/modules/services/rpcbind.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-2.6.3/policy/modules/services/rpcbind.if
 --- nsaserefpolicy/policy/modules/services/rpcbind.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/rpcbind.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rpcbind.if	2007-05-04 12:31:34.000000000 -0400
 @@ -0,0 +1,104 @@
 +
 +## <summary>policy for rpcbind</summary>
@@ -4642,9 +4881,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
 +	allow $1 rpcbind_var_lib_t:dir rw_dir_perms;
 +	files_search_var_lib($1)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-2.6.2/policy/modules/services/rpcbind.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-2.6.3/policy/modules/services/rpcbind.te
 --- nsaserefpolicy/policy/modules/services/rpcbind.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/rpcbind.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rpcbind.te	2007-05-04 12:31:35.000000000 -0400
 @@ -0,0 +1,83 @@
 +policy_module(rpcbind,1.0.0)
 +
@@ -4729,9 +4968,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
 +')
 +
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-2.6.2/policy/modules/services/rpc.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-2.6.3/policy/modules/services/rpc.if
 --- nsaserefpolicy/policy/modules/services/rpc.if	2007-03-20 23:38:10.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rpc.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rpc.if	2007-05-04 12:31:35.000000000 -0400
 @@ -89,8 +89,11 @@
  	# bind to arbitary unused ports
  	corenet_tcp_bind_generic_port($1_t)
@@ -4745,9 +4984,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
  
  	fs_rw_rpc_named_pipes($1_t) 
  	fs_search_auto_mountpoints($1_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-2.6.2/policy/modules/services/rpc.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-2.6.3/policy/modules/services/rpc.te
 --- nsaserefpolicy/policy/modules/services/rpc.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rpc.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rpc.te	2007-05-04 12:31:35.000000000 -0400
 @@ -79,6 +79,7 @@
  
  optional_policy(`
@@ -4764,9 +5003,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
  ')
  
  tunable_policy(`nfs_export_all_ro',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-2.6.2/policy/modules/services/rsync.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-2.6.3/policy/modules/services/rsync.te
 --- nsaserefpolicy/policy/modules/services/rsync.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rsync.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rsync.te	2007-05-04 12:31:35.000000000 -0400
 @@ -17,6 +17,7 @@
  type rsync_t;
  type rsync_exec_t;
@@ -4775,17 +5014,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn
  role system_r types rsync_t;
  
  type rsync_data_t;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-2.6.2/policy/modules/services/rwho.fc
---- nsaserefpolicy/policy/modules/services/rwho.fc	2007-04-30 22:35:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rwho.fc	2007-04-30 11:26:06.000000000 -0400
-@@ -1,3 +1,3 @@
--/usr/sbin/rwhod		--	gen_context(system_u:object_r:rwho_exec_t,s0)
- 
-+/usr/sbin/rwhod		--	gen_context(system_u:object_r:rwho_exec_t,s0)
- /var/spool/rwho(/.*)?		gen_context(system_u:object_r:rwho_spool_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-2.6.2/policy/modules/services/rwho.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-2.6.3/policy/modules/services/rwho.if
 --- nsaserefpolicy/policy/modules/services/rwho.if	2007-04-30 22:35:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rwho.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rwho.if	2007-05-04 12:31:35.000000000 -0400
 @@ -1 +1,84 @@
 -## <summary>Who is logged in on other machines?</summary>
 +
@@ -4872,79 +5103,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho
 +	allow $1 rwho_spool_t:dir rw_dir_perms;
 +	files_search_spool($1)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-2.6.2/policy/modules/services/rwho.te
---- nsaserefpolicy/policy/modules/services/rwho.te	2007-04-30 22:35:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rwho.te	2007-04-30 12:23:50.000000000 -0400
-@@ -1,4 +1,3 @@
--
- policy_module(rwho,1.0.0)
- 
- ########################################
-@@ -8,6 +7,7 @@
- 
- type rwho_t;
- type rwho_exec_t;
-+domain_type(rwho_t)
- init_daemon_domain(rwho_t, rwho_exec_t)
- 
- # var/spool files
-@@ -19,6 +19,7 @@
- # rwho local policy
- #
- 
-+#============= rwho_t ==============
- allow rwho_t self:capability sys_chroot;
- allow rwho_t self:unix_dgram_socket create;
- allow rwho_t self:fifo_file rw_file_perms;
-@@ -30,31 +31,31 @@
- allow rwho_t rwho_spool_t:file manage_file_perms;
- files_spool_filetrans(rwho_t,rwho_spool_t, { file dir })
- 
--kernel_read_system_state(rwho_t)
--
--corenet_non_ipsec_sendrecv(rwho_t)
--corenet_udp_sendrecv_all_if(rwho_t)
--corenet_udp_sendrecv_all_nodes(rwho_t)
--corenet_udp_sendrecv_all_ports(rwho_t)
--corenet_udp_bind_all_nodes(rwho_t)
--corenet_udp_bind_rwho_port(rwho_t)
--corenet_sendrecv_rwho_server_packets(rwho_t)
--
- domain_use_interactive_fds(rwho_t)
- 
- files_read_etc_files(rwho_t)
- 
- init_read_utmp(rwho_t)
- init_dontaudit_write_utmp(rwho_t)
-+init_use_fds(rwho_t)
-+init_use_script_ptys(rwho_t)
-+
-+kernel_read_system_state(rwho_t)
- 
- libs_use_ld_so(rwho_t)
- libs_use_shared_libs(rwho_t)
- 
- miscfiles_read_localization(rwho_t)
- 
-+# Default Networking
-+corenet_non_ipsec_sendrecv(rwho_t)
-+corenet_udp_sendrecv_all_if(rwho_t)
-+corenet_udp_sendrecv_all_nodes(rwho_t)
-+corenet_udp_sendrecv_all_ports(rwho_t)
-+corenet_udp_bind_all_nodes(rwho_t)
-+corenet_udp_bind_rwho_port(rwho_t)
-+
- sysnet_dns_name_resolve(rwho_t)
- 
--ifdef(`targeted_policy',`
--	term_dontaudit_use_unallocated_ttys(rwho_t)
--	term_dontaudit_use_generic_ptys(rwho_t)
--')
-+term_use_all_user_ttys(rwho_t)
-+term_use_all_user_ptys(rwho_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-2.6.2/policy/modules/services/samba.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-2.6.3/policy/modules/services/samba.fc
 --- nsaserefpolicy/policy/modules/services/samba.fc	2007-02-23 16:50:01.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/samba.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/samba.fc	2007-05-04 12:31:35.000000000 -0400
 @@ -27,6 +27,9 @@
  /var/cache/samba/winbindd_privileged(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0)
  
