diff --git a/.cvsignore b/.cvsignore
index bd6de8f..6154046 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -115,3 +115,4 @@ serefpolicy-2.5.11.tgz
serefpolicy-2.5.12.tgz
serefpolicy-2.6.1.tgz
serefpolicy-2.6.2.tgz
+serefpolicy-2.6.3.tgz
diff --git a/modules-mls.conf b/modules-mls.conf
index b11ae7b..6caaf61 100644
--- a/modules-mls.conf
+++ b/modules-mls.conf
@@ -1031,6 +1031,13 @@ aide = base
#
pcscd = module
+# Layer: service
+# Module: openct
+#
+# Middleware framework for smart card terminals
+#
+openct = module
+
# Layer: system
# Module: tzdata
#
diff --git a/modules-strict.conf b/modules-strict.conf
index 16cbabc..ece907d 100644
--- a/modules-strict.conf
+++ b/modules-strict.conf
@@ -1389,3 +1389,11 @@ apcupsd = module
# w3c
#
w3c = module
+
+# Layer: service
+# Module: openct
+#
+# Middleware framework for smart card terminals
+#
+openct = module
+
diff --git a/modules-targeted.conf b/modules-targeted.conf
index ec6e7d0..a17d64d 100644
--- a/modules-targeted.conf
+++ b/modules-targeted.conf
@@ -829,6 +829,13 @@ openvpn = base
#
pcscd = module
+# Layer: service
+# Module: openct
+#
+# Middleware framework for smart card terminals
+#
+openct = module
+
# Layer: system
# Module: pcmcia
#
diff --git a/policy-20070501.patch b/policy-20070501.patch
index 68454a3..4543321 100644
--- a/policy-20070501.patch
+++ b/policy-20070501.patch
@@ -1,25 +1,18 @@
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/Changelog serefpolicy-2.6.2/Changelog
---- nsaserefpolicy/Changelog 2007-04-30 22:35:02.000000000 -0400
-+++ serefpolicy-2.6.2/Changelog 2007-04-30 10:52:21.000000000 -0400
-@@ -1,6 +1,3 @@
--- Patch to allow amavis to read spamassassin libraries from Dan Walsh.
--- Patch to allow slocate to getattr other filesystems and directories on those
-- filesystems from Dan Walsh.
- - Fixes for RHEL4 from the CLIP project.
- - Replace the old lrrd fc entries with munin ones.
- - Move program admin template usage out of userdom_admin_user_template() to
-@@ -8,8 +5,6 @@
- parties.
- - Fix clockspeed_run_cli() declaration, it was incorrectly defined as a
- template instead of an interface.
--- Added modules:
-- rwho (Nalin Dahyabhai)
-
- * Tue Apr 17 2007 Chris PeBenito <selinux@tresys.com> - 20070417
- - Patch for sasl's use of kerberos from Dan Walsh.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-2.6.2/policy/flask/access_vectors
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-2.6.3/man/man8/ftpd_selinux.8
+--- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-04-02 10:58:34.000000000 -0400
++++ serefpolicy-2.6.3/man/man8/ftpd_selinux.8 2007-05-04 12:31:34.000000000 -0400
+@@ -12,7 +12,7 @@
+ .TP
+ chcon -R -t public_content_t /var/ftp
+ .TP
+-If you want to setup a directory where you can upload files to you must label the files and directories ftpd_anon_rw_t. So if you created a special directory /var/ftp/incoming, you would need to label the directory with the chcon tool.
++If you want to setup a directory where you can upload files to you must label the files and directories public_content_rw_t. So if you created a special directory /var/ftp/incoming, you would need to label the directory with the chcon tool.
+ .TP
+ chcon -t public_content_rw_t /var/ftp/incoming
+ .TP
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-2.6.3/policy/flask/access_vectors
--- nsaserefpolicy/policy/flask/access_vectors 2007-02-26 09:43:33.000000000 -0500
-+++ serefpolicy-2.6.2/policy/flask/access_vectors 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/flask/access_vectors 2007-05-04 12:31:34.000000000 -0400
@@ -598,6 +598,8 @@
shmempwd
shmemgrp
@@ -38,9 +31,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors
}
class key
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans serefpolicy-2.6.2/policy/global_booleans
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans serefpolicy-2.6.3/policy/global_booleans
--- nsaserefpolicy/policy/global_booleans 2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.2/policy/global_booleans 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/global_booleans 2007-05-04 12:31:34.000000000 -0400
@@ -4,7 +4,6 @@
# file should be used.
#
@@ -57,9 +50,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans seref
## <desc>
## <p>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-2.6.2/policy/global_tunables
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-2.6.3/policy/global_tunables
--- nsaserefpolicy/policy/global_tunables 2007-03-26 16:24:14.000000000 -0400
-+++ serefpolicy-2.6.2/policy/global_tunables 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/global_tunables 2007-05-04 12:31:34.000000000 -0400
@@ -102,12 +102,6 @@
## </desc>
gen_tunable(use_samba_home_dirs,false)
@@ -86,9 +79,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref
+## </desc>
+gen_tunable(allow_console_login,false)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.2/policy/mls
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.3/policy/mls
--- nsaserefpolicy/policy/mls 2007-03-09 13:02:20.000000000 -0500
-+++ serefpolicy-2.6.2/policy/mls 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/mls 2007-05-04 12:31:34.000000000 -0400
@@ -89,12 +89,14 @@
mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton }
(( l1 eq l2 ) or
@@ -160,9 +153,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.2
( t2 == unlabeled_t ));
mlsconstrain association { polmatch }
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-2.6.2/policy/modules/admin/acct.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-2.6.3/policy/modules/admin/acct.te
--- nsaserefpolicy/policy/modules/admin/acct.te 2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/acct.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/acct.te 2007-05-04 12:31:34.000000000 -0400
@@ -9,6 +9,7 @@
type acct_t;
type acct_exec_t;
@@ -171,25 +164,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te
type acct_data_t;
logging_log_file(acct_data_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-2.6.2/policy/modules/admin/alsa.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-2.6.3/policy/modules/admin/alsa.fc
--- nsaserefpolicy/policy/modules/admin/alsa.fc 2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/alsa.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/alsa.fc 2007-05-04 12:31:34.000000000 -0400
@@ -1,4 +1,5 @@
/etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)
+/etc/asound(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)
/usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.fc serefpolicy-2.6.2/policy/modules/admin/amtu.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.fc serefpolicy-2.6.3/policy/modules/admin/amtu.fc
--- nsaserefpolicy/policy/modules/admin/amtu.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/amtu.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/amtu.fc 2007-05-04 12:31:34.000000000 -0400
@@ -0,0 +1,3 @@
+
+/usr/bin/amtu -- gen_context(system_u:object_r:amtu_exec_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if serefpolicy-2.6.2/policy/modules/admin/amtu.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if serefpolicy-2.6.3/policy/modules/admin/amtu.if
--- nsaserefpolicy/policy/modules/admin/amtu.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/amtu.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/amtu.if 2007-05-04 12:31:34.000000000 -0400
@@ -0,0 +1,53 @@
+## <summary>
+## abstract Machine Test Utility
@@ -244,9 +237,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if
+ role $2 types amtu_t;
+ allow amtu_t $3:chr_file rw_term_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te serefpolicy-2.6.2/policy/modules/admin/amtu.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te serefpolicy-2.6.3/policy/modules/admin/amtu.te
--- nsaserefpolicy/policy/modules/admin/amtu.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/amtu.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/amtu.te 2007-05-04 12:31:34.000000000 -0400
@@ -0,0 +1,57 @@
+policy_module(amtu,1.0.23)
+
@@ -305,9 +298,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te
+ term_dontaudit_search_ptys(amtu_t)
+');
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-2.6.2/policy/modules/admin/bootloader.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-2.6.3/policy/modules/admin/bootloader.te
--- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/bootloader.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/bootloader.te 2007-05-04 12:31:34.000000000 -0400
@@ -65,6 +65,8 @@
files_tmp_filetrans(bootloader_t,bootloader_tmp_t,{ dir file lnk_file chr_file blk_file })
# for tune2fs (cjp: ?)
@@ -325,9 +318,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-2.6.2/policy/modules/admin/consoletype.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-2.6.3/policy/modules/admin/consoletype.te
--- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/consoletype.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/consoletype.te 2007-05-04 12:31:34.000000000 -0400
@@ -8,7 +8,12 @@
type consoletype_t;
@@ -359,9 +352,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console
domain_use_interactive_fds(consoletype_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-2.6.2/policy/modules/admin/dmesg.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-2.6.3/policy/modules/admin/dmesg.te
--- nsaserefpolicy/policy/modules/admin/dmesg.te 2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/dmesg.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/dmesg.te 2007-05-04 12:31:34.000000000 -0400
@@ -10,6 +10,7 @@
type dmesg_t;
type dmesg_exec_t;
@@ -370,9 +363,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.t
role system_r types dmesg_t;
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-2.6.2/policy/modules/admin/kudzu.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-2.6.3/policy/modules/admin/kudzu.te
--- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/kudzu.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/kudzu.te 2007-05-04 12:31:34.000000000 -0400
@@ -21,8 +21,8 @@
# Local policy
#
@@ -393,9 +386,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t
# kudzu will telinit to make init re-read
# the inittab after configuring serial consoles
init_telinit(kudzu_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-2.6.2/policy/modules/admin/logrotate.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-2.6.3/policy/modules/admin/logrotate.te
--- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/logrotate.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/logrotate.te 2007-05-04 12:31:34.000000000 -0400
@@ -75,6 +75,7 @@
mls_file_read_up(logrotate_t)
mls_file_write_down(logrotate_t)
@@ -404,9 +397,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota
selinux_get_fs_mount(logrotate_t)
selinux_get_enforce_mode(logrotate_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-2.6.2/policy/modules/admin/logwatch.te
---- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/logwatch.te 2007-04-30 11:26:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-2.6.3/policy/modules/admin/logwatch.te
+--- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-05-02 15:04:46.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/logwatch.te 2007-05-04 12:31:34.000000000 -0400
@@ -63,6 +63,8 @@
files_search_mnt(logwatch_t)
files_dontaudit_search_home(logwatch_t)
@@ -416,20 +409,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc
fs_getattr_all_fs(logwatch_t)
fs_dontaudit_list_auto_mountpoints(logwatch_t)
-@@ -95,6 +97,10 @@
- ')
-
- optional_policy(`
-+ avahi_dontaudit_search_pid(logwatch_t)
-+')
-+
-+optional_policy(`
- bind_read_config(logwatch_t)
- bind_read_zone(logwatch_t)
- ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-2.6.2/policy/modules/admin/netutils.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-2.6.3/policy/modules/admin/netutils.te
--- nsaserefpolicy/policy/modules/admin/netutils.te 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/netutils.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/netutils.te 2007-05-04 12:31:34.000000000 -0400
@@ -31,6 +31,7 @@
type traceroute_t;
type traceroute_exec_t;
@@ -438,10 +420,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil
role system_r types traceroute_t;
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-2.6.2/policy/modules/admin/readahead.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-2.6.3/policy/modules/admin/readahead.te
--- nsaserefpolicy/policy/modules/admin/readahead.te 2007-01-02 12:57:51.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/readahead.te 2007-04-30 11:26:06.000000000 -0400
-@@ -36,7 +36,7 @@
++++ serefpolicy-2.6.3/policy/modules/admin/readahead.te 2007-05-04 12:31:34.000000000 -0400
+@@ -18,7 +18,8 @@
+ # Local policy
+ #
+
+-dontaudit readahead_t self:capability { dac_override dac_read_search sys_tty_config };
++allow readahead_t self:capability { dac_override dac_read_search };
++dontaudit readahead_t self:capability sys_tty_config;
+ allow readahead_t self:process signal_perms;
+
+ manage_files_pattern(readahead_t,readahead_var_run_t,readahead_var_run_t)
+@@ -36,7 +37,7 @@
dev_dontaudit_read_all_blk_files(readahead_t)
dev_dontaudit_getattr_memory_dev(readahead_t)
dev_dontaudit_getattr_nvram_dev(readahead_t)
@@ -450,7 +442,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe
domain_use_interactive_fds(readahead_t)
-@@ -82,3 +82,7 @@
+@@ -82,3 +83,7 @@
optional_policy(`
seutil_sigchld_newrole(readahead_t)
')
@@ -458,9 +450,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe
+optional_policy(`
+ logging_dontaudit_search_audit_config(readahead_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-2.6.2/policy/modules/admin/rpm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-2.6.3/policy/modules/admin/rpm.fc
--- nsaserefpolicy/policy/modules/admin/rpm.fc 2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/rpm.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/rpm.fc 2007-05-04 12:31:34.000000000 -0400
@@ -21,6 +21,9 @@
/usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -471,37 +463,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
')
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-2.6.2/policy/modules/admin/rpm.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-2.6.3/policy/modules/admin/rpm.if
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-04-11 10:19:43.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/rpm.if 2007-04-30 11:26:06.000000000 -0400
-@@ -211,26 +211,6 @@
++++ serefpolicy-2.6.3/policy/modules/admin/rpm.if 2007-05-04 12:31:34.000000000 -0400
+@@ -225,8 +225,29 @@
+ type rpm_script_tmp_t;
+ ')
- ########################################
- ## <summary>
--## Create, read, write, and delete RPM
--## script temporary files.
--## </summary>
--## <param name="domain">
--## <summary>
--## Domain allowed access.
--## </summary>
--## </param>
--#
--interface(`rpm_manage_script_tmp_files',`
-- gen_require(`
-- type rpm_script_tmp_t;
-- ')
--
- files_search_tmp($1)
-- manage_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
--')
--
--########################################
--## <summary>
- ## Read the RPM package database.
