diff --git a/Changelog b/Changelog
index 5aea1d9..cf13e5b 100644
--- a/Changelog
+++ b/Changelog
@@ -17,7 +17,10 @@
 - Patches from Dan Walsh:
 	Tue, 24 Oct 2006
 - Added modules:
+	aide (Matt Anderson)
+	ccs (Dan Walsh)
 	iscsi (Dan Walsh)
+	ricci (Dan Walsh)
 
 * Wed Oct 18 2006 Chris PeBenito <selinux@tresys.com> - 20061018
 - Patch from Russell Coker Thu, 5 Oct 2006
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
index 2dd29c9..24921db 100644
--- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in
@@ -1,5 +1,5 @@
 
-policy_module(corenetwork,1.2.1)
+policy_module(corenetwork,1.2.2)
 
 ########################################
 #
@@ -66,6 +66,7 @@ network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0)
 type biff_port_t, port_type, reserved_port_type; dnl network_port(biff) # no defined portcon in current strict
 network_port(clamd, tcp,3310,s0)
 network_port(clockspeed, udp,4041,s0)
+network_port(cluster, tcp,5149,s0, udp,5149,s0, tcp,40040,s0, tcp,50006,s0, udp,50006,s0, tcp,50007,s0, udp,50007,s0, tcp,50008,s0, udp,50008,s0)
 network_port(comsat, udp,512,s0)
 network_port(cvs, tcp,2401,s0, udp,2401,s0)
 network_port(dcc, udp,6276,s0, udp,6277,s0)
@@ -106,6 +107,7 @@ network_port(mail, tcp,2000,s0)
 network_port(monopd, tcp,1234,s0)
 network_port(mysqld, tcp,3306,s0)
 network_port(nessus, tcp,1241,s0)
+network_port(netsupport, tcp,5405,s0, udp,5405,s0)
 network_port(nmbd, udp,137,s0, udp,138,s0, udp,139,s0)
 network_port(ntp, udp,123,s0)
 network_port(openvpn, udp,1194,s0)
@@ -122,6 +124,8 @@ network_port(pyzor, udp,24441,s0)
 network_port(radacct, udp,1646,s0, udp,1813,s0)
 network_port(radius, udp,1645,s0, udp,1812,s0)
 network_port(razor, tcp,2703,s0)
+network_port(ricci, tcp,11111,s0, udp,11111,s0)
+network_port(ricci_modcluster, tcp,16851,s0, udp,16851,s0)
 network_port(rlogind, tcp,513,s0)
 network_port(rndc, tcp,953,s0)
 network_port(router, udp,520,s0)
diff --git a/policy/modules/services/aide.fc b/policy/modules/services/aide.fc
new file mode 100644
index 0000000..be41434
--- /dev/null
+++ b/policy/modules/services/aide.fc
@@ -0,0 +1,5 @@
+/usr/sbin/aide		--	gen_context(system_u:object_r:aide_exec_t,mls_systemhigh)
+
+/var/lib/aide(/.*)		gen_context(system_u:object_r:aide_db_t,mls_systemhigh)
+
+/var/log/aide.log	--	gen_context(system_u:object_r:aide_log_t,mls_systemhigh)
diff --git a/policy/modules/services/aide.if b/policy/modules/services/aide.if
new file mode 100644
index 0000000..7723362
--- /dev/null
+++ b/policy/modules/services/aide.if
@@ -0,0 +1,55 @@
+## <summary>Aide filesystem integrity checker</summary>
+
+########################################
+## <summary>
+##      Execute aide in the aide domain
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`aide_domtrans',`
+        gen_require(`
+                type aide_t, aide_exec_t;
+        ')
+
+	corecmd_search_sbin($1)
+        domain_auto_trans($1,aide_exec_t,aide_t)
+
+	allow aide_t $1:fd use;
+	allow aide_t $1:fifo_file rw_file_perms;
+	allow aide_t $1:process sigchld;
+')
+
+
+########################################
+## <summary>
+##	Execute aide programs in the AIDE domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to allow the AIDE domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the terminal allow the AIDE domain to use.