@@ -4955,9 +5116,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  
  /var/log/samba(/.*)?			gen_context(system_u:object_r:samba_log_t,s0)
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-2.6.2/policy/modules/services/samba.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-2.6.3/policy/modules/services/samba.if
 --- nsaserefpolicy/policy/modules/services/samba.if	2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/samba.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/samba.if	2007-05-04 12:31:35.000000000 -0400
 @@ -177,6 +177,27 @@
  
  ########################################
@@ -5074,9 +5235,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
 +')
 +
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-2.6.2/policy/modules/services/samba.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-2.6.3/policy/modules/services/samba.te
 --- nsaserefpolicy/policy/modules/services/samba.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/samba.te	2007-05-01 16:47:09.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/samba.te	2007-05-04 12:31:35.000000000 -0400
 @@ -28,10 +28,39 @@
  ## </desc>
  gen_tunable(samba_share_nfs,false)
@@ -5307,9 +5468,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
 +unconfined_domain(samba_unconfined_script_t)
 +
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-2.6.2/policy/modules/services/sasl.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-2.6.3/policy/modules/services/sasl.te
 --- nsaserefpolicy/policy/modules/services/sasl.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/sasl.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/sasl.te	2007-05-04 12:31:35.000000000 -0400
 @@ -63,6 +63,7 @@
  selinux_compute_access_vector(saslauthd_t)
  
@@ -5318,9 +5479,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl
  auth_use_nsswitch(saslauthd_t)
  
  domain_use_interactive_fds(saslauthd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-2.6.2/policy/modules/services/sendmail.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-2.6.3/policy/modules/services/sendmail.if
 --- nsaserefpolicy/policy/modules/services/sendmail.if	2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/sendmail.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/sendmail.if	2007-05-04 12:31:35.000000000 -0400
 @@ -76,6 +76,26 @@
  
  ########################################
@@ -5357,9 +5518,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
  ')
  
  ########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-2.6.2/policy/modules/services/smartmon.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-2.6.3/policy/modules/services/setroubleshoot.te
+--- nsaserefpolicy/policy/modules/services/setroubleshoot.te	2007-04-23 09:36:01.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/setroubleshoot.te	2007-05-04 12:31:35.000000000 -0400
+@@ -28,7 +28,7 @@
+ #
+ 
+ allow setroubleshootd_t self:capability { dac_override sys_tty_config };
+-allow setroubleshootd_t self:process { signal getattr getsched };
++allow setroubleshootd_t self:process { signull signal getattr getsched };
+ allow setroubleshootd_t self:fifo_file rw_fifo_file_perms;
+ allow setroubleshootd_t self:tcp_socket create_stream_socket_perms;
+ allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto };
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-2.6.3/policy/modules/services/smartmon.te
 --- nsaserefpolicy/policy/modules/services/smartmon.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/smartmon.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/smartmon.te	2007-05-04 12:31:35.000000000 -0400
 @@ -60,6 +60,7 @@
  fs_search_auto_mountpoints(fsdaemon_t)
  
@@ -5368,9 +5541,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar
  
  storage_raw_read_fixed_disk(fsdaemon_t)
  storage_raw_write_fixed_disk(fsdaemon_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-2.6.2/policy/modules/services/snmp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-2.6.3/policy/modules/services/snmp.te
 --- nsaserefpolicy/policy/modules/services/snmp.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/snmp.te	2007-04-30 12:22:26.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/snmp.te	2007-05-04 12:31:35.000000000 -0400
 @@ -26,7 +26,7 @@
  # Local policy
  #
@@ -5380,19 +5553,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp
  allow snmpd_t self:fifo_file rw_fifo_file_perms;
  allow snmpd_t self:unix_dgram_socket create_socket_perms;
  allow snmpd_t self:unix_stream_socket create_stream_socket_perms;
-@@ -134,6 +134,11 @@
+@@ -134,11 +134,12 @@
  ')
  
  optional_policy(`
+-	nis_use_ypbind(snmpd_t)
 +	mta_read_config(snmpd_t)
 +	mta_search_queue(snmpd_t)
-+')
-+
-+optional_policy(`
- 	nis_use_ypbind(snmpd_t)
  ')
  
-@@ -146,9 +151,19 @@
+ optional_policy(`
+-	nscd_socket_use(snmpd_t)
++	auth_use_nsswitch(snmpd_t)
+ ')
+ 
+ optional_policy(`
+@@ -146,9 +147,19 @@
  ')
  
  optional_policy(`
@@ -5412,9 +5588,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp
  ')
 +
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.6.2/policy/modules/services/spamassassin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.6.3/policy/modules/services/spamassassin.te
 --- nsaserefpolicy/policy/modules/services/spamassassin.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/spamassassin.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/spamassassin.te	2007-05-04 12:31:35.000000000 -0400
 @@ -6,14 +6,12 @@
  # Declarations
  #
@@ -5468,18 +5644,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
  	nis_use_ypbind(spamd_t)
  ')
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-2.6.2/policy/modules/services/squid.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-2.6.3/policy/modules/services/squid.fc
 --- nsaserefpolicy/policy/modules/services/squid.fc	2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/squid.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/squid.fc	2007-05-04 12:31:35.000000000 -0400
 @@ -12,3 +12,5 @@
  /var/run/squid\.pid	--	gen_context(system_u:object_r:squid_var_run_t,s0)
  