- ## </summary>
- ## <param name="domain">
-@@ -290,3 +270,68 @@
++ manage_dirs_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
+ manage_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
++ manage_lnk_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
++')
++
++########################################
++## <summary>
++## read, RPM
++## script temporary files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`rpm_read_script_tmp_files',`
++ gen_require(`
++ type rpm_script_tmp_t;
++ ')
++
++ read_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
++ read_lnk_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
+ ')
+
+ ########################################
+@@ -290,3 +311,46 @@
dontaudit $1 rpm_var_lib_t:file manage_file_perms;
dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
')
@@ -548,31 +544,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
+
+ dontaudit $1 rpm_tmp_t:file rw_file_perms;
+')
-+
-+########################################
-+## <summary>
-+## Allow domain to manage RPM Script tmp files
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`rpm_manage_script_tmp_files',`
-+ gen_require(`
-+ type rpm_script_tmp_t;
-+ ')
-+
-+ manage_dirs_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
-+ manage_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
-+ manage_lnk_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
-+')
-+
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-2.6.2/policy/modules/admin/rpm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-2.6.3/policy/modules/admin/rpm.te
--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/rpm.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/rpm.te 2007-05-04 12:31:34.000000000 -0400
@@ -9,6 +9,8 @@
type rpm_t;
type rpm_exec_t;
@@ -582,9 +556,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
domain_obj_id_change_exemption(rpm_t)
domain_role_change_exemption(rpm_t)
domain_system_change_exemption(rpm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-2.6.2/policy/modules/admin/sudo.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-2.6.3/policy/modules/admin/sudo.if
--- nsaserefpolicy/policy/modules/admin/sudo.if 2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/sudo.if 2007-04-30 12:48:42.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/sudo.if 2007-05-04 12:31:34.000000000 -0400
@@ -69,7 +69,6 @@
allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms;
allow $1_sudo_t self:unix_dgram_socket sendto;
@@ -631,9 +605,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
nis_use_ypbind($1_sudo_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-2.6.2/policy/modules/admin/su.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-2.6.3/policy/modules/admin/su.if
--- nsaserefpolicy/policy/modules/admin/su.if 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/su.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/su.if 2007-05-04 12:31:34.000000000 -0400
@@ -41,12 +41,11 @@
allow $2 $1_su_t:process signal;
@@ -706,9 +680,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s
ifdef(`TODO',`
allow $1_su_t $1_home_t:file manage_file_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-2.6.2/policy/modules/admin/usermanage.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-2.6.3/policy/modules/admin/usermanage.if
--- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/usermanage.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/usermanage.if 2007-05-04 12:31:34.000000000 -0400
@@ -278,5 +278,5 @@
type crack_db_t;
')
@@ -716,9 +690,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
- allow $1 crack_db_t:file read_file_perms;
+ read_files_pattern($1,crack_db_t,crack_db_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-2.6.2/policy/modules/admin/usermanage.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-2.6.3/policy/modules/admin/usermanage.te
--- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/admin/usermanage.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/usermanage.te 2007-05-04 12:31:34.000000000 -0400
@@ -184,7 +184,7 @@
# Groupadd local policy
#
@@ -878,18 +852,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
rpm_rw_pipes(useradd_t)
+ rpm_dontaudit_rw_tmp_files(useradd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-2.6.2/policy/modules/admin/vbetool.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-2.6.3/policy/modules/admin/vbetool.te
--- nsaserefpolicy/policy/modules/admin/vbetool.te 2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/admin/vbetool.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/admin/vbetool.te 2007-05-04 12:31:34.000000000 -0400
@@ -32,4 +32,5 @@
optional_policy(`
hal_rw_pid_files(vbetool_t)
+ hal_write_log(vbetool_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-2.6.2/policy/modules/apps/gnome.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-2.6.3/policy/modules/apps/gnome.if
--- nsaserefpolicy/policy/modules/apps/gnome.if 2007-02-19 11:32:52.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/apps/gnome.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/apps/gnome.if 2007-05-04 12:31:34.000000000 -0400
@@ -35,6 +35,7 @@
template(`gnome_per_role_template',`
gen_require(`
@@ -943,9 +917,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
## </p>
## <p>
## This is a templated interface, and should only
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-2.6.2/policy/modules/apps/gpg.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-2.6.3/policy/modules/apps/gpg.fc
--- nsaserefpolicy/policy/modules/apps/gpg.fc 2006-11-16 17:15:07.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/apps/gpg.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/apps/gpg.fc 2007-05-04 12:31:34.000000000 -0400
@@ -7,6 +7,4 @@
/usr/lib/gnupg/.* -- gen_context(system_u:object_r:gpg_exec_t,s0)
/usr/lib/gnupg/gpgkeys.* -- gen_context(system_u:object_r:gpg_helper_exec_t,s0)
@@ -953,9 +927,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc s
-ifdef(`targeted_policy',`',`
HOME_DIR/\.gnupg(/.+)? gen_context(system_u:object_r:ROLE_gpg_secret_t,s0)
-')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.if serefpolicy-2.6.2/policy/modules/apps/loadkeys.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.if serefpolicy-2.6.3/policy/modules/apps/loadkeys.if
--- nsaserefpolicy/policy/modules/apps/loadkeys.if 2007-01-02 12:57:22.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/apps/loadkeys.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/apps/loadkeys.if 2007-05-04 12:31:34.000000000 -0400
@@ -11,16 +11,12 @@
## </param>
#
@@ -1022,9 +996,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys
')
+ can_exec($1,loadkeys_exec_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-2.6.2/policy/modules/apps/mozilla.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-2.6.3/policy/modules/apps/mozilla.if
--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-03-26 16:24:09.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/apps/mozilla.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/apps/mozilla.if 2007-05-04 12:31:34.000000000 -0400
@@ -150,6 +150,7 @@
corenet_dontaudit_tcp_bind_generic_port($1_mozilla_t)
@@ -1033,19 +1007,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
dev_write_sound($1_mozilla_t)
dev_read_sound($1_mozilla_t)
dev_dontaudit_rw_dri($1_mozilla_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-2.6.2/policy/modules/apps/slocate.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-2.6.3/policy/modules/apps/slocate.te
--- nsaserefpolicy/policy/modules/apps/slocate.te 2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/apps/slocate.te 2007-04-30 11:26:06.000000000 -0400
-@@ -1,5 +1,5 @@
++++ serefpolicy-2.6.3/policy/modules/apps/slocate.te 2007-05-04 12:31:34.000000000 -0400
+@@ -43,7 +43,7 @@
+ files_read_etc_files(locate_t)
--policy_module(slocate,1.4.1)
-+policy_module(slocate,1.4.0)
+ fs_getattr_all_fs(locate_t)
+-fs_getattr_all_dirs(locate_t)
++fs_getattr_all_files(locate_t)
- #################################
- #
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if serefpolicy-2.6.2/policy/modules/apps/uml.if
+ libs_use_shared_libs(locate_t)
+ libs_use_ld_so(locate_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if serefpolicy-2.6.3/policy/modules/apps/uml.if
--- nsaserefpolicy/policy/modules/apps/uml.if 2007-03-26 10:38:58.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/apps/uml.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/apps/uml.if 2007-05-04 12:31:34.000000000 -0400
@@ -193,33 +193,6 @@
nis_use_ypbind($1_uml_t)
')
@@ -1080,9 +1056,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if s
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-2.6.2/policy/modules/kernel/corecommands.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-2.6.3/policy/modules/kernel/corecommands.fc
--- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-04-11 15:52:53.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/corecommands.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/corecommands.fc 2007-05-04 12:31:34.000000000 -0400
@@ -36,6 +36,11 @@
/etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0)
/etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0)
@@ -1095,14 +1071,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
/etc/hotplug/.*agent -- gen_context(system_u:object_r:bin_t,s0)
/etc/hotplug/.*rc -- gen_context(system_u:object_r:bin_t,s0)
/etc/hotplug/hotplug\.functions -- gen_context(system_u:object_r:bin_t,s0)
-@@ -256,3 +261,4 @@
+@@ -256,3 +261,5 @@
ifdef(`distro_suse',`
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
')
+/usr/lib/vmware-tools/sbin32(/.*)? gen_context(system_u:object_r:bin_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-2.6.2/policy/modules/kernel/corecommands.if
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-2.6.3/policy/modules/kernel/corecommands.if
--- nsaserefpolicy/policy/modules/kernel/corecommands.if 2007-03-26 10:38:57.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/corecommands.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/corecommands.if 2007-05-04 12:31:34.000000000 -0400
@@ -988,3 +988,23 @@
mmap_files_pattern($1,bin_t,exec_type)
@@ -1127,16 +1104,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-2.6.2/policy/modules/kernel/corenetwork.te.in
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-2.6.3/policy/modules/kernel/corenetwork.te.in
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-04-30 22:35:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/corenetwork.te.in 2007-04-30 11:26:06.000000000 -0400
-@@ -1,5 +1,5 @@
-
--policy_module(corenetwork,1.2.7)
-+policy_module(corenetwork,1.2.6)
-
- ########################################
- #
++++ serefpolicy-2.6.3/policy/modules/kernel/corenetwork.te.in 2007-05-04 12:31:34.000000000 -0400
@@ -48,6 +48,11 @@
type reserved_port_t, port_type, reserved_port_type;
@@ -1193,9 +1163,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
portcon tcp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0)
portcon udp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-2.6.2/policy/modules/kernel/devices.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-2.6.3/policy/modules/kernel/devices.fc
--- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-03-01 10:01:48.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/devices.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/devices.fc 2007-05-04 12:31:34.000000000 -0400
@@ -19,6 +19,7 @@
/dev/evtchn -c gen_context(system_u:object_r:xen_device_t,s0)
/dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0)
@@ -1204,9 +1174,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
/dev/hiddev.* -c gen_context(system_u:object_r:usb_device_t,s0)
/dev/hpet -c gen_context(system_u:object_r:clock_device_t,s0)
/dev/hw_random -c gen_context(system_u:object_r:random_device_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-2.6.2/policy/modules/kernel/devices.if
+@@ -81,6 +82,8 @@
+
+ /dev/bus/usb/.*/[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0)
+
++/dev/cmx.* -c gen_context(system_u:object_r:smartcard_device_t,s0)
++
+ /dev/cpu/.* -c gen_context(system_u:object_r:cpu_device_t,s0)
+ /dev/cpu/mtrr -c gen_context(system_u:object_r:mtrr_device_t,s0)
+
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-2.6.3/policy/modules/kernel/devices.if
--- nsaserefpolicy/policy/modules/kernel/devices.if 2007-03-26 16:24:09.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/devices.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/devices.if 2007-05-04 12:31:34.000000000 -0400
@@ -2729,6 +2729,24 @@
########################################
@@ -1257,9 +1236,104 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
## Read and write VMWare devices.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-2.6.2/policy/modules/kernel/domain.if
+@@ -3192,3 +3228,78 @@
+
+ typeattribute $1 devices_unconfined_type;
+ ')
++
++########################################
++## <summary>
++## Getattr on smartcard devices
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_getattr_smartcard',`
++ gen_require(`
++ type smartcard_device_t;
++ ')
++
++ allow $1 smartcard_device_t:chr_file getattr;
++
++')
++
++########################################
++## <summary>
++## dontaudit getattr on smartcard devices
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_dontaudit_getattr_smartcard',`
++ gen_require(`
++ type smartcard_device_t;
++ ')
++
++ dontaudit $1 smartcard_device_t:chr_file getattr;
++
++')
++
++########################################
++## <summary>
++## Read and write smartcard devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_rw_smartcard',`
++ gen_require(`
++ type device_t, smartcard_device_t;
++ ')
++
++ rw_chr_files_pattern($1,device_t,smartcard_device_t)
++')
++
++########################################
++## <summary>
++## Create, read, write, and delete smartcard devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_manage_smartcard',`
++ gen_require(`
++ type device_t, smartcard_device_t;
++ ')
++
++ manage_chr_files_pattern($1,device_t,smartcard_device_t)
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-2.6.3/policy/modules/kernel/devices.te
+--- nsaserefpolicy/policy/modules/kernel/devices.te 2007-04-23 09:35:56.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/devices.te 2007-05-04 12:31:34.000000000 -0400
+@@ -139,6 +139,12 @@
+ #
+ # Type for sound devices and mixers
+ #
++type smartcard_device_t;
++dev_node(smartcard_device_t)
++
++#
++# Type for sound devices and mixers
++#
+ type sound_device_t;
+ dev_node(sound_device_t)
+
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-2.6.3/policy/modules/kernel/domain.if
--- nsaserefpolicy/policy/modules/kernel/domain.if 2007-02-19 11:32:51.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/domain.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/domain.if 2007-05-04 12:31:34.000000000 -0400
@@ -1254,3 +1254,21 @@
typeattribute $1 can_change_object_identity;
typeattribute $1 set_curr_context;
@@ -1282,9 +1356,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
+
+ allow $1 domain:association { sendto recvfrom };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-2.6.2/policy/modules/kernel/domain.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-2.6.3/policy/modules/kernel/domain.te
--- nsaserefpolicy/policy/modules/kernel/domain.te 2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/domain.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/domain.te 2007-05-04 12:31:34.000000000 -0400
@@ -6,6 +6,29 @@
# Declarations
#
@@ -1342,9 +1416,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
+ ipsec_labeled(domain)
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-2.6.2/policy/modules/kernel/files.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-2.6.3/policy/modules/kernel/files.fc
--- nsaserefpolicy/policy/modules/kernel/files.fc 2006-11-16 17:15:04.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/files.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/files.fc 2007-05-04 12:31:34.000000000 -0400
@@ -54,6 +54,7 @@
/etc/issue\.net -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/localtime -l gen_context(system_u:object_r:etc_t,s0)
@@ -1353,9 +1427,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
/etc/motd -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/nohotplug -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/nologin.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.6.2/policy/modules/kernel/files.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.6.3/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2007-02-26 14:17:21.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/files.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/files.if 2007-05-04 12:31:34.000000000 -0400
@@ -343,8 +343,7 @@
########################################
@@ -1532,10 +1606,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
+ allow $1 root_t:dir rw_dir_perms;
+ allow $1 root_t:file { create getattr write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-2.6.2/policy/modules/kernel/filesystem.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-2.6.3/policy/modules/kernel/filesystem.if
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-03-26 16:24:09.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/filesystem.if 2007-04-30 11:26:06.000000000 -0400
-@@ -1291,6 +1291,26 @@
++++ serefpolicy-2.6.3/policy/modules/kernel/filesystem.if 2007-05-04 12:31:34.000000000 -0400
+@@ -1096,6 +1096,24 @@
+
+ ########################################
+ ## <summary>
++## Search dosfs filesystem.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`fs_search_dos',`
++ gen_require(`
++ type dosfs_t;
++ ')
++
++ allow $1 dosfs_t:dir search_dir_perms;
++')
++
++########################################
++## <summary>
+ ## Read files on a DOS filesystem.
