diff --git a/policy-F12.patch b/policy-F12.patch
index bc6042d..66d4b73 100644
--- a/policy-F12.patch
+++ b/policy-F12.patch
@@ -1376,9 +1376,24 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	kismet_manage_log(tmpreaper_t)
  ')
  
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.6.28/policy/modules/admin/usermanage.if
+--- nsaserefpolicy/policy/modules/admin/usermanage.if	2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/admin/usermanage.if	2009-08-25 14:37:45.000000000 -0400
+@@ -274,6 +274,11 @@
+ 	usermanage_domtrans_useradd($1)
+ 	role $2 types useradd_t;
+ 
++	# Add/remove user home directories
++	userdom_manage_home_role($2, useradd_t)
++
++	seutil_run_semanage(useradd_t, $2)
++
+ 	optional_policy(`
+ 		nscd_run(useradd_t, $2)
+ 	')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.6.28/policy/modules/admin/usermanage.te
 --- nsaserefpolicy/policy/modules/admin/usermanage.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/admin/usermanage.te	2009-08-21 18:56:06.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/admin/usermanage.te	2009-08-25 09:31:26.000000000 -0400
 @@ -209,6 +209,7 @@
  files_manage_etc_files(groupadd_t)
  files_relabel_etc_files(groupadd_t)
@@ -1439,7 +1454,19 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  init_use_fds(useradd_t)
  init_rw_utmp(useradd_t)
-@@ -521,6 +518,12 @@
+@@ -494,10 +491,7 @@
+ 
+ userdom_use_unpriv_users_fds(useradd_t)
+ # Add/remove user home directories
+-userdom_manage_user_home_content_dirs(useradd_t)
+-userdom_manage_user_home_content_files(useradd_t)
+-userdom_home_filetrans_user_home_dir(useradd_t)
+-userdom_user_home_dir_filetrans_user_home_content(useradd_t, notdevfile_class_set)
++userdom_manage_home_role(system_r, useradd_t)
+ 
+ mta_manage_spool(useradd_t)
+ 
+@@ -521,6 +515,12 @@
  ')
  
  optional_policy(`
@@ -1519,6 +1546,32 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +optional_policy(`
 +	nscd_socket_use(calamaris_t)
 +')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cdrecord.te serefpolicy-3.6.28/policy/modules/apps/cdrecord.te
+--- nsaserefpolicy/policy/modules/apps/cdrecord.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/apps/cdrecord.te	2009-08-25 15:56:57.000000000 -0400
+@@ -28,12 +28,13 @@
+ #
+ 
+ allow cdrecord_t self:capability { ipc_lock sys_nice setuid dac_override sys_rawio };
+-allow cdrecord_t self:process { getsched setsched sigkill };
++allow cdrecord_t self:process { getcap getsched setsched sigkill };
+ allow cdrecord_t self:unix_dgram_socket create_socket_perms;
+ allow cdrecord_t self:unix_stream_socket create_stream_socket_perms;
+ 
+ # allow searching for cdrom-drive
+ dev_list_all_dev_nodes(cdrecord_t) 
++dev_read_sysfs(cdrecord_t)
+ 
+ domain_interactive_fd(cdrecord_t)
+ domain_use_interactive_fds(cdrecord_t)
+@@ -44,6 +45,7 @@
+ term_list_ptys(cdrecord_t)
+ 
+ # allow cdrecord to write the CD
++storage_raw_read_removable_device(cdrecord_t)
+ storage_raw_write_removable_device(cdrecord_t)
+ storage_write_scsi_generic(cdrecord_t)
+ 
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.6.28/policy/modules/apps/cpufreqselector.te
 --- nsaserefpolicy/policy/modules/apps/cpufreqselector.te	2009-07-28 13:28:33.000000000 -0400
 +++ serefpolicy-3.6.28/policy/modules/apps/cpufreqselector.te	2009-08-21 18:56:06.000000000 -0400
@@ -3538,20 +3591,32 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +term_use_ptmx(ptchown_t)
 +
 +miscfiles_read_localization(ptchown_t)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.6.28/policy/modules/apps/pulseaudio.if
+--- nsaserefpolicy/policy/modules/apps/pulseaudio.if	2009-07-23 14:11:04.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.if	2009-08-25 15:59:29.000000000 -0400
+@@ -141,5 +141,6 @@
+ 	')
+ 
+ 	allow $1 pulseaudio_t:process signull;
++	allow pulseaudio_t $1:process signull;
+ 	allow $1 pulseaudio_t:unix_stream_socket connectto;
+ ')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te
 --- nsaserefpolicy/policy/modules/apps/pulseaudio.te	2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te	2009-08-22 07:48:07.000000000 -0400
-@@ -22,6 +22,9 @@
++++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te	2009-08-26 08:11:55.000000000 -0400
+@@ -22,7 +22,11 @@
  allow pulseaudio_t self:unix_dgram_socket { sendto create_socket_perms };
  allow pulseaudio_t self:tcp_socket create_stream_socket_perms;
  allow pulseaudio_t self:udp_socket create_socket_perms;
 +allow pulseaudio_t self:netlink_kobject_uevent_socket create_socket_perms;
-+
-+can_exec(pulseaudio_t, pulseaudio_exec_t)
  
