commit f53f820fe366940d4fdecaef80de4e5b1178fac6

Author: Miroslav Grepl <mgrepl@redhat.com>

Date:   Thu Jun 7 01:38:59 2012 +0200

    roleattribute patch

diff --git a/livecd.if b/livecd.if

index bfbf676..fb7869e 100644

--- a/livecd.if

+++ b/livecd.if

@@ -38,12 +38,19 @@ interface(`livecd_run',`

 	gen_require(`

 		type livecd_t;

 		type livecd_exec_t;

-		attribute_role livecd_roles;

+		#attribute_role livecd_roles;

 	')

 	livecd_domtrans($1)

-	roleattribute $2 livecd_roles;

+	#roleattribute $2 livecd_roles;

+	role $2 types livecd_t;

 	role_transition $2 livecd_exec_t system_r;

+

+        seutil_run_setfiles_mac(livecd_t, system_r)

+

+        optional_policy(`

+                mount_run(livecd_t, $2)

+        ')

 ')

 ########################################

diff --git a/livecd.te b/livecd.te

index 65efdae..7a944b5 100644

--- a/livecd.te

+++ b/livecd.te

@@ -5,13 +5,14 @@ policy_module(livecd, 1.2.0)

 # Declarations

 #

-attribute_role livecd_roles;

-roleattribute system_r livecd_roles;

+#attribute_role livecd_roles;

+#roleattribute system_r livecd_roles;

 type livecd_t;

 type livecd_exec_t;

 application_domain(livecd_t, livecd_exec_t)

-role livecd_roles types livecd_t;

+role system_r types livecd_t;

+#role livecd_roles types livecd_t;

 type livecd_tmp_t;

 files_tmp_file(livecd_tmp_t)

@@ -35,10 +36,10 @@ term_filetrans_all_named_dev(livecd_t)

 sysnet_filetrans_named_content(livecd_t)

-optional_policy(`

-	mount_run(livecd_t, livecd_roles)

-	seutil_run_setfiles_mac(livecd_t, livecd_roles)

-')

+#optional_policy(`

+#	mount_run(livecd_t, livecd_roles)

+#	seutil_run_setfiles_mac(livecd_t, livecd_roles)

+#')

 optional_policy(`

 	ssh_filetrans_admin_home_content(livecd_t)

diff --git a/mozilla.if b/mozilla.if

index 30b0241..30bfefb 100644

--- a/mozilla.if

+++ b/mozilla.if

@@ -18,10 +18,11 @@

 interface(`mozilla_role',`

 	gen_require(`

 		type mozilla_t, mozilla_exec_t, mozilla_home_t;

-		attribute_role mozilla_roles;

+		#attribute_role mozilla_roles;

 	')

-	roleattribute $1 mozilla_roles;

+	#roleattribute $1 mozilla_roles;

+	role $1 types mozilla_t;

 	domain_auto_trans($2, mozilla_exec_t, mozilla_t)

 	# Unrestricted inheritance from the caller.

@@ -47,6 +48,8 @@ interface(`mozilla_role',`

 	relabel_files_pattern($2, mozilla_home_t, mozilla_home_t)

 	relabel_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t)

+	#should be remove then with adding of roleattribute

+	mozilla_run_plugin(mozilla_t, $1)

 	mozilla_dbus_chat($2)

 	userdom_manage_tmp_role($1, mozilla_t)

@@ -63,7 +66,6 @@ interface(`mozilla_role',`

 	mozilla_filetrans_home_content($2)

-	mozilla_dbus_chat($2)

 ')

 ########################################

diff --git a/mozilla.te b/mozilla.te

index 7bf56bf..56700a4 100644

--- a/mozilla.te

+++ b/mozilla.te

@@ -19,14 +19,15 @@ gen_tunable(mozilla_read_content, false)

 ## </desc>

 gen_tunable(mozilla_plugin_enable_homedirs, false)

-attribute_role mozilla_roles;

+#attribute_role mozilla_roles;

 type mozilla_t;

 type mozilla_exec_t;

 typealias mozilla_t alias { user_mozilla_t staff_mozilla_t sysadm_mozilla_t };

 typealias mozilla_t alias { auditadm_mozilla_t secadm_mozilla_t };

 userdom_user_application_domain(mozilla_t, mozilla_exec_t)

-role mozilla_roles types mozilla_t;

+#role mozilla_roles types mozilla_t;

+role system_r types mozilla_t;

 type mozilla_conf_t;

 files_config_file(mozilla_conf_t)