+ ## </summary>
+ ## <param name="domain">
+@@ -1291,6 +1309,26 @@
########################################
## <summary>
@@ -1562,7 +1661,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
## Mount a NFS filesystem.
## </summary>
## <param name="domain">
-@@ -3420,3 +3440,22 @@
+@@ -3420,3 +3458,22 @@
relabelfrom_blk_files_pattern($1,noxattrfs,noxattrfs)
relabelfrom_chr_files_pattern($1,noxattrfs,noxattrfs)
')
@@ -1585,9 +1684,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
+
+ allow $1 fusefs_t:filesystem mount;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.6.2/policy/modules/kernel/filesystem.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.6.3/policy/modules/kernel/filesystem.te
--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/filesystem.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/filesystem.te 2007-05-04 12:31:34.000000000 -0400
@@ -54,17 +54,30 @@
type capifs_t;
@@ -1632,10 +1731,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
type nfsd_fs_t;
fs_type(nfsd_fs_t)
genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-2.6.2/policy/modules/kernel/kernel.if
---- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-02-19 11:32:51.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/kernel.if 2007-04-30 11:26:06.000000000 -0400
-@@ -1830,6 +1830,26 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-2.6.3/policy/modules/kernel/kernel.if
+--- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-05-02 15:04:46.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/kernel.if 2007-05-04 12:31:34.000000000 -0400
+@@ -1848,6 +1848,26 @@
########################################
## <summary>
@@ -1662,7 +1761,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
## Do not audit attempts to list unlabeled directories.
## </summary>
## <param name="domain">
-@@ -2140,9 +2160,6 @@
+@@ -2158,9 +2178,6 @@
')
allow $1 unlabeled_t:association { sendto recvfrom };
@@ -1672,32 +1771,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
')
########################################
-@@ -2408,3 +2425,22 @@
-
- typeattribute $1 kern_unconfined;
- ')
-+
-+########################################
-+## <summary>
-+## Mount a kernel vm filesystem.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## The type of the domain mounting the filesystem.
-+## </summary>
-+## </param>
-+#
-+interface(`kernel_mount_kvmfs',`
-+ gen_require(`
-+ type kvmfs_t;
-+ ')
-+
-+ allow $1 kvmfs_t:filesystem mount;
-+')
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-2.6.2/policy/modules/kernel/kernel.te
---- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/kernel.te 2007-04-30 11:26:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-2.6.3/policy/modules/kernel/kernel.te
+--- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-05-02 15:04:46.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/kernel.te 2007-05-04 12:31:34.000000000 -0400
@@ -146,6 +146,8 @@
type unlabeled_t;
sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
@@ -1715,9 +1791,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-2.6.2/policy/modules/kernel/mls.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-2.6.3/policy/modules/kernel/mls.if
--- nsaserefpolicy/policy/modules/kernel/mls.if 2006-11-16 17:15:04.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/mls.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/mls.if 2007-05-04 12:31:34.000000000 -0400
@@ -154,6 +154,26 @@
########################################
## <summary>
@@ -1745,9 +1821,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if
## for writing to sockets at any level.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-2.6.2/policy/modules/kernel/mls.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-2.6.3/policy/modules/kernel/mls.te
--- nsaserefpolicy/policy/modules/kernel/mls.te 2007-01-02 12:57:13.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/mls.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/mls.te 2007-05-04 12:31:34.000000000 -0400
@@ -18,6 +18,7 @@
attribute mlsnetreadtoclr;
attribute mlsnetwrite;
@@ -1765,9 +1841,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te
attribute mlstrustedobject;
attribute privrangetrans;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-2.6.2/policy/modules/kernel/selinux.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-2.6.3/policy/modules/kernel/selinux.if
--- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-02-27 14:37:10.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/selinux.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/selinux.if 2007-05-04 12:31:34.000000000 -0400
@@ -51,6 +51,44 @@
########################################
@@ -1813,9 +1889,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu
## Search selinuxfs.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-2.6.2/policy/modules/kernel/storage.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-2.6.3/policy/modules/kernel/storage.if
--- nsaserefpolicy/policy/modules/kernel/storage.if 2007-01-02 12:57:13.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/storage.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/storage.if 2007-05-04 12:31:34.000000000 -0400
@@ -100,6 +100,7 @@
dev_list_all_dev_nodes($1)
@@ -1832,9 +1908,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag
typeattribute $1 fixed_disk_raw_write;
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-2.6.2/policy/modules/kernel/terminal.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-2.6.3/policy/modules/kernel/terminal.if
--- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-02-20 16:35:52.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/kernel/terminal.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/terminal.if 2007-05-04 12:31:34.000000000 -0400
@@ -278,6 +278,25 @@
########################################
@@ -1870,9 +1946,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-2.6.2/policy/modules/kernel/terminal.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-2.6.3/policy/modules/kernel/terminal.te
--- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/kernel/terminal.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/kernel/terminal.te 2007-05-04 12:31:34.000000000 -0400
@@ -28,6 +28,7 @@
type devpts_t;
files_mountpoint(devpts_t)
@@ -1881,9 +1957,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
fs_type(devpts_t)
fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0);
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.fc serefpolicy-2.6.2/policy/modules/services/aide.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.fc serefpolicy-2.6.3/policy/modules/services/aide.fc
--- nsaserefpolicy/policy/modules/services/aide.fc 2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/aide.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/aide.fc 2007-05-04 12:31:34.000000000 -0400
@@ -2,5 +2,5 @@
/var/lib/aide(/.*) gen_context(system_u:object_r:aide_db_t,mls_systemhigh)
@@ -1891,16 +1967,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide
-/var/log/aide(/.*)? gen_context(system_u:object_r:aide_log_t,mls_systemhigh)
/var/log/aide.log -- gen_context(system_u:object_r:aide_log_t,mls_systemhigh)
+/var/log/aide(/.*)? gen_context(system_u:object_r:aide_log_t,mls_systemhigh)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.te serefpolicy-2.6.2/policy/modules/services/aide.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.te serefpolicy-2.6.3/policy/modules/services/aide.te
--- nsaserefpolicy/policy/modules/services/aide.te 2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/aide.te 2007-04-30 11:26:06.000000000 -0400
-@@ -1,5 +1,5 @@
-
--policy_module(aide,1.0.1)
-+policy_module(aide,1.0.0)
-
- ########################################
- #
++++ serefpolicy-2.6.3/policy/modules/services/aide.te 2007-05-04 12:31:34.000000000 -0400
@@ -26,7 +26,7 @@
allow aide_t self:capability { dac_override fowner };
@@ -1910,9 +1979,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide
# database actions
manage_files_pattern(aide_t,aide_db_t,aide_db_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.if serefpolicy-2.6.2/policy/modules/services/amavis.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.if serefpolicy-2.6.3/policy/modules/services/amavis.if
--- nsaserefpolicy/policy/modules/services/amavis.if 2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/amavis.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/amavis.if 2007-05-04 12:31:34.000000000 -0400
@@ -167,3 +167,22 @@
allow $1 amavis_var_run_t:file setattr;
files_search_pids($1)
@@ -1936,31 +2005,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav
+ allow $1 amavis_var_run_t:file create_file_perms;
+ files_search_pids($1)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-2.6.2/policy/modules/services/amavis.te
---- nsaserefpolicy/policy/modules/services/amavis.te 2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/amavis.te 2007-04-30 11:26:06.000000000 -0400
-@@ -1,5 +1,5 @@
-
--policy_module(amavis,1.2.1)
-+policy_module(amavis,1.2.0)
-
- ########################################
- #
-@@ -75,10 +75,10 @@
- files_tmp_filetrans(amavis_t,amavis_tmp_t,file)
-
- # var/lib files for amavis
-+files_search_var_lib(amavis_t)
- manage_dirs_pattern(amavis_t,amavis_var_lib_t,amavis_var_lib_t)
- manage_files_pattern(amavis_t,amavis_var_lib_t,amavis_var_lib_t)
- manage_sock_files_pattern(amavis_t,amavis_var_lib_t,amavis_var_lib_t)
--files_search_var_lib(amavis_t)
-
- # log files
- allow amavis_t amavis_var_log_t:dir setattr;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-2.6.2/policy/modules/services/apache.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-2.6.3/policy/modules/services/apache.fc
--- nsaserefpolicy/policy/modules/services/apache.fc 2007-02-23 16:50:01.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/apache.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/apache.fc 2007-05-04 12:31:34.000000000 -0400
@@ -1,10 +1,5 @@
# temporary hack till genhomedircon is fixed
-ifdef(`targeted_policy',`
@@ -1992,9 +2039,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+#viewvc file context
+/var/spool/viewvc(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t, s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-2.6.2/policy/modules/services/apache.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-2.6.3/policy/modules/services/apache.if
--- nsaserefpolicy/policy/modules/services/apache.if 2007-04-02 10:58:34.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/apache.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/apache.if 2007-05-04 12:31:34.000000000 -0400
@@ -18,10 +18,6 @@
attribute httpd_script_exec_type;
type httpd_t, httpd_suexec_t, httpd_log_t;
@@ -2213,9 +2260,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+ allow $1 httpd_bugzilla_content_t:dir search_dir_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-2.6.2/policy/modules/services/apache.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-2.6.3/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/apache.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/apache.te 2007-05-04 12:31:34.000000000 -0400
@@ -106,6 +106,27 @@
## </desc>
gen_tunable(httpd_unified,false)
@@ -2379,9 +2426,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+ postgresql_stream_connect(httpd_bugzilla_script_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-2.6.2/policy/modules/services/apcupsd.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-2.6.3/policy/modules/services/apcupsd.fc
--- nsaserefpolicy/policy/modules/services/apcupsd.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/apcupsd.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/apcupsd.fc 2007-05-04 12:31:34.000000000 -0400
@@ -0,0 +1,9 @@
+
+/usr/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0)
@@ -2392,9 +2439,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
+/var/www/apcupsd/upsfstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
+/var/www/apcupsd/upsimage.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
+/var/www/apcupsd/upsstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-2.6.2/policy/modules/services/apcupsd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-2.6.3/policy/modules/services/apcupsd.if
--- nsaserefpolicy/policy/modules/services/apcupsd.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/apcupsd.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/apcupsd.if 2007-05-04 12:31:34.000000000 -0400
@@ -0,0 +1,108 @@
+
+## <summary>policy for apcupsd</summary>
@@ -2504,9 +2551,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
+ allow httpd_apcupsd_cgi_script_t $1:fifo_file rw_file_perms;
+ allow httpd_apcupsd_cgi_script_t $1:process sigchld;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-2.6.2/policy/modules/services/apcupsd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-2.6.3/policy/modules/services/apcupsd.te
--- nsaserefpolicy/policy/modules/services/apcupsd.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/apcupsd.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/apcupsd.te 2007-05-04 12:31:34.000000000 -0400
@@ -0,0 +1,92 @@
+policy_module(apcupsd,1.0.0)
+
@@ -2600,9 +2647,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
+corenet_udp_sendrecv_all_nodes(httpd_apcupsd_cgi_script_t)
+corenet_udp_sendrecv_all_ports(httpd_apcupsd_cgi_script_t)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-2.6.2/policy/modules/services/automount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-2.6.3/policy/modules/services/automount.te
--- nsaserefpolicy/policy/modules/services/automount.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/automount.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/automount.te 2007-05-04 12:31:34.000000000 -0400
@@ -69,6 +69,7 @@
files_mounton_all_mountpoints(automount_t)
files_mount_all_file_type_fs(automount_t)
@@ -2619,46 +2666,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto
dev_read_urand(automount_t)
domain_use_interactive_fds(automount_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.if serefpolicy-2.6.2/policy/modules/services/avahi.if
---- nsaserefpolicy/policy/modules/services/avahi.if 2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/avahi.if 2007-04-30 11:26:06.000000000 -0400
-@@ -39,3 +39,22 @@
- files_search_pids($1)
- stream_connect_pattern($1,avahi_var_run_t,avahi_var_run_t,avahi_t)
- ')
-+
-+########################################
-+## <summary>
-+## Do not audit attempts to search the AVAHI pid directory.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`avahi_dontaudit_search_pid',`
-+ gen_require(`
-+ type avahi_var_run_t;
-+ ')
-+
-+ dontaudit $1 avahi_var_run_t:dir search_dir_perms;
-+')
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-2.6.2/policy/modules/services/avahi.te
---- nsaserefpolicy/policy/modules/services/avahi.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/avahi.te 2007-04-30 11:26:06.000000000 -0400
-@@ -105,3 +105,7 @@
- optional_policy(`
- udev_read_db(avahi_t)
- ')
-+
-+optional_policy(`
-+ samba_stream_connect_winbind(avahi_t)
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-2.6.2/policy/modules/services/bind.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-2.6.3/policy/modules/services/bind.te
--- nsaserefpolicy/policy/modules/services/bind.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/bind.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/bind.te 2007-05-04 12:31:34.000000000 -0400
@@ -236,6 +236,7 @@
corenet_tcp_sendrecv_all_nodes(ndc_t)