  /var/spool/squid(/.*)?		gen_context(system_u:object_r:squid_cache_t,s0)
 +/usr/lib/squid/cachemgr\.cgi	--	gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
 +/usr/lib64/squid/cachemgr\.cgi	--	gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-2.6.2/policy/modules/services/squid.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-2.6.3/policy/modules/services/squid.if
 --- nsaserefpolicy/policy/modules/services/squid.if	2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/squid.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/squid.if	2007-05-04 12:31:35.000000000 -0400
 @@ -36,7 +36,7 @@
  	')
  
@@ -5513,9 +5689,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
 +	dontaudit $1 squid_cache_t:dir search_dir_perms;
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-2.6.2/policy/modules/services/squid.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-2.6.3/policy/modules/services/squid.te
 --- nsaserefpolicy/policy/modules/services/squid.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/squid.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/squid.te	2007-05-04 12:31:35.000000000 -0400
 @@ -89,6 +89,8 @@
  corenet_tcp_bind_ftp_port(squid_t)
  corenet_tcp_bind_gopher_port(squid_t)
@@ -5546,9 +5722,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
 +	sysnet_read_config(httpd_squid_script_t)
 +	corenet_non_ipsec_sendrecv(httpd_squid_script_t)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-2.6.2/policy/modules/services/ssh.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-2.6.3/policy/modules/services/ssh.if
 --- nsaserefpolicy/policy/modules/services/ssh.if	2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/ssh.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/ssh.if	2007-05-04 12:31:35.000000000 -0400
 @@ -709,3 +709,42 @@
  
  	dontaudit $1 sshd_key_t:file { getattr read };
@@ -5592,9 +5768,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
 +	dontaudit $2 $1_ssh_agent_t:fd use;
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-2.6.2/policy/modules/services/ssh.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-2.6.3/policy/modules/services/ssh.te
 --- nsaserefpolicy/policy/modules/services/ssh.te	2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/ssh.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/ssh.te	2007-05-04 12:31:35.000000000 -0400
 @@ -24,11 +24,11 @@
  
  # Type for the ssh-agent executable.
@@ -5628,20 +5804,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
  ifdef(`TODO',`
  tunable_policy(`ssh_sysadm_login',`
  	# Relabel and access ptys created by sshd
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-2.6.2/policy/modules/services/w3c.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-2.6.3/policy/modules/services/w3c.fc
 --- nsaserefpolicy/policy/modules/services/w3c.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/w3c.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/w3c.fc	2007-05-04 12:31:35.000000000 -0400
 @@ -0,0 +1,2 @@
 +/usr/share/w3c-markup-validator(/.*)?		gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0)
 +/usr/share/w3c-markup-validator/cgi-bin(/.*)?	gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-2.6.2/policy/modules/services/w3c.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-2.6.3/policy/modules/services/w3c.if
 --- nsaserefpolicy/policy/modules/services/w3c.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/w3c.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/w3c.if	2007-05-04 12:31:35.000000000 -0400
 @@ -0,0 +1 @@
 +## <summary>W3C</summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-2.6.2/policy/modules/services/w3c.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-2.6.3/policy/modules/services/w3c.te
 --- nsaserefpolicy/policy/modules/services/w3c.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/w3c.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/w3c.te	2007-05-04 12:31:35.000000000 -0400
 @@ -0,0 +1,14 @@
 +policy_module(w3c,1.2.1)
 +
@@ -5657,14 +5833,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.
 +corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t)
 +
 +miscfiles_read_certs(httpd_w3c_validator_script_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-2.6.2/policy/modules/system/application.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-2.6.3/policy/modules/system/application.fc
 --- nsaserefpolicy/policy/modules/system/application.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/application.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/application.fc	2007-05-04 12:31:35.000000000 -0400
 @@ -0,0 +1 @@
 +# No application file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-2.6.2/policy/modules/system/application.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-2.6.3/policy/modules/system/application.if
 --- nsaserefpolicy/policy/modules/system/application.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/application.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/application.if	2007-05-04 12:31:35.000000000 -0400
 @@ -0,0 +1,104 @@
 +## <summary>Policy for application domains</summary>
 +
@@ -5770,9 +5946,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic
 +	application_executable_file($2)
 +	domain_entry_file($1,$2)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-2.6.2/policy/modules/system/application.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-2.6.3/policy/modules/system/application.te
 --- nsaserefpolicy/policy/modules/system/application.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/application.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/application.te	2007-05-04 12:31:35.000000000 -0400
 @@ -0,0 +1,14 @@
 +
 +policy_module(application,1.0.0)
@@ -5788,9 +5964,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic
 +	ssh_rw_stream_sockets(application_domain_type)
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-2.6.2/policy/modules/system/authlogin.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-2.6.3/policy/modules/system/authlogin.fc
 --- nsaserefpolicy/policy/modules/system/authlogin.fc	2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/authlogin.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/authlogin.fc	2007-05-04 12:31:35.000000000 -0400
 @@ -14,6 +14,7 @@
  /sbin/pam_timestamp_check --	gen_context(system_u:object_r:pam_exec_t,s0)
  /sbin/unix_chkpwd	--	gen_context(system_u:object_r:chkpwd_exec_t,s0)
@@ -5799,9 +5975,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
  ifdef(`distro_suse', `
  /sbin/unix2_chkpwd	--	gen_context(system_u:object_r:chkpwd_exec_t,s0)
  ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-2.6.2/policy/modules/system/authlogin.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-2.6.3/policy/modules/system/authlogin.if
 --- nsaserefpolicy/policy/modules/system/authlogin.if	2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/authlogin.if	2007-04-30 12:48:30.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/authlogin.if	2007-05-04 12:31:35.000000000 -0400
 @@ -27,11 +27,9 @@
  	domain_type($1_chkpwd_t)
  	domain_entry_file($1_chkpwd_t,chkpwd_exec_t)
@@ -6064,9 +6240,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
 +	auth_dontaudit_read_shadow($1)
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-2.6.2/policy/modules/system/authlogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-2.6.3/policy/modules/system/authlogin.te
 --- nsaserefpolicy/policy/modules/system/authlogin.te	2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/authlogin.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/authlogin.te	2007-05-04 12:31:35.000000000 -0400
 @@ -9,6 +9,13 @@
  attribute can_read_shadow_passwords;
  attribute can_write_shadow_passwords;
@@ -6129,9 +6305,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
 +optional_policy(`
 +	nscd_socket_use(updpwd_t)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-2.6.2/policy/modules/system/clock.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-2.6.3/policy/modules/system/clock.te
 --- nsaserefpolicy/policy/modules/system/clock.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/clock.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/clock.te	2007-05-04 12:31:35.000000000 -0400
 @@ -26,8 +26,6 @@
  allow hwclock_t self:process signal_perms;
  allow hwclock_t self:fifo_file { getattr read write };
@@ -6149,9 +6325,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.
  
