diff --git a/policy-F12.patch b/policy-F12.patch
index a773c6f..cc7c045 100644
--- a/policy-F12.patch
+++ b/policy-F12.patch
@@ -1,3 +1,13 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/Changelog serefpolicy-3.6.28/Changelog
+--- nsaserefpolicy/Changelog	2009-08-18 18:39:50.000000000 -0400
++++ serefpolicy-3.6.28/Changelog	2009-08-18 13:23:29.000000000 -0400
+@@ -1,6 +1,3 @@
+-- Misc Gentoo fixes from Corentin Labbe.
+-- Debian policykit fixes from Martin Orr.
+-- Fix unconfined_r use of unconfined_java_t.
+ - Add missing x_device rules for XI2 functions, from Eamon Walsh.
+ - Add missing rules to make unconfined_cronjob_t a valid cron job domain.
+ - Add btrfs and ext4 to labeling targets.
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_contexts serefpolicy-3.6.28/config/appconfig-mcs/default_contexts
 --- nsaserefpolicy/config/appconfig-mcs/default_contexts	2009-07-14 14:19:57.000000000 -0400
 +++ serefpolicy-3.6.28/config/appconfig-mcs/default_contexts	2009-08-18 13:23:29.000000000 -0400
@@ -632,6 +642,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.te serefpolicy-3.6.28/policy/modules/admin/portage.te
 --- nsaserefpolicy/policy/modules/admin/portage.te	2009-08-18 18:39:50.000000000 -0400
 +++ serefpolicy-3.6.28/policy/modules/admin/portage.te	2009-08-18 13:23:29.000000000 -0400
+@@ -1,5 +1,5 @@
+ 
+-policy_module(portage, 1.8.1)
++policy_module(portage, 1.8.0)
+ 
+ ########################################
+ #
+@@ -119,7 +119,6 @@
+ # - setfscreate for merging to live fs
+ # - setexec to run portage fetch
+ allow portage_t self:process { setfscreate setexec };
+-allow portage_t self:capability sys_nice;
+ 
+ allow portage_t portage_log_t:file manage_file_perms;
+ logging_log_filetrans(portage_t, portage_log_t, file)
 @@ -196,7 +195,7 @@
  # - for rsync and distfile fetching
  #
@@ -3482,8 +3507,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ptchown.te serefpolicy-3.6.28/policy/modules/apps/ptchown.te
 --- nsaserefpolicy/policy/modules/apps/ptchown.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.28/policy/modules/apps/ptchown.te	2009-08-18 13:23:29.000000000 -0400
-@@ -0,0 +1,38 @@
++++ serefpolicy-3.6.28/policy/modules/apps/ptchown.te	2009-08-19 17:37:18.000000000 -0400
+@@ -0,0 +1,39 @@
 +policy_module(ptchown,1.0.0)
 +
 +########################################
@@ -3503,7 +3528,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +# ptchown local policy
 +#
 +
-+allow ptchown_t self:capability { fowner chown setuid };
++allow ptchown_t self:capability { chown fowner fsetid setuid };
 +allow ptchown_t self:process { getcap setcap };
 +
 +# Init script handling
@@ -3517,9 +3542,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +fs_rw_anon_inodefs_files(ptchown_t)
 +
-+term_use_generic_ptys(ptchown_t)
 +term_setattr_generic_ptys(ptchown_t)
 +term_setattr_all_user_ptys(ptchown_t)
++term_use_generic_ptys(ptchown_t)
++term_use_ptmx(ptchown_t)
 +
 +miscfiles_read_localization(ptchown_t)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te
@@ -5137,7 +5163,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.6.28/policy/modules/kernel/domain.if
 --- nsaserefpolicy/policy/modules/kernel/domain.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/domain.if	2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/domain.if	2009-08-19 16:58:54.000000000 -0400
 @@ -44,34 +44,6 @@
  interface(`domain_type',`
  	# start with basic domain
@@ -10709,6 +10735,25 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	manage_files_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
 +	files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir })
  ')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.6.28/policy/modules/services/dbus.fc
+--- nsaserefpolicy/policy/modules/services/dbus.fc	2009-08-18 18:39:50.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/dbus.fc	2009-08-18 11:41:45.000000000 -0400
+@@ -1,13 +1,12 @@
+ /etc/dbus-1(/.*)?		gen_context(system_u:object_r:dbusd_etc_t,s0)
+ 
++# Sorting does not work correctly if I combine these next two roles
++/usr/bin/dbus-daemon(-1)? --	gen_context(system_u:object_r:dbusd_exec_t,s0)
+ /bin/dbus-daemon 	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+ 
+ /lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
+ /lib64/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
+ 
+-/usr/bin/dbus-daemon(-1)? --	gen_context(system_u:object_r:dbusd_exec_t,s0)
+-/usr/libexec/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
+-
+ /var/lib/dbus(/.*)?		gen_context(system_u:object_r:system_dbusd_var_lib_t,s0)
+ 
+ /var/run/dbus(/.*)?		gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.28/policy/modules/services/dbus.if
 --- nsaserefpolicy/policy/modules/services/dbus.if	2009-07-28 13:28:33.000000000 -0400
 +++ serefpolicy-3.6.28/policy/modules/services/dbus.if	2009-08-18 13:23:29.000000000 -0400
@@ -10806,6 +10851,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.6.28/policy/modules/services/dbus.te
 --- nsaserefpolicy/policy/modules/services/dbus.te	2009-08-18 18:39:50.000000000 -0400
 +++ serefpolicy-3.6.28/policy/modules/services/dbus.te	2009-08-18 13:23:29.000000000 -0400
+@@ -1,5 +1,5 @@
+ 
+-policy_module(dbus, 1.11.1)
++policy_module(dbus, 1.11.0)
+ 
+ gen_require(`
+ 	class dbus all_dbus_perms;
 @@ -86,6 +86,7 @@
  dev_read_sysfs(system_dbusd_t)
  