+##	</summary>
+## </param>
+#
+interface(`aide_run',`
+	gen_require(`
+		type aide_t;
+	')
+
+	aide_domtrans($1)
+	role $2 types aide_t;
+	allow aide_t $3:chr_file rw_file_perms;
+')
diff --git a/policy/modules/services/aide.te b/policy/modules/services/aide.te
new file mode 100644
index 0000000..620c674
--- /dev/null
+++ b/policy/modules/services/aide.te
@@ -0,0 +1,45 @@
+
+policy_module(aide,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type aide_t;
+type aide_exec_t;
+domain_type(aide_t)
+domain_entry_file(aide_t,aide_exec_t)
+
+# log files
+type aide_log_t;
+logging_log_file(aide_log_t)
+
+# aide database
+type aide_db_t;
+files_type(aide_db_t)
+
+########################################
+#
+# aide local policy
+#
+
+allow aide_t self:capability { dac_override fowner };
+# audit
+allow aide_t self:capability audit_write;
+allow aide_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
+
+# database actions
+allow aide_t aide_db_t:dir rw_dir_perms;
+allow aide_t aide_db_t:file manage_file_perms;
+
+# logs
+logging_log_filetrans(aide_t,aide_log_t,file)
+allow aide_t aide_log_t:file manage_file_perms;
+
+files_read_all_files(aide_t)
+
+libs_use_ld_so(aide_t)
+libs_use_shared_libs(aide_t)
+
+seutil_use_newrole_fds(aide_t)
diff --git a/policy/modules/services/ccs.fc b/policy/modules/services/ccs.fc
new file mode 100644
index 0000000..12ac6d7
--- /dev/null
+++ b/policy/modules/services/ccs.fc
@@ -0,0 +1,8 @@
+/etc/cluster(/.*)?		gen_context(system_u:object_r:cluster_conf_t,s0)
+
+/sbin/ccsd		--	gen_context(system_u:object_r:ccs_exec_t,s0)
+
+/usr/sbin/aisexec 	--	gen_context(system_u:object_r:ccs_exec_t,s0)
+
+/var/run/cluster(/.*)?		gen_context(system_u:object_r:ccs_var_run_t,s0)
+/var/run/cman_.*	-s	gen_context(system_u:object_r:ccs_var_run_t,s0)
diff --git a/policy/modules/services/ccs.if b/policy/modules/services/ccs.if
new file mode 100644
index 0000000..366e5eb
--- /dev/null
+++ b/policy/modules/services/ccs.if
@@ -0,0 +1,81 @@
+## <summary>Cluster Configuration System</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run ccs.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ccs_domtrans',`
+	gen_require(`
+		type ccs_t, ccs_exec_t;
+	')
+
+	domain_auto_trans($1,ccs_exec_t,ccs_t)
+	allow ccs_t $1:fd use;
+	allow ccs_t $1:fifo_file rw_file_perms;
+	allow ccs_t $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Connect to ccs over an unix stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ccs_stream_connect',`
+	gen_require(`
+		type ccs_t, ccs_var_run_t;
+	')
+
+	files_search_pids($1)
+	allow $1 ccs_var_run_t:dir list_dir_perms;
+	allow $1 ccs_var_run_t:sock_file write;
+	allow $1 ccs_t:unix_stream_socket connectto;
+')
+
+########################################
+## <summary>
+##	Read cluster configuration files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ccs_read_config',`
+	gen_require(`
+		type cluster_conf_t;
+	')
+
+	allow $1 cluster_conf_t:dir search_dir_perms;
+	allow $1 cluster_conf_t:file { getattr read };
+')
+
+########################################
+## <summary>
+##	Manage cluster configuration files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ccs_manage_config',`
+	gen_require(`
+		type cluster_conf_t;
+	')
+
+	allow $1 cluster_conf_t:dir manage_dir_perms;
+	allow $1 cluster_conf_t:file manage_file_perms;
+')
diff --git a/policy/modules/services/ccs.te b/policy/modules/services/ccs.te
new file mode 100644
index 0000000..97939d7
--- /dev/null
+++ b/policy/modules/services/ccs.te
@@ -0,0 +1,98 @@
+
+policy_module(ccs,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type ccs_t;
+type ccs_exec_t;
+init_daemon_domain(ccs_t, ccs_exec_t)
+
+# pid files
+type cluster_conf_t;
+files_type(cluster_conf_t)
+
+# log files
+type ccs_var_log_t;
+logging_log_file(ccs_var_log_t)
+
+# pid files
+type ccs_var_run_t;
+files_pid_file(ccs_var_run_t)
+
+########################################
+#
+# ccs local policy
+#
+
+allow ccs_t self:capability { ipc_lock sys_nice sys_resource };
+allow ccs_t self:process { signal setrlimit setsched };
+allow ccs_t self:fifo_file { read write };
+allow ccs_t self:unix_stream_socket { connectto create_stream_socket_perms };
+allow ccs_t self:unix_dgram_socket create_socket_perms;
+allow ccs_t self:netlink_route_socket r_netlink_socket_perms;
