diff --git a/policy-F12.patch b/policy-F12.patch
index 2db71b3..9696638 100644
--- a/policy-F12.patch
+++ b/policy-F12.patch
@@ -1,5 +1,5 @@
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.6.32/Makefile
---- nsaserefpolicy/Makefile 2009-08-18 11:41:14.000000000 -0400
+--- nsaserefpolicy/Makefile 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/Makefile 2009-09-30 16:12:48.000000000 -0400
@@ -244,7 +244,7 @@
appdir := $(contextpath)
@@ -11,7 +11,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/Mak
all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.6.32/policy/flask/access_vectors
---- nsaserefpolicy/policy/flask/access_vectors 2009-08-31 13:30:04.000000000 -0400
+--- nsaserefpolicy/policy/flask/access_vectors 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/flask/access_vectors 2009-09-30 16:12:48.000000000 -0400
@@ -349,6 +349,7 @@
syslog_read
@@ -22,7 +22,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
#
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.6.32/policy/global_tunables
---- nsaserefpolicy/policy/global_tunables 2009-07-23 14:11:04.000000000 -0400
+--- nsaserefpolicy/policy/global_tunables 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/global_tunables 2009-09-30 16:12:48.000000000 -0400
@@ -61,15 +61,6 @@
@@ -60,7 +60,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+gen_tunable(mmap_low_allowed, false)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mcs serefpolicy-3.6.32/policy/mcs
---- nsaserefpolicy/policy/mcs 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/mcs 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/mcs 2009-09-30 16:12:48.000000000 -0400
@@ -66,8 +66,8 @@
#
@@ -96,7 +96,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
mlsconstrain process { transition dyntransition }
(( h1 dom h2 ) or ( t1 == mcssetcats ));
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.6.32/policy/modules/admin/alsa.te
---- nsaserefpolicy/policy/modules/admin/alsa.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/alsa.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/alsa.te 2009-10-09 07:40:41.000000000 -0400
@@ -51,6 +51,8 @@
files_read_etc_files(alsa_t)
@@ -108,7 +108,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
init_use_fds(alsa_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.6.32/policy/modules/admin/anaconda.te
---- nsaserefpolicy/policy/modules/admin/anaconda.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/anaconda.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/anaconda.te 2009-09-30 16:12:48.000000000 -0400
@@ -31,6 +31,7 @@
modutils_domtrans_insmod(anaconda_t)
@@ -128,7 +128,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/brctl.te serefpolicy-3.6.32/policy/modules/admin/brctl.te
---- nsaserefpolicy/policy/modules/admin/brctl.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/brctl.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/brctl.te 2009-09-30 16:12:48.000000000 -0400
@@ -21,7 +21,7 @@
allow brctl_t self:unix_dgram_socket create_socket_perms;
@@ -140,7 +140,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_sysctl(brctl_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/certwatch.te serefpolicy-3.6.32/policy/modules/admin/certwatch.te
---- nsaserefpolicy/policy/modules/admin/certwatch.te 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/certwatch.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/certwatch.te 2009-09-30 16:12:48.000000000 -0400
@@ -36,7 +36,7 @@
miscfiles_read_localization(certwatch_t)
@@ -152,7 +152,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
apache_exec_modules(certwatch_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.6.32/policy/modules/admin/consoletype.te
---- nsaserefpolicy/policy/modules/admin/consoletype.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/consoletype.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/consoletype.te 2009-10-07 14:44:15.000000000 -0400
@@ -84,6 +84,7 @@
optional_policy(`
@@ -163,7 +163,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.fc serefpolicy-3.6.32/policy/modules/admin/dmesg.fc
---- nsaserefpolicy/policy/modules/admin/dmesg.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/dmesg.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/dmesg.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,2 +1,4 @@
@@ -171,7 +171,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/usr/sbin/mcelog -- gen_context(system_u:object_r:dmesg_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-3.6.32/policy/modules/admin/dmesg.te
---- nsaserefpolicy/policy/modules/admin/dmesg.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/dmesg.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/dmesg.te 2009-10-06 09:52:38.000000000 -0400
@@ -9,6 +9,7 @@
type dmesg_t;
@@ -215,7 +215,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+#mcelog needs
+dev_read_raw_memory(dmesg_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstboot.te serefpolicy-3.6.32/policy/modules/admin/firstboot.te
---- nsaserefpolicy/policy/modules/admin/firstboot.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/firstboot.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/firstboot.te 2009-09-30 16:12:48.000000000 -0400
@@ -91,8 +91,12 @@
userdom_user_home_dir_filetrans_user_home_content(firstboot_t, { dir file lnk_file fifo_file sock_file })
@@ -240,7 +240,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.fc serefpolicy-3.6.32/policy/modules/admin/kismet.fc
---- nsaserefpolicy/policy/modules/admin/kismet.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/kismet.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/kismet.fc 2009-11-09 13:11:24.000000000 -0500
@@ -1,3 +1,5 @@
+HOME_DIR/\.kismet(/.*)? gen_context(system_u:object_r:kismet_home_t,s0)
@@ -249,7 +249,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/lib/kismet(/.*)? gen_context(system_u:object_r:kismet_var_lib_t,s0)
/var/log/kismet(/.*)? gen_context(system_u:object_r:kismet_log_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.te serefpolicy-3.6.32/policy/modules/admin/kismet.te
---- nsaserefpolicy/policy/modules/admin/kismet.te 2009-08-31 13:30:04.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/kismet.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/kismet.te 2009-11-09 13:10:35.000000000 -0500
@@ -26,6 +26,9 @@
type kismet_var_run_t;
@@ -275,7 +275,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_system_state(kismet_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.6.32/policy/modules/admin/logrotate.te
---- nsaserefpolicy/policy/modules/admin/logrotate.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/logrotate.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/logrotate.te 2009-11-09 11:59:58.000000000 -0500
@@ -32,7 +32,7 @@
# Change ownership on log files.
@@ -324,7 +324,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.6.32/policy/modules/admin/logwatch.te
---- nsaserefpolicy/policy/modules/admin/logwatch.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/logwatch.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/logwatch.te 2009-09-30 16:12:48.000000000 -0400
@@ -136,4 +136,5 @@
@@ -333,7 +333,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ samba_read_share_files(logwatch_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te serefpolicy-3.6.32/policy/modules/admin/mrtg.te
---- nsaserefpolicy/policy/modules/admin/mrtg.te 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/mrtg.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/mrtg.te 2009-09-30 16:12:48.000000000 -0400
@@ -116,6 +116,7 @@
userdom_use_user_terminals(mrtg_t)
@@ -344,7 +344,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
netutils_domtrans_ping(mrtg_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.6.32/policy/modules/admin/netutils.te
---- nsaserefpolicy/policy/modules/admin/netutils.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/netutils.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/netutils.te 2009-10-30 14:18:10.000000000 -0400
@@ -44,6 +44,7 @@
allow netutils_t self:packet_socket create_socket_perms;
@@ -578,7 +578,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+miscfiles_read_localization(ntop_t)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.te serefpolicy-3.6.32/policy/modules/admin/portage.te
---- nsaserefpolicy/policy/modules/admin/portage.te 2009-08-18 18:39:50.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/portage.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/portage.te 2009-09-30 16:12:48.000000000 -0400
@@ -196,7 +196,7 @@
# - for rsync and distfile fetching
@@ -590,7 +590,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow portage_fetch_t self:unix_stream_socket create_socket_perms;
allow portage_fetch_t self:tcp_socket create_stream_socket_perms;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.if serefpolicy-3.6.32/policy/modules/admin/prelink.if
---- nsaserefpolicy/policy/modules/admin/prelink.if 2009-09-16 09:09:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/prelink.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/prelink.if 2009-09-30 16:12:48.000000000 -0400
@@ -151,11 +151,11 @@
##
@@ -607,7 +607,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ relabel_files_pattern($1, prelink_var_lib_t, prelink_var_lib_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.6.32/policy/modules/admin/prelink.te
---- nsaserefpolicy/policy/modules/admin/prelink.te 2009-09-16 09:09:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/prelink.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/prelink.te 2009-10-28 08:45:40.000000000 -0400
@@ -80,6 +80,7 @@
selinux_get_enforce_mode(prelink_t)
@@ -636,7 +636,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
unconfined_domain(prelink_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.6.32/policy/modules/admin/readahead.te
---- nsaserefpolicy/policy/modules/admin/readahead.te 2009-09-16 09:09:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/readahead.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/readahead.te 2009-09-30 16:12:48.000000000 -0400
@@ -52,6 +52,7 @@
@@ -647,7 +647,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_getattr_all_pipes(readahead_t)
files_dontaudit_getattr_all_sockets(readahead_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.6.32/policy/modules/admin/rpm.fc
---- nsaserefpolicy/policy/modules/admin/rpm.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/rpm.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/rpm.fc 2009-10-28 08:38:25.000000000 -0400
@@ -1,18 +1,18 @@
@@ -699,7 +699,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
ifdef(`distro_suse', `
/usr/bin/online_update -- gen_context(system_u:object_r:rpm_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.6.32/policy/modules/admin/rpm.if
---- nsaserefpolicy/policy/modules/admin/rpm.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/rpm.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/rpm.if 2009-11-12 08:20:36.000000000 -0500
@@ -13,11 +13,34 @@
interface(`rpm_domtrans',`
@@ -1111,7 +1111,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.6.32/policy/modules/admin/rpm.te
---- nsaserefpolicy/policy/modules/admin/rpm.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/rpm.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/rpm.te 2009-11-09 12:10:46.000000000 -0500
@@ -15,6 +15,9 @@
domain_interactive_fd(rpm_t)
@@ -1388,7 +1388,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
java_domtrans_unconfined(rpm_script_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewall.fc serefpolicy-3.6.32/policy/modules/admin/shorewall.fc
---- nsaserefpolicy/policy/modules/admin/shorewall.fc 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/shorewall.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/shorewall.fc 2009-10-27 09:33:16.000000000 -0400
@@ -4,8 +4,9 @@
/etc/shorewall(/.*)? gen_context(system_u:object_r:shorewall_etc_t,s0)
@@ -1402,7 +1402,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/lib/shorewall6(/.*)? gen_context(system_u:object_r:shorewall_var_lib_t,s0)
/var/lib/shorewall-lite(/.*)? gen_context(system_u:object_r:shorewall_var_lib_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewall.if serefpolicy-3.6.32/policy/modules/admin/shorewall.if
---- nsaserefpolicy/policy/modules/admin/shorewall.if 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/shorewall.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/shorewall.if 2009-10-27 09:33:58.000000000 -0400
@@ -75,6 +75,46 @@
rw_files_pattern($1, shorewall_var_run_t, shorewall_var_run_t)
@@ -1452,7 +1452,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
## All of the rules required to administrate
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewall.te serefpolicy-3.6.32/policy/modules/admin/shorewall.te
---- nsaserefpolicy/policy/modules/admin/shorewall.te 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/shorewall.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/shorewall.te 2009-09-30 16:12:48.000000000 -0400
@@ -80,6 +80,8 @@
@@ -1547,7 +1547,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+permissive smoltclient_t;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.6.32/policy/modules/admin/sudo.if
---- nsaserefpolicy/policy/modules/admin/sudo.if 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/sudo.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/sudo.if 2009-09-30 16:12:48.000000000 -0400
@@ -66,8 +66,8 @@
allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms;
@@ -1594,7 +1594,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.6.32/policy/modules/admin/tmpreaper.te
---- nsaserefpolicy/policy/modules/admin/tmpreaper.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/tmpreaper.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/tmpreaper.te 2009-11-12 08:20:55.000000000 -0500
@@ -42,6 +42,7 @@
cron_system_entry(tmpreaper_t, tmpreaper_exec_t)
@@ -1626,7 +1626,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
unconfined_domain(tmpreaper_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tzdata.te serefpolicy-3.6.32/policy/modules/admin/tzdata.te
---- nsaserefpolicy/policy/modules/admin/tzdata.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/tzdata.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/tzdata.te 2009-09-30 16:12:48.000000000 -0400
@@ -19,6 +19,8 @@
files_read_etc_files(tzdata_t)
@@ -1638,7 +1638,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
locallogin_dontaudit_use_fds(tzdata_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.6.32/policy/modules/admin/usermanage.if
---- nsaserefpolicy/policy/modules/admin/usermanage.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/usermanage.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/usermanage.if 2009-11-09 09:42:20.000000000 -0500
@@ -113,6 +113,12 @@
files_search_usr($1)
@@ -1666,7 +1666,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
nscd_run(useradd_t, $2)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.6.32/policy/modules/admin/usermanage.te
---- nsaserefpolicy/policy/modules/admin/usermanage.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/usermanage.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/usermanage.te 2009-10-13 18:03:31.000000000 -0400
@@ -82,6 +82,7 @@
selinux_compute_relabel_context(chfn_t)
@@ -1790,7 +1790,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
rpm_rw_pipes(useradd_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.6.32/policy/modules/admin/vbetool.te
---- nsaserefpolicy/policy/modules/admin/vbetool.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/vbetool.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/vbetool.te 2009-10-08 14:37:24.000000000 -0400
@@ -15,15 +15,20 @@
# Local policy
@@ -1825,7 +1825,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ xserver_write_pid(vbetool_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.6.32/policy/modules/admin/vpn.te
---- nsaserefpolicy/policy/modules/admin/vpn.te 2009-08-31 13:30:04.000000000 -0400
+--- nsaserefpolicy/policy/modules/admin/vpn.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/admin/vpn.te 2009-10-09 09:10:49.000000000 -0400
@@ -46,6 +46,7 @@
kernel_read_system_state(vpnc_t)
@@ -1844,7 +1844,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
seutil_dontaudit_search_config(vpnc_t)
seutil_use_newrole_fds(vpnc_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/calamaris.te serefpolicy-3.6.32/policy/modules/apps/calamaris.te
---- nsaserefpolicy/policy/modules/apps/calamaris.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/calamaris.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/calamaris.te 2009-09-30 16:12:48.000000000 -0400
@@ -59,12 +59,12 @@
@@ -2040,7 +2040,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.6.32/policy/modules/apps/cpufreqselector.te
---- nsaserefpolicy/policy/modules/apps/cpufreqselector.te 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/cpufreqselector.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/cpufreqselector.te 2009-09-30 16:12:48.000000000 -0400
@@ -26,7 +26,7 @@
dev_rw_sysfs(cpufreqselector_t)
@@ -2275,7 +2275,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.if serefpolicy-3.6.32/policy/modules/apps/gitosis.if
---- nsaserefpolicy/policy/modules/apps/gitosis.if 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/gitosis.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/gitosis.if 2009-09-30 16:12:48.000000000 -0400
@@ -43,3 +43,48 @@
role $2 types gitosis_t;
@@ -2327,7 +2327,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ manage_dirs_pattern($1, gitosis_var_lib_t, gitosis_var_lib_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.6.32/policy/modules/apps/gnome.fc
---- nsaserefpolicy/policy/modules/apps/gnome.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/gnome.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/gnome.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,8 +1,16 @@
-HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:gnome_home_t,s0)
@@ -2349,7 +2349,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/usr/libexec/gnome-system-monitor-mechanism -- gen_context(system_u:object_r:gnomesystemmm_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.6.32/policy/modules/apps/gnome.if
---- nsaserefpolicy/policy/modules/apps/gnome.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/gnome.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/gnome.if 2009-10-14 10:28:56.000000000 -0400
@@ -89,5 +89,175 @@
@@ -2528,7 +2528,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ stream_connect_pattern($1, gnome_home_t, gnome_home_t, $2)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.6.32/policy/modules/apps/gnome.te
---- nsaserefpolicy/policy/modules/apps/gnome.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/gnome.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/gnome.te 2009-09-30 16:12:48.000000000 -0400
@@ -9,16 +9,18 @@
attribute gnomedomain;
@@ -2659,7 +2659,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ policykit_read_reload(gnomesystemmm_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.6.32/policy/modules/apps/gpg.te
