diff --git a/.cvsignore b/.cvsignore
index 03c8f64d..50a7c15f 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -117,3 +117,4 @@ serefpolicy-2.6.1.tgz
serefpolicy-2.6.2.tgz
serefpolicy-2.6.3.tgz
serefpolicy-2.6.4.tgz
+serefpolicy-2.6.5.tgz
diff --git a/modules-targeted.conf b/modules-targeted.conf
index a17d64da..32106a60 100644
--- a/modules-targeted.conf
+++ b/modules-targeted.conf
@@ -1456,3 +1456,10 @@ aide = base
#
w3c = module
+# Layer: services
+# Module: rpcbind
+#
+# universal addresses to RPC program number mapper
+#
+rpcbind = module
+
diff --git a/policy-20070501.patch b/policy-20070518.patch
similarity index 86%
rename from policy-20070501.patch
rename to policy-20070518.patch
index 123f5cd6..b9e43e2a 100644
--- a/policy-20070501.patch
+++ b/policy-20070518.patch
@@ -1,6 +1,6 @@
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-2.6.4/man/man8/ftpd_selinux.8
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-2.6.5/man/man8/ftpd_selinux.8
--- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-04-02 10:58:34.000000000 -0400
-+++ serefpolicy-2.6.4/man/man8/ftpd_selinux.8 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/man/man8/ftpd_selinux.8 2007-05-18 11:59:15.000000000 -0400
@@ -12,7 +12,7 @@
.TP
chcon -R -t public_content_t /var/ftp
@@ -10,9 +10,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 sere
.TP
chcon -t public_content_rw_t /var/ftp/incoming
.TP
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-2.6.4/policy/flask/access_vectors
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-2.6.5/policy/flask/access_vectors
--- nsaserefpolicy/policy/flask/access_vectors 2007-02-26 09:43:33.000000000 -0500
-+++ serefpolicy-2.6.4/policy/flask/access_vectors 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/flask/access_vectors 2007-05-18 11:59:15.000000000 -0400
@@ -598,6 +598,8 @@
shmempwd
shmemgrp
@@ -31,9 +31,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors
}
class key
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans serefpolicy-2.6.4/policy/global_booleans
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans serefpolicy-2.6.5/policy/global_booleans
--- nsaserefpolicy/policy/global_booleans 2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.4/policy/global_booleans 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/global_booleans 2007-05-18 11:59:15.000000000 -0400
@@ -4,7 +4,6 @@
# file should be used.
#
@@ -50,9 +50,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans seref
##
##
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-2.6.4/policy/global_tunables
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-2.6.5/policy/global_tunables
--- nsaserefpolicy/policy/global_tunables 2007-03-26 16:24:14.000000000 -0400
-+++ serefpolicy-2.6.4/policy/global_tunables 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/global_tunables 2007-05-18 11:59:15.000000000 -0400
@@ -102,12 +102,6 @@
##
gen_tunable(use_samba_home_dirs,false)
@@ -79,9 +79,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref
+##
+gen_tunable(allow_console_login,false)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.4/policy/mls
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.5/policy/mls
--- nsaserefpolicy/policy/mls 2007-03-09 13:02:20.000000000 -0500
-+++ serefpolicy-2.6.4/policy/mls 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/mls 2007-05-18 11:59:15.000000000 -0400
@@ -89,12 +89,14 @@
mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton }
(( l1 eq l2 ) or
@@ -153,9 +153,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.4
( t2 == unlabeled_t ));
mlsconstrain association { polmatch }
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-2.6.4/policy/modules/admin/acct.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-2.6.5/policy/modules/admin/acct.te
--- nsaserefpolicy/policy/modules/admin/acct.te 2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/admin/acct.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/acct.te 2007-05-18 11:59:15.000000000 -0400
@@ -9,6 +9,7 @@
type acct_t;
type acct_exec_t;
@@ -164,9 +164,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te
type acct_data_t;
logging_log_file(acct_data_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-2.6.4/policy/modules/admin/alsa.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-2.6.5/policy/modules/admin/alsa.fc
--- nsaserefpolicy/policy/modules/admin/alsa.fc 2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/admin/alsa.fc 2007-05-17 12:16:25.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/alsa.fc 2007-05-18 11:59:15.000000000 -0400
@@ -1,4 +1,7 @@
/etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)
@@ -175,9 +175,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc
/usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0)
+/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-2.6.4/policy/modules/admin/alsa.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-2.6.5/policy/modules/admin/alsa.te
--- nsaserefpolicy/policy/modules/admin/alsa.te 2007-01-02 12:57:51.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/admin/alsa.te 2007-05-17 11:22:07.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/alsa.te 2007-05-18 11:59:15.000000000 -0400
@@ -20,20 +20,23 @@
# Local policy
#
@@ -223,16 +223,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te
+ hal_write_log(alsa_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.fc serefpolicy-2.6.4/policy/modules/admin/amtu.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.fc serefpolicy-2.6.5/policy/modules/admin/amtu.fc
--- nsaserefpolicy/policy/modules/admin/amtu.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/admin/amtu.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/amtu.fc 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1,3 @@
+