  miscfiles_read_localization(hwclock_t)
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-2.6.2/policy/modules/system/fstools.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-2.6.3/policy/modules/system/fstools.fc
 --- nsaserefpolicy/policy/modules/system/fstools.fc	2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/fstools.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/fstools.fc	2007-05-04 12:31:35.000000000 -0400
 @@ -19,7 +19,6 @@
  /sbin/mkfs.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/mkraid		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -6160,9 +6336,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
  /sbin/parted		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/partprobe		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/partx		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-2.6.2/policy/modules/system/fstools.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-2.6.3/policy/modules/system/fstools.te
 --- nsaserefpolicy/policy/modules/system/fstools.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/fstools.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/fstools.te	2007-05-04 12:31:35.000000000 -0400
 @@ -9,6 +9,7 @@
  type fsadm_t;
  type fsadm_exec_t;
@@ -6171,9 +6347,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
  role system_r types fsadm_t;
  
  type fsadm_log_t;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-2.6.2/policy/modules/system/fusermount.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-2.6.3/policy/modules/system/fusermount.fc
 --- nsaserefpolicy/policy/modules/system/fusermount.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/fusermount.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/fusermount.fc	2007-05-04 12:31:35.000000000 -0400
 @@ -0,0 +1,6 @@
 +# fusermount executable will have:
 +# label: system_u:object_r:fusermount_exec_t
@@ -6181,9 +6357,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
 +# MCS categories: <none>
 +
 +/usr/bin/fusermount		--	gen_context(system_u:object_r:fusermount_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-2.6.2/policy/modules/system/fusermount.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-2.6.3/policy/modules/system/fusermount.if
 --- nsaserefpolicy/policy/modules/system/fusermount.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/fusermount.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/fusermount.if	2007-05-04 12:31:35.000000000 -0400
 @@ -0,0 +1,41 @@
 +## <summary>policy for fusermount</summary>
 +
@@ -6227,9 +6403,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
 +	allow $1 fusermount_t:fd use;
 +')
 \ No newline at end of file
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-2.6.2/policy/modules/system/fusermount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-2.6.3/policy/modules/system/fusermount.te
 --- nsaserefpolicy/policy/modules/system/fusermount.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/fusermount.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/fusermount.te	2007-05-04 12:31:35.000000000 -0400
 @@ -0,0 +1,50 @@
 +policy_module(fusermount,1.0.0)
 +
@@ -6281,9 +6457,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
 +	term_use_console(fusermount_t)
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-2.6.2/policy/modules/system/getty.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-2.6.3/policy/modules/system/getty.te
 --- nsaserefpolicy/policy/modules/system/getty.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/getty.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/getty.te	2007-05-04 12:31:35.000000000 -0400
 @@ -33,7 +33,8 @@
  #
  
@@ -6294,9 +6470,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.
  dontaudit getty_t self:capability sys_tty_config;
  allow getty_t self:process { getpgid setpgid getsession signal_perms };
  allow getty_t self:fifo_file rw_fifo_file_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-2.6.2/policy/modules/system/hostname.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-2.6.3/policy/modules/system/hostname.te
 --- nsaserefpolicy/policy/modules/system/hostname.te	2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/hostname.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/hostname.te	2007-05-04 12:31:35.000000000 -0400
 @@ -8,8 +8,12 @@
  
  type hostname_t;
@@ -6323,9 +6499,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna
 +optional_policy(`
 +	unconfined_dontaudit_rw_pipes(hostname_t)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-2.6.2/policy/modules/system/init.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-2.6.3/policy/modules/system/init.if
 --- nsaserefpolicy/policy/modules/system/init.if	2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/init.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/init.if	2007-05-04 12:31:35.000000000 -0400
 @@ -194,11 +194,14 @@
  	gen_require(`
  		type initrc_t;
@@ -6393,16 +6569,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
 +
 +	allow $1 init_t:process ptrace;
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-2.6.2/policy/modules/system/init.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-2.6.3/policy/modules/system/init.te
 --- nsaserefpolicy/policy/modules/system/init.te	2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/init.te	2007-04-30 11:26:06.000000000 -0400
-@@ -1,5 +1,5 @@
- 
--policy_module(init,1.6.1)
-+policy_module(init,1.6.0)
- 
- gen_require(`
- 	class passwd rootok;
++++ serefpolicy-2.6.3/policy/modules/system/init.te	2007-05-04 12:31:35.000000000 -0400
 @@ -10,13 +10,20 @@
  # Declarations
  #
@@ -6500,9 +6669,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
  ')
  
  optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-2.6.2/policy/modules/system/ipsec.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-2.6.3/policy/modules/system/ipsec.if
 --- nsaserefpolicy/policy/modules/system/ipsec.if	2007-03-26 16:24:13.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/ipsec.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/ipsec.if	2007-05-04 12:31:35.000000000 -0400
 @@ -114,6 +114,26 @@
  
