From e359546c5ac7ec332a0cf4cd8c22629ce314905d Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@fedoraproject.org>
Date: Feb 12 2008 17:47:56 +0000
Subject: - More fixes for polkit


---

diff --git a/policy-20071130.patch b/policy-20071130.patch
index fadb74c..560400f 100644
--- a/policy-20071130.patch
+++ b/policy-20071130.patch
@@ -2452,7 +2452,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if s
  ########################################
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.2.7/policy/modules/apps/gpg.te
 --- nsaserefpolicy/policy/modules/apps/gpg.te	2007-12-19 05:32:09.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/apps/gpg.te	2008-02-11 14:16:30.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/apps/gpg.te	2008-02-12 12:01:08.000000000 -0500
 @@ -7,15 +7,232 @@
  #
  
@@ -2549,7 +2549,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s
 +# GPG helper local policy
 +#
 +
-+allow gpg_helper_t self:process getsched;
++allow gpg_helper_t self:process { getsched setsched };
 +
 +# for helper programs (which automatically fetch keys)
 +# Note: this is only tested with the hkp interface. If you use eg the 
@@ -5647,7 +5647,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  # etc_runtime_t is the type of various
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.2.7/policy/modules/kernel/filesystem.if
 --- nsaserefpolicy/policy/modules/kernel/filesystem.if	2007-10-24 15:00:24.000000000 -0400
-+++ serefpolicy-3.2.7/policy/modules/kernel/filesystem.if	2008-02-06 11:02:29.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/kernel/filesystem.if	2008-02-12 09:41:43.000000000 -0500
 @@ -310,6 +310,25 @@
  
  ########################################
@@ -5735,6 +5735,90 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
  ##	Relabel block nodes on tmpfs filesystems.
  ## </summary>
  ## <param name="domain">
+@@ -3551,3 +3608,83 @@
+ 	relabelfrom_blk_files_pattern($1,noxattrfs,noxattrfs)
+ 	relabelfrom_chr_files_pattern($1,noxattrfs,noxattrfs)
+ ')
++
++########################################
++## <summary>
++##	Create, read, write, and delete directories
++##	on a FUSEFS filesystem.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++## <rolecap/>
++#
++interface(`fs_manage_fusefs_dirs',`
++	gen_require(`
++		type fusefs_t;
++	')
++
++	allow $1 fusefs_t:dir manage_dir_perms;
++')
++
++########################################
++## <summary>
++##	Do not audit attempts to create, read,
++##	write, and delete directories
++##	on a FUSEFS filesystem.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain to not audit.
++##	</summary>
++## </param>
++#
++interface(`fs_dontaudit_manage_fusefs_dirs',`
++	gen_require(`
++		type fusefs_t;
++	')
++
++	dontaudit $1 fusefs_t:dir manage_dir_perms;
++')
++
++########################################
++## <summary>
++##	Create, read, write, and delete files
++##	on a FUSEFS filesystem.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++## <rolecap/>
++#
++interface(`fs_manage_fusefs_files',`
++	gen_require(`
++		type fusefs_t;
++	')
++
++	manage_files_pattern($1,fusefs_t,fusefs_t)
++')
++
++########################################
++## <summary>
++##	Do not audit attempts to create,
++##	read, write, and delete files
++##	on a FUSEFS filesystem.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain to not audit.
++##	</summary>
++## </param>
++#
++interface(`fs_dontaudit_manage_fusefs_files',`
++	gen_require(`
++		type fusefs_t;
++	')
++
++	dontaudit $1 fusefs_t:file manage_file_perms;
++')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.2.7/policy/modules/kernel/filesystem.te
 --- nsaserefpolicy/policy/modules/kernel/filesystem.te	2007-12-19 05:32:07.000000000 -0500
 +++ serefpolicy-3.2.7/policy/modules/kernel/filesystem.te	2008-02-06 11:02:29.000000000 -0500
@@ -9223,7 +9307,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.2.7/policy/modules/services/cups.te
 --- nsaserefpolicy/policy/modules/services/cups.te	2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/services/cups.te	2008-02-06 11:02:29.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/services/cups.te	2008-02-12 10:06:49.000000000 -0500
 @@ -43,14 +43,12 @@
  