+/usr/bin/amtu -- gen_context(system_u:object_r:amtu_exec_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if serefpolicy-2.6.4/policy/modules/admin/amtu.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if serefpolicy-2.6.5/policy/modules/admin/amtu.if
--- nsaserefpolicy/policy/modules/admin/amtu.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/admin/amtu.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/amtu.if 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1,53 @@
+##
+## abstract Machine Test Utility
@@ -287,9 +287,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if
+ role $2 types amtu_t;
+ allow amtu_t $3:chr_file rw_term_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te serefpolicy-2.6.4/policy/modules/admin/amtu.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te serefpolicy-2.6.5/policy/modules/admin/amtu.te
--- nsaserefpolicy/policy/modules/admin/amtu.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/admin/amtu.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/amtu.te 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1,57 @@
+policy_module(amtu,1.0.23)
+
@@ -348,9 +348,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te
+ term_dontaudit_search_ptys(amtu_t)
+');
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-2.6.4/policy/modules/admin/bootloader.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-2.6.5/policy/modules/admin/bootloader.te
--- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/admin/bootloader.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/bootloader.te 2007-05-18 11:59:15.000000000 -0400
@@ -65,6 +65,8 @@
files_tmp_filetrans(bootloader_t,bootloader_tmp_t,{ dir file lnk_file chr_file blk_file })
# for tune2fs (cjp: ?)
@@ -368,9 +368,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-2.6.4/policy/modules/admin/consoletype.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-2.6.5/policy/modules/admin/consoletype.te
--- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/admin/consoletype.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/consoletype.te 2007-05-18 11:59:15.000000000 -0400
@@ -8,7 +8,12 @@
type consoletype_t;
@@ -402,9 +402,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console
domain_use_interactive_fds(consoletype_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-2.6.4/policy/modules/admin/dmesg.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-2.6.5/policy/modules/admin/dmesg.te
--- nsaserefpolicy/policy/modules/admin/dmesg.te 2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/admin/dmesg.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/dmesg.te 2007-05-18 11:59:15.000000000 -0400
@@ -10,6 +10,7 @@
type dmesg_t;
type dmesg_exec_t;
@@ -413,9 +413,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.t
role system_r types dmesg_t;
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-2.6.4/policy/modules/admin/kudzu.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-2.6.5/policy/modules/admin/kudzu.te
--- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/admin/kudzu.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/kudzu.te 2007-05-18 11:59:15.000000000 -0400
@@ -21,8 +21,8 @@
# Local policy
#
@@ -436,9 +436,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t
# kudzu will telinit to make init re-read
# the inittab after configuring serial consoles
init_telinit(kudzu_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-2.6.4/policy/modules/admin/logrotate.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-2.6.5/policy/modules/admin/logrotate.te
--- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/admin/logrotate.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/logrotate.te 2007-05-18 11:59:15.000000000 -0400
@@ -75,6 +75,7 @@
mls_file_read_up(logrotate_t)
mls_file_write_down(logrotate_t)
@@ -447,9 +447,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota
selinux_get_fs_mount(logrotate_t)
selinux_get_enforce_mode(logrotate_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-2.6.4/policy/modules/admin/logwatch.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-2.6.5/policy/modules/admin/logwatch.te
--- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-05-02 15:04:46.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/admin/logwatch.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/logwatch.te 2007-05-18 11:59:15.000000000 -0400
@@ -63,6 +63,8 @@
files_search_mnt(logwatch_t)
files_dontaudit_search_home(logwatch_t)
@@ -459,9 +459,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc
fs_getattr_all_fs(logwatch_t)
fs_dontaudit_list_auto_mountpoints(logwatch_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-2.6.4/policy/modules/admin/netutils.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-2.6.5/policy/modules/admin/netutils.te
--- nsaserefpolicy/policy/modules/admin/netutils.te 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/admin/netutils.te 2007-05-16 13:16:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/netutils.te 2007-05-18 11:59:15.000000000 -0400
@@ -31,6 +31,7 @@
type traceroute_t;
type traceroute_exec_t;
@@ -470,9 +470,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil
role system_r types traceroute_t;
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-2.6.4/policy/modules/admin/readahead.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-2.6.5/policy/modules/admin/prelink.te
+--- nsaserefpolicy/policy/modules/admin/prelink.te 2007-04-23 09:36:02.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/prelink.te 2007-05-21 11:37:45.000000000 -0400
+@@ -26,7 +26,7 @@
+ # Local policy
+ #
+
+-allow prelink_t self:capability { chown dac_override fowner fsetid };
++allow prelink_t self:capability { chown dac_override fowner fsetid sys_resource };
+ allow prelink_t self:process { execheap execmem execstack signal };
+ allow prelink_t self:fifo_file rw_fifo_file_perms;
+
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-2.6.5/policy/modules/admin/readahead.te
