-##
@@ -3376,25 +3466,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
##
##
-## Domain run the cgi script in.
-+## Domain to not audit.
++## Domain allowed access.
##
##
-##
+#
-+interface(`apache_relabel',`
++interface(`apache_search_bugzilla_dirs',`
+ gen_require(`
-+ attribute httpdcontent;
-+ attribute httpd_script_exec_type;
++ type httpd_bugzilla_content_t;
+ ')
+
-+ allow $1 { httpd_script_exec_type httpdcontent}:dir { relabelto relabelfrom };
-+ allow $1 { httpd_script_exec_type httpdcontent}:file { relabelto relabelfrom };
++ allow $1 httpd_bugzilla_content_t:dir search_dir_perms;
+')
+
+########################################
+##
-+## Allow the specified domain to search
-+## apache bugzilla directories.
++## Do not audit attempts to read and write Apache
++## bugzill script unix domain stream sockets.
+##
+##
##
@@ -3404,39 +3492,92 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
##
#
-interface(`apache_cgi_domain',`
-+interface(`apache_search_bugzilla_dirs',`
++interface(`apache_dontaudit_rw_bugzilla_script_stream_sockets',`
gen_require(`
- type httpd_t, httpd_sys_script_exec_t;
-+ type httpd_bugzilla_content_t;
++ type httpd_bugzilla_script_t;
')
- domtrans_pattern(httpd_t, $2, $1)
- apache_search_sys_scripts($1)
-+ allow $1 httpd_bugzilla_content_t:dir search_dir_perms;
++ dontaudit $1 httpd_bugzilla_script_t:unix_stream_socket { read write };
+')
+
+########################################
+##
-+## Do not audit attempts to read and write Apache
-+## bugzill script unix domain stream sockets.
++## Execute apache server in the ntpd domain.
++##
++##
++##
++## The type of the process performing this action.
++##
++##
++#
++interface(`apache_script_domtrans',`
++ gen_require(`
++ type httpd_script_exec_t;
++ ')
++
++ init_script_domtrans_spec($1,httpd_script_exec_t)
++')
++
++########################################
++##
++## All of the rules required to administrate an apache environment
+##
+##
+##
+## Domain allowed access.
+##
+##
++##
++##
++## The role to be allowed to manage the apache domain.
++##
++##
++##
++##
++## The type of the terminal allow the dmidecode domain to use.
++##
++##
++##
+#
-+interface(`apache_dontaudit_rw_bugzilla_script_stream_sockets',`
++interface(`apache_admin',`
++
+ gen_require(`
-+ type httpd_bugzilla_script_t;
++ type httpd_t;
++ type httpd_script_exec_t;
+ ')
++
++ allow $1 httpd_t:process { ptrace signal_perms };
++
++ # Allow $1 to restart the apache service
++ apache_script_domtrans($1)
++ domain_system_change_exemption($1)
++ domain_role_change_exemption($1)
++ domain_obj_id_change_exemption($1)
++ role_transition $2 httpd_script_exec_t system_r;
++ allow $2 system_r;
++
++ apache_manage_all_content($1)
++ apache_manage_config($1)
++ apache_manage_log($1)
++ apache_manage_modules($1)
++ apache_manage_lock($1)
++ apache_manage_pid($1)
++ apache_read_state($1)
++ apache_getattr($1)
++ apache_relabel($1)
++
++ seutil_domtrans_setfiles($1)
- allow httpd_t $1:process signal;
-+ dontaudit $1 httpd_bugzilla_script_t:unix_stream_socket { read write };
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.6/policy/modules/services/apache.te
++
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.7/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2007-08-22 07:14:07.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/apache.te 2007-08-27 17:32:31.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/apache.te 2007-09-04 16:06:38.000000000 -0400
@@ -30,6 +30,13 @@
##
@@ -3502,7 +3643,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
attribute httpdcontent;
# domains that can exec all users scripts
-@@ -182,6 +217,14 @@
+@@ -142,6 +177,9 @@
+ type httpd_log_t;
+ logging_log_file(httpd_log_t)
+
++type httpd_script_exec_t;
++init_script_type(httpd_script_exec_t)
++
+ # httpd_modules_t is the type given to module files (libraries)
+ # that come with Apache /etc/httpd/modules and /usr/lib/apache
+ type httpd_modules_t;
+@@ -182,6 +220,14 @@
type httpd_tmpfs_t;
files_tmpfs_file(httpd_tmpfs_t)
@@ -3517,7 +3668,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
# for apache2 memory mapped files
type httpd_var_lib_t;
files_type(httpd_var_lib_t)
-@@ -202,9 +245,11 @@
+@@ -202,9 +248,11 @@
# Apache server local policy
#
@@ -3530,7 +3681,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
allow httpd_t self:fd use;
allow httpd_t self:sock_file read_sock_file_perms;
allow httpd_t self:fifo_file rw_fifo_file_perms;
-@@ -244,6 +289,7 @@
+@@ -244,6 +292,7 @@
allow httpd_t httpd_modules_t:dir list_dir_perms;
mmap_files_pattern(httpd_t,httpd_modules_t,httpd_modules_t)
read_files_pattern(httpd_t,httpd_modules_t,httpd_modules_t)
@@ -3538,7 +3689,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
apache_domtrans_rotatelogs(httpd_t)
# Apache-httpd needs to be able to send signals to the log rotate procs.
-@@ -284,6 +330,7 @@
+@@ -284,6 +333,7 @@
kernel_read_kernel_sysctls(httpd_t)
# for modules that want to access /proc/meminfo
kernel_read_system_state(httpd_t)
@@ -3546,17 +3697,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
corenet_all_recvfrom_unlabeled(httpd_t)
corenet_all_recvfrom_netlabel(httpd_t)
-@@ -330,6 +377,9 @@
+@@ -330,6 +380,10 @@
files_read_var_lib_symlinks(httpd_t)
fs_search_auto_mountpoints(httpd_sys_script_t)
+# php uploads a file to /tmp and then execs programs to acton them
+manage_dirs_pattern(httpd_sys_script_t,httpd_tmp_t,httpd_tmp_t)
+manage_files_pattern(httpd_sys_script_t,httpd_tmp_t,httpd_tmp_t)
++files_tmp_filetrans(httpd_sys_script_t,httpd_sys_script_rw_t,{ dir file lnk_file sock_file fifo_file })
libs_use_ld_so(httpd_t)
libs_use_shared_libs(httpd_t)
-@@ -348,7 +398,9 @@
+@@ -348,7 +402,9 @@
userdom_use_unpriv_users_fds(httpd_t)
@@ -3567,7 +3719,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`allow_httpd_anon_write',`
miscfiles_manage_public_files(httpd_t)
-@@ -360,6 +412,7 @@
+@@ -360,6 +416,7 @@
#
tunable_policy(`allow_httpd_mod_auth_pam',`
auth_domtrans_chk_passwd(httpd_t)
@@ -3575,7 +3727,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
')
')
-@@ -367,6 +420,16 @@
+@@ -367,6 +424,16 @@
corenet_tcp_connect_all_ports(httpd_t)
')
@@ -3592,7 +3744,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_can_network_connect_db',`
# allow httpd to connect to mysql/posgresql
corenet_tcp_connect_postgresql_port(httpd_t)
-@@ -387,6 +450,17 @@
+@@ -387,6 +454,17 @@
corenet_sendrecv_http_cache_client_packets(httpd_t)
')
@@ -3610,7 +3762,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t)
-@@ -404,11 +478,21 @@
+@@ -404,11 +482,21 @@
fs_read_nfs_symlinks(httpd_t)
')
@@ -3632,7 +3784,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_ssi_exec',`
corecmd_shell_domtrans(httpd_t,httpd_sys_script_t)
allow httpd_sys_script_t httpd_t:fd use;
-@@ -430,6 +514,12 @@
+@@ -430,6 +518,12 @@
')
optional_policy(`
@@ -3645,7 +3797,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
calamaris_read_www_files(httpd_t)
')
-@@ -442,6 +532,13 @@
+@@ -442,6 +536,13 @@
')
optional_policy(`
@@ -3659,7 +3811,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
kerberos_use(httpd_t)
kerberos_read_kdc_config(httpd_t)
')
-@@ -461,7 +558,6 @@
+@@ -461,7 +562,6 @@
optional_policy(`
nagios_read_config(httpd_t)
@@ -3667,7 +3819,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
')
optional_policy(`
-@@ -481,6 +577,7 @@
+@@ -481,6 +581,7 @@
')
optional_policy(`
@@ -3675,7 +3827,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
')
-@@ -512,10 +609,16 @@
+@@ -512,10 +613,16 @@
tunable_policy(`httpd_tty_comm',`
# cjp: this is redundant:
term_use_controlling_term(httpd_helper_t)
@@ -3693,7 +3845,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
########################################
#
# Apache PHP script local policy
-@@ -567,7 +670,6 @@
+@@ -567,7 +674,6 @@
allow httpd_suexec_t self:capability { setuid setgid };
allow httpd_suexec_t self:process signal_perms;
allow httpd_suexec_t self:unix_stream_socket create_stream_socket_perms;
@@ -3701,7 +3853,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
domtrans_pattern(httpd_t, httpd_suexec_exec_t, httpd_suexec_t)
-@@ -581,6 +683,10 @@
+@@ -581,6 +687,10 @@
manage_files_pattern(httpd_suexec_t,httpd_suexec_tmp_t,httpd_suexec_tmp_t)
files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir })
@@ -3712,7 +3864,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
kernel_read_kernel_sysctls(httpd_suexec_t)
kernel_list_proc(httpd_suexec_t)
kernel_read_proc_symlinks(httpd_suexec_t)
-@@ -606,6 +712,10 @@
+@@ -606,6 +716,10 @@
miscfiles_read_localization(httpd_suexec_t)
@@ -3723,7 +3875,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_can_network_connect',`
allow httpd_suexec_t self:tcp_socket create_stream_socket_perms;
allow httpd_suexec_t self:udp_socket create_socket_perms;
-@@ -620,10 +730,13 @@
+@@ -620,10 +734,13 @@
corenet_udp_sendrecv_all_ports(httpd_suexec_t)
corenet_tcp_connect_all_ports(httpd_suexec_t)
corenet_sendrecv_all_client_packets(httpd_suexec_t)
@@ -3738,7 +3890,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_enable_cgi && httpd_unified',`
domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t)
')
-@@ -634,6 +747,12 @@
+@@ -634,6 +751,12 @@
fs_exec_nfs_files(httpd_suexec_t)
')
@@ -3751,7 +3903,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_suexec_t)
fs_read_cifs_symlinks(httpd_suexec_t)
-@@ -651,18 +770,6 @@
+@@ -651,18 +774,6 @@
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
')
@@ -3770,7 +3922,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
########################################
#
# Apache system script local policy
-@@ -672,7 +779,8 @@
+@@ -672,7 +783,8 @@
dontaudit httpd_sys_script_t httpd_config_t:dir search;
@@ -3780,7 +3932,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t)
-@@ -686,15 +794,66 @@
+@@ -686,15 +798,66 @@
# Should we add a boolean?
apache_domtrans_rotatelogs(httpd_sys_script_t)
@@ -3796,15 +3948,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+')
+
+tunable_policy(`httpd_use_nfs', `
-+ fs_read_nfs_files(httpd_sys_script_t)
-+ fs_read_nfs_symlinks(httpd_sys_script_t)
-+')
-+
-+tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs', `
fs_read_nfs_files(httpd_sys_script_t)
fs_read_nfs_symlinks(httpd_sys_script_t)
')
++tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs', `
++ fs_read_nfs_files(httpd_sys_script_t)
++ fs_read_nfs_symlinks(httpd_sys_script_t)
++')
++
+tunable_policy(`httpd_enable_cgi && httpd_can_network_connect_db',`
+ allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms;
+ allow httpd_sys_script_t self:udp_socket create_socket_perms;
@@ -3848,7 +4000,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_sys_script_t)
fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -711,6 +870,19 @@
+@@ -711,6 +874,19 @@
########################################
#
@@ -3868,7 +4020,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
# httpd_rotatelogs local policy
#
-@@ -728,3 +900,20 @@
+@@ -728,3 +904,20 @@
logging_search_logs(httpd_rotatelogs_t)
miscfiles_read_localization(httpd_rotatelogs_t)
@@ -3889,9 +4041,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+optional_policy(`
+ postgresql_stream_connect(httpd_bugzilla_script_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-3.0.6/policy/modules/services/apcupsd.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-3.0.7/policy/modules/services/apcupsd.fc
--- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/apcupsd.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/apcupsd.fc 2007-09-04 09:45:48.000000000 -0400
@@ -5,5 +5,11 @@
/usr/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0)
@@ -3904,9 +4056,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
+/var/www/apcupsd/upsfstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
+/var/www/apcupsd/upsimage.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
+/var/www/apcupsd/upsstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.0.6/policy/modules/services/apcupsd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.0.7/policy/modules/services/apcupsd.if
--- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/apcupsd.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/apcupsd.if 2007-08-28 15:53:39.000000000 -0400
@@ -79,3 +79,25 @@
allow $1 apcupsd_log_t:dir list_dir_perms;
allow $1 apcupsd_log_t:file { getattr append };
@@ -3933,9 +4085,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
+ allow httpd_apcupsd_cgi_script_t $1:fifo_file rw_file_perms;
+ allow httpd_apcupsd_cgi_script_t $1:process sigchld;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.6/policy/modules/services/apcupsd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.7/policy/modules/services/apcupsd.te
--- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/apcupsd.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/apcupsd.te 2007-09-04 17:43:34.000000000 -0400
@@ -16,6 +16,9 @@
type apcupsd_log_t;
logging_log_file(apcupsd_log_t)
@@ -4036,9 +4188,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
+corenet_udp_sendrecv_all_nodes(httpd_apcupsd_cgi_script_t)
+corenet_udp_sendrecv_all_ports(httpd_apcupsd_cgi_script_t)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.6/policy/modules/services/audioentropy.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.7/policy/modules/services/audioentropy.te
--- nsaserefpolicy/policy/modules/services/audioentropy.te 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/audioentropy.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/audioentropy.te 2007-08-28 15:53:39.000000000 -0400
@@ -18,7 +18,7 @@
# Local policy
#
@@ -4057,9 +4209,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audi
dev_read_sound(entropyd_t)
fs_getattr_all_fs(entropyd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.6/policy/modules/services/automount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.7/policy/modules/services/automount.te
--- nsaserefpolicy/policy/modules/services/automount.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/automount.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/automount.te 2007-08-28 15:53:39.000000000 -0400
@@ -69,6 +69,7 @@
files_mounton_all_mountpoints(automount_t)
files_mount_all_file_type_fs(automount_t)
@@ -4099,9 +4251,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto
seutil_sigchld_newrole(automount_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.0.6/policy/modules/services/avahi.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.0.7/policy/modules/services/avahi.te
--- nsaserefpolicy/policy/modules/services/avahi.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/avahi.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/avahi.te 2007-08-28 15:53:39.000000000 -0400
@@ -57,6 +57,7 @@
fs_getattr_all_fs(avahi_t)
@@ -4110,9 +4262,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah
domain_use_interactive_fds(avahi_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.6/policy/modules/services/bind.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.7/policy/modules/services/bind.fc
--- nsaserefpolicy/policy/modules/services/bind.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/bind.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/bind.fc 2007-08-28 15:53:39.000000000 -0400
@@ -45,4 +45,7 @@
/var/named/chroot/var/named/slaves(/.*)? gen_context(system_u:object_r:named_cache_t,s0)
/var/named/chroot/var/named/data(/.*)? gen_context(system_u:object_r:named_cache_t,s0)
@@ -4121,9 +4273,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind
+/var/named/chroot/var/named/dynamic(/.*)? gen_context(system_u:object_r:named_cache_t,s0)
')
+/var/named/chroot/var/log/named.* -- gen_context(system_u:object_r:named_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.6/policy/modules/services/bind.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.7/policy/modules/services/bind.te
--- nsaserefpolicy/policy/modules/services/bind.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/bind.te 2007-08-22 17:35:04.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/bind.te 2007-08-28 15:53:39.000000000 -0400
@@ -66,7 +66,6 @@
allow named_t self:unix_dgram_socket create_socket_perms;
allow named_t self:tcp_socket create_stream_socket_perms;
@@ -4175,9 +4327,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind
corenet_sendrecv_rndc_client_packets(ndc_t)
fs_getattr_xattr_fs(ndc_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.fc serefpolicy-3.0.6/policy/modules/services/clamav.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.fc serefpolicy-3.0.7/policy/modules/services/clamav.fc
--- nsaserefpolicy/policy/modules/services/clamav.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/clamav.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/clamav.fc 2007-08-28 15:53:39.000000000 -0400
@@ -9,6 +9,8 @@
/var/run/amavis(d)?/clamd\.pid -- gen_context(system_u:object_r:clamd_var_run_t,s0)
@@ -4187,9 +4339,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam
/var/lib/clamav(/.*)? gen_context(system_u:object_r:clamd_var_lib_t,s0)
/var/log/clamav -d gen_context(system_u:object_r:clamd_var_log_t,s0)
/var/log/clamav/clamav.* -- gen_context(system_u:object_r:clamd_var_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.6/policy/modules/services/clamav.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.7/policy/modules/services/clamav.te
--- nsaserefpolicy/policy/modules/services/clamav.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/clamav.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/clamav.te 2007-08-28 15:53:39.000000000 -0400
@@ -74,17 +74,20 @@
manage_files_pattern(clamd_t,clamd_var_lib_t,clamd_var_lib_t)
@@ -4236,9 +4388,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam
+optional_policy(`
+ mailscanner_manage_spool(clamscan_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.6/policy/modules/services/consolekit.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.7/policy/modules/services/consolekit.te
--- nsaserefpolicy/policy/modules/services/consolekit.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/consolekit.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/consolekit.te 2007-08-28 15:53:39.000000000 -0400
@@ -10,7 +10,6 @@
type consolekit_exec_t;
init_daemon_domain(consolekit_t, consolekit_exec_t)
@@ -4296,9 +4448,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons
+ unconfined_ptrace(consolekit_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.6/policy/modules/services/courier.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.7/policy/modules/services/courier.te
--- nsaserefpolicy/policy/modules/services/courier.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/courier.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/courier.te 2007-08-28 15:53:39.000000000 -0400
@@ -58,6 +58,7 @@
files_getattr_tmp_dirs(courier_authdaemon_t)
@@ -4307,9 +4459,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cour
libs_read_lib_files(courier_authdaemon_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cpucontrol.te serefpolicy-3.0.6/policy/modules/services/cpucontrol.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cpucontrol.te serefpolicy-3.0.7/policy/modules/services/cpucontrol.te
--- nsaserefpolicy/policy/modules/services/cpucontrol.te 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/cpucontrol.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/cpucontrol.te 2007-08-28 15:53:39.000000000 -0400
@@ -63,6 +63,10 @@
')
@@ -4321,9 +4473,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cpuc
seutil_sigchld_newrole(cpucontrol_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.6/policy/modules/services/cron.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.7/policy/modules/services/cron.fc
--- nsaserefpolicy/policy/modules/services/cron.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/cron.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/cron.fc 2007-08-28 15:53:39.000000000 -0400
@@ -17,6 +17,8 @@
/var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0)
/var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0)
@@ -4338,9 +4490,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
/var/spool/fcron/systab -- gen_context(system_u:object_r:system_cron_spool_t,s0)
/var/spool/fcron/new\.systab -- gen_context(system_u:object_r:system_cron_spool_t,s0)
+/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.6/policy/modules/services/cron.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.7/policy/modules/services/cron.if
--- nsaserefpolicy/policy/modules/services/cron.if 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/cron.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/cron.if 2007-08-28 15:53:39.000000000 -0400