  type cupsd_var_run_t;
@@ -9443,7 +9527,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
  
  fs_getattr_all_fs(cupsd_config_t)
  fs_search_auto_mountpoints(cupsd_config_t)
-@@ -372,6 +404,10 @@
+@@ -353,6 +385,7 @@
+ logging_send_syslog_msg(cupsd_config_t)
+ 
+ miscfiles_read_localization(cupsd_config_t)
++miscfiles_read_hwdata(cupsd_config_t)
+ 
+ seutil_dontaudit_search_config(cupsd_config_t)
+ 
+@@ -372,6 +405,10 @@
  ')
  
  optional_policy(`
@@ -9454,7 +9546,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
  	cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
  ')
  
-@@ -387,6 +423,7 @@
+@@ -387,6 +424,7 @@
  optional_policy(`
  	hal_domtrans(cupsd_config_t)
  	hal_read_tmp_files(cupsd_config_t)
@@ -9462,7 +9554,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
  ')
  
  optional_policy(`
-@@ -499,14 +536,12 @@
+@@ -499,14 +537,12 @@
  allow hplip_t self:udp_socket create_socket_perms;
  allow hplip_t self:rawip_socket create_socket_perms;
  
@@ -9481,7 +9573,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
  
  manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t)
  files_pid_filetrans(hplip_t,hplip_var_run_t,file)
-@@ -537,14 +572,14 @@
+@@ -537,14 +573,14 @@
  dev_read_urand(hplip_t)
  dev_read_rand(hplip_t)
  dev_rw_generic_usb_dev(hplip_t)
@@ -9498,7 +9590,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
  domain_use_interactive_fds(hplip_t)
  
  files_read_etc_files(hplip_t)
-@@ -565,6 +600,7 @@
+@@ -565,6 +601,7 @@
  userdom_dontaudit_search_all_users_home_content(hplip_t)
  
  lpd_read_config(cupsd_t)
@@ -9851,7 +9943,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru
  # Local policy
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.7/policy/modules/services/dbus.if
 --- nsaserefpolicy/policy/modules/services/dbus.if	2007-12-04 11:02:50.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/services/dbus.if	2008-02-11 17:07:47.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/services/dbus.if	2008-02-12 12:42:53.000000000 -0500
 @@ -53,6 +53,7 @@
  	gen_require(`
  		type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t;
@@ -9860,7 +9952,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  	')
  
  	##############################
-@@ -84,14 +85,20 @@
+@@ -64,8 +65,6 @@
+ 	domain_entry_file($1_dbusd_t,system_dbusd_exec_t)
+ 	role $3 types $1_dbusd_t;
+ 
+-	type $1_dbusd_$1_t;
+-
+ 	type $1_dbusd_tmp_t;
+ 	files_tmp_file($1_dbusd_tmp_t)
+ 
+@@ -84,14 +83,18 @@
  	allow $1_dbusd_t self:tcp_socket create_stream_socket_perms;
  	allow $1_dbusd_t self:netlink_selinux_socket create_socket_perms;
  
@@ -9869,12 +9970,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
 +
  	# For connecting to the bus
 -	allow $2 $1_dbusd_t:unix_stream_socket connectto;
+-	type_change $2 $1_dbusd_t:dbus $1_dbusd_$1_t;
 +	allow $2 $1_dbusd_t:unix_stream_socket { getattr connectto };
 +	allow $2 $1_dbusd_t:unix_dgram_socket getattr;
- 	type_change $2 $1_dbusd_t:dbus $1_dbusd_$1_t;
  