@@ -39,7 +40,8 @@ userdom_user_home_content(mozilla_home_t)

 type mozilla_plugin_t;

 type mozilla_plugin_exec_t;

 application_domain(mozilla_plugin_t, mozilla_plugin_exec_t)

-role mozilla_roles types mozilla_plugin_t;

+#role mozilla_roles types mozilla_plugin_t;

+role system_r types mozilla_plugin_t;

 type mozilla_plugin_tmp_t;

 userdom_user_tmp_content(mozilla_plugin_tmp_t)

@@ -55,7 +57,8 @@ files_type(mozilla_plugin_rw_t)

 type mozilla_plugin_config_t;

 type mozilla_plugin_config_exec_t;

 application_domain(mozilla_plugin_config_t, mozilla_plugin_config_exec_t)

-role mozilla_roles types mozilla_plugin_config_t;

+#role mozilla_roles types mozilla_plugin_config_t;

+role system_r types mozilla_plugin_config_t;

 type mozilla_tmp_t;

 userdom_user_tmp_file(mozilla_tmp_t)

@@ -186,7 +189,7 @@ sysnet_dns_name_resolve(mozilla_t)

 userdom_use_inherited_user_ptys(mozilla_t)

-mozilla_run_plugin(mozilla_t, mozilla_roles)

+#mozilla_run_plugin(mozilla_t, mozilla_roles)

 xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)

 xserver_dontaudit_read_xdm_tmp_files(mozilla_t)

@@ -298,7 +301,8 @@ optional_policy(`

 ')

 optional_policy(`

-	pulseaudio_role(mozilla_roles, mozilla_t)

+	#pulseaudio_role(mozilla_roles, mozilla_t)

+	pulseaudio_exec(mozilla_t)

 	pulseaudio_stream_connect(mozilla_t)

 	pulseaudio_manage_home_files(mozilla_t)

 ')

@@ -476,9 +480,9 @@ optional_policy(`

 	java_exec(mozilla_plugin_t)

 ')

-optional_policy(`

-	lpd_run_lpr(mozilla_plugin_t, mozilla_roles)

-')

+#optional_policy(`

+#	lpd_run_lpr(mozilla_plugin_t, mozilla_roles)

+#')

 optional_policy(`

 	mplayer_exec(mozilla_plugin_t)

diff --git a/ncftool.if b/ncftool.if

index 1520b6c..3a4455f 100644

--- a/ncftool.if

+++ b/ncftool.if

@@ -36,10 +36,18 @@ interface(`ncftool_domtrans',`

 #

 interface(`ncftool_run',`

 	gen_require(`

-		attribute_role ncftool_roles;

+		type ncftool_t;

+		#attribute_role ncftool_roles;

         ')

-        ncftool_domtrans($1)

-        roleattribute $2 ncftool_roles;

+        #ncftool_domtrans($1)

+        #roleattribute $2 ncftool_roles;

+

+	role $1 types ncftool_t;

+

+        ncftool_domtrans($2)

+

+        ps_process_pattern($2, ncftool_t)

+        allow $2 ncftool_t:process signal;

 ')

diff --git a/ncftool.te b/ncftool.te

index 91ab36d..8c48c33 100644

--- a/ncftool.te

+++ b/ncftool.te

@@ -5,15 +5,16 @@ policy_module(ncftool, 1.1.0)

 # Declarations

 #

-attribute_role ncftool_roles;

-roleattribute system_r ncftool_roles;

+#attribute_role ncftool_roles;

+#roleattribute system_r ncftool_roles;

 type ncftool_t;

 type ncftool_exec_t;

 application_domain(ncftool_t, ncftool_exec_t)

 domain_obj_id_change_exemption(ncftool_t)

 domain_system_change_exemption(ncftool_t)

-role ncftool_roles types ncftool_t;

+#role ncftool_roles types ncftool_t;

+role system_r types ncftool_t;

 ########################################

 #

@@ -53,8 +54,10 @@ term_use_all_inherited_terms(ncftool_t)

 miscfiles_read_localization(ncftool_t)

 sysnet_delete_dhcpc_pid(ncftool_t)

-sysnet_run_dhcpc(ncftool_t, ncftool_roles)

-sysnet_run_ifconfig(ncftool_t, ncftool_roles)

+sysnet_domtrans_dhcpc(ncftool_t)

+sysnet_domtrans_ifconfig(ncftool_t)