@@ -35,6 +35,7 @@
#
template(`cron_per_role_template',`
@@ -4482,9 +4634,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
## Read, and write cron daemon TCP sockets.
##
##
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.6/policy/modules/services/cron.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.7/policy/modules/services/cron.te
--- nsaserefpolicy/policy/modules/services/cron.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/cron.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/cron.te 2007-08-28 15:53:39.000000000 -0400
@@ -50,6 +50,7 @@
type crond_tmp_t;
@@ -4682,9 +4834,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
')
ifdef(`TODO',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.6/policy/modules/services/cups.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.7/policy/modules/services/cups.fc
--- nsaserefpolicy/policy/modules/services/cups.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/cups.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/cups.fc 2007-08-28 15:53:39.000000000 -0400
@@ -8,6 +8,7 @@
/etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
/etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
@@ -4707,9 +4859,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
/var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh)
+/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.6/policy/modules/services/cups.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.7/policy/modules/services/cups.te
--- nsaserefpolicy/policy/modules/services/cups.te 2007-08-22 07:14:07.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/cups.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/cups.te 2007-08-28 15:53:39.000000000 -0400
@@ -81,12 +81,11 @@
# /usr/lib/cups/backend/serial needs sys_admin(?!)
allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config };
@@ -4876,9 +5028,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
optional_policy(`
seutil_sigchld_newrole(hplip_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.6/policy/modules/services/cvs.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.7/policy/modules/services/cvs.te
--- nsaserefpolicy/policy/modules/services/cvs.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/cvs.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/cvs.te 2007-08-28 15:53:39.000000000 -0400
@@ -16,6 +16,7 @@
type cvs_t;
type cvs_exec_t;
@@ -4903,9 +5055,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.
miscfiles_read_localization(cvs_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.0.6/policy/modules/services/dbus.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.0.7/policy/modules/services/dbus.fc
--- nsaserefpolicy/policy/modules/services/dbus.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/dbus.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/dbus.fc 2007-08-28 15:53:39.000000000 -0400
@@ -5,6 +5,8 @@
/bin/dbus-daemon -- gen_context(system_u:object_r:system_dbusd_exec_t,s0)
/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
@@ -4915,9 +5067,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
ifdef(`distro_redhat',`
/var/named/chroot/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.6/policy/modules/services/dbus.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.7/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/dbus.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/dbus.if 2007-08-28 15:53:39.000000000 -0400
@@ -50,6 +50,12 @@
##
#
@@ -5045,9 +5197,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.0.6/policy/modules/services/dbus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.0.7/policy/modules/services/dbus.te
--- nsaserefpolicy/policy/modules/services/dbus.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/dbus.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/dbus.te 2007-08-28 15:53:39.000000000 -0400
@@ -23,6 +23,9 @@
type system_dbusd_var_run_t;
files_pid_file(system_dbusd_var_run_t)
@@ -5086,9 +5238,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
+ unconfined_use_terminals(system_dbusd_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.0.6/policy/modules/services/dhcp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.0.7/policy/modules/services/dhcp.te
--- nsaserefpolicy/policy/modules/services/dhcp.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/dhcp.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/dhcp.te 2007-08-28 15:53:39.000000000 -0400
@@ -114,6 +114,8 @@
dbus_system_bus_client_template(dhcpd,dhcpd_t)
dbus_connect_system_bus(dhcpd_t)
@@ -5098,9 +5250,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.0.6/policy/modules/services/dnsmasq.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.0.7/policy/modules/services/dnsmasq.te
--- nsaserefpolicy/policy/modules/services/dnsmasq.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/dnsmasq.te 2007-08-27 10:56:52.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/dnsmasq.te 2007-08-28 15:53:39.000000000 -0400
@@ -94,3 +94,8 @@
optional_policy(`
udev_read_db(dnsmasq_t)
@@ -5110,9 +5262,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsm
+ virt_read_lib_files(dnsmasq_t)
+ virt_append_lib_files(dnsmasq_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.6/policy/modules/services/dovecot.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.7/policy/modules/services/dovecot.fc
--- nsaserefpolicy/policy/modules/services/dovecot.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/dovecot.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/dovecot.fc 2007-08-28 15:53:39.000000000 -0400
@@ -17,16 +17,19 @@
ifdef(`distro_debian', `
@@ -5133,9 +5285,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
/var/lib/dovecot(/.*)? gen_context(system_u:object_r:dovecot_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.6/policy/modules/services/dovecot.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.7/policy/modules/services/dovecot.if
--- nsaserefpolicy/policy/modules/services/dovecot.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/dovecot.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/dovecot.if 2007-08-28 15:53:39.000000000 -0400
@@ -18,3 +18,43 @@
manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
@@ -5180,9 +5332,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
+ domtrans_pattern($1,dovecot_deliver_exec_t,dovecot_deliver_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.6/policy/modules/services/dovecot.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.7/policy/modules/services/dovecot.te
--- nsaserefpolicy/policy/modules/services/dovecot.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/dovecot.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/dovecot.te 2007-08-28 15:53:39.000000000 -0400
@@ -15,6 +15,12 @@
domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t)
role system_r types dovecot_auth_t;
@@ -5337,9 +5489,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
+ mta_manage_spool(dovecot_deliver_t)
')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.6/policy/modules/services/ftp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.7/policy/modules/services/ftp.te
--- nsaserefpolicy/policy/modules/services/ftp.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/ftp.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/ftp.te 2007-08-28 15:53:39.000000000 -0400
@@ -88,6 +88,7 @@
allow ftpd_t self:unix_stream_socket create_stream_socket_perms;
allow ftpd_t self:tcp_socket create_stream_socket_perms;
@@ -5381,9 +5533,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
')
tunable_policy(`ftp_home_dir && use_nfs_home_dirs',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.6/policy/modules/services/hal.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.7/policy/modules/services/hal.fc
--- nsaserefpolicy/policy/modules/services/hal.fc 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/hal.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/hal.fc 2007-08-28 15:53:39.000000000 -0400
@@ -8,9 +8,15 @@
/usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0)
@@ -5400,9 +5552,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
+
+/var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.0.6/policy/modules/services/hal.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.0.7/policy/modules/services/hal.if
--- nsaserefpolicy/policy/modules/services/hal.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/hal.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/hal.if 2007-08-28 15:53:40.000000000 -0400
@@ -208,3 +208,98 @@
files_search_pids($1)
allow $1 hald_var_run_t:file rw_file_perms;
@@ -5502,9 +5654,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
+ allow $1 hald_t:process ptrace;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.6/policy/modules/services/hal.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.7/policy/modules/services/hal.te
--- nsaserefpolicy/policy/modules/services/hal.te 2007-08-22 07:14:07.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/hal.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/hal.te 2007-08-28 15:53:40.000000000 -0400
@@ -22,6 +22,12 @@
type hald_log_t;
files_type(hald_log_t)
@@ -5613,9 +5765,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
+miscfiles_read_localization(hald_keymap_t)
+
+dev_rw_input_dev(hald_keymap_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.6/policy/modules/services/inetd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.7/policy/modules/services/inetd.te
--- nsaserefpolicy/policy/modules/services/inetd.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/inetd.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/inetd.te 2007-08-28 15:53:40.000000000 -0400
@@ -80,16 +80,21 @@
corenet_udp_bind_comsat_port(inetd_t)
corenet_tcp_bind_dbskkd_port(inetd_t)
@@ -5685,9 +5837,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
unconfined_domain(inetd_child_t)
+ inetd_service_domain(inetd_child_t,bin_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-3.0.6/policy/modules/services/kerberos.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-3.0.7/policy/modules/services/kerberos.if
--- nsaserefpolicy/policy/modules/services/kerberos.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/kerberos.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/kerberos.if 2007-09-04 11:11:12.000000000 -0400
@@ -42,6 +42,10 @@
dontaudit $1 krb5_conf_t:file write;
dontaudit $1 krb5kdc_conf_t:dir list_dir_perms;
@@ -5699,9 +5851,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
tunable_policy(`allow_kerberos',`
allow $1 self:tcp_socket create_socket_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.6/policy/modules/services/kerberos.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.7/policy/modules/services/kerberos.te
--- nsaserefpolicy/policy/modules/services/kerberos.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/kerberos.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/kerberos.te 2007-09-04 11:12:48.000000000 -0400
+@@ -62,7 +62,7 @@
+ # Use capabilities. Surplus capabilities may be allowed.
+ allow kadmind_t self:capability { setuid setgid chown fowner dac_override sys_nice };
+ dontaudit kadmind_t self:capability sys_tty_config;
+-allow kadmind_t self:process signal_perms;
++allow kadmind_t self:process { setfscreate signal_perms };
+ allow kadmind_t self:netlink_route_socket r_netlink_socket_perms;
+ allow kadmind_t self:unix_dgram_socket { connect create write };
+ allow kadmind_t self:tcp_socket connected_stream_socket_perms;
@@ -91,6 +91,7 @@
kernel_read_kernel_sysctls(kadmind_t)
kernel_list_proc(kadmind_t)
@@ -5728,7 +5889,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
userdom_dontaudit_use_unpriv_user_fds(kadmind_t)
userdom_dontaudit_search_sysadm_home_dirs(kadmind_t)
-@@ -223,6 +228,7 @@
+@@ -137,6 +142,7 @@
+
+ optional_policy(`
+ seutil_sigchld_newrole(kadmind_t)
++ seutil_read_file_contexts(kadmind_t)
+ ')
+
+ optional_policy(`
+@@ -223,6 +229,7 @@
miscfiles_read_localization(krb5kdc_t)
sysnet_read_config(krb5kdc_t)
@@ -5736,9 +5905,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t)
userdom_dontaudit_search_sysadm_home_dirs(krb5kdc_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.6/policy/modules/services/lpd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ktalk.te serefpolicy-3.0.7/policy/modules/services/ktalk.te
+--- nsaserefpolicy/policy/modules/services/ktalk.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/ktalk.te 2007-09-04 09:21:17.000000000 -0400
+@@ -49,6 +49,8 @@
+ manage_files_pattern(ktalkd_t,ktalkd_var_run_t,ktalkd_var_run_t)
+ files_pid_filetrans(ktalkd_t,ktalkd_var_run_t,file)
+
++auth_use_nsswitch(ktalkd_t)
++
+ kernel_read_kernel_sysctls(ktalkd_t)
+ kernel_read_system_state(ktalkd_t)
+ kernel_read_network_state(ktalkd_t)
+@@ -76,12 +78,4 @@
+
+ miscfiles_read_localization(ktalkd_t)
+
+-sysnet_read_config(ktalkd_t)
+-
+-optional_policy(`
+- nis_use_ypbind(ktalkd_t)
+-')
+-
+-optional_policy(`
+- nscd_socket_use(ktalkd_t)
+-')
++term_search_ptys(ktalkd_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.7/policy/modules/services/lpd.if
--- nsaserefpolicy/policy/modules/services/lpd.if 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/lpd.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/lpd.if 2007-08-28 15:53:40.000000000 -0400
@@ -394,3 +394,22 @@
domtrans_pattern($2, lpr_exec_t, $1_lpr_t)
@@ -5762,9 +5957,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.
+
+ can_exec($1,lpr_exec_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.6/policy/modules/services/mailman.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.7/policy/modules/services/mailman.te
--- nsaserefpolicy/policy/modules/services/mailman.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/mailman.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/mailman.te 2007-08-28 15:53:40.000000000 -0400
@@ -55,6 +55,7 @@
apache_use_fds(mailman_cgi_t)
apache_dontaudit_append_log(mailman_cgi_t)
@@ -5781,15 +5976,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail
files_dontaudit_search_pids(mailman_queue_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.6/policy/modules/services/mailscanner.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.7/policy/modules/services/mailscanner.fc
--- nsaserefpolicy/policy/modules/services/mailscanner.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/services/mailscanner.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/mailscanner.fc 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,2 @@
+/var/spool/MailScanner(/.*)? gen_context(system_u:object_r:mailscanner_spool_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.6/policy/modules/services/mailscanner.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.7/policy/modules/services/mailscanner.if
--- nsaserefpolicy/policy/modules/services/mailscanner.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/services/mailscanner.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/mailscanner.if 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,59 @@
+## Anti-Virus and Anti-Spam Filter
+
@@ -5850,18 +6045,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail
+ files_search_spool($1)
+ manage_files_pattern($1,mailscanner_spool_t,mailscanner_spool_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.6/policy/modules/services/mailscanner.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.7/policy/modules/services/mailscanner.te
--- nsaserefpolicy/policy/modules/services/mailscanner.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/services/mailscanner.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/mailscanner.te 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,5 @@
+
+policy_module(mailscanner,1.0.0)
+
+type mailscanner_spool_t;
+files_type(mailscanner_spool_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.6/policy/modules/services/mta.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.7/policy/modules/services/mta.if
--- nsaserefpolicy/policy/modules/services/mta.if 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/mta.if 2007-08-22 09:44:40.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/mta.if 2007-09-04 17:43:34.000000000 -0400
@@ -226,6 +226,15 @@
tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_files($1_mail_t)
@@ -5886,9 +6081,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
create_lnk_files_pattern($1,mail_spool_t,mail_spool_t)
read_lnk_files_pattern($1,mail_spool_t,mail_spool_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.6/policy/modules/services/mta.te
+@@ -595,6 +605,25 @@
+ files_search_etc($1)
+ allow $1 etc_aliases_t:file { rw_file_perms setattr };
+ ')
++########################################
++##
++## manage mail aliases.
++##
++##
++##
++## Domain allowed access.