  	# SE-DBus specific permissions
- 	allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
+-	allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
  	allow $2 $1_dbusd_t:dbus { send_msg acquire_svc };
 -	allow $1_t system_dbusd_t:dbus { send_msg acquire_svc };
 +	allow $1_dbusd_t $2:dbus send_msg;
@@ -9883,7 +9984,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  
  	allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms;
  	read_files_pattern($1_dbusd_t,dbusd_etc_t,dbusd_etc_t)
-@@ -102,10 +109,9 @@
+@@ -102,10 +105,9 @@
  	files_tmp_filetrans($1_dbusd_t, $1_dbusd_tmp_t, { file dir })
  
  	domtrans_pattern($2, system_dbusd_exec_t, $1_dbusd_t)
@@ -9896,7 +9997,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  	allow $1_dbusd_t $2:process sigkill;
  	allow $2 $1_dbusd_t:fd use;
  	allow $2 $1_dbusd_t:fifo_file rw_fifo_file_perms;
-@@ -139,6 +145,7 @@
+@@ -139,6 +141,7 @@
  
  	fs_getattr_romfs($1_dbusd_t)
  	fs_getattr_xattr_fs($1_dbusd_t)
@@ -9904,7 +10005,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  
  	selinux_get_fs_mount($1_dbusd_t)
  	selinux_validate_context($1_dbusd_t)
-@@ -161,12 +168,23 @@
+@@ -161,12 +164,23 @@
  	seutil_read_config($1_dbusd_t)
  	seutil_read_default_contexts($1_dbusd_t)
  
@@ -9912,7 +10013,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
 +	userdom_dontaudit_search_sysadm_home_dirs($1_dbusd_t)
 +	userdom_read_unpriv_users_home_content_files($1_dbusd_t)
 +	userdom_dontaudit_append_unpriv_home_content_files($1_dbusd_t)
-+	userdom_dontaudit_use_user_terminals($1, $1_dbusd_t)
++	term_dontaudit_use_all_user_ptys($1_dbusd_t)
  
  	ifdef(`hide_broken_symptoms', `
  		dontaudit $2 $1_dbusd_t:netlink_selinux_socket { read write };
@@ -9929,7 +10030,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  	tunable_policy(`read_default_t',`
  		files_list_default($1_dbusd_t)
  		files_read_default_files($1_dbusd_t)
-@@ -182,6 +200,7 @@
+@@ -182,6 +196,7 @@
  	optional_policy(`
  		xserver_use_xdm_fds($1_dbusd_t)
  		xserver_rw_xdm_pipes($1_dbusd_t)
@@ -9937,17 +10038,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  	')
  ')
  
-@@ -214,7 +233,8 @@
+@@ -209,12 +224,9 @@
+ 		class dbus send_msg;
+ 	')
  
+-#	type $1_dbusd_system_t;
+-#	type_change $2 system_dbusd_t:dbus $1_dbusd_system_t;
+-
  	# SE-DBus specific permissions
- #	allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
+-#	allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
 -	allow $2 { system_dbusd_t self }:dbus send_msg;
 +	allow $2 { system_dbusd_t $2 }:dbus send_msg;
 +	allow system_dbusd_t $2:dbus send_msg;
  
  	read_files_pattern($2, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
  	files_search_var_lib($2)
-@@ -223,6 +243,10 @@
+@@ -223,6 +235,10 @@
  	files_search_pids($2)
  	stream_connect_pattern($2,system_dbusd_var_run_t,system_dbusd_var_run_t,system_dbusd_t)
  	dbus_read_config($2)
@@ -9958,7 +10064,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  ')
  
  #######################################
-@@ -251,6 +275,7 @@
+@@ -251,18 +267,16 @@
  template(`dbus_user_bus_client_template',`
  	gen_require(`
  		type $1_dbusd_t;
@@ -9966,7 +10072,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  		class dbus send_msg;
  	')
  
-@@ -263,6 +288,7 @@
+-#	type $2_dbusd_$1_t;
+-#	type_change $3 $1_dbusd_t:dbus $2_dbusd_$1_t;
+-
+ 	# SE-DBus specific permissions
+-#	allow $2_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
+ 	allow $3 { $1_dbusd_t self }:dbus send_msg;
  
  	# For connecting to the bus
  	allow $3 $1_dbusd_t:unix_stream_socket connectto;
@@ -9974,7 +10085,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  ')
  