--- nsaserefpolicy/policy/modules/admin/readahead.te 2007-01-02 12:57:51.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/admin/readahead.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/readahead.te 2007-05-18 11:59:15.000000000 -0400
@@ -18,7 +18,8 @@
# Local policy
#
@@ -500,9 +512,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe
+optional_policy(`
+ logging_dontaudit_search_audit_config(readahead_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-2.6.4/policy/modules/admin/rpm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-2.6.5/policy/modules/admin/rpm.fc
--- nsaserefpolicy/policy/modules/admin/rpm.fc 2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/admin/rpm.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/rpm.fc 2007-05-18 11:59:15.000000000 -0400
@@ -21,6 +21,9 @@
/usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -513,10 +525,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
')
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-2.6.4/policy/modules/admin/rpm.if
---- nsaserefpolicy/policy/modules/admin/rpm.if 2007-04-11 10:19:43.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/admin/rpm.if 2007-05-08 09:59:33.000000000 -0400
-@@ -225,8 +225,29 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-2.6.5/policy/modules/admin/rpm.if
+--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/rpm.if 2007-05-18 11:59:15.000000000 -0400
+@@ -224,8 +224,29 @@
type rpm_script_tmp_t;
')
@@ -547,7 +559,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
')
########################################
-@@ -290,3 +311,46 @@
+@@ -289,3 +310,46 @@
dontaudit $1 rpm_var_lib_t:file manage_file_perms;
dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
')
@@ -594,9 +606,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
+
+ dontaudit $1 rpm_tmp_t:file rw_file_perms;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-2.6.4/policy/modules/admin/rpm.te
---- nsaserefpolicy/policy/modules/admin/rpm.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/admin/rpm.te 2007-05-08 09:59:33.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-2.6.5/policy/modules/admin/rpm.te
+--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-05-18 11:12:44.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/rpm.te 2007-05-18 11:59:15.000000000 -0400
@@ -9,6 +9,8 @@
type rpm_t;
type rpm_exec_t;
@@ -606,9 +618,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
domain_obj_id_change_exemption(rpm_t)
domain_role_change_exemption(rpm_t)
domain_system_change_exemption(rpm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-2.6.4/policy/modules/admin/sudo.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-2.6.5/policy/modules/admin/sudo.if
--- nsaserefpolicy/policy/modules/admin/sudo.if 2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/admin/sudo.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/sudo.if 2007-05-18 11:59:15.000000000 -0400
@@ -69,7 +69,6 @@
allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms;
allow $1_sudo_t self:unix_dgram_socket sendto;
@@ -655,9 +667,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
nis_use_ypbind($1_sudo_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-2.6.4/policy/modules/admin/su.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-2.6.5/policy/modules/admin/su.if
--- nsaserefpolicy/policy/modules/admin/su.if 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/admin/su.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/su.if 2007-05-18 11:59:15.000000000 -0400
@@ -41,12 +41,11 @@
allow $2 $1_su_t:process signal;
@@ -730,9 +742,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s
ifdef(`TODO',`
allow $1_su_t $1_home_t:file manage_file_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-2.6.4/policy/modules/admin/usermanage.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-2.6.5/policy/modules/admin/usermanage.if
--- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/admin/usermanage.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/usermanage.if 2007-05-18 11:59:15.000000000 -0400
@@ -278,5 +278,5 @@
type crack_db_t;
')
@@ -740,18 +752,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
- allow $1 crack_db_t:file read_file_perms;
+ read_files_pattern($1,crack_db_t,crack_db_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-2.6.4/policy/modules/admin/usermanage.te
---- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/admin/usermanage.te 2007-05-08 09:59:33.000000000 -0400
-@@ -184,7 +184,7 @@
- # Groupadd local policy
- #
-
--allow groupadd_t self:capability { dac_override chown kill setuid sys_resource audit_write };
-+allow groupadd_t self:capability { dac_override chown kill setuid sys_resource };
- dontaudit groupadd_t self:capability { fsetid sys_tty_config };
- allow groupadd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack };
- allow groupadd_t self:process { setrlimit setfscreate };
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-2.6.5/policy/modules/admin/usermanage.te
+--- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-05-18 11:12:44.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/usermanage.te 2007-05-18 11:59:15.000000000 -0400
@@ -198,7 +198,6 @@
allow groupadd_t self:unix_stream_socket create_stream_socket_perms;
allow groupadd_t self:unix_dgram_socket sendto;
@@ -815,24 +818,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
')
########################################
-@@ -396,6 +402,8 @@
- auth_relabel_shadow(sysadm_passwd_t)
- auth_etc_filetrans_shadow(sysadm_passwd_t)
-
-+# allow checking if a shell is executable
-+corecmd_check_exec_shell(sysadm_passwd_t)
- # allow vipw to exec the editor
- corecmd_exec_bin(sysadm_passwd_t)
- corecmd_exec_shell(sysadm_passwd_t)
-@@ -412,6 +420,7 @@
- # /usr/bin/passwd asks for w access to utmp, but it will operate
- # correctly without it. Do not audit write denials to utmp.