@@ -13443,7 +13495,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ########################################
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.6.28/policy/modules/services/openvpn.te
 --- nsaserefpolicy/policy/modules/services/openvpn.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/openvpn.te	2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/openvpn.te	2009-08-19 17:17:15.000000000 -0400
 @@ -86,6 +86,7 @@
  corenet_udp_bind_openvpn_port(openvpn_t)
  corenet_tcp_connect_openvpn_port(openvpn_t)
@@ -13452,7 +13504,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  corenet_rw_tun_tap_dev(openvpn_t)
  corenet_sendrecv_openvpn_server_packets(openvpn_t)
  corenet_sendrecv_openvpn_client_packets(openvpn_t)
-@@ -114,6 +115,16 @@
+@@ -98,6 +99,8 @@
+ files_read_etc_files(openvpn_t)
+ files_read_etc_runtime_files(openvpn_t)
+ 
++auth_use_pam(openvpn_t)
++
+ logging_send_syslog_msg(openvpn_t)
+ 
+ miscfiles_read_localization(openvpn_t)
+@@ -114,6 +117,16 @@
  	userdom_read_user_home_content_files(openvpn_t)
  ')
  
@@ -13598,6 +13659,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	allow $1 policykit_t:dbus send_msg;
  	allow policykit_t $1:dbus send_msg;
  ')
+@@ -41,7 +43,6 @@
+ 
+ ########################################
+ ## <summary>
+-##	Execute a policy_auth in the policy_auth domain, and
+ ##	allow the specified role the policy_auth domain,
+ ## </summary>
+ ## <param name="domain">
 @@ -206,4 +207,47 @@
  
  	files_search_var_lib($1)
@@ -15590,7 +15659,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.6.28/policy/modules/services/sasl.te
 --- nsaserefpolicy/policy/modules/services/sasl.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/sasl.te	2009-08-18 13:25:10.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/sasl.te	2009-08-19 17:16:45.000000000 -0400
 @@ -31,7 +31,7 @@
  # Local policy
  #
@@ -17610,7 +17679,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/var/run/libvirt/qemu(/.*)? 	gen_context(system_u:object_r:svirt_var_run_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.6.28/policy/modules/services/virt.if
 --- nsaserefpolicy/policy/modules/services/virt.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/virt.if	2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/virt.if	2009-08-19 17:01:25.000000000 -0400
 @@ -103,7 +103,7 @@
  