corenet_tcp_sendrecv_all_ports(ndc_t)
@@ -2667,9 +2677,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind
corenet_sendrecv_rndc_client_packets(ndc_t)
fs_getattr_xattr_fs(ndc_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-2.6.2/policy/modules/services/clamav.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-2.6.3/policy/modules/services/clamav.te
--- nsaserefpolicy/policy/modules/services/clamav.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/clamav.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/clamav.te 2007-05-04 12:31:34.000000000 -0400
@@ -126,6 +126,7 @@
amavis_read_lib_files(clamd_t)
amavis_read_spool_files(clamd_t)
@@ -2678,36 +2688,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-2.6.2/policy/modules/services/consolekit.te
---- nsaserefpolicy/policy/modules/services/consolekit.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/consolekit.te 2007-04-30 11:26:06.000000000 -0400
-@@ -19,14 +19,13 @@
- # consolekit local policy
- #
-
--allow consolekit_t self:capability { sys_tty_config dac_override sys_nice sys_ptrace };
-+allow consolekit_t self:capability { setuid setgid sys_tty_config dac_override sys_nice sys_ptrace };
- allow consolekit_t self:process { getsched signal };
- allow consolekit_t self:fifo_file rw_fifo_file_perms;
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-2.6.3/policy/modules/services/consolekit.te
+--- nsaserefpolicy/policy/modules/services/consolekit.te 2007-05-04 12:19:22.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/consolekit.te 2007-05-04 13:09:02.000000000 -0400
+@@ -10,7 +10,6 @@
+ type consolekit_exec_t;
+ init_daemon_domain(consolekit_t, consolekit_exec_t)
+
+-# pid files
+ type consolekit_var_run_t;
+ files_pid_file(consolekit_var_run_t)
+
+@@ -25,7 +24,6 @@
allow consolekit_t self:unix_stream_socket create_stream_socket_perms;
-+allow consolekit_t self:unix_dgram_socket create_socket_perms;
+ allow consolekit_t self:unix_dgram_socket create_socket_perms;
-# pid file
--manage_files_pattern(consolekit_t,consolekit_var_run_t,consolekit_var_run_t)
--files_pid_filetrans(consolekit_t,consolekit_var_run_t, file)
-+corecmd_exec_bin(consolekit_t)
-
- dev_read_urand(consolekit_t)
- dev_read_sysfs(consolekit_t)
-@@ -38,18 +37,34 @@
- # needs to read /var/lib/dbus/machine-id
- files_read_var_lib_files(consolekit_t)
-
--term_use_console(consolekit_t)
-+fs_list_inotifyfs(consolekit_t)
-+
-+kernel_read_system_state(consolekit_t)
+ manage_files_pattern(consolekit_t,consolekit_var_run_t,consolekit_var_run_t)
+ files_pid_filetrans(consolekit_t,consolekit_var_run_t, file)
+@@ -50,8 +48,15 @@
libs_use_ld_so(consolekit_t)
libs_use_shared_libs(consolekit_t)
@@ -2715,47 +2715,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons
+
miscfiles_read_localization(consolekit_t)
-+term_use_all_terms(consolekit_t)
-+
-+manage_files_pattern(consolekit_t,consolekit_var_run_t,consolekit_var_run_t)
-+files_pid_filetrans(consolekit_t,consolekit_var_run_t, file)
-+
- ifdef(`targeted_policy',`
-- term_dontaudit_use_unallocated_ttys(consolekit_t)
-- term_dontaudit_use_generic_ptys(consolekit_t)
-+ term_use_unallocated_ttys(consolekit_t)
-+ term_use_generic_ptys(consolekit_t)
-+ #reading .Xauthity
-+ userdom_read_generic_user_home_content_files(consolekit_t)
- ')
-
-+# Init script handling
-+
-+domain_ptrace_all_domains(consolekit_t)
++# consolekit needs to be able to ptrace all logged in users
++userdom_ptrace_all_users(consolekit_t)
++hal_ptrace(consolekit_t)
+mcs_ptrace_all(consolekit_t)
+
optional_policy(`
dbus_system_bus_client_template(consolekit, consolekit_t)
dbus_send_system_bus(consolekit_t)
-@@ -61,3 +76,7 @@
- unconfined_dbus_chat(consolekit_t)
- ')
+@@ -68,3 +73,9 @@
+ xserver_read_all_users_xauth(consolekit_t)
+ xserver_stream_connect_xdm_xserver(consolekit_t)
')
+
-+optional_policy(`
-+ xserver_stream_connect_xdm_xserver(consolekit_t)
++ifdef(`targeted_policy',`
++ #reading .Xauthity
++ unconfined_ptrace(consolekit_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-2.6.2/policy/modules/services/cron.fc
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-2.6.3/policy/modules/services/cron.fc
--- nsaserefpolicy/policy/modules/services/cron.fc 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/cron.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/cron.fc 2007-05-04 12:31:34.000000000 -0400
@@ -45,3 +45,4 @@
/var/spool/fcron/systab\.orig -- gen_context(system_u:object_r:system_cron_spool_t,s0)
/var/spool/fcron/systab -- gen_context(system_u:object_r:system_cron_spool_t,s0)
/var/spool/fcron/new\.systab -- gen_context(system_u:object_r:system_cron_spool_t,s0)
+/var/lib/misc(/.*)? gen_context(system_u:object_r:crond_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-2.6.2/policy/modules/services/cron.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-2.6.3/policy/modules/services/cron.if
--- nsaserefpolicy/policy/modules/services/cron.if 2007-03-26 10:39:05.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/cron.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/cron.if 2007-05-04 12:31:34.000000000 -0400
@@ -35,6 +35,7 @@
#
template(`cron_per_role_template',`
@@ -2864,9 +2852,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
tunable_policy(`fcron_crond',`
# fcron wants an instant update of a crontab change for the administrator
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-2.6.2/policy/modules/services/cron.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-2.6.3/policy/modules/services/cron.te
--- nsaserefpolicy/policy/modules/services/cron.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/cron.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/cron.te 2007-05-04 12:31:34.000000000 -0400
@@ -42,6 +42,9 @@
type cron_log_t;
logging_log_file(cron_log_t)
@@ -3004,9 +2992,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
mrtg_append_create_logs(system_crond_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-2.6.2/policy/modules/services/cups.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-2.6.3/policy/modules/services/cups.fc
+--- nsaserefpolicy/policy/modules/services/cups.fc 2006-11-16 17:15:21.000000000 -0500
++++ serefpolicy-2.6.3/policy/modules/services/cups.fc 2007-05-04 12:31:34.000000000 -0400
+@@ -8,6 +8,7 @@
+ /etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+ /etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+ /etc/cups/printers\.conf.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
++/etc/cups/subscriptions.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+ /etc/cups/certs -d gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+ /etc/cups/certs/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-2.6.3/policy/modules/services/cups.te
--- nsaserefpolicy/policy/modules/services/cups.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/cups.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/cups.te 2007-05-04 12:31:34.000000000 -0400
@@ -93,8 +93,6 @@
# generic socket here until appletalk socket is available in kernels
allow cupsd_t self:socket create_socket_perms;
@@ -3058,9 +3057,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
seutil_sigchld_newrole(cupsd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-2.6.2/policy/modules/services/cvs.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-2.6.3/policy/modules/services/cvs.te
--- nsaserefpolicy/policy/modules/services/cvs.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/cvs.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/cvs.te 2007-05-04 12:31:34.000000000 -0400
@@ -16,6 +16,7 @@
type cvs_t;
type cvs_exec_t;
@@ -3069,9 +3068,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.
role system_r types cvs_t;
type cvs_data_t; # customizable
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-2.6.2/policy/modules/services/cyrus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-2.6.3/policy/modules/services/cyrus.te
--- nsaserefpolicy/policy/modules/services/cyrus.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/cyrus.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/cyrus.te 2007-05-04 12:31:34.000000000 -0400
@@ -145,6 +145,7 @@
optional_policy(`
@@ -3080,9 +3079,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-2.6.2/policy/modules/services/dbus.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-2.6.3/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/dbus.if 2007-04-30 13:30:42.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/dbus.if 2007-05-04 12:31:34.000000000 -0400
@@ -49,6 +49,12 @@
## </param>
#
@@ -3202,9 +3201,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-2.6.2/policy/modules/services/dbus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-2.6.3/policy/modules/services/dbus.te
--- nsaserefpolicy/policy/modules/services/dbus.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/dbus.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/dbus.te 2007-05-04 12:31:34.000000000 -0400
@@ -40,8 +40,6 @@
# Receive notifications of policy reloads and enforcing status changes.
allow system_dbusd_t self:netlink_selinux_socket { create bind read };
@@ -3233,9 +3232,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
sysnet_domtrans_dhcpc(system_dbusd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-2.6.2/policy/modules/services/dhcp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-2.6.3/policy/modules/services/dhcp.te
--- nsaserefpolicy/policy/modules/services/dhcp.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/dhcp.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/dhcp.te 2007-05-04 12:31:34.000000000 -0400
@@ -119,6 +119,8 @@
dbus_system_bus_client_template(dhcpd,dhcpd_t)
dbus_connect_system_bus(dhcpd_t)
@@ -3245,9 +3244,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-2.6.2/policy/modules/services/djbdns.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-2.6.3/policy/modules/services/djbdns.te
--- nsaserefpolicy/policy/modules/services/djbdns.te 2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/djbdns.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/djbdns.te 2007-05-04 12:31:34.000000000 -0400
@@ -44,4 +44,7 @@
libs_use_ld_so(djbdns_axfrdns_t)
libs_use_shared_libs(djbdns_axfrdns_t)
@@ -3257,9 +3256,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbd
+ ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-2.6.2/policy/modules/services/dovecot.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-2.6.3/policy/modules/services/dovecot.fc
--- nsaserefpolicy/policy/modules/services/dovecot.fc 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/dovecot.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/dovecot.fc 2007-05-04 12:31:34.000000000 -0400
@@ -17,10 +17,12 @@
ifdef(`distro_debian', `
@@ -3273,9 +3272,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
')
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-2.6.2/policy/modules/services/dovecot.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-2.6.3/policy/modules/services/dovecot.if
--- nsaserefpolicy/policy/modules/services/dovecot.if 2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/dovecot.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/dovecot.if 2007-05-04 12:31:34.000000000 -0400
@@ -18,3 +18,43 @@
manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
@@ -3320,9 +3319,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
+ domtrans_pattern($1,dovecot_deliver_exec_t,dovecot_deliver_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-2.6.2/policy/modules/services/dovecot.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-2.6.3/policy/modules/services/dovecot.te
--- nsaserefpolicy/policy/modules/services/dovecot.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/dovecot.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/dovecot.te 2007-05-04 12:31:34.000000000 -0400
@@ -15,6 +15,12 @@
domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t)
role system_r types dovecot_auth_t;
@@ -3444,9 +3443,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
+ term_dontaudit_use_unallocated_ttys(dovecot_deliver_t)
+ term_dontaudit_use_generic_ptys(dovecot_deliver_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-2.6.2/policy/modules/services/ftp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-2.6.3/policy/modules/services/ftp.te
--- nsaserefpolicy/policy/modules/services/ftp.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/ftp.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/ftp.te 2007-05-04 12:31:34.000000000 -0400
@@ -223,10 +223,15 @@
userdom_manage_all_users_home_content_dirs(ftpd_t)
userdom_manage_all_users_home_content_files(ftpd_t)
@@ -3463,9 +3462,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
')
tunable_policy(`ftp_home_dir && use_nfs_home_dirs',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-2.6.2/policy/modules/services/hal.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-2.6.3/policy/modules/services/hal.fc
--- nsaserefpolicy/policy/modules/services/hal.fc 2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/hal.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/hal.fc 2007-05-04 12:31:34.000000000 -0400
@@ -8,4 +8,12 @@
/var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0)
@@ -3479,10 +3478,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
+/usr/libexec/hal-system-sonypic -- gen_context(system_u:object_r:hald_sonypic_exec_t,s0)
+
+/var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-2.6.2/policy/modules/services/hal.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-2.6.3/policy/modules/services/hal.if
--- nsaserefpolicy/policy/modules/services/hal.if 2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/hal.if 2007-04-30 11:26:06.000000000 -0400
-@@ -208,3 +208,80 @@
++++ serefpolicy-2.6.3/policy/modules/services/hal.if 2007-05-04 13:08:40.000000000 -0400
+@@ -208,3 +208,98 @@
files_search_pids($1)
allow $1 hald_var_run_t:file rw_file_perms;
')
@@ -3563,9 +3562,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
+ allow $1 hald_t:fifo_file rw_fifo_file_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-2.6.2/policy/modules/services/hal.te
++########################################
++## <summary>
++## Allow ptrace of hal domain
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`hal_ptrace',`
++ gen_require(`
++ type hald_t;
++ ')
++
++ allow $1 hald_t:process ptrace;
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-2.6.3/policy/modules/services/hal.te
--- nsaserefpolicy/policy/modules/services/hal.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/hal.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/hal.te 2007-05-04 12:31:34.000000000 -0400
@@ -16,9 +16,33 @@
type hald_var_run_t;
files_pid_file(hald_var_run_t)
@@ -3808,9 +3825,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
+ term_dontaudit_use_console(hald_sonypic_t)
+ term_dontaudit_use_generic_ptys(hald_sonypic_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-2.6.2/policy/modules/services/inetd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-2.6.3/policy/modules/services/inetd.te
--- nsaserefpolicy/policy/modules/services/inetd.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/inetd.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/inetd.te 2007-05-04 12:31:34.000000000 -0400
@@ -135,8 +135,8 @@
mls_fd_use_all_levels(inetd_t)
mls_fd_share_all_levels(inetd_t)
@@ -3831,9 +3848,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
files_search_home(inetd_child_t)