+allow ccs_t self:tcp_socket create_stream_socket_perms;
+allow ccs_t self:udp_socket { create_socket_perms listen recv_msg send_msg };
+# cjp: this needs to be fixed to be specific
+allow ccs_t self:socket create_socket_perms;
+
+allow ccs_t cluster_conf_t:dir rw_dir_perms;
+allow ccs_t cluster_conf_t:file manage_file_perms;
+
+# log files
+allow ccs_t ccs_var_log_t:file create_file_perms;
+allow ccs_t ccs_var_log_t:sock_file create_file_perms;
+allow ccs_t ccs_var_log_t:dir { rw_dir_perms setattr };
+logging_log_filetrans(ccs_t,ccs_var_log_t,{ sock_file file dir })
+
+# pid file
+allow ccs_t ccs_var_run_t:file manage_file_perms;
+allow ccs_t ccs_var_run_t:sock_file manage_file_perms;
+allow ccs_t ccs_var_run_t:dir manage_dir_perms;
+files_pid_filetrans(ccs_t,ccs_var_run_t, { dir file sock_file })
+
+kernel_read_kernel_sysctls(ccs_t)
+
+corecmd_list_sbin(ccs_t)
+corecmd_exec_bin(ccs_t)
+
+corenet_non_ipsec_sendrecv(ccs_t)
+corenet_tcp_sendrecv_all_if(ccs_t)
+corenet_udp_sendrecv_all_if(ccs_t)
+corenet_tcp_sendrecv_all_nodes(ccs_t)
+corenet_udp_sendrecv_all_nodes(ccs_t)
+corenet_tcp_sendrecv_all_ports(ccs_t)
+corenet_udp_sendrecv_all_ports(ccs_t)
+corenet_tcp_bind_all_nodes(ccs_t)
+corenet_udp_bind_all_nodes(ccs_t)
+corenet_tcp_bind_cluster_port(ccs_t)
+corenet_udp_bind_cluster_port(ccs_t)
+corenet_udp_bind_netsupport_port(ccs_t)
+
+dev_read_urand(ccs_t)
+
+files_read_etc_files(ccs_t)
+files_read_etc_runtime_files(ccs_t)
+
+init_dontaudit_use_fds(ccs_t)
+init_rw_script_tmp_files(ccs_t)
+
+libs_use_ld_so(ccs_t)
+libs_use_shared_libs(ccs_t)
+
+logging_send_syslog_msg(ccs_t)
+
+miscfiles_read_localization(ccs_t)
+
+sysnet_dns_name_resolve(ccs_t)
+
+ifdef(`targeted_policy',`
+	term_dontaudit_use_generic_ptys(ccs_t)
+	term_dontaudit_use_unallocated_ttys(ccs_t)
+')
+
+optional_policy(`
+	unconfined_use_fds(ccs_t)
+')
diff --git a/policy/modules/services/ricci.fc b/policy/modules/services/ricci.fc
new file mode 100644
index 0000000..3828004
--- /dev/null
+++ b/policy/modules/services/ricci.fc
@@ -0,0 +1,16 @@
+/usr/libexec/modcluster		--	gen_context(system_u:object_r:ricci_modcluster_exec_t,s0)
+/usr/libexec/ricci-modlog	--	gen_context(system_u:object_r:ricci_modlog_exec_t,s0)
+/usr/libexec/ricci-modrpm	--	gen_context(system_u:object_r:ricci_modrpm_exec_t,s0)
+/usr/libexec/ricci-modservice	--	gen_context(system_u:object_r:ricci_modservice_exec_t,s0)
+/usr/libexec/ricci-modstorage	--	gen_context(system_u:object_r:ricci_modstorage_exec_t,s0)
+
+/usr/sbin/modclusterd		--	gen_context(system_u:object_r:ricci_modclusterd_exec_t,s0)
+/usr/sbin/ricci			--	gen_context(system_u:object_r:ricci_exec_t,s0)
+
+/var/lib/ricci(/.*)?			gen_context(system_u:object_r:ricci_var_lib_t,s0)
+
+/var/log/clumond.log 		--	gen_context(system_u:object_r:ricci_modcluster_var_log_t,s0)
+
+/var/run/clumond.sock 		-s	gen_context(system_u:object_r:ricci_modcluster_var_run_t,s0)
+/var/run/modclusterd.pid  	--	gen_context(system_u:object_r:ricci_modcluster_var_run_t,s0)
+/var/run/ricci.pid  		--	gen_context(system_u:object_r:ricci_var_run_t,s0)
diff --git a/policy/modules/services/ricci.if b/policy/modules/services/ricci.if
new file mode 100644
index 0000000..6355d50
--- /dev/null
+++ b/policy/modules/services/ricci.if
@@ -0,0 +1,185 @@
+## <summary>Ricci cluster management agent</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run ricci.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ricci_domtrans',`
+	gen_require(`
+		type ricci_t, ricci_exec_t;
+	')
+
+	domain_auto_trans($1,ricci_exec_t,ricci_t)
+	allow ricci_t $1:fd use;
+	allow ricci_t $1:fifo_file rw_file_perms;
+	allow ricci_t $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Execute a domain transition to run ricci_modcluster.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ricci_domtrans_modcluster',`
+	gen_require(`
+		type ricci_modcluster_t, ricci_modcluster_exec_t;
+	')
+
+	domain_auto_trans($1,ricci_modcluster_exec_t,ricci_modcluster_t)
+	allow ricci_modcluster_t $1:fd use;
+	allow ricci_modcluster_t $1:fifo_file rw_file_perms;
+	allow ricci_modcluster_t $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to use
+##	ricci_modcluster file descriptors.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of process not to audit.
