diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index bd4d1a9..783906b 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -3194,7 +3194,7 @@ index 1d732f1..f6ff7aa 100644
+ stapserver_manage_lib(useradd_t)
+')
diff --git a/policy/modules/apps/seunshare.if b/policy/modules/apps/seunshare.if
-index 1dc7a85..1a2084f 100644
+index 1dc7a85..e4f6fc2 100644
--- a/policy/modules/apps/seunshare.if
+++ b/policy/modules/apps/seunshare.if
@@ -43,18 +43,18 @@ interface(`seunshare_run',`
@@ -3223,7 +3223,7 @@ index 1dc7a85..1a2084f 100644
## <param name="role">
## <summary>
## Role allowed access.
-@@ -66,15 +66,45 @@ interface(`seunshare_run',`
+@@ -66,15 +66,47 @@ interface(`seunshare_run',`
## </summary>
## </param>
#
@@ -3243,6 +3243,8 @@ index 1dc7a85..1a2084f 100644
- seunshare_domtrans($1)
+ kernel_read_system_state($1_seunshare_t)
+
++ domain_dyntrans_type($1_seunshare_t)
++
+ auth_use_nsswitch($1_seunshare_t)
+
+ logging_send_syslog_msg($1_seunshare_t)
@@ -6193,7 +6195,7 @@ index b31c054..d500876 100644
+/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
+/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
-index 76f285e..450a2b7 100644
+index 76f285e..68ef8e7 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',`
@@ -6894,7 +6896,57 @@ index 76f285e..450a2b7 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2725,7 +3149,7 @@ interface(`dev_write_misc',`
+@@ -2532,6 +2956,24 @@ interface(`dev_read_raw_memory',`
+
+ ########################################
+ ## <summary>
++## Allow to be reader of raw memory devices (e.g. /dev/mem).
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_raw_memory_reader',`
++ gen_require(`
++ attribute memory_raw_read;
++ ')
++
++ typeattribute $1 memory_raw_read;
++')
++
++########################################
++## <summary>
+ ## Do not audit attempts to read raw memory devices
+ ## (e.g. /dev/mem).
+ ## </summary>
+@@ -2573,6 +3015,24 @@ interface(`dev_write_raw_memory',`
+
+ ########################################
+ ## <summary>
++## Allow to be writer of raw memory devices (e.g. /dev/mem).
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_raw_memory_writer',`
++ gen_require(`
++ attribute memory_raw_write;
++ ')
++
++ typeattribute $1 memory_raw_write;
++')
++
++########################################
++## <summary>
+ ## Read and execute raw memory devices (e.g. /dev/mem).
+ ## </summary>
+ ## <param name="domain">
+@@ -2725,7 +3185,7 @@ interface(`dev_write_misc',`
## </summary>
## <param name="domain">
## <summary>
@@ -6903,7 +6955,7 @@ index 76f285e..450a2b7 100644
## </summary>
## </param>
#
-@@ -2811,6 +3235,78 @@ interface(`dev_rw_modem',`
+@@ -2811,6 +3271,78 @@ interface(`dev_rw_modem',`
########################################
## <summary>
@@ -6982,7 +7034,7 @@ index 76f285e..450a2b7 100644
## Get the attributes of the mouse devices.
## </summary>
## <param name="domain">
-@@ -2903,20 +3399,20 @@ interface(`dev_getattr_mtrr_dev',`
+@@ -2903,20 +3435,20 @@ interface(`dev_getattr_mtrr_dev',`
########################################
## <summary>
@@ -7007,7 +7059,7 @@ index 76f285e..450a2b7 100644
## </p>
## </desc>
## <param name="domain">
-@@ -2925,43 +3421,34 @@ interface(`dev_getattr_mtrr_dev',`
+@@ -2925,43 +3457,34 @@ interface(`dev_getattr_mtrr_dev',`
## </summary>
## </param>
#
@@ -7063,7 +7115,7 @@ index 76f285e..450a2b7 100644
## range registers (MTRR).
## </summary>
## <param name="domain">
-@@ -2970,13 +3457,32 @@ interface(`dev_write_mtrr',`
+@@ -2970,13 +3493,32 @@ interface(`dev_write_mtrr',`
## </summary>
## </param>
#
@@ -7099,11 +7151,10 @@ index 76f285e..450a2b7 100644
')
########################################
-@@ -3144,7 +3650,43 @@ interface(`dev_create_null_dev',`
+@@ -3144,6 +3686,42 @@ interface(`dev_create_null_dev',`
########################################
## <summary>
--## Do not audit attempts to get the attributes
+## Get the status of a null device service.
+## </summary>
+## <param name="domain">
@@ -7140,11 +7191,10 @@ index 76f285e..450a2b7 100644
+
+########################################
+## <summary>
-+## Do not audit attempts to get the attributes
+ ## Do not audit attempts to get the attributes
## of the BIOS non-volatile RAM device.
## </summary>
- ## <param name="domain">
-@@ -3163,6 +3705,24 @@ interface(`dev_dontaudit_getattr_nvram_dev',`
+@@ -3163,6 +3741,24 @@ interface(`dev_dontaudit_getattr_nvram_dev',`
########################################
## <summary>
@@ -7169,7 +7219,7 @@ index 76f285e..450a2b7 100644
## Read and write BIOS non-volatile RAM.
## </summary>
## <param name="domain">
-@@ -3254,7 +3814,25 @@ interface(`dev_rw_printer',`
+@@ -3254,7 +3850,25 @@ interface(`dev_rw_printer',`
########################################
## <summary>
@@ -7196,7 +7246,7 @@ index 76f285e..450a2b7 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3262,12 +3840,13 @@ interface(`dev_rw_printer',`
+@@ -3262,12 +3876,13 @@ interface(`dev_rw_printer',`
## </summary>
## </param>
#
@@ -7213,7 +7263,7 @@ index 76f285e..450a2b7 100644
')
########################################
-@@ -3399,7 +3978,7 @@ interface(`dev_dontaudit_read_rand',`
+@@ -3399,7 +4014,7 @@ interface(`dev_dontaudit_read_rand',`
########################################
## <summary>
@@ -7222,7 +7272,7 @@ index 76f285e..450a2b7 100644
## number generator devices (e.g., /dev/random)
## </summary>
## <param name="domain">
-@@ -3413,7 +3992,7 @@ interface(`dev_dontaudit_append_rand',`
+@@ -3413,7 +4028,7 @@ interface(`dev_dontaudit_append_rand',`
type random_device_t;
')
@@ -7231,213 +7281,760 @@ index 76f285e..450a2b7 100644
')
########################################
-@@ -3855,6 +4434,114 @@ interface(`dev_getattr_sysfs_dirs',`
+@@ -3855,7 +4470,7 @@ interface(`dev_getattr_sysfs_dirs',`
########################################
## <summary>
+-## Search the sysfs directories.
+## Set the attributes of sysfs directories.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -3863,91 +4478,89 @@ interface(`dev_getattr_sysfs_dirs',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_search_sysfs',`
+interface(`dev_setattr_sysfs_dirs',`
-+ gen_require(`
-+ type sysfs_t;
-+ ')
-+
+ gen_require(`
+ type sysfs_t;
+ ')
+
+- search_dirs_pattern($1, sysfs_t, sysfs_t)
+ allow $1 sysfs_t:dir setattr_dir_perms;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Do not audit attempts to search sysfs.
+## Get attributes of sysfs filesystems.
-+## </summary>
-+## <param name="domain">
-+## <summary>
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain to not audit.
+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_dontaudit_search_sysfs',`
+interface(`dev_getattr_sysfs_fs',`
-+ gen_require(`
-+ type sysfs_t;
-+ ')
-+
+ gen_require(`
+ type sysfs_t;
+ ')
+
+- dontaudit $1 sysfs_t:dir search_dir_perms;
+ allow $1 sysfs_t:filesystem getattr;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## List the contents of the sysfs directories.
+## Mount a filesystem on /sys
-+## </summary>
-+## <param name="domain">
-+## <summary>
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain allowed access.
+## Domain allow access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_list_sysfs',`
+interface(`dev_mounton_sysfs',`
-+ gen_require(`
-+ type sysfs_t;
-+ ')
-+
+ gen_require(`
+ type sysfs_t;
+ ')
+
+- list_dirs_pattern($1, sysfs_t, sysfs_t)
+ allow $1 sysfs_t:dir mounton;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Write in a sysfs directories.
+## Dontaudit attempts to mount a filesystem on /sys
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_dontaudit_mounton_sysfs',`
-+ gen_require(`
-+ type sysfs_t;
-+ ')
-+
-+ dontaudit $1 sysfs_t:dir mounton;
-+')
-+
-+########################################
-+## <summary>
-+## Mount sysfs filesystems.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_mount_sysfs_fs',`
-+ gen_require(`
-+ type sysfs_t;
-+ ')
-+
-+ allow $1 sysfs_t:filesystem mount;
-+')
-+
-+########################################
-+## <summary>
-+## Unmount sysfs filesystems.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_unmount_sysfs_fs',`
-+ gen_require(`
-+ type sysfs_t;
-+ ')
-+
-+ allow $1 sysfs_t:filesystem unmount;
-+')
-+
-+########################################
-+## <summary>
- ## Search the sysfs directories.
## </summary>
## <param name="domain">
-@@ -3904,6 +4591,7 @@ interface(`dev_list_sysfs',`
+ ## <summary>
+-## Domain allowed access.
++## Domain to not audit.
+ ## </summary>
+ ## </param>
+ #
+-# cjp: added for cpuspeed
+-interface(`dev_write_sysfs_dirs',`
++interface(`dev_dontaudit_mounton_sysfs',`
+ gen_require(`
type sysfs_t;
')
-+ read_lnk_files_pattern($1, sysfs_t, sysfs_t)
- list_dirs_pattern($1, sysfs_t, sysfs_t)
+- allow $1 sysfs_t:dir write;
++ dontaudit $1 sysfs_t:dir mounton;
')
-@@ -3928,6 +4616,24 @@ interface(`dev_write_sysfs_dirs',`
-
########################################
## <summary>
-+## Access check for a sysfs directories.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_access_check_sysfs',`
-+ gen_require(`
-+ type sysfs_t;
-+ ')
-+
-+ allow $1 sysfs_t:dir audit_access;
-+')
-+
-+########################################
-+## <summary>
- ## Do not audit attempts to write in a sysfs directory.
+-## Do not audit attempts to write in a sysfs directory.
++## Mount sysfs filesystems.
## </summary>
## <param name="domain">
-@@ -3946,23 +4652,49 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
+ ## <summary>
+-## Domain to not audit.
++## Domain allowed access.
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_dontaudit_write_sysfs_dirs',`
++interface(`dev_mount_sysfs_fs',`
+ gen_require(`
+ type sysfs_t;
+ ')
+
+- dontaudit $1 sysfs_t:dir write;
++ allow $1 sysfs_t:filesystem mount;
+ ')
########################################
## <summary>
-## Create, read, write, and delete sysfs
-## directories.
-+## Read cpu online hardware state information.
++## Unmount sysfs filesystems.
## </summary>
-+## <desc>
-+## <p>
-+## Allow the specified domain to read /sys/devices/system/cpu/online file.
-+## </p>
-+## </desc>
## <param name="domain">
## <summary>
- ## Domain allowed access.
+@@ -3955,68 +4568,53 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
## </summary>
## </param>
#
-interface(`dev_manage_sysfs_dirs',`
-+interface(`dev_read_cpu_online',`
-+ gen_require(`
-+ type cpu_online_t;
-+ ')
-+
-+ dev_search_sysfs($1)
-+ read_files_pattern($1, cpu_online_t, cpu_online_t)
-+')
-+
-+########################################
-+## <summary>
-+## Relabel cpu online hardware state information.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_relabel_cpu_online',`
++interface(`dev_unmount_sysfs_fs',`
gen_require(`
-+ type cpu_online_t;
type sysfs_t;
')
- manage_dirs_pattern($1, sysfs_t, sysfs_t)
-+ dev_search_sysfs($1)
++ allow $1 sysfs_t:filesystem unmount;
+ ')
+
+ ########################################
+ ## <summary>
+-## Read hardware state information.
++## Search the sysfs directories.
+ ## </summary>
+-## <desc>
+-## <p>
+-## Allow the specified domain to read the contents of
+-## the sysfs filesystem. This filesystem contains
+-## information, parameters, and other settings on the
+-## hardware installed on the system.
+-## </p>
+-## </desc>
+ ## <param name="domain">
+ ## <summary>
+ ## Domain allowed access.
+ ## </summary>
+ ## </param>
+-## <infoflow type="read" weight="10"/>
+ #
+-interface(`dev_read_sysfs',`
++interface(`dev_search_sysfs',`
+ gen_require(`
+ type sysfs_t;
+ ')
+
+- read_files_pattern($1, sysfs_t, sysfs_t)
+- read_lnk_files_pattern($1, sysfs_t, sysfs_t)
+-
+- list_dirs_pattern($1, sysfs_t, sysfs_t)
++ search_dirs_pattern($1, sysfs_t, sysfs_t)
+ ')
+
+ ########################################
+ ## <summary>
+-## Allow caller to modify hardware state information.
++## Do not audit attempts to search sysfs.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain allowed access.
++## Domain to not audit.
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_rw_sysfs',`
++interface(`dev_dontaudit_search_sysfs',`
+ gen_require(`
+ type sysfs_t;
+ ')
+
+- rw_files_pattern($1, sysfs_t, sysfs_t)
+- read_lnk_files_pattern($1, sysfs_t, sysfs_t)
+-
+- list_dirs_pattern($1, sysfs_t, sysfs_t)
++ dontaudit $1 sysfs_t:dir search_dir_perms;
+ ')
+
+ ########################################
+ ## <summary>
+-## Read and write the TPM device.
++## List the contents of the sysfs directories.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -4024,114 +4622,97 @@ interface(`dev_rw_sysfs',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_rw_tpm',`
++interface(`dev_list_sysfs',`
+ gen_require(`
+- type device_t, tpm_device_t;
++ type sysfs_t;
+ ')
+
+- rw_chr_files_pattern($1, device_t, tpm_device_t)
++ read_lnk_files_pattern($1, sysfs_t, sysfs_t)
++ list_dirs_pattern($1, sysfs_t, sysfs_t)
+ ')
+
+ ########################################
+ ## <summary>
+-## Read from pseudo random number generator devices (e.g., /dev/urandom).
++## Write in a sysfs directories.
+ ## </summary>
+-## <desc>
+-## <p>
+-## Allow the specified domain to read from pseudo random number
+-## generator devices (e.g., /dev/urandom). Typically this is
+-## used in situations when a cryptographically secure random
+-## number is not necessarily needed. One example is the Stack
+-## Smashing Protector (SSP, formerly known as ProPolice) support
+-## that may be compiled into programs.
+-## </p>
+-## <p>
+-## Related interface:
+-## </p>
+-## <ul>
+-## <li>dev_read_rand()</li>
+-## </ul>
+-## <p>
+-## Related tunable:
+-## </p>
+-## <ul>
+-## <li>global_ssp</li>
+-## </ul>
+-## </desc>
+ ## <param name="domain">
+ ## <summary>
+ ## Domain allowed access.
+ ## </summary>
+ ## </param>
+-## <infoflow type="read" weight="10"/>
+ #
+-interface(`dev_read_urand',`
++# cjp: added for cpuspeed
++interface(`dev_write_sysfs_dirs',`
+ gen_require(`
+- type device_t, urandom_device_t;
++ type sysfs_t;
+ ')
+
+- read_chr_files_pattern($1, device_t, urandom_device_t)
++ allow $1 sysfs_t:dir write;
+ ')
+
+ ########################################
+ ## <summary>
+-## Do not audit attempts to read from pseudo
+-## random devices (e.g., /dev/urandom)
++## Access check for a sysfs directories.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain to not audit.
++## Domain allowed access.
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_dontaudit_read_urand',`
++interface(`dev_access_check_sysfs',`
+ gen_require(`
+- type urandom_device_t;
++ type sysfs_t;
+ ')
+
+- dontaudit $1 urandom_device_t:chr_file { getattr read };
++ allow $1 sysfs_t:dir audit_access;
+ ')
+
+ ########################################
+ ## <summary>
+-## Write to the pseudo random device (e.g., /dev/urandom). This
+-## sets the random number generator seed.
++## Do not audit attempts to write in a sysfs directory.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain allowed access.
++## Domain to not audit.
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_write_urand',`
++interface(`dev_dontaudit_write_sysfs_dirs',`
+ gen_require(`
+- type device_t, urandom_device_t;
++ type sysfs_t;
+ ')
+
+- write_chr_files_pattern($1, device_t, urandom_device_t)
++ dontaudit $1 sysfs_t:dir write;
+ ')
+
+ ########################################
+ ## <summary>
+-## Getattr generic the USB devices.
++## Read cpu online hardware state information.
+ ## </summary>
++## <desc>
++## <p>
++## Allow the specified domain to read /sys/devices/system/cpu/online file.
++## </p>
++## </desc>
+ ## <param name="domain">
+ ## <summary>
+ ## Domain allowed access.
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_getattr_generic_usb_dev',`
++interface(`dev_read_cpu_online',`
+ gen_require(`
+- type usb_device_t;
++ type cpu_online_t;
+ ')
+
+- getattr_chr_files_pattern($1, device_t, usb_device_t)
++ dev_search_sysfs($1)
++ read_files_pattern($1, cpu_online_t, cpu_online_t)
+ ')
+
+ ########################################
+ ## <summary>
+-## Setattr generic the USB devices.