++##
++##
++##
++#
++interface(`mta_manage_aliases',`
++ gen_require(`
++ type etc_aliases_t;
++ ')
++
++ files_search_etc($1)
++ allow $1 etc_aliases_t:file manage_file_perms;
++')
+
+ #######################################
+ ##
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.7/policy/modules/services/mta.te
--- nsaserefpolicy/policy/modules/services/mta.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/mta.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/mta.te 2007-08-28 15:53:40.000000000 -0400
@@ -44,6 +44,7 @@
kernel_read_system_state(system_mail_t)
kernel_read_network_state(system_mail_t)
@@ -5952,10 +6173,116 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
cron_dontaudit_write_pipes(system_mail_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.0.6/policy/modules/services/nagios.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.fc serefpolicy-3.0.7/policy/modules/services/mysql.fc
+--- nsaserefpolicy/policy/modules/services/mysql.fc 2007-05-29 14:10:57.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/mysql.fc 2007-08-31 06:48:04.000000000 -0400
+@@ -22,3 +22,5 @@
+ /var/log/mysql.* -- gen_context(system_u:object_r:mysqld_log_t,s0)
+
+ /var/run/mysqld(/.*)? gen_context(system_u:object_r:mysqld_var_run_t,s0)
++
++/etc/rc\.d/init\.d/mysqld -- gen_context(system_u:object_r:mysqld_script_exec_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.if serefpolicy-3.0.7/policy/modules/services/mysql.if
+--- nsaserefpolicy/policy/modules/services/mysql.if 2007-05-29 14:10:57.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/mysql.if 2007-09-04 16:56:14.000000000 -0400
+@@ -157,3 +157,80 @@
+ logging_search_logs($1)
+ allow $1 mysqld_log_t:file { write append setattr ioctl };
+ ')
++
++########################################
++##
++## Execute mysql server in the mysqld domain.
++##
++##
++##
++## The type of the process performing this action.
++##
++##
++#
++interface(`mysql_script_domtrans',`
++ gen_require(`
++ type mysqld_script_exec_t;
++ ')
++
++ init_script_domtrans_spec($1,mysqld_script_exec_t)
++')
++
++########################################
++##
++## All of the rules required to administrate an mysql environment
++##
++##
++##
++## Domain allowed access.
++##
++##
++##
++##
++## The role to be allowed to manage the mysql domain.
++##
++##
++##
++##
++## The type of the terminal allow the mysql domain to use.
++##
++##
++##
++#
++interface(`mysql_admin',`
++
++ gen_require(`
++ type mysqld_t;
++ type mysqld_var_run_t;
++ type mysqld_tmp_t;
++ type mysqld_db_t;
++ type mysqld_etc_t;
++ type mysqld_log_t;
++ type mysqld_script_exec_t;
++ ')
++
++ allow $1 mysqld_t:process { ptrace signal_perms };
++
++ # Allow $1 to restart the apache service
++ mysql_script_domtrans($1)
++ domain_role_change_exemption($1)
++ domain_system_change_exemption($1)
++ domain_obj_id_change_exemption($1)
++ role_transition $2 mysqld_script_exec_t system_r;
++ allow $2 system_r;
++
++ manage_dirs_pattern($1,mysqld_var_run_t,mysqld_var_run_t)
++ manage_files_pattern($1,mysqld_var_run_t,mysqld_var_run_t)
++
++ manage_dirs_pattern($1,mysqld_db_t,mysqld_db_t)
++ manage_files_pattern($1,mysqld_db_t,mysqld_db_t)
++
++ manage_dirs_pattern($1,mysqld_etc_t,mysqld_etc_t)
++ manage_files_pattern($1,mysqld_etc_t,mysqld_etc_t)
++
++ manage_dirs_pattern($1,mysqld_log_t,mysqld_log_t)
++ manage_files_pattern($1,mysqld_log_t,mysqld_log_t)
++
++ manage_dirs_pattern($1,mysqld_tmp_t,mysqld_tmp_t)
++ manage_files_pattern($1,mysqld_tmp_t,mysqld_tmp_t)
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.0.7/policy/modules/services/mysql.te
+--- nsaserefpolicy/policy/modules/services/mysql.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/mysql.te 2007-08-31 06:45:08.000000000 -0400
+@@ -25,6 +25,9 @@
+ type mysqld_tmp_t;
+ files_tmp_file(mysqld_tmp_t)
+
++type mysqld_script_exec_t;
++init_script_type(mysqld_script_exec_t)
++
+ ########################################
+ #
+ # Local policy
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.0.7/policy/modules/services/nagios.fc
--- nsaserefpolicy/policy/modules/services/nagios.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/nagios.fc 2007-08-22 08:03:53.000000000 -0400
-@@ -4,13 +4,13 @@
++++ serefpolicy-3.0.7/policy/modules/services/nagios.fc 2007-09-01 07:24:13.000000000 -0400
+@@ -4,13 +4,15 @@
/usr/bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0)
/usr/bin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0)
@@ -5967,14 +6294,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi
/var/log/nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
/var/log/netsaint(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
++/var/spool/nagios(/.*)? gen_context(system_u:object_r:nagios_spool_t,s0)
++
ifdef(`distro_debian',`
/usr/sbin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0)
-/usr/lib/cgi-bin/nagios/.+ -- gen_context(system_u:object_r:nagios_cgi_exec_t,s0)
')
+/usr/lib(64)?/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.0.6/policy/modules/services/nagios.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.0.7/policy/modules/services/nagios.if
--- nsaserefpolicy/policy/modules/services/nagios.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/nagios.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/nagios.if 2007-08-28 15:53:40.000000000 -0400
@@ -44,25 +44,6 @@
########################################
@@ -6001,9 +6330,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi
## Execute the nagios NRPE with
## a domain transition.
##
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.0.6/policy/modules/services/nagios.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.0.7/policy/modules/services/nagios.te
--- nsaserefpolicy/policy/modules/services/nagios.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/nagios.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/nagios.te 2007-09-05 12:54:07.000000000 -0400
@@ -10,10 +10,6 @@
type nagios_exec_t;
init_daemon_domain(nagios_t,nagios_exec_t)
@@ -6015,7 +6344,39 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi
type nagios_etc_t;
files_config_file(nagios_etc_t)
-@@ -132,42 +128,31 @@
+@@ -26,6 +22,9 @@
+ type nagios_var_run_t;
+ files_pid_file(nagios_var_run_t)
+
++type nagios_spool_t;
++files_type(nagios_spool_t)
++
+ type nrpe_t;
+ type nrpe_exec_t;
+ init_daemon_domain(nrpe_t,nrpe_exec_t)
+@@ -60,6 +59,10 @@
+ manage_files_pattern(nagios_t,nagios_var_run_t,nagios_var_run_t)
+ files_pid_filetrans(nagios_t,nagios_var_run_t,file)
+
++rw_fifo_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t)
++
++auth_use_nsswitch(nagios_t)
++
+ kernel_read_system_state(nagios_t)
+ kernel_read_kernel_sysctls(nagios_t)
+
+@@ -106,10 +109,6 @@
+ mta_send_mail(nagios_t)
+
+ optional_policy(`
+- auth_use_nsswitch(nagios_t)
+-')
+-
+-optional_policy(`
+ netutils_domtrans_ping(nagios_t)
+ netutils_signal_ping(nagios_t)
+ netutils_kill_ping(nagios_t)
+@@ -132,42 +131,31 @@
#
# Nagios CGI local policy
#
@@ -6025,47 +6386,47 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi
-allow nagios_cgi_t self:process signal_perms;
-allow nagios_cgi_t self:fifo_file rw_fifo_file_perms;
--
++allow httpd_nagios_script_t self:process signal_perms;
+
-read_files_pattern(nagios_cgi_t,nagios_t,nagios_t)
-read_lnk_files_pattern(nagios_cgi_t,nagios_t,nagios_t)
--
++read_files_pattern(httpd_nagios_script_t,nagios_t,nagios_t)
++read_lnk_files_pattern(httpd_nagios_script_t,nagios_t,nagios_t)
+
-allow nagios_cgi_t nagios_etc_t:dir list_dir_perms;
-read_files_pattern(nagios_cgi_t,nagios_etc_t,nagios_etc_t)
-read_lnk_files_pattern(nagios_cgi_t,nagios_etc_t,nagios_etc_t)
--
++allow httpd_nagios_script_t nagios_etc_t:dir list_dir_perms;
++read_files_pattern(httpd_nagios_script_t,nagios_etc_t,nagios_etc_t)
++read_lnk_files_pattern(httpd_nagios_script_t,nagios_etc_t,nagios_etc_t)
+
-allow nagios_cgi_t nagios_log_t:dir list_dir_perms;
-read_files_pattern(nagios_cgi_t,nagios_etc_t,nagios_log_t)
-read_lnk_files_pattern(nagios_cgi_t,nagios_etc_t,nagios_log_t)
-+allow httpd_nagios_script_t self:process signal_perms;
++allow httpd_nagios_script_t nagios_log_t:dir list_dir_perms;
++read_files_pattern(httpd_nagios_script_t,nagios_etc_t,nagios_log_t)
++read_lnk_files_pattern(httpd_nagios_script_t,nagios_etc_t,nagios_log_t)
-kernel_read_system_state(nagios_cgi_t)
-+read_files_pattern(httpd_nagios_script_t,nagios_t,nagios_t)
-+read_lnk_files_pattern(httpd_nagios_script_t,nagios_t,nagios_t)
++kernel_read_system_state(httpd_nagios_script_t)
-corecmd_exec_bin(nagios_cgi_t)
-+allow httpd_nagios_script_t nagios_etc_t:dir list_dir_perms;
-+read_files_pattern(httpd_nagios_script_t,nagios_etc_t,nagios_etc_t)
-+read_lnk_files_pattern(httpd_nagios_script_t,nagios_etc_t,nagios_etc_t)
++domain_dontaudit_read_all_domains_state(httpd_nagios_script_t)
-domain_dontaudit_read_all_domains_state(nagios_cgi_t)
-+allow httpd_nagios_script_t nagios_log_t:dir list_dir_perms;
-+read_files_pattern(httpd_nagios_script_t,nagios_etc_t,nagios_log_t)
-+read_lnk_files_pattern(httpd_nagios_script_t,nagios_etc_t,nagios_log_t)
++files_read_etc_runtime_files(httpd_nagios_script_t)
++files_read_kernel_symbol_table(httpd_nagios_script_t)
-files_read_etc_files(nagios_cgi_t)
-files_read_etc_runtime_files(nagios_cgi_t)
-files_read_kernel_symbol_table(nagios_cgi_t)
-+kernel_read_system_state(httpd_nagios_script_t)
-
+-
-libs_use_ld_so(nagios_cgi_t)
-libs_use_shared_libs(nagios_cgi_t)
-+domain_dontaudit_read_all_domains_state(httpd_nagios_script_t)
-
+-
-logging_send_syslog_msg(nagios_cgi_t)
-logging_search_logs(nagios_cgi_t)
-+files_read_etc_runtime_files(httpd_nagios_script_t)
-+files_read_kernel_symbol_table(httpd_nagios_script_t)
-
+-
-miscfiles_read_localization(nagios_cgi_t)
-
-optional_policy(`
@@ -6075,9 +6436,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi
########################################
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.0.6/policy/modules/services/networkmanager.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.0.7/policy/modules/services/networkmanager.fc
--- nsaserefpolicy/policy/modules/services/networkmanager.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/networkmanager.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/networkmanager.fc 2007-08-28 15:53:40.000000000 -0400
@@ -1,5 +1,6 @@
/usr/(s)?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0)
@@ -6085,9 +6446,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
/var/run/NetworkManager\.pid -- gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
/var/run/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
/var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.6/policy/modules/services/networkmanager.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.7/policy/modules/services/networkmanager.te
--- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-08-22 07:14:07.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/networkmanager.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/networkmanager.te 2007-08-28 15:53:40.000000000 -0400
@@ -20,7 +20,7 @@
# networkmanager will ptrace itself if gdb is installed
@@ -6129,9 +6490,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.6/policy/modules/services/nis.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.7/policy/modules/services/nis.fc
--- nsaserefpolicy/policy/modules/services/nis.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/nis.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/nis.fc 2007-08-28 15:53:40.000000000 -0400
@@ -4,6 +4,7 @@
/sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0)
@@ -6140,9 +6501,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
/usr/sbin/rpc\.yppasswdd -- gen_context(system_u:object_r:yppasswdd_exec_t,s0)
/usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.6/policy/modules/services/nis.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.7/policy/modules/services/nis.if
--- nsaserefpolicy/policy/modules/services/nis.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/nis.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/nis.if 2007-08-28 15:53:40.000000000 -0400
@@ -49,8 +49,8 @@
corenet_udp_bind_all_nodes($1)
corenet_tcp_bind_generic_port($1)
@@ -6154,9 +6515,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
corenet_dontaudit_tcp_bind_all_ports($1)
corenet_dontaudit_udp_bind_all_ports($1)
corenet_tcp_connect_portmap_port($1)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.6/policy/modules/services/nis.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.7/policy/modules/services/nis.te
--- nsaserefpolicy/policy/modules/services/nis.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/nis.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/nis.te 2007-08-28 15:53:40.000000000 -0400
@@ -113,6 +113,14 @@
userdom_dontaudit_use_unpriv_user_fds(ypbind_t)
userdom_dontaudit_search_sysadm_home_dirs(ypbind_t)
@@ -6209,9 +6570,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)
corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t)
corenet_tcp_connect_all_ports(ypxfr_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.6/policy/modules/services/nscd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.7/policy/modules/services/nscd.te
--- nsaserefpolicy/policy/modules/services/nscd.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/nscd.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/nscd.te 2007-08-28 15:53:40.000000000 -0400
@@ -28,14 +28,14 @@
# Local policy
#
@@ -6260,9 +6621,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd
+ samba_read_config(nscd_t)
+ samba_read_var_files(nscd_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.0.6/policy/modules/services/ntp.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.0.7/policy/modules/services/ntp.fc
--- nsaserefpolicy/policy/modules/services/ntp.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/ntp.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/ntp.fc 2007-09-04 11:51:24.000000000 -0400
@@ -17,3 +17,8 @@
/var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0)
@@ -6272,9 +6633,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
+/etc/ntp/keys -- gen_context(system_u:object_r:ntpd_key_t,s0)
+
+/etc/rc\.d/init\.d/ntpd -- gen_context(system_u:object_r:ntpd_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.if serefpolicy-3.0.6/policy/modules/services/ntp.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.if serefpolicy-3.0.7/policy/modules/services/ntp.if
--- nsaserefpolicy/policy/modules/services/ntp.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/ntp.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/ntp.if 2007-09-04 11:52:20.000000000 -0400
@@ -53,3 +53,59 @@
corecmd_search_bin($1)
domtrans_pattern($1,ntpdate_exec_t,ntpd_t)
@@ -6335,9 +6696,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
+ allow $1 ntpd_t:process signal;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.6/policy/modules/services/ntp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.7/policy/modules/services/ntp.te
--- nsaserefpolicy/policy/modules/services/ntp.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/ntp.te 2007-08-24 16:30:03.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/ntp.te 2007-09-04 11:51:12.000000000 -0400
@@ -25,6 +25,12 @@
type ntpdate_exec_t;
init_system_domain(ntpd_t,ntpdate_exec_t)
@@ -6402,9 +6763,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
udev_read_db(ntpd_t)
')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-3.0.6/policy/modules/services/openvpn.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-3.0.7/policy/modules/services/openvpn.if
--- nsaserefpolicy/policy/modules/services/openvpn.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/openvpn.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/openvpn.if 2007-08-28 15:53:40.000000000 -0400
@@ -22,3 +22,71 @@
read_files_pattern($1,openvpn_etc_t,openvpn_etc_t)
read_lnk_files_pattern($1,openvpn_etc_t,openvpn_etc_t)
@@ -6477,9 +6838,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
+
+ allow $1 openvpn_t:process signal;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.6/policy/modules/services/openvpn.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.7/policy/modules/services/openvpn.te
--- nsaserefpolicy/policy/modules/services/openvpn.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/openvpn.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/openvpn.te 2007-08-28 15:53:40.000000000 -0400
@@ -6,6 +6,13 @@
# Declarations
#
@@ -6556,9 +6917,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
+ unconfined_use_terminals(openvpn_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.6/policy/modules/services/pegasus.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.7/policy/modules/services/pegasus.if
--- nsaserefpolicy/policy/modules/services/pegasus.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/pegasus.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/pegasus.if 2007-08-28 15:53:40.000000000 -0400