+##	</summary>
+## </param>
+#
+interface(`ricci_dontaudit_use_modcluster_fds',`
+	gen_require(`
+		type ricci_modcluster_t;
+	')
+
+	dontaudit $1 ricci_modcluster_t:fd use;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read write
+##	ricci_modcluster unamed pipes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of process not to audit.
+##	</summary>
+## </param>
+#
+interface(`ricci_dontaudit_rw_modcluster_pipes',`
+	gen_require(`
+		type ricci_modcluster_t;
+	')
+
+	dontaudit $1 ricci_modcluster_t:fifo_file  { read write };
+')
+
+########################################
+## <summary>
+##	Connect to ricci_modclusterd over an unix stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ricci_stream_connect_modclusterd',`
+	gen_require(`
+		type ricci_modclusterd_t, ricci_modcluster_var_run_t;
+	')
+
+	files_search_pids($1)
+	allow $1 ricci_modcluster_var_run_t:sock_file write;
+	allow $1 ricci_modclusterd_t:unix_stream_socket connectto;
+')
+
+########################################
+## <summary>
+##	Execute a domain transition to run ricci_modlog.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ricci_domtrans_modlog',`
+	gen_require(`
+		type ricci_modlog_t, ricci_modlog_exec_t;
+	')
+
+	domain_auto_trans($1,ricci_modlog_exec_t,ricci_modlog_t)
+	allow ricci_modlog_t $1:fd use;
+	allow ricci_modlog_t $1:fifo_file rw_file_perms;
+	allow ricci_modlog_t $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Execute a domain transition to run ricci_modrpm.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ricci_domtrans_modrpm',`
+	gen_require(`
+		type ricci_modrpm_t, ricci_modrpm_exec_t;
+	')
+
+	domain_auto_trans($1,ricci_modrpm_exec_t,ricci_modrpm_t)
+	allow ricci_modrpm_t $1:fd use;
+	allow ricci_modrpm_t $1:fifo_file rw_file_perms;
+	allow ricci_modrpm_t $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Execute a domain transition to run ricci_modservice.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ricci_domtrans_modservice',`
+	gen_require(`
+		type ricci_modservice_t, ricci_modservice_exec_t;
+	')
+
+	domain_auto_trans($1,ricci_modservice_exec_t,ricci_modservice_t)
+	allow ricci_modservice_t $1:fd use;
+	allow ricci_modservice_t $1:fifo_file rw_file_perms;
+	allow ricci_modservice_t $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Execute a domain transition to run ricci_modstorage.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ricci_domtrans_modstorage',`
+	gen_require(`
+		type ricci_modstorage_t, ricci_modstorage_exec_t;
+	')
+
+	domain_auto_trans($1,ricci_modstorage_exec_t,ricci_modstorage_t)
+	allow ricci_modstorage_t $1:fd use;
+	allow ricci_modstorage_t $1:fifo_file rw_file_perms;
+	allow ricci_modstorage_t $1:process sigchld;
+')
diff --git a/policy/modules/services/ricci.te b/policy/modules/services/ricci.te
new file mode 100644
index 0000000..be60d82
--- /dev/null
+++ b/policy/modules/services/ricci.te
@@ -0,0 +1,498 @@
+
+policy_module(ricci,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type ricci_t;
+type ricci_exec_t;
+domain_type(ricci_t)
+init_daemon_domain(ricci_t, ricci_exec_t)
+
+# tmp files
+type ricci_tmp_t;
+files_tmp_file(ricci_tmp_t)
+
+# var/lib files
+type ricci_var_lib_t;
+files_type(ricci_var_lib_t)
+