++## Relabel cpu online hardware state information.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -4139,35 +4720,50 @@ interface(`dev_getattr_generic_usb_dev',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_setattr_generic_usb_dev',`
++interface(`dev_relabel_cpu_online',`
+ gen_require(`
+- type usb_device_t;
++ type cpu_online_t;
++ type sysfs_t;
+ ')
+
+- setattr_chr_files_pattern($1, device_t, usb_device_t)
++ dev_search_sysfs($1)
+ allow $1 cpu_online_t:file relabel_file_perms;
')
+
- ########################################
- ## <summary>
- ## Read hardware state information.
-@@ -4016,6 +4748,62 @@ interface(`dev_rw_sysfs',`
-
- ########################################
- ## <summary>
-+## Relabel hardware state directories.
+ ########################################
+ ## <summary>
+-## Read generic the USB devices.
++## Read hardware state information.
+ ## </summary>
++## <desc>
++## <p>
++## Allow the specified domain to read the contents of
++## the sysfs filesystem. This filesystem contains
++## information, parameters, and other settings on the
++## hardware installed on the system.
++## </p>
++## </desc>
+ ## <param name="domain">
+ ## <summary>
+ ## Domain allowed access.
+ ## </summary>
+ ## </param>
++## <infoflow type="read" weight="10"/>
+ #
+-interface(`dev_read_generic_usb_dev',`
++interface(`dev_read_sysfs',`
+ gen_require(`
+- type usb_device_t;
++ type sysfs_t;
+ ')
+
+- read_chr_files_pattern($1, device_t, usb_device_t)
++ read_files_pattern($1, sysfs_t, sysfs_t)
++ read_lnk_files_pattern($1, sysfs_t, sysfs_t)
++
++ list_dirs_pattern($1, sysfs_t, sysfs_t)
+ ')
+
+ ########################################
+ ## <summary>
+-## Read and write generic the USB devices.
++## Allow caller to modify hardware state information.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -4175,17 +4771,20 @@ interface(`dev_read_generic_usb_dev',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_rw_generic_usb_dev',`
++interface(`dev_rw_sysfs',`
+ gen_require(`
+- type device_t, usb_device_t;
++ type sysfs_t;
+ ')
+
+- rw_chr_files_pattern($1, device_t, usb_device_t)
++ rw_files_pattern($1, sysfs_t, sysfs_t)
++ read_lnk_files_pattern($1, sysfs_t, sysfs_t)
++
++ list_dirs_pattern($1, sysfs_t, sysfs_t)
+ ')
+
+ ########################################
+ ## <summary>
+-## Relabel generic the USB devices.
++## Relabel hardware state directories.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -4193,17 +4792,17 @@ interface(`dev_rw_generic_usb_dev',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_relabel_generic_usb_dev',`
++interface(`dev_relabel_sysfs_dirs',`
+ gen_require(`
+- type usb_device_t;
++ type sysfs_t;
+ ')
+
+- relabel_chr_files_pattern($1, device_t, usb_device_t)
++ relabel_dirs_pattern($1, sysfs_t, sysfs_t)
+ ')
+
+ ########################################
+ ## <summary>
+-## Read USB monitor devices.
++## Relabel hardware state files
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -4211,7 +4810,251 @@ interface(`dev_relabel_generic_usb_dev',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_read_usbmon_dev',`
++interface(`dev_relabel_all_sysfs',`
++ gen_require(`
++ type sysfs_t;
++ ')
++
++ relabel_dirs_pattern($1, sysfs_t, sysfs_t)
++ relabel_files_pattern($1, sysfs_t, sysfs_t)
++ relabel_lnk_files_pattern($1, sysfs_t, sysfs_t)
++')
++
++########################################
++## <summary>
++## Allow caller to modify hardware state information.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_manage_sysfs_dirs',`
++ gen_require(`
++ type sysfs_t;
++ ')
++
++ manage_dirs_pattern($1, sysfs_t, sysfs_t)
++')
++
++########################################
++## <summary>
++## Read and write the TPM device.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_rw_tpm',`
++ gen_require(`
++ type device_t, tpm_device_t;
++ ')
++
++ rw_chr_files_pattern($1, device_t, tpm_device_t)
++')
++
++########################################
++## <summary>
++## Read from pseudo random number generator devices (e.g., /dev/urandom).
++## </summary>
++## <desc>
++## <p>
++## Allow the specified domain to read from pseudo random number
++## generator devices (e.g., /dev/urandom). Typically this is
++## used in situations when a cryptographically secure random
++## number is not necessarily needed. One example is the Stack
++## Smashing Protector (SSP, formerly known as ProPolice) support
++## that may be compiled into programs.
++## </p>
++## <p>
++## Related interface:
++## </p>
++## <ul>
++## <li>dev_read_rand()</li>
++## </ul>
++## <p>
++## Related tunable:
++## </p>
++## <ul>
++## <li>global_ssp</li>
++## </ul>
++## </desc>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <infoflow type="read" weight="10"/>
++#
++interface(`dev_read_urand',`
++ gen_require(`
++ type device_t, urandom_device_t;
++ ')
++
++ read_chr_files_pattern($1, device_t, urandom_device_t)
++')
++
++########################################
++## <summary>
++## Do not audit attempts to read from pseudo
++## random devices (e.g., /dev/urandom)
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`dev_dontaudit_read_urand',`
++ gen_require(`
++ type urandom_device_t;
++ ')
++
++ dontaudit $1 urandom_device_t:chr_file { getattr read };
++')
++
++########################################
++## <summary>
++## Write to the pseudo random device (e.g., /dev/urandom). This
++## sets the random number generator seed.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_write_urand',`
++ gen_require(`
++ type device_t, urandom_device_t;
++ ')
++
++ write_chr_files_pattern($1, device_t, urandom_device_t)
++')
++
++########################################
++## <summary>
++## Do not audit attempts to write to pseudo
++## random devices (e.g., /dev/urandom)
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`dev_dontaudit_write_urand',`
++ gen_require(`
++ type urandom_device_t;
++ ')
++
++ dontaudit $1 urandom_device_t:chr_file write;
++')
++
++########################################
++## <summary>
++## Getattr generic the USB devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_getattr_generic_usb_dev',`
++ gen_require(`
++ type usb_device_t,device_t;
++ ')
++
++ getattr_chr_files_pattern($1, device_t, usb_device_t)
++')
++
++########################################
++## <summary>
++## Setattr generic the USB devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_setattr_generic_usb_dev',`
++ gen_require(`
++ type usb_device_t;
++ ')
++
++ setattr_chr_files_pattern($1, device_t, usb_device_t)
++')
++
++########################################
++## <summary>
++## Read generic the USB devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_read_generic_usb_dev',`
++ gen_require(`
++ type usb_device_t;
++ ')
++
++ read_chr_files_pattern($1, device_t, usb_device_t)
++')
++
++########################################
++## <summary>
++## Read and write generic the USB devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_rw_generic_usb_dev',`
++ gen_require(`
++ type device_t, usb_device_t;
++ ')
++
++ rw_chr_files_pattern($1, device_t, usb_device_t)
++')
++
++########################################
++## <summary>
++## Relabel generic the USB devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_relabel_generic_usb_dev',`
++ gen_require(`
++ type usb_device_t;
++ ')
++
++ relabel_chr_files_pattern($1, device_t, usb_device_t)
++')
++
++########################################
++## <summary>
++## Read USB monitor devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_read_usbmon_dev',`
+ gen_require(`
+ type device_t, usbmon_device_t;
+ ')
+@@ -4267,15 +5110,169 @@ interface(`dev_mount_usbfs',`
+ #
+ interface(`dev_associate_usbfs',`
+ gen_require(`
+- type usbfs_t;
++ type usbfs_t;
++ ')
++
++ allow $1 usbfs_t:filesystem associate;
++')
++
++########################################
++## <summary>
++## Get the attributes of a directory in the usb filesystem.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_getattr_usbfs_dirs',`
++ gen_require(`
++ type usbfs_t;
++ ')
++
++ allow $1 usbfs_t:dir getattr_dir_perms;
++')
++
++########################################
++## <summary>
++## Do not audit attempts to get the attributes
++## of a directory in the usb filesystem.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`dev_dontaudit_getattr_usbfs_dirs',`
++ gen_require(`
++ type usbfs_t;
++ ')
++
++ dontaudit $1 usbfs_t:dir getattr_dir_perms;
++')
++
++########################################
++## <summary>
++## Search the directory containing USB hardware information.
+## </summary>
+## <param name="domain">
+## <summary>
@@ -7445,17 +8042,17 @@ index 76f285e..450a2b7 100644
+## </summary>
+## </param>
+#
-+interface(`dev_relabel_sysfs_dirs',`
++interface(`dev_search_usbfs',`
+ gen_require(`
-+ type sysfs_t;
++ type usbfs_t;
+ ')
+
-+ relabel_dirs_pattern($1, sysfs_t, sysfs_t)
++ search_dirs_pattern($1, usbfs_t, usbfs_t)
+')
+
+########################################
+## <summary>
-+## Relabel hardware state files
++## Allow caller to get a list of usb hardware.
+## </summary>
+## <param name="domain">
+## <summary>
@@ -7463,19 +8060,20 @@ index 76f285e..450a2b7 100644
+## </summary>
+## </param>
+#
-+interface(`dev_relabel_all_sysfs',`
++interface(`dev_list_usbfs',`
+ gen_require(`
-+ type sysfs_t;
++ type usbfs_t;
+ ')
+
-+ relabel_dirs_pattern($1, sysfs_t, sysfs_t)
-+ relabel_files_pattern($1, sysfs_t, sysfs_t)
-+ relabel_lnk_files_pattern($1, sysfs_t, sysfs_t)
++ read_lnk_files_pattern($1, usbfs_t, usbfs_t)
++ getattr_files_pattern($1, usbfs_t, usbfs_t)
++
++ list_dirs_pattern($1, usbfs_t, usbfs_t)
+')
+
+########################################
+## <summary>
-+## Allow caller to modify hardware state information.
++## Set the attributes of usbfs filesystem.
+## </summary>
+## <param name="domain">
+## <summary>
@@ -7483,266 +8081,425 @@ index 76f285e..450a2b7 100644
+## </summary>
+## </param>
+#
-+interface(`dev_manage_sysfs_dirs',`
++interface(`dev_setattr_usbfs_files',`
+ gen_require(`
-+ type sysfs_t;
++ type usbfs_t;
+ ')
+
-+ manage_dirs_pattern($1, sysfs_t, sysfs_t)
++ setattr_files_pattern($1, usbfs_t, usbfs_t)
++ list_dirs_pattern($1, usbfs_t, usbfs_t)
+')
+
+########################################
+## <summary>
- ## Read and write the TPM device.
- ## </summary>
- ## <param name="domain">
-@@ -4113,6 +4901,25 @@ interface(`dev_write_urand',`
-
- ########################################
- ## <summary>
-+## Do not audit attempts to write to pseudo
-+## random devices (e.g., /dev/urandom)
++## Read USB hardware information using
++## the usbfs filesystem interface.
+## </summary>
+## <param name="domain">
+## <summary>
-+## Domain to not audit.
++## Domain allowed access.
+## </summary>
+## </param>
+#
-+interface(`dev_dontaudit_write_urand',`
++interface(`dev_read_usbfs',`
+ gen_require(`
-+ type urandom_device_t;
++ type usbfs_t;
+ ')
+
-+ dontaudit $1 urandom_device_t:chr_file write;
++ read_files_pattern($1, usbfs_t, usbfs_t)
++ read_lnk_files_pattern($1, usbfs_t, usbfs_t)
++ list_dirs_pattern($1, usbfs_t, usbfs_t)
+')
+
+########################################
+## <summary>
- ## Getattr generic the USB devices.
++## Allow caller to modify usb hardware configuration files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_rw_usbfs',`
++ gen_require(`
++ type usbfs_t;
++ ')
++
++ list_dirs_pattern($1, usbfs_t, usbfs_t)
++ rw_files_pattern($1, usbfs_t, usbfs_t)
++ read_lnk_files_pattern($1, usbfs_t, usbfs_t)
++')
++
++######################################
++## <summary>
++## Read and write userio device.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_rw_userio_dev',`
++ gen_require(`
++ type device_t, userio_device_t;
+ ')
+
+- allow $1 usbfs_t:filesystem associate;
++ rw_chr_files_pattern($1, device_t, userio_device_t)
+ ')
+
+ ########################################
+ ## <summary>
+-## Get the attributes of a directory in the usb filesystem.
++## Get the attributes of video4linux devices.
## </summary>
## <param name="domain">
-@@ -4123,7 +4930,7 @@ interface(`dev_write_urand',`
+ ## <summary>
+@@ -4283,18 +5280,18 @@ interface(`dev_associate_usbfs',`
+ ## </summary>
+ ## </param>
#
- interface(`dev_getattr_generic_usb_dev',`
+-interface(`dev_getattr_usbfs_dirs',`
++interface(`dev_getattr_video_dev',`
gen_require(`
-- type usb_device_t;
-+ type usb_device_t,device_t;
+- type usbfs_t;
++ type device_t, v4l_device_t;
')
- getattr_chr_files_pattern($1, device_t, usb_device_t)
-@@ -4409,9 +5216,9 @@ interface(`dev_rw_usbfs',`
- read_lnk_files_pattern($1, usbfs_t, usbfs_t)
+- allow $1 usbfs_t:dir getattr_dir_perms;
++ getattr_chr_files_pattern($1, device_t, v4l_device_t)
')
--########################################
-+######################################
+ ########################################
## <summary>
--## Get the attributes of video4linux devices.
-+## Read and write userio device.
+ ## Do not audit attempts to get the attributes
+-## of a directory in the usb filesystem.
++## of video4linux device nodes.
## </summary>
## <param name="domain">
## <summary>
-@@ -4419,17 +5226,17 @@ interface(`dev_rw_usbfs',`
+@@ -4302,17 +5299,17 @@ interface(`dev_getattr_usbfs_dirs',`
## </summary>
## </param>
#
--interface(`dev_getattr_video_dev',`
-+interface(`dev_rw_userio_dev',`
+-interface(`dev_dontaudit_getattr_usbfs_dirs',`
++interface(`dev_dontaudit_getattr_video_dev',`
gen_require(`
-- type device_t, v4l_device_t;
-+ type device_t, userio_device_t;
+- type usbfs_t;
++ type v4l_device_t;
')
-- getattr_chr_files_pattern($1, device_t, v4l_device_t)
-+ rw_chr_files_pattern($1, device_t, userio_device_t)
+- dontaudit $1 usbfs_t:dir getattr_dir_perms;
++ dontaudit $1 v4l_device_t:chr_file getattr;
')
--######################################
-+########################################
+ ########################################
## <summary>
--## Read and write userio device.
-+## Get the attributes of video4linux devices.
+-## Search the directory containing USB hardware information.
++## Set the attributes of video4linux device nodes.
## </summary>
## <param name="domain">
## <summary>
-@@ -4437,12 +5244,12 @@ interface(`dev_getattr_video_dev',`
+@@ -4320,38 +5317,36 @@ interface(`dev_dontaudit_getattr_usbfs_dirs',`
## </summary>
## </param>
#
--interface(`dev_rw_userio_dev',`
-+interface(`dev_getattr_video_dev',`
+-interface(`dev_search_usbfs',`
++interface(`dev_setattr_video_dev',`
gen_require(`
-- type device_t, userio_device_t;
+- type usbfs_t;
+ type device_t, v4l_device_t;
')
-- rw_chr_files_pattern($1, device_t, userio_device_t)
-+ getattr_chr_files_pattern($1, device_t, v4l_device_t)
+- search_dirs_pattern($1, usbfs_t, usbfs_t)
++ setattr_chr_files_pattern($1, device_t, v4l_device_t)
+ ')
+
+ ########################################
+ ## <summary>
+-## Allow caller to get a list of usb hardware.
++## Do not audit attempts to set the attributes
++## of video4linux device nodes.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain allowed access.
++## Domain to not audit.
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_list_usbfs',`
++interface(`dev_dontaudit_setattr_video_dev',`
+ gen_require(`
+- type usbfs_t;
++ type v4l_device_t;
+ ')
+
+- read_lnk_files_pattern($1, usbfs_t, usbfs_t)
+- getattr_files_pattern($1, usbfs_t, usbfs_t)
+-
+- list_dirs_pattern($1, usbfs_t, usbfs_t)
++ dontaudit $1 v4l_device_t:chr_file setattr;
+ ')
+
+ ########################################
+ ## <summary>
+-## Set the attributes of usbfs filesystem.
++## Read the video4linux devices.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -4359,19 +5354,17 @@ interface(`dev_list_usbfs',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_setattr_usbfs_files',`
++interface(`dev_read_video_dev',`
+ gen_require(`
+- type usbfs_t;
++ type device_t, v4l_device_t;
+ ')
+
+- setattr_files_pattern($1, usbfs_t, usbfs_t)
+- list_dirs_pattern($1, usbfs_t, usbfs_t)
++ read_chr_files_pattern($1, device_t, v4l_device_t)
')
########################################
-@@ -4539,6 +5346,134 @@ interface(`dev_write_video_dev',`
+ ## <summary>
+-## Read USB hardware information using
+-## the usbfs filesystem interface.
++## Write the video4linux devices.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -4379,19 +5372,17 @@ interface(`dev_setattr_usbfs_files',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_read_usbfs',`
++interface(`dev_write_video_dev',`
+ gen_require(`
+- type usbfs_t;
++ type device_t, v4l_device_t;
+ ')
+
+- read_files_pattern($1, usbfs_t, usbfs_t)
+- read_lnk_files_pattern($1, usbfs_t, usbfs_t)
+- list_dirs_pattern($1, usbfs_t, usbfs_t)
++ write_chr_files_pattern($1, device_t, v4l_device_t)
+ ')
########################################
## <summary>
+-## Allow caller to modify usb hardware configuration files.