  ########################################
@@ -6530,9 +6699,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
  ##	Execute racoon in the racoon domain.
  ## </summary>
  ## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-2.6.2/policy/modules/system/ipsec.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-2.6.3/policy/modules/system/ipsec.te
 --- nsaserefpolicy/policy/modules/system/ipsec.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/ipsec.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/ipsec.te	2007-05-04 12:31:35.000000000 -0400
 @@ -289,6 +289,7 @@
  allow racoon_t self:netlink_selinux_socket { bind create read };
  allow racoon_t self:udp_socket create_socket_perms;
@@ -6541,9 +6710,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
  
  # manage pid file
  manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-2.6.2/policy/modules/system/iptables.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-2.6.3/policy/modules/system/iptables.te
 --- nsaserefpolicy/policy/modules/system/iptables.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/iptables.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/iptables.te	2007-05-04 12:31:35.000000000 -0400
 @@ -56,6 +56,7 @@
  domain_use_interactive_fds(iptables_t)
  
@@ -6560,30 +6729,34 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl
 +optional_policy(`
 +	fail2ban_append_log(iptables_t)
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-2.6.2/policy/modules/system/libraries.fc
---- nsaserefpolicy/policy/modules/system/libraries.fc	2007-04-10 16:13:39.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/libraries.fc	2007-04-30 11:26:06.000000000 -0400
-@@ -82,6 +82,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-2.6.3/policy/modules/system/libraries.fc
+--- nsaserefpolicy/policy/modules/system/libraries.fc	2007-05-04 12:19:22.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/libraries.fc	2007-05-04 12:31:35.000000000 -0400
+@@ -81,8 +81,8 @@
+ /opt/cisco-vpnclient/lib/libvpnapi\.so	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
  /opt/netbeans(.*/)?jdk.*/linux/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
  /opt/cxoffice/lib/wine/.+\.so		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/opt/f-secure/fspms/libexec/librapi.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
  /opt/ibm/java2-ppc64-50/jre/bin/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 +/opt/f-secure/fspms/libexec/librapi.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
  
  ifdef(`distro_gentoo',`
  # despite the extensions, they are actually libs
-@@ -132,6 +133,9 @@
+@@ -132,8 +132,10 @@
+ 
  /usr/(.*/)?nvidia/.+\.so(\..*)?		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
  
+-/usr/lib/transgaming_cedega/gddb_parser.so --	gen_context(system_u:object_r:shlib_t,s0)
  /usr/lib/win32/.*			--	gen_context(system_u:object_r:shlib_t,s0)
 +/usr/lib/transgaming_cedega/gddb_parser.so --	gen_context(system_u:object_r:shlib_t,s0)
-+/usr/lib/vlc/codec/libdmo_plugin.so	   --	gen_context(system_u:object_r:shlib_t,s0)
-+/usr/lib/vlc/codec/librealaudio_plugin.so  --	gen_context(system_u:object_r:shlib_t,s0)
++/usr/lib/vlc/codec/libdmo_plugin.so	   --	gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib/vlc/codec/librealaudio_plugin.so  --	gen_context(system_u:object_r:textrel_shlib_t,s0)
  
  /usr/(.*/)?lib(64)?(/.*)?/nvidia/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib(64)?(/.*)?/nvidia/.+\.so(\..*)? --	gen_context(system_u:object_r:textrel_shlib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-2.6.2/policy/modules/system/libraries.te
---- nsaserefpolicy/policy/modules/system/libraries.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/libraries.te	2007-04-30 11:26:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-2.6.3/policy/modules/system/libraries.te
+--- nsaserefpolicy/policy/modules/system/libraries.te	2007-05-04 12:19:23.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/libraries.te	2007-05-04 12:31:35.000000000 -0400
 @@ -62,7 +62,8 @@
  
  manage_dirs_pattern(ldconfig_t,ldconfig_tmp_t,ldconfig_tmp_t)
@@ -6602,9 +6775,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
  ')
  
  optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-2.6.2/policy/modules/system/locallogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-2.6.3/policy/modules/system/locallogin.te
 --- nsaserefpolicy/policy/modules/system/locallogin.te	2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/locallogin.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/locallogin.te	2007-05-04 12:31:35.000000000 -0400
 @@ -48,6 +48,8 @@
  allow local_login_t self:msgq create_msgq_perms;
  allow local_login_t self:msg { send receive };
@@ -6645,9 +6818,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall
  	gpm_getattr_gpmctl(local_login_t)
  	gpm_setattr_gpmctl(local_login_t)
  ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-2.6.2/policy/modules/system/logging.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-2.6.3/policy/modules/system/logging.if
 --- nsaserefpolicy/policy/modules/system/logging.if	2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/logging.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/logging.if	2007-05-04 12:31:35.000000000 -0400
 @@ -302,6 +302,25 @@
  
  ########################################
@@ -6814,9 +6987,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
 +	typeattribute $1 can_send_audit_msg;
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-2.6.2/policy/modules/system/logging.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-2.6.3/policy/modules/system/logging.te
 --- nsaserefpolicy/policy/modules/system/logging.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/logging.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/logging.te	2007-05-04 12:31:35.000000000 -0400
 @@ -7,10 +7,15 @@
  #
  