@@ -1 +1,19 @@
## The Open Group Pegasus CIM/WBEM Server.
+
@@ -6579,10 +6940,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
+
+ domtrans_pattern($1,pegasus_exec_t,pegasus_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.6/policy/modules/services/pegasus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.7/policy/modules/services/pegasus.te
--- nsaserefpolicy/policy/modules/services/pegasus.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/pegasus.te 2007-08-22 08:03:53.000000000 -0400
-@@ -95,13 +95,13 @@
++++ serefpolicy-3.0.7/policy/modules/services/pegasus.te 2007-09-01 07:02:51.000000000 -0400
+@@ -42,6 +42,7 @@
+ allow pegasus_t pegasus_conf_t:file { read_file_perms link unlink };
+ allow pegasus_t pegasus_conf_t:lnk_file read_lnk_file_perms;
+
++manage_dirs_pattern(pegasus_t,pegasus_data_t,pegasus_data_t)
+ manage_files_pattern(pegasus_t,pegasus_data_t,pegasus_data_t)
+ manage_lnk_files_pattern(pegasus_t,pegasus_data_t,pegasus_data_t)
+ filetrans_pattern(pegasus_t,pegasus_conf_t,pegasus_data_t,{ file dir })
+@@ -95,13 +96,13 @@
auth_use_nsswitch(pegasus_t)
auth_domtrans_chk_passwd(pegasus_t)
@@ -6599,7 +6968,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
files_read_var_lib_symlinks(pegasus_t)
hostname_exec(pegasus_t)
-@@ -113,19 +113,17 @@
+@@ -113,19 +114,17 @@
libs_use_shared_libs(pegasus_t)
logging_send_audit_msgs(pegasus_t)
@@ -6621,9 +6990,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
rpm_exec(pegasus_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.6/policy/modules/services/portslave.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.7/policy/modules/services/portslave.te
--- nsaserefpolicy/policy/modules/services/portslave.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/portslave.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/portslave.te 2007-08-28 15:53:40.000000000 -0400
@@ -85,6 +85,7 @@
auth_rw_login_records(portslave_t)
@@ -6632,9 +7001,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port
init_rw_utmp(portslave_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.6/policy/modules/services/postfix.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.7/policy/modules/services/postfix.fc
--- nsaserefpolicy/policy/modules/services/postfix.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/postfix.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/postfix.fc 2007-09-04 17:47:41.000000000 -0400
@@ -14,6 +14,7 @@
/usr/libexec/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
/usr/libexec/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
@@ -6643,9 +7012,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
', `
/usr/lib/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
/usr/lib/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.6/policy/modules/services/postfix.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.7/policy/modules/services/postfix.if
--- nsaserefpolicy/policy/modules/services/postfix.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/postfix.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/postfix.if 2007-09-04 17:42:35.000000000 -0400
@@ -41,6 +41,8 @@
allow postfix_$1_t self:unix_stream_socket connectto;
@@ -6767,10 +7136,36 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+ allow $1 postfix_private_t:dir list_dir_perms;
+ create_sock_files_pattern($1,postfix_private_t,postfix_private_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.6/policy/modules/services/postfix.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.7/policy/modules/services/postfix.te
--- nsaserefpolicy/policy/modules/services/postfix.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/postfix.te 2007-08-22 08:03:53.000000000 -0400
-@@ -83,6 +83,12 @@
++++ serefpolicy-3.0.7/policy/modules/services/postfix.te 2007-09-04 17:42:51.000000000 -0400
+@@ -6,6 +6,14 @@
+ # Declarations
+ #
+
++##
++##
++## Allow postfix_local domain full write access to mail_spool directories
++##
++##
++##
++gen_tunable(allow_postfix_local_write_mail_spool,false)
++
+ attribute postfix_user_domains;
+ # domains that transition to the
+ # postfix user domains
+@@ -27,6 +35,10 @@
+ postfix_server_domain_template(local)
+ mta_mailserver_delivery(postfix_local_t)
+
++tunable_policy(`allow_postfix_local_write_mail_spool', `
++ mta_rw_spool(postfix_local_t)
++')
++
+ type postfix_local_tmp_t;
+ files_tmp_file(postfix_local_tmp_t)
+
+@@ -83,6 +95,12 @@
type postfix_var_run_t;
files_pid_file(postfix_var_run_t)
@@ -6783,7 +7178,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
########################################
#
# Postfix master process local policy
-@@ -168,6 +174,11 @@
+@@ -168,6 +186,11 @@
mta_rw_aliases(postfix_master_t)
mta_read_sendmail_bin(postfix_master_t)
@@ -6795,7 +7190,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
optional_policy(`
cyrus_stream_connect(postfix_master_t)
-@@ -179,9 +190,17 @@
+@@ -179,9 +202,17 @@
')
optional_policy(`
@@ -6813,7 +7208,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
###########################################################
#
# Partially converted rules. THESE ARE ONLY TEMPORARY
-@@ -263,6 +282,8 @@
+@@ -263,6 +294,8 @@
files_read_etc_files(postfix_local_t)
@@ -6822,7 +7217,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
mta_read_aliases(postfix_local_t)
mta_delete_spool(postfix_local_t)
# For reading spamassasin
-@@ -377,7 +398,7 @@
+@@ -377,7 +410,7 @@
# Postfix pipe local policy
#
@@ -6831,7 +7226,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
write_sock_files_pattern(postfix_pipe_t,postfix_private_t,postfix_private_t)
-@@ -386,6 +407,10 @@
+@@ -386,6 +419,10 @@
rw_files_pattern(postfix_pipe_t,postfix_spool_t,postfix_spool_t)
optional_policy(`
@@ -6842,7 +7237,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
procmail_domtrans(postfix_pipe_t)
')
-@@ -426,6 +451,11 @@
+@@ -426,6 +463,11 @@
cron_system_entry(postfix_postdrop_t, postfix_postdrop_exec_t)
')
@@ -6854,7 +7249,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
optional_policy(`
ppp_use_fds(postfix_postqueue_t)
ppp_sigchld(postfix_postqueue_t)
-@@ -505,8 +535,6 @@
+@@ -505,8 +547,6 @@
# Postfix smtp delivery local policy
#
@@ -6863,7 +7258,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
# connect to master process
stream_connect_pattern(postfix_smtp_t,{ postfix_private_t postfix_public_t },{ postfix_private_t postfix_public_t },postfix_master_t)
-@@ -514,6 +542,8 @@
+@@ -514,6 +554,8 @@
allow postfix_smtp_t postfix_spool_t:file rw_file_perms;
@@ -6872,7 +7267,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
optional_policy(`
cyrus_stream_connect(postfix_smtp_t)
')
-@@ -538,9 +568,45 @@
+@@ -538,9 +580,45 @@
mta_read_aliases(postfix_smtpd_t)
optional_policy(`
@@ -6918,18 +7313,122 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+# For reading spamassasin
+mta_read_config(postfix_virtual_t)
+mta_manage_spool(postfix_virtual_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.6/policy/modules/services/procmail.te
---- nsaserefpolicy/policy/modules/services/procmail.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/procmail.te 2007-08-22 08:03:53.000000000 -0400
-@@ -30,6 +30,8 @@
- allow procmail_t procmail_tmp_t:file manage_file_perms;
- files_tmp_filetrans(procmail_t, procmail_tmp_t, file)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.fc serefpolicy-3.0.7/policy/modules/services/postgresql.fc
+--- nsaserefpolicy/policy/modules/services/postgresql.fc 2007-05-29 14:10:57.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/postgresql.fc 2007-08-28 16:44:28.000000000 -0400
+@@ -38,3 +38,5 @@
+ ')
-+can_exec(procmail_t,procmail_exec_t)
+ /var/run/postgresql(/.*)? gen_context(system_u:object_r:postgresql_var_run_t,s0)
+
- kernel_read_system_state(procmail_t)
- kernel_read_kernel_sysctls(procmail_t)
-
++/etc/rc\.d/init\.d/postgresql -- gen_context(system_u:object_r:postgresql_script_exec_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.0.7/policy/modules/services/postgresql.if
+--- nsaserefpolicy/policy/modules/services/postgresql.if 2007-05-29 14:10:57.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/postgresql.if 2007-09-05 15:13:11.000000000 -0400
+@@ -113,3 +113,78 @@
+ # Some versions of postgresql put the sock file in /tmp
+ allow $1 postgresql_tmp_t:sock_file write;
+ ')
++
++########################################
++##
++## Execute postgresql server in the posgresql domain.
++##
++##
++##
++## The type of the process performing this action.
++##
++##
++#
++interface(`postgresql_script_domtrans',`
++ gen_require(`
++ type postgresql_script_exec_t;
++ ')
++
++ init_script_domtrans_spec($1,postgresql_script_exec_t)
++')
++
++########################################
++##
++## All of the rules required to administrate an postgresql environment
++##
++##
++##
++## Domain allowed access.
++##
++##
++##
++##
++## The role to be allowed to manage the postgresql domain.
++##
++##
++##
++##
++## The type of the terminal allow the postgresql domain to use.
++##
++##
++##
++#
++interface(`postgresql_admin',`
++ gen_require(`
++ type postgresql_t;
++ type postgresql_var_run_t;
++ type postgresql_tmp_t;
++ type postgresql_db_t;
++ type postgresql_etc_t;
++ type postgresql_log_t;
++ ')
++
++ allow $1 postgresql_t:process { ptrace signal_perms };
++
++ # Allow $1 to restart the apache service
++ postgresql_script_domtrans($1)
++ domain_system_change_exemption($1)
++ domain_role_change_exemption($1)
++ domain_obj_id_change_exemption($1)
++ role_transition $2 postgresql_script_exec_t system_r;
++ allow $2 system_r;
++
++ manage_dirs_pattern($1,postgresql_var_run_t,postgresql_var_run_t)
++ manage_files_pattern($1,postgresql_var_run_t,postgresql_var_run_t)
++
++ manage_dirs_pattern($1,postgresql_db_t,postgresql_db_t)
++ manage_files_pattern($1,postgresql_db_t,postgresql_db_t)
++
++ manage_dirs_pattern($1,postgresql_etc_t,postgresql_etc_t)
++ manage_files_pattern($1,postgresql_etc_t,postgresql_etc_t)
++
++ manage_dirs_pattern($1,postgresql_log_t,postgresql_log_t)
++ manage_files_pattern($1,postgresql_log_t,postgresql_log_t)
++
++ manage_dirs_pattern($1,postgresql_tmp_t,postgresql_tmp_t)
++ manage_files_pattern($1,postgresql_tmp_t,postgresql_tmp_t)
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.0.7/policy/modules/services/postgresql.te
+--- nsaserefpolicy/policy/modules/services/postgresql.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/postgresql.te 2007-08-28 16:44:00.000000000 -0400
+@@ -27,6 +27,9 @@
+ type postgresql_var_run_t;
+ files_pid_file(postgresql_var_run_t)
+
++type postgresql_script_exec_t;
++init_script_type(postgresql_script_exec_t)
++
+ ########################################
+ #
+ # postgresql Local policy
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.7/policy/modules/services/procmail.te
+--- nsaserefpolicy/policy/modules/services/procmail.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/procmail.te 2007-08-28 15:53:40.000000000 -0400
+@@ -30,6 +30,8 @@
+ allow procmail_t procmail_tmp_t:file manage_file_perms;
+ files_tmp_filetrans(procmail_t, procmail_tmp_t, file)
+
++can_exec(procmail_t,procmail_exec_t)
++
+ kernel_read_system_state(procmail_t)
+ kernel_read_kernel_sysctls(procmail_t)
+
@@ -50,6 +52,7 @@
fs_getattr_xattr_fs(procmail_t)
@@ -6956,9 +7455,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc
+optional_policy(`
+ mailscanner_read_spool(procmail_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.6/policy/modules/services/pyzor.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.7/policy/modules/services/pyzor.if
--- nsaserefpolicy/policy/modules/services/pyzor.if 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/pyzor.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/pyzor.if 2007-08-28 15:53:40.000000000 -0400
@@ -25,16 +25,16 @@
#
template(`pyzor_per_role_template',`
@@ -6981,9 +7480,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.0.6/policy/modules/services/pyzor.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.0.7/policy/modules/services/pyzor.te
--- nsaserefpolicy/policy/modules/services/pyzor.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/pyzor.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/pyzor.te 2007-08-28 15:53:40.000000000 -0400
@@ -70,6 +70,11 @@
userdom_dontaudit_search_sysadm_home_dirs(pyzor_t)
@@ -7007,17 +7506,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
optional_policy(`
logging_send_syslog_msg(pyzord_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.fc serefpolicy-3.0.6/policy/modules/services/radius.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.fc serefpolicy-3.0.7/policy/modules/services/radius.fc
--- nsaserefpolicy/policy/modules/services/radius.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/radius.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/radius.fc 2007-08-28 15:53:40.000000000 -0400
@@ -18,3 +18,4 @@
/var/run/radiusd(/.*)? gen_context(system_u:object_r:radiusd_var_run_t,s0)
/var/run/radiusd\.pid -- gen_context(system_u:object_r:radiusd_var_run_t,s0)
+/var/lib/radiousd(/.*)? gen_context(system_u:object_r:radiusd_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.6/policy/modules/services/radius.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.7/policy/modules/services/radius.te
--- nsaserefpolicy/policy/modules/services/radius.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/radius.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/radius.te 2007-08-28 15:53:40.000000000 -0400
@@ -19,6 +19,9 @@
type radiusd_log_t;
logging_log_file(radiusd_log_t)
@@ -7053,9 +7552,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi
sysnet_read_config(radiusd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remotelogin.te serefpolicy-3.0.6/policy/modules/services/remotelogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remotelogin.te serefpolicy-3.0.7/policy/modules/services/remotelogin.te
--- nsaserefpolicy/policy/modules/services/remotelogin.te 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/remotelogin.te 2007-08-28 11:20:57.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/remotelogin.te 2007-08-28 15:53:40.000000000 -0400
@@ -85,6 +85,7 @@
miscfiles_read_localization(remote_login_t)
@@ -7064,9 +7563,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remo
userdom_use_unpriv_users_fds(remote_login_t)
userdom_search_all_users_home_content(remote_login_t)
# Only permit unprivileged user domains to be entered via rlogin,
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.6/policy/modules/services/rhgb.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.7/policy/modules/services/rhgb.te
--- nsaserefpolicy/policy/modules/services/rhgb.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/rhgb.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/rhgb.te 2007-08-28 15:53:40.000000000 -0400
@@ -59,6 +59,7 @@
corenet_sendrecv_all_client_packets(rhgb_t)
@@ -7083,9 +7582,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb
xserver_read_xdm_xserver_tmp_files(rhgb_t)
xserver_kill_xdm_xserver(rhgb_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.6/policy/modules/services/ricci.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.7/policy/modules/services/ricci.te
--- nsaserefpolicy/policy/modules/services/ricci.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/ricci.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/ricci.te 2007-08-28 15:53:40.000000000 -0400
@@ -138,6 +138,7 @@
files_create_boot_flag(ricci_t)
@@ -7113,9 +7612,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc
optional_policy(`
nscd_dontaudit_search_pid(ricci_modlog_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.6/policy/modules/services/rlogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.7/policy/modules/services/rlogin.te
--- nsaserefpolicy/policy/modules/services/rlogin.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/rlogin.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/rlogin.te 2007-08-28 15:53:40.000000000 -0400
@@ -65,6 +65,7 @@
fs_search_auto_mountpoints(rlogind_t)
@@ -7124,9 +7623,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog
auth_rw_login_records(rlogind_t)
auth_use_nsswitch(rlogind_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.6/policy/modules/services/rpcbind.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.7/policy/modules/services/rpcbind.te
--- nsaserefpolicy/policy/modules/services/rpcbind.te 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/rpcbind.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/rpcbind.te 2007-08-28 15:53:40.000000000 -0400
@@ -21,11 +21,13 @@
# rpcbind local policy
#
@@ -7142,9 +7641,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
allow rpcbind_t self:tcp_socket create_stream_socket_perms;
manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.6/policy/modules/services/rpc.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.7/policy/modules/services/rpc.if
--- nsaserefpolicy/policy/modules/services/rpc.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/rpc.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/rpc.if 2007-08-28 15:53:40.000000000 -0400
@@ -81,6 +81,7 @@
corenet_tcp_bind_all_nodes($1_t)
corenet_udp_bind_all_nodes($1_t)
@@ -7166,9 +7665,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
fs_rw_rpc_named_pipes($1_t)
fs_search_auto_mountpoints($1_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.6/policy/modules/services/rpc.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.7/policy/modules/services/rpc.te
--- nsaserefpolicy/policy/modules/services/rpc.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/rpc.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/rpc.te 2007-09-04 11:46:58.000000000 -0400
@@ -59,10 +59,14 @@
manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t)
files_pid_filetrans(rpcd_t,rpcd_var_run_t,file)
@@ -7227,9 +7726,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
kernel_read_network_state(gssd_t)
kernel_read_network_state_symlinks(gssd_t)
kernel_search_network_sysctl(gssd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.6/policy/modules/services/rshd.te
+@@ -158,6 +171,9 @@
+
+ miscfiles_read_certs(gssd_t)
+
++userdom_dontaudit_search_users_home_dirs(rpcd_t)
++userdom_dontaudit_search_sysadm_home_dirs(rpcd_t)
++
+ tunable_policy(`allow_gssd_read_tmp',`
+ userdom_list_unpriv_users_tmp(gssd_t)
+ userdom_read_unpriv_users_tmp_files(gssd_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.7/policy/modules/services/rshd.te
--- nsaserefpolicy/policy/modules/services/rshd.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/rshd.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/rshd.te 2007-08-28 15:53:40.000000000 -0400
@@ -11,6 +11,7 @@
domain_subj_id_change_exemption(rshd_t)
domain_role_change_exemption(rshd_t)
@@ -7264,9 +7773,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd
- unconfined_domain(rshd_t)
unconfined_shell_domtrans(rshd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.6/policy/modules/services/rsync.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.7/policy/modules/services/rsync.te
--- nsaserefpolicy/policy/modules/services/rsync.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/rsync.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/rsync.te 2007-08-28 15:53:40.000000000 -0400
@@ -17,6 +17,7 @@
type rsync_t;
type rsync_exec_t;
@@ -7275,17 +7784,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn
role system_r types rsync_t;
type rsync_data_t;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-3.0.6/policy/modules/services/rwho.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-3.0.7/policy/modules/services/rwho.fc
--- nsaserefpolicy/policy/modules/services/rwho.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/rwho.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/rwho.fc 2007-08-28 15:53:40.000000000 -0400
@@ -1,3 +1,4 @@
/usr/sbin/rwhod -- gen_context(system_u:object_r:rwho_exec_t,s0)
/var/spool/rwho(/.*)? gen_context(system_u:object_r:rwho_spool_t,s0)
+/var/log/rwhod(/.*)? gen_context(system_u:object_r:rwho_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-3.0.6/policy/modules/services/rwho.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-3.0.7/policy/modules/services/rwho.if
--- nsaserefpolicy/policy/modules/services/rwho.if 2007-06-15 14:54:33.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/rwho.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/rwho.if 2007-08-28 15:53:40.000000000 -0400
@@ -72,6 +72,47 @@
type rwho_spool_t;
')
@@ -7335,9 +7844,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho
+ logging_search_logs($1)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-3.0.6/policy/modules/services/rwho.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-3.0.7/policy/modules/services/rwho.te
--- nsaserefpolicy/policy/modules/services/rwho.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/rwho.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/rwho.te 2007-08-28 15:53:40.000000000 -0400
@@ -10,10 +10,12 @@
type rwho_exec_t;
init_daemon_domain(rwho_t, rwho_exec_t)
@@ -7363,9 +7872,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho
kernel_read_system_state(rwho_t)
corenet_all_recvfrom_unlabeled(rwho_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.6/policy/modules/services/samba.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.7/policy/modules/services/samba.fc
--- nsaserefpolicy/policy/modules/services/samba.fc 2007-06-19 16:23:34.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/samba.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/samba.fc 2007-08-28 15:53:40.000000000 -0400
@@ -30,6 +30,8 @@
/var/lib/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0)
/var/lib/samba/winbindd_privileged(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0)
@@ -7375,9 +7884,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
/var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0)
/var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.6/policy/modules/services/samba.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.7/policy/modules/services/samba.if
--- nsaserefpolicy/policy/modules/services/samba.if 2007-06-19 16:23:35.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/samba.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/samba.if 2007-08-28 15:53:40.000000000 -0400
@@ -349,6 +349,7 @@
files_search_var($1)
files_search_var_lib($1)
@@ -7439,9 +7948,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
+ read_files_pattern($1, samba_share_t, samba_share_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.6/policy/modules/services/samba.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.7/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/samba.te 2007-08-23 17:07:11.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/samba.te 2007-08-28 15:53:40.000000000 -0400
@@ -190,6 +190,8 @@
miscfiles_read_localization(samba_net_t)
@@ -7640,9 +8149,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.6/policy/modules/services/sasl.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.7/policy/modules/services/sasl.te
--- nsaserefpolicy/policy/modules/services/sasl.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/sasl.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/sasl.te 2007-08-28 15:53:40.000000000 -0400
@@ -64,6 +64,7 @@
selinux_compute_access_vector(saslauthd_t)
@@ -7651,10 +8160,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl
auth_use_nsswitch(saslauthd_t)
domain_use_interactive_fds(saslauthd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.6/policy/modules/services/sendmail.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.7/policy/modules/services/sendmail.if
--- nsaserefpolicy/policy/modules/services/sendmail.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/sendmail.if 2007-08-22 08:03:53.000000000 -0400
-@@ -131,3 +131,21 @@
++++ serefpolicy-3.0.7/policy/modules/services/sendmail.if 2007-09-04 17:43:19.000000000 -0400
+@@ -131,3 +131,51 @@
logging_log_filetrans($1,sendmail_log_t,file)
')
@@ -7676,9 +8185,39 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
+ allow $1 sendmail_t:process signal;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.0.6/policy/modules/services/sendmail.te
++########################################
++##
++## Execute the sendmail program in the sendmail domain.