+## Get the attributes of vfio devices.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -4399,37 +5390,36 @@ interface(`dev_read_usbfs',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_rw_usbfs',`
+interface(`dev_getattr_vfio_dev',`
-+ gen_require(`
+ gen_require(`
+- type usbfs_t;
+ type device_t, vfio_device_t;
-+ ')
-+
+ ')
+
+- list_dirs_pattern($1, usbfs_t, usbfs_t)
+- rw_files_pattern($1, usbfs_t, usbfs_t)
+- read_lnk_files_pattern($1, usbfs_t, usbfs_t)
+ getattr_chr_files_pattern($1, device_t, vfio_device_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Get the attributes of video4linux devices.
+## Do not audit attempts to get the attributes
+## of vfio device nodes.
-+## </summary>
-+## <param name="domain">
-+## <summary>
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain allowed access.
+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_getattr_video_dev',`
+interface(`dev_dontaudit_getattr_vfio_dev',`
-+ gen_require(`
+ gen_require(`
+- type device_t, v4l_device_t;
+ type vfio_device_t;
-+ ')
-+
+ ')
+
+- getattr_chr_files_pattern($1, device_t, v4l_device_t)
+ dontaudit $1 vfio_device_t:chr_file getattr;
-+')
-+
+ ')
+
+-######################################
+########################################
-+## <summary>
+ ## <summary>
+-## Read and write userio device.
+## Set the attributes of vfio device nodes.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -4437,18 +5427,18 @@ interface(`dev_getattr_video_dev',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_rw_userio_dev',`
+interface(`dev_setattr_vfio_dev',`
-+ gen_require(`
+ gen_require(`
+- type device_t, userio_device_t;
+ type device_t, vfio_device_t;
-+ ')
-+
+ ')
+
+- rw_chr_files_pattern($1, device_t, userio_device_t)
+ setattr_chr_files_pattern($1, device_t, vfio_device_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Do not audit attempts to get the attributes
+-## of video4linux device nodes.
+## Do not audit attempts to set the attributes
+## of vfio device nodes.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -4456,17 +5446,17 @@ interface(`dev_rw_userio_dev',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_dontaudit_getattr_video_dev',`
+interface(`dev_dontaudit_setattr_vfio_dev',`
-+ gen_require(`
+ gen_require(`
+- type v4l_device_t;
+ type vfio_device_t;
-+ ')
-+
+ ')
+
+- dontaudit $1 v4l_device_t:chr_file getattr;
+ dontaudit $1 vfio_device_t:chr_file setattr;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Set the attributes of video4linux device nodes.
+## Read the vfio devices.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -4474,36 +5464,35 @@ interface(`dev_dontaudit_getattr_video_dev',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_setattr_video_dev',`
+interface(`dev_read_vfio_dev',`
-+ gen_require(`
+ gen_require(`
+- type device_t, v4l_device_t;
+ type device_t, vfio_device_t;
-+ ')
-+
+ ')
+
+- setattr_chr_files_pattern($1, device_t, v4l_device_t)
+ read_chr_files_pattern($1, device_t, vfio_device_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Do not audit attempts to set the attributes
+-## of video4linux device nodes.
+## Write the vfio devices.
-+## </summary>
-+## <param name="domain">
-+## <summary>
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain to not audit.
+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_dontaudit_setattr_video_dev',`
+interface(`dev_write_vfio_dev',`
-+ gen_require(`
+ gen_require(`
+- type v4l_device_t;
+ type device_t, vfio_device_t;
-+ ')
-+
+ ')
+
+- dontaudit $1 v4l_device_t:chr_file setattr;
+ write_chr_files_pattern($1, device_t, vfio_device_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Read the video4linux devices.
+## Read and write the VFIO devices.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -4511,17 +5500,17 @@ interface(`dev_dontaudit_setattr_video_dev',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_read_video_dev',`
+interface(`dev_rw_vfio_dev',`
-+ gen_require(`
+ gen_require(`
+- type device_t, v4l_device_t;
+ type device_t, vfio_device_t;
-+ ')
-+
+ ')
+
+- read_chr_files_pattern($1, device_t, v4l_device_t)
+ rw_chr_files_pattern($1, device_t, vfio_device_t)
-+')
-+
-+########################################
-+## <summary>
- ## Allow read/write the vhost net device
+ ')
+
+ ########################################
+ ## <summary>
+-## Write the video4linux devices.
++## Allow read/write the vhost net device
## </summary>
## <param name="domain">
-@@ -4557,6 +5492,24 @@ interface(`dev_rw_vhost',`
+ ## <summary>
+@@ -4529,17 +5518,17 @@ interface(`dev_read_video_dev',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_write_video_dev',`
++interface(`dev_rw_vhost',`
+ gen_require(`
+- type device_t, v4l_device_t;
++ type device_t, vhost_device_t;
+ ')
+
+- write_chr_files_pattern($1, device_t, v4l_device_t)
++ rw_chr_files_pattern($1, device_t, vhost_device_t)
+ ')
########################################
## <summary>
+-## Allow read/write the vhost net device
+## Allow read/write inheretid the vhost net device
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_rw_inherited_vhost',`
-+ gen_require(`
-+ type device_t, vhost_device_t;
-+ ')
-+
-+ allow $1 vhost_device_t:chr_file rw_inherited_chr_file_perms;
-+')
-+
-+########################################
-+## <summary>
- ## Read and write VMWare devices.
## </summary>
## <param name="domain">
-@@ -4630,6 +5583,24 @@ interface(`dev_write_watchdog',`
+ ## <summary>
+@@ -4547,12 +5536,12 @@ interface(`dev_write_video_dev',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_rw_vhost',`
++interface(`dev_rw_inherited_vhost',`
+ gen_require(`
+ type device_t, vhost_device_t;
+ ')
+
+- rw_chr_files_pattern($1, device_t, vhost_device_t)
++ allow $1 vhost_device_t:chr_file rw_inherited_chr_file_perms;
+ ')
+
+ ########################################
+@@ -4630,6 +5619,24 @@ interface(`dev_write_watchdog',`
########################################
## <summary>
@@ -7767,7 +8524,7 @@ index 76f285e..450a2b7 100644
## Read and write the the wireless device.
## </summary>
## <param name="domain">
-@@ -4762,6 +5733,44 @@ interface(`dev_rw_xserver_misc',`
+@@ -4762,6 +5769,44 @@ interface(`dev_rw_xserver_misc',`
########################################
## <summary>
@@ -7812,7 +8569,7 @@ index 76f285e..450a2b7 100644
## Read and write to the zero device (/dev/zero).
## </summary>
## <param name="domain">
-@@ -4851,3 +5860,966 @@ interface(`dev_unconfined',`
+@@ -4851,3 +5896,966 @@ interface(`dev_unconfined',`
typeattribute $1 devices_unconfined_type;
')
@@ -10019,7 +10776,7 @@ index b876c48..a351aff 100644
+/nsr(/.*)? gen_context(system_u:object_r:var_t,s0)
+/nsr/logs(/.*)? gen_context(system_u:object_r:var_log_t,s0)
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
-index f962f76..1a36ae2 100644
+index f962f76..a226015 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -19,6 +19,136 @@
@@ -10760,7 +11517,7 @@ index f962f76..1a36ae2 100644
## Do not audit attempts to get the attributes
## of non security named sockets.
## </summary>
-@@ -1073,10 +1502,8 @@ interface(`files_relabel_all_files',`
+@@ -1073,13 +1502,12 @@ interface(`files_relabel_all_files',`
relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 })
relabel_sock_files_pattern($1, { file_type $2 }, { file_type $2 })
@@ -10773,7 +11530,20 @@ index f962f76..1a36ae2 100644
# satisfy the assertions:
seutil_relabelto_bin_policy($1)
-@@ -1182,24 +1609,6 @@ interface(`files_list_all',`
++ auth_relabelto_shadow($1)
+ ')
+
+ ########################################
+@@ -1140,6 +1568,8 @@ interface(`files_manage_all_files',`
+ # satisfy the assertions:
+ seutil_create_bin_policy($1)
+ files_manage_kernel_modules($1)
++ auth_reader_shadow($1)
++ auth_writer_shadow($1)
+ ')
+
+ ########################################
+@@ -1182,24 +1612,6 @@ interface(`files_list_all',`
########################################
## <summary>
@@ -10798,17 +11568,18 @@ index f962f76..1a36ae2 100644
## Do not audit attempts to search the
## contents of any directories on extended
## attribute filesystems.
-@@ -1443,9 +1852,6 @@ interface(`files_relabel_non_auth_files',`
- # device nodes with file types.
+@@ -1444,8 +1856,8 @@ interface(`files_relabel_non_auth_files',`
relabelfrom_blk_files_pattern($1, non_auth_file_type, non_auth_file_type)
relabelfrom_chr_files_pattern($1, non_auth_file_type, non_auth_file_type)
--
+
- # satisfy the assertions:
- seutil_relabelto_bin_policy($1)
++ # satisfy the assertions:
++ seutil_relabelto_bin_policy($1)
')
#############################################
-@@ -1601,6 +2007,24 @@ interface(`files_setattr_all_mountpoints',`
+@@ -1601,6 +2013,24 @@ interface(`files_setattr_all_mountpoints',`
########################################
## <summary>
@@ -10833,7 +11604,7 @@ index f962f76..1a36ae2 100644
## Do not audit attempts to set the attributes on all mount points.
## </summary>
## <param name="domain">
-@@ -1691,6 +2115,24 @@ interface(`files_dontaudit_list_all_mountpoints',`
+@@ -1691,6 +2121,24 @@ interface(`files_dontaudit_list_all_mountpoints',`
########################################
## <summary>
@@ -10858,7 +11629,14 @@ index f962f76..1a36ae2 100644
## Do not audit attempts to write to mount points.
## </summary>
## <param name="domain">
-@@ -1709,98 +2151,79 @@ interface(`files_dontaudit_write_all_mountpoints',`
+@@ -1703,104 +2151,86 @@ interface(`files_dontaudit_write_all_mountpoints',`
+ gen_require(`
+ attribute mountpoint;
+ ')
++ dontaudit $1 self:capability dac_override;
+
+ dontaudit $1 mountpoint:dir write;
+ ')
########################################
## <summary>
@@ -10978,7 +11756,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1808,17 +2231,127 @@ interface(`files_root_filetrans',`
+@@ -1808,18 +2238,128 @@ interface(`files_root_filetrans',`
## </summary>
## </param>
#
@@ -10995,6 +11773,7 @@ index f962f76..1a36ae2 100644
########################################
## <summary>
-## Do not audit attempts to read or write
+-## files in the root directory.
+## Do not audit attempts to write to / dirs.
+## </summary>
+## <param name="domain">
@@ -11106,10 +11885,11 @@ index f962f76..1a36ae2 100644
+########################################
+## <summary>
+## Do not audit attempts to read or write
- ## files in the root directory.
++## files in the root directory.
## </summary>
## <param name="domain">
-@@ -1892,25 +2425,25 @@ interface(`files_delete_root_dir_entry',`
+ ## <summary>
+@@ -1892,25 +2432,25 @@ interface(`files_delete_root_dir_entry',`
########################################
## <summary>
@@ -11141,7 +11921,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1923,7 +2456,7 @@ interface(`files_relabel_rootfs',`
+@@ -1923,7 +2463,7 @@ interface(`files_relabel_rootfs',`
type root_t;
')
@@ -11150,7 +11930,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -1946,6 +2479,42 @@ interface(`files_unmount_rootfs',`
+@@ -1946,6 +2486,42 @@ interface(`files_unmount_rootfs',`
########################################
## <summary>
@@ -11193,7 +11973,7 @@ index f962f76..1a36ae2 100644
## Get attributes of the /boot directory.
## </summary>
## <param name="domain">
-@@ -2181,6 +2750,24 @@ interface(`files_relabelfrom_boot_files',`
+@@ -2181,6 +2757,24 @@ interface(`files_relabelfrom_boot_files',`
relabelfrom_files_pattern($1, boot_t, boot_t)
')
@@ -11218,7 +11998,7 @@ index f962f76..1a36ae2 100644
######################################
## <summary>
## Read symbolic links in the /boot directory.
-@@ -2645,6 +3232,24 @@ interface(`files_rw_etc_dirs',`
+@@ -2645,6 +3239,24 @@ interface(`files_rw_etc_dirs',`
allow $1 etc_t:dir rw_dir_perms;
')
@@ -11243,7 +12023,7 @@ index f962f76..1a36ae2 100644
##########################################
## <summary>
## Manage generic directories in /etc
-@@ -2716,6 +3321,7 @@ interface(`files_read_etc_files',`
+@@ -2716,6 +3328,7 @@ interface(`files_read_etc_files',`
allow $1 etc_t:dir list_dir_perms;
read_files_pattern($1, etc_t, etc_t)
read_lnk_files_pattern($1, etc_t, etc_t)
@@ -11251,7 +12031,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -2724,7 +3330,7 @@ interface(`files_read_etc_files',`
+@@ -2724,7 +3337,7 @@ interface(`files_read_etc_files',`
## </summary>
## <param name="domain">
## <summary>
@@ -11260,7 +12040,7 @@ index f962f76..1a36ae2 100644
## </summary>
## </param>
#
-@@ -2780,6 +3386,25 @@ interface(`files_manage_etc_files',`
+@@ -2780,6 +3393,25 @@ interface(`files_manage_etc_files',`
########################################
## <summary>
@@ -11286,7 +12066,7 @@ index f962f76..1a36ae2 100644
## Delete system configuration files in /etc.
## </summary>
## <param name="domain">
-@@ -2798,6 +3423,24 @@ interface(`files_delete_etc_files',`
+@@ -2798,6 +3430,24 @@ interface(`files_delete_etc_files',`
########################################
## <summary>
@@ -11311,7 +12091,7 @@ index f962f76..1a36ae2 100644
## Execute generic files in /etc.
## </summary>
## <param name="domain">
-@@ -2963,24 +3606,6 @@ interface(`files_delete_boot_flag',`
+@@ -2963,24 +3613,6 @@ interface(`files_delete_boot_flag',`
########################################
## <summary>
@@ -11336,7 +12116,7 @@ index f962f76..1a36ae2 100644
## Read files in /etc that are dynamically
## created on boot, such as mtab.
## </summary>
-@@ -3021,9 +3646,7 @@ interface(`files_read_etc_runtime_files',`
+@@ -3021,9 +3653,7 @@ interface(`files_read_etc_runtime_files',`
########################################
## <summary>
@@ -11347,7 +12127,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3031,18 +3654,17 @@ interface(`files_read_etc_runtime_files',`
+@@ -3031,18 +3661,17 @@ interface(`files_read_etc_runtime_files',`
## </summary>
## </param>
#
@@ -11369,7 +12149,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3060,6 +3682,26 @@ interface(`files_dontaudit_write_etc_runtime_files',`
+@@ -3060,6 +3689,26 @@ interface(`files_dontaudit_write_etc_runtime_files',`
########################################
## <summary>
@@ -11396,7 +12176,7 @@ index f962f76..1a36ae2 100644
## Read and write files in /etc that are dynamically
## created on boot, such as mtab.
## </summary>
-@@ -3077,6 +3719,7 @@ interface(`files_rw_etc_runtime_files',`
+@@ -3077,6 +3726,7 @@ interface(`files_rw_etc_runtime_files',`
allow $1 etc_t:dir list_dir_perms;
rw_files_pattern($1, etc_t, etc_runtime_t)
@@ -11404,7 +12184,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3098,6 +3741,7 @@ interface(`files_manage_etc_runtime_files',`
+@@ -3098,6 +3748,7 @@ interface(`files_manage_etc_runtime_files',`
')
manage_files_pattern($1, { etc_t etc_runtime_t }, etc_runtime_t)
@@ -11412,7 +12192,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3142,34 +3786,34 @@ interface(`files_etc_filetrans_etc_runtime',`
+@@ -3142,34 +3793,34 @@ interface(`files_etc_filetrans_etc_runtime',`
#
interface(`files_getattr_isid_type_dirs',`
gen_require(`
@@ -11455,7 +12235,7 @@ index f962f76..1a36ae2 100644
## that have not yet been labeled.
## </summary>
## <param name="domain">
-@@ -3178,17 +3822,55 @@ interface(`files_dontaudit_search_isid_type_dirs',`
+@@ -3178,12 +3829,50 @@ interface(`files_dontaudit_search_isid_type_dirs',`
## </summary>
## </param>
#
@@ -11468,11 +12248,10 @@ index f962f76..1a36ae2 100644
- allow $1 file_t:dir list_dir_perms;
+ allow $1 unlabeled_t:dir setattr;
- ')
-
- ########################################
- ## <summary>
--## Read and write directories on new filesystems
++')
++
++########################################
++## <summary>
+## Do not audit attempts to search directories on new filesystems
+## that have not yet been labeled.
+## </summary>
@@ -11507,15 +12286,10 @@ index f962f76..1a36ae2 100644
+ ')
+
+ allow $1 unlabeled_t:dir list_dir_perms;
-+')
-+
-+########################################
-+## <summary>
-+## Read and write directories on new filesystems
- ## that have not yet been labeled.