++can_exec(pulseaudio_t, pulseaudio_exec_t)
++
++kernel_read_system_state(pulseaudio_t)
  kernel_read_kernel_sysctls(pulseaudio_t)
  
-@@ -47,6 +50,7 @@
+ corecmd_exec_bin(pulseaudio_t)
+@@ -47,6 +51,7 @@
  
  fs_rw_anon_inodefs_files(pulseaudio_t)
  fs_getattr_tmpfs(pulseaudio_t)
@@ -3559,7 +3624,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  term_use_all_user_ttys(pulseaudio_t)
  term_use_all_user_ptys(pulseaudio_t)
-@@ -78,6 +82,15 @@
+@@ -78,6 +83,15 @@
  	policykit_domtrans_auth(pulseaudio_t)
  	policykit_read_lib(pulseaudio_t)
  	policykit_read_reload(pulseaudio_t)
@@ -3575,7 +3640,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -85,8 +98,7 @@
+@@ -85,8 +99,7 @@
  ')
  
  optional_policy(`
@@ -4620,8 +4685,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -/opt/picasa/wine/bin/wine	--	gen_context(system_u:object_r:wine_exec_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.6.28/policy/modules/apps/wine.if
 --- nsaserefpolicy/policy/modules/apps/wine.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/apps/wine.if	2009-08-21 18:56:07.000000000 -0400
-@@ -43,3 +43,63 @@
++++ serefpolicy-3.6.28/policy/modules/apps/wine.if	2009-08-25 15:59:59.000000000 -0400
+@@ -43,3 +43,62 @@
  	wine_domtrans($1)
  	role $2 types wine_t;
  ')
@@ -4683,11 +4748,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	relabel_dirs_pattern($2, wine_home_t, wine_home_t)
 +	relabel_files_pattern($2, wine_home_t, wine_home_t)
 +	relabel_lnk_files_pattern($2, wine_home_t, wine_home_t)
-+
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.6.28/policy/modules/apps/wine.te
 --- nsaserefpolicy/policy/modules/apps/wine.te	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/apps/wine.te	2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/apps/wine.te	2009-08-25 16:00:27.000000000 -0400
 @@ -9,20 +9,35 @@
  type wine_t;
  type wine_exec_t;
@@ -4933,7 +4997,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /dev/usb/mdc800.*	-c	gen_context(system_u:object_r:scanner_device_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.28/policy/modules/kernel/devices.if
 --- nsaserefpolicy/policy/modules/kernel/devices.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/devices.if	2009-08-24 08:40:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/devices.if	2009-08-25 15:58:11.000000000 -0400
 @@ -1655,6 +1655,78 @@
  
  ########################################
@@ -5954,7 +6018,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/dev/shm		-d	gen_context(system_u:object_r:tmpfs_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.6.28/policy/modules/kernel/filesystem.if
 --- nsaserefpolicy/policy/modules/kernel/filesystem.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/filesystem.if	2009-08-24 08:48:26.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/filesystem.if	2009-08-24 09:57:00.000000000 -0400
 @@ -1537,6 +1537,24 @@
  