+#sysnet_run_dhcpc(ncftool_t, ncftool_roles)

+#sysnet_run_ifconfig(ncftool_t, ncftool_roles)

 sysnet_etc_filetrans_config(ncftool_t)

 sysnet_manage_config(ncftool_t)

 sysnet_read_dhcpc_state(ncftool_t)

@@ -66,9 +69,9 @@ sysnet_signal_dhcpc(ncftool_t)

 userdom_use_user_terminals(ncftool_t)

 userdom_read_user_tmp_files(ncftool_t)

-optional_policy(`

-	brctl_run(ncftool_t, ncftool_roles)

-')

+#optional_policy(`

+#	brctl_run(ncftool_t, ncftool_roles)

+#')

 optional_policy(`

 	consoletype_exec(ncftool_t)

@@ -85,9 +88,12 @@ optional_policy(`

 optional_policy(`

 	modutils_read_module_config(ncftool_t)

-	modutils_run_insmod(ncftool_t, ncftool_roles)

+	modutils_domtrans_insmod(ncftool_t)

+	#modutils_run_insmod(ncftool_t, ncftool_roles)

+

 ')

 optional_policy(`

-	netutils_run(ncftool_t, ncftool_roles)

+	netutils_domtrans(ncftool_t)

+	#netutils_run(ncftool_t, ncftool_roles)

 ')

diff --git a/ppp.if b/ppp.if

index c174b05..a4cad0b 100644

--- a/ppp.if

+++ b/ppp.if

@@ -175,11 +175,18 @@ interface(`ppp_run_cond',`

 #

 interface(`ppp_run',`

 	gen_require(`

-		attribute_role pppd_roles;

+		#attribute_role pppd_roles;

+		type pppd_t;

 	')

-	ppp_domtrans($1)

-	roleattribute $2 pppd_roles;

+	#ppp_domtrans($1)

+	#roleattribute $2 pppd_roles;

+

+	role $2 types pppd_t;

+

+        tunable_policy(`pppd_for_user',`

+                ppp_domtrans($1)

+        ')

 ')

 ########################################

diff --git a/ppp.te b/ppp.te

index 17e10a2..92cec2b 100644

--- a/ppp.te

+++ b/ppp.te

@@ -19,14 +19,15 @@ gen_tunable(pppd_can_insmod, false)

 ## </desc>

 gen_tunable(pppd_for_user, false)

-attribute_role pppd_roles;

+#attribute_role pppd_roles;

 # pppd_t is the domain for the pppd program.

 # pppd_exec_t is the type of the pppd executable.

 type pppd_t;

 type pppd_exec_t;

 init_daemon_domain(pppd_t, pppd_exec_t)

-role pppd_roles types pppd_t;

+#role pppd_roles types pppd_t;

+role system_r types pppd_t;

 type pppd_devpts_t;

 term_pty(pppd_devpts_t)

@@ -64,7 +65,8 @@ files_pid_file(pppd_var_run_t)

 type pptp_t;

 type pptp_exec_t;

 init_daemon_domain(pptp_t, pptp_exec_t)

-role pppd_roles types pptp_t;

+#role pppd_roles types pptp_t;

+role system_r types pptp_t;

 type pptp_log_t;

 logging_log_file(pptp_log_t)

@@ -176,7 +178,8 @@ init_dontaudit_write_utmp(pppd_t)

 init_signal_script(pppd_t)

 auth_use_nsswitch(pppd_t)

-auth_run_chk_passwd(pppd_t,pppd_roles)

+auth_domtrans_chk_passwd(pppd_t)

+#auth_run_chk_passwd(pppd_t,pppd_roles)

 auth_write_login_records(pppd_t)

 logging_send_syslog_msg(pppd_t)

@@ -196,7 +199,8 @@ userdom_search_admin_dir(pppd_t)

 ppp_exec(pppd_t)

 optional_policy(`

-	ddclient_run(pppd_t, pppd_roles)

+	#ddclient_run(pppd_t, pppd_roles)

+	ddclient_domtrans(pppd_t)

 ')

 optional_policy(`

diff --git a/usernetctl.if b/usernetctl.if

index d45c715..2d4f1ba 100644

--- a/usernetctl.if

+++ b/usernetctl.if

@@ -37,9 +37,26 @@ interface(`usernetctl_domtrans',`

 #

 interface(`usernetctl_run',`

 	gen_require(`

-		attribute_role usernetctl_roles;

+		type usernetctl_t;

+		#attribute_role usernetctl_roles;