++##
++##
++##
++## Domain allowed access.
++##
++##
++##
++##
++## The role to allow the sendmail domain.
++##
++##
++##
++##
++## The type of the terminal allow the sendmail domain to use.
++##
++##
++##
++#
++interface(`sendmail_run',`
++ gen_require(`
++ type sendmail_t;
++ ')
++
++ sendmail_domtrans($1)
++ role $2 types sendmail_t;
++ allow sendmail_t $3:chr_file rw_term_perms;
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.0.7/policy/modules/services/sendmail.te
--- nsaserefpolicy/policy/modules/services/sendmail.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/sendmail.te 2007-08-23 09:58:58.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/sendmail.te 2007-08-28 15:53:40.000000000 -0400
@@ -32,7 +32,6 @@
allow sendmail_t self:unix_dgram_socket create_socket_perms;
allow sendmail_t self:tcp_socket create_stream_socket_perms;
@@ -7696,7 +8235,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
corenet_all_recvfrom_unlabeled(sendmail_t)
corenet_all_recvfrom_netlabel(sendmail_t)
corenet_tcp_sendrecv_all_if(sendmail_t)
-@@ -91,11 +92,9 @@
+@@ -91,32 +92,27 @@
logging_send_syslog_msg(sendmail_t)
@@ -7709,7 +8248,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
userdom_dontaudit_use_unpriv_user_fds(sendmail_t)
userdom_dontaudit_search_sysadm_home_dirs(sendmail_t)
-@@ -106,17 +105,14 @@
+ mta_read_config(sendmail_t)
+ mta_etc_filetrans_aliases(sendmail_t)
+ # Write to /etc/aliases and /etc/mail.
+-mta_rw_aliases(sendmail_t)
++mta_manage_aliases(sendmail_t)
# Write to /var/spool/mail and /var/spool/mqueue.
mta_manage_queue(sendmail_t)
mta_manage_spool(sendmail_t)
@@ -7741,9 +8284,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
seutil_sigchld_newrole(sendmail_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.0.6/policy/modules/services/setroubleshoot.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.0.7/policy/modules/services/setroubleshoot.if
--- nsaserefpolicy/policy/modules/services/setroubleshoot.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/setroubleshoot.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/setroubleshoot.if 2007-08-28 15:53:40.000000000 -0400
@@ -19,3 +19,22 @@
allow $1 setroubleshoot_var_run_t:sock_file write;
allow $1 setroubleshootd_t:unix_stream_socket connectto;
@@ -7767,9 +8310,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr
+ dontaudit $1 setroubleshoot_var_run_t:sock_file write;
+ dontaudit $1 setroubleshootd_t:unix_stream_socket connectto;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.6/policy/modules/services/setroubleshoot.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.7/policy/modules/services/setroubleshoot.te
--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/setroubleshoot.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/setroubleshoot.te 2007-08-28 15:53:40.000000000 -0400
@@ -33,7 +33,6 @@
allow setroubleshootd_t self:tcp_socket create_stream_socket_perms;
allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto };
@@ -7812,17 +8355,30 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr
-optional_policy(`
- nis_use_ypbind(setroubleshootd_t)
-')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.0.6/policy/modules/services/snmp.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.0.7/policy/modules/services/snmp.fc
--- nsaserefpolicy/policy/modules/services/snmp.fc 2007-06-19 16:23:35.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/snmp.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/snmp.fc 2007-08-28 15:53:40.000000000 -0400
@@ -1,3 +1,4 @@
+
#
# /usr
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.fc serefpolicy-3.0.6/policy/modules/services/soundserver.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.0.7/policy/modules/services/snmp.te
+--- nsaserefpolicy/policy/modules/services/snmp.te 2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/snmp.te 2007-09-04 10:33:59.000000000 -0400
+@@ -81,8 +81,7 @@
+ files_read_usr_files(snmpd_t)
+ files_read_etc_runtime_files(snmpd_t)
+ files_search_home(snmpd_t)
+-files_getattr_boot_dirs(snmpd_t)
+-files_dontaudit_getattr_home_dir(snmpd_t)
++auth_read_all_dirs_except_shadow(snmpd_t)
+
+ fs_getattr_all_dirs(snmpd_t)
+ fs_getattr_all_fs(snmpd_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.fc serefpolicy-3.0.7/policy/modules/services/soundserver.fc
--- nsaserefpolicy/policy/modules/services/soundserver.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/soundserver.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/soundserver.fc 2007-08-28 15:53:40.000000000 -0400
@@ -1,10 +1,16 @@
-/etc/nas(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0)
-/etc/yiff(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0)
@@ -7846,9 +8402,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun
+#
+
+/usr/bin/nasd -- gen_context(system_u:object_r:soundd_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.if serefpolicy-3.0.6/policy/modules/services/soundserver.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.if serefpolicy-3.0.7/policy/modules/services/soundserver.if
--- nsaserefpolicy/policy/modules/services/soundserver.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/soundserver.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/soundserver.if 2007-08-28 15:53:40.000000000 -0400
@@ -13,3 +13,64 @@
interface(`soundserver_tcp_connect',`
refpolicywarn(`$0($*) has been deprecated.')
@@ -7914,9 +8470,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun
+ allow $1 soundd_var_run_t:sock_file r_file_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.te serefpolicy-3.0.6/policy/modules/services/soundserver.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.te serefpolicy-3.0.7/policy/modules/services/soundserver.te
--- nsaserefpolicy/policy/modules/services/soundserver.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/soundserver.te 2007-08-24 16:10:39.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/soundserver.te 2007-08-28 15:53:40.000000000 -0400
@@ -10,9 +10,6 @@
type soundd_exec_t;
init_daemon_domain(soundd_t,soundd_exec_t)
@@ -7980,9 +8536,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun
seutil_sigchld_newrole(soundd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.0.6/policy/modules/services/spamassassin.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.0.7/policy/modules/services/spamassassin.fc
--- nsaserefpolicy/policy/modules/services/spamassassin.fc 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/spamassassin.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/spamassassin.fc 2007-08-28 15:53:40.000000000 -0400
@@ -10,3 +10,9 @@
/var/lib/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_lib_t,s0)
@@ -7993,9 +8549,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
+/var/run/spamass-milter(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0)
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.0.6/policy/modules/services/spamassassin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.0.7/policy/modules/services/spamassassin.te
--- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-08-02 08:17:27.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/spamassassin.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/spamassassin.te 2007-08-28 16:26:23.000000000 -0400
@@ -83,8 +83,9 @@
allow spamd_t spamd_var_lib_t:dir list_dir_perms;
read_files_pattern(spamd_t,spamd_var_lib_t,spamd_var_lib_t)
@@ -8007,18 +8563,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
kernel_read_all_sysctls(spamd_t)
kernel_read_system_state(spamd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.6/policy/modules/services/squid.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.7/policy/modules/services/squid.fc
--- nsaserefpolicy/policy/modules/services/squid.fc 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/squid.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/squid.fc 2007-08-28 15:53:40.000000000 -0400
@@ -12,3 +12,5 @@
/var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0)
/var/spool/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0)
+/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
+/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-3.0.6/policy/modules/services/squid.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-3.0.7/policy/modules/services/squid.if
--- nsaserefpolicy/policy/modules/services/squid.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/squid.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/squid.if 2007-08-28 15:53:40.000000000 -0400
@@ -131,3 +131,22 @@
interface(`squid_use',`
refpolicywarn(`$0($*) has been deprecated.')
@@ -8042,9 +8598,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
+
+ allow $1 squid_t:unix_stream_socket { read write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.6/policy/modules/services/squid.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.7/policy/modules/services/squid.te
--- nsaserefpolicy/policy/modules/services/squid.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/squid.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/squid.te 2007-09-04 13:41:59.000000000 -0400
@@ -36,7 +36,7 @@
# Local policy
#
@@ -8063,7 +8619,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
# Grant permissions to create, access, and delete cache files.
manage_dirs_pattern(squid_t,squid_cache_t,squid_cache_t)
manage_files_pattern(squid_t,squid_cache_t,squid_cache_t)
-@@ -109,6 +111,8 @@
+@@ -92,6 +94,7 @@
+ corenet_udp_bind_gopher_port(squid_t)
+ corenet_tcp_bind_squid_port(squid_t)
+ corenet_udp_bind_squid_port(squid_t)
++corenet_udp_bind_wccp_port(squid_t)
+ corenet_tcp_connect_ftp_port(squid_t)
+ corenet_tcp_connect_gopher_port(squid_t)
+ corenet_tcp_connect_http_port(squid_t)
+@@ -109,6 +112,8 @@
fs_getattr_all_fs(squid_t)
fs_search_auto_mountpoints(squid_t)
@@ -8072,7 +8636,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
selinux_dontaudit_getattr_dir(squid_t)
-@@ -137,9 +141,6 @@
+@@ -137,9 +142,6 @@
miscfiles_read_certs(squid_t)
miscfiles_read_localization(squid_t)
@@ -8082,7 +8646,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
userdom_use_unpriv_users_fds(squid_t)
userdom_dontaudit_use_unpriv_user_fds(squid_t)
userdom_dontaudit_search_sysadm_home_dirs(squid_t)
-@@ -149,19 +150,7 @@
+@@ -149,19 +151,7 @@
')
optional_policy(`
@@ -8103,7 +8667,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
')
optional_policy(`
-@@ -176,7 +165,12 @@
+@@ -176,7 +166,12 @@
udev_read_db(squid_t)
')
@@ -8120,9 +8684,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
+ corenet_all_recvfrom_unlabeled(httpd_squid_script_t)
+ corenet_all_recvfrom_netlabel(httpd_squid_script_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.6/policy/modules/services/ssh.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.7/policy/modules/services/ssh.if
--- nsaserefpolicy/policy/modules/services/ssh.if 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/ssh.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/ssh.if 2007-08-28 15:53:40.000000000 -0400
@@ -202,6 +202,7 @@
#
template(`ssh_per_role_template',`
@@ -8174,9 +8738,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
+ dontaudit $2 $1_ssh_agent_t:fd use;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.6/policy/modules/services/ssh.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.7/policy/modules/services/ssh.te
--- nsaserefpolicy/policy/modules/services/ssh.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/ssh.te 2007-08-28 11:18:37.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/ssh.te 2007-08-28 15:53:40.000000000 -0400
@@ -24,7 +24,7 @@
# Type for the ssh-agent executable.
@@ -8230,9 +8794,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
')
ifdef(`TODO',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-3.0.6/policy/modules/services/tftp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-3.0.7/policy/modules/services/tftp.te
--- nsaserefpolicy/policy/modules/services/tftp.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/tftp.te 2007-08-22 08:28:21.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/tftp.te 2007-08-28 15:53:40.000000000 -0400
@@ -26,6 +26,7 @@
allow tftpd_t self:udp_socket create_socket_perms;
allow tftpd_t self:unix_dgram_socket create_socket_perms;
@@ -8241,9 +8805,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp
dontaudit tftpd_t self:capability sys_tty_config;
allow tftpd_t tftpdir_t:dir { getattr read search };
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.6/policy/modules/services/uwimap.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.7/policy/modules/services/uwimap.te
--- nsaserefpolicy/policy/modules/services/uwimap.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/uwimap.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/uwimap.te 2007-08-28 15:53:40.000000000 -0400
@@ -64,6 +64,7 @@
fs_search_auto_mountpoints(imapd_t)
@@ -8252,20 +8816,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwim
libs_use_ld_so(imapd_t)
libs_use_shared_libs(imapd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.6/policy/modules/services/w3c.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.7/policy/modules/services/w3c.fc
--- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/services/w3c.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/w3c.fc 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,2 @@
+/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0)
+/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.6/policy/modules/services/w3c.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.7/policy/modules/services/w3c.if
--- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/services/w3c.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/w3c.if 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1 @@
+## W3C
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.6/policy/modules/services/w3c.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.7/policy/modules/services/w3c.te
--- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/services/w3c.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/w3c.te 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,14 @@
+policy_module(w3c,1.2.1)
+
@@ -8281,9 +8845,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.
+corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t)
+
+miscfiles_read_certs(httpd_w3c_validator_script_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.6/policy/modules/services/xserver.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.7/policy/modules/services/xserver.fc
--- nsaserefpolicy/policy/modules/services/xserver.fc 2007-08-22 07:14:07.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/xserver.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/xserver.fc 2007-08-28 15:53:40.000000000 -0400
@@ -32,11 +32,6 @@
/etc/X11/wdm/Xstartup.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/X11/Xsession[^/]* -- gen_context(system_u:object_r:xsession_exec_t,s0)
@@ -8307,9 +8871,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
ifdef(`distro_suse',`
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.6/policy/modules/services/xserver.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.7/policy/modules/services/xserver.if
--- nsaserefpolicy/policy/modules/services/xserver.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/xserver.if 2007-08-24 10:18:58.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/xserver.if 2007-08-28 15:53:40.000000000 -0400
@@ -126,6 +126,8 @@
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev($1_xserver_t)
@@ -8640,9 +9204,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
+
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.6/policy/modules/services/xserver.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.7/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2007-08-22 07:14:07.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/xserver.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/services/xserver.te 2007-08-28 15:53:40.000000000 -0400
@@ -16,6 +16,13 @@
##
@@ -8806,9 +9370,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
-#
-allow pam_t xdm_t:fifo_file { getattr ioctl write };
-') dnl end TODO
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.6/policy/modules/system/application.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.7/policy/modules/system/application.if
--- nsaserefpolicy/policy/modules/system/application.if 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/application.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/application.if 2007-08-28 15:53:40.000000000 -0400
@@ -63,6 +63,26 @@
########################################
@@ -8836,9 +9400,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic
## Create a domain which can be started by users
##
##
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.6/policy/modules/system/authlogin.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.7/policy/modules/system/authlogin.fc
--- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/authlogin.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/authlogin.fc 2007-08-28 15:53:40.000000000 -0400
@@ -14,6 +14,7 @@
/sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
@@ -8847,9 +9411,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
ifdef(`distro_suse', `
/sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.6/policy/modules/system/authlogin.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.7/policy/modules/system/authlogin.if
--- nsaserefpolicy/policy/modules/system/authlogin.if 2007-08-22 07:14:13.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/authlogin.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/authlogin.if 2007-09-05 15:03:49.000000000 -0400
@@ -26,7 +26,8 @@
type $1_chkpwd_t, can_read_shadow_passwords;
application_domain($1_chkpwd_t,chkpwd_exec_t)
@@ -8956,7 +9520,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+##
+##
+##
-+## The role to allow the updpwd domain.
++## The role to allow hte updpwd domain.
+##
+##
+##
@@ -9185,9 +9749,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+ allow system_chkpwd_t $3:chr_file rw_file_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.6/policy/modules/system/authlogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.7/policy/modules/system/authlogin.te
--- nsaserefpolicy/policy/modules/system/authlogin.te 2007-08-22 07:14:12.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/authlogin.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/authlogin.te 2007-09-05 12:06:19.000000000 -0400
@@ -9,6 +9,13 @@
attribute can_read_shadow_passwords;
attribute can_write_shadow_passwords;
@@ -9231,7 +9795,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
')
########################################
-@@ -302,3 +315,30 @@
+@@ -302,3 +315,28 @@
xserver_use_xdm_fds(utempter_t)
xserver_rw_xdm_pipes(utempter_t)
')
@@ -9252,25 +9816,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+miscfiles_read_localization(updpwd_t)
+
+auth_manage_shadow(updpwd_t)
++auth_use_nsswitch(updpwd_t)
++
+term_dontaudit_use_console(updpwd_t)
+term_dontaudit_use_console(updpwd_t)
+term_dontaudit_use_unallocated_ttys(updpwd_t)
+files_manage_etc_files(updpwd_t)
+kernel_read_system_state(updpwd_t)
+logging_send_syslog_msg(updpwd_t)
-+
-+optional_policy(`
-+ nscd_socket_use(updpwd_t)
-+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.fc serefpolicy-3.0.6/policy/modules/system/brctl.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.fc serefpolicy-3.0.7/policy/modules/system/brctl.fc
--- nsaserefpolicy/policy/modules/system/brctl.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/system/brctl.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/brctl.fc 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,2 @@
+
+/usr/sbin/brctl -- gen_context(system_u:object_r:brctl_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.if serefpolicy-3.0.6/policy/modules/system/brctl.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.if serefpolicy-3.0.7/policy/modules/system/brctl.if
--- nsaserefpolicy/policy/modules/system/brctl.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/system/brctl.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/brctl.if 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,25 @@
+
+## Utilities for configuring the linux ethernet bridge
@@ -9297,9 +9859,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.
+ allow brctl_t $1:fifo_file rw_file_perms;
+ allow brctl_t $1:process sigchld;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.te serefpolicy-3.0.6/policy/modules/system/brctl.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.te serefpolicy-3.0.7/policy/modules/system/brctl.te
--- nsaserefpolicy/policy/modules/system/brctl.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/system/brctl.te 2007-08-27 10:44:36.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/brctl.te 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,51 @@
+policy_module(brctl,1.0.0)
+
@@ -9352,9 +9914,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.
+optional_policy(`
+ xen_append_log(brctl_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.6/policy/modules/system/fstools.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.7/policy/modules/system/fstools.fc
--- nsaserefpolicy/policy/modules/system/fstools.fc 2007-06-11 16:05:30.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/fstools.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/fstools.fc 2007-08-28 15:53:40.000000000 -0400
@@ -20,7 +20,6 @@
/sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -9363,9 +9925,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.0.6/policy/modules/system/fstools.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.0.7/policy/modules/system/fstools.if
--- nsaserefpolicy/policy/modules/system/fstools.if 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/fstools.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/fstools.if 2007-08-28 15:53:40.000000000 -0400
@@ -124,3 +124,22 @@
allow $1 swapfile_t:file getattr;
@@ -9389,9 +9951,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
+ allow $1 fsdaemon_t:fifo_file read_fifo_file_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.6/policy/modules/system/fstools.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.7/policy/modules/system/fstools.te
--- nsaserefpolicy/policy/modules/system/fstools.te 2007-08-22 07:14:11.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/fstools.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/fstools.te 2007-09-04 10:57:27.000000000 -0400
@@ -69,6 +69,7 @@
dev_getattr_all_chr_files(fsadm_t)
@@ -9400,7 +9962,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
# mkreiserfs and other programs need this for UUID
dev_read_rand(fsadm_t)
dev_read_urand(fsadm_t)
-@@ -179,3 +180,12 @@
+@@ -108,8 +109,7 @@
+
+ term_use_console(fsadm_t)
+
+-corecmd_list_bin(fsadm_t)
+-corecmd_read_bin_symlinks(fsadm_t)
++corecmd_exec_bin(fsadm_t)
+ #RedHat bug #201164
+ corecmd_exec_shell(fsadm_t)
+
+@@ -179,3 +179,12 @@
fs_dontaudit_write_ramfs_pipes(fsadm_t)
rhgb_stub(fsadm_t)
')
@@ -9413,9 +9985,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
+tunable_policy(`xen_use_nfs',`
+ fs_manage_nfs_files(fsadm_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.6/policy/modules/system/fusermount.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.7/policy/modules/system/fusermount.fc
--- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/system/fusermount.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/fusermount.fc 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,7 @@
+# fusermount executable will have:
+# label: system_u:object_r:fusermount_exec_t
@@ -9424,9 +9996,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+
+/usr/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0)
+/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.6/policy/modules/system/fusermount.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.7/policy/modules/system/fusermount.if
--- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/system/fusermount.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/fusermount.if 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,41 @@
+## policy for fusermount
+
@@ -9470,9 +10042,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+ allow $1 fusermount_t:fd use;
+')
\ No newline at end of file
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.6/policy/modules/system/fusermount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.7/policy/modules/system/fusermount.te
--- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/system/fusermount.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/fusermount.te 2007-09-04 09:46:20.000000000 -0400
@@ -0,0 +1,44 @@
+policy_module(fusermount,1.0.0)
+
@@ -9518,9 +10090,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.6/policy/modules/system/getty.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.7/policy/modules/system/getty.te
--- nsaserefpolicy/policy/modules/system/getty.te 2007-08-22 07:14:13.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/getty.te 2007-08-27 10:45:03.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/getty.te 2007-08-28 15:53:40.000000000 -0400
@@ -33,7 +33,8 @@
#
@@ -9531,9 +10103,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.
dontaudit getty_t self:capability sys_tty_config;
allow getty_t self:process { getpgid setpgid getsession signal_perms };
allow getty_t self:fifo_file rw_fifo_file_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.6/policy/modules/system/hostname.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.7/policy/modules/system/hostname.te
--- nsaserefpolicy/policy/modules/system/hostname.te 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/hostname.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/hostname.te 2007-08-28 15:53:40.000000000 -0400
@@ -8,7 +8,9 @@
type hostname_t;
@@ -9557,9 +10129,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna
+optional_policy(`
+ unconfined_dontaudit_rw_pipes(hostname_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.6/policy/modules/system/init.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.7/policy/modules/system/init.if
--- nsaserefpolicy/policy/modules/system/init.if 2007-08-22 07:14:12.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/init.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/init.if 2007-09-04 11:59:51.000000000 -0400
@@ -540,18 +540,19 @@
#
interface(`init_spec_domtrans_script',`
@@ -9591,19 +10163,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
- type initrc_t, initrc_exec_t;
+ type initrc_t;
+ attribute initscript;
- ')
-
- files_list_etc($1)
-- domtrans_pattern($1,initrc_exec_t,initrc_t)
++ ')
++
++ files_list_etc($1)
+ domtrans_pattern($1,initscript,initrc_t)
-
- ifdef(`enable_mcs',`
-- range_transition $1 initrc_exec_t:process s0;
++
++ ifdef(`enable_mcs',`
+ range_transition $1 initscript:process s0;
- ')
-
- ifdef(`enable_mls',`
-- range_transition $1 initrc_exec_t:process s0 - mls_systemhigh;
++ ')
++
++ ifdef(`enable_mls',`
+ range_transition $1 initscript:process s0 - mls_systemhigh;
+ ')
+')
@@ -9621,16 +10190,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
+interface(`init_script_domtrans_spec',`
+ gen_require(`
+ type initrc_t;
-+ ')
-+
-+ files_list_etc($1)
+ ')
+
+ files_list_etc($1)
+- domtrans_pattern($1,initrc_exec_t,initrc_t)
+ domtrans_pattern($1,$2,initrc_t)
-+
-+ ifdef(`enable_mcs',`
+
+ ifdef(`enable_mcs',`
+- range_transition $1 initrc_exec_t:process s0;
+ range_transition $1 $2:process s0;
-+ ')
-+
-+ ifdef(`enable_mls',`
+ ')
+
+ ifdef(`enable_mls',`
+- range_transition $1 initrc_exec_t:process s0 - mls_systemhigh;
+ range_transition $1 $2:process s0 - mls_systemhigh;
')
')
@@ -9677,7 +10249,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
')
########################################
-@@ -1030,11 +1059,11 @@
+@@ -931,6 +960,7 @@
+
+ dontaudit $1 initrc_t:unix_stream_socket connectto;
+ ')
++
+ ########################################
+ ##
+ ## Send messages to init scripts over dbus.
+@@ -1030,11 +1060,11 @@
#
interface(`init_read_script_files',`
gen_require(`
@@ -9691,7 +10271,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
')
########################################
-@@ -1252,7 +1281,7 @@
+@@ -1252,7 +1282,7 @@
type initrc_var_run_t;
')
@@ -9700,7 +10280,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
')
########################################
-@@ -1273,3 +1302,64 @@
+@@ -1273,3 +1303,64 @@
files_search_pids($1)
allow $1 initrc_var_run_t:file manage_file_perms;
')
@@ -9765,9 +10345,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
+ domain_entry_file(initrc_t,$1)
+
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.6/policy/modules/system/init.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.7/policy/modules/system/init.te
--- nsaserefpolicy/policy/modules/system/init.te 2007-08-22 07:14:12.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/init.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/init.te 2007-09-04 12:01:50.000000000 -0400
@@ -10,6 +10,20 @@
# Declarations
#
@@ -9901,9 +10481,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.6/policy/modules/system/ipsec.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.7/policy/modules/system/ipsec.te
--- nsaserefpolicy/policy/modules/system/ipsec.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/ipsec.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/ipsec.te 2007-08-28 15:53:40.000000000 -0400
@@ -283,6 +283,7 @@
allow racoon_t self:netlink_selinux_socket { bind create read };
allow racoon_t self:udp_socket create_socket_perms;
@@ -9912,9 +10492,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
# manage pid file
manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.6/policy/modules/system/iptables.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.7/policy/modules/system/iptables.te
--- nsaserefpolicy/policy/modules/system/iptables.te 2007-08-22 07:14:11.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/iptables.te 2007-08-27 10:45:25.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/iptables.te 2007-08-28 15:53:40.000000000 -0400
@@ -44,6 +44,8 @@
corenet_relabelto_all_packets(iptables_t)
@@ -9946,9 +10526,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.6/policy/modules/system/libraries.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.7/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2007-08-02 08:17:28.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/libraries.fc 2007-08-27 10:58:43.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/libraries.fc 2007-08-28 15:53:40.000000000 -0400
@@ -65,11 +65,12 @@
/opt/(.*/)?java/.+\.jar -- gen_context(system_u:object_r:lib_t,s0)
/opt/(.*/)?jre.*/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -9990,9 +10570,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
+
+/var/cache/ldconfig(/.*)? gen_context(system_u:object_r:ldconfig_cache_t,s0)
+/usr/lib/libtheora\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.6/policy/modules/system/libraries.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.7/policy/modules/system/libraries.te
--- nsaserefpolicy/policy/modules/system/libraries.te 2007-08-02 08:17:28.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/libraries.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/libraries.te 2007-08-28 15:53:40.000000000 -0400
@@ -23,6 +23,9 @@
init_system_domain(ldconfig_t,ldconfig_exec_t)
role system_r types ldconfig_t;
@@ -10041,9 +10621,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
+ # run mkinitrd as unconfined user
+ unconfined_manage_tmp_files(ldconfig_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.6/policy/modules/system/locallogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.7/policy/modules/system/locallogin.te
--- nsaserefpolicy/policy/modules/system/locallogin.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/locallogin.te 2007-08-28 11:20:41.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/locallogin.te 2007-08-28 15:53:40.000000000 -0400
@@ -97,6 +97,11 @@
term_setattr_all_user_ttys(local_login_t)
term_setattr_unallocated_ttys(local_login_t)
@@ -10100,9 +10680,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall
#################################
#
# Sulogin local policy
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.6/policy/modules/system/logging.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.7/policy/modules/system/logging.fc
--- nsaserefpolicy/policy/modules/system/logging.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/logging.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/logging.fc 2007-08-31 06:46:14.000000000 -0400
@@ -1,12 +1,15 @@
-
/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
@@ -10129,15 +10709,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
/var/run/audit_events -s gen_context(system_u:object_r:auditd_var_run_t,s0)
/var/run/auditd\.pid -- gen_context(system_u:object_r:auditd_var_run_t,s0)
/var/run/auditd_sock -s gen_context(system_u:object_r:auditd_var_run_t,s0)
-@@ -43,3 +48,5 @@
+@@ -43,3 +48,8 @@
/var/spool/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0)
/var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
+
+/var/log/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.6/policy/modules/system/logging.if
++
++/etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_script_exec_t,s0)
++/etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_script_exec_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.7/policy/modules/system/logging.if
--- nsaserefpolicy/policy/modules/system/logging.if 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/logging.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/logging.if 2007-09-04 17:01:26.000000000 -0400
@@ -33,8 +33,13 @@
##
#
@@ -10261,7 +10844,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
')
########################################
-@@ -578,3 +661,101 @@
+@@ -578,3 +661,254 @@
files_search_var($1)
manage_files_pattern($1,var_log_t,var_log_t)
')
@@ -10363,9 +10946,162 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+ typeattribute $1 can_send_audit_msgs;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.6/policy/modules/system/logging.te
++########################################
++##
++## Execute syslog server in the syslogd domain.
++##
++##
++##
++## The type of the process performing this action.
++##
++##
++#
++interface(`logging_syslog_script_domtrans',`
++ gen_require(`
++ type syslogd_script_exec_t;
++ ')
++
++ init_script_domtrans_spec($1,syslogd_script_exec_t)
++')
++
++########################################
++##
++## Execute audit server in the auditd domain.
++##
++##
++##
++## The type of the process performing this action.
++##
++##
++#
++interface(`logging_audit_script_domtrans',`
++ gen_require(`
++ type auditd_script_exec_t;
++ ')
++
++ init_script_domtrans_spec($1,auditd_script_exec_t)
++')
++
++
++########################################
++##
++## All of the rules required to administrate an audit environment
++##
++##
++##
++## Domain allowed access.
++##
++##
++##
++##
++## The role to be allowed to manage the audit domain.
++##
++##
++##
++##
++## The type of the terminal allow the audit domain to use.