---- nsaserefpolicy/policy/modules/apps/gpg.te 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/gpg.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/gpg.te 2009-09-30 16:12:48.000000000 -0400
@@ -104,12 +104,19 @@
@@ -2706,7 +2706,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.6.32/policy/modules/apps/java.fc
---- nsaserefpolicy/policy/modules/apps/java.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/java.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/java.fc 2009-10-02 08:53:58.000000000 -0400
@@ -2,15 +2,16 @@
# /opt
@@ -2744,7 +2744,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/usr/lib/opera(/.*)?/opera -- gen_context(system_u:object_r:java_exec_t,s0)
+/usr/lib/opera(/.*)?/works -- gen_context(system_u:object_r:java_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.6.32/policy/modules/apps/java.if
---- nsaserefpolicy/policy/modules/apps/java.if 2009-08-18 11:41:14.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/java.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/java.if 2009-10-23 09:22:39.000000000 -0400
@@ -30,6 +30,7 @@
@@ -2890,7 +2890,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ ')
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.6.32/policy/modules/apps/java.te
---- nsaserefpolicy/policy/modules/apps/java.te 2009-08-18 11:41:14.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/java.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/java.te 2009-10-23 08:58:46.000000000 -0400
@@ -20,6 +20,8 @@
typealias java_t alias { staff_javaplugin_t user_javaplugin_t sysadm_javaplugin_t };
@@ -3116,7 +3116,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+seutil_domtrans_setfiles_mac(livecd_t)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.6.32/policy/modules/apps/loadkeys.te
---- nsaserefpolicy/policy/modules/apps/loadkeys.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/loadkeys.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/loadkeys.te 2009-11-03 12:14:31.000000000 -0500
@@ -40,8 +40,12 @@
miscfiles_read_localization(loadkeys_t)
@@ -3133,13 +3133,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ dev_dontaudit_rw_lvm_control_dev(loadkeys_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.fc serefpolicy-3.6.32/policy/modules/apps/mono.fc
---- nsaserefpolicy/policy/modules/apps/mono.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/mono.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/mono.fc 2009-11-09 12:10:45.000000000 -0500
@@ -1 +1 @@
-/usr/bin/mono -- gen_context(system_u:object_r:mono_exec_t,s0)
+/usr/bin/mono.* -- gen_context(system_u:object_r:mono_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.6.32/policy/modules/apps/mono.if
---- nsaserefpolicy/policy/modules/apps/mono.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/mono.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/mono.if 2009-10-17 07:22:40.000000000 -0400
@@ -21,6 +21,105 @@
@@ -3257,7 +3257,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corecmd_search_bin($1)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.6.32/policy/modules/apps/mono.te
---- nsaserefpolicy/policy/modules/apps/mono.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/mono.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/mono.te 2009-09-30 16:12:48.000000000 -0400
@@ -15,7 +15,7 @@
# Local policy
@@ -3283,7 +3283,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ xserver_rw_shm(mono_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.fc serefpolicy-3.6.32/policy/modules/apps/mozilla.fc
---- nsaserefpolicy/policy/modules/apps/mozilla.fc 2009-07-28 13:28:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/mozilla.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/mozilla.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,6 +1,7 @@
HOME_DIR/\.galeon(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
@@ -3294,7 +3294,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.6.32/policy/modules/apps/mozilla.if
---- nsaserefpolicy/policy/modules/apps/mozilla.if 2009-07-28 13:28:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/mozilla.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/mozilla.if 2009-11-10 16:28:27.000000000 -0500
@@ -45,6 +45,18 @@
relabel_dirs_pattern($2, mozilla_home_t, mozilla_home_t)
@@ -3386,7 +3386,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
##
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.6.32/policy/modules/apps/mozilla.te
---- nsaserefpolicy/policy/modules/apps/mozilla.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/mozilla.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/mozilla.te 2009-11-09 13:10:04.000000000 -0500
@@ -59,6 +59,7 @@
manage_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
@@ -4226,7 +4226,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+type openoffice_exec_t;
+application_domain(openoffice_t, openoffice_exec_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/podsleuth.te serefpolicy-3.6.32/policy/modules/apps/podsleuth.te
---- nsaserefpolicy/policy/modules/apps/podsleuth.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/podsleuth.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/podsleuth.te 2009-11-04 08:12:01.000000000 -0500
@@ -71,6 +71,8 @@
@@ -4238,7 +4238,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dbus_system_bus_client(podsleuth_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.6.32/policy/modules/apps/pulseaudio.if
---- nsaserefpolicy/policy/modules/apps/pulseaudio.if 2009-08-31 13:30:04.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/pulseaudio.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/pulseaudio.if 2009-10-05 08:28:56.000000000 -0400
@@ -40,7 +40,7 @@
userdom_manage_tmpfs_role($1, pulseaudio_t)
@@ -4250,7 +4250,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.32/policy/modules/apps/pulseaudio.te
---- nsaserefpolicy/policy/modules/apps/pulseaudio.te 2009-08-31 13:30:04.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/pulseaudio.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/pulseaudio.te 2009-10-21 07:52:28.000000000 -0400
@@ -26,6 +26,7 @@
@@ -4296,7 +4296,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ xserver_common_app(pulseaudio_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.fc serefpolicy-3.6.32/policy/modules/apps/qemu.fc
---- nsaserefpolicy/policy/modules/apps/qemu.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/qemu.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/qemu.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,2 +1,2 @@
-/usr/bin/qemu -- gen_context(system_u:object_r:qemu_exec_t,s0)
@@ -4304,7 +4304,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/usr/bin/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0)
+/usr/libexec/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.if serefpolicy-3.6.32/policy/modules/apps/qemu.if
---- nsaserefpolicy/policy/modules/apps/qemu.if 2009-08-31 13:44:40.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/qemu.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/qemu.if 2009-10-26 13:31:02.000000000 -0400
@@ -40,6 +40,10 @@
@@ -4507,9 +4507,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ manage_files_pattern($1, qemu_tmp_t, qemu_tmp_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.te serefpolicy-3.6.32/policy/modules/apps/qemu.te
---- nsaserefpolicy/policy/modules/apps/qemu.te 2009-08-31 13:30:04.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/apps/qemu.te 2009-10-26 15:14:29.000000000 -0400
-@@ -13,15 +13,46 @@
+--- nsaserefpolicy/policy/modules/apps/qemu.te 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/apps/qemu.te 2009-11-13 08:12:27.000000000 -0500
+@@ -13,15 +13,48 @@
##
gen_tunable(qemu_full_network, false)
@@ -4552,6 +4552,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-#
-# qemu local policy
-#
++dev_read_sysfs(qemu_t)
++
+storage_raw_write_removable_device(qemu_t)
+storage_raw_read_removable_device(qemu_t)
+
@@ -4561,7 +4563,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
tunable_policy(`qemu_full_network',`
allow qemu_t self:udp_socket create_socket_perms;
-@@ -35,6 +66,44 @@
+@@ -35,6 +68,44 @@
corenet_tcp_connect_all_ports(qemu_t)
')
@@ -4606,7 +4608,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
#
# qemu_unconfined local policy
-@@ -44,6 +113,9 @@
+@@ -44,6 +115,9 @@
type qemu_unconfined_t;
domain_type(qemu_unconfined_t)
unconfined_domain_noaudit(qemu_unconfined_t)
@@ -4885,8 +4887,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.te serefpolicy-3.6.32/policy/modules/apps/sandbox.te
--- nsaserefpolicy/policy/modules/apps/sandbox.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.32/policy/modules/apps/sandbox.te 2009-11-10 16:28:19.000000000 -0500
-@@ -0,0 +1,335 @@
++++ serefpolicy-3.6.32/policy/modules/apps/sandbox.te 2009-11-13 09:25:10.000000000 -0500
+@@ -0,0 +1,331 @@
+policy_module(sandbox,1.0.0)
+dbus_stub()
+attribute sandbox_domain;
@@ -5078,11 +5080,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+files_search_home(sandbox_x_t)
+userdom_use_user_ptys(sandbox_x_t)
+
-+optional_policy(`
-+ mozilla_dontaudit_manage_user_home_files(sandbox_x_t)
-+')
-+
-+
+########################################
+#
+# sandbox_x_client_t local policy
@@ -5210,6 +5207,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+seutil_read_default_contexts(sandbox_net_client_t)
+
+optional_policy(`
++ mozilla_dontaudit_rw_user_home_files(sandbox_x_t)
++ mozilla_dontaudit_rw_user_home_files(sandbox_xserver_t)
++ mozilla_dontaudit_rw_user_home_files(sandbox_x_domain)
++')
++
++optional_policy(`
+ nsplugin_read_rw_files(sandbox_web_client_t)
+ nsplugin_rw_exec(sandbox_web_client_t)
+')
@@ -5217,13 +5220,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+optional_policy(`
+ hal_dbus_chat(sandbox_net_client_t)
+')
-+
-+ifdef(`hide_broken_symptoms', `
-+ mozilla_dontaudit_rw_user_home_files(sandbox_x_server_t)
-+ mozilla_dontaudit_rw_user_home_files(sandbox_x_domain)
-+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/screen.if serefpolicy-3.6.32/policy/modules/apps/screen.if
---- nsaserefpolicy/policy/modules/apps/screen.if 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/screen.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/screen.if 2009-10-22 14:51:34.000000000 -0400
@@ -45,6 +45,7 @@
@@ -5487,8 +5485,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.te serefpolicy-3.6.32/policy/modules/apps/seunshare.te
--- nsaserefpolicy/policy/modules/apps/seunshare.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.32/policy/modules/apps/seunshare.te 2009-09-30 16:12:48.000000000 -0400
-@@ -0,0 +1,45 @@
++++ serefpolicy-3.6.32/policy/modules/apps/seunshare.te 2009-11-12 13:08:16.000000000 -0500
+@@ -0,0 +1,43 @@
+policy_module(seunshare,1.0.0)
+
+########################################
@@ -5501,8 +5499,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+application_domain(seunshare_t, seunshare_exec_t)
+role system_r types seunshare_t;
+
-+permissive seunshare_t;
-+
+########################################
+#
+# seunshare local policy
@@ -5535,7 +5531,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ mozilla_dontaudit_manage_user_home_files(seunshare_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.6.32/policy/modules/apps/vmware.te
---- nsaserefpolicy/policy/modules/apps/vmware.te 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/vmware.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/vmware.te 2009-09-30 16:12:48.000000000 -0400
@@ -157,6 +157,7 @@
optional_policy(`
@@ -5546,7 +5542,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
ifdef(`TODO',`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.fc serefpolicy-3.6.32/policy/modules/apps/wine.fc
---- nsaserefpolicy/policy/modules/apps/wine.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/wine.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/wine.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,4 +1,22 @@
-/usr/bin/wine -- gen_context(system_u:object_r:wine_exec_t,s0)
@@ -5575,7 +5571,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-/opt/cxoffice/bin/wine -- gen_context(system_u:object_r:wine_exec_t,s0)
-/opt/picasa/wine/bin/wine -- gen_context(system_u:object_r:wine_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.6.32/policy/modules/apps/wine.if
---- nsaserefpolicy/policy/modules/apps/wine.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/wine.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/wine.if 2009-10-07 16:38:13.000000000 -0400
@@ -43,3 +43,118 @@
wine_domtrans($1)
@@ -5697,7 +5693,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ ')
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.6.32/policy/modules/apps/wine.te
---- nsaserefpolicy/policy/modules/apps/wine.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/apps/wine.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/apps/wine.te 2009-10-07 16:37:55.000000000 -0400
@@ -9,20 +9,46 @@
type wine_t;
@@ -5751,7 +5747,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ xserver_rw_shm(wine_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.6.32/policy/modules/kernel/corecommands.fc
---- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2009-07-30 13:09:10.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/corecommands.fc 2009-10-24 08:27:37.000000000 -0400
@@ -1,4 +1,4 @@
-
@@ -5842,7 +5838,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/usr/lib(64)?/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-3.6.32/policy/modules/kernel/corecommands.if
---- nsaserefpolicy/policy/modules/kernel/corecommands.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/corecommands.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/corecommands.if 2009-09-30 16:12:48.000000000 -0400
@@ -893,6 +893,7 @@
@@ -5887,7 +5883,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_lnk_files_pattern($1, bin_t, bin_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.6.32/policy/modules/kernel/corenetwork.te.in
---- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/corenetwork.te.in 2009-11-10 08:33:22.000000000 -0500
@@ -65,6 +65,7 @@
type server_packet_t, packet_type, server_packet_type;
@@ -6033,7 +6029,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
#network_node(lo, s0 - mls_systemhigh, 127.0.0.1, 255.255.255.255)
#network_node(multicast, s0 - mls_systemhigh, ff00::, ff00::)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.6.32/policy/modules/kernel/devices.fc
---- nsaserefpolicy/policy/modules/kernel/devices.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/devices.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/devices.fc 2009-10-19 09:11:30.000000000 -0400
@@ -47,8 +47,10 @@
/dev/kmem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
@@ -6093,7 +6089,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/named/chroot/dev/random -c gen_context(system_u:object_r:random_device_t,s0)
/var/named/chroot/dev/zero -c gen_context(system_u:object_r:zero_device_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.32/policy/modules/kernel/devices.if
---- nsaserefpolicy/policy/modules/kernel/devices.if 2009-08-28 14:58:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/devices.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/devices.if 2009-11-09 13:41:27.000000000 -0500
@@ -1692,6 +1692,78 @@
@@ -6393,7 +6389,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
##
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.6.32/policy/modules/kernel/devices.te
---- nsaserefpolicy/policy/modules/kernel/devices.te 2009-08-28 14:58:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/devices.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/devices.te 2009-10-19 09:09:54.000000000 -0400
@@ -84,6 +84,13 @@
dev_node(kmsg_device_t)
@@ -6449,7 +6445,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dev_node(xen_device_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.6.32/policy/modules/kernel/domain.if
---- nsaserefpolicy/policy/modules/kernel/domain.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/domain.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/domain.if 2009-10-27 11:08:41.000000000 -0400
@@ -44,34 +44,6 @@
interface(`domain_type',`
@@ -6651,8 +6647,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow $1 unconfined_domain_type:process signal;
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.6.32/policy/modules/kernel/domain.te
---- nsaserefpolicy/policy/modules/kernel/domain.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/kernel/domain.te 2009-10-21 16:43:26.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/domain.te 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/kernel/domain.te 2009-11-13 11:32:04.000000000 -0500
@@ -5,6 +5,13 @@
#
# Declarations
@@ -6723,7 +6719,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Act upon any other process.
allow unconfined_domain_type domain:process ~{ transition dyntransition execmem execstack execheap };
-@@ -153,3 +174,70 @@
+@@ -153,3 +174,71 @@
# receive from all domains over labeled networking
domain_all_recvfrom_all_domains(unconfined_domain_type)
@@ -6749,6 +6745,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+optional_policy(`
+ abrt_signull(domain)
++ abrt_domtrans_helper(domain)
+')
+
+optional_policy(`
@@ -6795,7 +6792,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ userdom_relabelto_user_home_files(polydomain)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.6.32/policy/modules/kernel/files.fc
---- nsaserefpolicy/policy/modules/kernel/files.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/files.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/files.fc 2009-09-30 16:12:48.000000000 -0400
@@ -18,6 +18,7 @@
/fsckoptions -- gen_context(system_u:object_r:etc_runtime_t,s0)
@@ -6815,7 +6812,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/lib/nfs/rpc_pipefs(/.*)? <>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.6.32/policy/modules/kernel/files.if
---- nsaserefpolicy/policy/modules/kernel/files.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/files.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/files.if 2009-11-09 16:26:24.000000000 -0500
@@ -110,6 +110,11 @@
##
@@ -7275,7 +7272,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow $1 file_type:file entrypoint;
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.6.32/policy/modules/kernel/files.te
---- nsaserefpolicy/policy/modules/kernel/files.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/files.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/files.te 2009-09-30 16:12:48.000000000 -0400
@@ -42,6 +42,7 @@
#
@@ -7305,13 +7302,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
#
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.fc serefpolicy-3.6.32/policy/modules/kernel/filesystem.fc
---- nsaserefpolicy/policy/modules/kernel/filesystem.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/filesystem.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/filesystem.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1 +1 @@
-# This module currently does not have any file contexts.