 	')

-	usernetctl_domtrans($1)

-	roleattribute $2 usernetctl_roles;

+	#usernetctl_domtrans($1)

+	#roleattribute $2 usernetctl_roles;

+

+	sysnet_run_ifconfig(usernetctl_t, $2)

+        sysnet_run_dhcpc(usernetctl_t, $2)

+

+        optional_policy(`

+                iptables_run(usernetctl_t, $2)

+        ')

+

+        optional_policy(`

+                modutils_run_insmod(usernetctl_t, $2)

+        ')

+

+        optional_policy(`

+                ppp_run(usernetctl_t, $2)

+        ')

+

 ')

diff --git a/usernetctl.te b/usernetctl.te

index 8604c1c..35b12a6 100644

--- a/usernetctl.te

+++ b/usernetctl.te

@@ -5,13 +5,14 @@ policy_module(usernetctl, 1.6.0)

 # Declarations

 #

-attribute_role usernetctl_roles;

+#attribute_role usernetctl_roles;

 type usernetctl_t;

 type usernetctl_exec_t;

 application_domain(usernetctl_t, usernetctl_exec_t)

 domain_interactive_fd(usernetctl_t)

-role usernetctl_roles types usernetctl_t;

+#role usernetctl_roles types usernetctl_t;

+role system_r types usernetctl_t;

 ########################################

 #

@@ -63,29 +64,30 @@ sysnet_read_config(usernetctl_t)

 userdom_use_inherited_user_terminals(usernetctl_t)

-sysnet_run_ifconfig(usernetctl_t, usernetctl_roles)

-sysnet_run_dhcpc(usernetctl_t, usernetctl_roles)

+#sysnet_run_ifconfig(usernetctl_t, usernetctl_roles)

+#sysnet_run_dhcpc(usernetctl_t, usernetctl_roles)

 optional_policy(`

-	consoletype_run(usernetctl_t, usernetctl_roles)

+	#consoletype_run(usernetctl_t, usernetctl_roles)

+	consoletype_exec(usernetctl_t)

 ')

 optional_policy(`

 	hostname_exec(usernetctl_t)

 ')

-optional_policy(`

-	iptables_run(usernetctl_t, usernetctl_roles)

-')

+#optional_policy(`

+#	iptables_run(usernetctl_t, usernetctl_roles)

+#')

-optional_policy(`

-	modutils_run_insmod(usernetctl_t, usernetctl_roles)

-')

+#optional_policy(`

+#	modutils_run_insmod(usernetctl_t, usernetctl_roles)

+#')

 optional_policy(`

 	nis_use_ypbind(usernetctl_t)

 ')

-optional_policy(`

-	ppp_run(usernetctl_t, usernetctl_roles)

-')

+#optional_policy(`

+#	ppp_run(usernetctl_t, usernetctl_roles)

+#')

diff --git a/vpn.if b/vpn.if

index 7b93e07..a4e2f60 100644

--- a/vpn.if

+++ b/vpn.if

@@ -37,11 +37,16 @@ interface(`vpn_domtrans',`

 #

 interface(`vpn_run',`

 	gen_require(`

-		attribute_role vpnc_roles;

+		#attribute_role vpnc_roles;

+		type vpnc_t;

 	')

+	#vpn_domtrans($1)

+	#roleattribute $2 vpnc_roles;

+

 	vpn_domtrans($1)

-	roleattribute $2 vpnc_roles;

+        role $2 types vpnc_t;

+        sysnet_run_ifconfig(vpnc_t, $2)

 ')

 ########################################

diff --git a/vpn.te b/vpn.te

index 99fd457..d2585bb 100644

--- a/vpn.te

+++ b/vpn.te

@@ -5,14 +5,15 @@ policy_module(vpn, 1.15.0)

 # Declarations

 #

-attribute_role vpnc_roles;

-roleattribute system_r vpnc_roles;

+#attribute_role vpnc_roles;

+#roleattribute system_r vpnc_roles;

 type vpnc_t;

 type vpnc_exec_t;

 init_system_domain(vpnc_t, vpnc_exec_t)

 application_domain(vpnc_t, vpnc_exec_t)

-role vpnc_roles types vpnc_t;

+#role vpnc_roles types vpnc_t;

+role system_r types vpnc_t;

 type vpnc_tmp_t;

 files_tmp_file(vpnc_tmp_t)