+# log files
+type ricci_var_log_t;
+logging_log_file(ricci_var_log_t)
+
+# pid files
+type ricci_var_run_t;
+files_pid_file(ricci_var_run_t)
+
+type ricci_modcluster_t;
+type ricci_modcluster_exec_t;
+domain_type(ricci_modcluster_t)
+domain_entry_file(ricci_modcluster_t, ricci_modcluster_exec_t)
+role system_r types ricci_modcluster_t;
+
+# var/lib files
+type ricci_modcluster_var_lib_t;
+files_type(ricci_modcluster_var_lib_t)
+
+# log files
+type ricci_modcluster_var_log_t;
+logging_log_file(ricci_modcluster_var_log_t)
+
+# pid files
+type ricci_modcluster_var_run_t;
+files_pid_file(ricci_modcluster_var_run_t)
+
+type ricci_modclusterd_t;
+type ricci_modclusterd_exec_t;
+domain_type(ricci_modclusterd_t)
+init_daemon_domain(ricci_modclusterd_t, ricci_modclusterd_exec_t)
+
+type ricci_modlog_t;
+type ricci_modlog_exec_t;
+domain_type(ricci_modlog_t)
+domain_entry_file(ricci_modlog_t, ricci_modlog_exec_t)
+role system_r types ricci_modlog_t;
+
+type ricci_modrpm_t;
+type ricci_modrpm_exec_t;
+domain_type(ricci_modrpm_t)
+domain_entry_file(ricci_modrpm_t, ricci_modrpm_exec_t)
+role system_r types ricci_modrpm_t;
+
+type ricci_modservice_t;
+type ricci_modservice_exec_t;
+domain_type(ricci_modservice_t)
+domain_entry_file(ricci_modservice_t, ricci_modservice_exec_t)
+role system_r types ricci_modservice_t;
+
+type ricci_modstorage_t;
+type ricci_modstorage_exec_t;
+domain_type(ricci_modstorage_t)
+domain_entry_file(ricci_modstorage_t, ricci_modstorage_exec_t)
+role system_r types ricci_modstorage_t;
+
+########################################
+#
+# ricci local policy
+#
+
+allow ricci_t self:capability { setuid sys_nice sys_boot };
+allow ricci_t self:process setsched;
+allow ricci_t self:fifo_file { read write };
+allow ricci_t self:unix_stream_socket { create_stream_socket_perms connectto };
+allow ricci_t self:tcp_socket create_stream_socket_perms;
+
+domain_auto_trans(ricci_t,ricci_modcluster_exec_t,ricci_modcluster_t)
+domain_auto_trans(ricci_t,ricci_modlog_exec_t,ricci_modlog_t)
+domain_auto_trans(ricci_t,ricci_modrpm_exec_t,ricci_modrpm_t)
+domain_auto_trans(ricci_t,ricci_modservice_exec_t,ricci_modservice_t)
+domain_auto_trans(ricci_t,ricci_modstorage_exec_t,ricci_modstorage_t)
+
+# tmp file
+allow ricci_t ricci_tmp_t:dir create_dir_perms;
+allow ricci_t ricci_tmp_t:file create_file_perms;
+files_tmp_filetrans(ricci_t, ricci_tmp_t, { file dir })
+
+# var/lib files for ricci
+allow ricci_t ricci_var_lib_t:file create_file_perms;
+allow ricci_t ricci_var_lib_t:sock_file create_file_perms;
+allow ricci_t ricci_var_lib_t:dir create_dir_perms;
+files_var_lib_filetrans(ricci_t,ricci_var_lib_t, { file dir sock_file })
+
+# log files
+allow ricci_t ricci_var_log_t:file create_file_perms;
+allow ricci_t ricci_var_log_t:sock_file create_file_perms;
+allow ricci_t ricci_var_log_t:dir { rw_dir_perms setattr };
+logging_log_filetrans(ricci_t,ricci_var_log_t,{ sock_file file dir })
+
+# pid file
+allow ricci_t ricci_var_run_t:file manage_file_perms;
+allow ricci_t ricci_var_run_t:sock_file manage_file_perms;
+allow ricci_t ricci_var_run_t:dir rw_dir_perms;
+files_pid_filetrans(ricci_t,ricci_var_run_t, { file sock_file })
+
+kernel_read_kernel_sysctls(ricci_t)
+
+corecmd_exec_bin(ricci_t)