+/dev/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.6.32/policy/modules/kernel/filesystem.if
---- nsaserefpolicy/policy/modules/kernel/filesystem.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/filesystem.if 2009-11-09 16:33:29.000000000 -0500
@@ -290,7 +290,7 @@
@@ -7586,18 +7583,28 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.6.32/policy/modules/kernel/filesystem.te
---- nsaserefpolicy/policy/modules/kernel/filesystem.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/kernel/filesystem.te 2009-10-14 09:29:50.000000000 -0400
-@@ -93,7 +93,7 @@
+--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/kernel/filesystem.te 2009-11-13 10:04:43.000000000 -0500
+@@ -29,6 +29,7 @@
+ fs_use_xattr ext4dev gen_context(system_u:object_r:fs_t,s0);
+ fs_use_xattr gfs gen_context(system_u:object_r:fs_t,s0);
+ fs_use_xattr gfs2 gen_context(system_u:object_r:fs_t,s0);
++fs_use_xattr gpfs gen_context(system_u:object_r:fs_t,s0);
+ fs_use_xattr jffs2 gen_context(system_u:object_r:fs_t,s0);
+ fs_use_xattr jfs gen_context(system_u:object_r:fs_t,s0);
+ fs_use_xattr lustre gen_context(system_u:object_r:fs_t,s0);
+@@ -93,7 +94,9 @@
type hugetlbfs_t;
fs_type(hugetlbfs_t)
files_mountpoint(hugetlbfs_t)
-genfscon hugetlbfs / gen_context(system_u:object_r:hugetlbfs_t,s0)
++files_type(hugetlbfs_t)
++files_poly_parent(hugetlbfs_t)
+fs_use_trans hugetlbfs gen_context(system_u:object_r:hugetlbfs_t,s0);
type ibmasmfs_t;
fs_type(ibmasmfs_t)
-@@ -171,6 +171,7 @@
+@@ -171,6 +174,7 @@
fs_use_trans mqueue gen_context(system_u:object_r:tmpfs_t,s0);
fs_use_trans shm gen_context(system_u:object_r:tmpfs_t,s0);
fs_use_trans tmpfs gen_context(system_u:object_r:tmpfs_t,s0);
@@ -7605,7 +7612,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow tmpfs_t noxattrfs:filesystem associate;
-@@ -250,9 +251,13 @@
+@@ -250,9 +254,13 @@
genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon panfs / gen_context(system_u:object_r:nfs_t,s0)
@@ -7621,7 +7628,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
#
# Rules for all filesystem types
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.6.32/policy/modules/kernel/kernel.if
---- nsaserefpolicy/policy/modules/kernel/kernel.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/kernel.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/kernel.if 2009-11-09 11:35:02.000000000 -0500
@@ -485,6 +485,25 @@
@@ -7736,7 +7743,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow $1 kernel_t:unix_stream_socket connectto;
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.6.32/policy/modules/kernel/kernel.te
---- nsaserefpolicy/policy/modules/kernel/kernel.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/kernel.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/kernel.te 2009-11-09 11:35:13.000000000 -0500
@@ -9,6 +9,7 @@
# assertion related attributes
@@ -7837,7 +7844,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+files_boot(kernel_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.6.32/policy/modules/kernel/selinux.if
---- nsaserefpolicy/policy/modules/kernel/selinux.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/selinux.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/selinux.if 2009-09-30 16:12:48.000000000 -0400
@@ -40,7 +40,7 @@
@@ -7897,7 +7904,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ mls_trusted_object($1)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.6.32/policy/modules/kernel/storage.fc
---- nsaserefpolicy/policy/modules/kernel/storage.fc 2009-07-29 15:15:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/storage.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/storage.fc 2009-09-30 16:12:48.000000000 -0400
@@ -28,6 +28,7 @@
/dev/megadev.* -c gen_context(system_u:object_r:removable_device_t,s0)
@@ -7908,7 +7915,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/p[fg][0-3] -b gen_context(system_u:object_r:removable_device_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.6.32/policy/modules/kernel/storage.if
---- nsaserefpolicy/policy/modules/kernel/storage.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/storage.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/storage.if 2009-09-30 16:12:48.000000000 -0400
@@ -266,6 +266,7 @@
@@ -7928,7 +7935,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.6.32/policy/modules/kernel/terminal.fc
---- nsaserefpolicy/policy/modules/kernel/terminal.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/terminal.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/terminal.fc 2009-09-30 16:12:48.000000000 -0400
@@ -13,6 +13,7 @@
/dev/ip2[^/]* -c gen_context(system_u:object_r:tty_device_t,s0)
@@ -7939,7 +7946,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/dev/slamr[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/tty -c gen_context(system_u:object_r:devtty_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.6.32/policy/modules/kernel/terminal.if
---- nsaserefpolicy/policy/modules/kernel/terminal.if 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/terminal.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/terminal.if 2009-11-09 13:31:28.000000000 -0500
@@ -196,7 +196,7 @@
@@ -8026,7 +8033,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.6.32/policy/modules/kernel/terminal.te
---- nsaserefpolicy/policy/modules/kernel/terminal.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/kernel/terminal.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/terminal.te 2009-09-30 16:12:48.000000000 -0400
@@ -44,6 +44,7 @@
type ptmx_t;
@@ -8037,7 +8044,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
#
# tty_device_t is the type of /dev/*tty*
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/guest.te serefpolicy-3.6.32/policy/modules/roles/guest.te
---- nsaserefpolicy/policy/modules/roles/guest.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/roles/guest.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/roles/guest.te 2009-09-30 16:12:48.000000000 -0400
@@ -16,7 +16,11 @@
#
@@ -8054,7 +8061,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+gen_user(guest_u, user, guest_r, s0, s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.te serefpolicy-3.6.32/policy/modules/roles/staff.te
---- nsaserefpolicy/policy/modules/roles/staff.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/roles/staff.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/roles/staff.te 2009-10-27 17:32:32.000000000 -0400
@@ -10,161 +10,117 @@
@@ -8260,7 +8267,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ virt_stream_connect(staff_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.te serefpolicy-3.6.32/policy/modules/roles/sysadm.te
---- nsaserefpolicy/policy/modules/roles/sysadm.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/roles/sysadm.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/roles/sysadm.te 2009-11-09 16:32:50.000000000 -0500
@@ -15,7 +15,7 @@
@@ -9654,7 +9661,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unprivuser.te serefpolicy-3.6.32/policy/modules/roles/unprivuser.te
---- nsaserefpolicy/policy/modules/roles/unprivuser.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/roles/unprivuser.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/roles/unprivuser.te 2009-10-13 14:49:35.000000000 -0400
@@ -14,96 +14,19 @@
userdom_unpriv_user_template(user)
@@ -9805,7 +9812,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ setroubleshoot_dontaudit_stream_connect(user_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/xguest.te serefpolicy-3.6.32/policy/modules/roles/xguest.te
---- nsaserefpolicy/policy/modules/roles/xguest.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/roles/xguest.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/roles/xguest.te 2009-10-21 11:43:32.000000000 -0400
@@ -31,16 +31,37 @@
@@ -9885,28 +9892,87 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-#gen_user(xguest_u,, xguest_r, s0, s0)
+gen_user(xguest_u, user, xguest_r, s0, s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.fc serefpolicy-3.6.32/policy/modules/services/abrt.fc
---- nsaserefpolicy/policy/modules/services/abrt.fc 2009-09-16 09:09:20.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/abrt.fc 2009-10-30 09:40:56.000000000 -0400
-@@ -1,11 +1,14 @@
+--- nsaserefpolicy/policy/modules/services/abrt.fc 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/abrt.fc 2009-11-13 11:01:55.000000000 -0500
+@@ -1,11 +1,15 @@
/etc/abrt(/.*)? gen_context(system_u:object_r:abrt_etc_t,s0)
/etc/rc\.d/init\.d/abrt -- gen_context(system_u:object_r:abrt_initrc_exec_t,s0)
-/usr/sbin/abrt -- gen_context(system_u:object_r:abrt_exec_t,s0)
-+/usr/sbin/abrtd -- gen_context(system_u:object_r:abrt_exec_t,s0)
++/usr/bin/abrt-pyhook-helper -- gen_context(system_u:object_r:abrt_helper_exec_t,s0)
++
++/usr/sbin/abrtd -- gen_context(system_u:object_r:abrt_exec_t,s0)
/var/cache/abrt(/.*)? gen_context(system_u:object_r:abrt_var_cache_t,s0)
-+/var/cache/abrt-di(/.*)? gen_context(system_u:object_r:abrt_var_cache_t,s0)
++/var/cache/abrt-di(/.*)? gen_context(system_u:object_r:abrt_var_cache_t,s0)
/var/log/abrt-logger -- gen_context(system_u:object_r:abrt_var_log_t,s0)
/var/run/abrt\.pid -- gen_context(system_u:object_r:abrt_var_run_t,s0)
/var/run/abrt\.lock -- gen_context(system_u:object_r:abrt_var_run_t,s0)
+/var/run/abrt(/.*)? gen_context(system_u:object_r:abrt_var_run_t,s0)
-+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.if serefpolicy-3.6.32/policy/modules/services/abrt.if
---- nsaserefpolicy/policy/modules/services/abrt.if 2009-09-16 09:09:20.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/abrt.if 2009-10-29 17:36:00.000000000 -0400
-@@ -75,6 +75,64 @@
+--- nsaserefpolicy/policy/modules/services/abrt.if 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/abrt.if 2009-11-13 11:04:53.000000000 -0500
+@@ -19,6 +19,24 @@
+ domtrans_pattern($1, abrt_exec_t, abrt_t)
+ ')
+
++#####################################
++##
++## Execute abrt-helper in the abrt-helper domain.
++##
++##
++##
++## The type of the process performing this action.
++##
++##
++#
++interface(`abrt_domtrans_helper',`
++ gen_require(`
++ type abrt_helper_t, abrt_helper_exec_t;
++ ')
++
++ domtrans_pattern($1, abrt_helper_exec_t, abrt_helper_t)
++')
++
+ ######################################
+ ##
+ ## Execute abrt
+@@ -56,6 +74,32 @@
+ read_files_pattern($1, abrt_etc_t, abrt_etc_t)
+ ')
+
++########################################
++##
++## Execute abrt helper in the abrt_helper domain, and
++## allow the specified role the abrt_helper domain.
++##
++##
++##
++## The type of the process performing this action.
++##
++##
++##
++##
++## The role to be allowed the abrt_helper domain.
++##
++##
++##
++#
++interface(`abrt_run_helper',`
++ gen_require(`
++ type abrt_helper_t;
++ ')
++
++ abrt_domtrans_helper($1)
++ role $2 types abrt_helper_t;
++')
++
+ ######################################
+ ##
+ ## Read abrt logs.
+@@ -75,6 +119,64 @@
read_files_pattern($1, abrt_var_log_t, abrt_var_log_t)
')
@@ -9972,12 +10038,19 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
## All of the rules required to administrate
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.te serefpolicy-3.6.32/policy/modules/services/abrt.te
---- nsaserefpolicy/policy/modules/services/abrt.te 2009-09-16 09:09:20.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/abrt.te 2009-11-10 16:07:06.000000000 -0500
-@@ -33,12 +33,16 @@
+--- nsaserefpolicy/policy/modules/services/abrt.te 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/abrt.te 2009-11-13 11:05:19.000000000 -0500
+@@ -33,12 +33,23 @@
type abrt_var_run_t;
files_pid_file(abrt_var_run_t)
++# type needed to allow all domains
++# to handle /var/cache/abrt
++type abrt_helper_t;
++type abrt_helper_exec_t;
++application_domain(abrt_helper_t, abrt_helper_exec_t)
++role system_r types abrt_helper_t;
++
+ifdef(`enable_mcs',`
+ init_ranged_daemon_domain(abrt_t, abrt_exec_t, s0 - mcs_systemhigh)
+')
@@ -9992,7 +10065,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow abrt_t self:process { signal signull setsched getsched };
allow abrt_t self:fifo_file rw_fifo_file_perms;
-@@ -60,13 +64,15 @@
+@@ -60,13 +71,15 @@
files_tmp_filetrans(abrt_t, abrt_tmp_t, { file dir })
# abrt var/cache files
@@ -10010,7 +10083,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_pid_filetrans(abrt_t, abrt_var_run_t, { file dir })
kernel_read_ring_buffer(abrt_t)
-@@ -75,11 +81,17 @@
+@@ -75,11 +88,17 @@
corecmd_exec_bin(abrt_t)
corecmd_exec_shell(abrt_t)
@@ -10028,7 +10101,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_getattr_all_files(abrt_t)
files_read_etc_files(abrt_t)
files_read_usr_files(abrt_t)
-@@ -96,22 +108,41 @@
+@@ -96,22 +115,59 @@
miscfiles_read_certs(abrt_t)
miscfiles_read_localization(abrt_t)
@@ -10036,10 +10109,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-# read ~/.abrt/Bugzilla.conf
-userdom_read_user_home_content_files(abrt_t)
+userdom_dontaudit_read_user_home_content_files(abrt_t)
-
- optional_policy(`
-- dbus_connect_system_bus(abrt_t)
-- dbus_system_bus_client(abrt_t)
++
++optional_policy(`
+ dbus_system_domain(abrt_t, abrt_exec_t)
+')
+
@@ -10047,8 +10118,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ nsplugin_read_rw_files(abrt_t)
+ nsplugin_read_home(abrt_t)
+')
-+
-+optional_policy(`
+
+ optional_policy(`
+- dbus_connect_system_bus(abrt_t)
+- dbus_system_bus_client(abrt_t)
+ policykit_dbus_chat(abrt_t)
+ policykit_domtrans_auth(abrt_t)
+ policykit_read_lib(abrt_t)
@@ -10077,8 +10150,26 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
+permissive abrt_t;
++
++########################################
++#
++# abrt--helper local policy
++#
++
++allow abrt_helper_t self:capability { setgid };
++read_files_pattern(abrt_helper_t, abrt_etc_t, abrt_etc_t)
++
++manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
++manage_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
++manage_lnk_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
++files_var_filetrans(abrt_helper_t, abrt_var_cache_t, { file dir })
++
++files_read_etc_files(abrt_helper_t)
++
++permissive abrt_helper_t;
++
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.fc serefpolicy-3.6.32/policy/modules/services/afs.fc
---- nsaserefpolicy/policy/modules/services/afs.fc 2009-07-23 14:11:04.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/afs.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/afs.fc 2009-09-30 16:12:48.000000000 -0400
@@ -25,6 +25,7 @@
/usr/vice/etc/afsd -- gen_context(system_u:object_r:afs_exec_t,s0)
@@ -10089,8 +10180,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/vicepa gen_context(system_u:object_r:afs_files_t,s0)
/vicepb gen_context(system_u:object_r:afs_files_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.te serefpolicy-3.6.32/policy/modules/services/afs.te
---- nsaserefpolicy/policy/modules/services/afs.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/afs.te 2009-09-30 16:12:48.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/afs.te 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/afs.te 2009-11-13 08:49:41.000000000 -0500
+@@ -71,7 +71,7 @@
+ # afs client local policy
+ #
+
+-allow afs_t self:capability { sys_nice sys_tty_config };
++allow afs_t self:capability { sys_admin sys_nice sys_tty_config };
+ allow afs_t self:process setsched;
+ allow afs_t self:udp_socket create_socket_perms;
+ allow afs_t self:fifo_file rw_file_perms;
@@ -83,6 +83,7 @@
files_mounton_mnt(afs_t)
@@ -10342,7 +10442,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+groupd_rw_shm(aisexec_t)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.6.32/policy/modules/services/amavis.te
---- nsaserefpolicy/policy/modules/services/amavis.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/amavis.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/amavis.te 2009-09-30 16:12:48.000000000 -0400
@@ -103,6 +103,8 @@
kernel_dontaudit_read_proc_symlinks(amavis_t)
@@ -10354,7 +10454,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corecmd_exec_bin(amavis_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.6.32/policy/modules/services/apache.fc
---- nsaserefpolicy/policy/modules/services/apache.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/apache.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/apache.fc 2009-11-10 14:50:41.000000000 -0500
@@ -1,12 +1,15 @@
-HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0)
@@ -10473,7 +10573,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/www/svn/conf(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.6.32/policy/modules/services/apache.if
---- nsaserefpolicy/policy/modules/services/apache.if 2009-07-28 15:51:13.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/apache.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/apache.if 2009-10-21 11:09:04.000000000 -0400
@@ -13,21 +13,16 @@
#
@@ -11079,7 +11179,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ typeattribute $1 httpd_rw_content;
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.6.32/policy/modules/services/apache.te
---- nsaserefpolicy/policy/modules/services/apache.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/apache.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/apache.te 2009-10-30 16:16:22.000000000 -0400
@@ -19,6 +19,8 @@
# Declarations
@@ -11887,7 +11987,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+typealias httpd_var_run_t alias httpd_fastcgi_var_run_t;
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apm.te serefpolicy-3.6.32/policy/modules/services/apm.te
---- nsaserefpolicy/policy/modules/services/apm.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/apm.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/apm.te 2009-09-30 16:12:48.000000000 -0400
@@ -60,7 +60,7 @@
# mknod: controlling an orderly resume of PCMCIA requires creating device
@@ -11899,7 +11999,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow apmd_t self:fifo_file rw_fifo_file_perms;
allow apmd_t self:unix_dgram_socket create_socket_perms;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.if serefpolicy-3.6.32/policy/modules/services/asterisk.if
---- nsaserefpolicy/policy/modules/services/asterisk.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/asterisk.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/asterisk.if 2009-11-09 12:03:06.000000000 -0500
@@ -1,5 +1,26 @@
## Asterisk IP telephony server
@@ -11929,7 +12029,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
## All of the rules required to administrate
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.te serefpolicy-3.6.32/policy/modules/services/asterisk.te
---- nsaserefpolicy/policy/modules/services/asterisk.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/asterisk.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/asterisk.te 2009-11-09 12:04:26.000000000 -0500
@@ -34,6 +34,8 @@
type asterisk_var_run_t;
@@ -11949,7 +12049,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# for VOIP voice channels.