  ########################################
-@@ -292,6 +318,59 @@
+@@ -292,6 +306,59 @@
  
  ########################################
  ## <summary>
@@ -10034,7 +10145,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  ##	Read dbus configuration.
  ## </summary>
  ## <param name="domain">
-@@ -366,3 +445,55 @@
+@@ -366,3 +433,55 @@
  
  	allow $1 system_dbusd_t:dbus *;
  ')
@@ -16181,8 +16292,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.2.7/policy/modules/services/prelude.te
 --- nsaserefpolicy/policy/modules/services/prelude.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/services/prelude.te	2008-02-08 14:54:04.000000000 -0500
-@@ -0,0 +1,140 @@
++++ serefpolicy-3.2.7/policy/modules/services/prelude.te	2008-02-12 12:37:44.000000000 -0500
+@@ -0,0 +1,142 @@
 +policy_module(prelude,1.0.0)
 +
 +########################################
@@ -16250,6 +16361,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel
 +manage_dirs_pattern(prelude_t,prelude_spool_t,prelude_spool_t)
 +manage_files_pattern(prelude_t,prelude_spool_t,prelude_spool_t)
 +
++auth_use_nsswitch(prelude_t)
++
 +libs_use_ld_so(prelude_t)
 +libs_use_shared_libs(prelude_t)
 +
@@ -18021,7 +18134,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.2.7/policy/modules/services/samba.te
 --- nsaserefpolicy/policy/modules/services/samba.te	2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/services/samba.te	2008-02-08 14:53:50.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/services/samba.te	2008-02-12 09:43:12.000000000 -0500
 @@ -26,28 +26,28 @@
  
  ## <desc>
@@ -18055,7 +18168,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  ## </p>
  ## </desc>
  gen_tunable(samba_run_unconfined,false)
-@@ -73,11 +73,9 @@
+@@ -59,6 +59,13 @@
+ ## </desc>
+ gen_tunable(samba_share_nfs,false)
+ 
++## <desc>
++## <p>
++## Allow samba to export ntfs/fusefs volumes.
++## </p>
++## </desc>
++gen_tunable(samba_share_fusefs,false)
++
+ type nmbd_t;
+ type nmbd_exec_t;
+ init_daemon_domain(nmbd_t,nmbd_exec_t)
+@@ -73,11 +80,9 @@
  logging_log_file(samba_log_t)
  
  type samba_net_t;
@@ -18069,7 +18196,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  
  type samba_net_tmp_t;
  files_tmp_file(samba_net_tmp_t)
-@@ -139,6 +137,14 @@
+@@ -139,6 +144,14 @@
  type winbind_var_run_t;
  files_pid_file(winbind_var_run_t)
  
@@ -18084,7 +18211,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  ########################################
  #
  # Samba net local policy
-@@ -193,7 +199,10 @@
+@@ -193,7 +206,10 @@
  
  miscfiles_read_localization(samba_net_t) 
  
@@ -18095,7 +18222,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  
  optional_policy(`
  	kerberos_use(samba_net_t)
-@@ -213,7 +222,7 @@
+@@ -213,7 +229,7 @@
  allow smbd_t self:msgq create_msgq_perms;
  allow smbd_t self:sem create_sem_perms;
  allow smbd_t self:shm create_shm_perms;
@@ -18104,7 +18231,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  allow smbd_t self:tcp_socket create_stream_socket_perms;
  allow smbd_t self:udp_socket create_socket_perms;
  allow smbd_t self:unix_dgram_socket { create_socket_perms sendto };
-@@ -221,10 +230,8 @@
+@@ -221,10 +237,8 @@
  
  allow smbd_t samba_etc_t:file { rw_file_perms setattr };
  
@@ -18117,7 +18244,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  
  allow smbd_t samba_net_tmp_t:file getattr;
  