- init_dontaudit_rw_utmp(sysadm_passwd_t)
-+init_use_fds(sysadm_passwd_t)
-
- libs_use_ld_so(sysadm_passwd_t)
- libs_use_shared_libs(sysadm_passwd_t)
-@@ -433,6 +442,7 @@
+@@ -433,6 +439,7 @@
optional_policy(`
nscd_socket_use(sysadm_passwd_t)
@@ -840,7 +826,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
')
########################################
-@@ -440,7 +450,7 @@
+@@ -440,7 +447,7 @@
# Useradd local policy
#
@@ -849,7 +835,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
dontaudit useradd_t self:capability sys_tty_config;
allow useradd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow useradd_t self:process setfscreate;
-@@ -454,7 +464,6 @@
+@@ -454,7 +461,6 @@
allow useradd_t self:unix_stream_socket create_stream_socket_perms;
allow useradd_t self:unix_dgram_socket sendto;
allow useradd_t self:unix_stream_socket connectto;
@@ -857,7 +843,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
# for getting the number of groups
kernel_read_kernel_sysctls(useradd_t)
-@@ -500,6 +509,7 @@
+@@ -500,6 +506,7 @@
libs_use_shared_libs(useradd_t)
logging_send_syslog_msg(useradd_t)
@@ -865,17 +851,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
miscfiles_read_localization(useradd_t)
-@@ -508,6 +518,9 @@
+@@ -508,6 +515,9 @@
seutil_read_default_contexts(useradd_t)
seutil_domtrans_semanage(useradd_t)
- seutil_domtrans_restorecon(useradd_t)
+ seutil_domtrans_setfiles(useradd_t)
+# Required because semanage execs these and hands them useradd_t:fd
+seutil_domtrans_setfiles(useradd_t)
+seutil_domtrans_loadpolicy(useradd_t)
userdom_use_unpriv_users_fds(useradd_t)
# for when /root is the cwd
-@@ -521,11 +534,26 @@
+@@ -521,11 +531,26 @@
mta_manage_spool(useradd_t)
optional_policy(`
@@ -902,18 +888,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
rpm_rw_pipes(useradd_t)
+ rpm_dontaudit_rw_tmp_files(useradd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-2.6.4/policy/modules/admin/vbetool.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-2.6.5/policy/modules/admin/vbetool.te
--- nsaserefpolicy/policy/modules/admin/vbetool.te 2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/admin/vbetool.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/vbetool.te 2007-05-18 11:59:15.000000000 -0400
@@ -32,4 +32,5 @@
optional_policy(`
hal_rw_pid_files(vbetool_t)
+ hal_write_log(vbetool_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-2.6.4/policy/modules/apps/gnome.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-2.6.5/policy/modules/apps/gnome.if
--- nsaserefpolicy/policy/modules/apps/gnome.if 2007-02-19 11:32:52.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/apps/gnome.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/apps/gnome.if 2007-05-18 11:59:15.000000000 -0400
@@ -35,6 +35,7 @@
template(`gnome_per_role_template',`
gen_require(`
@@ -967,9 +953,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
##
##
## This is a templated interface, and should only
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-2.6.4/policy/modules/apps/gpg.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-2.6.5/policy/modules/apps/gpg.fc
--- nsaserefpolicy/policy/modules/apps/gpg.fc 2006-11-16 17:15:07.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/apps/gpg.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/apps/gpg.fc 2007-05-18 11:59:15.000000000 -0400
@@ -7,6 +7,4 @@
/usr/lib/gnupg/.* -- gen_context(system_u:object_r:gpg_exec_t,s0)
/usr/lib/gnupg/gpgkeys.* -- gen_context(system_u:object_r:gpg_helper_exec_t,s0)
@@ -977,9 +963,48 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc s
-ifdef(`targeted_policy',`',`
HOME_DIR/\.gnupg(/.+)? gen_context(system_u:object_r:ROLE_gpg_secret_t,s0)
-')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.if serefpolicy-2.6.4/policy/modules/apps/loadkeys.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-2.6.5/policy/modules/apps/java.if
+--- nsaserefpolicy/policy/modules/apps/java.if 2007-02-19 11:32:52.000000000 -0500
++++ serefpolicy-2.6.5/policy/modules/apps/java.if 2007-05-21 10:46:27.000000000 -0400
+@@ -224,3 +224,35 @@
+ refpolicywarn(`$0($1) has no effect in strict policy.')