@@ -6902,9 +7075,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
  files_read_etc_runtime_files(syslogd_t)
  # /initrd is not umounted before minilog starts
  files_dontaudit_search_isid_type_dirs(syslogd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-2.6.2/policy/modules/system/lvm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-2.6.3/policy/modules/system/lvm.fc
 --- nsaserefpolicy/policy/modules/system/lvm.fc	2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/lvm.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/lvm.fc	2007-05-04 12:31:35.000000000 -0400
 @@ -15,6 +15,7 @@
  #
  /etc/lvm(/.*)?			gen_context(system_u:object_r:lvm_etc_t,s0)
@@ -6913,9 +7086,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc
  /etc/lvm/archive(/.*)?		gen_context(system_u:object_r:lvm_metadata_t,s0)
  /etc/lvm/backup(/.*)?		gen_context(system_u:object_r:lvm_metadata_t,s0)
  /etc/lvm/lock(/.*)?		gen_context(system_u:object_r:lvm_lock_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-2.6.2/policy/modules/system/lvm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-2.6.3/policy/modules/system/lvm.te
 --- nsaserefpolicy/policy/modules/system/lvm.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/lvm.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/lvm.te	2007-05-04 12:31:35.000000000 -0400
 @@ -16,6 +16,7 @@
  type lvm_t;
  type lvm_exec_t;
@@ -6952,18 +7125,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
  
  term_getattr_all_user_ttys(lvm_t)
  term_list_ptys(lvm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-2.6.2/policy/modules/system/modutils.te
---- nsaserefpolicy/policy/modules/system/modutils.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/modutils.te	2007-04-30 11:26:06.000000000 -0400
-@@ -58,6 +58,7 @@
- kernel_read_system_state(insmod_t)
- kernel_write_proc_files(insmod_t)
- kernel_mount_debugfs(insmod_t)
-+kernel_mount_kvmfs(insmod_t)
- kernel_read_debugfs(insmod_t)
- # Rules for /proc/sys/kernel/tainted
- kernel_read_kernel_sysctls(insmod_t)
-@@ -101,6 +102,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-2.6.3/policy/modules/system/modutils.te
+--- nsaserefpolicy/policy/modules/system/modutils.te	2007-05-02 15:04:46.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/modutils.te	2007-05-04 12:31:35.000000000 -0400
+@@ -102,6 +102,7 @@
  init_use_fds(insmod_t)
  init_use_script_fds(insmod_t)
  init_use_script_ptys(insmod_t)
@@ -6971,18 +7136,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
  
  libs_use_ld_so(insmod_t)
  libs_use_shared_libs(insmod_t)
-@@ -163,6 +165,10 @@
- 	xserver_getattr_log(insmod_t)
+@@ -155,6 +156,7 @@
+ 
+ optional_policy(`
+ 	rpm_rw_pipes(insmod_t)
++	rpm_read_script_tmp_files(insmod_t)
  ')
  
-+optional_policy(`
-+	unconfined_dontaudit_rw_pipes(insmod_t)
-+')
-+
- ########################################
- #
- # depmod local policy
-@@ -180,6 +186,7 @@
+ optional_policy(`
+@@ -185,6 +187,7 @@
  
  files_read_kernel_symbol_table(depmod_t)
  files_read_kernel_modules(depmod_t)
@@ -6990,18 +7152,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
  
  fs_getattr_xattr_fs(depmod_t)
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-2.6.2/policy/modules/system/mount.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-2.6.3/policy/modules/system/mount.fc
 --- nsaserefpolicy/policy/modules/system/mount.fc	2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/mount.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/mount.fc	2007-05-04 12:31:35.000000000 -0400
 @@ -1,4 +1,3 @@
  /bin/mount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
  /bin/umount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
 -
 -/usr/bin/fusermount		--	gen_context(system_u:object_r:mount_exec_t,s0)
 +/sbin/mount.ntfs-3g		--	gen_context(system_u:object_r:mount_ntfs_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-2.6.2/policy/modules/system/mount.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-2.6.3/policy/modules/system/mount.if
 --- nsaserefpolicy/policy/modules/system/mount.if	2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/mount.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/mount.if	2007-05-04 12:31:35.000000000 -0400
 @@ -143,3 +143,40 @@
  		mount_domtrans($1)
  	')
@@ -7043,9 +7205,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
 +
 +	allow $1 mount_ntfs_t:unix_stream_socket { read write };
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-2.6.2/policy/modules/system/mount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-2.6.3/policy/modules/system/mount.te
 --- nsaserefpolicy/policy/modules/system/mount.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/mount.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/mount.te	2007-05-04 12:31:35.000000000 -0400
 @@ -9,6 +9,13 @@
  ifdef(`targeted_policy',`
  ## <desc>
@@ -7153,9 +7315,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
 +	term_use_generic_ptys(mount_ntfs_t)
 +')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-2.6.2/policy/modules/system/raid.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-2.6.3/policy/modules/system/raid.te
 --- nsaserefpolicy/policy/modules/system/raid.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/raid.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/raid.te	2007-05-04 12:31:35.000000000 -0400
 @@ -46,6 +46,7 @@
  # RAID block device access
  storage_manage_fixed_disk(mdadm_t)
@@ -7164,9 +7326,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t
  
  term_dontaudit_list_ptys(mdadm_t)
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-2.6.2/policy/modules/system/selinuxutil.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-2.6.3/policy/modules/system/selinuxutil.fc
 --- nsaserefpolicy/policy/modules/system/selinuxutil.fc	2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/selinuxutil.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/selinuxutil.fc	2007-05-04 12:31:35.000000000 -0400
 @@ -40,6 +40,7 @@
  /usr/sbin/setfiles.*		--	gen_context(system_u:object_r:setfiles_exec_t,s0)
  /usr/sbin/setsebool		--	gen_context(system_u:object_r:semanage_exec_t,s0)
@@ -7175,9 +7337,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
  /usr/sbin/semodule		--	gen_context(system_u:object_r:semanage_exec_t,s0)
  