corenet_tcp_bind_generic_port(asterisk_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.6.32/policy/modules/services/automount.te
---- nsaserefpolicy/policy/modules/services/automount.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/automount.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/automount.te 2009-11-09 08:40:15.000000000 -0500
@@ -75,6 +75,7 @@
@@ -11968,7 +12068,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
storage_rw_fuse(automount_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.6.32/policy/modules/services/avahi.te
---- nsaserefpolicy/policy/modules/services/avahi.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/avahi.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/avahi.te 2009-10-24 08:21:35.000000000 -0400
@@ -24,7 +24,7 @@
# Local policy
@@ -11980,7 +12080,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow avahi_t self:process { setrlimit signal_perms getcap setcap };
allow avahi_t self:fifo_file rw_fifo_file_perms;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.if serefpolicy-3.6.32/policy/modules/services/bind.if
---- nsaserefpolicy/policy/modules/services/bind.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/bind.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/bind.if 2009-09-30 16:12:48.000000000 -0400
@@ -235,7 +235,7 @@
@@ -12044,7 +12144,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## an bind environment
##
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.te serefpolicy-3.6.32/policy/modules/services/bitlbee.te
---- nsaserefpolicy/policy/modules/services/bitlbee.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/bitlbee.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/bitlbee.te 2009-10-27 15:03:37.000000000 -0400
@@ -68,6 +68,8 @@
# MSN can use passport auth, which is over http:
@@ -12056,7 +12156,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dev_read_rand(bitlbee_t)
dev_read_urand(bitlbee_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.if serefpolicy-3.6.32/policy/modules/services/bluetooth.if
---- nsaserefpolicy/policy/modules/services/bluetooth.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/bluetooth.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/bluetooth.if 2009-10-21 07:54:27.000000000 -0400
@@ -153,6 +153,27 @@
dontaudit $1 bluetooth_helper_t:file { read getattr };
@@ -12087,7 +12187,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
## All of the rules required to administrate
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.6.32/policy/modules/services/bluetooth.te
---- nsaserefpolicy/policy/modules/services/bluetooth.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/bluetooth.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/bluetooth.te 2009-10-26 09:03:29.000000000 -0400
@@ -54,9 +54,9 @@
# Bluetooth services local policy
@@ -12137,7 +12237,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ccs.fc serefpolicy-3.6.32/policy/modules/services/ccs.fc
---- nsaserefpolicy/policy/modules/services/ccs.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/ccs.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ccs.fc 2009-10-15 13:16:38.000000000 -0400
@@ -2,9 +2,5 @@
@@ -12152,7 +12252,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/run/cluster/ccsd\.pid -- gen_context(system_u:object_r:ccs_var_run_t,s0)
+/var/run/cluster/ccsd\.sock -s gen_context(system_u:object_r:ccs_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ccs.te serefpolicy-3.6.32/policy/modules/services/ccs.te
---- nsaserefpolicy/policy/modules/services/ccs.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/ccs.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ccs.te 2009-10-29 11:16:33.000000000 -0400
@@ -10,23 +10,21 @@
type ccs_exec_t;
@@ -12238,7 +12338,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corecmd_dontaudit_write_bin_dirs(ccs_t)
files_manage_isid_type_files(ccs_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmaster.te serefpolicy-3.6.32/policy/modules/services/certmaster.te
---- nsaserefpolicy/policy/modules/services/certmaster.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/certmaster.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/certmaster.te 2009-09-30 16:12:48.000000000 -0400
@@ -30,7 +30,7 @@
# certmaster local policy
@@ -12445,7 +12545,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+permissive chronyd_t;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.6.32/policy/modules/services/clamav.te
---- nsaserefpolicy/policy/modules/services/clamav.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/clamav.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/clamav.te 2009-09-30 16:12:48.000000000 -0400
@@ -117,9 +117,9 @@
@@ -12728,7 +12828,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+type cobbler_var_lib_t;
+files_type(cobbler_var_lib_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.fc serefpolicy-3.6.32/policy/modules/services/consolekit.fc
---- nsaserefpolicy/policy/modules/services/consolekit.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/consolekit.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/consolekit.fc 2009-10-29 09:17:15.000000000 -0400
@@ -2,4 +2,5 @@
@@ -12738,7 +12838,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/var/run/ConsoleKit(/.*)? gen_context(system_u:object_r:consolekit_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.if serefpolicy-3.6.32/policy/modules/services/consolekit.if
---- nsaserefpolicy/policy/modules/services/consolekit.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/consolekit.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/consolekit.if 2009-09-30 16:12:48.000000000 -0400
@@ -57,3 +57,42 @@
read_files_pattern($1, consolekit_log_t, consolekit_log_t)
@@ -12784,7 +12884,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.6.32/policy/modules/services/consolekit.te
---- nsaserefpolicy/policy/modules/services/consolekit.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/consolekit.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/consolekit.te 2009-11-02 09:43:56.000000000 -0500
@@ -21,7 +21,7 @@
# consolekit local policy
@@ -12990,8 +13090,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/corosync.te serefpolicy-3.6.32/policy/modules/services/corosync.te
--- nsaserefpolicy/policy/modules/services/corosync.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.32/policy/modules/services/corosync.te 2009-11-10 08:36:39.000000000 -0500
-@@ -0,0 +1,109 @@
++++ serefpolicy-3.6.32/policy/modules/services/corosync.te 2009-11-13 09:25:10.000000000 -0500
+@@ -0,0 +1,107 @@
+
+policy_module(corosync,1.0.0)
+
@@ -13083,8 +13183,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+logging_send_syslog_msg(corosync_t)
+
-+userdom_manage_tmpfs_role(system_r, corosync_t)
-+
+# to communication with RHCS
+dlm_controld_manage_tmpfs_files(corosync_t)
+dlm_controld_rw_semaphores(corosync_t)
@@ -13102,7 +13200,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+permissive corosync_t;
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.if serefpolicy-3.6.32/policy/modules/services/courier.if
---- nsaserefpolicy/policy/modules/services/courier.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/courier.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/courier.if 2009-09-30 16:12:48.000000000 -0400
@@ -179,6 +179,24 @@
@@ -13130,7 +13228,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
##
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.6.32/policy/modules/services/courier.te
---- nsaserefpolicy/policy/modules/services/courier.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/courier.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/courier.te 2009-09-30 16:12:48.000000000 -0400
@@ -10,6 +10,7 @@
@@ -13141,7 +13239,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
courier_domain_template(pcp)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.6.32/policy/modules/services/cron.fc
---- nsaserefpolicy/policy/modules/services/cron.fc 2009-09-16 09:09:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/cron.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/cron.fc 2009-10-22 11:35:47.000000000 -0400
@@ -14,7 +14,7 @@
/var/run/anacron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0)
@@ -13161,7 +13259,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/var/log/mcelog.* -- gen_context(system_u:object_r:cron_log_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.6.32/policy/modules/services/cron.if
---- nsaserefpolicy/policy/modules/services/cron.if 2009-09-16 09:09:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/cron.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/cron.if 2009-11-03 08:58:13.000000000 -0500
@@ -12,6 +12,10 @@
##
@@ -13305,7 +13403,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ manage_files_pattern($1, system_cronjob_var_lib_t, system_cronjob_var_lib_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.6.32/policy/modules/services/cron.te
---- nsaserefpolicy/policy/modules/services/cron.te 2009-09-16 09:09:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/cron.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/cron.te 2009-11-09 17:18:07.000000000 -0500
@@ -38,6 +38,7 @@
type cron_var_lib_t;
@@ -13564,7 +13662,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_user_home_dir_filetrans_user_home_content(system_cronjob_t, { dir file lnk_file fifo_file sock_file })
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.6.32/policy/modules/services/cups.fc
---- nsaserefpolicy/policy/modules/services/cups.fc 2009-07-28 15:51:13.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/cups.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/cups.fc 2009-09-30 16:12:48.000000000 -0400
@@ -13,10 +13,14 @@
/etc/cups/certs/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
@@ -13610,7 +13708,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/usr/local/linuxprinter/ppd(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.6.32/policy/modules/services/cups.te
---- nsaserefpolicy/policy/modules/services/cups.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/cups.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/cups.te 2009-10-29 08:36:18.000000000 -0400
@@ -23,6 +23,9 @@
type cupsd_initrc_exec_t;
@@ -13774,7 +13872,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dev_read_sysfs(hplip_t)
dev_rw_printer(hplip_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.6.32/policy/modules/services/cvs.te
---- nsaserefpolicy/policy/modules/services/cvs.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/cvs.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/cvs.te 2009-09-30 16:12:48.000000000 -0400
@@ -112,4 +112,5 @@
read_files_pattern(httpd_cvs_script_t, cvs_data_t, cvs_data_t)
@@ -13783,7 +13881,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir })
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-3.6.32/policy/modules/services/cyrus.te
---- nsaserefpolicy/policy/modules/services/cyrus.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/cyrus.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/cyrus.te 2009-09-30 16:12:48.000000000 -0400
@@ -137,6 +137,7 @@
optional_policy(`
@@ -13794,7 +13892,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.32/policy/modules/services/dbus.if
---- nsaserefpolicy/policy/modules/services/dbus.if 2009-07-28 13:28:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/dbus.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/dbus.if 2009-10-05 08:30:03.000000000 -0400
@@ -42,8 +42,10 @@
gen_require(`
@@ -13922,7 +14020,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.6.32/policy/modules/services/dbus.te
---- nsaserefpolicy/policy/modules/services/dbus.te 2009-08-18 18:39:50.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/dbus.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/dbus.te 2009-09-30 16:12:48.000000000 -0400
@@ -86,6 +86,7 @@
dev_read_sysfs(system_dbusd_t)
@@ -13977,7 +14075,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+allow dbusd_unconfined dbusd_unconfined:dbus all_dbus_perms;
+allow session_bus_type dbusd_unconfined:dbus send_msg;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.te serefpolicy-3.6.32/policy/modules/services/dcc.te
---- nsaserefpolicy/policy/modules/services/dcc.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/dcc.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/dcc.te 2009-09-30 16:12:48.000000000 -0400
@@ -130,11 +130,13 @@
@@ -14006,7 +14104,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ddclient.if serefpolicy-3.6.32/policy/modules/services/ddclient.if
---- nsaserefpolicy/policy/modules/services/ddclient.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/ddclient.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ddclient.if 2009-09-30 16:12:48.000000000 -0400
@@ -21,6 +21,31 @@
@@ -14041,7 +14139,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## an ddclient environment
##
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.fc serefpolicy-3.6.32/policy/modules/services/devicekit.fc
---- nsaserefpolicy/policy/modules/services/devicekit.fc 2009-07-29 15:15:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/devicekit.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/devicekit.fc 2009-09-30 16:12:48.000000000 -0400
@@ -5,4 +5,4 @@
/var/lib/DeviceKit-.* gen_context(system_u:object_r:devicekit_var_lib_t,s0)
@@ -14050,7 +14148,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-/var/run/DeviceKit-disk(/.*)? gen_context(system_u:object_r:devicekit_var_run_t,s0)
+/var/run/DeviceKit-disks(/.*)? gen_context(system_u:object_r:devicekit_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.if serefpolicy-3.6.32/policy/modules/services/devicekit.if
---- nsaserefpolicy/policy/modules/services/devicekit.if 2009-07-29 15:15:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/devicekit.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/devicekit.if 2009-09-30 16:12:48.000000000 -0400
@@ -139,6 +139,26 @@
@@ -14089,7 +14187,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow $1 devicekit_t:process { ptrace signal_perms getattr };
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.32/policy/modules/services/devicekit.te
---- nsaserefpolicy/policy/modules/services/devicekit.te 2009-07-29 15:15:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/devicekit.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/devicekit.te 2009-11-05 08:28:20.000000000 -0500
@@ -36,12 +36,15 @@
manage_dirs_pattern(devicekit_t, devicekit_var_run_t, devicekit_var_run_t)
@@ -14275,7 +14373,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
vbetool_domtrans(devicekit_power_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.6.32/policy/modules/services/dnsmasq.te
---- nsaserefpolicy/policy/modules/services/dnsmasq.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/dnsmasq.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/dnsmasq.te 2009-09-30 16:12:48.000000000 -0400
@@ -83,6 +83,18 @@
userdom_dontaudit_search_user_home_dirs(dnsmasq_t)
@@ -14297,8 +14395,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.6.32/policy/modules/services/dovecot.te
---- nsaserefpolicy/policy/modules/services/dovecot.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/dovecot.te 2009-10-20 14:55:45.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/dovecot.te 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/dovecot.te 2009-11-13 11:27:34.000000000 -0500
@@ -56,7 +56,7 @@
allow dovecot_t self:capability { dac_override dac_read_search chown net_bind_service setgid setuid sys_chroot };
@@ -14325,7 +14423,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow dovecot_auth_t self:fifo_file rw_fifo_file_perms;
allow dovecot_auth_t self:unix_dgram_socket create_socket_perms;
allow dovecot_auth_t self:unix_stream_socket create_stream_socket_perms;
-@@ -220,9 +221,15 @@
+@@ -220,15 +221,23 @@
')
optional_policy(`
@@ -14341,23 +14439,31 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
#
# dovecot deliver local policy
-@@ -260,3 +267,14 @@
+ #
+ allow dovecot_deliver_t self:unix_dgram_socket create_socket_perms;
+
++allow dovecot_deliver_t dovecot_t:process signull;
++
+ allow dovecot_deliver_t dovecot_etc_t:file read_file_perms;
+ allow dovecot_deliver_t dovecot_var_run_t:dir list_dir_perms;
+
+@@ -260,3 +269,14 @@
optional_policy(`
mta_manage_spool(dovecot_deliver_t)
')
+
+tunable_policy(`use_nfs_home_dirs',`
-+ fs_manage_nfs_files(dovecot_t)
-+ fs_manage_nfs_symlinks(dovecot_t)
++ fs_manage_nfs_files(dovecot_deliver_t)
++ fs_manage_nfs_symlinks(dovecot_deliver_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
-+ fs_manage_cifs_files(dovecot_t)
-+ fs_manage_cifs_symlinks(dovecot_t)
++ fs_manage_cifs_files(dovecot_deliver_t)
++ fs_manage_cifs_symlinks(dovecot_deliver_t)
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.6.32/policy/modules/services/exim.te
---- nsaserefpolicy/policy/modules/services/exim.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/exim.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/exim.te 2009-09-30 16:12:48.000000000 -0400
@@ -111,6 +111,7 @@
files_search_var(exim_t)
@@ -14379,7 +14485,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
spamassassin_exec_client(exim_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.te serefpolicy-3.6.32/policy/modules/services/fail2ban.te
---- nsaserefpolicy/policy/modules/services/fail2ban.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/fail2ban.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/fail2ban.te 2009-10-14 12:53:20.000000000 -0400
@@ -33,6 +33,7 @@
allow fail2ban_t self:process signal;
@@ -14398,7 +14504,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
miscfiles_read_localization(fail2ban_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetchmail.te serefpolicy-3.6.32/policy/modules/services/fetchmail.te
---- nsaserefpolicy/policy/modules/services/fetchmail.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/fetchmail.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/fetchmail.te 2009-09-30 16:12:48.000000000 -0400
@@ -47,6 +47,8 @@
kernel_read_proc_symlinks(fetchmail_t)
@@ -14410,7 +14516,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_all_recvfrom_netlabel(fetchmail_t)
corenet_tcp_sendrecv_generic_if(fetchmail_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fprintd.te serefpolicy-3.6.32/policy/modules/services/fprintd.te
---- nsaserefpolicy/policy/modules/services/fprintd.te 2009-07-29 15:15:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/fprintd.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/fprintd.te 2009-09-30 16:12:48.000000000 -0400
@@ -37,6 +37,8 @@
files_read_etc_files(fprintd_t)
@@ -14430,7 +14536,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.6.32/policy/modules/services/ftp.te
---- nsaserefpolicy/policy/modules/services/ftp.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/ftp.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ftp.te 2009-10-01 14:28:11.000000000 -0400
@@ -41,6 +41,13 @@
@@ -14556,7 +14662,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.fc serefpolicy-3.6.32/policy/modules/services/git.fc
---- nsaserefpolicy/policy/modules/services/git.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/git.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/git.fc 2009-10-21 11:39:52.000000000 -0400
@@ -1,3 +1,9 @@
/var/cache/cgit(/.*)? gen_context(system_u:object_r:httpd_git_script_rw_t,s0)
@@ -14570,7 +14676,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+# Conflict with Fedora cgit fc spec.
+/var/lib/git(/.*)? gen_context(system_u:object_r:git_data_t, s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.if serefpolicy-3.6.32/policy/modules/services/git.if
---- nsaserefpolicy/policy/modules/services/git.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/git.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/git.if 2009-10-21 11:33:38.000000000 -0400
@@ -1 +1,285 @@
-## GIT revision control system
@@ -14860,7 +14966,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ seutil_domtrans_setfiles($1)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.te serefpolicy-3.6.32/policy/modules/services/git.te
---- nsaserefpolicy/policy/modules/services/git.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/git.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/git.te 2009-10-21 11:39:13.000000000 -0400
@@ -1,9 +1,173 @@
@@ -15038,7 +15144,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
apache_content_template(git)
+git_read_data_content(httpd_git_script_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpm.te serefpolicy-3.6.32/policy/modules/services/gpm.te
---- nsaserefpolicy/policy/modules/services/gpm.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/gpm.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/gpm.te 2009-09-30 16:12:48.000000000 -0400
@@ -27,7 +27,8 @@
# Local policy
@@ -15051,7 +15157,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow gpm_t gpm_conf_t:dir list_dir_perms;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.fc serefpolicy-3.6.32/policy/modules/services/gpsd.fc
---- nsaserefpolicy/policy/modules/services/gpsd.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/gpsd.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/gpsd.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1 +1,6 @@
+/etc/rc\.d/init\.d/gpsd -- gen_context(system_u:object_r:gpsd_initrc_exec_t,s0)
@@ -15061,7 +15167,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/run/gpsd\.pid -- gen_context(system_u:object_r:gpsd_var_run_t,s0)
+/var/run/gpsd\.sock -s gen_context(system_u:object_r:gpsd_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.if serefpolicy-3.6.32/policy/modules/services/gpsd.if
---- nsaserefpolicy/policy/modules/services/gpsd.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/gpsd.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/gpsd.if 2009-09-30 16:12:48.000000000 -0400