+corecmd_exec_sbin(ricci_t)
+
+corenet_non_ipsec_sendrecv(ricci_t)
+corenet_tcp_sendrecv_all_if(ricci_t)
+corenet_tcp_sendrecv_all_nodes(ricci_t)
+corenet_tcp_sendrecv_all_ports(ricci_t)
+corenet_tcp_bind_all_nodes(ricci_t)
+corenet_udp_bind_all_nodes(ricci_t)
+corenet_tcp_bind_ricci_port(ricci_t)
+corenet_udp_bind_ricci_port(ricci_t)
+corenet_tcp_connect_http_port(ricci_t)
+
+dev_read_urand(ricci_t)
+
+files_read_etc_files(ricci_t)
+files_read_etc_runtime_files(ricci_t)
+files_create_boot_flag(ricci_t)
+
+auth_domtrans_chk_passwd(ricci_t)
+auth_append_login_records(ricci_t)
+
+init_dontaudit_use_fds(ricci_t)
+init_dontaudit_stream_connect_script(ricci_t)
+
+libs_use_ld_so(ricci_t)
+libs_use_shared_libs(ricci_t)
+
+locallogin_dontaudit_use_fds(ricci_t)
+
+logging_send_syslog_msg(ricci_t)
+
+miscfiles_read_localization(ricci_t)
+
+sysnet_dns_name_resolve(ricci_t)
+
+ifdef(`targeted_policy', `
+	term_dontaudit_use_console(ricci_t)
+	term_dontaudit_use_generic_ptys(ricci_t)
+	term_dontaudit_use_unallocated_ttys(ricci_t)
+')
+
+optional_policy(`
+	ccs_read_config(ricci_t)
+')
+
+optional_policy(`
+	dbus_system_bus_client_template(ricci,ricci_t)
+	dbus_send_system_bus(ricci_t)
+	oddjob_dbus_chat(ricci_t)
+')
+
+optional_policy(`
+	# Needed so oddjob can run halt/reboot on behalf of ricci
+	corecmd_sbin_entry_type(ricci_t)
+	term_dontaudit_search_ptys(ricci_t)
+	init_exec(ricci_t)
+	init_telinit(ricci_t)
+	init_rw_utmp(ricci_t)
+
+	oddjob_system_entry(ricci_t, ricci_exec_t)
+')
+
+optional_policy(`
+	rpm_use_script_fds(ricci_t)
+')
+
+optional_policy(`
+	sasl_connect(ricci_t)
+')
+
+optional_policy(`
+	unconfined_use_fds(ricci_t)
+')
+
+optional_policy(`
+	xen_domtrans_xm(ricci_t)
+')
+
+########################################
+#
+# ricci_modcluster local policy
+#
+
+allow ricci_modcluster_t self:capability sys_nice;
+allow ricci_modcluster_t self:process setsched;
+allow ricci_modcluster_t self:fifo_file rw_file_perms;
+
+kernel_read_kernel_sysctls(ricci_modcluster_t)
+kernel_read_system_state(ricci_modcluster_t)
+
+corecmd_exec_shell(ricci_modcluster_t)
+corecmd_exec_sbin(ricci_modcluster_t)
+corecmd_exec_bin(ricci_modcluster_t)
+
+domain_dontaudit_read_all_domains_state(ricci_modcluster_t)
+
+files_search_locks(ricci_modcluster_t)
+files_read_etc_runtime_files(ricci_modcluster_t)
+files_read_etc_files(ricci_modcluster_t)
+files_search_usr(ricci_modcluster_t)
+
+init_exec(ricci_modcluster_t)
+init_domtrans_script(ricci_modcluster_t)
+
+libs_use_ld_so(ricci_modcluster_t)
+libs_use_shared_libs(ricci_modcluster_t)
+
+logging_send_syslog_msg(ricci_modcluster_t)
+
+miscfiles_read_localization(ricci_modcluster_t)
+
+modutils_domtrans_insmod(ricci_modcluster_t)
+
+mount_domtrans(ricci_modcluster_t)
+
+ricci_stream_connect_modclusterd(ricci_modcluster_t)
+
+optional_policy(`
+	ccs_stream_connect(ricci_modcluster_t)
+	ccs_domtrans(ricci_modcluster_t)
+	ccs_manage_config(ricci_modcluster_t)
+')
+
+optional_policy(`
+	consoletype_exec(ricci_modcluster_t)
+')
+
+optional_policy(`
+	lvm_domtrans(ricci_modcluster_t)
+')
+
+optional_policy(`
+	nscd_socket_use(ricci_modcluster_t)
+')
+
+optional_policy(`
+	oddjob_system_entry(ricci_modcluster_t, ricci_modcluster_exec_t)
+')
+
+# XXX This has got to go.