  #
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-2.6.2/policy/modules/system/selinuxutil.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-2.6.3/policy/modules/system/selinuxutil.if
 --- nsaserefpolicy/policy/modules/system/selinuxutil.if	2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/selinuxutil.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/selinuxutil.if	2007-05-04 12:31:35.000000000 -0400
 @@ -445,6 +445,7 @@
  	role $2 types run_init_t;
  	allow run_init_t $3:chr_file rw_term_perms;
@@ -7212,9 +7374,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
  	manage_files_pattern($1,selinux_config_t,selinux_config_t)
  	read_lnk_files_pattern($1,selinux_config_t,selinux_config_t)
  ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-2.6.2/policy/modules/system/selinuxutil.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-2.6.3/policy/modules/system/selinuxutil.te
 --- nsaserefpolicy/policy/modules/system/selinuxutil.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/selinuxutil.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/selinuxutil.te	2007-05-04 12:31:35.000000000 -0400
 @@ -1,10 +1,8 @@
  
  policy_module(selinuxutil,1.5.0)
@@ -7415,9 +7577,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
  ')
 +
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-2.6.2/policy/modules/system/sysnetwork.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-2.6.3/policy/modules/system/sysnetwork.te
 --- nsaserefpolicy/policy/modules/system/sysnetwork.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/sysnetwork.te	2007-04-30 13:30:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/sysnetwork.te	2007-05-04 12:31:35.000000000 -0400
 @@ -164,6 +164,10 @@
  	dbus_connect_system_bus(dhcpc_t)
  	dbus_send_system_bus(dhcpc_t)
@@ -7437,9 +7599,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
  ')
  
  optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-2.6.2/policy/modules/system/udev.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-2.6.3/policy/modules/system/udev.te
 --- nsaserefpolicy/policy/modules/system/udev.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/udev.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/udev.te	2007-05-04 12:31:35.000000000 -0400
 @@ -83,12 +83,19 @@
  kernel_dgram_send(udev_t)
  kernel_signal(udev_t)
@@ -7460,10 +7622,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
  
  domain_read_all_domains_state(udev_t)
  domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these 
-@@ -194,5 +201,10 @@
+@@ -194,5 +201,21 @@
  ')
  
  optional_policy(`
++	openct_read_pid_files(udev_t)
++	openct_domtrans(udev_t)
++')
++
++optional_policy(`
++	pcscd_read_pub_files(udev_t)
++	pcscd_domtrans(udev_t)
++')
++
++optional_policy(`
 +	xen_append_log(udev_t)
 +')
 +
@@ -7471,18 +7643,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
  	xserver_read_xdm_pid(udev_t)
  ')
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-2.6.2/policy/modules/system/unconfined.fc
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-2.6.3/policy/modules/system/unconfined.fc
 --- nsaserefpolicy/policy/modules/system/unconfined.fc	2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/unconfined.fc	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/unconfined.fc	2007-05-04 12:31:35.000000000 -0400
 @@ -10,4 +10,5 @@
  /usr/bin/valgrind 		--	gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
  /usr/local/RealPlayer/realplay\.bin --	gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
  /usr/lib/ia32el/ia32x_loader 	--	gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
 +/usr/bin/vmware.*		--	gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
  ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-2.6.2/policy/modules/system/unconfined.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-2.6.3/policy/modules/system/unconfined.if
 --- nsaserefpolicy/policy/modules/system/unconfined.if	2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/unconfined.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/unconfined.if	2007-05-04 12:38:48.000000000 -0400
 @@ -18,7 +18,7 @@
  	')
  
@@ -7526,9 +7699,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
  		nscd_unconfined($1)
  	')
  
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-2.6.2/policy/modules/system/unconfined.te
+@@ -556,3 +559,22 @@
+ 
+ 	allow $1 unconfined_t:dbus acquire_svc;
+ ')
++
++########################################
++## <summary>
++##	Allow ptrace of unconfined domain
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`unconfined_ptrace',`
++	gen_require(`
++		type unconfined_t;
++	')
++
++	allow $1 unconfined_t:process ptrace;
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-2.6.3/policy/modules/system/unconfined.te
 --- nsaserefpolicy/policy/modules/system/unconfined.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/unconfined.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/unconfined.te	2007-05-04 12:31:35.000000000 -0400
 @@ -6,6 +6,15 @@
  # Declarations
  #
@@ -7554,7 +7750,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
  	optional_policy(`
  		ada_domtrans(unconfined_t)
  	')
-@@ -153,6 +164,8 @@
+@@ -63,10 +74,6 @@
+ 	')
+ 
+ 	optional_policy(`
+-		bootloader_domtrans(unconfined_t)
+-	')
+-
+-	optional_policy(`
+ 		init_dbus_chat_script(unconfined_t)
+ 
+ 		dbus_stub(unconfined_t)
+@@ -153,6 +160,8 @@
  
  	optional_policy(`
  		rpm_domtrans(unconfined_t)
@@ -7563,7 +7770,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
  	')
  
  	optional_policy(`
-@@ -192,6 +205,9 @@
+@@ -192,6 +201,9 @@
  	optional_policy(`
  		xserver_domtrans_xdm_xserver(unconfined_t)
  	')
@@ -7573,7 +7780,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
  ')
  
  ########################################
-@@ -200,10 +216,18 @@
+@@ -200,10 +212,18 @@
  #
  
  ifdef(`targeted_policy',`
@@ -7592,9 +7799,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
  		dbus_stub(unconfined_execmem_t)
  
  		init_dbus_chat_script(unconfined_execmem_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.6.2/policy/modules/system/userdomain.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.6.3/policy/modules/system/userdomain.if
 --- nsaserefpolicy/policy/modules/system/userdomain.if	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/userdomain.if	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/userdomain.if	2007-05-04 12:36:46.000000000 -0400
 @@ -114,6 +114,18 @@
  		# Allow making the stack executable via mprotect.
  		allow $1_t self:process execstack;
@@ -8027,7 +8234,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
  ')
  