  ########################################
@@ -17708,7 +17777,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	All of the rules required to administrate 
  ##	an virt environment
  ## </summary>
-@@ -327,3 +364,77 @@
+@@ -327,3 +364,79 @@
  
  	virt_manage_log($1)
  ')
@@ -17734,6 +17803,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	domain_type($1_t)
 +	role system_r types $1_t;
 +
++	domain_user_exemption_target($1_t)
++
 +	type $1_tmp_t;
 +	files_tmp_file($1_tmp_t)
 +
@@ -17788,7 +17859,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.28/policy/modules/services/virt.te
 --- nsaserefpolicy/policy/modules/services/virt.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/virt.te	2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/virt.te	2009-08-19 17:26:56.000000000 -0400
 @@ -20,6 +20,28 @@
  ## </desc>
  gen_tunable(virt_use_samba, false)
@@ -17897,7 +17968,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  corecmd_exec_bin(virtd_t)
  corecmd_exec_shell(virtd_t)
-@@ -96,30 +152,51 @@
+@@ -96,30 +152,52 @@
  corenet_tcp_sendrecv_generic_node(virtd_t)
  corenet_tcp_sendrecv_all_ports(virtd_t)
  corenet_tcp_bind_generic_node(virtd_t)
@@ -17934,6 +18005,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +files_manage_etc_files(virtd_t)
 +
 +modutils_read_module_deps(virtd_t)
++modutils_read_module_config(virtd_t)
  
  fs_list_auto_mountpoints(virtd_t)
 +fs_getattr_xattr_fs(virtd_t)
@@ -17952,7 +18024,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  term_use_ptmx(virtd_t)
  
  auth_use_nsswitch(virtd_t)
-@@ -129,7 +206,14 @@
+@@ -129,7 +207,14 @@
  
  logging_send_syslog_msg(virtd_t)
  
@@ -17967,7 +18039,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  tunable_policy(`virt_use_nfs',`
  	fs_manage_nfs_dirs(virtd_t)
-@@ -167,22 +251,35 @@
+@@ -167,22 +252,35 @@
  	dnsmasq_domtrans(virtd_t)
  	dnsmasq_signal(virtd_t)
  	dnsmasq_kill(virtd_t)
@@ -18008,7 +18080,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -195,8 +292,159 @@
+@@ -195,8 +293,159 @@
  
  	xen_stream_connect(virtd_t)
  	xen_stream_connect_xenstore(virtd_t)
@@ -21221,7 +21293,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.6.28/policy/modules/system/ipsec.te
 --- nsaserefpolicy/policy/modules/system/ipsec.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/ipsec.te	2009-08-18 13:42:27.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/ipsec.te	2009-08-19 20:01:37.000000000 -0400
 @@ -6,6 +6,13 @@
  # Declarations
  #
@@ -21246,7 +21318,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # type for file(s) containing ipsec keys - RSA or preshared
  type ipsec_key_file_t;
  files_type(ipsec_key_file_t)
-@@ -53,21 +63,23 @@
+@@ -43,6 +53,9 @@
+ init_daemon_domain(racoon_t, racoon_exec_t)
+ role system_r types racoon_t;
+ 
++type racoon_tmp_t;
++files_tmp_file(racoon_tmp_t)
++
+ type setkey_t;
+ type setkey_exec_t;
+ init_system_domain(setkey_t, setkey_exec_t)
+@@ -53,21 +66,23 @@
  # ipsec Local policy
  #
  
@@ -21273,7 +21355,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  read_lnk_files_pattern(ipsec_t, ipsec_key_file_t, ipsec_key_file_t)
  
  manage_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t)
-@@ -76,7 +88,7 @@
+@@ -76,13 +91,13 @@
  
  can_exec(ipsec_t, ipsec_mgmt_exec_t)
  
@@ -21282,7 +21364,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # a shell script, we need to find a way to make things work without
  # letting all sorts of stuff possibly be run...
  # so try flipping back into the ipsec_mgmt_t domain
-@@ -95,9 +107,6 @@
+ corecmd_shell_domtrans(ipsec_t, ipsec_mgmt_t)
+ allow ipsec_mgmt_t ipsec_t:fd use;
+-allow ipsec_mgmt_t ipsec_t:fifo_file rw_file_perms;
++allow ipsec_mgmt_t ipsec_t:fifo_file rw_fifo_file_perms;
+ allow ipsec_mgmt_t ipsec_t:process sigchld;
+ 
+ kernel_read_kernel_sysctls(ipsec_t)
+@@ -95,9 +110,6 @@
  kernel_getattr_core_if(ipsec_t)
  kernel_getattr_message_if(ipsec_t)
  