  ########################################
@@ -6377,6 +6441,29 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	fs_type($1)
 +	mls_trusted_object($1)
 +')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.6.28/policy/modules/kernel/storage.fc
+--- nsaserefpolicy/policy/modules/kernel/storage.fc	2009-07-29 15:15:33.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/storage.fc	2009-08-24 10:07:26.000000000 -0400
+@@ -28,6 +28,7 @@
+ /dev/megadev.*		-c	gen_context(system_u:object_r:removable_device_t,s0)
+ /dev/mmcblk.*		-b	gen_context(system_u:object_r:removable_device_t,s0)
+ /dev/mspblk.*		-b	gen_context(system_u:object_r:removable_device_t,s0)
++/dev/mtd.*		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+ /dev/nb[^/]+		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+ /dev/optcd		-b	gen_context(system_u:object_r:removable_device_t,s0)
+ /dev/p[fg][0-3]		-b	gen_context(system_u:object_r:removable_device_t,s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.6.28/policy/modules/kernel/storage.if
+--- nsaserefpolicy/policy/modules/kernel/storage.if	2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/storage.if	2009-08-25 15:56:31.000000000 -0400
+@@ -529,7 +529,7 @@
+ 
+ 	')
+ 
+-	dontaudit $1 removable_device_t:blk_file { getattr ioctl read };
++	dontaudit $1 removable_device_t:blk_file read_blk_file_perms;
+ ')
+ 
+ ########################################
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.6.28/policy/modules/kernel/terminal.fc
 --- nsaserefpolicy/policy/modules/kernel/terminal.fc	2009-07-14 14:19:57.000000000 -0400
 +++ serefpolicy-3.6.28/policy/modules/kernel/terminal.fc	2009-08-21 18:56:07.000000000 -0400
@@ -7680,8 +7767,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te
 --- nsaserefpolicy/policy/modules/roles/unconfineduser.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te	2009-08-21 18:56:07.000000000 -0400
-@@ -0,0 +1,391 @@
++++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te	2009-08-25 09:40:01.000000000 -0400
+@@ -0,0 +1,392 @@
 +policy_module(unconfineduser, 1.0.0)
 +
 +########################################
@@ -7937,9 +8024,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	portmap_run_helper(unconfined_t, unconfined_r)
 +')
 +
-+optional_policy(`
-+	ppp_run(unconfined_t, unconfined_r)
-+')
++#optional_policy(`
++#	ppp_run(unconfined_t, unconfined_r)
++#')
 +
 +optional_policy(`
 +	qemu_role_notrans(unconfined_r, unconfined_t)
@@ -8012,6 +8099,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +allow unconfined_execmem_t self:process { execstack execmem };
 +unconfined_domain_noaudit(unconfined_execmem_t)
 +allow unconfined_execmem_t unconfined_t:process transition;
++rpm_transition_script(unconfined_execmem_t)
 +
 +optional_policy(`
 +	init_dbus_chat_script(unconfined_execmem_t)
@@ -8548,6 +8636,28 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 +permissive abrt_t;
 +
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.fc serefpolicy-3.6.28/policy/modules/services/afs.fc
+--- nsaserefpolicy/policy/modules/services/afs.fc	2009-07-23 14:11:04.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/afs.fc	2009-08-24 10:21:30.000000000 -0400
+@@ -25,6 +25,7 @@
+ /usr/vice/etc/afsd	--	gen_context(system_u:object_r:afs_exec_t,s0)
+ 
+ /var/cache/afs(/.*)?		gen_context(system_u:object_r:afs_cache_t,s0)
++/usr/vice/cache(/.*)?		gen_context(system_u:object_r:afs_cache_t,s0)
+ 
+ /vicepa				gen_context(system_u:object_r:afs_files_t,s0)
+ /vicepb				gen_context(system_u:object_r:afs_files_t,s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.te serefpolicy-3.6.28/policy/modules/services/afs.te
+--- nsaserefpolicy/policy/modules/services/afs.te	2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/afs.te	2009-08-24 09:19:56.000000000 -0400
+@@ -83,6 +83,7 @@
+ 
+ files_mounton_mnt(afs_t)
+ files_read_etc_files(afs_t)
++files_read_usr_files(afs_t)
+ files_rw_etc_runtime_files(afs_t)
+ 
+ fs_getattr_xattr_fs(afs_t)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.6.28/policy/modules/services/amavis.te
 --- nsaserefpolicy/policy/modules/services/amavis.te	2009-08-14 16:14:31.000000000 -0400
 +++ serefpolicy-3.6.28/policy/modules/services/amavis.te	2009-08-21 18:56:07.000000000 -0400
@@ -11132,7 +11242,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /var/run/dbus(/.*)?		gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.28/policy/modules/services/dbus.if
 --- nsaserefpolicy/policy/modules/services/dbus.if	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/dbus.if	2009-08-23 12:50:58.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/dbus.if	2009-08-25 16:33:22.000000000 -0400
 @@ -42,8 +42,10 @@
  	gen_require(`
  		class dbus { send_msg acquire_svc };
@@ -11251,11 +11361,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +#
 +interface(`dbus_manage_lib_files',`
 +	gen_require(`
-+		type system_dbus_var_lib_t;
++		type system_dbusd_var_lib_t;
 +	')
 +
 +	files_search_var_lib($1)
-+	manage_files_pattern($1, system_dbus_var_lib_t, system_dbus_var_lib_t)
++	manage_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
 +')
 +
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.6.28/policy/modules/services/dbus.te
@@ -15127,7 +15237,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ########################################
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.6.28/policy/modules/services/ppp.te
 --- nsaserefpolicy/policy/modules/services/ppp.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/ppp.te	2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/ppp.te	2009-08-24 09:25:42.000000000 -0400
 @@ -193,6 +193,8 @@
  