- ## </summary>
- ## <param name="domain">
-@@ -3199,10 +3881,10 @@ interface(`files_list_isid_type_dirs',`
+ ')
+
+ ########################################
+@@ -3199,10 +3888,10 @@ interface(`files_list_isid_type_dirs',`
#
interface(`files_rw_isid_type_dirs',`
gen_require(`
@@ -11528,7 +12302,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3218,10 +3900,66 @@ interface(`files_rw_isid_type_dirs',`
+@@ -3218,10 +3907,66 @@ interface(`files_rw_isid_type_dirs',`
#
interface(`files_delete_isid_type_dirs',`
gen_require(`
@@ -11571,9 +12345,8 @@ index f962f76..1a36ae2 100644
+interface(`files_mounton_isid',`
+ gen_require(`
+ type unlabeled_t;
- ')
-
-- delete_dirs_pattern($1, file_t, file_t)
++ ')
++
+ allow $1 unlabeled_t:dir mounton;
+')
+
@@ -11591,13 +12364,14 @@ index f962f76..1a36ae2 100644
+interface(`files_relabelfrom_isid_type',`
+ gen_require(`
+ type unlabeled_t;
-+ ')
-+
+ ')
+
+- delete_dirs_pattern($1, file_t, file_t)
+ dontaudit $1 unlabeled_t:dir_file_class_set relabelfrom;
')
########################################
-@@ -3237,10 +3975,10 @@ interface(`files_delete_isid_type_dirs',`
+@@ -3237,10 +3982,10 @@ interface(`files_delete_isid_type_dirs',`
#
interface(`files_manage_isid_type_dirs',`
gen_require(`
@@ -11610,7 +12384,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3256,10 +3994,29 @@ interface(`files_manage_isid_type_dirs',`
+@@ -3256,10 +4001,29 @@ interface(`files_manage_isid_type_dirs',`
#
interface(`files_mounton_isid_type_dirs',`
gen_require(`
@@ -11642,7 +12416,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3275,10 +4032,10 @@ interface(`files_mounton_isid_type_dirs',`
+@@ -3275,10 +4039,10 @@ interface(`files_mounton_isid_type_dirs',`
#
interface(`files_read_isid_type_files',`
gen_require(`
@@ -11655,7 +12429,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3294,10 +4051,10 @@ interface(`files_read_isid_type_files',`
+@@ -3294,10 +4058,10 @@ interface(`files_read_isid_type_files',`
#
interface(`files_delete_isid_type_files',`
gen_require(`
@@ -11668,7 +12442,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3313,10 +4070,10 @@ interface(`files_delete_isid_type_files',`
+@@ -3313,10 +4077,10 @@ interface(`files_delete_isid_type_files',`
#
interface(`files_delete_isid_type_symlinks',`
gen_require(`
@@ -11681,7 +12455,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3332,10 +4089,10 @@ interface(`files_delete_isid_type_symlinks',`
+@@ -3332,10 +4096,10 @@ interface(`files_delete_isid_type_symlinks',`
#
interface(`files_delete_isid_type_fifo_files',`
gen_require(`
@@ -11694,7 +12468,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3351,10 +4108,10 @@ interface(`files_delete_isid_type_fifo_files',`
+@@ -3351,10 +4115,10 @@ interface(`files_delete_isid_type_fifo_files',`
#
interface(`files_delete_isid_type_sock_files',`
gen_require(`
@@ -11707,7 +12481,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3370,10 +4127,10 @@ interface(`files_delete_isid_type_sock_files',`
+@@ -3370,10 +4134,10 @@ interface(`files_delete_isid_type_sock_files',`
#
interface(`files_delete_isid_type_blk_files',`
gen_require(`
@@ -11720,7 +12494,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3389,10 +4146,10 @@ interface(`files_delete_isid_type_blk_files',`
+@@ -3389,10 +4153,10 @@ interface(`files_delete_isid_type_blk_files',`
#
interface(`files_dontaudit_write_isid_chr_files',`
gen_require(`
@@ -11733,7 +12507,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3408,10 +4165,10 @@ interface(`files_dontaudit_write_isid_chr_files',`
+@@ -3408,10 +4172,10 @@ interface(`files_dontaudit_write_isid_chr_files',`
#
interface(`files_delete_isid_type_chr_files',`
gen_require(`
@@ -11746,7 +12520,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3427,10 +4184,10 @@ interface(`files_delete_isid_type_chr_files',`
+@@ -3427,10 +4191,10 @@ interface(`files_delete_isid_type_chr_files',`
#
interface(`files_manage_isid_type_files',`
gen_require(`
@@ -11759,7 +12533,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3446,10 +4203,10 @@ interface(`files_manage_isid_type_files',`
+@@ -3446,10 +4210,10 @@ interface(`files_manage_isid_type_files',`
#
interface(`files_manage_isid_type_symlinks',`
gen_require(`
@@ -11772,7 +12546,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3465,10 +4222,29 @@ interface(`files_manage_isid_type_symlinks',`
+@@ -3465,10 +4229,29 @@ interface(`files_manage_isid_type_symlinks',`
#
interface(`files_rw_isid_type_blk_files',`
gen_require(`
@@ -11804,7 +12578,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3484,10 +4260,10 @@ interface(`files_rw_isid_type_blk_files',`
+@@ -3484,10 +4267,10 @@ interface(`files_rw_isid_type_blk_files',`
#
interface(`files_manage_isid_type_blk_files',`
gen_require(`
@@ -11817,7 +12591,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3503,10 +4279,10 @@ interface(`files_manage_isid_type_blk_files',`
+@@ -3503,10 +4286,10 @@ interface(`files_manage_isid_type_blk_files',`
#
interface(`files_manage_isid_type_chr_files',`
gen_require(`
@@ -11830,7 +12604,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -3552,6 +4328,27 @@ interface(`files_dontaudit_getattr_home_dir',`
+@@ -3552,6 +4335,27 @@ interface(`files_dontaudit_getattr_home_dir',`
########################################
## <summary>
@@ -11858,7 +12632,7 @@ index f962f76..1a36ae2 100644
## Search home directories root (/home).
## </summary>
## <param name="domain">
-@@ -3814,20 +4611,38 @@ interface(`files_list_mnt',`
+@@ -3814,20 +4618,38 @@ interface(`files_list_mnt',`
######################################
## <summary>
@@ -11902,7 +12676,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -4217,6 +5032,175 @@ interface(`files_read_world_readable_sockets',`
+@@ -4217,6 +5039,175 @@ interface(`files_read_world_readable_sockets',`
allow $1 readable_t:sock_file read_sock_file_perms;
')
@@ -12078,7 +12852,7 @@ index f962f76..1a36ae2 100644
########################################
## <summary>
## Allow the specified type to associate
-@@ -4239,6 +5223,26 @@ interface(`files_associate_tmp',`
+@@ -4239,6 +5230,26 @@ interface(`files_associate_tmp',`
########################################
## <summary>
@@ -12105,7 +12879,7 @@ index f962f76..1a36ae2 100644
## Get the attributes of the tmp directory (/tmp).
## </summary>
## <param name="domain">
-@@ -4252,17 +5256,37 @@ interface(`files_getattr_tmp_dirs',`
+@@ -4252,17 +5263,37 @@ interface(`files_getattr_tmp_dirs',`
type tmp_t;
')
@@ -12144,7 +12918,7 @@ index f962f76..1a36ae2 100644
## </summary>
## </param>
#
-@@ -4289,6 +5313,8 @@ interface(`files_search_tmp',`
+@@ -4289,6 +5320,8 @@ interface(`files_search_tmp',`
type tmp_t;
')
@@ -12153,7 +12927,7 @@ index f962f76..1a36ae2 100644
allow $1 tmp_t:dir search_dir_perms;
')
-@@ -4325,6 +5351,7 @@ interface(`files_list_tmp',`
+@@ -4325,6 +5358,7 @@ interface(`files_list_tmp',`
type tmp_t;
')
@@ -12161,7 +12935,7 @@ index f962f76..1a36ae2 100644
allow $1 tmp_t:dir list_dir_perms;
')
-@@ -4334,7 +5361,7 @@ interface(`files_list_tmp',`
+@@ -4334,7 +5368,7 @@ interface(`files_list_tmp',`
## </summary>
## <param name="domain">
## <summary>
@@ -12170,7 +12944,7 @@ index f962f76..1a36ae2 100644
## </summary>
## </param>
#
-@@ -4346,14 +5373,33 @@ interface(`files_dontaudit_list_tmp',`
+@@ -4346,21 +5380,41 @@ interface(`files_dontaudit_list_tmp',`
dontaudit $1 tmp_t:dir list_dir_perms;
')
@@ -12187,8 +12961,9 @@ index f962f76..1a36ae2 100644
+## <summary>
+## Domain not to audit.
+## </summary>
-+## </param>
-+#
+ ## </param>
+ #
+-interface(`files_delete_tmp_dir_entry',`
+interface(`files_rw_generic_tmp_dir',`
+ gen_require(`
+ type tmp_t;
@@ -12206,10 +12981,10 @@ index f962f76..1a36ae2 100644
+## <summary>
+## Domain allowed access.
+## </summary>
- ## </param>
- #
- interface(`files_delete_tmp_dir_entry',`
-@@ -4361,6 +5407,7 @@ interface(`files_delete_tmp_dir_entry',`
++## </param>
++#
++interface(`files_delete_tmp_dir_entry',`
+ gen_require(`
type tmp_t;
')
@@ -12217,7 +12992,7 @@ index f962f76..1a36ae2 100644
allow $1 tmp_t:dir del_entry_dir_perms;
')
-@@ -4402,6 +5449,32 @@ interface(`files_manage_generic_tmp_dirs',`
+@@ -4402,6 +5456,32 @@ interface(`files_manage_generic_tmp_dirs',`
########################################
## <summary>
@@ -12250,7 +13025,7 @@ index f962f76..1a36ae2 100644
## Manage temporary files and directories in /tmp.
## </summary>
## <param name="domain">
-@@ -4456,6 +5529,42 @@ interface(`files_rw_generic_tmp_sockets',`
+@@ -4456,6 +5536,42 @@ interface(`files_rw_generic_tmp_sockets',`
########################################
## <summary>
@@ -12293,7 +13068,7 @@ index f962f76..1a36ae2 100644
## Set the attributes of all tmp directories.
## </summary>
## <param name="domain">
-@@ -4474,6 +5583,60 @@ interface(`files_setattr_all_tmp_dirs',`
+@@ -4474,6 +5590,60 @@ interface(`files_setattr_all_tmp_dirs',`
########################################
## <summary>
@@ -12354,7 +13129,7 @@ index f962f76..1a36ae2 100644
## List all tmp directories.
## </summary>
## <param name="domain">
-@@ -4519,7 +5682,7 @@ interface(`files_relabel_all_tmp_dirs',`
+@@ -4519,7 +5689,7 @@ interface(`files_relabel_all_tmp_dirs',`
## </summary>
## <param name="domain">
## <summary>
@@ -12363,7 +13138,7 @@ index f962f76..1a36ae2 100644
## </summary>
## </param>
#
-@@ -4579,7 +5742,7 @@ interface(`files_relabel_all_tmp_files',`
+@@ -4579,7 +5749,7 @@ interface(`files_relabel_all_tmp_files',`
## </summary>
## <param name="domain">
## <summary>
@@ -12372,7 +13147,7 @@ index f962f76..1a36ae2 100644
## </summary>
## </param>
#
-@@ -4611,6 +5774,44 @@ interface(`files_read_all_tmp_files',`
+@@ -4611,6 +5781,44 @@ interface(`files_read_all_tmp_files',`
########################################
## <summary>
@@ -12417,7 +13192,7 @@ index f962f76..1a36ae2 100644
## Create an object in the tmp directories, with a private
## type using a type transition.
## </summary>
-@@ -4664,6 +5865,16 @@ interface(`files_purge_tmp',`
+@@ -4664,6 +5872,16 @@ interface(`files_purge_tmp',`
delete_lnk_files_pattern($1, tmpfile, tmpfile)
delete_fifo_files_pattern($1, tmpfile, tmpfile)
delete_sock_files_pattern($1, tmpfile, tmpfile)
@@ -12434,7 +13209,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -5112,6 +6323,24 @@ interface(`files_create_kernel_symbol_table',`
+@@ -5112,6 +6330,24 @@ interface(`files_create_kernel_symbol_table',`
########################################
## <summary>
@@ -12459,7 +13234,7 @@ index f962f76..1a36ae2 100644
## Read system.map in the /boot directory.
## </summary>
## <param name="domain">
-@@ -5241,6 +6470,24 @@ interface(`files_list_var',`
+@@ -5241,6 +6477,24 @@ interface(`files_list_var',`
########################################
## <summary>
@@ -12484,7 +13259,7 @@ index f962f76..1a36ae2 100644
## Create, read, write, and delete directories
## in the /var directory.
## </summary>
-@@ -5328,7 +6575,7 @@ interface(`files_dontaudit_rw_var_files',`
+@@ -5328,7 +6582,7 @@ interface(`files_dontaudit_rw_var_files',`
type var_t;
')
@@ -12493,7 +13268,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -5527,6 +6774,25 @@ interface(`files_rw_var_lib_dirs',`
+@@ -5527,6 +6781,25 @@ interface(`files_rw_var_lib_dirs',`
########################################
## <summary>
@@ -12519,7 +13294,7 @@ index f962f76..1a36ae2 100644
## Create objects in the /var/lib directory
## </summary>
## <param name="domain">
-@@ -5596,6 +6862,25 @@ interface(`files_read_var_lib_symlinks',`
+@@ -5596,6 +6869,25 @@ interface(`files_read_var_lib_symlinks',`
read_lnk_files_pattern($1, { var_t var_lib_t }, var_lib_t)
')
@@ -12545,7 +13320,7 @@ index f962f76..1a36ae2 100644
# cjp: the next two interfaces really need to be fixed
# in some way. They really neeed their own types.
-@@ -5641,7 +6926,7 @@ interface(`files_manage_mounttab',`
+@@ -5641,7 +6933,7 @@ interface(`files_manage_mounttab',`
########################################
## <summary>
@@ -12554,7 +13329,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -5649,12 +6934,13 @@ interface(`files_manage_mounttab',`
+@@ -5649,12 +6941,13 @@ interface(`files_manage_mounttab',`
## </summary>
## </param>
#
@@ -12570,7 +13345,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -5672,6 +6958,7 @@ interface(`files_search_locks',`
+@@ -5672,6 +6965,7 @@ interface(`files_search_locks',`
type var_t, var_lock_t;
')
@@ -12578,7 +13353,7 @@ index f962f76..1a36ae2 100644
allow $1 var_lock_t:lnk_file read_lnk_file_perms;
search_dirs_pattern($1, var_t, var_lock_t)
')
-@@ -5698,7 +6985,26 @@ interface(`files_dontaudit_search_locks',`
+@@ -5698,7 +6992,26 @@ interface(`files_dontaudit_search_locks',`
########################################
## <summary>
@@ -12606,7 +13381,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -5706,13 +7012,12 @@ interface(`files_dontaudit_search_locks',`
+@@ -5706,13 +7019,12 @@ interface(`files_dontaudit_search_locks',`
## </summary>
## </param>
#
@@ -12623,7 +13398,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -5731,7 +7036,7 @@ interface(`files_rw_lock_dirs',`
+@@ -5731,7 +7043,7 @@ interface(`files_rw_lock_dirs',`
type var_t, var_lock_t;
')
@@ -12632,7 +13407,7 @@ index f962f76..1a36ae2 100644
rw_dirs_pattern($1, var_t, var_lock_t)
')
-@@ -5764,7 +7069,6 @@ interface(`files_create_lock_dirs',`
+@@ -5764,7 +7076,6 @@ interface(`files_create_lock_dirs',`
## Domain allowed access.
## </summary>
## </param>
@@ -12640,7 +13415,7 @@ index f962f76..1a36ae2 100644
#
interface(`files_relabel_all_lock_dirs',`
gen_require(`
-@@ -5779,7 +7083,7 @@ interface(`files_relabel_all_lock_dirs',`
+@@ -5779,7 +7090,7 @@ interface(`files_relabel_all_lock_dirs',`
########################################
## <summary>
@@ -12649,7 +13424,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -5787,13 +7091,33 @@ interface(`files_relabel_all_lock_dirs',`
+@@ -5787,13 +7098,33 @@ interface(`files_relabel_all_lock_dirs',`
## </summary>
## </param>
#
@@ -12684,7 +13459,7 @@ index f962f76..1a36ae2 100644
allow $1 var_lock_t:dir list_dir_perms;
getattr_files_pattern($1, var_lock_t, var_lock_t)
')
-@@ -5809,13 +7133,12 @@ interface(`files_getattr_generic_locks',`
+@@ -5809,13 +7140,12 @@ interface(`files_getattr_generic_locks',`
## </param>
#
interface(`files_delete_generic_locks',`
@@ -12702,7 +13477,7 @@ index f962f76..1a36ae2 100644
')
########################################
-@@ -5834,9 +7157,7 @@ interface(`files_manage_generic_locks',`
+@@ -5834,9 +7164,7 @@ interface(`files_manage_generic_locks',`
type var_t, var_lock_t;
')
@@ -12713,7 +13488,7 @@ index f962f76..1a36ae2 100644
manage_files_pattern($1, var_lock_t, var_lock_t)
')
-@@ -5878,8 +7199,7 @@ interface(`files_read_all_locks',`
+@@ -5878,8 +7206,7 @@ interface(`files_read_all_locks',`
type var_t, var_lock_t;
')
@@ -12723,7 +13498,7 @@ index f962f76..1a36ae2 100644
allow $1 lockfile:dir list_dir_perms;
read_files_pattern($1, lockfile, lockfile)
read_lnk_files_pattern($1, lockfile, lockfile)
-@@ -5901,8 +7221,7 @@ interface(`files_manage_all_locks',`
+@@ -5901,8 +7228,7 @@ interface(`files_manage_all_locks',`
type var_t, var_lock_t;
')
@@ -12733,7 +13508,7 @@ index f962f76..1a36ae2 100644
manage_dirs_pattern($1, lockfile, lockfile)
manage_files_pattern($1, lockfile, lockfile)
manage_lnk_files_pattern($1, lockfile, lockfile)
-@@ -5939,8 +7258,7 @@ interface(`files_lock_filetrans',`
+@@ -5939,8 +7265,7 @@ interface(`files_lock_filetrans',`
type var_t, var_lock_t;
')
@@ -12743,7 +13518,7 @@ index f962f76..1a36ae2 100644
filetrans_pattern($1, var_lock_t, $2, $3, $4)
')
-@@ -5979,7 +7297,7 @@ interface(`files_setattr_pid_dirs',`
+@@ -5979,7 +7304,7 @@ interface(`files_setattr_pid_dirs',`
type var_run_t;
')
@@ -12752,7 +13527,7 @@ index f962f76..1a36ae2 100644
allow $1 var_run_t:dir setattr;
')
-@@ -5999,10 +7317,48 @@ interface(`files_search_pids',`
+@@ -5999,10 +7324,48 @@ interface(`files_search_pids',`
type var_t, var_run_t;
')