manage_dirs_pattern(inetd_child_t,inetd_child_tmp_t,inetd_child_tmp_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-2.6.2/policy/modules/services/kerberos.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-2.6.3/policy/modules/services/kerberos.if
--- nsaserefpolicy/policy/modules/services/kerberos.if 2007-04-10 13:21:52.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/kerberos.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/kerberos.if 2007-05-04 12:31:34.000000000 -0400
@@ -33,43 +33,10 @@
#
interface(`kerberos_use',`
@@ -3980,9 +3997,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
-
+ allow $1 krb5_keytab_t:file read_file_perms;
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-2.6.2/policy/modules/services/kerberos.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-2.6.3/policy/modules/services/kerberos.te
--- nsaserefpolicy/policy/modules/services/kerberos.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/kerberos.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/kerberos.te 2007-05-04 12:31:34.000000000 -0400
@@ -5,6 +5,7 @@
#
# Declarations
@@ -4028,9 +4045,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
+ pcscd_stream_connect(kerberosclient)
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-2.6.2/policy/modules/services/mailman.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-2.6.3/policy/modules/services/mailman.if
--- nsaserefpolicy/policy/modules/services/mailman.if 2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/mailman.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/mailman.if 2007-05-04 12:31:34.000000000 -0400
@@ -275,6 +275,25 @@
#######################################
@@ -4057,9 +4074,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail
## Allow domain to read mailman archive files.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-2.6.2/policy/modules/services/mta.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-2.6.3/policy/modules/services/mta.if
--- nsaserefpolicy/policy/modules/services/mta.if 2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/mta.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/mta.if 2007-05-04 12:31:34.000000000 -0400
@@ -847,6 +847,25 @@
manage_files_pattern($1,mqueue_spool_t,mqueue_spool_t)
')
@@ -4086,9 +4103,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
#######################################
## <summary>
## Read sendmail binary.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-2.6.2/policy/modules/services/mta.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-2.6.3/policy/modules/services/mta.te
--- nsaserefpolicy/policy/modules/services/mta.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/mta.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/mta.te 2007-05-04 12:31:34.000000000 -0400
@@ -27,6 +27,7 @@
type sendmail_exec_t;
@@ -4105,9 +4122,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
# apache should set close-on-exec
apache_dontaudit_append_log(system_mail_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.6.2/policy/modules/services/nis.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.6.3/policy/modules/services/nis.if
--- nsaserefpolicy/policy/modules/services/nis.if 2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/nis.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/nis.if 2007-05-04 12:31:34.000000000 -0400
@@ -48,8 +48,8 @@
corenet_udp_bind_all_nodes($1)
corenet_tcp_bind_generic_port($1)
@@ -4119,10 +4136,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
corenet_dontaudit_tcp_bind_all_ports($1)
corenet_dontaudit_udp_bind_all_ports($1)
corenet_tcp_connect_portmap_port($1)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-2.6.2/policy/modules/services/nis.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-2.6.3/policy/modules/services/nis.te
--- nsaserefpolicy/policy/modules/services/nis.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/nis.te 2007-04-30 11:26:06.000000000 -0400
-@@ -258,6 +258,8 @@
++++ serefpolicy-2.6.3/policy/modules/services/nis.te 2007-05-04 12:31:34.000000000 -0400
+@@ -120,6 +120,13 @@
+ ')
+
+ optional_policy(`
++ dbus_system_bus_client_template(ypbind,ypbind_t)
++ dbus_connect_system_bus(ypbind_t)
++ dbus_send_system_bus(ypbind_t)
++ init_dbus_chat_script(ypbind_t)
++')
++
++optional_policy(`
+ seutil_sigchld_newrole(ypbind_t)
+ ')
+
+@@ -258,6 +265,8 @@
corenet_udp_bind_all_nodes(ypserv_t)
corenet_tcp_bind_reserved_port(ypserv_t)
corenet_udp_bind_reserved_port(ypserv_t)
@@ -4131,7 +4162,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
corenet_dontaudit_tcp_bind_all_reserved_ports(ypserv_t)
corenet_dontaudit_udp_bind_all_reserved_ports(ypserv_t)
corenet_sendrecv_generic_server_packets(ypserv_t)
-@@ -332,6 +334,8 @@
+@@ -332,6 +341,8 @@
corenet_udp_bind_all_nodes(ypxfr_t)
corenet_tcp_bind_reserved_port(ypxfr_t)
corenet_udp_bind_reserved_port(ypxfr_t)
@@ -4140,9 +4171,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)
corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t)
corenet_tcp_connect_all_ports(ypxfr_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-2.6.2/policy/modules/services/nscd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-2.6.3/policy/modules/services/nscd.te
--- nsaserefpolicy/policy/modules/services/nscd.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/nscd.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/nscd.te 2007-05-04 12:31:34.000000000 -0400
@@ -28,14 +28,14 @@
# Local policy
#
@@ -4181,9 +4212,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd
+ ')
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-2.6.2/policy/modules/services/ntp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-2.6.3/policy/modules/services/ntp.te
--- nsaserefpolicy/policy/modules/services/ntp.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/ntp.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/ntp.te 2007-05-04 12:31:34.000000000 -0400
@@ -137,6 +137,10 @@
')
@@ -4195,9 +4226,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
seutil_sigchld_newrole(ntpd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-2.6.2/policy/modules/services/oddjob.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-2.6.3/policy/modules/services/oddjob.te
--- nsaserefpolicy/policy/modules/services/oddjob.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/oddjob.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/oddjob.te 2007-05-04 12:31:34.000000000 -0400
@@ -27,7 +27,7 @@
# oddjob local policy
#
@@ -4207,9 +4238,203 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj
allow oddjob_t self:process { setexec signal };
allow oddjob_t self:fifo_file { read write };
allow oddjob_t self:unix_stream_socket create_stream_socket_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-2.6.2/policy/modules/services/pcscd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.fc serefpolicy-2.6.3/policy/modules/services/openct.fc
+--- nsaserefpolicy/policy/modules/services/openct.fc 2006-11-16 17:15:20.000000000 -0500
++++ serefpolicy-2.6.3/policy/modules/services/openct.fc 2007-05-04 12:31:34.000000000 -0400
+@@ -1,9 +1,3 @@
+-#
+-# /usr
+-#
+-/usr/sbin/openct-control -- gen_context(system_u:object_r:openct_exec_t,s0)
+
+-#
+-# /var
+-#
+-/var/run/openct(/.*)? gen_context(system_u:object_r:openct_var_run_t,s0)
++/usr/sbin/ifdhandler -- gen_context(system_u:object_r:openct_exec_t,s0)
++/var/run/openct(/.*)? gen_context(system_u:object_r:openct_var_run_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.if serefpolicy-2.6.3/policy/modules/services/openct.if
+--- nsaserefpolicy/policy/modules/services/openct.if 2006-11-16 17:15:20.000000000 -0500
++++ serefpolicy-2.6.3/policy/modules/services/openct.if 2007-05-04 12:31:34.000000000 -0400
+@@ -1 +1,83 @@
+-## <summary>Service for handling smart card readers.</summary>
++
++## <summary>policy for openct</summary>
++
++########################################
++## <summary>
++## Execute a domain transition to run openct.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`openct_domtrans',`
++ gen_require(`
++ type openct_t, openct_exec_t;
++ ')
++
++ domain_auto_trans($1,openct_exec_t,openct_t)
++
++ allow openct_t $1:fd use;
++ allow openct_t $1:fifo_file rw_file_perms;
++ allow openct_t $1:process sigchld;
++')
++
++########################################
++## <summary>
++## Read openct PID files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`openct_read_pid_files',`
++ gen_require(`
++ type openct_var_run_t;
++ ')
++
++ files_search_pids($1)
++ allow $1 openct_var_run_t:dir search_dir_perms;
++ allow $1 openct_var_run_t:file r_file_perms;
++')
++
++########################################
++## <summary>
++## Connect to openct over an unix stream socket.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`openct_stream_connect',`
++ gen_require(`
++ type openct_t, openct_var_run_t;
++ ')
++
++ files_search_pids($1)
++ allow $1 openct_var_run_t:dir search_dir_perms;
++ allow $1 openct_var_run_t:sock_file write;
++ allow $1 openct_t:unix_stream_socket connectto;
++')
++
++########################################
++## <summary>
++## Send openct a null signal.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`openct_signull',`
++ gen_require(`
++ type openct_t;
++ ')
++
++ allow $1 openct_t:process signull;
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-2.6.3/policy/modules/services/openct.te
+--- nsaserefpolicy/policy/modules/services/openct.te 2007-04-23 09:36:01.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/openct.te 2007-05-04 12:31:34.000000000 -0400
+@@ -1,5 +1,4 @@
+-
+-policy_module(openct,1.1.0)
++policy_module(openct,1.0.0)
+
+ ########################################
+ #
+@@ -8,58 +7,48 @@
+
+ type openct_t;
+ type openct_exec_t;
+-init_daemon_domain(openct_t,openct_exec_t)
++domain_type(openct_t)
++init_daemon_domain(openct_t, openct_exec_t)
+
+ type openct_var_run_t;
+ files_pid_file(openct_var_run_t)
+
+ ########################################
+ #
+-# Local policy
++# openct local policy
+ #
+
+-dontaudit openct_t self:capability sys_tty_config;
+-allow openct_t self:process signal_perms;
+-
+-manage_files_pattern(openct_t,openct_var_run_t,openct_var_run_t)
+-files_pid_filetrans(openct_t,openct_var_run_t,file)
+-
+-kernel_read_kernel_sysctls(openct_t)
+-kernel_list_proc(openct_t)
+-kernel_read_proc_symlinks(openct_t)
+-
+-dev_read_sysfs(openct_t)
+-# openct asks for this
+-dev_rw_usbfs(openct_t)
+-
++# Init script handling
++init_use_fds(openct_t)
++init_use_script_ptys(openct_t)
+ domain_use_interactive_fds(openct_t)
+
+-# openct asks for this
+-files_read_etc_files(openct_t)
++## internal communication is often done using fifo and unix sockets.
++allow openct_t self:fifo_file rw_file_perms;
++allow openct_t self:unix_stream_socket create_stream_socket_perms;
+
+-fs_getattr_all_fs(openct_t)
+-fs_search_auto_mountpoints(openct_t)
++files_read_etc_files(openct_t)
+
+ libs_use_ld_so(openct_t)
+ libs_use_shared_libs(openct_t)
+
+-logging_send_syslog_msg(openct_t)
+-
+ miscfiles_read_localization(openct_t)
+
+-userdom_dontaudit_use_unpriv_user_fds(openct_t)
+-userdom_dontaudit_search_sysadm_home_dirs(openct_t)
+-
+ ifdef(`targeted_policy',`
+ term_dontaudit_use_unallocated_ttys(openct_t)
+ term_dontaudit_use_generic_ptys(openct_t)
+- files_dontaudit_read_root_files(openct_t)
+ ')
+
+-optional_policy(`
+- seutil_sigchld_newrole(openct_t)
+-')
++allow openct_t openct_var_run_t:file manage_file_perms;
++allow openct_t openct_var_run_t:dir manage_dir_perms;
++allow openct_t openct_var_run_t:sock_file manage_file_perms;
++files_pid_filetrans(openct_t,openct_var_run_t, { file dir })
++
++logging_send_syslog_msg(openct_t)
++
++dev_rw_smartcard(openct_t)
++dev_search_sysfs(openct_t)
++dev_rw_generic_usb_dev(openct_t)
++
++
+
+-optional_policy(`
+- udev_read_db(openct_t)
+-')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-2.6.3/policy/modules/services/pcscd.te
--- nsaserefpolicy/policy/modules/services/pcscd.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/pcscd.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/pcscd.te 2007-05-04 12:31:34.000000000 -0400
@@ -21,6 +21,7 @@
#
@@ -4218,9 +4443,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcsc
allow pcscd_t self:fifo_file { read write };
allow pcscd_t self:unix_stream_socket create_stream_socket_perms;
allow pcscd_t self:unix_dgram_socket create_socket_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-2.6.2/policy/modules/services/pegasus.if
+@@ -62,5 +63,13 @@
+ ')
+
+ optional_policy(`
++ openct_stream_connect(pcscd_t)
++ openct_read_pid_files(pcscd_t)
++ openct_signull(pcscd_t)
++')
++
++optional_policy(`
+ rpm_use_script_fds(pcscd_t)
+ ')
++
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-2.6.3/policy/modules/services/pegasus.if
--- nsaserefpolicy/policy/modules/services/pegasus.if 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/pegasus.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/pegasus.if 2007-05-04 12:31:34.000000000 -0400
@@ -1 +1,19 @@
## <summary>The Open Group Pegasus CIM/WBEM Server.</summary>
+
@@ -4241,9 +4480,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
+
+ domtrans_pattern($1,pegasus_exec_t,pegasus_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-2.6.2/policy/modules/services/pegasus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-2.6.3/policy/modules/services/pegasus.te
--- nsaserefpolicy/policy/modules/services/pegasus.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/pegasus.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/pegasus.te 2007-05-04 12:31:34.000000000 -0400
@@ -38,8 +38,6 @@
allow pegasus_t self:unix_stream_socket create_stream_socket_perms;
allow pegasus_t self:tcp_socket create_stream_socket_perms;
@@ -4285,9 +4524,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-2.6.2/policy/modules/services/postfix.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-2.6.3/policy/modules/services/postfix.if
--- nsaserefpolicy/policy/modules/services/postfix.if 2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/postfix.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/postfix.if 2007-05-04 12:31:34.000000000 -0400
@@ -122,6 +122,7 @@
allow postfix_$1_t postfix_master_t:unix_stream_socket { connectto rw_stream_socket_perms };
allow postfix_$1_t self:tcp_socket create_socket_perms;
@@ -4319,9 +4558,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+ allow $1 postfix_private_t:dir list_dir_perms;
+ create_sock_files_pattern($1,postfix_private_t,postfix_private_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-2.6.2/policy/modules/services/postfix.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-2.6.3/policy/modules/services/postfix.te
--- nsaserefpolicy/policy/modules/services/postfix.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/postfix.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/postfix.te 2007-05-04 12:31:34.000000000 -0400
@@ -169,6 +169,8 @@
mta_rw_aliases(postfix_master_t)
mta_read_sendmail_bin(postfix_master_t)
@@ -4431,9 +4670,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+ dovecot_auth_stream_connect(postfix_smtpd_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-2.6.2/policy/modules/services/ppp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-2.6.3/policy/modules/services/ppp.te
--- nsaserefpolicy/policy/modules/services/ppp.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/ppp.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/ppp.te 2007-05-04 12:31:34.000000000 -0400
@@ -155,7 +155,7 @@
files_exec_etc_files(pppd_t)
@@ -4443,9 +4682,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.