@@ -21292,7 +21381,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # Pluto needs network access
  corenet_all_recvfrom_unlabeled(ipsec_t)
  corenet_tcp_sendrecv_all_if(ipsec_t)
-@@ -118,21 +127,26 @@
+@@ -107,10 +119,11 @@
+ corenet_tcp_sendrecv_all_ports(ipsec_t)
+ corenet_tcp_bind_all_nodes(ipsec_t)
+ corenet_udp_bind_all_nodes(ipsec_t)
++corenet_udp_bind_isakmp_port(ipsec_t)
+ corenet_tcp_bind_reserved_port(ipsec_t)
+ corenet_tcp_bind_isakmp_port(ipsec_t)
+-corenet_udp_bind_isakmp_port(ipsec_t)
+ corenet_udp_bind_ipsecnat_port(ipsec_t)
++
+ corenet_sendrecv_generic_server_packets(ipsec_t)
+ corenet_sendrecv_isakmp_server_packets(ipsec_t)
+ 
+@@ -118,21 +131,26 @@
  dev_read_rand(ipsec_t)
  dev_read_urand(ipsec_t)
  
@@ -21324,7 +21426,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  logging_send_syslog_msg(ipsec_t)
  
  miscfiles_read_localization(ipsec_t)
-@@ -154,12 +168,12 @@
+@@ -154,12 +172,12 @@
  #
  
  allow ipsec_mgmt_t self:capability { net_admin sys_tty_config dac_override dac_read_search };
@@ -21339,7 +21441,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  allow ipsec_mgmt_t ipsec_mgmt_lock_t:file manage_file_perms;
  files_lock_filetrans(ipsec_mgmt_t, ipsec_mgmt_lock_t, file)
-@@ -209,15 +223,21 @@
+@@ -209,15 +227,21 @@
  files_read_kernel_symbol_table(ipsec_mgmt_t)
  files_getattr_kernel_modules(ipsec_mgmt_t)
  
@@ -21364,7 +21466,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  domain_use_interactive_fds(ipsec_mgmt_t)
  # denials when ps tries to search /proc. Do not audit these denials.
  domain_dontaudit_list_all_domains_state(ipsec_mgmt_t)
-@@ -232,12 +252,6 @@
+@@ -232,12 +256,6 @@
  files_dontaudit_getattr_default_dirs(ipsec_mgmt_t)
  files_dontaudit_getattr_default_files(ipsec_mgmt_t)
  
@@ -21377,17 +21479,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  init_use_script_ptys(ipsec_mgmt_t)
  init_exec_script_files(ipsec_mgmt_t)
  init_use_fds(ipsec_mgmt_t)
-@@ -280,6 +294,9 @@
+@@ -280,6 +298,13 @@
  allow racoon_t self:netlink_selinux_socket { bind create read };
  allow racoon_t self:udp_socket create_socket_perms;
  allow racoon_t self:key_socket create_socket_perms;
 +allow racoon_t self:fifo_file rw_fifo_file_perms;
 +
++manage_dirs_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t)
++manage_files_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t)
++files_tmp_filetrans(racoon_t, racoon_tmp_t, { dir file }) 
++
 +can_exec(racoon_t, setkey_exec_t)
  
  # manage pid file
  manage_files_pattern(racoon_t, ipsec_var_run_t, ipsec_var_run_t)
-@@ -297,6 +314,13 @@
+@@ -297,6 +322,13 @@
  kernel_read_system_state(racoon_t)
  kernel_read_network_state(racoon_t)
  
@@ -21401,7 +21507,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  corenet_all_recvfrom_unlabeled(racoon_t)
  corenet_tcp_sendrecv_all_if(racoon_t)
  corenet_udp_sendrecv_all_if(racoon_t)
-@@ -314,13 +338,15 @@
+@@ -314,13 +346,15 @@
  
  files_read_etc_files(racoon_t)
  
@@ -21419,10 +21525,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  locallogin_use_fds(racoon_t)
  
  logging_send_syslog_msg(racoon_t)
-@@ -328,6 +354,11 @@
+@@ -328,6 +362,13 @@
  
  miscfiles_read_localization(racoon_t)
  
++auth_use_pam(racoon_t)
++
 +auth_can_read_shadow_passwords(racoon_t)
 +tunable_policy(`racoon_read_shadow',`
 +	auth_tunable_read_shadow(racoon_t) 
@@ -21431,7 +21539,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ########################################
  #
  # Setkey local policy
-@@ -347,6 +378,7 @@
+@@ -347,6 +388,7 @@
  files_read_etc_files(setkey_t)
  
  init_dontaudit_use_fds(setkey_t)
@@ -27293,7 +27401,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.6.28/policy/modules/system/xen.te
 --- nsaserefpolicy/policy/modules/system/xen.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/xen.te	2009-08-18 18:28:36.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/xen.te	2009-08-19 17:23:15.000000000 -0400
 @@ -1,11 +1,18 @@
  