@@ -33,11 +33,6 @@
## The role to be allowed the gpsd domain.
@@ -15109,7 +15215,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ read_lnk_files_pattern($1, gpsd_tmpfs_t, gpsd_tmpfs_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.te serefpolicy-3.6.32/policy/modules/services/gpsd.te
---- nsaserefpolicy/policy/modules/services/gpsd.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/gpsd.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/gpsd.te 2009-09-30 16:12:48.000000000 -0400
@@ -11,15 +11,21 @@
application_domain(gpsd_t, gpsd_exec_t)
@@ -15153,7 +15259,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ ntp_rw_shm(gpsd_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.6.32/policy/modules/services/hal.fc
---- nsaserefpolicy/policy/modules/services/hal.fc 2009-07-28 13:28:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/hal.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/hal.fc 2009-09-30 16:12:48.000000000 -0400
@@ -26,6 +26,7 @@
/var/run/pm(/.*)? gen_context(system_u:object_r:hald_var_run_t,s0)
@@ -15164,7 +15270,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
ifdef(`distro_gentoo',`
/var/lib/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.6.32/policy/modules/services/hal.if
---- nsaserefpolicy/policy/modules/services/hal.if 2009-07-28 13:28:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/hal.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/hal.if 2009-10-11 07:59:31.000000000 -0400
@@ -413,3 +413,21 @@
files_search_pids($1)
@@ -15189,7 +15295,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ dontaudit $1 hald_t:unix_dgram_socket { read write };
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.6.32/policy/modules/services/hal.te
---- nsaserefpolicy/policy/modules/services/hal.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/hal.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/hal.te 2009-11-09 13:39:05.000000000 -0500
@@ -55,6 +55,9 @@
type hald_var_lib_t;
@@ -15344,7 +15450,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ dbus_system_bus_client(hald_dccm_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/howl.te serefpolicy-3.6.32/policy/modules/services/howl.te
---- nsaserefpolicy/policy/modules/services/howl.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/howl.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/howl.te 2009-10-06 15:44:07.000000000 -0400
@@ -30,7 +30,7 @@
@@ -15356,7 +15462,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_proc_symlinks(howl_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.fc serefpolicy-3.6.32/policy/modules/services/inetd.fc
---- nsaserefpolicy/policy/modules/services/inetd.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/inetd.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/inetd.fc 2009-10-20 08:54:47.000000000 -0400
@@ -9,4 +9,4 @@
@@ -15365,7 +15471,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-/var/run/inetd\.pid -- gen_context(system_u:object_r:inetd_var_run_t,s0)
+/var/run/(x)?inetd\.pid -- gen_context(system_u:object_r:inetd_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.6.32/policy/modules/services/inetd.te
---- nsaserefpolicy/policy/modules/services/inetd.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/inetd.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/inetd.te 2009-10-21 11:02:27.000000000 -0400
@@ -104,6 +104,8 @@
corenet_tcp_bind_telnetd_port(inetd_t)
@@ -15386,7 +15492,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
miscfiles_read_localization(inetd_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/irqbalance.te serefpolicy-3.6.32/policy/modules/services/irqbalance.te
---- nsaserefpolicy/policy/modules/services/irqbalance.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/irqbalance.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/irqbalance.te 2009-09-30 16:12:48.000000000 -0400
@@ -18,11 +18,11 @@
# Local policy
@@ -15402,10 +15508,44 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_files_pattern(irqbalance_t, irqbalance_var_run_t, irqbalance_var_run_t)
files_pid_filetrans(irqbalance_t, irqbalance_var_run_t, file)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-3.6.32/policy/modules/services/kerberos.if
+--- nsaserefpolicy/policy/modules/services/kerberos.if 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/kerberos.if 2009-11-13 11:27:49.000000000 -0500
+@@ -74,7 +74,7 @@
+ ')
+
+ files_search_etc($1)
+- allow $1 krb5_conf_t:file read_file_perms;
++ read_files_pattern($1, krb5_conf_t, krb5_conf_t)
+ dontaudit $1 krb5_conf_t:file write;
+ dontaudit $1 krb5kdc_conf_t:dir list_dir_perms;
+ dontaudit $1 krb5kdc_conf_t:file rw_file_perms;
+@@ -84,6 +84,10 @@
+ selinux_dontaudit_validate_context($1)
+ seutil_dontaudit_read_file_contexts($1)
+
++ optional_policy(`
++ sssd_read_config_files($1)
++ ')
++
+ tunable_policy(`allow_kerberos',`
+ allow $1 self:tcp_socket create_socket_perms;
+ allow $1 self:udp_socket create_socket_perms;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.6.32/policy/modules/services/kerberos.te
---- nsaserefpolicy/policy/modules/services/kerberos.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/kerberos.te 2009-10-14 10:10:42.000000000 -0400
-@@ -277,6 +277,8 @@
+--- nsaserefpolicy/policy/modules/services/kerberos.te 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/kerberos.te 2009-11-13 08:15:25.000000000 -0500
+@@ -110,8 +110,9 @@
+ manage_files_pattern(kadmind_t, kadmind_var_run_t, kadmind_var_run_t)
+ files_pid_filetrans(kadmind_t, kadmind_var_run_t, file)
+
+-kernel_read_kernel_sysctls(kadmind_t)
+ kernel_list_proc(kadmind_t)
++kernel_read_kernel_sysctls(kadmind_t)
++kernel_read_network_state(kadmind_t)
+ kernel_read_proc_symlinks(kadmind_t)
+ kernel_read_system_state(kadmind_t)
+
+@@ -277,6 +278,8 @@
#
allow kpropd_t self:capability net_bind_service;
@@ -15414,7 +15554,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow kpropd_t self:fifo_file rw_file_perms;
allow kpropd_t self:unix_stream_socket create_stream_socket_perms;
allow kpropd_t self:tcp_socket create_stream_socket_perms;
-@@ -286,8 +288,13 @@
+@@ -286,8 +289,13 @@
allow kpropd_t krb5_keytab_t:file read_file_perms;
manage_files_pattern(kpropd_t, krb5kdc_conf_t, krb5kdc_lock_t)
@@ -15429,7 +15569,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corecmd_exec_bin(kpropd_t)
-@@ -303,10 +310,14 @@
+@@ -303,10 +311,14 @@
files_read_etc_files(kpropd_t)
files_search_tmp(kpropd_t)
@@ -15445,7 +15585,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kerberos_use(kpropd_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.te serefpolicy-3.6.32/policy/modules/services/kerneloops.te
---- nsaserefpolicy/policy/modules/services/kerneloops.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/kerneloops.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/kerneloops.te 2009-09-30 16:12:48.000000000 -0400
@@ -22,7 +22,7 @@
#
@@ -15457,7 +15597,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_files_pattern(kerneloops_t, kerneloops_tmp_t, kerneloops_tmp_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ktalk.te serefpolicy-3.6.32/policy/modules/services/ktalk.te
---- nsaserefpolicy/policy/modules/services/ktalk.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/ktalk.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ktalk.te 2009-09-30 16:12:48.000000000 -0400
@@ -69,6 +69,7 @@
files_read_etc_files(ktalkd_t)
@@ -15468,7 +15608,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
auth_use_nsswitch(ktalkd_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lircd.fc serefpolicy-3.6.32/policy/modules/services/lircd.fc
---- nsaserefpolicy/policy/modules/services/lircd.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/lircd.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/lircd.fc 2009-10-29 09:05:50.000000000 -0400
@@ -6,3 +6,5 @@
/usr/sbin/lircd -- gen_context(system_u:object_r:lircd_exec_t,s0)
@@ -15477,7 +15617,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/run/lircd(/.*)? gen_context(system_u:object_r:lircd_var_run_t,s0)
+/var/run/lirc(/.*)? gen_context(system_u:object_r:lircd_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lircd.if serefpolicy-3.6.32/policy/modules/services/lircd.if
---- nsaserefpolicy/policy/modules/services/lircd.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/lircd.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/lircd.if 2009-10-23 09:32:21.000000000 -0400
@@ -32,12 +32,11 @@
#
@@ -15511,7 +15651,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- admin_pattern($1, lircd_sock_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lircd.te serefpolicy-3.6.32/policy/modules/services/lircd.te
---- nsaserefpolicy/policy/modules/services/lircd.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/lircd.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/lircd.te 2009-10-29 08:39:44.000000000 -0400
@@ -16,13 +16,9 @@
type lircd_etc_t;
@@ -15559,7 +15699,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
miscfiles_read_localization(lircd_t)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.6.32/policy/modules/services/mailman.te
---- nsaserefpolicy/policy/modules/services/mailman.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/mailman.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/mailman.te 2009-09-30 16:12:48.000000000 -0400
@@ -78,6 +78,10 @@
mta_dontaudit_rw_queue(mailman_mail_t)
@@ -15573,7 +15713,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/memcached.te serefpolicy-3.6.32/policy/modules/services/memcached.te
---- nsaserefpolicy/policy/modules/services/memcached.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/memcached.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/memcached.te 2009-09-30 16:12:48.000000000 -0400
@@ -44,6 +44,8 @@
@@ -15585,7 +15725,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
sysnet_dns_name_resolve(memcached_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/milter.if serefpolicy-3.6.32/policy/modules/services/milter.if
---- nsaserefpolicy/policy/modules/services/milter.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/milter.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/milter.if 2009-10-14 09:54:10.000000000 -0400
@@ -35,6 +35,8 @@
# Create other data files and directories in the data directory
@@ -15597,7 +15737,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_send_syslog_msg($1_milter_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.te serefpolicy-3.6.32/policy/modules/services/modemmanager.te
---- nsaserefpolicy/policy/modules/services/modemmanager.te 2009-09-16 09:09:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/modemmanager.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/modemmanager.te 2009-10-22 10:43:01.000000000 -0400
@@ -16,7 +16,7 @@
#
@@ -15617,7 +15757,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_read_etc_files(modemmanager_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.6.32/policy/modules/services/mta.fc
---- nsaserefpolicy/policy/modules/services/mta.fc 2009-07-29 15:15:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/mta.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/mta.fc 2009-09-30 16:12:48.000000000 -0400
@@ -26,3 +26,5 @@
/var/spool/imap(/.*)? gen_context(system_u:object_r:mail_spool_t,s0)
@@ -15626,7 +15766,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+HOME_DIR/\.forward -- gen_context(system_u:object_r:mail_forward_t,s0)
+/root/\.forward -- gen_context(system_u:object_r:mail_forward_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.6.32/policy/modules/services/mta.if
---- nsaserefpolicy/policy/modules/services/mta.if 2009-07-29 15:15:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/mta.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/mta.if 2009-11-04 07:56:06.000000000 -0500
@@ -69,6 +69,7 @@
can_exec($1_mail_t, sendmail_exec_t)
@@ -15690,7 +15830,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.6.32/policy/modules/services/mta.te
---- nsaserefpolicy/policy/modules/services/mta.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/mta.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/mta.te 2009-10-19 14:29:50.000000000 -0400
@@ -27,6 +27,9 @@
type mail_spool_t;
@@ -15782,7 +15922,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
#
# User send mail local policy
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.fc serefpolicy-3.6.32/policy/modules/services/munin.fc
---- nsaserefpolicy/policy/modules/services/munin.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/munin.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/munin.fc 2009-09-30 16:12:48.000000000 -0400
@@ -9,3 +9,6 @@
/var/lib/munin(/.*)? gen_context(system_u:object_r:munin_var_lib_t,s0)
@@ -15792,7 +15932,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/www/html/munin/cgi(/.*)? gen_context(system_u:object_r:httpd_munin_script_exec_t,s0)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.te serefpolicy-3.6.32/policy/modules/services/munin.te
---- nsaserefpolicy/policy/modules/services/munin.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/munin.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/munin.te 2009-09-30 16:12:48.000000000 -0400
@@ -33,7 +33,7 @@
# Local policy
@@ -15812,7 +15952,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.6.32/policy/modules/services/mysql.te
---- nsaserefpolicy/policy/modules/services/mysql.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/mysql.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/mysql.te 2009-11-02 09:22:10.000000000 -0500
@@ -136,7 +136,12 @@
@@ -15837,7 +15977,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
mysql_search_pid_files(mysqld_safe_t)
mysql_write_log(mysqld_safe_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.6.32/policy/modules/services/nagios.fc
---- nsaserefpolicy/policy/modules/services/nagios.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/nagios.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/nagios.fc 2009-10-23 08:00:38.000000000 -0400
@@ -1,16 +1,22 @@
/etc/nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0)
@@ -15868,7 +16008,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/usr/lib(64)?/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0)
+/usr/lib(64)?/nagios/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.6.32/policy/modules/services/nagios.if
---- nsaserefpolicy/policy/modules/services/nagios.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/nagios.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/nagios.if 2009-10-29 17:36:24.000000000 -0400
@@ -64,7 +64,7 @@
@@ -15989,7 +16129,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ admin_pattern($1, nrpe_etc_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.6.32/policy/modules/services/nagios.te
---- nsaserefpolicy/policy/modules/services/nagios.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/nagios.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/nagios.te 2009-10-23 09:18:37.000000000 -0400
@@ -10,13 +10,12 @@
type nagios_exec_t;
@@ -16130,7 +16270,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.6.32/policy/modules/services/networkmanager.fc
---- nsaserefpolicy/policy/modules/services/networkmanager.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/networkmanager.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/networkmanager.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,12 +1,26 @@
+/etc/rc\.d/init\.d/wicd -- gen_context(system_u:object_r:NetworkManager_initrc_exec_t, s0)
@@ -16160,7 +16300,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/run/nm-dhclient.* gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.6.32/policy/modules/services/networkmanager.if
---- nsaserefpolicy/policy/modules/services/networkmanager.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/networkmanager.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/networkmanager.if 2009-10-21 10:29:42.000000000 -0400
@@ -118,6 +118,24 @@
@@ -16239,7 +16379,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.6.32/policy/modules/services/networkmanager.te
---- nsaserefpolicy/policy/modules/services/networkmanager.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/networkmanager.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/networkmanager.te 2009-09-30 16:12:48.000000000 -0400
@@ -19,6 +19,9 @@
type NetworkManager_tmp_t;
@@ -16480,7 +16620,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.6.32/policy/modules/services/nis.fc
---- nsaserefpolicy/policy/modules/services/nis.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/nis.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/nis.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,4 +1,7 @@
-
@@ -16492,7 +16632,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.6.32/policy/modules/services/nis.if
---- nsaserefpolicy/policy/modules/services/nis.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/nis.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/nis.if 2009-09-30 16:12:48.000000000 -0400
@@ -28,7 +28,7 @@
type var_yp_t;
@@ -16636,7 +16776,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.6.32/policy/modules/services/nis.te
---- nsaserefpolicy/policy/modules/services/nis.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/nis.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/nis.te 2009-09-30 16:12:48.000000000 -0400
@@ -13,6 +13,9 @@
type ypbind_exec_t;
@@ -16688,7 +16828,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_udp_bind_all_rpc_ports(ypxfr_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.6.32/policy/modules/services/nscd.if
---- nsaserefpolicy/policy/modules/services/nscd.if 2009-09-16 09:09:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/nscd.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/nscd.if 2009-11-10 08:25:12.000000000 -0500
@@ -121,6 +121,24 @@
@@ -16716,7 +16856,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## an inherited NSCD file descriptor.
##
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.6.32/policy/modules/services/nscd.te
---- nsaserefpolicy/policy/modules/services/nscd.te 2009-09-16 09:09:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/nscd.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/nscd.te 2009-10-14 10:11:11.000000000 -0400
@@ -5,6 +5,13 @@
class nscd all_nscd_perms;
@@ -16754,7 +16894,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ samba_read_var_files(nscd_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nslcd.if serefpolicy-3.6.32/policy/modules/services/nslcd.if
---- nsaserefpolicy/policy/modules/services/nslcd.if 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/nslcd.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/nslcd.if 2009-09-30 16:12:48.000000000 -0400
@@ -94,6 +94,7 @@
interface(`nslcd_admin',`
@@ -16777,7 +16917,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.if serefpolicy-3.6.32/policy/modules/services/ntp.if
---- nsaserefpolicy/policy/modules/services/ntp.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/ntp.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ntp.if 2009-09-30 16:12:48.000000000 -0400
@@ -37,6 +37,32 @@
@@ -16847,7 +16987,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## an ntp environment
##
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.6.32/policy/modules/services/ntp.te
---- nsaserefpolicy/policy/modules/services/ntp.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/ntp.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ntp.te 2009-09-30 16:12:48.000000000 -0400
@@ -41,10 +41,11 @@
@@ -17145,7 +17285,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+miscfiles_read_localization(upsdrvctl_t)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.fc serefpolicy-3.6.32/policy/modules/services/nx.fc
---- nsaserefpolicy/policy/modules/services/nx.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/nx.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/nx.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,6 +1,7 @@
/opt/NX/bin/nxserver -- gen_context(system_u:object_r:nx_server_exec_t,s0)
@@ -17156,7 +17296,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/opt/NX/var(/.*)? gen_context(system_u:object_r:nx_server_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.if serefpolicy-3.6.32/policy/modules/services/nx.if
---- nsaserefpolicy/policy/modules/services/nx.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/nx.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/nx.if 2009-09-30 16:12:48.000000000 -0400
@@ -17,3 +17,22 @@
@@ -17182,7 +17322,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ read_lnk_files_pattern($1, nx_server_home_ssh_t, nx_server_home_ssh_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.te serefpolicy-3.6.32/policy/modules/services/nx.te
---- nsaserefpolicy/policy/modules/services/nx.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/nx.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/nx.te 2009-09-30 16:12:48.000000000 -0400
@@ -25,6 +25,9 @@
type nx_server_var_run_t;
@@ -17205,7 +17345,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_kernel_sysctls(nx_server_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.if serefpolicy-3.6.32/policy/modules/services/oddjob.if
---- nsaserefpolicy/policy/modules/services/oddjob.if 2009-07-28 13:28:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/oddjob.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/oddjob.if 2009-09-30 16:12:48.000000000 -0400
@@ -44,6 +44,7 @@
')
@@ -17216,7 +17356,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.6.32/policy/modules/services/openvpn.te
---- nsaserefpolicy/policy/modules/services/openvpn.te 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/openvpn.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/openvpn.te 2009-09-30 16:12:48.000000000 -0400
@@ -100,6 +100,8 @@
files_read_etc_files(openvpn_t)
@@ -17228,7 +17368,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
miscfiles_read_localization(openvpn_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.if serefpolicy-3.6.32/policy/modules/services/pcscd.if
---- nsaserefpolicy/policy/modules/services/pcscd.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/pcscd.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/pcscd.if 2009-11-09 09:06:23.000000000 -0500
@@ -53,6 +53,5 @@
')
@@ -17239,7 +17379,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ stream_connect_pattern($1, pcscd_var_run_t, pcscd_var_run_t, pcscd_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-3.6.32/policy/modules/services/pcscd.te
---- nsaserefpolicy/policy/modules/services/pcscd.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/pcscd.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/pcscd.te 2009-10-29 14:35:35.000000000 -0400
@@ -29,6 +29,7 @@
@@ -17266,7 +17406,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
term_dontaudit_getattr_pty_dirs(pcscd_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.6.32/policy/modules/services/pegasus.te
---- nsaserefpolicy/policy/modules/services/pegasus.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/pegasus.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/pegasus.te 2009-09-30 16:12:48.000000000 -0400
@@ -30,7 +30,7 @@
# Local policy
@@ -17740,7 +17880,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.fc serefpolicy-3.6.32/policy/modules/services/policykit.fc
---- nsaserefpolicy/policy/modules/services/policykit.fc 2009-08-18 11:41:14.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/policykit.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/policykit.fc 2009-09-30 16:12:48.000000000 -0400
@@ -6,10 +6,13 @@
/usr/libexec/polkit-read-auth-helper -- gen_context(system_u:object_r:policykit_auth_exec_t,s0)