  optional_policy(`
@@ -15137,6 +15247,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
+@@ -216,7 +218,7 @@
+ # PPTP Local policy
+ #
+ 
+-allow pptp_t self:capability { net_raw net_admin };
++allow pptp_t self:capability { dac_override dac_read_search net_raw net_admin };
+ dontaudit pptp_t self:capability sys_tty_config;
+ allow pptp_t self:process signal;
+ allow pptp_t self:fifo_file rw_fifo_file_perms;
 @@ -295,6 +297,14 @@
  ')
  
@@ -15935,7 +16054,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.28/policy/modules/services/samba.te
 --- nsaserefpolicy/policy/modules/services/samba.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/samba.te	2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/samba.te	2009-08-25 09:18:50.000000000 -0400
 @@ -66,6 +66,13 @@
  ## </desc>
  gen_tunable(samba_share_nfs, false)
@@ -15978,7 +16097,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # Allow samba to list mnt_t for potential mounted dirs
  files_list_mnt(smbd_t)
  
-@@ -341,6 +352,8 @@
+@@ -338,9 +349,12 @@
+ 
+ userdom_use_unpriv_users_fds(smbd_t)
+ userdom_dontaudit_search_user_home_dirs(smbd_t)
++userdom_signal_all_users(smbd_t)
  
  usermanage_read_crack_db(smbd_t)
  
@@ -15987,7 +16110,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ifdef(`hide_broken_symptoms', `
  	files_dontaudit_getattr_default_dirs(smbd_t)
  	files_dontaudit_getattr_boot_dirs(smbd_t)
-@@ -352,19 +365,19 @@
+@@ -352,19 +366,19 @@
  ') 
  
  tunable_policy(`samba_domain_controller',`
@@ -16013,7 +16136,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  # Support Samba sharing of NFS mount points
-@@ -376,6 +389,15 @@
+@@ -376,6 +390,15 @@
  	fs_manage_nfs_named_sockets(smbd_t)
  ')
  
@@ -16029,7 +16152,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  optional_policy(`
  	cups_read_rw_config(smbd_t)
  	cups_stream_connect(smbd_t)
-@@ -391,6 +413,11 @@
+@@ -391,6 +414,11 @@
  ')
  
  optional_policy(`
@@ -16041,7 +16164,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	rpc_search_nfs_state_data(smbd_t)
  ')
  
-@@ -405,13 +432,15 @@
+@@ -405,13 +433,15 @@
  tunable_policy(`samba_create_home_dirs',`
  	allow smbd_t self:capability chown;
  	userdom_create_user_home_dirs(smbd_t)
@@ -16058,7 +16181,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	auth_read_all_files_except_shadow(nmbd_t)
  ')
  
-@@ -420,8 +449,8 @@
+@@ -420,8 +450,8 @@
  	auth_manage_all_files_except_shadow(smbd_t)
  	fs_read_noxattr_fs_files(nmbd_t) 
  	auth_manage_all_files_except_shadow(nmbd_t)
@@ -16068,7 +16191,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  ########################################
  #
-@@ -525,6 +554,7 @@
+@@ -525,6 +555,7 @@
  
  allow smbcontrol_t winbind_t:process { signal signull };
  