@@ -12801,7 +13576,7 @@ index f962f76..1a36ae2 100644
########################################
## <summary>
## Do not audit attempts to search
-@@ -6025,6 +7381,43 @@ interface(`files_dontaudit_search_pids',`
+@@ -6025,6 +7388,43 @@ interface(`files_dontaudit_search_pids',`
########################################
## <summary>
@@ -12845,7 +13620,7 @@ index f962f76..1a36ae2 100644
## List the contents of the runtime process
## ID directories (/var/run).
## </summary>
-@@ -6039,7 +7432,7 @@ interface(`files_list_pids',`
+@@ -6039,7 +7439,7 @@ interface(`files_list_pids',`
type var_t, var_run_t;
')
@@ -12854,7 +13629,7 @@ index f962f76..1a36ae2 100644
list_dirs_pattern($1, var_t, var_run_t)
')
-@@ -6058,7 +7451,7 @@ interface(`files_read_generic_pids',`
+@@ -6058,7 +7458,7 @@ interface(`files_read_generic_pids',`
type var_t, var_run_t;
')
@@ -12863,7 +13638,7 @@ index f962f76..1a36ae2 100644
list_dirs_pattern($1, var_t, var_run_t)
read_files_pattern($1, var_run_t, var_run_t)
')
-@@ -6078,7 +7471,7 @@ interface(`files_write_generic_pid_pipes',`
+@@ -6078,7 +7478,7 @@ interface(`files_write_generic_pid_pipes',`
type var_run_t;
')
@@ -12872,7 +13647,7 @@ index f962f76..1a36ae2 100644
allow $1 var_run_t:fifo_file write;
')
-@@ -6140,7 +7533,6 @@ interface(`files_pid_filetrans',`
+@@ -6140,7 +7540,6 @@ interface(`files_pid_filetrans',`
')
allow $1 var_t:dir search_dir_perms;
@@ -12880,7 +13655,7 @@ index f962f76..1a36ae2 100644
filetrans_pattern($1, var_run_t, $2, $3, $4)
')
-@@ -6169,6 +7561,24 @@ interface(`files_pid_filetrans_lock_dir',`
+@@ -6169,6 +7568,24 @@ interface(`files_pid_filetrans_lock_dir',`
########################################
## <summary>
@@ -12905,7 +13680,7 @@ index f962f76..1a36ae2 100644
## Read and write generic process ID files.
## </summary>
## <param name="domain">
-@@ -6182,7 +7592,7 @@ interface(`files_rw_generic_pids',`
+@@ -6182,7 +7599,7 @@ interface(`files_rw_generic_pids',`
type var_t, var_run_t;
')
@@ -12914,7 +13689,7 @@ index f962f76..1a36ae2 100644
list_dirs_pattern($1, var_t, var_run_t)
rw_files_pattern($1, var_run_t, var_run_t)
')
-@@ -6249,55 +7659,43 @@ interface(`files_dontaudit_ioctl_all_pids',`
+@@ -6249,55 +7666,43 @@ interface(`files_dontaudit_ioctl_all_pids',`
########################################
## <summary>
@@ -12977,7 +13752,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6305,42 +7703,35 @@ interface(`files_delete_all_pids',`
+@@ -6305,42 +7710,35 @@ interface(`files_delete_all_pids',`
## </summary>
## </param>
#
@@ -13027,7 +13802,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6348,18 +7739,18 @@ interface(`files_manage_all_pids',`
+@@ -6348,18 +7746,18 @@ interface(`files_manage_all_pids',`
## </summary>
## </param>
#
@@ -13051,7 +13826,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6367,37 +7758,40 @@ interface(`files_mounton_all_poly_members',`
+@@ -6367,37 +7765,40 @@ interface(`files_mounton_all_poly_members',`
## </summary>
## </param>
#
@@ -13103,7 +13878,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6405,18 +7799,17 @@ interface(`files_dontaudit_search_spool',`
+@@ -6405,18 +7806,17 @@ interface(`files_dontaudit_search_spool',`
## </summary>
## </param>
#
@@ -13126,7 +13901,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6424,18 +7817,18 @@ interface(`files_list_spool',`
+@@ -6424,18 +7824,18 @@ interface(`files_list_spool',`
## </summary>
## </param>
#
@@ -13150,7 +13925,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6443,19 +7836,18 @@ interface(`files_manage_generic_spool_dirs',`
+@@ -6443,19 +7843,18 @@ interface(`files_manage_generic_spool_dirs',`
## </summary>
## </param>
#
@@ -13175,7 +13950,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6463,109 +7855,62 @@ interface(`files_read_generic_spool',`
+@@ -6463,109 +7862,62 @@ interface(`files_read_generic_spool',`
## </summary>
## </param>
#
@@ -13306,7 +14081,7 @@ index f962f76..1a36ae2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6573,10 +7918,944 @@ interface(`files_polyinstantiate_all',`
+@@ -6573,10 +7925,944 @@ interface(`files_polyinstantiate_all',`
## </summary>
## </param>
#
@@ -17276,7 +18051,7 @@ index 7be4ddf..9710b33 100644
+/sys/kernel/debug -d gen_context(system_u:object_r:debugfs_t,s0)
+/sys/kernel/debug/.* <<none>>
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
-index e100d88..991e1a5 100644
+index e100d88..d2fc766 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -126,6 +126,24 @@ interface(`kernel_setsched',`
@@ -17536,7 +18311,7 @@ index e100d88..991e1a5 100644
## Do not audit attempts to list all proc directories.
## </summary>
## <param name="domain">
-@@ -1477,6 +1640,24 @@ interface(`kernel_dontaudit_list_all_proc',`
+@@ -1477,6 +1640,28 @@ interface(`kernel_dontaudit_list_all_proc',`
########################################
## <summary>
@@ -17551,9 +18326,13 @@ index e100d88..991e1a5 100644
+interface(`kernel_read_all_proc',`
+ gen_require(`
+ attribute proc_type;
++ attribute can_dump_kernel;
++ attribute can_receive_kernel_messages;
+ ')
+
+ read_files_pattern($1, proc_type, proc_type)
++ typeattribute $1 can_dump_kernel;
++ typeattribute $1 can_receive_kernel_messages;
+')
+
+########################################
@@ -17561,7 +18340,7 @@ index e100d88..991e1a5 100644
## Do not audit attempts by caller to search
## the base directory of sysctls.
## </summary>
-@@ -1672,7 +1853,7 @@ interface(`kernel_read_net_sysctls',`
+@@ -1672,7 +1857,7 @@ interface(`kernel_read_net_sysctls',`
')
read_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_t)
@@ -17570,7 +18349,7 @@ index e100d88..991e1a5 100644
list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
')
-@@ -1693,7 +1874,7 @@ interface(`kernel_rw_net_sysctls',`
+@@ -1693,7 +1878,7 @@ interface(`kernel_rw_net_sysctls',`
')
rw_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_t)
@@ -17579,7 +18358,7 @@ index e100d88..991e1a5 100644
list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
')
-@@ -1715,7 +1896,6 @@ interface(`kernel_read_unix_sysctls',`
+@@ -1715,7 +1900,6 @@ interface(`kernel_read_unix_sysctls',`
')
read_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_unix_t)
@@ -17587,7 +18366,7 @@ index e100d88..991e1a5 100644
list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
')
-@@ -1750,16 +1930,9 @@ interface(`kernel_rw_unix_sysctls',`
+@@ -1750,16 +1934,9 @@ interface(`kernel_rw_unix_sysctls',`
## Domain allowed access.
## </summary>
## </param>
@@ -17605,7 +18384,7 @@ index e100d88..991e1a5 100644
')
########################################
-@@ -1771,16 +1944,9 @@ interface(`kernel_read_hotplug_sysctls',`
+@@ -1771,16 +1948,9 @@ interface(`kernel_read_hotplug_sysctls',`
## Domain allowed access.
## </summary>
## </param>
@@ -17623,7 +18402,7 @@ index e100d88..991e1a5 100644
')
########################################
-@@ -1792,16 +1958,9 @@ interface(`kernel_rw_hotplug_sysctls',`
+@@ -1792,16 +1962,9 @@ interface(`kernel_rw_hotplug_sysctls',`
## Domain allowed access.
## </summary>
## </param>
@@ -17641,7 +18420,7 @@ index e100d88..991e1a5 100644
')
########################################
-@@ -1813,16 +1972,9 @@ interface(`kernel_read_modprobe_sysctls',`
+@@ -1813,16 +1976,9 @@ interface(`kernel_read_modprobe_sysctls',`
## Domain allowed access.
## </summary>
## </param>
@@ -17659,7 +18438,7 @@ index e100d88..991e1a5 100644
')
########################################
-@@ -2085,9 +2237,28 @@ interface(`kernel_dontaudit_list_all_sysctls',`
+@@ -2085,9 +2241,28 @@ interface(`kernel_dontaudit_list_all_sysctls',`
')
dontaudit $1 sysctl_type:dir list_dir_perms;
@@ -17689,7 +18468,7 @@ index e100d88..991e1a5 100644
########################################
## <summary>
## Allow caller to read all sysctls.
-@@ -2282,6 +2453,25 @@ interface(`kernel_list_unlabeled',`
+@@ -2282,6 +2457,25 @@ interface(`kernel_list_unlabeled',`
########################################
## <summary>
@@ -17715,7 +18494,7 @@ index e100d88..991e1a5 100644
## Read the process state (/proc/pid) of all unlabeled_t.
## </summary>
## <param name="domain">
-@@ -2306,7 +2496,7 @@ interface(`kernel_read_unlabeled_state',`
+@@ -2306,7 +2500,7 @@ interface(`kernel_read_unlabeled_state',`
## </summary>
## <param name="domain">
## <summary>
@@ -17724,7 +18503,7 @@ index e100d88..991e1a5 100644
## </summary>
## </param>
#
-@@ -2488,6 +2678,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
+@@ -2488,6 +2682,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
########################################
## <summary>
@@ -17749,7 +18528,7 @@ index e100d88..991e1a5 100644
## Do not audit attempts by caller to get attributes for
## unlabeled character devices.
## </summary>
-@@ -2525,6 +2733,24 @@ interface(`kernel_relabelfrom_unlabeled_dirs',`
+@@ -2525,6 +2737,24 @@ interface(`kernel_relabelfrom_unlabeled_dirs',`
########################################
## <summary>
@@ -17774,7 +18553,7 @@ index e100d88..991e1a5 100644
## Allow caller to relabel unlabeled files.
## </summary>
## <param name="domain">
-@@ -2667,16 +2893,34 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
+@@ -2667,16 +2897,34 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
########################################
## <summary>
@@ -17818,7 +18597,7 @@ index e100d88..991e1a5 100644
## </desc>
## <param name="domain">
## <summary>
-@@ -2694,6 +2938,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',`
+@@ -2694,6 +2942,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',`
########################################
## <summary>
@@ -17844,7 +18623,7 @@ index e100d88..991e1a5 100644
## Do not audit attempts to receive TCP packets from an unlabeled
## connection.
## </summary>
-@@ -2803,6 +3066,33 @@ interface(`kernel_raw_recvfrom_unlabeled',`
+@@ -2803,6 +3070,33 @@ interface(`kernel_raw_recvfrom_unlabeled',`
allow $1 unlabeled_t:rawip_socket recvfrom;
')
@@ -17878,7 +18657,7 @@ index e100d88..991e1a5 100644
########################################
## <summary>
-@@ -2958,6 +3248,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
+@@ -2958,6 +3252,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
########################################
## <summary>
@@ -17903,7 +18682,7 @@ index e100d88..991e1a5 100644
## Unconfined access to kernel module resources.
## </summary>
## <param name="domain">
-@@ -2972,5 +3280,628 @@ interface(`kernel_unconfined',`
+@@ -2972,5 +3284,628 @@ interface(`kernel_unconfined',`
')
typeattribute $1 kern_unconfined;
@@ -18534,7 +19313,7 @@ index e100d88..991e1a5 100644
+')
+
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
-index 8dbab4c..46d7f18 100644
+index 8dbab4c..a85c5d7 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -25,6 +25,9 @@ attribute kern_unconfined;
@@ -18690,7 +19469,7 @@ index 8dbab4c..46d7f18 100644
corecmd_exec_shell(kernel_t)
corecmd_list_bin(kernel_t)
-@@ -277,25 +315,53 @@ files_list_root(kernel_t)
+@@ -277,25 +315,54 @@ files_list_root(kernel_t)
files_list_etc(kernel_t)
files_list_home(kernel_t)
files_read_usr_files(kernel_t)
@@ -18720,6 +19499,7 @@ index 8dbab4c..46d7f18 100644
+
+optional_policy(`
+ abrt_filetrans_named_content(kernel_t)
++ abrt_dump_oops_domtrans(kernel_t)
+')
+
+optional_policy(`
@@ -18744,7 +19524,7 @@ index 8dbab4c..46d7f18 100644
')
optional_policy(`
-@@ -305,6 +371,19 @@ optional_policy(`
+@@ -305,6 +372,19 @@ optional_policy(`
optional_policy(`
logging_send_syslog_msg(kernel_t)
@@ -18764,7 +19544,7 @@ index 8dbab4c..46d7f18 100644
')
optional_policy(`
-@@ -312,6 +391,11 @@ optional_policy(`
+@@ -312,6 +392,11 @@ optional_policy(`
')
optional_policy(`
@@ -18776,7 +19556,7 @@ index 8dbab4c..46d7f18 100644
# nfs kernel server needs kernel UDP access. It is less risky and painful
# to just give it everything.
allow kernel_t self:tcp_socket create_stream_socket_perms;
-@@ -332,9 +416,6 @@ optional_policy(`
+@@ -332,9 +417,6 @@ optional_policy(`
sysnet_read_config(kernel_t)
@@ -18786,7 +19566,7 @@ index 8dbab4c..46d7f18 100644
rpc_udp_rw_nfs_sockets(kernel_t)
tunable_policy(`nfs_export_all_ro',`
-@@ -343,9 +424,7 @@ optional_policy(`
+@@ -343,9 +425,7 @@ optional_policy(`
fs_read_noxattr_fs_files(kernel_t)
fs_read_noxattr_fs_symlinks(kernel_t)
@@ -18797,7 +19577,7 @@ index 8dbab4c..46d7f18 100644
')
tunable_policy(`nfs_export_all_rw',`
-@@ -354,7 +433,7 @@ optional_policy(`
+@@ -354,7 +434,7 @@ optional_policy(`
fs_read_noxattr_fs_files(kernel_t)
fs_read_noxattr_fs_symlinks(kernel_t)
@@ -18806,7 +19586,7 @@ index 8dbab4c..46d7f18 100644
')
')
-@@ -367,6 +446,15 @@ optional_policy(`
+@@ -367,6 +447,15 @@ optional_policy(`
unconfined_domain_noaudit(kernel_t)
')
@@ -18822,7 +19602,7 @@ index 8dbab4c..46d7f18 100644
########################################
#
# Unlabeled process local policy
-@@ -399,14 +487,39 @@ if( ! secure_mode_insmod ) {
+@@ -399,14 +488,39 @@ if( ! secure_mode_insmod ) {
# Rules for unconfined acccess to this module
#
@@ -19433,10 +20213,10 @@ index 54f1827..6910c88 100644
+/usr/lib/udev/devices/loop.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/usr/lib/udev/devices/fuse -c gen_context(system_u:object_r:fuse_device_t,s0)
diff --git a/policy/modules/kernel/storage.if b/policy/modules/kernel/storage.if
-index 64c4cd0..542299c 100644
+index 64c4cd0..52070af 100644
--- a/policy/modules/kernel/storage.if
+++ b/policy/modules/kernel/storage.if
-@@ -22,6 +22,26 @@ interface(`storage_getattr_fixed_disk_dev',`
+@@ -22,6 +22,30 @@ interface(`storage_getattr_fixed_disk_dev',`
########################################
## <summary>
@@ -19451,11 +20231,15 @@ index 64c4cd0..542299c 100644
+#
+interface(`storage_rw_inherited_fixed_disk_dev',`
+ gen_require(`
-+ type fixed_disk_device_t;
++ type fixed_disk_device_t;
++ attribute fixed_disk_raw_read;
++ attribute fixed_disk_raw_write;
+ ')
+
-+ allow $1 fixed_disk_device_t:chr_file { read write };
-+ allow $1 fixed_disk_device_t:blk_file { read write };
++ allow $1 fixed_disk_device_t:chr_file { read write };
++ allow $1 fixed_disk_device_t:blk_file { read write };
++ typeattribute $1 fixed_disk_raw_read;
++ typeattribute $1 fixed_disk_raw_write;
+')