files_dontaudit_write_etc_files(pppd_t)
# for scripts
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-2.6.2/policy/modules/services/procmail.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-2.6.3/policy/modules/services/procmail.te
--- nsaserefpolicy/policy/modules/services/procmail.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/procmail.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/procmail.te 2007-05-04 12:31:34.000000000 -0400
@@ -10,6 +10,7 @@
type procmail_exec_t;
domain_type(procmail_t)
@@ -4471,9 +4710,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc
')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-2.6.2/policy/modules/services/pyzor.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-2.6.3/policy/modules/services/pyzor.te
--- nsaserefpolicy/policy/modules/services/pyzor.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/pyzor.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/pyzor.te 2007-05-04 12:31:34.000000000 -0400
@@ -54,6 +54,11 @@
corenet_udp_sendrecv_all_nodes(pyzor_t)
corenet_udp_sendrecv_all_ports(pyzor_t)
@@ -4502,9 +4741,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
spamassassin_read_spamd_tmp_files(pyzor_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-2.6.2/policy/modules/services/radius.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-2.6.3/policy/modules/services/radius.te
--- nsaserefpolicy/policy/modules/services/radius.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/radius.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/radius.te 2007-05-04 12:31:34.000000000 -0400
@@ -130,3 +130,7 @@
optional_policy(`
udev_read_db(radiusd_t)
@@ -4513,9 +4752,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi
+optional_policy(`
+ samba_read_var_files(radiusd_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-2.6.2/policy/modules/services/rlogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-2.6.3/policy/modules/services/rlogin.te
--- nsaserefpolicy/policy/modules/services/rlogin.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rlogin.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rlogin.te 2007-05-04 12:31:34.000000000 -0400
@@ -64,6 +64,7 @@
fs_search_auto_mountpoints(rlogind_t)
@@ -4524,9 +4763,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog
auth_rw_login_records(rlogind_t)
auth_use_nsswitch(rlogind_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.fc serefpolicy-2.6.2/policy/modules/services/rpcbind.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.fc serefpolicy-2.6.3/policy/modules/services/rpcbind.fc
--- nsaserefpolicy/policy/modules/services/rpcbind.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/rpcbind.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rpcbind.fc 2007-05-04 12:31:34.000000000 -0400
@@ -0,0 +1,6 @@
+
+/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0)
@@ -4534,9 +4773,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
+/var/run/rpc.statd.pid -- gen_context(system_u:object_r:rpcbind_var_run_t,s0)
+/var/run/rpcbind.sock -- gen_context(system_u:object_r:rpcbind_var_run_t,s0)
+/var/lib/rpcbind(/.*)? gen_context(system_u:object_r:rpcbind_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-2.6.2/policy/modules/services/rpcbind.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-2.6.3/policy/modules/services/rpcbind.if
--- nsaserefpolicy/policy/modules/services/rpcbind.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/rpcbind.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rpcbind.if 2007-05-04 12:31:34.000000000 -0400
@@ -0,0 +1,104 @@
+
+## <summary>policy for rpcbind</summary>
@@ -4642,9 +4881,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
+ allow $1 rpcbind_var_lib_t:dir rw_dir_perms;
+ files_search_var_lib($1)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-2.6.2/policy/modules/services/rpcbind.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-2.6.3/policy/modules/services/rpcbind.te
--- nsaserefpolicy/policy/modules/services/rpcbind.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/rpcbind.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rpcbind.te 2007-05-04 12:31:35.000000000 -0400
@@ -0,0 +1,83 @@
+policy_module(rpcbind,1.0.0)
+
@@ -4729,9 +4968,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-2.6.2/policy/modules/services/rpc.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-2.6.3/policy/modules/services/rpc.if
--- nsaserefpolicy/policy/modules/services/rpc.if 2007-03-20 23:38:10.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rpc.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rpc.if 2007-05-04 12:31:35.000000000 -0400
@@ -89,8 +89,11 @@
# bind to arbitary unused ports
corenet_tcp_bind_generic_port($1_t)
@@ -4745,9 +4984,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
fs_rw_rpc_named_pipes($1_t)
fs_search_auto_mountpoints($1_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-2.6.2/policy/modules/services/rpc.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-2.6.3/policy/modules/services/rpc.te
--- nsaserefpolicy/policy/modules/services/rpc.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rpc.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rpc.te 2007-05-04 12:31:35.000000000 -0400
@@ -79,6 +79,7 @@
optional_policy(`
@@ -4764,9 +5003,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
')
tunable_policy(`nfs_export_all_ro',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-2.6.2/policy/modules/services/rsync.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-2.6.3/policy/modules/services/rsync.te
--- nsaserefpolicy/policy/modules/services/rsync.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rsync.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rsync.te 2007-05-04 12:31:35.000000000 -0400
@@ -17,6 +17,7 @@
type rsync_t;
type rsync_exec_t;
@@ -4775,17 +5014,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn
role system_r types rsync_t;
type rsync_data_t;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-2.6.2/policy/modules/services/rwho.fc
---- nsaserefpolicy/policy/modules/services/rwho.fc 2007-04-30 22:35:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rwho.fc 2007-04-30 11:26:06.000000000 -0400
-@@ -1,3 +1,3 @@
--/usr/sbin/rwhod -- gen_context(system_u:object_r:rwho_exec_t,s0)
-
-+/usr/sbin/rwhod -- gen_context(system_u:object_r:rwho_exec_t,s0)
- /var/spool/rwho(/.*)? gen_context(system_u:object_r:rwho_spool_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-2.6.2/policy/modules/services/rwho.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-2.6.3/policy/modules/services/rwho.if
--- nsaserefpolicy/policy/modules/services/rwho.if 2007-04-30 22:35:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rwho.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/rwho.if 2007-05-04 12:31:35.000000000 -0400
@@ -1 +1,84 @@
-## <summary>Who is logged in on other machines?</summary>
+
@@ -4872,79 +5103,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho
+ allow $1 rwho_spool_t:dir rw_dir_perms;
+ files_search_spool($1)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-2.6.2/policy/modules/services/rwho.te
---- nsaserefpolicy/policy/modules/services/rwho.te 2007-04-30 22:35:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/rwho.te 2007-04-30 12:23:50.000000000 -0400
-@@ -1,4 +1,3 @@
--
- policy_module(rwho,1.0.0)
-
- ########################################
-@@ -8,6 +7,7 @@
-
- type rwho_t;
- type rwho_exec_t;
-+domain_type(rwho_t)
- init_daemon_domain(rwho_t, rwho_exec_t)
-
- # var/spool files
-@@ -19,6 +19,7 @@
- # rwho local policy
- #
-
-+#============= rwho_t ==============
- allow rwho_t self:capability sys_chroot;
- allow rwho_t self:unix_dgram_socket create;
- allow rwho_t self:fifo_file rw_file_perms;
-@@ -30,31 +31,31 @@
- allow rwho_t rwho_spool_t:file manage_file_perms;
- files_spool_filetrans(rwho_t,rwho_spool_t, { file dir })
-
--kernel_read_system_state(rwho_t)
--
--corenet_non_ipsec_sendrecv(rwho_t)
--corenet_udp_sendrecv_all_if(rwho_t)
--corenet_udp_sendrecv_all_nodes(rwho_t)
--corenet_udp_sendrecv_all_ports(rwho_t)
--corenet_udp_bind_all_nodes(rwho_t)
--corenet_udp_bind_rwho_port(rwho_t)
--corenet_sendrecv_rwho_server_packets(rwho_t)
--
- domain_use_interactive_fds(rwho_t)
-
- files_read_etc_files(rwho_t)
-
- init_read_utmp(rwho_t)
- init_dontaudit_write_utmp(rwho_t)
-+init_use_fds(rwho_t)
-+init_use_script_ptys(rwho_t)
-+
-+kernel_read_system_state(rwho_t)
-
- libs_use_ld_so(rwho_t)
- libs_use_shared_libs(rwho_t)
-
- miscfiles_read_localization(rwho_t)
-
-+# Default Networking
-+corenet_non_ipsec_sendrecv(rwho_t)
-+corenet_udp_sendrecv_all_if(rwho_t)
-+corenet_udp_sendrecv_all_nodes(rwho_t)
-+corenet_udp_sendrecv_all_ports(rwho_t)
-+corenet_udp_bind_all_nodes(rwho_t)
-+corenet_udp_bind_rwho_port(rwho_t)
-+
- sysnet_dns_name_resolve(rwho_t)
-
--ifdef(`targeted_policy',`
-- term_dontaudit_use_unallocated_ttys(rwho_t)
-- term_dontaudit_use_generic_ptys(rwho_t)
--')
-+term_use_all_user_ttys(rwho_t)
-+term_use_all_user_ptys(rwho_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-2.6.2/policy/modules/services/samba.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-2.6.3/policy/modules/services/samba.fc
--- nsaserefpolicy/policy/modules/services/samba.fc 2007-02-23 16:50:01.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/samba.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/samba.fc 2007-05-04 12:31:35.000000000 -0400
@@ -27,6 +27,9 @@
/var/cache/samba/winbindd_privileged(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0)
@@ -4955,9 +5116,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
/var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-2.6.2/policy/modules/services/samba.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-2.6.3/policy/modules/services/samba.if
--- nsaserefpolicy/policy/modules/services/samba.if 2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/samba.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/samba.if 2007-05-04 12:31:35.000000000 -0400
@@ -177,6 +177,27 @@
########################################
@@ -5074,9 +5235,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-2.6.2/policy/modules/services/samba.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-2.6.3/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/samba.te 2007-05-01 16:47:09.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/samba.te 2007-05-04 12:31:35.000000000 -0400
@@ -28,10 +28,39 @@
## </desc>
gen_tunable(samba_share_nfs,false)
@@ -5307,9 +5468,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
+unconfined_domain(samba_unconfined_script_t)
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-2.6.2/policy/modules/services/sasl.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-2.6.3/policy/modules/services/sasl.te
--- nsaserefpolicy/policy/modules/services/sasl.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/sasl.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/sasl.te 2007-05-04 12:31:35.000000000 -0400
@@ -63,6 +63,7 @@
selinux_compute_access_vector(saslauthd_t)
@@ -5318,9 +5479,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl
auth_use_nsswitch(saslauthd_t)
domain_use_interactive_fds(saslauthd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-2.6.2/policy/modules/services/sendmail.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-2.6.3/policy/modules/services/sendmail.if
--- nsaserefpolicy/policy/modules/services/sendmail.if 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/sendmail.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/sendmail.if 2007-05-04 12:31:35.000000000 -0400
@@ -76,6 +76,26 @@
########################################
@@ -5357,9 +5518,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-2.6.2/policy/modules/services/smartmon.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-2.6.3/policy/modules/services/setroubleshoot.te
+--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-04-23 09:36:01.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/setroubleshoot.te 2007-05-04 12:31:35.000000000 -0400
+@@ -28,7 +28,7 @@
+ #
+
+ allow setroubleshootd_t self:capability { dac_override sys_tty_config };
+-allow setroubleshootd_t self:process { signal getattr getsched };
++allow setroubleshootd_t self:process { signull signal getattr getsched };
+ allow setroubleshootd_t self:fifo_file rw_fifo_file_perms;
+ allow setroubleshootd_t self:tcp_socket create_stream_socket_perms;
+ allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto };
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-2.6.3/policy/modules/services/smartmon.te
--- nsaserefpolicy/policy/modules/services/smartmon.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/smartmon.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/smartmon.te 2007-05-04 12:31:35.000000000 -0400
@@ -60,6 +60,7 @@
fs_search_auto_mountpoints(fsdaemon_t)
@@ -5368,9 +5541,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar
storage_raw_read_fixed_disk(fsdaemon_t)
storage_raw_write_fixed_disk(fsdaemon_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-2.6.2/policy/modules/services/snmp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-2.6.3/policy/modules/services/snmp.te
--- nsaserefpolicy/policy/modules/services/snmp.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/snmp.te 2007-04-30 12:22:26.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/snmp.te 2007-05-04 12:31:35.000000000 -0400
@@ -26,7 +26,7 @@
# Local policy
#
@@ -5380,19 +5553,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp
allow snmpd_t self:fifo_file rw_fifo_file_perms;
allow snmpd_t self:unix_dgram_socket create_socket_perms;
allow snmpd_t self:unix_stream_socket create_stream_socket_perms;
-@@ -134,6 +134,11 @@
+@@ -134,11 +134,12 @@
')
optional_policy(`
+- nis_use_ypbind(snmpd_t)
+ mta_read_config(snmpd_t)
+ mta_search_queue(snmpd_t)
-+')
-+
-+optional_policy(`
- nis_use_ypbind(snmpd_t)
')
-@@ -146,9 +151,19 @@
+ optional_policy(`
+- nscd_socket_use(snmpd_t)
++ auth_use_nsswitch(snmpd_t)
+ ')
+
+ optional_policy(`
+@@ -146,9 +147,19 @@
')
optional_policy(`
@@ -5412,9 +5588,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp
')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.6.2/policy/modules/services/spamassassin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.6.3/policy/modules/services/spamassassin.te
--- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/spamassassin.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/spamassassin.te 2007-05-04 12:31:35.000000000 -0400
@@ -6,14 +6,12 @@
# Declarations
#
@@ -5468,18 +5644,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
nis_use_ypbind(spamd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-2.6.2/policy/modules/services/squid.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-2.6.3/policy/modules/services/squid.fc
--- nsaserefpolicy/policy/modules/services/squid.fc 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/squid.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/squid.fc 2007-05-04 12:31:35.000000000 -0400
@@ -12,3 +12,5 @@
/var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0)
/var/spool/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0)
+/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
+/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-2.6.2/policy/modules/services/squid.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-2.6.3/policy/modules/services/squid.if
--- nsaserefpolicy/policy/modules/services/squid.if 2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/squid.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/squid.if 2007-05-04 12:31:35.000000000 -0400
@@ -36,7 +36,7 @@
')
@@ -5513,9 +5689,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
+ dontaudit $1 squid_cache_t:dir search_dir_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-2.6.2/policy/modules/services/squid.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-2.6.3/policy/modules/services/squid.te
--- nsaserefpolicy/policy/modules/services/squid.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/squid.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/squid.te 2007-05-04 12:31:35.000000000 -0400
@@ -89,6 +89,8 @@
corenet_tcp_bind_ftp_port(squid_t)
corenet_tcp_bind_gopher_port(squid_t)
@@ -5546,9 +5722,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
+ sysnet_read_config(httpd_squid_script_t)
+ corenet_non_ipsec_sendrecv(httpd_squid_script_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-2.6.2/policy/modules/services/ssh.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-2.6.3/policy/modules/services/ssh.if
--- nsaserefpolicy/policy/modules/services/ssh.if 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/ssh.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/ssh.if 2007-05-04 12:31:35.000000000 -0400
@@ -709,3 +709,42 @@
dontaudit $1 sshd_key_t:file { getattr read };
@@ -5592,9 +5768,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
+ dontaudit $2 $1_ssh_agent_t:fd use;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-2.6.2/policy/modules/services/ssh.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-2.6.3/policy/modules/services/ssh.te
--- nsaserefpolicy/policy/modules/services/ssh.te 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/services/ssh.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/ssh.te 2007-05-04 12:31:35.000000000 -0400
@@ -24,11 +24,11 @@
# Type for the ssh-agent executable.
@@ -5628,20 +5804,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
ifdef(`TODO',`
tunable_policy(`ssh_sysadm_login',`
# Relabel and access ptys created by sshd
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-2.6.2/policy/modules/services/w3c.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-2.6.3/policy/modules/services/w3c.fc
--- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/w3c.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/w3c.fc 2007-05-04 12:31:35.000000000 -0400
@@ -0,0 +1,2 @@
+/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0)
+/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-2.6.2/policy/modules/services/w3c.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-2.6.3/policy/modules/services/w3c.if
--- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/w3c.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/w3c.if 2007-05-04 12:31:35.000000000 -0400
@@ -0,0 +1 @@
+## <summary>W3C</summary>
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-2.6.2/policy/modules/services/w3c.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-2.6.3/policy/modules/services/w3c.te
--- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/services/w3c.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/services/w3c.te 2007-05-04 12:31:35.000000000 -0400
@@ -0,0 +1,14 @@
+policy_module(w3c,1.2.1)
+
@@ -5657,14 +5833,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.
+corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t)
+
+miscfiles_read_certs(httpd_w3c_validator_script_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-2.6.2/policy/modules/system/application.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-2.6.3/policy/modules/system/application.fc
--- nsaserefpolicy/policy/modules/system/application.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/application.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/application.fc 2007-05-04 12:31:35.000000000 -0400
@@ -0,0 +1 @@
+# No application file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-2.6.2/policy/modules/system/application.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-2.6.3/policy/modules/system/application.if
--- nsaserefpolicy/policy/modules/system/application.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/application.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/application.if 2007-05-04 12:31:35.000000000 -0400
@@ -0,0 +1,104 @@
+## <summary>Policy for application domains</summary>
+
@@ -5770,9 +5946,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic
+ application_executable_file($2)
+ domain_entry_file($1,$2)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-2.6.2/policy/modules/system/application.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-2.6.3/policy/modules/system/application.te
--- nsaserefpolicy/policy/modules/system/application.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/application.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/application.te 2007-05-04 12:31:35.000000000 -0400
@@ -0,0 +1,14 @@
+
+policy_module(application,1.0.0)
@@ -5788,9 +5964,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic
+ ssh_rw_stream_sockets(application_domain_type)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-2.6.2/policy/modules/system/authlogin.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-2.6.3/policy/modules/system/authlogin.fc
--- nsaserefpolicy/policy/modules/system/authlogin.fc 2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/authlogin.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/authlogin.fc 2007-05-04 12:31:35.000000000 -0400
@@ -14,6 +14,7 @@
/sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
@@ -5799,9 +5975,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
ifdef(`distro_suse', `
/sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-2.6.2/policy/modules/system/authlogin.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-2.6.3/policy/modules/system/authlogin.if
--- nsaserefpolicy/policy/modules/system/authlogin.if 2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/authlogin.if 2007-04-30 12:48:30.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/authlogin.if 2007-05-04 12:31:35.000000000 -0400
@@ -27,11 +27,9 @@
domain_type($1_chkpwd_t)
domain_entry_file($1_chkpwd_t,chkpwd_exec_t)
@@ -6064,9 +6240,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+ auth_dontaudit_read_shadow($1)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-2.6.2/policy/modules/system/authlogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-2.6.3/policy/modules/system/authlogin.te
--- nsaserefpolicy/policy/modules/system/authlogin.te 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/authlogin.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/authlogin.te 2007-05-04 12:31:35.000000000 -0400
@@ -9,6 +9,13 @@
attribute can_read_shadow_passwords;
attribute can_write_shadow_passwords;
@@ -6129,9 +6305,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+optional_policy(`
+ nscd_socket_use(updpwd_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-2.6.2/policy/modules/system/clock.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-2.6.3/policy/modules/system/clock.te
--- nsaserefpolicy/policy/modules/system/clock.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/clock.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/clock.te 2007-05-04 12:31:35.000000000 -0400
@@ -26,8 +26,6 @@
allow hwclock_t self:process signal_perms;
allow hwclock_t self:fifo_file { getattr read write };
@@ -6149,9 +6325,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.
miscfiles_read_localization(hwclock_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-2.6.2/policy/modules/system/fstools.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-2.6.3/policy/modules/system/fstools.fc
--- nsaserefpolicy/policy/modules/system/fstools.fc 2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/fstools.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/fstools.fc 2007-05-04 12:31:35.000000000 -0400
@@ -19,7 +19,6 @@
/sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -6160,9 +6336,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-2.6.2/policy/modules/system/fstools.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-2.6.3/policy/modules/system/fstools.te
--- nsaserefpolicy/policy/modules/system/fstools.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/fstools.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/fstools.te 2007-05-04 12:31:35.000000000 -0400
@@ -9,6 +9,7 @@
type fsadm_t;
type fsadm_exec_t;
@@ -6171,9 +6347,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
role system_r types fsadm_t;
type fsadm_log_t;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-2.6.2/policy/modules/system/fusermount.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-2.6.3/policy/modules/system/fusermount.fc
--- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/fusermount.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/fusermount.fc 2007-05-04 12:31:35.000000000 -0400
@@ -0,0 +1,6 @@
+# fusermount executable will have:
+# label: system_u:object_r:fusermount_exec_t
@@ -6181,9 +6357,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+# MCS categories: <none>
+
+/usr/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-2.6.2/policy/modules/system/fusermount.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-2.6.3/policy/modules/system/fusermount.if
--- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/fusermount.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/fusermount.if 2007-05-04 12:31:35.000000000 -0400
@@ -0,0 +1,41 @@
+## <summary>policy for fusermount</summary>
+
@@ -6227,9 +6403,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+ allow $1 fusermount_t:fd use;
+')
\ No newline at end of file
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-2.6.2/policy/modules/system/fusermount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-2.6.3/policy/modules/system/fusermount.te
--- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/fusermount.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/fusermount.te 2007-05-04 12:31:35.000000000 -0400
@@ -0,0 +1,50 @@
+policy_module(fusermount,1.0.0)
+
@@ -6281,9 +6457,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+ term_use_console(fusermount_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-2.6.2/policy/modules/system/getty.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-2.6.3/policy/modules/system/getty.te
--- nsaserefpolicy/policy/modules/system/getty.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/getty.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/getty.te 2007-05-04 12:31:35.000000000 -0400
@@ -33,7 +33,8 @@
#
@@ -6294,9 +6470,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.
dontaudit getty_t self:capability sys_tty_config;
allow getty_t self:process { getpgid setpgid getsession signal_perms };
allow getty_t self:fifo_file rw_fifo_file_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-2.6.2/policy/modules/system/hostname.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-2.6.3/policy/modules/system/hostname.te
--- nsaserefpolicy/policy/modules/system/hostname.te 2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/hostname.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/hostname.te 2007-05-04 12:31:35.000000000 -0400
@@ -8,8 +8,12 @@
type hostname_t;
@@ -6323,9 +6499,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna
+optional_policy(`
+ unconfined_dontaudit_rw_pipes(hostname_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-2.6.2/policy/modules/system/init.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-2.6.3/policy/modules/system/init.if
--- nsaserefpolicy/policy/modules/system/init.if 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/init.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/init.if 2007-05-04 12:31:35.000000000 -0400
@@ -194,11 +194,14 @@
gen_require(`
type initrc_t;
@@ -6393,16 +6569,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
+
+ allow $1 init_t:process ptrace;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-2.6.2/policy/modules/system/init.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-2.6.3/policy/modules/system/init.te
--- nsaserefpolicy/policy/modules/system/init.te 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/init.te 2007-04-30 11:26:06.000000000 -0400
-@@ -1,5 +1,5 @@
-
--policy_module(init,1.6.1)
-+policy_module(init,1.6.0)
-
- gen_require(`
- class passwd rootok;
++++ serefpolicy-2.6.3/policy/modules/system/init.te 2007-05-04 12:31:35.000000000 -0400
@@ -10,13 +10,20 @@
# Declarations
#
@@ -6500,9 +6669,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-2.6.2/policy/modules/system/ipsec.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-2.6.3/policy/modules/system/ipsec.if
--- nsaserefpolicy/policy/modules/system/ipsec.if 2007-03-26 16:24:13.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/ipsec.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/ipsec.if 2007-05-04 12:31:35.000000000 -0400
@@ -114,6 +114,26 @@
########################################
@@ -6530,9 +6699,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
## Execute racoon in the racoon domain.
## </summary>
## <param name="domain">
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-2.6.2/policy/modules/system/ipsec.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-2.6.3/policy/modules/system/ipsec.te
--- nsaserefpolicy/policy/modules/system/ipsec.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/ipsec.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/ipsec.te 2007-05-04 12:31:35.000000000 -0400
@@ -289,6 +289,7 @@
allow racoon_t self:netlink_selinux_socket { bind create read };
allow racoon_t self:udp_socket create_socket_perms;
@@ -6541,9 +6710,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
# manage pid file
manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-2.6.2/policy/modules/system/iptables.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-2.6.3/policy/modules/system/iptables.te
--- nsaserefpolicy/policy/modules/system/iptables.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/iptables.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/iptables.te 2007-05-04 12:31:35.000000000 -0400
@@ -56,6 +56,7 @@
domain_use_interactive_fds(iptables_t)
@@ -6560,30 +6729,34 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl
+optional_policy(`
+ fail2ban_append_log(iptables_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-2.6.2/policy/modules/system/libraries.fc
---- nsaserefpolicy/policy/modules/system/libraries.fc 2007-04-10 16:13:39.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/libraries.fc 2007-04-30 11:26:06.000000000 -0400
-@@ -82,6 +82,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-2.6.3/policy/modules/system/libraries.fc
+--- nsaserefpolicy/policy/modules/system/libraries.fc 2007-05-04 12:19:22.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/libraries.fc 2007-05-04 12:31:35.000000000 -0400
+@@ -81,8 +81,8 @@
+ /opt/cisco-vpnclient/lib/libvpnapi\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/opt/netbeans(.*/)?jdk.*/linux/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/opt/cxoffice/lib/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/opt/f-secure/fspms/libexec/librapi.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/opt/ibm/java2-ppc64-50/jre/bin/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/opt/f-secure/fspms/libexec/librapi.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
ifdef(`distro_gentoo',`
# despite the extensions, they are actually libs
-@@ -132,6 +133,9 @@
+@@ -132,8 +132,10 @@
+
/usr/(.*/)?nvidia/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib/transgaming_cedega/gddb_parser.so -- gen_context(system_u:object_r:shlib_t,s0)
/usr/lib/win32/.* -- gen_context(system_u:object_r:shlib_t,s0)
+/usr/lib/transgaming_cedega/gddb_parser.so -- gen_context(system_u:object_r:shlib_t,s0)
-+/usr/lib/vlc/codec/libdmo_plugin.so -- gen_context(system_u:object_r:shlib_t,s0)
-+/usr/lib/vlc/codec/librealaudio_plugin.so -- gen_context(system_u:object_r:shlib_t,s0)
++/usr/lib/vlc/codec/libdmo_plugin.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib/vlc/codec/librealaudio_plugin.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/(.*/)?lib(64)?(/.*)?/nvidia/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?(/.*)?/nvidia/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-2.6.2/policy/modules/system/libraries.te
---- nsaserefpolicy/policy/modules/system/libraries.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/libraries.te 2007-04-30 11:26:06.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-2.6.3/policy/modules/system/libraries.te
+--- nsaserefpolicy/policy/modules/system/libraries.te 2007-05-04 12:19:23.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/libraries.te 2007-05-04 12:31:35.000000000 -0400
@@ -62,7 +62,8 @@
manage_dirs_pattern(ldconfig_t,ldconfig_tmp_t,ldconfig_tmp_t)
@@ -6602,9 +6775,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-2.6.2/policy/modules/system/locallogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-2.6.3/policy/modules/system/locallogin.te
--- nsaserefpolicy/policy/modules/system/locallogin.te 2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/locallogin.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/locallogin.te 2007-05-04 12:31:35.000000000 -0400
@@ -48,6 +48,8 @@
allow local_login_t self:msgq create_msgq_perms;
allow local_login_t self:msg { send receive };
@@ -6645,9 +6818,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall
gpm_getattr_gpmctl(local_login_t)
gpm_setattr_gpmctl(local_login_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-2.6.2/policy/modules/system/logging.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-2.6.3/policy/modules/system/logging.if
--- nsaserefpolicy/policy/modules/system/logging.if 2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/logging.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/logging.if 2007-05-04 12:31:35.000000000 -0400
@@ -302,6 +302,25 @@
########################################
@@ -6814,9 +6987,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+ typeattribute $1 can_send_audit_msg;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-2.6.2/policy/modules/system/logging.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-2.6.3/policy/modules/system/logging.te
--- nsaserefpolicy/policy/modules/system/logging.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/logging.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/logging.te 2007-05-04 12:31:35.000000000 -0400
@@ -7,10 +7,15 @@
#
@@ -6902,9 +7075,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
files_read_etc_runtime_files(syslogd_t)
# /initrd is not umounted before minilog starts
files_dontaudit_search_isid_type_dirs(syslogd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-2.6.2/policy/modules/system/lvm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-2.6.3/policy/modules/system/lvm.fc
--- nsaserefpolicy/policy/modules/system/lvm.fc 2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/lvm.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/lvm.fc 2007-05-04 12:31:35.000000000 -0400
@@ -15,6 +15,7 @@
#
/etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0)
@@ -6913,9 +7086,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc
/etc/lvm/archive(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0)
/etc/lvm/backup(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0)
/etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-2.6.2/policy/modules/system/lvm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-2.6.3/policy/modules/system/lvm.te