@@ -16076,7 +16199,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  samba_read_config(smbcontrol_t)
  samba_rw_var_files(smbcontrol_t)
  samba_search_var(smbcontrol_t)
-@@ -638,6 +668,10 @@
+@@ -638,6 +669,10 @@
  
  allow swat_t smbd_var_run_t:file { lock unlink };
  
@@ -16087,7 +16210,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  rw_files_pattern(swat_t, samba_etc_t, samba_etc_t)
  read_lnk_files_pattern(swat_t, samba_etc_t, samba_etc_t)
  
-@@ -713,12 +747,23 @@
+@@ -713,12 +748,23 @@
  	kerberos_use(swat_t)
  ')
  
@@ -16112,7 +16235,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  dontaudit winbind_t self:capability sys_tty_config;
  allow winbind_t self:process { signal_perms getsched setsched };
  allow winbind_t self:fifo_file rw_fifo_file_perms;
-@@ -866,6 +911,16 @@
+@@ -866,6 +912,16 @@
  #
  
  optional_policy(`
@@ -16129,7 +16252,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	type samba_unconfined_script_t;
  	type samba_unconfined_script_exec_t;
  	domain_type(samba_unconfined_script_t)
-@@ -876,9 +931,12 @@
+@@ -876,9 +932,12 @@
  	allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms;
  	allow smbd_t samba_unconfined_script_exec_t:file ioctl;
  
@@ -23809,8 +23932,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.6.28/policy/modules/system/raid.te
 --- nsaserefpolicy/policy/modules/system/raid.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/raid.te	2009-08-21 18:56:07.000000000 -0400
-@@ -32,10 +32,6 @@
++++ serefpolicy-3.6.28/policy/modules/system/raid.te	2009-08-25 15:58:45.000000000 -0400
+@@ -32,11 +32,6 @@
  kernel_rw_software_raid_state(mdadm_t)
  kernel_getattr_core_if(mdadm_t)
  
@@ -23818,18 +23941,22 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -corecmd_exec_bin(mdadm_t)
 -corecmd_exec_shell(mdadm_t)
 -
- dev_read_sysfs(mdadm_t)
+-dev_read_sysfs(mdadm_t)
  # Ignore attempts to read every device file
  dev_dontaudit_getattr_all_blk_files(mdadm_t)
-@@ -45,24 +41,28 @@
+ dev_dontaudit_getattr_all_chr_files(mdadm_t)
+@@ -44,25 +39,31 @@
+ dev_dontaudit_getattr_generic_chr_files(mdadm_t)
  dev_dontaudit_getattr_generic_blk_files(mdadm_t)
  dev_read_realtime_clock(mdadm_t)
- 
+-
 -domain_use_interactive_fds(mdadm_t)
 -
 -files_read_etc_files(mdadm_t)
 -files_read_etc_runtime_files(mdadm_t)
--
++dev_read_raw_memory(mdadm_t)
++dev_read_sysfs(mdadm_t)
+ 
  fs_search_auto_mountpoints(mdadm_t)
  fs_dontaudit_list_tmpfs(mdadm_t)
  
@@ -23902,7 +24029,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/etc/share/selinux/mls(/.*)?		gen_context(system_u:object_r:semanage_store_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.6.28/policy/modules/system/selinuxutil.if
 --- nsaserefpolicy/policy/modules/system/selinuxutil.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/selinuxutil.if	2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/selinuxutil.if	2009-08-25 15:30:03.000000000 -0400
 @@ -535,6 +535,53 @@
  
  ########################################
@@ -26012,7 +26139,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +HOME_DIR/\.gvfs(/.*)?	<<none>>
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.28/policy/modules/system/userdomain.if
 --- nsaserefpolicy/policy/modules/system/userdomain.if	2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/userdomain.if	2009-08-24 08:49:32.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/userdomain.if	2009-08-25 09:28:37.000000000 -0400
 @@ -30,8 +30,9 @@
  	')
  
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 32514b1..b8cb1eb 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -20,7 +20,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.6.28
-Release: 6%{?dist}
+Release: 7%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -475,6 +475,9 @@ exit 0
 %endif
 
 %changelog
+* Tue Aug 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-7
+- Fixes for cdrecord, mdadm, and others
+
 * Sat Aug 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-6
 - Add capability setting to dhcpc and gpm