@@ -108,7 +109,7 @@ miscfiles_read_localization(vpnc_t)

 seutil_dontaudit_search_config(vpnc_t)

 seutil_use_newrole_fds(vpnc_t)

-sysnet_run_ifconfig(vpnc_t, vpnc_roles)

+#sysnet_run_ifconfig(vpnc_t, vpnc_roles)

 sysnet_etc_filetrans_config(vpnc_t)

 sysnet_manage_config(vpnc_t)

commit 88b64bdd71ef734271b9370fc37e02785f354f7f

Author: Miroslav Grepl <mgrepl@redhat.com>

Date:   Thu Jun 7 02:33:40 2012 +0200

    Fix ncftool.if

diff --git a/ncftool.if b/ncftool.if

index 3a4455f..59f096b 100644

--- a/ncftool.if

+++ b/ncftool.if

@@ -43,11 +43,12 @@ interface(`ncftool_run',`

         #ncftool_domtrans($1)

         #roleattribute $2 ncftool_roles;

-	role $1 types ncftool_t;

+	ncftool_domtrans($1)

+        role $2 types ncftool_t;

-        ncftool_domtrans($2)

+        optional_policy(`

+                brctl_run(ncftool_t, $2)

+        ')

-        ps_process_pattern($2, ncftool_t)

-        allow $2 ncftool_t:process signal;

 ')

commit 1d49e7e1383a578e75d16b0b7f58dbe25351b1d9

Author: Miroslav Grepl <mgrepl@redhat.com>

Date:   Thu Jun 7 10:47:57 2012 +0200

    roleattriburte temp fixes for portage and dpkg

diff --git a/dpkg.if b/dpkg.if

index 4d32b42..d945bd0 100644

--- a/dpkg.if

+++ b/dpkg.if

@@ -62,11 +62,18 @@ interface(`dpkg_domtrans_script',`

 #

 interface(`dpkg_run',`

 	gen_require(`

-		attribute_role dpkg_roles;

+		#attribute_role dpkg_roles;

+		type dpkg_t, dpkg_script_t		

 	')

+	#dpkg_domtrans($1)

+	#roleattribute $2 dpkg_roles;

+

 	dpkg_domtrans($1)

-	roleattribute $2 dpkg_roles;

+        role $2 types dpkg_t;

+        role $2 types dpkg_script_t;

+        seutil_run_loadpolicy(dpkg_script_t, $2)

+

 ')

 ########################################

diff --git a/dpkg.te b/dpkg.te

index a1b8f92..9ac1b80 100644

--- a/dpkg.te

+++ b/dpkg.te

@@ -5,8 +5,8 @@ policy_module(dpkg, 1.9.1)

 # Declarations

 #

-attribute_role dpkg_roles;

-roleattribute system_r dpkg_roles;

+#attribute_role dpkg_roles;

+#roleattribute system_r dpkg_roles;

 type dpkg_t;

 type dpkg_exec_t;

@@ -17,7 +17,8 @@ domain_obj_id_change_exemption(dpkg_t)

 domain_role_change_exemption(dpkg_t)

 domain_system_change_exemption(dpkg_t)

 domain_interactive_fd(dpkg_t)

-role dpkg_roles types dpkg_t;

+#role dpkg_roles types dpkg_t;

+role system_r types dpkg_t;

 # lockfile

 type dpkg_lock_t;

@@ -41,7 +42,8 @@ corecmd_shell_entry_type(dpkg_script_t)

 domain_obj_id_change_exemption(dpkg_script_t)

 domain_system_change_exemption(dpkg_script_t)

 domain_interactive_fd(dpkg_script_t)

-role dpkg_roles types dpkg_script_t;

+#role dpkg_roles types dpkg_script_t;

+role system_r types dpkg_script_t;

 type dpkg_script_tmp_t;

 files_tmp_file(dpkg_script_tmp_t)

@@ -152,9 +154,12 @@ files_exec_etc_files(dpkg_t)

 init_domtrans_script(dpkg_t)

 init_use_script_ptys(dpkg_t)

+#libs_exec_ld_so(dpkg_t)

+#libs_exec_lib_files(dpkg_t)

+#libs_run_ldconfig(dpkg_t, dpkg_roles)

 libs_exec_ld_so(dpkg_t)

 libs_exec_lib_files(dpkg_t)

-libs_run_ldconfig(dpkg_t, dpkg_roles)

+libs_domtrans_ldconfig(dpkg_t)

 logging_send_syslog_msg(dpkg_t)