-@@ -234,6 +241,7 @@
+@@ -234,6 +248,7 @@
  manage_dirs_pattern(smbd_t,samba_share_t,samba_share_t)
  manage_files_pattern(smbd_t,samba_share_t,samba_share_t)
  manage_lnk_files_pattern(smbd_t,samba_share_t,samba_share_t)
@@ -18125,7 +18252,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  
  manage_dirs_pattern(smbd_t,samba_var_t,samba_var_t)
  manage_files_pattern(smbd_t,samba_var_t,samba_var_t)
-@@ -251,7 +259,7 @@
+@@ -251,7 +266,7 @@
  manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t)
  files_pid_filetrans(smbd_t,smbd_var_run_t,file)
  
@@ -18134,7 +18261,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  
  kernel_getattr_core_if(smbd_t)
  kernel_getattr_message_if(smbd_t)
-@@ -320,6 +328,8 @@
+@@ -320,6 +335,8 @@
  userdom_dontaudit_use_unpriv_user_fds(smbd_t)
  userdom_use_unpriv_users_fds(smbd_t)
  
@@ -18143,7 +18270,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  ifdef(`hide_broken_symptoms', `
  	files_dontaudit_getattr_default_dirs(smbd_t)
  	files_dontaudit_getattr_boot_dirs(smbd_t)
-@@ -340,6 +350,17 @@
+@@ -340,6 +357,23 @@
  tunable_policy(`samba_share_nfs',`
  	fs_manage_nfs_dirs(smbd_t)
  	fs_manage_nfs_files(smbd_t)
@@ -18152,6 +18279,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
 +	fs_manage_nfs_named_sockets(smbd_t)
 +')
 +
++# Support Samba sharing of ntfs/fusefs mount points
++tunable_policy(`samba_share_fusefs',`
++	fs_manage_fusefs_dirs(smbd_t)
++	fs_manage_fusefs_files(smbd_t)
++')
++
 +optional_policy(`
 +	kerberos_read_keytab(smbd_t)
 +')
@@ -18161,7 +18294,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  ')
  
  optional_policy(`
-@@ -391,7 +412,7 @@
+@@ -391,7 +425,7 @@
  allow nmbd_t self:msgq create_msgq_perms;
  allow nmbd_t self:sem create_sem_perms;
  allow nmbd_t self:shm create_shm_perms;
@@ -18170,7 +18303,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  allow nmbd_t self:tcp_socket create_stream_socket_perms;
  allow nmbd_t self:udp_socket create_socket_perms;
  allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto };
-@@ -403,8 +424,7 @@
+@@ -403,8 +437,7 @@
  read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t)
  
  manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t)
@@ -18180,7 +18313,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  
  read_files_pattern(nmbd_t,samba_log_t,samba_log_t)
  create_files_pattern(nmbd_t,samba_log_t,samba_log_t)
-@@ -439,6 +459,7 @@
+@@ -439,6 +472,7 @@
  dev_getattr_mtrr_dev(nmbd_t)
  
  fs_getattr_all_fs(nmbd_t)
@@ -18188,7 +18321,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  fs_search_auto_mountpoints(nmbd_t)
  
  domain_use_interactive_fds(nmbd_t)
-@@ -522,6 +543,7 @@
+@@ -522,6 +556,7 @@
  storage_raw_write_fixed_disk(smbmount_t)
  
  term_list_ptys(smbmount_t)
@@ -18196,7 +18329,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  
  corecmd_list_bin(smbmount_t)
  
-@@ -546,28 +568,37 @@
+@@ -546,28 +581,37 @@
  
  userdom_use_all_users_fds(smbmount_t)
  
@@ -18241,7 +18374,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  allow swat_t smbd_var_run_t:file read;
  
  manage_dirs_pattern(swat_t,swat_tmp_t,swat_tmp_t)
-@@ -577,7 +608,9 @@
+@@ -577,7 +621,9 @@
  manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t)
  files_pid_filetrans(swat_t,swat_var_run_t,file)
  
@@ -18252,7 +18385,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  
  kernel_read_kernel_sysctls(swat_t)
  kernel_read_system_state(swat_t)
-@@ -602,6 +635,7 @@
+@@ -602,6 +648,7 @@
  
  dev_read_urand(swat_t)
  