+
+########################################
@@ -19463,7 +20247,7 @@ index 64c4cd0..542299c 100644
## Do not audit attempts made by the caller to get
## the attributes of fixed disk device nodes.
## </summary>
-@@ -101,6 +121,8 @@ interface(`storage_raw_read_fixed_disk',`
+@@ -101,6 +125,8 @@ interface(`storage_raw_read_fixed_disk',`
dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file read_blk_file_perms;
allow $1 fixed_disk_device_t:chr_file read_chr_file_perms;
@@ -19472,7 +20256,7 @@ index 64c4cd0..542299c 100644
typeattribute $1 fixed_disk_raw_read;
')
-@@ -186,6 +208,7 @@ interface(`storage_dontaudit_write_fixed_disk',`
+@@ -186,6 +212,7 @@ interface(`storage_dontaudit_write_fixed_disk',`
interface(`storage_raw_rw_fixed_disk',`
storage_raw_read_fixed_disk($1)
storage_raw_write_fixed_disk($1)
@@ -19480,7 +20264,7 @@ index 64c4cd0..542299c 100644
')
########################################
-@@ -205,6 +228,7 @@ interface(`storage_create_fixed_disk_dev',`
+@@ -205,6 +232,7 @@ interface(`storage_create_fixed_disk_dev',`
allow $1 self:capability mknod;
allow $1 fixed_disk_device_t:blk_file create_blk_file_perms;
@@ -19488,7 +20272,7 @@ index 64c4cd0..542299c 100644
dev_add_entry_generic_dirs($1)
')
-@@ -274,6 +298,48 @@ interface(`storage_dev_filetrans_fixed_disk',`
+@@ -274,6 +302,48 @@ interface(`storage_dev_filetrans_fixed_disk',`
dev_filetrans($1, fixed_disk_device_t, blk_file, $2)
')
@@ -19537,7 +20321,7 @@ index 64c4cd0..542299c 100644
########################################
## <summary>
## Create block devices in on a tmpfs filesystem with the
-@@ -295,6 +361,25 @@ interface(`storage_tmpfs_filetrans_fixed_disk',`
+@@ -295,6 +365,25 @@ interface(`storage_tmpfs_filetrans_fixed_disk',`
########################################
## <summary>
@@ -19563,7 +20347,43 @@ index 64c4cd0..542299c 100644
## Relabel fixed disk device nodes.
## </summary>
## <param name="domain">
-@@ -716,6 +801,24 @@ interface(`storage_dontaudit_raw_write_removable_device',`
+@@ -478,6 +567,35 @@ interface(`storage_write_scsi_generic',`
+ typeattribute $1 scsi_generic_write;
+ ')
+
++
++########################################
++## <summary>
++## Allow the caller to directly read and write, in a
++## generic fashion, from any SCSI device.
++## This is extremly dangerous as it can bypass the
++## SELinux protections for filesystem objects, and
++## should only be used by trusted domains.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`storage_rw_inherited_scsi_generic',`
++ gen_require(`
++ attribute scsi_generic_read;
++ attribute scsi_generic_write;
++ type scsi_generic_device_t;
++ ')
++
++ dev_list_all_dev_nodes($1)
++ allow $1 scsi_generic_device_t:chr_file rw_inherited_chr_file_perms;
++ allow $1 scsi_generic_device_t:chr_file rw_inherited_blk_file_perms;
++ typeattribute $1 scsi_generic_write;
++ typeattribute $1 scsi_generic_read;
++')
++
+ ########################################
+ ## <summary>
+ ## Set attributes of the device nodes
+@@ -716,6 +834,24 @@ interface(`storage_dontaudit_raw_write_removable_device',`
dontaudit $1 removable_device_t:blk_file write_blk_file_perms;
')
@@ -19588,7 +20408,7 @@ index 64c4cd0..542299c 100644
########################################
## <summary>
## Allow the caller to directly read
-@@ -813,3 +916,452 @@ interface(`storage_unconfined',`
+@@ -813,3 +949,452 @@ interface(`storage_unconfined',`
typeattribute $1 storage_unconfined_type;
')
@@ -29100,7 +29920,7 @@ index 2479587..890e1e2 100644
/var/(db|adm)/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
/var/lib/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
-index 3efd5b6..9e85ea0 100644
+index 3efd5b6..3db526f 100644
--- a/policy/modules/system/authlogin.if
+++ b/policy/modules/system/authlogin.if
@@ -23,11 +23,17 @@ interface(`auth_role',`
@@ -29651,33 +30471,75 @@ index 3efd5b6..9e85ea0 100644
## Read login records files (/var/log/wtmp).
## </summary>
## <param name="domain">
-@@ -1726,24 +1968,7 @@ interface(`auth_manage_login_records',`
+@@ -1726,24 +1968,63 @@ interface(`auth_manage_login_records',`
logging_rw_generic_log_dirs($1)
allow $1 wtmp_t:file manage_file_perms;
--')
--
--########################################
--## <summary>
++ logging_log_named_filetrans($1, wtmp_t, file, "wtmp")
+ ')
+
+ ########################################
+ ## <summary>
-## Relabel login record files.
--## </summary>
--## <param name="domain">
--## <summary>
--## Domain allowed access.
--## </summary>
--## </param>
--#
++## Read access to the authlogin module.
+ ## </summary>
++## <desc>
++## <p>
++## Read access to the authlogin module.
++## </p>
++## <p>
++## Currently, this only allows assertions for
++## the shadow passwords file (/etc/shadow) to
++## be passed. No access is granted yet.
++## </p>
++## </desc>
+ ## <param name="domain">
+ ## <summary>
+ ## Domain allowed access.
+ ## </summary>
+ ## </param>
+ #
-interface(`auth_relabel_login_records',`
-- gen_require(`
++interface(`auth_reader_shadow',`
+ gen_require(`
- type wtmp_t;
-- ')
--
++ attribute can_read_shadow_passwords;
+ ')
+
- allow $1 wtmp_t:file relabel_file_perms;
-+ logging_log_named_filetrans($1, wtmp_t, file, "wtmp")
++ typeattribute $1 can_read_shadow_passwords;
++')
++
++########################################
++## <summary>
++## Write access to the authlogin module.
++## </summary>
++## <desc>
++## <p>
++## Write access to the authlogin module.
++## </p>
++## <p>
++## Currently, this only allows assertions for
++## the shadow passwords file (/etc/shadow) to
++## be passed. No access is granted yet.
++## </p>
++## </desc>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`auth_writer_shadow',`
++ gen_require(`
++ attribute can_write_shadow_passwords;
++ ')
++
++ typeattribute $1 can_write_shadow_passwords;
')
########################################
-@@ -1767,11 +1992,13 @@ interface(`auth_relabel_login_records',`
+@@ -1767,11 +2048,13 @@ interface(`auth_relabel_login_records',`
## <infoflow type="both" weight="10"/>
#
interface(`auth_use_nsswitch',`
@@ -29694,7 +30556,7 @@ index 3efd5b6..9e85ea0 100644
')
########################################
-@@ -1805,3 +2032,280 @@ interface(`auth_unconfined',`
+@@ -1805,3 +2088,280 @@ interface(`auth_unconfined',`
typeattribute $1 can_write_shadow_passwords;
typeattribute $1 can_relabelto_shadow_passwords;
')
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index b1f2938..a121c91 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -80,7 +80,7 @@ index 1a93dc5..f2b26f5 100644
-/var/spool/abrt-retrace(/.*)? gen_context(system_u:object_r:abrt_retrace_spool_t,s0)
-/var/spool/retrace-server(/.*)? gen_context(system_u:object_r:abrt_retrace_spool_t,s0)
diff --git a/abrt.if b/abrt.if
-index 058d908..158acba 100644
+index 058d908..7da78c7 100644
--- a/abrt.if
+++ b/abrt.if
@@ -1,4 +1,26 @@
@@ -111,7 +111,33 @@ index 058d908..158acba 100644
######################################
## <summary>
-@@ -40,7 +62,7 @@ interface(`abrt_exec',`
+@@ -21,6 +43,25 @@ interface(`abrt_domtrans',`
+
+ ######################################
+ ## <summary>
++## Execute abrt_dump_oops in the abrt_dump_oops_t domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`abrt_dump_oops_domtrans',`
++ gen_require(`
++ type abrt_dump_oops_t, abrt_dump_oops_exec_t;
++ ')
++
++ corecmd_search_bin($1)
++ domtrans_pattern($1, abrt_dump_oops_exec_t, abrt_dump_oops_t)
++')
++
++######################################
++## <summary>
+ ## Execute abrt in the caller domain.
+ ## </summary>
+ ## <param name="domain">
+@@ -40,7 +81,7 @@ interface(`abrt_exec',`
########################################
## <summary>
@@ -120,7 +146,7 @@ index 058d908..158acba 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -58,7 +80,7 @@ interface(`abrt_signull',`
+@@ -58,7 +99,7 @@ interface(`abrt_signull',`
########################################
## <summary>
@@ -129,7 +155,7 @@ index 058d908..158acba 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -71,12 +93,13 @@ interface(`abrt_read_state',`
+@@ -71,12 +112,13 @@ interface(`abrt_read_state',`
type abrt_t;
')
@@ -144,7 +170,7 @@ index 058d908..158acba 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -116,8 +139,7 @@ interface(`abrt_dbus_chat',`
+@@ -116,8 +158,7 @@ interface(`abrt_dbus_chat',`
#####################################
## <summary>
@@ -154,7 +180,7 @@ index 058d908..158acba 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -130,15 +152,13 @@ interface(`abrt_domtrans_helper',`
+@@ -130,15 +171,13 @@ interface(`abrt_domtrans_helper',`
type abrt_helper_t, abrt_helper_exec_t;
')
@@ -172,7 +198,7 @@ index 058d908..158acba 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -163,8 +183,26 @@ interface(`abrt_run_helper',`
+@@ -163,8 +202,45 @@ interface(`abrt_run_helper',`
########################################
## <summary>
@@ -198,53 +224,53 @@ index 058d908..158acba 100644
+########################################
+## <summary>
+## Append abrt cache
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`abrt_append_cache',`
++ gen_require(`
++ type abrt_var_cache_t;
++ ')
++
++
++ allow $1 abrt_var_cache_t:file append_inherited_file_perms;
++')
++
++########################################
++## <summary>
++## Read/Write inherited abrt cache
## </summary>
## <param name="domain">
## <summary>
-@@ -172,15 +210,37 @@ interface(`abrt_run_helper',`
+@@ -172,15 +248,18 @@ interface(`abrt_run_helper',`
## </summary>
## </param>
#
-interface(`abrt_cache_manage',`
- refpolicywarn(`$0($*) has been deprecated, use abrt_manage_cache() instead.')
- abrt_manage_cache($1)
-+interface(`abrt_append_cache',`
++interface(`abrt_rw_inherited_cache',`
+ gen_require(`
+ type abrt_var_cache_t;
+ ')
+
+
-+ allow $1 abrt_var_cache_t:file append_inherited_file_perms;
++ allow $1 abrt_var_cache_t:file rw_inherited_file_perms;
')
########################################
## <summary>
-## Create, read, write, and delete
-## abrt cache content.
-+## Read/Write inherited abrt cache
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`abrt_rw_inherited_cache',`
-+ gen_require(`
-+ type abrt_var_cache_t;
-+ ')
-+
-+
-+ allow $1 abrt_var_cache_t:file rw_inherited_file_perms;
-+')
-+
-+########################################
-+## <summary>
+## Manage abrt cache
## </summary>
## <param name="domain">
## <summary>
-@@ -193,7 +253,6 @@ interface(`abrt_manage_cache',`
+@@ -193,7 +272,6 @@ interface(`abrt_manage_cache',`
type abrt_var_cache_t;
')
@@ -252,7 +278,7 @@ index 058d908..158acba 100644
manage_files_pattern($1, abrt_var_cache_t, abrt_var_cache_t)
manage_lnk_files_pattern($1, abrt_var_cache_t, abrt_var_cache_t)
manage_dirs_pattern($1, abrt_var_cache_t, abrt_var_cache_t)
-@@ -201,7 +260,7 @@ interface(`abrt_manage_cache',`
+@@ -201,7 +279,7 @@ interface(`abrt_manage_cache',`
####################################
## <summary>
@@ -261,7 +287,7 @@ index 058d908..158acba 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -218,9 +277,29 @@ interface(`abrt_read_config',`
+@@ -218,9 +296,29 @@ interface(`abrt_read_config',`
read_files_pattern($1, abrt_etc_t, abrt_etc_t)
')
@@ -292,7 +318,7 @@ index 058d908..158acba 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -258,8 +337,7 @@ interface(`abrt_read_pid_files',`
+@@ -258,8 +356,7 @@ interface(`abrt_read_pid_files',`
######################################
## <summary>
@@ -302,7 +328,7 @@ index 058d908..158acba 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -276,10 +354,52 @@ interface(`abrt_manage_pid_files',`
+@@ -276,10 +373,52 @@ interface(`abrt_manage_pid_files',`
manage_files_pattern($1, abrt_var_run_t, abrt_var_run_t)
')
@@ -357,7 +383,7 @@ index 058d908..158acba 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -288,39 +408,174 @@ interface(`abrt_manage_pid_files',`
+@@ -288,39 +427,174 @@ interface(`abrt_manage_pid_files',`
## </param>
## <param name="role">
## <summary>
@@ -546,7 +572,7 @@ index 058d908..158acba 100644
+')
+
diff --git a/abrt.te b/abrt.te
-index eb50f07..d6d0e34 100644
+index eb50f07..f93be3c 100644
--- a/abrt.te
+++ b/abrt.te
@@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1)
@@ -989,7 +1015,7 @@ index eb50f07..d6d0e34 100644
allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms;
domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t)
-@@ -365,38 +456,60 @@ corecmd_exec_shell(abrt_retrace_worker_t)
+@@ -365,38 +456,64 @@ corecmd_exec_shell(abrt_retrace_worker_t)
dev_read_urand(abrt_retrace_worker_t)
@@ -1011,7 +1037,7 @@ index eb50f07..d6d0e34 100644
#
-allow abrt_dump_oops_t self:capability dac_override;
-+allow abrt_dump_oops_t self:capability { ipc_lock fowner chown fsetid dac_override };
++allow abrt_dump_oops_t self:capability { kill net_admin sys_ptrace ipc_lock fowner chown fsetid dac_override };
allow abrt_dump_oops_t self:fifo_file rw_fifo_file_perms;
-allow abrt_dump_oops_t self:unix_stream_socket { accept listen };
+allow abrt_dump_oops_t self:unix_stream_socket create_stream_socket_perms;
@@ -1034,13 +1060,17 @@ index eb50f07..d6d0e34 100644
+kernel_read_debugfs(abrt_dump_oops_t)
kernel_read_kernel_sysctls(abrt_dump_oops_t)
kernel_read_ring_buffer(abrt_dump_oops_t)
-
++kernel_read_security_state(abrt_dump_oops_t)
++
+auth_read_passwd(abrt_dump_oops_t)
+
+dev_read_urand(abrt_dump_oops_t)
+dev_read_rand(abrt_dump_oops_t)
-+
+
domain_use_interactive_fds(abrt_dump_oops_t)
++domain_signull_all_domains(abrt_dump_oops_t)
++domain_ptrace_all_domains(abrt_dump_oops_t)
++domain_read_all_domains_state(abrt_dump_oops_t)
+fs_getattr_all_fs(abrt_dump_oops_t)
fs_list_inotifyfs(abrt_dump_oops_t)
@@ -1054,7 +1084,7 @@ index eb50f07..d6d0e34 100644
#######################################
#
-@@ -404,25 +517,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
+@@ -404,25 +521,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
#
allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms;
@@ -1117,7 +1147,7 @@ index eb50f07..d6d0e34 100644
')
#######################################
-@@ -430,10 +578,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
+@@ -430,10 +582,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
# Global local policy
#
@@ -3364,10 +3394,10 @@ index 0000000..6183b21
+ spamassassin_read_pid_files(antivirus_domain)
+')
diff --git a/apache.fc b/apache.fc
-index 7caefc3..3ef1de6 100644
+index 7caefc3..239cefa 100644
--- a/apache.fc
+++ b/apache.fc
-@@ -1,162 +1,207 @@
+@@ -1,162 +1,211 @@
-HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0)
-HOME_DIR/((www)|(web)|(public_html))/cgi-bin(/.+)? gen_context(system_u:object_r:httpd_user_script_exec_t,s0)
+HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0)
@@ -3407,6 +3437,7 @@ index 7caefc3..3ef1de6 100644
+/etc/lighttpd(/.*)? gen_context(system_u:object_r:httpd_config_t,s0)
+/etc/mock/koji(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)
+/etc/nginx(/.*)? gen_context(system_u:object_r:httpd_config_t,s0)
++/etc/opt/rh/rh-nginx18/nginx(/.*)? gen_context(system_u:object_r:httpd_config_t,s0)
/etc/rc\.d/init\.d/httpd -- gen_context(system_u:object_r:httpd_initrc_exec_t,s0)
/etc/rc\.d/init\.d/lighttpd -- gen_context(system_u:object_r:httpd_initrc_exec_t,s0)
@@ -3586,6 +3617,7 @@ index 7caefc3..3ef1de6 100644
+/var/lib/moodle(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)
+/var/lib/mod_security(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0)
+/var/lib/nginx(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0)
++/var/opt/rh/rh-nginx18/lib/nginx(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0)
+/var/lib/php/session(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
+/var/lib/php/wsdlcache(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
+
@@ -3626,6 +3658,7 @@ index 7caefc3..3ef1de6 100644
+/var/log/httpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
+/var/log/lighttpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
+/var/log/nginx(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
++/var/opt/rh/rh-nginx18/log(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
+/var/log/php-fpm(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
/var/log/roundcubemail(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
/var/log/suphp\.log.* -- gen_context(system_u:object_r:httpd_log_t,s0)
@@ -3663,6 +3696,7 @@ index 7caefc3..3ef1de6 100644
+/var/run/lighttpd(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
+/var/run/mod_.* gen_context(system_u:object_r:httpd_var_run_t,s0)
+/var/run/nginx.* gen_context(system_u:object_r:httpd_var_run_t,s0)
++/var/opt/rh/rh-nginx18/run/nginx(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
+/var/run/php-fpm(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
+/var/run/thttpd\.pid -- gen_context(system_u:object_r:httpd_var_run_t,s0)
+/var/run/wsgi.* -s gen_context(system_u:object_r:httpd_var_run_t,s0)
@@ -9692,6 +9726,195 @@ index f5c1a48..f7b4f1d 100644
tcpd_wrapped_domain(bitlbee_t, bitlbee_exec_t)
')
+
+diff --git a/blkmapd.fc b/blkmapd.fc
+new file mode 100644
+index 0000000..5e59fb4
+--- /dev/null
++++ b/blkmapd.fc
+@@ -0,0 +1,6 @@
++
++/etc/rc\.d/init\.d/blkmapd -- gen_context(system_u:object_r:blkmapd_initrc_exec_t,s0)
++
++/usr/sbin/blkmapd -- gen_context(system_u:object_r:blkmapd_exec_t,s0)
++
++/var/run/blkmapd\.pid -- gen_context(system_u:object_r:blkmapd_var_run_t,s0)
+diff --git a/blkmapd.if b/blkmapd.if
+new file mode 100644
+index 0000000..7666379
+--- /dev/null
++++ b/blkmapd.if
+@@ -0,0 +1,121 @@
++
++## <summary>The blkmapd daemon performs device discovery and mapping for pNFS block layout client.</summary>
++
++########################################
++## <summary>
++## Execute blkmapd_exec_t in the blkmapd domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`blkmapd_domtrans',`
++ gen_require(`
++ type blkmapd_t, blkmapd_exec_t;
++ ')
++
++ corecmd_search_bin($1)
++ domtrans_pattern($1, blkmapd_exec_t, blkmapd_t)
++')
++
++######################################
++## <summary>
++## Execute blkmapd in the caller domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`blkmapd_exec',`
++ gen_require(`
++ type blkmapd_exec_t;
++ ')
++
++ corecmd_search_bin($1)
++ can_exec($1, blkmapd_exec_t)
++')
++
++########################################
++## <summary>
++## Execute blkmapd server in the blkmapd domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`blkmapd_initrc_domtrans',`
++ gen_require(`
++ type blkmapd_initrc_exec_t;
++ ')
++
++ init_labeled_script_domtrans($1, blkmapd_initrc_exec_t)
++')
++########################################
++## <summary>
++## Read blkmapd PID files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`blkmapd_read_pid_files',`
++ gen_require(`
++ type blkmapd_var_run_t;
++ ')
++
++ files_search_pids($1)
++ read_files_pattern($1, blkmapd_var_run_t, blkmapd_var_run_t)
++')
++
++
++########################################
++## <summary>
++## All of the rules required to administrate
++## an blkmapd environment
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <param name="role">
++## <summary>
++## Role allowed access.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`blkmapd_admin',`
++ gen_require(`
++ type blkmapd_t;
++ type blkmapd_initrc_exec_t;
++ type blkmapd_var_run_t;
++ ')
++
++ allow $1 blkmapd_t:process { signal_perms };
++ ps_process_pattern($1, blkmapd_t)
++
++ tunable_policy(`deny_ptrace',`',`
++ allow $1 blkmapd_t:process ptrace;
++ ')
++
++ blkmapd_initrc_domtrans($1)
++ domain_system_change_exemption($1)
++ role_transition $2 blkmapd_initrc_exec_t system_r;
++ allow $2 system_r;
++
++ files_search_pids($1)
++ admin_pattern($1, blkmapd_var_run_t)
++ optional_policy(`
++ systemd_passwd_agent_exec($1)
++ systemd_read_fifo_file_passwd_run($1)
++ ')
++')
+diff --git a/blkmapd.te b/blkmapd.te
+new file mode 100644
+index 0000000..6cfb355
+--- /dev/null
++++ b/blkmapd.te
+@@ -0,0 +1,44 @@
++policy_module(blkmapd, 1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type blkmapd_t;
++type blkmapd_exec_t;
++init_daemon_domain(blkmapd_t, blkmapd_exec_t)
++
++type blkmapd_initrc_exec_t;
++init_script_file(blkmapd_initrc_exec_t)
++
++type blkmapd_var_run_t;
++files_pid_file(blkmapd_var_run_t)
++
++
++########################################
++#
++# blkmapd local policy
++#
++
++allow blkmapd_t self:capability sys_rawio;
++
++manage_files_pattern(blkmapd_t, blkmapd_var_run_t, blkmapd_var_run_t)
++files_pid_filetrans(blkmapd_t, blkmapd_var_run_t, file)
++
++kernel_read_system_state(blkmapd_t)
++
++dev_list_sysfs(blkmapd_t)
++
++fs_list_rpc(blkmapd_t)
++fs_rw_rpc_named_pipes(blkmapd_t)
++
++storage_raw_read_fixed_disk(blkmapd_t)
++storage_raw_read_removable_device(blkmapd_t)
++
++
++logging_send_syslog_msg(blkmapd_t)
++
++optional_policy(`
++ rpc_read_nfs_state_data(blkmapd_t)
++')
diff --git a/blueman.fc b/blueman.fc
index c295d2e..4f84e9c 100644
--- a/blueman.fc
@@ -35956,10 +36179,10 @@ index 6517fad..f183748 100644
+ allow $1 hypervkvp_unit_file_t:service all_service_perms;
')
diff --git a/hypervkvp.te b/hypervkvp.te
-index 4eb7041..2e4b08a 100644
+index 4eb7041..3ba4a51 100644
--- a/hypervkvp.te
+++ b/hypervkvp.te
-@@ -5,24 +5,135 @@ policy_module(hypervkvp, 1.0.0)
+@@ -5,24 +5,139 @@ policy_module(hypervkvp, 1.0.0)
# Declarations
#
@@ -35997,7 +36220,7 @@ index 4eb7041..2e4b08a 100644
#
-# Local policy
+# hyperv domain local policy
-+#
+ #
+
+allow hyperv_domain self:capability net_admin;
+allow hyperv_domain self:netlink_socket create_socket_perms;
@@ -36011,12 +36234,13 @@ index 4eb7041..2e4b08a 100644
+dev_read_sysfs(hyperv_domain)
+
+########################################
- #
++#
+# hypervkvp local policy
#
-allow hypervkvpd_t self:fifo_file rw_fifo_file_perms;
-allow hypervkvpd_t self:unix_stream_socket create_stream_socket_perms;
++allow hypervkvp_t self:capability sys_ptrace;
+allow hypervkvp_t self:process setfscreate;
+allow hypervkvp_t self:netlink_route_socket rw_netlink_socket_perms;
+
@@ -36032,6 +36256,8 @@ index 4eb7041..2e4b08a 100644
+kernel_read_network_state(hypervkvp_t)
+kernel_rw_net_sysctls(hypervkvp_t)
+
++corecmd_getattr_all_executables(hypervkvp_t)
++
+domain_read_all_domains_state(hypervkvp_t)
+
+seutil_exec_setfiles(hypervkvp_t)
@@ -36074,6 +36300,7 @@ index 4eb7041..2e4b08a 100644
+
+optional_policy(`
+ dbus_read_pid_files(hypervkvp_t)
++ dbus_system_bus_client(hypervkvp_t)
+')
+
+optional_policy(`
@@ -36976,10 +37203,10 @@ index 0000000..71bde7d
+
diff --git a/ipa.te b/ipa.te
new file mode 100644
-index 0000000..7d70dcb
+index 0000000..694c092
--- /dev/null
+++ b/ipa.te
-@@ -0,0 +1,113 @@
+@@ -0,0 +1,122 @@
+policy_module(ipa, 1.0.0)
+
+########################################
@@ -37047,7 +37274,10 @@ index 0000000..7d70dcb
+#
+
+
-+allow ipa_helper_t self:capability { dac_override chown };
++allow ipa_helper_t self:capability { net_admin dac_override chown };
++
++#kernel bug
++dontaudit ipa_helper_t self:capability2 block_suspend;
+
+allow ipa_helper_t self:process setfscreate;
+allow ipa_helper_t self:fifo_file rw_fifo_file_perms;
@@ -37065,6 +37295,8 @@ index 0000000..7d70dcb
+
+auth_use_nsswitch(ipa_helper_t)
+
++files_list_tmp(ipa_helper_t)
++
+ipa_manage_pid_files(ipa_helper_t)
+ipa_read_lib(ipa_helper_t)
+
@@ -37087,12 +37319,191 @@ index 0000000..7d70dcb
+')
+
+optional_policy(`
++ rpm_read_db(ipa_helper_t)
++')
++
++optional_policy(`
+ samba_read_config(ipa_helper_t)
+')
+
+optional_policy(`
+ sssd_manage_lib_files(ipa_helper_t)
+')
+diff --git a/ipmievd.fc b/ipmievd.fc
+new file mode 100644
+index 0000000..caf1fe5
+--- /dev/null
++++ b/ipmievd.fc
+@@ -0,0 +1,5 @@
++/usr/lib/systemd/system/ipmievd\.service -- gen_context(system_u:object_r:ipmievd_unit_file_t,s0)
++
++/usr/sbin/ipmievd -- gen_context(system_u:object_r:ipmievd_exec_t,s0)
++
++/var/run/ipmievd\.pid -- gen_context(system_u:object_r:ipmievd_var_run_t,s0)
+diff --git a/ipmievd.if b/ipmievd.if
+new file mode 100644
+index 0000000..e86db54
+--- /dev/null
++++ b/ipmievd.if
+@@ -0,0 +1,120 @@
++## <summary>IPMI event daemon for sending events to syslog.</summary>
++
++########################################
++## <summary>
++## Execute ipmievd_exec_t in the ipmievd domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`ipmievd_domtrans',`
++ gen_require(`
++ type ipmievd_t, ipmievd_exec_t;
++ ')
++
++ corecmd_search_bin($1)
++ domtrans_pattern($1, ipmievd_exec_t, ipmievd_t)
++')
++
++######################################
++## <summary>
++## Execute ipmievd in the caller domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`ipmievd_exec',`
++ gen_require(`
++ type ipmievd_exec_t;
++ ')
++
++ corecmd_search_bin($1)
++ can_exec($1, ipmievd_exec_t)
++')
++
++########################################
++## <summary>
++## Read ipmievd PID files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`ipmievd_read_pid_files',`
++ gen_require(`
++ type ipmievd_var_run_t;
++ ')
++
++ files_search_pids($1)
++ read_files_pattern($1, ipmievd_var_run_t, ipmievd_var_run_t)
++')
++
++########################################
++## <summary>
++## Execute ipmievd server in the ipmievd domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`ipmievd_systemctl',`
++ gen_require(`
++ type ipmievd_t;
++ type ipmievd_unit_file_t;
++ ')
++
++ systemd_exec_systemctl($1)
++ systemd_read_fifo_file_passwd_run($1)
++ allow $1 ipmievd_unit_file_t:file read_file_perms;
++ allow $1 ipmievd_unit_file_t:service manage_service_perms;
++
++ ps_process_pattern($1, ipmievd_t)
++')
++
++########################################
++## <summary>
++## All of the rules required to administrate
++## an ipmievd environment
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`ipmievd_admin',`
++ gen_require(`
++ type ipmievd_t;
++ type ipmievd_var_run_t;
++ type ipmievd_unit_file_t;
++ ')
++
++ allow $1 ipmievd_t:process { signal_perms };
++ ps_process_pattern($1, ipmievd_t)
++
++ tunable_policy(`deny_ptrace',`',`
++ allow $1 ipmievd_t:process ptrace;
++ ')
++
++ files_search_pids($1)
++ admin_pattern($1, ipmievd_var_run_t)
++
++ ipmievd_systemctl($1)
++ admin_pattern($1, ipmievd_unit_file_t)
++ allow $1 ipmievd_unit_file_t:service all_service_perms;
++
++ optional_policy(`
++ systemd_passwd_agent_exec($1)
++ systemd_read_fifo_file_passwd_run($1)
++ ')
++')
+diff --git a/ipmievd.te b/ipmievd.te
+new file mode 100644
+index 0000000..f8428ca
+--- /dev/null
++++ b/ipmievd.te
+@@ -0,0 +1,32 @@
++policy_module(ipmievd, 1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type ipmievd_t;
++type ipmievd_exec_t;
++init_daemon_domain(ipmievd_t, ipmievd_exec_t)
++
++type ipmievd_var_run_t;
++files_pid_file(ipmievd_var_run_t)
++
++type ipmievd_unit_file_t;
++systemd_unit_file(ipmievd_unit_file_t)
++
++########################################
++#
++# ipmievd local policy
++#
++
++allow ipmievd_t self:process { fork setpgid };
++allow ipmievd_t self:fifo_file rw_fifo_file_perms;
++
++manage_files_pattern(ipmievd_t, ipmievd_var_run_t, ipmievd_var_run_t)
++files_pid_filetrans(ipmievd_t, ipmievd_var_run_t, { file })
++
++dev_rw_ipmi_dev(ipmievd_t)
++
++logging_send_syslog_msg(ipmievd_t)
++
diff --git a/irc.fc b/irc.fc
index 48e7739..1bf0326 100644
--- a/irc.fc
@@ -37572,7 +37983,7 @@ index 1a35420..8101022 100644
logging_search_logs($1)
admin_pattern($1, iscsi_log_t)
diff --git a/iscsi.te b/iscsi.te
-index ca020fa..d4ed777 100644
+index ca020fa..989eba9 100644
--- a/iscsi.te
+++ b/iscsi.te
@@ -5,12 +5,15 @@ policy_module(iscsi, 1.9.0)
@@ -37620,12 +38031,12 @@ index ca020fa..d4ed777 100644
can_exec(iscsid_t, iscsid_exec_t)
++kernel_load_module(iscsid_t)
+kernel_request_load_module(iscsid_t)
kernel_read_network_state(iscsid_t)
kernel_read_system_state(iscsid_t)
-kernel_setsched(iscsid_t)
+kernel_dontaudit_setsched(iscsid_t)
-+kernel_request_load_module(iscsid_t)
-corenet_all_recvfrom_unlabeled(iscsid_t)
corenet_all_recvfrom_netlabel(iscsid_t)
@@ -47145,10 +47556,10 @@ index 0000000..86467cf
+')
diff --git a/mirrormanager.te b/mirrormanager.te
new file mode 100644
-index 0000000..841b732
+index 0000000..f59af1b
--- /dev/null
+++ b/mirrormanager.te
-@@ -0,0 +1,43 @@
+@@ -0,0 +1,46 @@
+policy_module(mirrormanager, 1.0.0)
+
+########################################
@@ -47158,7 +47569,7 @@ index 0000000..841b732
+
+type mirrormanager_t;
+type mirrormanager_exec_t;
-+cron_system_entry(mirrormanager_t, mirrormanager_exec_t)
++application_domain(mirrormanager_t, mirrormanager_exec_t)
+
+type mirrormanager_log_t;
+logging_log_file(mirrormanager_log_t)
@@ -47192,6 +47603,9 @@ index 0000000..841b732
+manage_lnk_files_pattern(mirrormanager_t, mirrormanager_var_run_t, mirrormanager_var_run_t)
+files_pid_filetrans(mirrormanager_t, mirrormanager_var_run_t, { dir })
+
++optional_policy(`
++ cron_system_entry(mirrormanager_t, mirrormanager_exec_t)
++')
diff --git a/mock.fc b/mock.fc
new file mode 100644
index 0000000..8d0e473
@@ -53015,7 +53429,7 @@ index b744fe3..cb0e2af 100644
+ admin_pattern($1, munin_content_t)
')
diff --git a/munin.te b/munin.te
-index b708708..dd6e04b 100644
+index b708708..f4c0e61 100644
--- a/munin.te
+++ b/munin.te
@@ -44,41 +44,40 @@ files_tmpfs_file(services_munin_plugin_tmpfs_t)