@@ -17758,7 +17898,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/run/PolicyKit(/.*)? gen_context(system_u:object_r:policykit_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.if serefpolicy-3.6.32/policy/modules/services/policykit.if
---- nsaserefpolicy/policy/modules/services/policykit.if 2009-08-18 18:39:50.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/policykit.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/policykit.if 2009-09-30 16:12:48.000000000 -0400
@@ -17,6 +17,8 @@
class dbus send_msg;
@@ -17828,7 +17968,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow $1 policykit_auth_t:process signal;
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.6.32/policy/modules/services/policykit.te
---- nsaserefpolicy/policy/modules/services/policykit.te 2009-08-18 11:41:14.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/policykit.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/policykit.te 2009-10-06 15:29:56.000000000 -0400
@@ -36,11 +36,12 @@
# policykit local policy
@@ -17980,7 +18120,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow policykit_resolve_t self:unix_stream_socket create_stream_socket_perms;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.6.32/policy/modules/services/postfix.fc
---- nsaserefpolicy/policy/modules/services/postfix.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/postfix.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/postfix.fc 2009-09-30 16:12:48.000000000 -0400
@@ -29,12 +29,10 @@
/usr/lib/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
@@ -17996,7 +18136,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/usr/sbin/postfix -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
/usr/sbin/postkick -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.6.32/policy/modules/services/postfix.if
---- nsaserefpolicy/policy/modules/services/postfix.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/postfix.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/postfix.if 2009-09-30 16:12:48.000000000 -0400
@@ -46,6 +46,7 @@
@@ -18245,7 +18385,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.6.32/policy/modules/services/postfix.te
---- nsaserefpolicy/policy/modules/services/postfix.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/postfix.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/postfix.te 2009-10-21 16:53:07.000000000 -0400
@@ -6,6 +6,15 @@
# Declarations
@@ -18640,7 +18780,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+userdom_home_filetrans_user_home_dir(postfix_virtual_t)
+userdom_user_home_dir_filetrans_user_home_content(postfix_virtual_t, {file dir })
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.fc serefpolicy-3.6.32/policy/modules/services/postgresql.fc
---- nsaserefpolicy/policy/modules/services/postgresql.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/postgresql.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/postgresql.fc 2009-10-21 12:55:04.000000000 -0400
@@ -2,6 +2,8 @@
# /etc
@@ -18680,7 +18820,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/var/run/postmaster.* gen_context(system_u:object_r:postgresql_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.6.32/policy/modules/services/postgresql.if
---- nsaserefpolicy/policy/modules/services/postgresql.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/postgresql.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/postgresql.if 2009-09-30 16:12:48.000000000 -0400
@@ -384,3 +384,46 @@
@@ -18730,7 +18870,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ admin_pattern($1, postgresql_tmp_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.6.32/policy/modules/services/postgresql.te
---- nsaserefpolicy/policy/modules/services/postgresql.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/postgresql.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/postgresql.te 2009-09-30 16:12:48.000000000 -0400
@@ -32,6 +32,9 @@
type postgresql_etc_t;
@@ -18777,7 +18917,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
miscfiles_read_localization(postgresql_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.if serefpolicy-3.6.32/policy/modules/services/ppp.if
---- nsaserefpolicy/policy/modules/services/ppp.if 2009-07-23 14:11:04.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/ppp.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ppp.if 2009-09-30 16:12:48.000000000 -0400
@@ -177,10 +177,16 @@
interface(`ppp_run',`
@@ -18797,7 +18937,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.6.32/policy/modules/services/ppp.te
---- nsaserefpolicy/policy/modules/services/ppp.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/ppp.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ppp.te 2009-09-30 16:12:48.000000000 -0400
@@ -38,7 +38,7 @@
files_type(pppd_etc_rw_t)
@@ -18851,7 +18991,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.6.32/policy/modules/services/prelude.te
---- nsaserefpolicy/policy/modules/services/prelude.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/prelude.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/prelude.te 2009-10-29 08:57:18.000000000 -0400
@@ -122,7 +122,8 @@
#
@@ -18864,7 +19004,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow prelude_audisp_t self:unix_stream_socket create_stream_socket_perms;
allow prelude_audisp_t self:unix_dgram_socket create_socket_perms;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/privoxy.fc serefpolicy-3.6.32/policy/modules/services/privoxy.fc
---- nsaserefpolicy/policy/modules/services/privoxy.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/privoxy.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/privoxy.fc 2009-10-13 11:19:42.000000000 -0400
@@ -1,6 +1,5 @@
@@ -18875,7 +19015,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/usr/sbin/privoxy -- gen_context(system_u:object_r:privoxy_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/privoxy.te serefpolicy-3.6.32/policy/modules/services/privoxy.te
---- nsaserefpolicy/policy/modules/services/privoxy.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/privoxy.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/privoxy.te 2009-09-30 16:12:48.000000000 -0400
@@ -47,9 +47,8 @@
manage_files_pattern(privoxy_t, privoxy_var_run_t, privoxy_var_run_t)
@@ -18889,7 +19029,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_all_recvfrom_unlabeled(privoxy_t)
corenet_all_recvfrom_netlabel(privoxy_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.6.32/policy/modules/services/procmail.te
---- nsaserefpolicy/policy/modules/services/procmail.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/procmail.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/procmail.te 2009-09-30 16:12:48.000000000 -0400
@@ -22,7 +22,7 @@
# Local policy
@@ -18939,7 +19079,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.fc serefpolicy-3.6.32/policy/modules/services/pyzor.fc
---- nsaserefpolicy/policy/modules/services/pyzor.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/pyzor.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/pyzor.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,6 +1,10 @@
/etc/pyzor(/.*)? gen_context(system_u:object_r:pyzor_etc_t, s0)
@@ -18953,7 +19093,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/usr/bin/pyzor -- gen_context(system_u:object_r:pyzor_exec_t,s0)
/usr/bin/pyzord -- gen_context(system_u:object_r:pyzord_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.6.32/policy/modules/services/pyzor.if
---- nsaserefpolicy/policy/modules/services/pyzor.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/pyzor.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/pyzor.if 2009-09-30 16:12:48.000000000 -0400
@@ -88,3 +88,50 @@
corecmd_search_bin($1)
@@ -19007,7 +19147,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.6.32/policy/modules/services/pyzor.te
---- nsaserefpolicy/policy/modules/services/pyzor.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/pyzor.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/pyzor.te 2009-09-30 16:12:48.000000000 -0400
@@ -6,6 +6,38 @@
# Declarations
@@ -19074,7 +19214,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radvd.te serefpolicy-3.6.32/policy/modules/services/radvd.te
---- nsaserefpolicy/policy/modules/services/radvd.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/radvd.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/radvd.te 2009-09-30 16:12:48.000000000 -0400
@@ -41,6 +41,7 @@
kernel_rw_net_sysctls(radvd_t)
@@ -19085,7 +19225,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_all_recvfrom_unlabeled(radvd_t)
corenet_all_recvfrom_netlabel(radvd_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.fc serefpolicy-3.6.32/policy/modules/services/razor.fc
---- nsaserefpolicy/policy/modules/services/razor.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/razor.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/razor.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,3 +1,4 @@
+/root/\.razor(/.*)? gen_context(system_u:object_r:razor_home_t,s0)
@@ -19093,7 +19233,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/etc/razor(/.*)? gen_context(system_u:object_r:razor_etc_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.if serefpolicy-3.6.32/policy/modules/services/razor.if
---- nsaserefpolicy/policy/modules/services/razor.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/razor.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/razor.if 2009-09-30 16:12:48.000000000 -0400
@@ -157,3 +157,45 @@
@@ -19142,7 +19282,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.te serefpolicy-3.6.32/policy/modules/services/razor.te
---- nsaserefpolicy/policy/modules/services/razor.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/razor.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/razor.te 2009-09-30 16:12:48.000000000 -0400
@@ -6,6 +6,32 @@
# Declarations
@@ -20134,7 +20274,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.6.32/policy/modules/services/ricci.te
---- nsaserefpolicy/policy/modules/services/ricci.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/ricci.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ricci.te 2009-10-15 13:16:38.000000000 -0400
@@ -194,10 +194,13 @@
# ricci_modcluster local policy
@@ -20225,7 +20365,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
ccs_read_config(ricci_modstorage_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-3.6.32/policy/modules/services/rpcbind.if
---- nsaserefpolicy/policy/modules/services/rpcbind.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/rpcbind.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/rpcbind.if 2009-09-30 16:12:48.000000000 -0400
@@ -97,6 +97,26 @@
@@ -20255,7 +20395,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## an rpcbind environment
##
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.6.32/policy/modules/services/rpcbind.te
---- nsaserefpolicy/policy/modules/services/rpcbind.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/rpcbind.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/rpcbind.te 2009-09-30 17:16:58.000000000 -0400
@@ -42,6 +42,7 @@
@@ -20266,7 +20406,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_all_recvfrom_unlabeled(rpcbind_t)
corenet_all_recvfrom_netlabel(rpcbind_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.6.32/policy/modules/services/rpc.if
---- nsaserefpolicy/policy/modules/services/rpc.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/rpc.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/rpc.if 2009-09-30 16:12:48.000000000 -0400
@@ -54,7 +54,7 @@
allow $1_t self:unix_dgram_socket create_socket_perms;
@@ -20297,7 +20437,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.6.32/policy/modules/services/rpc.te
---- nsaserefpolicy/policy/modules/services/rpc.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/rpc.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/rpc.te 2009-11-09 13:15:31.000000000 -0500
@@ -53,7 +53,7 @@
# RPC local policy
@@ -20386,7 +20526,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.6.32/policy/modules/services/rsync.te
---- nsaserefpolicy/policy/modules/services/rsync.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/rsync.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/rsync.te 2009-09-30 16:12:48.000000000 -0400
@@ -8,6 +8,13 @@
@@ -20431,7 +20571,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
auth_can_read_shadow_passwords(rsync_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtkit.if serefpolicy-3.6.32/policy/modules/services/rtkit.if
---- nsaserefpolicy/policy/modules/services/rtkit.if 2009-09-16 09:09:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/rtkit.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/rtkit.if 2009-11-06 14:26:20.000000000 -0500
@@ -38,3 +38,23 @@
allow $1 rtkit_daemon_t:dbus send_msg;
@@ -20458,7 +20598,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ rtkit_daemon_dbus_chat($1)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtkit.te serefpolicy-3.6.32/policy/modules/services/rtkit.te
---- nsaserefpolicy/policy/modules/services/rtkit.te 2009-09-16 09:09:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/rtkit.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/rtkit.te 2009-09-30 16:12:48.000000000 -0400
@@ -17,9 +17,11 @@
@@ -20473,7 +20613,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
fs_rw_anon_inodefs_files(rtkit_daemon_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.6.32/policy/modules/services/samba.fc
---- nsaserefpolicy/policy/modules/services/samba.fc 2009-07-29 15:15:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/samba.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/samba.fc 2009-09-30 16:12:48.000000000 -0400
@@ -51,3 +51,7 @@
/var/run/winbindd(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0)
@@ -20484,8 +20624,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/lib/samba/scripts(/.*)? gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.6.32/policy/modules/services/samba.if
---- nsaserefpolicy/policy/modules/services/samba.if 2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/samba.if 2009-09-30 16:12:48.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/samba.if 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/samba.if 2009-11-13 11:04:22.000000000 -0500
@@ -62,6 +62,25 @@
########################################
@@ -20659,7 +20799,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ admin_pattern($1, samba_unconfined_script_exec_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.32/policy/modules/services/samba.te
---- nsaserefpolicy/policy/modules/services/samba.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/samba.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/samba.te 2009-10-20 15:50:54.000000000 -0400
@@ -66,6 +66,13 @@
##
@@ -20893,7 +21033,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ can_exec(smbd_t, samba_unconfined_script_exec_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.6.32/policy/modules/services/sasl.te
---- nsaserefpolicy/policy/modules/services/sasl.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/sasl.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/sasl.te 2009-09-30 16:12:48.000000000 -0400
@@ -31,7 +31,7 @@
# Local policy
@@ -20958,7 +21098,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.6.32/policy/modules/services/sendmail.if
---- nsaserefpolicy/policy/modules/services/sendmail.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/sendmail.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/sendmail.if 2009-09-30 16:12:48.000000000 -0400
@@ -59,20 +59,20 @@
@@ -21133,7 +21273,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow $1 sendmail_t:fifo_file rw_fifo_file_perms;
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.6.32/policy/modules/services/sendmail.te
---- nsaserefpolicy/policy/modules/services/sendmail.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/sendmail.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/sendmail.te 2009-09-30 16:12:48.000000000 -0400
@@ -20,13 +20,17 @@
mta_mailserver_delivery(sendmail_t)
@@ -21311,7 +21451,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-dontaudit sendmail_t admin_tty_type:chr_file { getattr ioctl };
-') dnl end TODO
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.fc serefpolicy-3.6.32/policy/modules/services/setroubleshoot.fc
---- nsaserefpolicy/policy/modules/services/setroubleshoot.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/setroubleshoot.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/setroubleshoot.fc 2009-09-30 16:12:48.000000000 -0400
@@ -5,3 +5,5 @@
/var/log/setroubleshoot(/.*)? gen_context(system_u:object_r:setroubleshoot_var_log_t,s0)
@@ -21320,7 +21460,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/usr/share/setroubleshoot/SetroubleshootFixit\.py* -- gen_context(system_u:object_r:setroubleshoot_fixit_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.6.32/policy/modules/services/setroubleshoot.if
---- nsaserefpolicy/policy/modules/services/setroubleshoot.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/setroubleshoot.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/setroubleshoot.if 2009-10-22 15:56:48.000000000 -0400
@@ -16,8 +16,8 @@
')
@@ -21459,7 +21599,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ admin_pattern($1, setroubleshoot_var_run_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.6.32/policy/modules/services/setroubleshoot.te
---- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/setroubleshoot.te 2009-11-02 08:56:55.000000000 -0500
@@ -22,13 +22,19 @@
type setroubleshoot_var_run_t;
@@ -21602,7 +21742,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ policykit_dbus_chat(setroubleshoot_fixit_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.6.32/policy/modules/services/smartmon.te
---- nsaserefpolicy/policy/modules/services/smartmon.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/smartmon.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/smartmon.te 2009-09-30 16:12:48.000000000 -0400
@@ -19,14 +19,18 @@
type fsdaemon_tmp_t;
@@ -21665,7 +21805,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.if serefpolicy-3.6.32/policy/modules/services/snmp.if
---- nsaserefpolicy/policy/modules/services/snmp.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/snmp.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/snmp.if 2009-09-30 16:12:48.000000000 -0400
@@ -50,6 +50,24 @@
@@ -21720,7 +21860,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
## All of the rules required to administrate
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.6.32/policy/modules/services/snmp.te
---- nsaserefpolicy/policy/modules/services/snmp.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/snmp.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/snmp.te 2009-09-30 16:12:48.000000000 -0400
@@ -27,7 +27,7 @@
#
@@ -21741,7 +21881,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dev_list_sysfs(snmpd_t)
dev_read_sysfs(snmpd_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.6.32/policy/modules/services/spamassassin.fc
---- nsaserefpolicy/policy/modules/services/spamassassin.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/spamassassin.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/spamassassin.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,15 +1,26 @@
-HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:spamassassin_home_t,s0)
@@ -21773,7 +21913,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/spool/MD-Quarantine(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0)
+/var/spool/MIMEDefang(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.6.32/policy/modules/services/spamassassin.if
---- nsaserefpolicy/policy/modules/services/spamassassin.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/spamassassin.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/spamassassin.if 2009-09-30 16:12:48.000000000 -0400
@@ -111,6 +111,27 @@
')
@@ -21884,7 +22024,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ admin_pattern($1, spamd_var_run_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.6.32/policy/modules/services/spamassassin.te
---- nsaserefpolicy/policy/modules/services/spamassassin.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/spamassassin.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/spamassassin.te 2009-10-26 09:38:33.000000000 -0400
@@ -20,6 +20,35 @@
##
@@ -22188,7 +22328,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
udev_read_db(spamd_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.6.32/policy/modules/services/squid.te
---- nsaserefpolicy/policy/modules/services/squid.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/squid.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/squid.te 2009-09-30 16:12:48.000000000 -0400
@@ -67,7 +67,9 @@
@@ -22219,7 +22359,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-allow squid_t tmpfs_t:file { read write };
-') dnl end TODO
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.fc serefpolicy-3.6.32/policy/modules/services/ssh.fc
---- nsaserefpolicy/policy/modules/services/ssh.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/ssh.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ssh.fc 2009-10-09 09:06:33.000000000 -0400
@@ -14,3 +14,5 @@
/usr/sbin/sshd -- gen_context(system_u:object_r:sshd_exec_t,s0)
@@ -22228,7 +22368,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/root/\.ssh(/.*)? gen_context(system_u:object_r:home_ssh_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.6.32/policy/modules/services/ssh.if
---- nsaserefpolicy/policy/modules/services/ssh.if 2009-07-23 14:11:04.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/ssh.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ssh.if 2009-10-08 09:12:21.000000000 -0400
@@ -36,6 +36,7 @@
gen_require(`
@@ -22552,7 +22692,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.6.32/policy/modules/services/ssh.te
---- nsaserefpolicy/policy/modules/services/ssh.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/ssh.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ssh.te 2009-10-08 09:12:07.000000000 -0400
@@ -41,6 +41,9 @@
files_tmp_file(sshd_tmp_t)
@@ -22746,7 +22886,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.fc serefpolicy-3.6.32/policy/modules/services/sssd.fc
---- nsaserefpolicy/policy/modules/services/sssd.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/sssd.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/sssd.fc 2009-10-21 10:05:54.000000000 -0400
@@ -1,6 +1,9 @@
-/etc/rc.d/init.d/sssd -- gen_context(system_u:object_r:sssd_initrc_exec_t,s0)
@@ -22760,8 +22900,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
/var/run/sssd.pid -- gen_context(system_u:object_r:sssd_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.if serefpolicy-3.6.32/policy/modules/services/sssd.if
---- nsaserefpolicy/policy/modules/services/sssd.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/sssd.if 2009-09-30 16:12:48.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/sssd.if 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/sssd.if 2009-11-13 11:16:50.000000000 -0500
@@ -12,12 +12,32 @@
#
interface(`sssd_domtrans',`
@@ -22796,7 +22936,33 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
##
## Read sssd PID files.
-@@ -116,6 +136,27 @@
+@@ -96,6 +116,25 @@
+
+ ########################################
+ ##
++## Read sssd config files.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`sssd_read_config_files',`
++ gen_require(`
++ type sssd_config_t;
++ ')
++
++ sssd_search_lib($1)
++ read_files_pattern($1, sssd_config_t, sssd_config_t)
++')
++
++########################################
++##
+ ## Create, read, write, and delete
+ ## sssd lib files.
+ ##
+@@ -116,6 +155,27 @@
########################################
##
@@ -22825,7 +22991,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## sssd over dbus.