 -policy_module(xen, 1.9.0)
@@ -27432,16 +27540,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	consoletype_exec(xend_t)
  ')
  
-@@ -239,6 +270,8 @@
+@@ -239,6 +270,10 @@
  
  files_read_usr_files(xenconsoled_t)
  
 +fs_list_tmpfs(xenconsoled_t)
++fs_manage_xenfs_dirs(xenconsoled_t)
++fs_manage_xenfs_files(xenconsoled_t)
 +
  term_create_pty(xenconsoled_t, xen_devpts_t)
  term_use_generic_ptys(xenconsoled_t)
  term_use_console(xenconsoled_t)
-@@ -248,7 +281,7 @@
+@@ -248,7 +283,7 @@
  
  miscfiles_read_localization(xenconsoled_t)
  
@@ -27450,7 +27560,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  xen_stream_connect_xenstore(xenconsoled_t)
  
  ########################################
-@@ -256,21 +289,33 @@
+@@ -256,21 +291,33 @@
  # Xen store local policy
  #
  
@@ -27485,7 +27595,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  kernel_write_xen_state(xenstored_t)
  kernel_read_xen_state(xenstored_t)
  
-@@ -304,6 +349,7 @@
+@@ -304,6 +351,7 @@
  #
  
  allow xm_t self:capability { dac_override ipc_lock sys_tty_config };
@@ -27493,7 +27603,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  # internal communication is often done using fifo and unix sockets.
  allow xm_t self:fifo_file rw_fifo_file_perms;
-@@ -312,24 +358,28 @@
+@@ -312,24 +360,28 @@
  
  manage_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t)
  manage_fifo_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t)
@@ -27523,11 +27633,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  files_read_etc_runtime_files(xm_t)
  files_read_usr_files(xm_t)
-@@ -339,15 +389,69 @@
+@@ -339,15 +391,70 @@
  
  storage_raw_read_fixed_disk(xm_t)
  
 +fs_getattr_all_fs(xm_t)
++fs_manage_xenfs_dirs(xm_t)
++fs_manage_xenfs_files(xm_t)
 +
  term_use_all_terms(xm_t)
  
@@ -27557,6 +27669,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +kernel_read_xen_state(xm_ssh_t)
 +kernel_write_xen_state(xm_ssh_t)
 +
++fs_manage_xenfs_dirs(xm_ssh_t)
++fs_manage_xenfs_files(xm_ssh_t)
++
 +userdom_search_admin_dir(xm_ssh_t)
 +
 +#Should have a boolean wrapping these
@@ -27564,6 +27679,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +files_search_mnt(xend_t)
 +fs_getattr_all_fs(xend_t)
 +fs_read_dos_files(xend_t)
++fs_manage_xenfs_dirs(xend_t)
++fs_manage_xenfs_files(xend_t)
 +
 +tunable_policy(`xen_use_nfs',`
 +	fs_manage_nfs_files(xend_t)
@@ -27588,12 +27705,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +manage_sock_files_pattern(evtchnd_t,evtchnd_var_run_t,evtchnd_var_run_t)
 +files_pid_filetrans(evtchnd_t, evtchnd_var_run_t, { file sock_file dir })
 +
-+fs_manage_xenfs_dirs(xend_t)
-+fs_manage_xenfs_files(xend_t)
-+fs_manage_xenfs_dirs(xenstored_t)
-+fs_manage_xenfs_files(xenstored_t)
-+fs_manage_xenfs_dirs(xm_t)
-+fs_manage_xenfs_files(xm_t)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.6.28/policy/support/obj_perm_sets.spt
 --- nsaserefpolicy/policy/support/obj_perm_sets.spt	2009-07-14 14:19:57.000000000 -0400
 +++ serefpolicy-3.6.28/policy/support/obj_perm_sets.spt	2009-08-18 13:23:29.000000000 -0400
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 513db90..7088426 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -20,7 +20,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.6.28
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -475,6 +475,9 @@ exit 0
 %endif
 
 %changelog
+* Wed Aug 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-2
+- Allow libvirt to change user componant of virt_domain
+
 * Tue Aug 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-1
 - Allow cupsd_config_t to be started by dbus
 - Add smoltclient policy