@@ -53122,7 +53536,7 @@ index b708708..dd6e04b 100644
')
optional_policy(`
-@@ -246,21 +234,23 @@ allow disk_munin_plugin_t self:tcp_socket create_stream_socket_perms;
+@@ -246,21 +234,25 @@ allow disk_munin_plugin_t self:tcp_socket create_stream_socket_perms;
rw_files_pattern(disk_munin_plugin_t, munin_var_lib_t, munin_var_lib_t)
@@ -53141,16 +53555,18 @@ index b708708..dd6e04b 100644
-
-files_read_etc_runtime_files(disk_munin_plugin_t)
+dev_read_all_blk_files(disk_munin_plugin_t)
++dev_raw_memory_reader(disk_munin_plugin_t)
fs_getattr_all_fs(disk_munin_plugin_t)
fs_getattr_all_dirs(disk_munin_plugin_t)
-storage_getattr_fixed_disk_dev(disk_munin_plugin_t)
+storage_raw_read_fixed_disk(disk_munin_plugin_t)
++storage_read_scsi_generic(disk_munin_plugin_t)
sysnet_read_config(disk_munin_plugin_t)
-@@ -272,6 +262,10 @@ optional_policy(`
+@@ -272,6 +264,10 @@ optional_policy(`
fstools_exec(disk_munin_plugin_t)
')
@@ -53161,7 +53577,7 @@ index b708708..dd6e04b 100644
####################################
#
# Mail local policy
-@@ -279,27 +273,39 @@ optional_policy(`
+@@ -279,27 +275,39 @@ optional_policy(`
allow mail_munin_plugin_t self:capability dac_override;
@@ -53205,7 +53621,7 @@ index b708708..dd6e04b 100644
')
optional_policy(`
-@@ -339,7 +345,7 @@ dev_read_rand(services_munin_plugin_t)
+@@ -339,7 +347,7 @@ dev_read_rand(services_munin_plugin_t)
sysnet_read_config(services_munin_plugin_t)
optional_policy(`
@@ -53214,7 +53630,7 @@ index b708708..dd6e04b 100644
')
optional_policy(`
-@@ -348,6 +354,10 @@ optional_policy(`
+@@ -348,6 +356,10 @@ optional_policy(`
')
optional_policy(`
@@ -53225,7 +53641,7 @@ index b708708..dd6e04b 100644
lpd_exec_lpr(services_munin_plugin_t)
')
-@@ -361,7 +371,11 @@ optional_policy(`
+@@ -361,7 +373,11 @@ optional_policy(`
')
optional_policy(`
@@ -53238,7 +53654,7 @@ index b708708..dd6e04b 100644
')
optional_policy(`
-@@ -393,6 +407,7 @@ read_files_pattern(system_munin_plugin_t, munin_log_t, munin_log_t)
+@@ -393,6 +409,7 @@ read_files_pattern(system_munin_plugin_t, munin_log_t, munin_log_t)
kernel_read_network_state(system_munin_plugin_t)
kernel_read_all_sysctls(system_munin_plugin_t)
@@ -53246,7 +53662,7 @@ index b708708..dd6e04b 100644
dev_read_sysfs(system_munin_plugin_t)
dev_read_urand(system_munin_plugin_t)
-@@ -421,3 +436,33 @@ optional_policy(`
+@@ -421,3 +438,33 @@ optional_policy(`
optional_policy(`
unconfined_domain(unconfined_munin_plugin_t)
')
@@ -61436,10 +61852,19 @@ index 3b6920e..3e9b17f 100644
userdom_dontaudit_search_user_home_dirs(openct_t)
diff --git a/openhpi.te b/openhpi.te
-index 8de6191..af7f2a8 100644
+index 8de6191..1a01e99 100644
--- a/openhpi.te
+++ b/openhpi.te
-@@ -50,8 +50,10 @@ corenet_tcp_sendrecv_openhpid_port(openhpid_t)
+@@ -38,6 +38,8 @@ files_var_lib_filetrans(openhpid_t, openhpid_var_lib_t, dir)
+ manage_files_pattern(openhpid_t, openhpid_var_run_t, openhpid_var_run_t)
+ files_pid_filetrans(openhpid_t, openhpid_var_run_t, file)
+
++kernel_read_system_state(openhpid_t)
++
+ corenet_all_recvfrom_unlabeled(openhpid_t)
+ corenet_all_recvfrom_netlabel(openhpid_t)
+ corenet_tcp_sendrecv_generic_if(openhpid_t)
+@@ -50,8 +52,10 @@ corenet_tcp_sendrecv_openhpid_port(openhpid_t)
dev_read_urand(openhpid_t)
@@ -63990,7 +64415,7 @@ index 9b15730..cb00f20 100644
+ ')
')
diff --git a/openvswitch.te b/openvswitch.te
-index 44dbc99..ac08330 100644
+index 44dbc99..eb8d420 100644
--- a/openvswitch.te
+++ b/openvswitch.te
@@ -9,11 +9,8 @@ type openvswitch_t;
@@ -64055,12 +64480,13 @@ index 44dbc99..ac08330 100644
manage_lnk_files_pattern(openvswitch_t, openvswitch_log_t, openvswitch_log_t)
logging_log_filetrans(openvswitch_t, openvswitch_log_t, { dir file lnk_file })
-@@ -65,33 +68,45 @@ manage_sock_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_
+@@ -65,33 +68,46 @@ manage_sock_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_
manage_lnk_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
files_pid_filetrans(openvswitch_t, openvswitch_var_run_t, { dir file lnk_file })
-can_exec(openvswitch_t, openvswitch_exec_t)
-
++kernel_load_module(openvswitch_t)
kernel_read_network_state(openvswitch_t)
kernel_read_system_state(openvswitch_t)
+kernel_request_load_module(openvswitch_t)
@@ -85125,7 +85551,7 @@ index 6dbc905..4b17c93 100644
- admin_pattern($1, rhsmcertd_lock_t)
')
diff --git a/rhsmcertd.te b/rhsmcertd.te
-index d32e1a2..e030327 100644
+index d32e1a2..2078892 100644
--- a/rhsmcertd.te
+++ b/rhsmcertd.te
@@ -18,6 +18,9 @@ logging_log_file(rhsmcertd_log_t)
@@ -85164,7 +85590,7 @@ index d32e1a2..e030327 100644
manage_dirs_pattern(rhsmcertd_t, rhsmcertd_var_lib_t, rhsmcertd_var_lib_t)
manage_files_pattern(rhsmcertd_t, rhsmcertd_var_lib_t, rhsmcertd_var_lib_t)
-@@ -50,25 +56,78 @@ manage_files_pattern(rhsmcertd_t, rhsmcertd_var_run_t, rhsmcertd_var_run_t)
+@@ -50,25 +56,83 @@ manage_files_pattern(rhsmcertd_t, rhsmcertd_var_run_t, rhsmcertd_var_run_t)
files_pid_filetrans(rhsmcertd_t, rhsmcertd_var_run_t, { file dir })
kernel_read_network_state(rhsmcertd_t)
@@ -85211,8 +85637,12 @@ index d32e1a2..e030327 100644
sysnet_dns_name_resolve(rhsmcertd_t)
- optional_policy(`
-- rpm_read_db(rhsmcertd_t)
++ifdef(`hide_broken_symptoms',`
++ exec_files_pattern(rhsmcertd_t, rhsmcertd_tmp_t, rhsmcertd_tmp_t)
++ exec_files_pattern(rhsmcertd_t, rhsmcertd_var_run_t, rhsmcertd_var_run_t)
++')
++
++optional_policy(`
+ dbus_system_domain(rhsmcertd_t,rhsmcertd_exec_t)
+')
+
@@ -85245,7 +85675,8 @@ index d32e1a2..e030327 100644
+ virt_signull(rhsmcertd_t)
+')
+
-+optional_policy(`
+ optional_policy(`
+- rpm_read_db(rhsmcertd_t)
+ unconfined_signull(rhsmcertd_t)
')
diff --git a/ricci.if b/ricci.if
@@ -91902,10 +92333,10 @@ index 0000000..b7db254
+# Empty
diff --git a/sandbox.if b/sandbox.if
new file mode 100644
-index 0000000..1e7c447
+index 0000000..b21026b
--- /dev/null
+++ b/sandbox.if
-@@ -0,0 +1,80 @@
+@@ -0,0 +1,92 @@
+
+## <summary>policy for sandbox</summary>
+
@@ -91983,8 +92414,20 @@ index 0000000..1e7c447
+
+ application_type($1_t)
+
++ # this is to satisfy the assertion:
++ dev_raw_memory_reader($1_t)
++ dev_raw_memory_writer($1_t)
++
+ mls_rangetrans_target($1_t)
+ mcs_constrained($1_t)
++
++ # this is to satisfy the assertion:
++ storage_rw_inherited_fixed_disk_dev($1_t)
++ storage_rw_inherited_scsi_generic($1_t)
++
++ # this is to satisfy the assertion:
++ auth_reader_shadow($1_t)
++ auth_writer_shadow($1_t)
+')
diff --git a/sandbox.te b/sandbox.te
new file mode 100644
@@ -92066,7 +92509,7 @@ index 0000000..6caef63
+/usr/share/sandbox/start -- gen_context(system_u:object_r:sandbox_exec_t,s0)
diff --git a/sandboxX.if b/sandboxX.if
new file mode 100644
-index 0000000..03bdcef
+index 0000000..5b65b7c
--- /dev/null
+++ b/sandboxX.if
@@ -0,0 +1,395 @@
@@ -92157,7 +92600,7 @@ index 0000000..03bdcef
+ attribute sandbox_type;
+ ')
+
-+ type $1_t, sandbox_x_domain, sandbox_type;
++ type $1_t, sandbox_x_domain, sandbox_type, sandbox_web_type;
+ application_type($1_t)
+ mcs_constrained($1_t)
+
@@ -92467,10 +92910,10 @@ index 0000000..03bdcef
+')
diff --git a/sandboxX.te b/sandboxX.te
new file mode 100644
-index 0000000..a3319b0
+index 0000000..7a8e744
--- /dev/null
+++ b/sandboxX.te
-@@ -0,0 +1,501 @@
+@@ -0,0 +1,505 @@
+policy_module(sandboxX,1.0.0)
+
+dbus_stub()
@@ -92764,6 +93207,10 @@ index 0000000..a3319b0
+files_search_home(sandbox_x_t)
+userdom_use_user_ptys(sandbox_x_t)
+
++#1103622
++corenet_tcp_connect_xserver_port(sandbox_x_t)
++xserver_stream_connect(sandbox_x_t)
++
+########################################
+#
+# sandbox_x_client_t local policy
@@ -108693,7 +109140,7 @@ index facdee8..a6dcaaa 100644
+ typeattribute $1 sandbox_caps_domain;
')
diff --git a/virt.te b/virt.te
-index f03dcf5..36afdd2 100644
+index f03dcf5..d15b4d3 100644
--- a/virt.te
+++ b/virt.te
@@ -1,150 +1,241 @@
@@ -110193,7 +110640,7 @@ index f03dcf5..36afdd2 100644
selinux_get_enforce_mode(virtd_lxc_t)
selinux_get_fs_mount(virtd_lxc_t)
selinux_validate_context(virtd_lxc_t)
-@@ -974,194 +1171,325 @@ selinux_compute_create_context(virtd_lxc_t)
+@@ -974,194 +1171,326 @@ selinux_compute_create_context(virtd_lxc_t)
selinux_compute_relabel_context(virtd_lxc_t)
selinux_compute_user_contexts(virtd_lxc_t)
@@ -110484,6 +110931,7 @@ index f03dcf5..36afdd2 100644
+dontaudit svirt_lxc_net_t self:capability2 block_suspend ;
+allow svirt_lxc_net_t self:process { execstack execmem };
+manage_chr_files_pattern(svirt_lxc_net_t, svirt_sandbox_file_t, svirt_sandbox_file_t)
++kernel_load_module(svirt_lxc_net_t)
+
+tunable_policy(`virt_sandbox_use_sys_admin',`
+ allow svirt_lxc_net_t self:capability sys_admin;
@@ -110660,7 +111108,7 @@ index f03dcf5..36afdd2 100644
allow virt_qmf_t self:tcp_socket create_stream_socket_perms;
allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms;
-@@ -1174,12 +1502,12 @@ dev_read_sysfs(virt_qmf_t)
+@@ -1174,12 +1503,12 @@ dev_read_sysfs(virt_qmf_t)
dev_read_rand(virt_qmf_t)
dev_read_urand(virt_qmf_t)
@@ -110675,7 +111123,7 @@ index f03dcf5..36afdd2 100644
sysnet_read_config(virt_qmf_t)
optional_policy(`
-@@ -1192,9 +1520,8 @@ optional_policy(`
+@@ -1192,9 +1521,8 @@ optional_policy(`
########################################
#
@@ -110686,7 +111134,7 @@ index f03dcf5..36afdd2 100644
allow virt_bridgehelper_t self:process { setcap getcap };
allow virt_bridgehelper_t self:capability { setpcap setgid setuid net_admin };
allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
-@@ -1207,5 +1534,242 @@ kernel_read_network_state(virt_bridgehelper_t)
+@@ -1207,5 +1535,242 @@ kernel_read_network_state(virt_bridgehelper_t)
corenet_rw_tun_tap_dev(virt_bridgehelper_t)
@@ -111205,7 +111653,7 @@ index 20a1fb2..470ea95 100644
allow $2 { vmware_tmp_t vmware_file_t }:dir { manage_dir_perms relabel_dir_perms };
allow $2 { vmware_conf_t vmware_file_t vmware_tmp_t vmware_tmpfs_t }:file { manage_file_perms relabel_file_perms };
diff --git a/vmware.te b/vmware.te
-index 4ad1894..d72037f 100644
+index 4ad1894..840409e 100644
--- a/vmware.te
+++ b/vmware.te
@@ -65,7 +65,8 @@ ifdef(`enable_mcs',`
@@ -111218,7 +111666,11 @@ index 4ad1894..d72037f 100644
dontaudit vmware_host_t self:capability sys_tty_config;
allow vmware_host_t self:process { execstack execmem signal_perms };
allow vmware_host_t self:fifo_file rw_fifo_file_perms;
-@@ -94,8 +95,8 @@ can_exec(vmware_host_t, vmware_host_exec_t)
+@@ -91,11 +92,12 @@ logging_log_filetrans(vmware_host_t, vmware_log_t, file)
+
+ can_exec(vmware_host_t, vmware_host_exec_t)
+
++kernel_load_module(vmware_host_t)
kernel_read_kernel_sysctls(vmware_host_t)
kernel_read_system_state(vmware_host_t)
kernel_read_network_state(vmware_host_t)
@@ -111228,7 +111680,7 @@ index 4ad1894..d72037f 100644
corenet_all_recvfrom_netlabel(vmware_host_t)
corenet_tcp_sendrecv_generic_if(vmware_host_t)
corenet_udp_sendrecv_generic_if(vmware_host_t)
-@@ -115,14 +116,13 @@ dev_getattr_all_blk_files(vmware_host_t)
+@@ -115,14 +117,13 @@ dev_getattr_all_blk_files(vmware_host_t)
dev_read_sysfs(vmware_host_t)
dev_read_urand(vmware_host_t)
dev_rw_vmware(vmware_host_t)
@@ -111244,7 +111696,7 @@ index 4ad1894..d72037f 100644
fs_getattr_all_fs(vmware_host_t)
fs_search_auto_mountpoints(vmware_host_t)
-@@ -138,23 +138,27 @@ libs_exec_ld_so(vmware_host_t)
+@@ -138,23 +139,27 @@ libs_exec_ld_so(vmware_host_t)
logging_send_syslog_msg(vmware_host_t)
@@ -111276,7 +111728,7 @@ index 4ad1894..d72037f 100644
optional_policy(`
samba_read_config(vmware_host_t)
-@@ -244,9 +248,7 @@ dev_search_sysfs(vmware_t)
+@@ -244,9 +249,7 @@ dev_search_sysfs(vmware_t)
domain_use_interactive_fds(vmware_t)
@@ -111286,7 +111738,7 @@ index 4ad1894..d72037f 100644
files_list_home(vmware_t)
fs_getattr_all_fs(vmware_t)
-@@ -258,9 +260,8 @@ storage_raw_write_removable_device(vmware_t)
+@@ -258,9 +261,8 @@ storage_raw_write_removable_device(vmware_t)
libs_exec_ld_so(vmware_t)
libs_read_lib_files(vmware_t)
diff --git a/selinux-policy.spec b/selinux-policy.spec
index d5babb9..59f6779 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 142%{?dist}
+Release: 143%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -647,6 +647,35 @@ exit 0
%endif
%changelog
+* Fri Aug 21 2015 Miroslav Grepl <mgrepl@redhat.com> 3.13.1-143
+- Add ipmievd policy creaed by vmojzis@redhat.com
+- Call kernel_load_module(vmware_host_t) to satisfy neverallow assertion for sys_moudle in MLS where unconfined is disabled.
+- Allow NetworkManager to write audit log messages
+- Add new policy for ipmievd (ipmitool).
+- mirrormanager needs to be application domain and cron_system_entry needs to be called in optional block.
+- Allow sandbox domain to be also /dev/mem writer
+- Fix neverallow assertion for sys_module capability for openvswitch.
+- kernel_load_module() needs to be called out of boolean for svirt_lxc_net_t.
+- Fix neverallow assertion for sys_module capability.
+- Add more attributes for sandbox domains to avoid neverallow assertion issues.
+- Add neverallow asserition fixes related to storage.
+- Allow exec pidof under hypervkvp domain. Allow hypervkvp daemon create connection to the system DBUS
+- Allow openhpid_t to read system state.
+- Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type.
+- Added labels for files provided by rh-nginx18 collection
+- Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db.
+- Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution.
+- Update files_manage_all_files to contain auth_reader_shadow and auth_writer_shadow tosatisfy neverallow assertions.
+- Update files_relabel_all_files() interface to contain auth_relabelto_shadow() interface to satisfy neverallow assertion.
+- seunshare domains needs to have set_curr_context attribute to resolve neverallow assertion issues.
+- Add dev_raw_memory_writer() interface
+- Add auth_reader_shadow() and auth_writer_shadow() interfaces
+- Add dev_raw_memory_reader() interface.
+- Add storage_rw_inherited_scsi_generic() interface.
+- Update files_relabel_non_auth_files() to contain seutil_relabelto_bin_policy() to make neverallow assertion working.
+- Update kernel_read_all_proc() interface to contain can_dump_kernel and can_receive_kernel_messages attributes to fix neverallow violated issue for proc_kcore_t and proc_kmsg_t.
+- Update storage_rw_inherited_fixed_disk_dev() interface to use proper attributes to fix neverallow violated issues caused by neverallow check during build process.
+
* Tue Aug 18 2015 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-142
- Allow samba_net_t to manage samba_var_t sock files.
- Allow httpd daemon to manage httpd_var_lib_t lnk_files.