##
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.te serefpolicy-3.6.32/policy/modules/services/sssd.te
---- nsaserefpolicy/policy/modules/services/sssd.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/sssd.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/sssd.te 2009-10-21 10:05:38.000000000 -0400
@@ -16,6 +16,9 @@
type sssd_var_lib_t;
@@ -22872,7 +23038,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dbus_system_bus_client(sssd_t)
dbus_connect_system_bus(sssd_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.6.32/policy/modules/services/sysstat.te
---- nsaserefpolicy/policy/modules/services/sysstat.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/sysstat.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/sysstat.te 2009-09-30 16:12:48.000000000 -0400
@@ -19,14 +19,15 @@
# Local policy
@@ -22893,7 +23059,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# get info from /proc
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.fc serefpolicy-3.6.32/policy/modules/services/tftp.fc
---- nsaserefpolicy/policy/modules/services/tftp.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/tftp.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/tftp.fc 2009-10-16 08:44:49.000000000 -0400
@@ -5,4 +5,4 @@
/tftpboot -d gen_context(system_u:object_r:tftpdir_t,s0)
@@ -23118,7 +23284,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp.te serefpolicy-3.6.32/policy/modules/services/uucp.te
---- nsaserefpolicy/policy/modules/services/uucp.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/uucp.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/uucp.te 2009-09-30 16:12:48.000000000 -0400
@@ -95,6 +95,8 @@
files_search_home(uucpd_t)
@@ -23149,7 +23315,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.fc serefpolicy-3.6.32/policy/modules/services/virt.fc
---- nsaserefpolicy/policy/modules/services/virt.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/virt.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/virt.fc 2009-10-26 13:22:08.000000000 -0400
@@ -8,5 +8,18 @@
@@ -23171,7 +23337,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/var/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.6.32/policy/modules/services/virt.if
---- nsaserefpolicy/policy/modules/services/virt.if 2009-08-31 13:30:04.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/virt.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/virt.if 2009-10-28 12:01:39.000000000 -0400
@@ -136,7 +136,7 @@
')
@@ -23391,8 +23557,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ manage_lnk_files_pattern($1, svirt_cache_t, svirt_cache_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.32/policy/modules/services/virt.te
---- nsaserefpolicy/policy/modules/services/virt.te 2009-08-31 13:30:04.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/virt.te 2009-10-28 12:03:46.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/virt.te 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/virt.te 2009-11-13 08:12:38.000000000 -0500
@@ -20,6 +20,28 @@
##
gen_tunable(virt_use_samba, false)
@@ -23685,7 +23851,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ dev_rw_printer(svirt_t)
+')
+
-+dev_list_sysfs(svirt_t)
++dev_read_sysfs(svirt_t)
+
+tunable_policy(`virt_manage_sysfs',`
+ dev_rw_sysfs(svirt_t)
@@ -23787,7 +23953,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ virt_stream_connect(virt_domain)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.6.32/policy/modules/services/w3c.te
---- nsaserefpolicy/policy/modules/services/w3c.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/w3c.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/w3c.te 2009-09-30 16:12:48.000000000 -0400
@@ -8,11 +8,18 @@
@@ -23809,7 +23975,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_sendrecv_ftp_port(httpd_w3c_validator_script_t)
corenet_tcp_connect_http_port(httpd_w3c_validator_script_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.6.32/policy/modules/services/xserver.fc
---- nsaserefpolicy/policy/modules/services/xserver.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/xserver.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/xserver.fc 2009-10-30 07:58:49.000000000 -0400
@@ -3,12 +3,19 @@
#
@@ -23902,7 +24068,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
ifdef(`distro_suse',`
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.6.32/policy/modules/services/xserver.if
---- nsaserefpolicy/policy/modules/services/xserver.if 2009-09-09 15:37:17.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/xserver.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/xserver.if 2009-11-10 16:23:46.000000000 -0500
@@ -74,6 +74,12 @@
@@ -24775,7 +24941,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.32/policy/modules/services/xserver.te
---- nsaserefpolicy/policy/modules/services/xserver.te 2009-08-28 14:58:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/services/xserver.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/xserver.te 2009-11-09 15:38:27.000000000 -0500
@@ -34,6 +34,13 @@
@@ -25574,7 +25740,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-allow xdm_t user_home_type:file unlink;
-') dnl end TODO
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.6.32/policy/modules/system/application.if
---- nsaserefpolicy/policy/modules/system/application.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/application.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/application.if 2009-10-02 10:28:50.000000000 -0400
@@ -2,7 +2,7 @@
@@ -25608,7 +25774,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow $1 application_domain_type:process signull;
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.6.32/policy/modules/system/application.te
---- nsaserefpolicy/policy/modules/system/application.te 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/application.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/application.te 2009-09-30 16:12:48.000000000 -0400
@@ -7,7 +7,18 @@
# Executables to be run by user
@@ -25630,7 +25796,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.6.32/policy/modules/system/authlogin.fc
---- nsaserefpolicy/policy/modules/system/authlogin.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/authlogin.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/authlogin.fc 2009-09-30 16:12:48.000000000 -0400
@@ -7,12 +7,10 @@
/etc/passwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
@@ -25658,8 +25824,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/run/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.6.32/policy/modules/system/authlogin.if
---- nsaserefpolicy/policy/modules/system/authlogin.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/system/authlogin.if 2009-11-10 16:06:50.000000000 -0500
+--- nsaserefpolicy/policy/modules/system/authlogin.if 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/system/authlogin.if 2009-11-13 11:28:16.000000000 -0500
@@ -40,17 +40,76 @@
##
##
@@ -25971,7 +26137,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.6.32/policy/modules/system/authlogin.te
---- nsaserefpolicy/policy/modules/system/authlogin.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/authlogin.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/authlogin.te 2009-10-13 18:05:10.000000000 -0400
@@ -103,6 +103,7 @@
@@ -26001,7 +26167,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
#
# PAM local policy
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.6.32/policy/modules/system/fstools.fc
---- nsaserefpolicy/policy/modules/system/fstools.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/fstools.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/fstools.fc 2009-11-02 15:59:17.000000000 -0500
@@ -1,4 +1,3 @@
-/sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -26025,7 +26191,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.6.32/policy/modules/system/fstools.te
---- nsaserefpolicy/policy/modules/system/fstools.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/fstools.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/fstools.te 2009-09-30 16:12:48.000000000 -0400
@@ -118,6 +118,8 @@
fs_search_tmpfs(fsadm_t)
@@ -26057,7 +26223,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ xen_rw_image_files(fsadm_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.fc serefpolicy-3.6.32/policy/modules/system/init.fc
---- nsaserefpolicy/policy/modules/system/init.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/init.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/init.fc 2009-09-30 16:12:48.000000000 -0400
@@ -4,10 +4,10 @@
/etc/init\.d/.* -- gen_context(system_u:object_r:initrc_exec_t,s0)
@@ -26083,7 +26249,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
#
# /var
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.6.32/policy/modules/system/init.if
---- nsaserefpolicy/policy/modules/system/init.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/init.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/init.if 2009-11-02 13:55:55.000000000 -0500
@@ -162,6 +162,7 @@
gen_require(`
@@ -26340,7 +26506,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow init_t $1:unix_dgram_socket sendto;
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.32/policy/modules/system/init.te
---- nsaserefpolicy/policy/modules/system/init.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/init.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/init.te 2009-11-09 16:27:27.000000000 -0500
@@ -17,6 +17,20 @@
##
@@ -26927,8 +27093,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ fail2ban_read_lib_files(daemon)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.fc serefpolicy-3.6.32/policy/modules/system/ipsec.fc
---- nsaserefpolicy/policy/modules/system/ipsec.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/system/ipsec.fc 2009-09-30 16:12:48.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/ipsec.fc 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/system/ipsec.fc 2009-11-13 11:30:56.000000000 -0500
@@ -1,3 +1,6 @@
+/etc/rc\.d/init\.d/ipsec -- gen_context(system_u:object_r:ipsec_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/racoon -- gen_context(system_u:object_r:ipsec_initrc_exec_t,s0)
@@ -26936,8 +27102,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/etc/ipsec\.secrets -- gen_context(system_u:object_r:ipsec_key_file_t,s0)
/etc/ipsec\.conf -- gen_context(system_u:object_r:ipsec_conf_file_t,s0)
/etc/racoon/psk\.txt -- gen_context(system_u:object_r:ipsec_key_file_t,s0)
+@@ -34,6 +37,8 @@
+
+ /var/racoon(/.*)? gen_context(system_u:object_r:ipsec_var_run_t,s0)
+
++/var/log/pluto\.log -- gen_context(system_u:object_r:ipsec_log_t,s0)
++
+ /var/run/pluto(/.*)? gen_context(system_u:object_r:ipsec_var_run_t,s0)
++/var/run/racoon\.pid -- gen_context(system_u:object_r:ipsec_var_run_t,s0)
+
+-/var/run/racoon.pid -- gen_context(system_u:object_r:ipsec_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.6.32/policy/modules/system/ipsec.if
---- nsaserefpolicy/policy/modules/system/ipsec.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/ipsec.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/ipsec.if 2009-09-30 16:12:48.000000000 -0400
@@ -229,3 +229,28 @@
ipsec_domtrans_setkey($1)
@@ -26969,8 +27145,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ role $2 types racoon_t;
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.6.32/policy/modules/system/ipsec.te
---- nsaserefpolicy/policy/modules/system/ipsec.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/system/ipsec.te 2009-10-28 08:39:49.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/ipsec.te 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/system/ipsec.te 2009-11-13 08:03:49.000000000 -0500
@@ -6,6 +6,13 @@
# Declarations
#
@@ -26995,7 +27171,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# type for file(s) containing ipsec keys - RSA or preshared
type ipsec_key_file_t;
files_type(ipsec_key_file_t)
-@@ -43,6 +53,9 @@
+@@ -22,6 +32,9 @@
+ # Default type for IPSEC SPD entries
+ type ipsec_spd_t;
+
++type ipsec_log_t;
++logging_log_file(ipsec_log_t)
++
+ # type for runtime files, including pluto.ctl
+ type ipsec_var_run_t;
+ files_pid_file(ipsec_var_run_t)
+@@ -43,6 +56,9 @@
init_daemon_domain(racoon_t, racoon_exec_t)
role system_r types racoon_t;
@@ -27005,7 +27191,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
type setkey_t;
type setkey_exec_t;
init_system_domain(setkey_t, setkey_exec_t)
-@@ -53,21 +66,23 @@
+@@ -53,21 +69,23 @@
# ipsec Local policy
#
@@ -27032,7 +27218,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
read_lnk_files_pattern(ipsec_t, ipsec_key_file_t, ipsec_key_file_t)
manage_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t)
-@@ -82,16 +97,17 @@
+@@ -82,16 +100,17 @@
# so try flipping back into the ipsec_mgmt_t domain
corecmd_shell_domtrans(ipsec_t, ipsec_mgmt_t)
allow ipsec_mgmt_t ipsec_t:fd use;
@@ -27052,7 +27238,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_getattr_core_if(ipsec_t)
kernel_getattr_message_if(ipsec_t)
-@@ -120,7 +136,9 @@
+@@ -120,7 +139,9 @@
domain_use_interactive_fds(ipsec_t)
@@ -27062,7 +27248,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
fs_getattr_all_fs(ipsec_t)
fs_search_auto_mountpoints(ipsec_t)
-@@ -154,12 +172,12 @@
+@@ -154,16 +175,19 @@
#
allow ipsec_mgmt_t self:capability { net_admin sys_tty_config dac_override dac_read_search };
@@ -27077,7 +27263,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow ipsec_mgmt_t ipsec_mgmt_lock_t:file manage_file_perms;
files_lock_filetrans(ipsec_mgmt_t, ipsec_mgmt_lock_t, file)
-@@ -241,6 +259,7 @@
+
++manage_files_pattern(ipsec_mgmt_t, ipsec_log_t, ipsec_log_t)
++logging_log_filetrans(ipsec_mgmt_t, ipsec_log_t, file)
++
+ allow ipsec_mgmt_t ipsec_mgmt_var_run_t:file manage_file_perms;
+ files_pid_filetrans(ipsec_mgmt_t, ipsec_mgmt_var_run_t, file)
+
+@@ -241,6 +265,7 @@
init_use_script_ptys(ipsec_mgmt_t)
init_exec_script_files(ipsec_mgmt_t)
init_use_fds(ipsec_mgmt_t)
@@ -27085,7 +27278,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_send_syslog_msg(ipsec_mgmt_t)
-@@ -280,6 +299,13 @@
+@@ -280,6 +305,13 @@
allow racoon_t self:netlink_selinux_socket { bind create read };
allow racoon_t self:udp_socket create_socket_perms;
allow racoon_t self:key_socket create_socket_perms;
@@ -27099,7 +27292,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# manage pid file
manage_files_pattern(racoon_t, ipsec_var_run_t, ipsec_var_run_t)
-@@ -297,6 +323,13 @@
+@@ -297,6 +329,13 @@
kernel_read_system_state(racoon_t)
kernel_read_network_state(racoon_t)
@@ -27113,7 +27306,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_all_recvfrom_unlabeled(racoon_t)
corenet_tcp_sendrecv_all_if(racoon_t)
corenet_udp_sendrecv_all_if(racoon_t)
-@@ -314,6 +347,8 @@
+@@ -314,6 +353,8 @@
files_read_etc_files(racoon_t)
@@ -27122,7 +27315,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# allow racoon to use avc_has_perm to check context on proposed SA
selinux_compute_access_vector(racoon_t)
-@@ -328,6 +363,14 @@
+@@ -328,6 +369,14 @@
miscfiles_read_localization(racoon_t)
@@ -27137,7 +27330,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
#
# Setkey local policy
-@@ -347,6 +390,7 @@
+@@ -347,6 +396,7 @@
files_read_etc_files(setkey_t)
init_dontaudit_use_fds(setkey_t)
@@ -27146,7 +27339,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# allow setkey to set the context for ipsec SAs and policy.
ipsec_setcontext_default_spd(setkey_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.fc serefpolicy-3.6.32/policy/modules/system/iptables.fc
---- nsaserefpolicy/policy/modules/system/iptables.fc 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/iptables.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/iptables.fc 2009-10-26 15:13:26.000000000 -0400
@@ -1,7 +1,16 @@
-/sbin/ip6tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
@@ -27170,7 +27363,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/usr/sbin/iptables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.if serefpolicy-3.6.32/policy/modules/system/iptables.if
---- nsaserefpolicy/policy/modules/system/iptables.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/iptables.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/iptables.if 2009-10-26 15:11:55.000000000 -0400
@@ -19,6 +19,24 @@
domtrans_pattern($1, iptables_exec_t, iptables_t)
@@ -27281,7 +27474,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.6.32/policy/modules/system/iptables.te
---- nsaserefpolicy/policy/modules/system/iptables.te 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/iptables.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/iptables.te 2009-10-27 09:34:30.000000000 -0400
@@ -11,6 +11,12 @@
init_system_domain(iptables_t, iptables_exec_t)
@@ -27345,7 +27538,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.if serefpolicy-3.6.32/policy/modules/system/iscsi.if
---- nsaserefpolicy/policy/modules/system/iscsi.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/iscsi.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/iscsi.if 2009-09-30 16:12:48.000000000 -0400
@@ -17,3 +17,43 @@
@@ -27392,7 +27585,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.6.32/policy/modules/system/iscsi.te
---- nsaserefpolicy/policy/modules/system/iscsi.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/iscsi.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/iscsi.te 2009-09-30 16:12:48.000000000 -0400
@@ -55,6 +55,7 @@
files_pid_filetrans(iscsid_t, iscsi_var_run_t, file)
@@ -27418,7 +27611,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-sysnet_dns_name_resolve(iscsid_t)
+miscfiles_read_localization(iscsid_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.te serefpolicy-3.6.32/policy/modules/system/kdump.te
---- nsaserefpolicy/policy/modules/system/kdump.te 2009-09-09 09:23:16.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/kdump.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/kdump.te 2009-11-12 08:45:07.000000000 -0500
@@ -21,7 +21,7 @@
# kdump local policy
@@ -27442,7 +27635,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+permissive kdump_t;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.6.32/policy/modules/system/libraries.fc
---- nsaserefpolicy/policy/modules/system/libraries.fc 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/libraries.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/libraries.fc 2009-11-12 08:52:03.000000000 -0500
@@ -60,12 +60,15 @@
#
@@ -27743,7 +27936,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.if serefpolicy-3.6.32/policy/modules/system/libraries.if
---- nsaserefpolicy/policy/modules/system/libraries.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/libraries.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/libraries.if 2009-10-20 14:41:55.000000000 -0400
@@ -17,6 +17,7 @@
@@ -27772,7 +27965,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
read_lnk_files_pattern($1, lib_t, { lib_t textrel_shlib_t })
mmap_files_pattern($1, lib_t, { lib_t textrel_shlib_t })
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.6.32/policy/modules/system/libraries.te
---- nsaserefpolicy/policy/modules/system/libraries.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/libraries.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/libraries.te 2009-10-20 18:45:39.000000000 -0400
@@ -58,11 +58,11 @@
# ldconfig local policy
@@ -27836,7 +28029,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ unconfined_domain(ldconfig_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.6.32/policy/modules/system/locallogin.te
---- nsaserefpolicy/policy/modules/system/locallogin.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/locallogin.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/locallogin.te 2009-09-30 16:13:33.000000000 -0400
@@ -33,7 +33,7 @@
# Local login local policy
@@ -27927,7 +28120,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- nscd_socket_use(sulogin_t)
-')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.6.32/policy/modules/system/logging.fc
---- nsaserefpolicy/policy/modules/system/logging.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/logging.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/logging.fc 2009-09-30 16:12:48.000000000 -0400
@@ -51,17 +51,21 @@
@@ -27956,7 +28149,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.6.32/policy/modules/system/logging.if
---- nsaserefpolicy/policy/modules/system/logging.if 2009-08-28 14:58:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/logging.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/logging.if 2009-10-07 13:42:04.000000000 -0400
@@ -69,6 +69,20 @@
@@ -27998,7 +28191,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.6.32/policy/modules/system/logging.te
---- nsaserefpolicy/policy/modules/system/logging.te 2009-08-28 14:58:20.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/logging.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/logging.te 2009-09-30 16:12:48.000000000 -0400
@@ -123,10 +123,10 @@
@@ -28108,7 +28301,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.if serefpolicy-3.6.32/policy/modules/system/lvm.if
---- nsaserefpolicy/policy/modules/system/lvm.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/lvm.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/lvm.if 2009-10-15 13:16:38.000000000 -0400
@@ -21,6 +21,26 @@
@@ -28161,7 +28354,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ domtrans_pattern($1,clvmd_exec_t,clvmd_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.6.32/policy/modules/system/lvm.te
---- nsaserefpolicy/policy/modules/system/lvm.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/lvm.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/lvm.te 2009-10-20 18:39:22.000000000 -0400
@@ -10,6 +10,9 @@
type clvmd_exec_t;
@@ -28283,7 +28476,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
xen_dontaudit_rw_unix_stream_sockets(lvm_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.6.32/policy/modules/system/miscfiles.fc
---- nsaserefpolicy/policy/modules/system/miscfiles.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/miscfiles.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/miscfiles.fc 2009-10-09 09:06:59.000000000 -0400
@@ -85,3 +85,5 @@
/var/empty/sshd/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
@@ -28292,7 +28485,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+HOME_DIR/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.6.32/policy/modules/system/miscfiles.if
---- nsaserefpolicy/policy/modules/system/miscfiles.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/miscfiles.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/miscfiles.if 2009-11-09 15:19:47.000000000 -0500
@@ -23,6 +23,28 @@