@@ -196,19 +201,30 @@ domain_signull_all_domains(dpkg_t)

 files_read_etc_runtime_files(dpkg_t)

 files_exec_usr_files(dpkg_t)

 miscfiles_read_localization(dpkg_t)

-modutils_run_depmod(dpkg_t, dpkg_roles)

-modutils_run_insmod(dpkg_t, dpkg_roles)

-seutil_run_loadpolicy(dpkg_t, dpkg_roles)

-seutil_run_setfiles(dpkg_t, dpkg_roles)

+#modutils_run_depmod(dpkg_t, dpkg_roles)

+#modutils_run_insmod(dpkg_t, dpkg_roles)

+#seutil_run_loadpolicy(dpkg_t, dpkg_roles)

+#seutil_run_setfiles(dpkg_t, dpkg_roles)

 userdom_use_all_users_fds(dpkg_t)

 optional_policy(`

 	mta_send_mail(dpkg_t)

 ')

+

+

 optional_policy(`

-	usermanage_run_groupadd(dpkg_t, dpkg_roles)

-	usermanage_run_useradd(dpkg_t, dpkg_roles)

+        modutils_domtrans_depmod(dpkg_t)

+        modutils_domtrans_insmod(dpkg_t)

+	seutil_domtrans_loadpolicy(dpkg_t)

+	seutil_domtrans_setfiles(dpkg_t)

+        usermanage_domtrans_groupadd(dpkg_t)

+        usermanage_domtrans_useradd(dpkg_t)

 ')

+#optional_policy(`

+#	usermanage_run_groupadd(dpkg_t, dpkg_roles)

+#	usermanage_run_useradd(dpkg_t, dpkg_roles)

+#')

+

 ########################################

 #

 # dpkg-script Local policy

@@ -302,11 +318,11 @@ logging_send_syslog_msg(dpkg_script_t)

 miscfiles_read_localization(dpkg_script_t)

-modutils_run_depmod(dpkg_script_t, dpkg_roles)

-modutils_run_insmod(dpkg_script_t, dpkg_roles)

+#modutils_run_depmod(dpkg_script_t, dpkg_roles)

+#modutils_run_insmod(dpkg_script_t, dpkg_roles)

-seutil_run_loadpolicy(dpkg_script_t, dpkg_roles)

-seutil_run_setfiles(dpkg_script_t, dpkg_roles)

+#seutil_run_loadpolicy(dpkg_script_t, dpkg_roles)

+#seutil_run_setfiles(dpkg_script_t, dpkg_roles)

 userdom_use_all_users_fds(dpkg_script_t)

@@ -319,9 +335,9 @@ optional_policy(`

 	apt_use_fds(dpkg_script_t)

 ')

-optional_policy(`

-	bootloader_run(dpkg_script_t, dpkg_roles)

-')

+#optional_policy(`

+#	bootloader_run(dpkg_script_t, dpkg_roles)

+#')

 optional_policy(`

 	mta_send_mail(dpkg_script_t)

@@ -335,7 +351,7 @@ optional_policy(`

 	unconfined_domain(dpkg_script_t)

 ')

-optional_policy(`

-	usermanage_run_groupadd(dpkg_script_t, dpkg_roles)

-	usermanage_run_useradd(dpkg_script_t, dpkg_roles)

-')

+#optional_policy(`

+#	usermanage_run_groupadd(dpkg_script_t, dpkg_roles)

+#	usermanage_run_useradd(dpkg_script_t, dpkg_roles)

+#')

diff --git a/portage.if b/portage.if

index b4bb48a..e5e8f12 100644

--- a/portage.if

+++ b/portage.if

@@ -43,11 +43,15 @@ interface(`portage_domtrans',`

 #

 interface(`portage_run',`

 	gen_require(`

-		attribute_role portage_roles;

+		type portage_t, portage_fetch_t, portage_sandbox_t;

+		#attribute_role portage_roles;

 	')

-	portage_domtrans($1)

-	roleattribute $2 portage_roles;

+	#portage_domtrans($1)

+	#roleattribute $2 portage_roles;

+	    portage_domtrans($1)

+    role $2 types { portage_t portage_fetch_t portage_sandbox_t }

+

 ')

 ########################################

diff --git a/portage.te b/portage.te

index 22bdf7d..f726e1d 100644

--- a/portage.te

+++ b/portage.te

@@ -12,7 +12,7 @@ policy_module(portage, 1.12.4)

 ## </desc>

 gen_tunable(portage_use_nfs, false)