+unconfined_domain(ricci_modcluster_t)
+
+########################################
+#
+# ricci_modclusterd local policy
+#
+
+allow ricci_modclusterd_t self:capability sys_nice;
+allow ricci_modclusterd_t self:process { signal sigkill setsched };
+allow ricci_modclusterd_t self:fifo_file rw_file_perms;
+allow ricci_modclusterd_t self:unix_stream_socket create_stream_socket_perms;
+allow ricci_modclusterd_t self:tcp_socket create_stream_socket_perms;
+allow ricci_modclusterd_t self:netlink_route_socket r_netlink_socket_perms;
+# cjp: this needs to be fixed for a specific socket type:
+allow ricci_modclusterd_t self:socket create_socket_perms;
+
+allow ricci_modclusterd_t ricci_modcluster_t:unix_stream_socket connectto;
+
+# log files
+allow ricci_modclusterd_t ricci_modcluster_var_log_t:file create_file_perms;
+allow ricci_modclusterd_t ricci_modcluster_var_log_t:sock_file create_file_perms;
+allow ricci_modclusterd_t ricci_modcluster_var_log_t:dir { rw_dir_perms setattr };
+logging_log_filetrans(ricci_modclusterd_t,ricci_modcluster_var_log_t,{ sock_file file dir })
+
+# pid file
+allow ricci_modclusterd_t ricci_modcluster_var_run_t:file manage_file_perms;
+allow ricci_modclusterd_t ricci_modcluster_var_run_t:sock_file manage_file_perms;
+allow ricci_modclusterd_t ricci_modcluster_var_run_t:dir rw_dir_perms;
+files_pid_filetrans(ricci_modclusterd_t,ricci_modcluster_var_run_t, { file sock_file })
+
+kernel_read_kernel_sysctls(ricci_modclusterd_t)
+kernel_read_system_state(ricci_modclusterd_t)
+
+corecmd_exec_bin(ricci_modclusterd_t)
+corecmd_exec_sbin(ricci_modclusterd_t)
+
+corenet_tcp_sendrecv_all_if(ricci_modclusterd_t)
+corenet_tcp_sendrecv_all_ports(ricci_modclusterd_t)
+corenet_tcp_bind_all_nodes(ricci_modclusterd_t)
+corenet_tcp_bind_ricci_modcluster_port(ricci_modclusterd_t)
+corenet_tcp_connect_ricci_modcluster_port(ricci_modclusterd_t)
+
+domain_dontaudit_read_all_domains_state(ricci_modclusterd_t)
+
+files_read_etc_files(ricci_modclusterd_t)
+files_read_etc_runtime_files(ricci_modclusterd_t)
+
+fs_getattr_xattr_fs(ricci_modclusterd_t)
+
+init_dontaudit_use_fds(ricci_modclusterd_t)
+init_dontaudit_stream_connect_script(ricci_modclusterd_t)
+
+libs_use_ld_so(ricci_modclusterd_t)
+libs_use_shared_libs(ricci_modclusterd_t)
+
+locallogin_dontaudit_use_fds(ricci_modclusterd_t)
+
+logging_send_syslog_msg(ricci_modclusterd_t)
+
+miscfiles_read_localization(ricci_modclusterd_t)
+
+sysnet_domtrans_ifconfig(ricci_modclusterd_t)
+sysnet_dns_name_resolve(ricci_modclusterd_t)
+
+ifdef(`targeted_policy', `
+	term_dontaudit_use_console(ricci_modclusterd_t)
+	term_dontaudit_use_generic_ptys(ricci_modclusterd_t)
+	term_dontaudit_use_unallocated_ttys(ricci_modclusterd_t)
+')
+
+optional_policy(`
+	ccs_domtrans(ricci_modclusterd_t)
+	ccs_stream_connect(ricci_modclusterd_t)
+	ccs_read_config(ricci_modclusterd_t)
+')
+
+optional_policy(`
+	unconfined_use_fds(ricci_modclusterd_t)
+')
+
+########################################
+#
+# ricci_modlog local policy
+#
+
+allow ricci_modlog_t self:capability sys_nice;
+allow ricci_modlog_t self:process setsched;
+
+kernel_read_kernel_sysctls(ricci_modlog_t)
+kernel_read_system_state(ricci_modlog_t)
+
+corecmd_exec_bin(ricci_modlog_t)
+corecmd_exec_sbin(ricci_modlog_t)
+
+domain_dontaudit_read_all_domains_state(ricci_modlog_t)
+
+files_read_etc_files(ricci_modlog_t)
+files_search_usr(ricci_modlog_t)
+