@@ -18260,7 +18393,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  files_read_etc_files(swat_t)
  files_search_home(swat_t)
  files_read_usr_files(swat_t)
-@@ -614,6 +648,7 @@
+@@ -614,6 +661,7 @@
  libs_use_shared_libs(swat_t)
  
  logging_send_syslog_msg(swat_t)
@@ -18268,7 +18401,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  logging_search_logs(swat_t)
  
  miscfiles_read_localization(swat_t)
-@@ -631,6 +666,17 @@
+@@ -631,6 +679,17 @@
  	kerberos_use(swat_t)
  ')
  
@@ -18286,7 +18419,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  ########################################
  #
  # Winbind local policy
-@@ -679,6 +725,8 @@
+@@ -679,6 +738,8 @@
  manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t)
  files_pid_filetrans(winbind_t,winbind_var_run_t,file)
  
@@ -18295,7 +18428,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  kernel_read_kernel_sysctls(winbind_t)
  kernel_list_proc(winbind_t)
  kernel_read_proc_symlinks(winbind_t)
-@@ -766,6 +814,7 @@
+@@ -766,6 +827,7 @@
  optional_policy(`
  	squid_read_log(winbind_helper_t)
  	squid_append_log(winbind_helper_t)
@@ -18303,7 +18436,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  ')
  
  ########################################
-@@ -790,3 +839,37 @@
+@@ -790,3 +852,37 @@
  		domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t)
  	')
  ')
@@ -20992,7 +21125,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  /var/lib/pam_devperm/:0	--	gen_context(system_u:object_r:xdm_var_lib_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.2.7/policy/modules/services/xserver.if
 --- nsaserefpolicy/policy/modules/services/xserver.if	2007-12-04 11:02:50.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/services/xserver.if	2008-02-06 11:02:30.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/services/xserver.if	2008-02-12 12:15:41.000000000 -0500
 @@ -15,6 +15,7 @@
  template(`xserver_common_domain_template',`
  	gen_require(`
@@ -21714,7 +21847,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.2.7/policy/modules/services/xserver.te
 --- nsaserefpolicy/policy/modules/services/xserver.te	2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/services/xserver.te	2008-02-11 14:21:09.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/services/xserver.te	2008-02-12 12:43:50.000000000 -0500
 @@ -16,6 +16,13 @@
  
  ## <desc>
@@ -21919,31 +22052,36 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  
  xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t)
  
-@@ -304,7 +363,23 @@
+@@ -304,7 +363,27 @@
  ')
  
  optional_policy(`
+-	consolekit_dbus_chat(xdm_t)
 +	bootloader_domtrans(xdm_t)
 +')
 +
 +optional_policy(`
 +	consolekit_read_log(xdm_t)
-+')
 +
 +optional_policy(`
- 	consolekit_dbus_chat(xdm_t)
-+	dbus_system_bus_client_template(xdm, xdm_t)
 +	dbus_per_role_template(xdm, xdm_t, system_r)
++	dbus_system_bus_client_template(xdm, xdm_t)
++
++	optional_policy(`
++		consolekit_dbus_chat(xdm_t)
++	')
++
 +	optional_policy(`
 +		hal_dbus_chat(xdm_t)
 +	')
++
 +	optional_policy(`
 +		networkmanager_dbus_chat(xdm_t)
 +	')
  ')
  
  optional_policy(`
-@@ -322,6 +397,10 @@
+@@ -322,6 +401,10 @@
  ')
  
  optional_policy(`
@@ -21954,7 +22092,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  	loadkeys_exec(xdm_t)
  ')
  
-@@ -335,6 +414,11 @@
+@@ -335,6 +418,11 @@
  ')
  
  optional_policy(`
@@ -21966,7 +22104,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  	seutil_sigchld_newrole(xdm_t)
  ')
  
-@@ -343,8 +427,8 @@
+@@ -343,8 +431,8 @@
  ')
  
  optional_policy(`
@@ -21976,7 +22114,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  
  	ifndef(`distro_redhat',`
  		allow xdm_t self:process { execheap execmem };
-@@ -380,7 +464,7 @@
+@@ -380,7 +468,7 @@
  allow xdm_xserver_t xdm_var_lib_t:file { getattr read };
  dontaudit xdm_xserver_t xdm_var_lib_t:dir search;
  