++##
++##
++##
++#
++interface(`logging_audit_admin',`
++
++ gen_require(`
++ type auditd_t;
++ type audit_script_exec_t;
++ type auditd_etc_t;
++ type auditd_log_t;
++ type auditd_var_run_t;
++ ')
++
++ allow $1 auditd_t:process { ptrace signal_perms };
++ # Allow $1 to restart the apache service
++ audit_script_domtrans($1)
++ domain_role_change_exemption($1)
++ domain_system_change_exemption($1)
++ domain_obj_id_change_exemption($1)
++ role_transition $2 audit_script_exec_t system_r;
++ allow $2 system_r;
++
++ manage_dir_perms($1,auditd_etc_t,auditd_etc_t)
++ manage_file_perms($1,auditd_etc_t,auditd_etc_t)
++
++ manage_dir_perms($1,auditd_log_t,auditd_log_t)
++ manage_file_perms($1,auditd_log_t,auditd_log_t)
++
++ manage_dir_perms($1,auditd_var_run_t,auditd_var_run_t)
++ manage_file_perms($1,auditd_var_run_t,auditd_var_run_t)
++')
++
++########################################
++##
++## All of the rules required to administrate an audit environment
++##
++##
++##
++## Domain allowed access.
++##
++##
++##
++##
++## The role to be allowed to manage the audit domain.
++##
++##
++##
++##
++## The type of the terminal allow the audit domain to use.
++##
++##
++##
++#
++interface(`logging_syslog_admin',`
++
++ gen_require(`
++ type syslogd_t;
++ type syslog_script_exec_t;
++ type syslogd_conf_t;
++ type syslogd_tmp_t;
++ type syslogd_var_lib_t;
++ type syslogd_var_run_t;
++ type klogd_var_run_t;
++ type klogd_tmp_t;
++ type var_log_t;
++ ')
++
++ allow $1 syslogd_t:process { ptrace signal_perms };
++ allow $1 klogd_t:process { ptrace signal_perms };
++
++ # Allow $1 to restart the apache service
++ syslog_script_domtrans($1)
++ domain_role_change_exemption($1)
++ domain_system_change_exemption($1)
++ domain_obj_id_change_exemption($1)
++ role_transition $2 syslog_script_exec_t system_r;
++ allow $2 system_r;
++
++ manage_dir_perms($1,klogd_var_run_t,klogd_var_run_t)
++ manage_file_perms($1,klogd_var_run_t,klogd_var_run_t)
++
++ manage_dir_perms($1,klogd_tmp_t,klogd_tmp_t)
++ manage_file_perms($1,klogd_tmp_t,klogd_tmp_t)
++
++ manage_dir_perms($1,syslogd_tmp_t,syslogd_tmp_t)
++ manage_file_perms($1,syslogd_tmp_t,syslogd_tmp_t)
++
++ manage_dir_perms($1,syslogd_conf_t,syslogd_conf_t)
++ manage_file_perms($1,syslogd_conf_t,syslogd_conf_t)
++
++ manage_dir_perms($1,syslogd_var_lib_t,syslogd_var_lib_t)
++ manage_file_perms($1,syslogd_var_lib_t,syslogd_var_lib_t)
++
++ manage_dir_perms($1,syslogd_var_run_t,syslogd_var_run_t)
++ manage_file_perms($1,syslogd_var_run_t,syslogd_var_run_t)
++
++ logging_manage_all_logs($1)
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.7/policy/modules/system/logging.te
--- nsaserefpolicy/policy/modules/system/logging.te 2007-08-22 07:14:11.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/logging.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/logging.te 2007-08-31 06:44:53.000000000 -0400
@@ -7,6 +7,10 @@
#
@@ -10393,7 +11129,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
type syslogd_var_run_t;
files_pid_file(syslogd_var_run_t)
-@@ -59,19 +69,25 @@
+@@ -55,23 +65,35 @@
+ logging_log_file(var_log_t)
+ files_mountpoint(var_log_t)
+
++type auditd_script_exec_t;
++init_script_type(auditd_script_exec_t)
++
++type syslogd_script_exec_t;
++init_script_type(syslogd_script_exec_t)
++
+ ifdef(`enable_mls',`
init_ranged_daemon_domain(auditd_t,auditd_exec_t,mls_systemhigh)
')
@@ -10422,7 +11168,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
files_read_etc_files(auditctl_t)
kernel_read_kernel_sysctls(auditctl_t)
-@@ -91,6 +107,7 @@
+@@ -91,6 +113,7 @@
locallogin_dontaudit_use_fds(auditctl_t)
@@ -10430,7 +11176,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
logging_send_syslog_msg(auditctl_t)
########################################
-@@ -98,12 +115,11 @@
+@@ -98,12 +121,11 @@
# Auditd local policy
#
@@ -10444,7 +11190,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
allow auditd_t self:fifo_file rw_file_perms;
allow auditd_t auditd_etc_t:dir list_dir_perms;
-@@ -141,6 +157,7 @@
+@@ -141,6 +163,7 @@
init_telinit(auditd_t)
@@ -10452,7 +11198,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
logging_send_syslog_msg(auditd_t)
libs_use_ld_so(auditd_t)
-@@ -242,12 +259,18 @@
+@@ -242,12 +265,18 @@
allow syslogd_t self:udp_socket create_socket_perms;
allow syslogd_t self:tcp_socket create_stream_socket_perms;
@@ -10471,7 +11217,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
# Allow access for syslog-ng
allow syslogd_t var_log_t:dir { create setattr };
-@@ -256,6 +279,9 @@
+@@ -256,6 +285,9 @@
manage_files_pattern(syslogd_t,syslogd_tmp_t,syslogd_tmp_t)
files_tmp_filetrans(syslogd_t,syslogd_tmp_t,{ dir file })
@@ -10481,7 +11227,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
allow syslogd_t syslogd_var_run_t:file manage_file_perms;
files_pid_filetrans(syslogd_t,syslogd_var_run_t,file)
-@@ -313,6 +339,7 @@
+@@ -313,6 +345,7 @@
domain_use_interactive_fds(syslogd_t)
files_read_etc_files(syslogd_t)
@@ -10489,9 +11235,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
files_read_etc_runtime_files(syslogd_t)
# /initrd is not umounted before minilog starts
files_dontaudit_search_isid_type_dirs(syslogd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.6/policy/modules/system/lvm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.7/policy/modules/system/lvm.fc
--- nsaserefpolicy/policy/modules/system/lvm.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/lvm.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/lvm.fc 2007-08-28 15:53:40.000000000 -0400
@@ -15,6 +15,7 @@
#
/etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0)
@@ -10500,9 +11246,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc
/etc/lvm/archive(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0)
/etc/lvm/backup(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0)
/etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.6/policy/modules/system/lvm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.7/policy/modules/system/lvm.te
--- nsaserefpolicy/policy/modules/system/lvm.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/lvm.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/lvm.te 2007-08-28 15:53:40.000000000 -0400
@@ -150,7 +150,9 @@
# DAC overrides and mknod for modifying /dev entries (vgmknodes)
@@ -10547,9 +11293,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
+ xen_dontaudit_rw_unix_stream_sockets(lvm_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.0.6/policy/modules/system/miscfiles.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.0.7/policy/modules/system/miscfiles.fc
--- nsaserefpolicy/policy/modules/system/miscfiles.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/miscfiles.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/miscfiles.fc 2007-08-28 15:53:40.000000000 -0400
@@ -66,6 +66,7 @@
/var/lib/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0)
@@ -10558,9 +11304,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi
/var/cache/man(/.*)? gen_context(system_u:object_r:man_t,s0)
/var/spool/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.6/policy/modules/system/modutils.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.7/policy/modules/system/modutils.te
--- nsaserefpolicy/policy/modules/system/modutils.te 2007-08-22 07:14:12.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/modutils.te 2007-08-24 16:32:27.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/modutils.te 2007-09-04 11:46:50.000000000 -0400
@@ -42,7 +42,7 @@
# insmod local policy
#
@@ -10597,11 +11343,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
libs_use_ld_so(insmod_t)
libs_use_shared_libs(insmod_t)
-@@ -112,11 +112,25 @@
+@@ -112,11 +112,27 @@
seutil_read_file_contexts(insmod_t)
+term_dontaudit_use_unallocated_ttys(insmod_t)
++userdom_dontaudit_search_users_home_dirs(insmod_t)
++userdom_dontaudit_search_sysadm_home_dirs(insmod_t)
+
if( ! secure_mode_insmod ) {
kernel_domtrans_to(insmod_t,insmod_exec_t)
@@ -10623,7 +11371,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
hotplug_search_config(insmod_t)
')
-@@ -149,10 +163,12 @@
+@@ -149,10 +165,12 @@
optional_policy(`
rpm_rw_pipes(insmod_t)
@@ -10636,7 +11384,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
')
optional_policy(`
-@@ -179,6 +195,7 @@
+@@ -179,6 +197,7 @@
files_read_kernel_symbol_table(depmod_t)
files_read_kernel_modules(depmod_t)
@@ -10644,7 +11392,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
fs_getattr_xattr_fs(depmod_t)
-@@ -205,9 +222,12 @@
+@@ -205,9 +224,12 @@
userdom_read_staff_home_content_files(depmod_t)
userdom_read_sysadm_home_content_files(depmod_t)
@@ -10657,17 +11405,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.6/policy/modules/system/mount.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.7/policy/modules/system/mount.fc
--- nsaserefpolicy/policy/modules/system/mount.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/mount.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/mount.fc 2007-08-28 15:53:40.000000000 -0400
@@ -1,4 +1,2 @@
/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
-
-/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.6/policy/modules/system/mount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.7/policy/modules/system/mount.te
--- nsaserefpolicy/policy/modules/system/mount.te 2007-08-22 07:14:13.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/mount.te 2007-08-24 16:33:07.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/mount.te 2007-09-04 09:53:38.000000000 -0400
@@ -8,6 +8,13 @@
##
@@ -10704,7 +11452,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
########################################
#
-@@ -36,14 +44,15 @@
+@@ -36,21 +44,22 @@
#
# setuid/setgid needed to mount cifs
@@ -10716,13 +11464,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
allow mount_t mount_tmp_t:file manage_file_perms;
allow mount_t mount_tmp_t:dir manage_dir_perms;
++files_tmp_filetrans(mount_t,mount_tmp_t,{ file dir })
+-can_exec(mount_t, mount_exec_t)
+auth_use_nsswitch(mount_t)
-+
- can_exec(mount_t, mount_exec_t)
- files_tmp_filetrans(mount_t,mount_tmp_t,{ file dir })
-@@ -51,6 +60,7 @@
+-files_tmp_filetrans(mount_t,mount_tmp_t,{ file dir })
++can_exec(mount_t, mount_exec_t)
+
kernel_read_system_state(mount_t)
kernel_read_kernel_sysctls(mount_t)
kernel_dontaudit_getattr_core_if(mount_t)
@@ -10730,7 +11479,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
dev_getattr_all_blk_files(mount_t)
dev_list_all_dev_nodes(mount_t)
-@@ -101,6 +111,8 @@
+@@ -101,6 +110,8 @@
init_use_fds(mount_t)
init_use_script_ptys(mount_t)
init_dontaudit_getattr_initctl(mount_t)
@@ -10739,7 +11488,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
libs_use_ld_so(mount_t)
libs_use_shared_libs(mount_t)
-@@ -127,10 +139,15 @@
+@@ -127,10 +138,15 @@
')
')
@@ -10756,7 +11505,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
')
optional_policy(`
-@@ -159,13 +176,8 @@
+@@ -159,13 +175,8 @@
fs_search_rpc(mount_t)
@@ -10770,7 +11519,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
')
optional_policy(`
-@@ -189,10 +201,6 @@
+@@ -189,10 +200,6 @@
samba_domtrans_smbmount(mount_t)
')
@@ -10781,7 +11530,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
########################################
#
# Unconfined mount local policy
-@@ -201,4 +209,29 @@
+@@ -201,4 +208,29 @@
optional_policy(`
files_etc_filetrans_etc_runtime(unconfined_mount_t,file)
unconfined_domain(unconfined_mount_t)
@@ -10811,9 +11560,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
+ hal_rw_pipes(mount_t)
')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-3.0.6/policy/modules/system/netlabel.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-3.0.7/policy/modules/system/netlabel.te
--- nsaserefpolicy/policy/modules/system/netlabel.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/netlabel.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/netlabel.te 2007-08-28 15:53:40.000000000 -0400
@@ -19,6 +19,8 @@
allow netlabel_mgmt_t self:capability net_admin;
allow netlabel_mgmt_t self:netlink_socket create_socket_perms;
@@ -10823,9 +11572,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlab
kernel_read_network_state(netlabel_mgmt_t)
libs_use_ld_so(netlabel_mgmt_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.6/policy/modules/system/raid.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.7/policy/modules/system/raid.te
--- nsaserefpolicy/policy/modules/system/raid.te 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/raid.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/raid.te 2007-08-28 15:53:40.000000000 -0400
@@ -19,7 +19,7 @@
# Local policy
#
@@ -10843,9 +11592,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t
mta_send_mail(mdadm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.6/policy/modules/system/selinuxutil.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.7/policy/modules/system/selinuxutil.fc
--- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/selinuxutil.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/selinuxutil.fc 2007-08-28 15:53:40.000000000 -0400
@@ -38,8 +38,9 @@
/usr/sbin/restorecond -- gen_context(system_u:object_r:restorecond_exec_t,s0)
/usr/sbin/run_init -- gen_context(system_u:object_r:run_init_exec_t,s0)
@@ -10857,9 +11606,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
/usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0)
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.6/policy/modules/system/selinuxutil.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.7/policy/modules/system/selinuxutil.if
--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/selinuxutil.if 2007-08-22 08:04:43.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/selinuxutil.if 2007-09-04 16:32:15.000000000 -0400
@@ -432,6 +432,7 @@
role $2 types run_init_t;
allow run_init_t $3:chr_file rw_term_perms;
@@ -11093,9 +11842,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
+seutil_manage_default_contexts($1)
+
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.6/policy/modules/system/selinuxutil.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.7/policy/modules/system/selinuxutil.te
--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-08-22 07:14:13.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/selinuxutil.te 2007-08-28 11:34:21.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/selinuxutil.te 2007-08-28 15:53:40.000000000 -0400
@@ -1,5 +1,5 @@
-policy_module(selinuxutil,1.6.2)
@@ -11267,9 +12016,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
udev_dontaudit_rw_dgram_sockets(setfiles_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.6/policy/modules/system/sysnetwork.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.7/policy/modules/system/sysnetwork.if
--- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/sysnetwork.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/sysnetwork.if 2007-08-28 15:53:40.000000000 -0400
@@ -522,6 +522,8 @@
files_search_etc($1)
@@ -11279,9 +12028,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.6/policy/modules/system/sysnetwork.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.7/policy/modules/system/sysnetwork.te
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/sysnetwork.te 2007-08-22 08:36:35.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/sysnetwork.te 2007-09-04 11:49:28.000000000 -0400
@@ -45,7 +45,7 @@
dontaudit dhcpc_t self:capability sys_tty_config;
# for access("/etc/bashrc", X_OK) on Red Hat
@@ -11302,20 +12051,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
optional_policy(`
networkmanager_dbus_chat(dhcpc_t)
')
-@@ -205,7 +209,12 @@
+@@ -203,9 +207,7 @@
+ ')
+
optional_policy(`
- # dhclient sometimes starts ntpd
- init_exec_script_files(dhcpc_t)
-+')
-+
-+optional_policy(`
- ntp_domtrans(dhcpc_t)
-+ ntp_domtrans_ntpdate(dhcpc_t)
+- # dhclient sometimes starts ntpd
+- init_exec_script_files(dhcpc_t)
+- ntp_domtrans(dhcpc_t)
+ ntp_script_domtrans(dhcpc_t)
')
optional_policy(`
-@@ -216,6 +225,7 @@
+@@ -216,6 +218,7 @@
optional_policy(`
seutil_sigchld_newrole(dhcpc_t)
seutil_dontaudit_search_config(dhcpc_t)
@@ -11323,7 +12070,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
')
optional_policy(`
-@@ -254,6 +264,7 @@
+@@ -254,6 +257,7 @@
allow ifconfig_t self:sem create_sem_perms;
allow ifconfig_t self:msgq create_msgq_perms;
allow ifconfig_t self:msg { send receive };
@@ -11331,7 +12078,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
# Create UDP sockets, necessary when called from dhcpc
allow ifconfig_t self:udp_socket create_socket_perms;
-@@ -280,6 +291,8 @@
+@@ -280,6 +284,8 @@
fs_getattr_xattr_fs(ifconfig_t)
fs_search_auto_mountpoints(ifconfig_t)
@@ -11340,9 +12087,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
term_dontaudit_use_all_user_ttys(ifconfig_t)
term_dontaudit_use_all_user_ptys(ifconfig_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.6/policy/modules/system/udev.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.7/policy/modules/system/udev.te
--- nsaserefpolicy/policy/modules/system/udev.te 2007-08-22 07:14:12.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/udev.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/udev.te 2007-08-31 06:47:15.000000000 -0400
@@ -68,8 +68,9 @@
allow udev_t udev_tbl_t:file manage_file_perms;
dev_filetrans(udev_t,udev_tbl_t,file)
@@ -11442,9 +12189,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.6/policy/modules/system/unconfined.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.7/policy/modules/system/unconfined.if
--- nsaserefpolicy/policy/modules/system/unconfined.if 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/unconfined.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/unconfined.if 2007-08-28 15:53:40.000000000 -0400
@@ -12,14 +12,13 @@
#
interface(`unconfined_domain_noaudit',`
@@ -11629,9 +12376,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
+ dontaudit $1 unconfined_terminal:chr_file rw_term_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.6/policy/modules/system/unconfined.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.7/policy/modules/system/unconfined.te
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/unconfined.te 2007-08-24 10:16:34.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/unconfined.te 2007-08-29 06:26:57.000000000 -0400
@@ -5,28 +5,36 @@
#
# Declarations
@@ -11782,18 +12529,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
')
optional_policy(`
-@@ -180,10 +168,6 @@
+@@ -180,9 +168,10 @@
')
optional_policy(`
- spamassassin_per_role_template(unconfined,unconfined_t,unconfined_r)
--')
--
--optional_policy(`
++ sendmail_run(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
+ ')
+
++
+ optional_policy(`
sysnet_run_dhcpc(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
sysnet_dbus_chat_dhcpc(unconfined_t)
- ')
-@@ -205,11 +189,12 @@
+@@ -205,11 +194,12 @@
')
optional_policy(`
@@ -11808,7 +12556,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
')
########################################
-@@ -227,6 +212,17 @@
+@@ -227,6 +217,17 @@
unconfined_dbus_chat(unconfined_execmem_t)
optional_policy(`
@@ -11826,18 +12574,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
')
+
+corecmd_exec_all_executables(unconfined_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.0.6/policy/modules/system/userdomain.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.0.7/policy/modules/system/userdomain.fc
--- nsaserefpolicy/policy/modules/system/userdomain.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/userdomain.fc 2007-08-28 11:11:29.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/userdomain.fc 2007-08-28 15:53:40.000000000 -0400
@@ -1,4 +1,5 @@
HOME_DIR -d gen_context(system_u:object_r:ROLE_home_dir_t,s0-mls_systemhigh)
+HOME_DIR -l gen_context(system_u:object_r:ROLE_home_dir_t,s0-mls_systemhigh)
HOME_DIR/.+ gen_context(system_u:object_r:ROLE_home_t,s0)
/tmp/gconfd-USER -d gen_context(system_u:object_r:ROLE_tmp_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.6/policy/modules/system/userdomain.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.7/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-08-27 09:18:17.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/userdomain.if 2007-08-28 11:17:43.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/userdomain.if 2007-09-04 16:56:00.000000000 -0400
@@ -62,6 +62,10 @@
allow $1_t $1_tty_device_t:chr_file { setattr rw_chr_file_perms };
@@ -12498,32 +13246,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
-@@ -1817,27 +1900,62 @@
+@@ -1852,21 +1935,57 @@
##
- ##
+ ##
##
--## Domain to transition to.