+libs_use_ld_so(ricci_modlog_t)
+libs_use_shared_libs(ricci_modlog_t)
+
+logging_read_generic_logs(ricci_modlog_t)
+
+miscfiles_read_localization(ricci_modlog_t)
+
+
+optional_policy(`
+	nscd_dontaudit_search_pid(ricci_modlog_t)
+')
+
+optional_policy(`
+	oddjob_system_entry(ricci_modlog_t, ricci_modlog_exec_t)
+')
+
+########################################
+#
+# ricci_modrpm local policy
+#
+
+allow ricci_modrpm_t self:fifo_file { getattr read };
+
+corecmd_exec_bin(ricci_modrpm_t)
+
+libs_use_ld_so(ricci_modrpm_t)
+libs_use_shared_libs(ricci_modrpm_t)
+
+files_search_usr(ricci_modrpm_t)
+files_read_etc_files(ricci_modrpm_t)
+
+miscfiles_read_localization(ricci_modrpm_t)
+
+optional_policy(`
+	oddjob_system_entry(ricci_modrpm_t, ricci_modrpm_exec_t)
+')
+
+optional_policy(`
+	rpm_domtrans(ricci_modrpm_t)
+')
+
+########################################
+#
+# ricci_modservice local policy
+#
+
+allow ricci_modservice_t self:capability { dac_override sys_nice };
+allow ricci_modservice_t self:fifo_file { getattr read write };
+allow ricci_modservice_t self:process setsched;
+
+kernel_read_kernel_sysctls(ricci_modservice_t)
+kernel_read_system_state(ricci_modservice_t)
+
+corecmd_exec_sbin(ricci_modservice_t)
+corecmd_exec_bin(ricci_modservice_t)
+corecmd_exec_shell(ricci_modservice_t)
+
+files_read_etc_files(ricci_modservice_t)
+files_read_etc_runtime_files(ricci_modservice_t)
+files_search_usr(ricci_modservice_t)
+
+consoletype_exec(ricci_modservice_t)
+
+init_domtrans_script(ricci_modservice_t)
+
+libs_use_ld_so(ricci_modservice_t)
+libs_use_shared_libs(ricci_modservice_t)
+
+miscfiles_read_localization(ricci_modservice_t)
+
+optional_policy(`
+	ccs_read_config(ricci_modservice_t)
+')
+
+optional_policy(`
+	nscd_dontaudit_search_pid(ricci_modservice_t)
+')
+
+optional_policy(`
+	oddjob_system_entry(ricci_modservice_t, ricci_modservice_exec_t)
+')
+
+########################################
+#
+# ricci_modstorage local policy
+#
+
+allow ricci_modstorage_t self:process { setsched signal };
+allow ricci_modstorage_t self:capability { mknod sys_nice };
+allow ricci_modstorage_t self:fifo_file rw_file_perms;
+allow ricci_modstorage_t self:unix_dgram_socket create_socket_perms;
+
+kernel_read_kernel_sysctls(ricci_modstorage_t)
+kernel_read_system_state(ricci_modstorage_t)
+
+corecmd_exec_bin(ricci_modstorage_t)
+corecmd_exec_sbin(ricci_modstorage_t)
+
+dev_read_sysfs(ricci_modstorage_t)
+dev_read_urand(ricci_modstorage_t)
+dev_manage_generic_blk_files(ricci_modstorage_t)
+
+#Needed for editing /etc/fstab
+files_manage_etc_files(ricci_modstorage_t)
+files_read_etc_runtime_files(ricci_modstorage_t)
+files_read_usr_files(ricci_modstorage_t)
+
+storage_raw_read_fixed_disk(ricci_modstorage_t)
+
+term_dontaudit_use_console(ricci_modstorage_t)
+
+fstools_domtrans(ricci_modstorage_t)
+
+libs_use_ld_so(ricci_modstorage_t)
+libs_use_shared_libs(ricci_modstorage_t)
+
+logging_send_syslog_msg(ricci_modstorage_t)
+
+lvm_domtrans(ricci_modstorage_t)
+lvm_read_config(ricci_modstorage_t)
+
+miscfiles_read_localization(ricci_modstorage_t)
+
+modutils_read_module_deps(ricci_modstorage_t)
+
+optional_policy(`
+	ccs_read_config(ricci_modstorage_t)
+')
+
+optional_policy(`
+	lvm_domtrans(ricci_modstorage_t)
+')
+
+optional_policy(`
+	oddjob_system_entry(ricci_modstorage_t, ricci_modstorage_exec_t)
+')
+
+optional_policy(`
+	raid_domtrans_mdadm(ricci_modstorage_t)
+')