--- nsaserefpolicy/policy/modules/system/lvm.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/lvm.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/lvm.te 2007-05-04 12:31:35.000000000 -0400
@@ -16,6 +16,7 @@
type lvm_t;
type lvm_exec_t;
@@ -6952,18 +7125,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
term_getattr_all_user_ttys(lvm_t)
term_list_ptys(lvm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-2.6.2/policy/modules/system/modutils.te
---- nsaserefpolicy/policy/modules/system/modutils.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/modutils.te 2007-04-30 11:26:06.000000000 -0400
-@@ -58,6 +58,7 @@
- kernel_read_system_state(insmod_t)
- kernel_write_proc_files(insmod_t)
- kernel_mount_debugfs(insmod_t)
-+kernel_mount_kvmfs(insmod_t)
- kernel_read_debugfs(insmod_t)
- # Rules for /proc/sys/kernel/tainted
- kernel_read_kernel_sysctls(insmod_t)
-@@ -101,6 +102,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-2.6.3/policy/modules/system/modutils.te
+--- nsaserefpolicy/policy/modules/system/modutils.te 2007-05-02 15:04:46.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/modutils.te 2007-05-04 12:31:35.000000000 -0400
+@@ -102,6 +102,7 @@
init_use_fds(insmod_t)
init_use_script_fds(insmod_t)
init_use_script_ptys(insmod_t)
@@ -6971,18 +7136,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
libs_use_ld_so(insmod_t)
libs_use_shared_libs(insmod_t)
-@@ -163,6 +165,10 @@
- xserver_getattr_log(insmod_t)
+@@ -155,6 +156,7 @@
+
+ optional_policy(`
+ rpm_rw_pipes(insmod_t)
++ rpm_read_script_tmp_files(insmod_t)
')
-+optional_policy(`
-+ unconfined_dontaudit_rw_pipes(insmod_t)
-+')
-+
- ########################################
- #
- # depmod local policy
-@@ -180,6 +186,7 @@
+ optional_policy(`
+@@ -185,6 +187,7 @@
files_read_kernel_symbol_table(depmod_t)
files_read_kernel_modules(depmod_t)
@@ -6990,18 +7152,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
fs_getattr_xattr_fs(depmod_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-2.6.2/policy/modules/system/mount.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-2.6.3/policy/modules/system/mount.fc
--- nsaserefpolicy/policy/modules/system/mount.fc 2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/mount.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/mount.fc 2007-05-04 12:31:35.000000000 -0400
@@ -1,4 +1,3 @@
/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
-
-/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0)
+/sbin/mount.ntfs-3g -- gen_context(system_u:object_r:mount_ntfs_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-2.6.2/policy/modules/system/mount.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-2.6.3/policy/modules/system/mount.if
--- nsaserefpolicy/policy/modules/system/mount.if 2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/mount.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/mount.if 2007-05-04 12:31:35.000000000 -0400
@@ -143,3 +143,40 @@
mount_domtrans($1)
')
@@ -7043,9 +7205,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
+
+ allow $1 mount_ntfs_t:unix_stream_socket { read write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-2.6.2/policy/modules/system/mount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-2.6.3/policy/modules/system/mount.te
--- nsaserefpolicy/policy/modules/system/mount.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/mount.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/mount.te 2007-05-04 12:31:35.000000000 -0400
@@ -9,6 +9,13 @@
ifdef(`targeted_policy',`
## <desc>
@@ -7153,9 +7315,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
+ term_use_generic_ptys(mount_ntfs_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-2.6.2/policy/modules/system/raid.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-2.6.3/policy/modules/system/raid.te
--- nsaserefpolicy/policy/modules/system/raid.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/raid.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/raid.te 2007-05-04 12:31:35.000000000 -0400
@@ -46,6 +46,7 @@
# RAID block device access
storage_manage_fixed_disk(mdadm_t)
@@ -7164,9 +7326,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t
term_dontaudit_list_ptys(mdadm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-2.6.2/policy/modules/system/selinuxutil.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-2.6.3/policy/modules/system/selinuxutil.fc
--- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/selinuxutil.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/selinuxutil.fc 2007-05-04 12:31:35.000000000 -0400
@@ -40,6 +40,7 @@
/usr/sbin/setfiles.* -- gen_context(system_u:object_r:setfiles_exec_t,s0)
/usr/sbin/setsebool -- gen_context(system_u:object_r:semanage_exec_t,s0)
@@ -7175,9 +7337,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
/usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0)
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-2.6.2/policy/modules/system/selinuxutil.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-2.6.3/policy/modules/system/selinuxutil.if
--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/selinuxutil.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/selinuxutil.if 2007-05-04 12:31:35.000000000 -0400
@@ -445,6 +445,7 @@
role $2 types run_init_t;
allow run_init_t $3:chr_file rw_term_perms;
@@ -7212,9 +7374,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
manage_files_pattern($1,selinux_config_t,selinux_config_t)
read_lnk_files_pattern($1,selinux_config_t,selinux_config_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-2.6.2/policy/modules/system/selinuxutil.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-2.6.3/policy/modules/system/selinuxutil.te
--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/selinuxutil.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/selinuxutil.te 2007-05-04 12:31:35.000000000 -0400
@@ -1,10 +1,8 @@
policy_module(selinuxutil,1.5.0)
@@ -7415,9 +7577,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-2.6.2/policy/modules/system/sysnetwork.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-2.6.3/policy/modules/system/sysnetwork.te
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/sysnetwork.te 2007-04-30 13:30:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/sysnetwork.te 2007-05-04 12:31:35.000000000 -0400
@@ -164,6 +164,10 @@
dbus_connect_system_bus(dhcpc_t)
dbus_send_system_bus(dhcpc_t)
@@ -7437,9 +7599,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-2.6.2/policy/modules/system/udev.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-2.6.3/policy/modules/system/udev.te
--- nsaserefpolicy/policy/modules/system/udev.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/udev.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/udev.te 2007-05-04 12:31:35.000000000 -0400
@@ -83,12 +83,19 @@
kernel_dgram_send(udev_t)
kernel_signal(udev_t)
@@ -7460,10 +7622,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
domain_read_all_domains_state(udev_t)
domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these
-@@ -194,5 +201,10 @@
+@@ -194,5 +201,21 @@
')
optional_policy(`
++ openct_read_pid_files(udev_t)
++ openct_domtrans(udev_t)
++')
++
++optional_policy(`
++ pcscd_read_pub_files(udev_t)
++ pcscd_domtrans(udev_t)
++')
++
++optional_policy(`
+ xen_append_log(udev_t)
+')
+
@@ -7471,18 +7643,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
xserver_read_xdm_pid(udev_t)
')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-2.6.2/policy/modules/system/unconfined.fc
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-2.6.3/policy/modules/system/unconfined.fc
--- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/unconfined.fc 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/unconfined.fc 2007-05-04 12:31:35.000000000 -0400
@@ -10,4 +10,5 @@
/usr/bin/valgrind -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
/usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
/usr/lib/ia32el/ia32x_loader -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
+/usr/bin/vmware.* -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-2.6.2/policy/modules/system/unconfined.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-2.6.3/policy/modules/system/unconfined.if
--- nsaserefpolicy/policy/modules/system/unconfined.if 2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-2.6.2/policy/modules/system/unconfined.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/unconfined.if 2007-05-04 12:38:48.000000000 -0400
@@ -18,7 +18,7 @@
')
@@ -7526,9 +7699,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
nscd_unconfined($1)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-2.6.2/policy/modules/system/unconfined.te
+@@ -556,3 +559,22 @@
+
+ allow $1 unconfined_t:dbus acquire_svc;
+ ')
++
++########################################
++## <summary>
++## Allow ptrace of unconfined domain
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`unconfined_ptrace',`
++ gen_require(`
++ type unconfined_t;
++ ')
++
++ allow $1 unconfined_t:process ptrace;
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-2.6.3/policy/modules/system/unconfined.te
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/unconfined.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/unconfined.te 2007-05-04 12:31:35.000000000 -0400
@@ -6,6 +6,15 @@
# Declarations
#
@@ -7554,7 +7750,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
optional_policy(`
ada_domtrans(unconfined_t)
')
-@@ -153,6 +164,8 @@
+@@ -63,10 +74,6 @@
+ ')
+
+ optional_policy(`
+- bootloader_domtrans(unconfined_t)
+- ')
+-
+- optional_policy(`
+ init_dbus_chat_script(unconfined_t)
+
+ dbus_stub(unconfined_t)
+@@ -153,6 +160,8 @@
optional_policy(`
rpm_domtrans(unconfined_t)
@@ -7563,7 +7770,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
')
optional_policy(`
-@@ -192,6 +205,9 @@
+@@ -192,6 +201,9 @@
optional_policy(`
xserver_domtrans_xdm_xserver(unconfined_t)
')
@@ -7573,7 +7780,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
')
########################################
-@@ -200,10 +216,18 @@
+@@ -200,10 +212,18 @@
#
ifdef(`targeted_policy',`
@@ -7592,9 +7799,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
dbus_stub(unconfined_execmem_t)
init_dbus_chat_script(unconfined_execmem_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.6.2/policy/modules/system/userdomain.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.6.3/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/userdomain.if 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/userdomain.if 2007-05-04 12:36:46.000000000 -0400
@@ -114,6 +114,18 @@
# Allow making the stack executable via mprotect.
allow $1_t self:process execstack;
@@ -8027,7 +8234,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -5721,3 +5713,92 @@
+@@ -5721,3 +5713,112 @@
allow $1 user_home_dir_t:dir manage_dir_perms;
files_home_filetrans($1,user_home_dir_t,dir)
')
@@ -8120,9 +8327,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ dontaudit $1 sysadm_home_dir_t:dir write;
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.6.2/policy/modules/system/userdomain.te
++
++########################################
++## <summary>
++## Ptrace all user domains.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`userdom_ptrace_all_users',`
++ gen_require(`
++ attribute userdomain;
++ ')
++
++ allow $1 userdomain:process ptrace;
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.6.3/policy/modules/system/userdomain.te
--- nsaserefpolicy/policy/modules/system/userdomain.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/userdomain.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/userdomain.te 2007-05-04 12:31:35.000000000 -0400
@@ -15,7 +15,6 @@
# Declarations
#
@@ -8299,9 +8526,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+tunable_policy(`allow_console_login', `
+ term_use_console(userdomain)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-2.6.2/policy/modules/system/xen.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-2.6.3/policy/modules/system/xen.te
--- nsaserefpolicy/policy/modules/system/xen.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.2/policy/modules/system/xen.te 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/modules/system/xen.te 2007-05-04 12:31:35.000000000 -0400
@@ -25,6 +25,10 @@
domain_type(xend_t)
init_daemon_domain(xend_t, xend_exec_t)
@@ -8384,9 +8611,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
+fs_read_nfs_files(xend_t)
+fs_getattr_all_fs(xend_t)
+fs_read_dos_files(xend_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-2.6.2/policy/support/misc_patterns.spt
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-2.6.3/policy/support/misc_patterns.spt
--- nsaserefpolicy/policy/support/misc_patterns.spt 2007-01-02 12:57:51.000000000 -0500
-+++ serefpolicy-2.6.2/policy/support/misc_patterns.spt 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/policy/support/misc_patterns.spt 2007-05-04 12:31:35.000000000 -0400
@@ -41,11 +41,6 @@
#
# Other process permissions
@@ -8399,10 +8626,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns
define(`ps_process_pattern',`
allow $1 $2:dir { search getattr read };
allow $1 $2:{ file lnk_file } { read getattr };
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-2.6.2/policy/support/obj_perm_sets.spt
---- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-01-02 12:57:51.000000000 -0500
-+++ serefpolicy-2.6.2/policy/support/obj_perm_sets.spt 2007-04-30 11:26:06.000000000 -0400
-@@ -215,7 +215,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-2.6.3/policy/support/obj_perm_sets.spt
+--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-05-04 12:19:23.000000000 -0400
++++ serefpolicy-2.6.3/policy/support/obj_perm_sets.spt 2007-05-04 12:31:35.000000000 -0400
+@@ -203,7 +203,6 @@
+ define(`add_entry_dir_perms',`{ getattr search lock ioctl write add_name }')
+ define(`del_entry_dir_perms',`{ getattr search lock ioctl write remove_name }')
+ define(`create_dir_perms',`{ getattr create }')
+-define(`rename_dir_perms',`{ getattr rename }')
+ define(`delete_dir_perms',`{ getattr rmdir }')
+ define(`manage_dir_perms',`{ create getattr setattr read write link unlink rename search add_name remove_name reparent rmdir lock ioctl }')
+ define(`relabelfrom_dir_perms',`{ getattr relabelfrom }')
+@@ -216,7 +215,7 @@
define(`getattr_file_perms',`{ getattr }')
define(`setattr_file_perms',`{ setattr }')
define(`read_file_perms',`{ getattr read lock ioctl }')
@@ -8411,7 +8646,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
define(`exec_file_perms',`{ getattr read execute execute_no_trans }')
define(`append_file_perms',`{ getattr append lock ioctl }')
define(`write_file_perms',`{ getattr write append lock ioctl }')
-@@ -324,3 +324,13 @@
+@@ -325,3 +324,13 @@
#
define(`client_stream_socket_perms', `{ create ioctl read getattr write setattr append bind getopt setopt shutdown }')
define(`server_stream_socket_perms', `{ client_stream_socket_perms listen accept }')
@@ -8425,9 +8660,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
+define(`all_association', `{ sendto recvfrom setcontext polmatch } ')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-2.6.2/Rules.modular
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-2.6.3/Rules.modular
--- nsaserefpolicy/Rules.modular 2007-03-22 14:30:10.000000000 -0400
-+++ serefpolicy-2.6.2/Rules.modular 2007-04-30 11:26:06.000000000 -0400
++++ serefpolicy-2.6.3/Rules.modular 2007-05-04 12:31:35.000000000 -0400
@@ -167,7 +167,7 @@
# these have to run individually because order matters:
$(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 741d617..d6d4563 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -16,7 +16,7 @@
%define CHECKPOLICYVER 2.0.1-2
Summary: SELinux policy configuration
Name: selinux-policy
-Version: 2.6.2
+Version: 2.6.3
Release: 1%{?dist}
License: GPL
Group: System Environment/Base
@@ -359,6 +359,9 @@ semodule -b base.pp -r bootloader -r clock -r dpkg -r fstools -r hotplug -r init
%endif
%changelog
+* Fri May 4 2007 Dan Walsh <dwalsh@redhat.com> 2.6.3-1
+- Update to latest from upstream
+
* Mon Apr 30 2007 Dan Walsh <dwalsh@redhat.com> 2.6.2-1
- Update to latest from upstream
diff --git a/sources b/sources
index eddbff8..0d61942 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-e7e4854e3bd60e61453f054b404ec3b9 serefpolicy-2.6.3.tgz
+61aceefcea6b4644d7abbfb6a73af136 serefpolicy-2.6.3.tgz