  ########################################
-@@ -5721,3 +5713,92 @@
+@@ -5721,3 +5713,112 @@
  	allow $1 user_home_dir_t:dir manage_dir_perms;
  	files_home_filetrans($1,user_home_dir_t,dir)
  ')
@@ -8120,9 +8327,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
 +		dontaudit $1 sysadm_home_dir_t:dir write;
 +	')
 +')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.6.2/policy/modules/system/userdomain.te
++
++########################################
++## <summary>
++##	Ptrace all user domains.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++## <rolecap/>
++#
++interface(`userdom_ptrace_all_users',`
++	gen_require(`
++		attribute userdomain;
++	')
++
++	allow $1 userdomain:process ptrace;
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.6.3/policy/modules/system/userdomain.te
 --- nsaserefpolicy/policy/modules/system/userdomain.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/userdomain.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/userdomain.te	2007-05-04 12:31:35.000000000 -0400
 @@ -15,7 +15,6 @@
  # Declarations
  #
@@ -8299,9 +8526,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
 +tunable_policy(`allow_console_login', `
 +	term_use_console(userdomain)
  ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-2.6.2/policy/modules/system/xen.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-2.6.3/policy/modules/system/xen.te
 --- nsaserefpolicy/policy/modules/system/xen.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/xen.te	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/xen.te	2007-05-04 12:31:35.000000000 -0400
 @@ -25,6 +25,10 @@
  domain_type(xend_t)
  init_daemon_domain(xend_t, xend_exec_t)
@@ -8384,9 +8611,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
 +fs_read_nfs_files(xend_t)
 +fs_getattr_all_fs(xend_t)
 +fs_read_dos_files(xend_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-2.6.2/policy/support/misc_patterns.spt
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-2.6.3/policy/support/misc_patterns.spt
 --- nsaserefpolicy/policy/support/misc_patterns.spt	2007-01-02 12:57:51.000000000 -0500
-+++ serefpolicy-2.6.2/policy/support/misc_patterns.spt	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/support/misc_patterns.spt	2007-05-04 12:31:35.000000000 -0400
 @@ -41,11 +41,6 @@
  #
  # Other process permissions
@@ -8399,10 +8626,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns
  define(`ps_process_pattern',`
  	allow $1 $2:dir { search getattr read };
  	allow $1 $2:{ file lnk_file } { read getattr };
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-2.6.2/policy/support/obj_perm_sets.spt
---- nsaserefpolicy/policy/support/obj_perm_sets.spt	2007-01-02 12:57:51.000000000 -0500
-+++ serefpolicy-2.6.2/policy/support/obj_perm_sets.spt	2007-04-30 11:26:06.000000000 -0400
-@@ -215,7 +215,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-2.6.3/policy/support/obj_perm_sets.spt
+--- nsaserefpolicy/policy/support/obj_perm_sets.spt	2007-05-04 12:19:23.000000000 -0400
++++ serefpolicy-2.6.3/policy/support/obj_perm_sets.spt	2007-05-04 12:31:35.000000000 -0400
+@@ -203,7 +203,6 @@
+ define(`add_entry_dir_perms',`{ getattr search lock ioctl write add_name }')
+ define(`del_entry_dir_perms',`{ getattr search lock ioctl write remove_name }')
+ define(`create_dir_perms',`{ getattr create }')
+-define(`rename_dir_perms',`{ getattr rename }')
+ define(`delete_dir_perms',`{ getattr rmdir }')
+ define(`manage_dir_perms',`{ create getattr setattr read write link unlink rename search add_name remove_name reparent rmdir lock ioctl }')
+ define(`relabelfrom_dir_perms',`{ getattr relabelfrom }')
+@@ -216,7 +215,7 @@
  define(`getattr_file_perms',`{ getattr }')
  define(`setattr_file_perms',`{ setattr }')
  define(`read_file_perms',`{ getattr read lock ioctl }')
@@ -8411,7 +8646,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
  define(`exec_file_perms',`{ getattr read execute execute_no_trans }')
  define(`append_file_perms',`{ getattr append lock ioctl }')
  define(`write_file_perms',`{ getattr write append lock ioctl }')
-@@ -324,3 +324,13 @@
+@@ -325,3 +324,13 @@
  #
  define(`client_stream_socket_perms', `{ create ioctl read getattr write setattr append bind getopt setopt shutdown }')
  define(`server_stream_socket_perms', `{ client_stream_socket_perms listen accept }')
@@ -8425,9 +8660,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
 +define(`all_association', `{ sendto recvfrom setcontext polmatch } ')
 +
 +
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-2.6.2/Rules.modular
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-2.6.3/Rules.modular
 --- nsaserefpolicy/Rules.modular	2007-03-22 14:30:10.000000000 -0400
-+++ serefpolicy-2.6.2/Rules.modular	2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/Rules.modular	2007-05-04 12:31:35.000000000 -0400
 @@ -167,7 +167,7 @@
  # these have to run individually because order matters:
  	$(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 741d617..d6d4563 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -16,7 +16,7 @@
 %define CHECKPOLICYVER 2.0.1-2
 Summary: SELinux policy configuration
 Name: selinux-policy
-Version: 2.6.2
+Version: 2.6.3
 Release: 1%{?dist}
 License: GPL
 Group: System Environment/Base
@@ -359,6 +359,9 @@ semodule -b base.pp -r bootloader -r clock -r dpkg -r fstools -r hotplug -r init
 %endif
 
 %changelog
+* Fri May 4 2007 Dan Walsh <dwalsh@redhat.com> 2.6.3-1
+- Update to latest from upstream
+
 * Mon Apr 30 2007 Dan Walsh <dwalsh@redhat.com> 2.6.2-1
 - Update to latest from upstream
 
diff --git a/sources b/sources
index eddbff8..0d61942 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-e7e4854e3bd60e61453f054b404ec3b9  serefpolicy-2.6.3.tgz
+61aceefcea6b4644d7abbfb6a73af136  serefpolicy-2.6.3.tgz