-+## Domain to transition to.
+-## Domain to not audit
++## Domain to not audit
+##
+##
+#
-+template(`userdom_user_home_domtrans',`
++template(`userdom_dontaudit_list_user_home_dirs',`
+ gen_require(`
-+ type $1_home_dir_t, $1_home_t;
++ type $1_home_dir_t;
+ ')
+
-+ files_search_home($2)
-+ allow $2 $1_home_dir_t:dir search_dir_perms;
-+ domain_auto_trans($2,$1_home_t,$3)
++ dontaudit $2 $1_home_dir_t:dir list_dir_perms;
+')
+
+########################################
+##
-+## Do not audit attempts to list user home subdirectories.
++## Create, read, write, and delete directories
++## in a user home subdirectory.
+##
+##
+##
-+## Do not audit attempts to list user home subdirectories.
++## Create, read, write, and delete directories
++## in a user home subdirectory.
+##
+##
+## This is a templated interface, and should only
@@ -12538,42 +13286,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+##
+##
+##
-+## Domain to not audit
- ##
- ##
- #
--template(`userdom_user_home_domtrans',`
-+template(`userdom_dontaudit_list_user_home_dirs',`
- gen_require(`
-- type $1_home_dir_t, $1_home_t;
-+ type $1_home_dir_t;
- ')
-
-- files_search_home($2)
-- allow $2 $1_home_dir_t:dir search_dir_perms;
-- domain_auto_trans($2,$1_home_t,$3)
-+ dontaudit $2 $1_home_dir_t:dir list_dir_perms;
- ')
-
- ########################################
- ##
--## Do not audit attempts to list user home subdirectories.
-+## Create, read, write, and delete directories
-+## in a user home subdirectory.
- ##
- ##
- ##
--## Do not audit attempts to list user home subdirectories.
-+## Create, read, write, and delete directories
-+## in a user home subdirectory.
- ##
- ##
- ## This is a templated interface, and should only
-@@ -1852,21 +1970,22 @@
- ##
- ##
- ##
--## Domain to not audit
+## Domain allowed access.
##
##
@@ -12657,7 +13369,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -5559,3 +5695,280 @@
+@@ -5559,3 +5695,297 @@
interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.')
')
@@ -12802,6 +13514,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ allow $1 user_home_type:file unlink;
+')
+
++########################################
++##
++## dontaudit search all users home directory
++## files.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`userdom_dontaudit_search_users_home_dirs',`
++
++ gen_require(`
++ attribute user_home_dir_type;
++ ')
++
++ files_search_home($1)
++ dontaudit $1 user_home_dir_type:dir search_dir_perms;
++')
++
+#######################################
+##
+## The template for creating a unprivileged xwindows login user.
@@ -12865,10 +13598,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+')
+
+optional_policy(`
-+ ssh_per_role_template($1, $1_t, $1_r)
-+')
-+
-+optional_policy(`
+ setroubleshoot_dontaudit_stream_connect($1_t)
+')
+
@@ -12938,9 +13667,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ files_search_home($1)
+ allow $1 user_home_type:file execute;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.6/policy/modules/system/userdomain.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.7/policy/modules/system/userdomain.te
--- nsaserefpolicy/policy/modules/system/userdomain.te 2007-08-22 07:14:11.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/userdomain.te 2007-08-27 17:33:50.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/userdomain.te 2007-09-05 13:26:43.000000000 -0400
@@ -74,6 +74,9 @@
# users home directory contents
attribute home_type;
@@ -13047,14 +13776,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+tunable_policy(`allow_console_login', `
+ term_use_console(userdomain)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.fc serefpolicy-3.0.6/policy/modules/system/virt.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.fc serefpolicy-3.0.7/policy/modules/system/virt.fc
--- nsaserefpolicy/policy/modules/system/virt.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/system/virt.fc 2007-08-27 10:52:37.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/virt.fc 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1 @@
+/var/lib/libvirt(/.*)? gen_context(system_u:object_r:virt_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.0.6/policy/modules/system/virt.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.0.7/policy/modules/system/virt.if
--- nsaserefpolicy/policy/modules/system/virt.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/system/virt.if 2007-08-27 10:53:48.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/virt.if 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,58 @@
+## Virtualization
+
@@ -13114,16 +13843,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.i
+ files_list_var_lib($1)
+ rw_files_pattern($1,virt_var_lib_t,virt_var_lib_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.0.6/policy/modules/system/virt.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.0.7/policy/modules/system/virt.te
--- nsaserefpolicy/policy/modules/system/virt.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/system/virt.te 2007-08-27 10:52:32.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/virt.te 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,3 @@
+# var/lib files
+type virt_var_lib_t;
+files_type(virt_var_lib_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.6/policy/modules/system/xen.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.7/policy/modules/system/xen.if
--- nsaserefpolicy/policy/modules/system/xen.if 2007-07-03 07:06:32.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/xen.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/xen.if 2007-08-28 15:53:40.000000000 -0400
@@ -191,3 +191,24 @@
domtrans_pattern($1,xm_exec_t,xm_t)
@@ -13149,9 +13878,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if
+ allow $1 xend_var_lib_t:dir search_dir_perms;
+ rw_files_pattern($1,xen_image_t,xen_image_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.6/policy/modules/system/xen.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.7/policy/modules/system/xen.te
--- nsaserefpolicy/policy/modules/system/xen.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/xen.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/system/xen.te 2007-08-28 15:53:40.000000000 -0400
@@ -176,6 +176,7 @@
files_manage_etc_runtime_files(xend_t)
files_etc_filetrans_etc_runtime(xend_t,file)
@@ -13209,19 +13938,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
+ fs_manage_nfs_files(xend_t)
+ fs_read_nfs_symlinks(xend_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.6/policy/modules/users/guest.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.7/policy/modules/users/guest.fc
--- nsaserefpolicy/policy/modules/users/guest.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/users/guest.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/users/guest.fc 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1 @@
+# No guest file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.6/policy/modules/users/guest.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.7/policy/modules/users/guest.if
--- nsaserefpolicy/policy/modules/users/guest.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/users/guest.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/users/guest.if 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1 @@
+## Policy for guest user
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.6/policy/modules/users/guest.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.7/policy/modules/users/guest.te
--- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/users/guest.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/users/guest.te 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,9 @@
+policy_module(guest,1.0.0)
+userdom_unpriv_login_user(guest)
@@ -13232,19 +13961,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.t
+optional_policy(`
+ hal_dbus_chat(xguest_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.6/policy/modules/users/logadm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.7/policy/modules/users/logadm.fc
--- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/users/logadm.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/users/logadm.fc 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1 @@
+# No logadm file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.6/policy/modules/users/logadm.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.7/policy/modules/users/logadm.if
--- nsaserefpolicy/policy/modules/users/logadm.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/users/logadm.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/users/logadm.if 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1 @@
+## Policy for logadm user
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.6/policy/modules/users/logadm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.7/policy/modules/users/logadm.te
--- nsaserefpolicy/policy/modules/users/logadm.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/users/logadm.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/users/logadm.te 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1,33 @@
+policy_module(logadm,1.0.0)
+
@@ -13279,25 +14008,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.
+
+files_dontaudit_search_all_dirs(logadm_t)
+files_dontaudit_getattr_all_files(logadm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.6/policy/modules/users/metadata.xml
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.7/policy/modules/users/metadata.xml
--- nsaserefpolicy/policy/modules/users/metadata.xml 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/users/metadata.xml 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/users/metadata.xml 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1 @@
+Policy modules for users
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.6/policy/modules/users/webadm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.7/policy/modules/users/webadm.fc
--- nsaserefpolicy/policy/modules/users/webadm.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/users/webadm.fc 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/users/webadm.fc 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1 @@
+# No webadm file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.6/policy/modules/users/webadm.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.7/policy/modules/users/webadm.if
--- nsaserefpolicy/policy/modules/users/webadm.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/users/webadm.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/modules/users/webadm.if 2007-08-28 15:53:40.000000000 -0400
@@ -0,0 +1 @@
+## Policy for webadm user
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.6/policy/modules/users/webadm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.7/policy/modules/users/webadm.te
--- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.6/policy/modules/users/webadm.te 2007-08-22 08:03:53.000000000 -0400
-@@ -0,0 +1,70 @@
++++ serefpolicy-3.0.7/policy/modules/users/webadm.te 2007-08-31 15:27:24.000000000 -0400
+@@ -0,0 +1,42 @@
+policy_module(webadm,1.0.0)
+
+########################################
@@ -13308,69 +14037,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.
+userdom_base_user_template(webadm)
+allow webadm_t self:capability { dac_override dac_read_search kill sys_ptrace sys_nice };
+
-+# Allow webadm_t to restart the apache service
-+domain_dontaudit_search_all_domains_state(webadm_t)
-+apache_domtrans(webadm_t)
-+init_exec_script_files(webadm_t)
-+domain_role_change_exemption(webadm_t)
-+domain_obj_id_change_exemption(webadm_t)
-+role_transition webadm_r httpd_exec_t system_r;
-+allow webadm_r system_r;
-+
-+apache_manage_all_content(webadm_t)
-+apache_manage_config(webadm_t)
-+apache_manage_log(webadm_t)
-+apache_manage_modules(webadm_t)
-+apache_manage_lock(webadm_t)
-+apache_manage_pid(webadm_t)
-+apache_read_state(webadm_t)
-+apache_signal(webadm_t)
-+apache_getattr(webadm_t)
-+apache_relabel(webadm_t)
++bool webadm_read_user_files false;
++bool webadm_manage_user_files false;
+
-+seutil_domtrans_restorecon(webadm_t)
++if (webadm_read_user_files) {
++ userdom_read_unpriv_users_home_content_files(webadm_t)
++ userdom_read_unpriv_users_tmp_files(webadm_t)
++}
++
++if (webadm_manage_user_files) {
++ userdom_manage_unpriv_users_home_content_dirs(webadm_t)
++ userdom_read_unpriv_users_tmp_files(webadm_t)
++ userdom_write_unpriv_users_tmp_files(webadm_t)
++}
+
+files_dontaudit_search_all_dirs(webadm_t)
-+files_dontaudit_getattr_all_files(webadm_t)
+files_manage_generic_locks(webadm_t)
+files_list_var(webadm_t)
+selinux_get_enforce_mode(webadm_t)
-+
++seutil_domtrans_restorecon(webadm_t)
+
+logging_send_syslog_msg(webadm_t)
+
-+ifdef(`targeted_policy',`
-+ term_use_generic_ptys(webadm_t)
-+ term_use_unallocated_ttys(webadm_t)
-+')
-+
+userdom_dontaudit_search_sysadm_home_dirs(webadm_t)
+userdom_dontaudit_search_generic_user_home_dirs(webadm_t)
+
-+bool webadm_read_user_files false;
-+bool webadm_manage_user_files false;
-+
-+if (webadm_read_user_files) {
-+ userdom_read_unpriv_users_home_content_files(webadm_t)
-+ userdom_read_unpriv_users_tmp_files(webadm_t)
-+}
-+
-+if (webadm_manage_user_files) {
-+ userdom_manage_unpriv_users_home_content_dirs(webadm_t)
-+ userdom_read_unpriv_users_tmp_files(webadm_t)
-+ userdom_write_unpriv_users_tmp_files(webadm_t)
-+}
++apache_admin(webadm_t, webadm_r, { webadm_tty_device_t webadm_devpts_t })
+
+gen_require(`
+ type gadmin_t;
+')
+allow gadmin_t webadm_t:process transition;
+allow webadm_t gadmin_t:dir getattr;
-+
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.6/policy/support/obj_perm_sets.spt
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.7/policy/support/obj_perm_sets.spt
--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-08-22 07:14:18.000000000 -0400
-+++ serefpolicy-3.0.6/policy/support/obj_perm_sets.spt 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/support/obj_perm_sets.spt 2007-08-28 15:53:40.000000000 -0400
@@ -216,7 +216,7 @@
define(`getattr_file_perms',`{ getattr }')
define(`setattr_file_perms',`{ setattr }')
@@ -13394,9 +14095,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
+define(`all_association', `{ sendto recvfrom setcontext polmatch } ')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.6/policy/users
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.7/policy/users
--- nsaserefpolicy/policy/users 2007-07-17 14:52:27.000000000 -0400
-+++ serefpolicy-3.0.6/policy/users 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/policy/users 2007-08-28 15:53:40.000000000 -0400
@@ -16,7 +16,7 @@
# and a user process should never be assigned the system user
# identity.
@@ -13431,9 +14132,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0
- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
-')
+gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.6/Rules.modular
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.7/Rules.modular
--- nsaserefpolicy/Rules.modular 2007-05-25 09:09:10.000000000 -0400
-+++ serefpolicy-3.0.6/Rules.modular 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.7/Rules.modular 2007-08-28 15:53:40.000000000 -0400
@@ -219,6 +219,16 @@
########################################
diff --git a/selinux-policy.spec b/selinux-policy.spec
index a5247a9..58e300a 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.0.7
-Release: 2%{?dist}
+Release: 3%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -162,7 +162,7 @@ FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
selinuxenabled; \
if [ $? == 0 -a "${SELINUXTYPE}" == %1 -a -f ${FILE_CONTEXT}.pre ]; then \
fixfiles -C ${FILE_CONTEXT}.pre restore; \
- restorecon -R /var/log 2> /dev/null; \
+ restorecon -R /var/log /var/run 2> /dev/null; \
rm -f ${FILE_CONTEXT}.pre; \
fi;
@@ -362,6 +362,9 @@ exit 0
%endif
%changelog
+* Tue Aug 28 2007 Dan Walsh 3.0.7-3
+- Allow sendmail to create etc_aliases_t
+
* Tue Aug 28 2007 Dan Walsh 3.0.7-2
- Allow login programs to read symlinks on homedirs