@@ -28403,7 +28596,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.te serefpolicy-3.6.32/policy/modules/system/miscfiles.te
---- nsaserefpolicy/policy/modules/system/miscfiles.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/miscfiles.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/miscfiles.te 2009-10-09 09:09:07.000000000 -0400
@@ -12,6 +12,9 @@
type cert_t;
@@ -28416,7 +28609,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# fonts_t is the type of various font
# files in /usr
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.fc serefpolicy-3.6.32/policy/modules/system/modutils.fc
---- nsaserefpolicy/policy/modules/system/modutils.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/modutils.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/modutils.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,6 +1,7 @@
@@ -28427,7 +28620,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
ifdef(`distro_gentoo',`
# gentoo init scripts still manage this file
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.if serefpolicy-3.6.32/policy/modules/system/modutils.if
---- nsaserefpolicy/policy/modules/system/modutils.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/modutils.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/modutils.if 2009-11-09 13:38:57.000000000 -0500
@@ -1,5 +1,24 @@
## Policy for kernel module utilities
@@ -28503,7 +28696,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.6.32/policy/modules/system/modutils.te
---- nsaserefpolicy/policy/modules/system/modutils.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/modutils.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/modutils.te 2009-11-09 16:33:47.000000000 -0500
@@ -19,6 +19,7 @@
type insmod_exec_t;
@@ -28672,7 +28865,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_etc_filetrans(update_modules_t, modules_conf_t, file)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.6.32/policy/modules/system/mount.fc
---- nsaserefpolicy/policy/modules/system/mount.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/mount.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/mount.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,4 +1,9 @@
/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
@@ -28686,7 +28879,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/cache/davfs2(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0)
+/var/run/davfs2(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-3.6.32/policy/modules/system/mount.if
---- nsaserefpolicy/policy/modules/system/mount.if 2009-07-29 15:15:33.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/mount.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/mount.if 2009-09-30 16:12:48.000000000 -0400
@@ -84,9 +84,11 @@
interface(`mount_signal',`
@@ -28701,8 +28894,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.6.32/policy/modules/system/mount.te
---- nsaserefpolicy/policy/modules/system/mount.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/system/mount.te 2009-11-03 08:56:35.000000000 -0500
+--- nsaserefpolicy/policy/modules/system/mount.te 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/system/mount.te 2009-11-13 07:48:33.000000000 -0500
@@ -18,8 +18,12 @@
init_system_domain(mount_t, mount_exec_t)
role system_r types mount_t;
@@ -28733,7 +28926,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# setuid/setgid needed to mount cifs
-allow mount_t self:capability { ipc_lock sys_rawio sys_admin dac_override chown sys_tty_config setuid setgid };
+allow mount_t self:capability { fsetid ipc_lock sys_rawio sys_resource sys_admin dac_override chown sys_tty_config setuid setgid };
-+allow mount_t self:process { ptrace signal };
++allow mount_t self:process { getsched ptrace signal };
+allow mount_t self:fifo_file rw_fifo_file_perms;
+allow mount_t self:unix_stream_socket create_stream_socket_perms;
+allow mount_t self:unix_dgram_socket create_socket_perms;
@@ -28910,7 +29103,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.fc serefpolicy-3.6.32/policy/modules/system/raid.fc
---- nsaserefpolicy/policy/modules/system/raid.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/raid.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/raid.fc 2009-09-30 16:12:48.000000000 -0400
@@ -3,3 +3,5 @@
/sbin/mdmpd -- gen_context(system_u:object_r:mdadm_exec_t,s0)
@@ -28919,7 +29112,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/dev/.mdadm.map -- gen_context(system_u:object_r:mdadm_map_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.6.32/policy/modules/system/raid.te
---- nsaserefpolicy/policy/modules/system/raid.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/raid.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/raid.te 2009-09-30 16:12:48.000000000 -0400
@@ -14,6 +14,9 @@
type mdadm_var_run_t;
@@ -28949,7 +29142,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
fs_search_auto_mountpoints(mdadm_t)
fs_dontaudit_list_tmpfs(mdadm_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.6.32/policy/modules/system/selinuxutil.fc
---- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/selinuxutil.fc 2009-09-30 16:12:48.000000000 -0400
@@ -6,13 +6,13 @@
/etc/selinux(/.*)? gen_context(system_u:object_r:selinux_config_t,s0)
@@ -28991,7 +29184,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/etc/share/selinux/targeted(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
+/etc/share/selinux/mls(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.6.32/policy/modules/system/selinuxutil.if
---- nsaserefpolicy/policy/modules/system/selinuxutil.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/selinuxutil.if 2009-10-20 08:04:03.000000000 -0400
@@ -351,6 +351,27 @@
@@ -29349,7 +29542,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.6.32/policy/modules/system/selinuxutil.te
---- nsaserefpolicy/policy/modules/system/selinuxutil.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/selinuxutil.te 2009-10-18 12:56:30.000000000 -0400
@@ -23,6 +23,9 @@
type selinux_config_t;
@@ -29726,7 +29919,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ unconfined_domain(setfiles_mac_t)
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/setrans.if serefpolicy-3.6.32/policy/modules/system/setrans.if
---- nsaserefpolicy/policy/modules/system/setrans.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/setrans.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/setrans.if 2009-09-30 16:12:48.000000000 -0400
@@ -21,3 +21,23 @@
stream_connect_pattern($1, setrans_var_run_t, setrans_var_run_t, setrans_t)
@@ -29753,7 +29946,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.fc serefpolicy-3.6.32/policy/modules/system/sysnetwork.fc
---- nsaserefpolicy/policy/modules/system/sysnetwork.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/sysnetwork.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/sysnetwork.fc 2009-09-30 16:12:48.000000000 -0400
@@ -11,15 +11,20 @@
/etc/dhclient-script -- gen_context(system_u:object_r:dhcp_etc_t,s0)
@@ -29784,7 +29977,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/etc/firestarter/firestarter\.sh gen_context(system_u:object_r:dhcpc_helper_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.6.32/policy/modules/system/sysnetwork.if
---- nsaserefpolicy/policy/modules/system/sysnetwork.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/sysnetwork.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/sysnetwork.if 2009-09-30 16:12:48.000000000 -0400
@@ -43,6 +43,39 @@
@@ -29964,7 +30157,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ role_transition $1 dhcpc_exec_t system_r;
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.6.32/policy/modules/system/sysnetwork.te
---- nsaserefpolicy/policy/modules/system/sysnetwork.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/sysnetwork.te 2009-10-13 11:04:29.000000000 -0400
@@ -20,6 +20,9 @@
init_daemon_domain(dhcpc_t, dhcpc_exec_t)
@@ -30179,7 +30372,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ hal_dontaudit_rw_dgram_sockets(ifconfig_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.fc serefpolicy-3.6.32/policy/modules/system/udev.fc
---- nsaserefpolicy/policy/modules/system/udev.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/udev.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/udev.fc 2009-09-30 16:12:48.000000000 -0400
@@ -7,6 +7,9 @@
/etc/hotplug\.d/default/udev.* -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
@@ -30192,7 +30385,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/sbin/start_udev -- gen_context(system_u:object_r:udev_exec_t,s0)
/sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.if serefpolicy-3.6.32/policy/modules/system/udev.if
---- nsaserefpolicy/policy/modules/system/udev.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/udev.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/udev.if 2009-10-22 09:04:35.000000000 -0400
@@ -168,4 +168,43 @@
@@ -30239,7 +30432,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow $1 udev_t:process signal;
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.6.32/policy/modules/system/udev.te
---- nsaserefpolicy/policy/modules/system/udev.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/udev.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/udev.te 2009-10-22 09:03:07.000000000 -0400
@@ -50,6 +50,7 @@
allow udev_t self:unix_stream_socket connectto;
@@ -30355,7 +30548,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_xen_state(udev_t)
xen_manage_log(udev_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.6.32/policy/modules/system/unconfined.fc
---- nsaserefpolicy/policy/modules/system/unconfined.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/unconfined.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/unconfined.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,16 +1 @@
# Add programs here which should not be confined by SELinux
@@ -30375,7 +30568,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-/usr/lib32/openoffice/program/[^/]+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
-')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.6.32/policy/modules/system/unconfined.if
---- nsaserefpolicy/policy/modules/system/unconfined.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/unconfined.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/unconfined.if 2009-09-30 16:12:48.000000000 -0400
@@ -12,14 +12,13 @@
#
@@ -30881,7 +31074,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- allow $1 unconfined_t:dbus acquire_svc;
-')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.6.32/policy/modules/system/unconfined.te
---- nsaserefpolicy/policy/modules/system/unconfined.te 2009-08-18 11:41:14.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/unconfined.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/unconfined.te 2009-09-30 16:12:48.000000000 -0400
@@ -5,227 +5,5 @@
#
@@ -31113,7 +31306,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- ')
-')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.6.32/policy/modules/system/userdomain.fc
---- nsaserefpolicy/policy/modules/system/userdomain.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/userdomain.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/userdomain.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,4 +1,8 @@
HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
@@ -31126,8 +31319,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
+HOME_DIR/\.gvfs(/.*)? <>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.32/policy/modules/system/userdomain.if
---- nsaserefpolicy/policy/modules/system/userdomain.if 2009-08-31 13:30:04.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/system/userdomain.if 2009-11-10 08:35:46.000000000 -0500
+--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/system/userdomain.if 2009-11-13 11:30:14.000000000 -0500
@@ -30,8 +30,9 @@
')
@@ -32018,7 +32211,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
typeattribute $1_t unpriv_userdomain;
domain_interactive_fd($1_t)
-@@ -836,6 +901,25 @@
+@@ -836,6 +901,26 @@
#
optional_policy(`
@@ -32028,6 +32221,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+ optional_policy(`
+ abrt_dbus_chat($1_usertype)
++ abrt_run_helper($1_usertype, $1_r)
+ ')
+
+ optional_policy(`
@@ -32044,7 +32238,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
loadkeys_run($1_t,$1_r)
')
')
-@@ -865,51 +949,93 @@
+@@ -865,51 +950,93 @@
userdom_restricted_user_template($1)
@@ -32151,7 +32345,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
')
-@@ -943,8 +1069,8 @@
+@@ -943,8 +1070,8 @@
# Declarations
#
@@ -32161,7 +32355,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_common_user_template($1)
##############################
-@@ -953,58 +1079,67 @@
+@@ -953,58 +1080,67 @@
#
# port access is audited even if dac would not have allowed it, so dontaudit it here
@@ -32259,7 +32453,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
')
-@@ -1040,7 +1175,7 @@
+@@ -1040,7 +1176,7 @@
template(`userdom_admin_user_template',`
gen_require(`
attribute admindomain;
@@ -32268,7 +32462,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
##############################
-@@ -1049,8 +1184,7 @@
+@@ -1049,8 +1185,7 @@
#
# Inherit rules for ordinary users.
@@ -32278,7 +32472,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domain_obj_id_change_exemption($1_t)
role system_r types $1_t;
-@@ -1075,6 +1209,9 @@
+@@ -1075,6 +1210,9 @@
# Skip authentication when pam_rootok is specified.
allow $1_t self:passwd rootok;
@@ -32288,7 +32482,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
kernel_getattr_message_if($1_t)
-@@ -1089,6 +1226,7 @@
+@@ -1089,6 +1227,7 @@
kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t)
@@ -32296,7 +32490,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels
-@@ -1096,8 +1234,6 @@
+@@ -1096,8 +1235,6 @@
dev_getattr_generic_blk_files($1_t)
dev_getattr_generic_chr_files($1_t)
@@ -32305,7 +32499,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Allow MAKEDEV to work
dev_create_all_blk_files($1_t)
dev_create_all_chr_files($1_t)
-@@ -1124,12 +1260,11 @@
+@@ -1124,12 +1261,11 @@
files_exec_usr_src_files($1_t)
fs_getattr_all_fs($1_t)
@@ -32320,7 +32514,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
term_use_all_terms($1_t)
auth_getattr_shadow($1_t)
-@@ -1152,20 +1287,6 @@
+@@ -1152,20 +1288,6 @@
# But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t)
@@ -32341,7 +32535,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
postgresql_unconfined($1_t)
')
-@@ -1211,6 +1332,7 @@
+@@ -1211,6 +1333,7 @@
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@@ -32349,7 +32543,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
-@@ -1276,11 +1398,15 @@
+@@ -1276,11 +1399,15 @@
interface(`userdom_user_home_content',`
gen_require(`
type user_home_t;
@@ -32365,7 +32559,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1391,12 +1517,13 @@
+@@ -1391,12 +1518,13 @@
')
allow $1 user_home_dir_t:dir search_dir_perms;
@@ -32380,7 +32574,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
##
##
-@@ -1429,6 +1556,14 @@
+@@ -1429,6 +1557,14 @@
allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1)
@@ -32395,7 +32589,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1444,9 +1579,11 @@
+@@ -1444,9 +1580,11 @@
interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
type user_home_dir_t;
@@ -32407,7 +32601,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1503,6 +1640,42 @@
+@@ -1503,6 +1641,42 @@
allow $1 user_home_dir_t:dir relabelto;
')
@@ -32450,7 +32644,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
##
## Create directories in the home dir root with
-@@ -1577,6 +1750,8 @@
+@@ -1577,6 +1751,8 @@
')
dontaudit $1 user_home_t:dir search_dir_perms;
@@ -32459,7 +32653,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1619,6 +1794,24 @@
+@@ -1619,6 +1795,24 @@
########################################
##
@@ -32484,7 +32678,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Do not audit attempts to set the
## attributes of user home files.
##
-@@ -1670,6 +1863,7 @@
+@@ -1670,6 +1864,7 @@
type user_home_dir_t, user_home_t;
')
@@ -32492,7 +32686,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
files_search_home($1)
')
-@@ -1686,11 +1880,11 @@
+@@ -1686,11 +1881,11 @@
#
interface(`userdom_dontaudit_read_user_home_content_files',`
gen_require(`
@@ -32507,7 +32701,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1797,19 +1991,32 @@
+@@ -1797,19 +1992,32 @@
#
interface(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -32547,7 +32741,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1844,6 +2051,7 @@
+@@ -1844,6 +2052,7 @@
interface(`userdom_manage_user_home_content_files',`
gen_require(`
type user_home_dir_t, user_home_t;
@@ -32555,7 +32749,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
manage_files_pattern($1, user_home_t, user_home_t)
-@@ -2196,7 +2404,7 @@
+@@ -2196,7 +2405,7 @@
########################################
##
@@ -32564,7 +32758,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## temporary files.
##
##
-@@ -2205,37 +2413,56 @@
+@@ -2205,37 +2414,56 @@
##
##
#
@@ -32630,7 +32824,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## temporary directories.
##
##
-@@ -2276,6 +2503,46 @@
+@@ -2276,6 +2504,46 @@
########################################
##
## Create, read, write, and delete user
@@ -32677,36 +32871,61 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## temporary symbolic links.
##
##
-@@ -2391,27 +2658,7 @@
+@@ -2391,7 +2659,7 @@
########################################
##
-## Read user tmpfs files.
--##
--##
--##
--## Domain allowed access.
--##
--##
--#
++## Read/Write user tmpfs files.
+ ##
+ ##
+ ##
+@@ -2399,19 +2667,20 @@
+ ##
+ ##
+ #
-interface(`userdom_read_user_tmpfs_files',`
-- gen_require(`
-- type user_tmpfs_t;
-- ')
--
++interface(`userdom_rw_user_tmpfs_files',`
+ gen_require(`
+ type user_tmpfs_t;
+ ')
+
- read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
-- allow $1 user_tmpfs_t:dir list_dir_perms;
-- fs_search_tmpfs($1)
--')
--
++ rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
++ read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+ allow $1 user_tmpfs_t:dir list_dir_perms;
+ fs_search_tmpfs($1)
+ ')
+
-########################################
--##
++######################################
+ ##
-## Read user tmpfs files.
-+## Read/Write user tmpfs files.
++## Manage user tmpfs files.
##
##
##
-@@ -2749,7 +2996,7 @@
+@@ -2419,15 +2688,14 @@
+ ##
+ ##
+ #
+-interface(`userdom_rw_user_tmpfs_files',`
++interface(`userdom_manage_user_tmpfs_files',`
+ gen_require(`
+ type user_tmpfs_t;
+ ')
+
+- rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+- read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+- allow $1 user_tmpfs_t:dir list_dir_perms;
+- fs_search_tmpfs($1)
++ manage_dirs_pattern($1, user_tmpfs_t, user_tmpfs_t)
++ manage_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
++ manage_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+ ')
+
+ ########################################
+@@ -2749,7 +3017,7 @@
domain_entry_file_spec_domtrans($1, unpriv_userdomain)
allow unpriv_userdomain $1:fd use;
@@ -32715,7 +32934,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow unpriv_userdomain $1:process sigchld;
')
-@@ -2765,11 +3012,32 @@
+@@ -2765,11 +3033,32 @@
#
interface(`userdom_search_user_home_content',`
gen_require(`
@@ -32750,7 +32969,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2897,7 +3165,43 @@
+@@ -2897,7 +3186,43 @@
type user_tmp_t;
')
@@ -32795,7 +33014,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2934,6 +3238,7 @@
+@@ -2934,6 +3259,7 @@
')
read_files_pattern($1, userdomain, userdomain)
@@ -32803,7 +33022,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_search_proc($1)
')
-@@ -3064,3 +3369,578 @@
+@@ -3064,3 +3390,578 @@
allow $1 userdomain:dbus send_msg;
')
@@ -33383,7 +33602,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow $1 user_tmp_t:file { getattr append };
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.6.32/policy/modules/system/userdomain.te
---- nsaserefpolicy/policy/modules/system/userdomain.te 2009-08-31 13:30:04.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/userdomain.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/userdomain.te 2009-10-20 14:58:48.000000000 -0400
@@ -8,13 +8,6 @@
@@ -33470,7 +33689,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+allow userdomain userdomain:process signull;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc serefpolicy-3.6.32/policy/modules/system/xen.fc
---- nsaserefpolicy/policy/modules/system/xen.fc 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/xen.fc 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/xen.fc 2009-09-30 16:12:48.000000000 -0400
@@ -1,5 +1,7 @@
/dev/xen/tapctrl.* -p gen_context(system_u:object_r:xenctl_t,s0)
@@ -33500,7 +33719,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/run/xenstored(/.*)? gen_context(system_u:object_r:xenstored_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.6.32/policy/modules/system/xen.if
---- nsaserefpolicy/policy/modules/system/xen.if 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/xen.if 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/xen.if 2009-09-30 16:12:48.000000000 -0400
@@ -71,6 +71,8 @@
')
@@ -33553,7 +33772,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ rw_files_pattern($1, xen_image_t, xen_image_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.6.32/policy/modules/system/xen.te
---- nsaserefpolicy/policy/modules/system/xen.te 2009-08-14 16:14:31.000000000 -0400
+--- nsaserefpolicy/policy/modules/system/xen.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/xen.te 2009-10-14 08:25:08.000000000 -0400
@@ -6,6 +6,13 @@
# Declarations
@@ -33853,7 +34072,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+files_pid_filetrans(evtchnd_t, evtchnd_var_run_t, { file sock_file dir })
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.6.32/policy/support/obj_perm_sets.spt
---- nsaserefpolicy/policy/support/obj_perm_sets.spt 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/support/obj_perm_sets.spt 2009-09-30 16:12:48.000000000 -0400
@@ -201,7 +201,7 @@
define(`setattr_file_perms',`{ setattr }')
@@ -33888,7 +34107,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+define(`manage_key_perms', `{ create link read search setattr view write } ')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.6.32/policy/users
---- nsaserefpolicy/policy/users 2009-07-14 14:19:57.000000000 -0400
+--- nsaserefpolicy/policy/users 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/users 2009-09-30 16:12:48.000000000 -0400
@@ -25,11 +25,8 @@
# permit any access to such users, then remove this entry.