@@ -21985,7 +22123,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  
  # Label pid and temporary files with derived types.
  manage_files_pattern(xdm_xserver_t,xdm_tmp_t,xdm_tmp_t)
-@@ -392,6 +476,15 @@
+@@ -392,6 +480,15 @@
  can_exec(xdm_xserver_t, xkb_var_lib_t)
  files_search_var_lib(xdm_xserver_t)
  
@@ -22001,7 +22139,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  # VNC v4 module in X server
  corenet_tcp_bind_vnc_port(xdm_xserver_t)
  
-@@ -404,6 +497,7 @@
+@@ -404,6 +501,7 @@
  # to read ROLE_home_t - examine this in more detail
  # (xauth?)
  userdom_read_unpriv_users_home_content_files(xdm_xserver_t)
@@ -22009,7 +22147,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  
  xserver_use_all_users_fonts(xdm_xserver_t)
  
-@@ -420,6 +514,14 @@
+@@ -420,6 +518,14 @@
  ')
  
  optional_policy(`
@@ -22024,7 +22162,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  	resmgr_stream_connect(xdm_t)
  ')
  
-@@ -429,47 +531,103 @@
+@@ -429,47 +535,103 @@
  ')
  
  optional_policy(`
@@ -22048,6 +22186,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
 +	# xserver signals unconfined user on startx
 +	unconfined_signal(xdm_xserver_t)
 +	unconfined_getpgid(xdm_xserver_t)
++')
++
++
++tunable_policy(`allow_xserver_execmem', `
++	allow xdm_xserver_t self:process { execheap execmem execstack };
++')
++
++ifndef(`distro_redhat',`
++	allow xdm_xserver_t self:process { execheap execmem };
  ')
  
 -ifdef(`TODO',`
@@ -22071,19 +22218,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
 -allow xdm_t polymember:lnk_file { create unlink };
 -# xdm needs access for copying .Xauthority into new home
 -allow xdm_t polymember:file { create getattr write };
-+
-+tunable_policy(`allow_xserver_execmem', `
-+	allow xdm_xserver_t self:process { execheap execmem execstack };
- ')
- 
-+ifndef(`distro_redhat',`
-+	allow xdm_xserver_t self:process { execheap execmem };
-+')
-+
 +ifdef(`distro_rhel4',`
 +	allow xdm_xserver_t self:process { execheap execmem };
-+')
-+
+ ')
+ 
 +##############################
  #
 -# Wants to delete .xsession-errors file
@@ -25316,8 +25454,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
  	xen_append_log(ifconfig_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.2.7/policy/modules/system/udev.te
 --- nsaserefpolicy/policy/modules/system/udev.te	2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/system/udev.te	2008-02-06 11:02:30.000000000 -0500
-@@ -96,9 +96,6 @@
++++ serefpolicy-3.2.7/policy/modules/system/udev.te	2008-02-12 12:02:58.000000000 -0500
+@@ -83,6 +83,7 @@
+ kernel_rw_unix_dgram_sockets(udev_t)
+ kernel_dgram_send(udev_t)
+ kernel_signal(udev_t)
++kernel_search_debugfs(udev_t)
+ 
+ #https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182
+ kernel_rw_net_sysctls(udev_t)
+@@ -96,9 +97,6 @@
  dev_delete_generic_files(udev_t)
  dev_search_usbfs(udev_t)
  dev_relabel_all_dev_nodes(udev_t)
@@ -25327,7 +25473,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
  
  domain_read_all_domains_state(udev_t)
  domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these 
-@@ -189,6 +186,7 @@
+@@ -189,6 +187,7 @@
  
  optional_policy(`
  	alsa_domtrans(udev_t)
@@ -25335,7 +25481,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
  	alsa_read_rw_config(udev_t)
  ')
  
-@@ -197,6 +195,10 @@
+@@ -197,6 +196,10 @@
  ')
  
  optional_policy(`