+ ')
+ ')
++
++########################################
++##
++## Execute a java in the specified domain
++##
++##
++##
++## Execute the java command in the specified domain. This allows
++## the specified domain to execute any file
++## on these filesystems in the specified
++## domain.
++##
++##
++##
++##
++## Domain allowed access.
++##
++##
++##
++##
++## The type of the new process.
++##
++##
++#
++interface(`java_spec_domtrans',`
++ gen_require(`
++ type java_exec_t;
++ ')
++
++ domain_trans($1,java_exec_t,$2)
++ type_transition $1 java_exec_t:process $2;
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.if serefpolicy-2.6.5/policy/modules/apps/loadkeys.if
--- nsaserefpolicy/policy/modules/apps/loadkeys.if 2007-01-02 12:57:22.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/apps/loadkeys.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/apps/loadkeys.if 2007-05-18 11:59:15.000000000 -0400
@@ -11,16 +11,12 @@
##
#
@@ -1046,9 +1071,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys
')
+ can_exec($1,loadkeys_exec_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-2.6.4/policy/modules/apps/mozilla.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-2.6.5/policy/modules/apps/mozilla.if
--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-03-26 16:24:09.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/apps/mozilla.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/apps/mozilla.if 2007-05-18 11:59:15.000000000 -0400
@@ -150,6 +150,7 @@
corenet_dontaudit_tcp_bind_generic_port($1_mozilla_t)
@@ -1057,9 +1082,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
dev_write_sound($1_mozilla_t)
dev_read_sound($1_mozilla_t)
dev_dontaudit_rw_dri($1_mozilla_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-2.6.4/policy/modules/apps/slocate.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-2.6.5/policy/modules/apps/slocate.te
--- nsaserefpolicy/policy/modules/apps/slocate.te 2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/apps/slocate.te 2007-05-15 11:05:16.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/apps/slocate.te 2007-05-18 11:59:15.000000000 -0400
@@ -39,11 +39,12 @@
files_list_all(locate_t)
@@ -1074,9 +1099,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.
libs_use_shared_libs(locate_t)
libs_use_ld_so(locate_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if serefpolicy-2.6.4/policy/modules/apps/uml.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if serefpolicy-2.6.5/policy/modules/apps/uml.if
--- nsaserefpolicy/policy/modules/apps/uml.if 2007-03-26 10:38:58.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/apps/uml.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/apps/uml.if 2007-05-18 11:59:15.000000000 -0400
@@ -193,33 +193,6 @@
nis_use_ypbind($1_uml_t)
')
@@ -1111,9 +1136,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if s
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-2.6.4/policy/modules/kernel/corecommands.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-2.6.5/policy/modules/kernel/corecommands.fc
--- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-04-11 15:52:53.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/corecommands.fc 2007-05-18 11:59:15.000000000 -0400
@@ -36,6 +36,11 @@
/etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0)
/etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0)
@@ -1132,9 +1157,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
')
+/usr/lib/vmware-tools/sbin32(/.*)? gen_context(system_u:object_r:bin_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-2.6.4/policy/modules/kernel/corecommands.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-2.6.5/policy/modules/kernel/corecommands.if
--- nsaserefpolicy/policy/modules/kernel/corecommands.if 2007-03-26 10:38:57.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/corecommands.if 2007-05-18 11:59:15.000000000 -0400
@@ -988,3 +988,23 @@
mmap_files_pattern($1,bin_t,exec_type)
@@ -1159,9 +1184,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-2.6.4/policy/modules/kernel/corenetwork.te.in
---- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-05-07 10:32:44.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/kernel/corenetwork.te.in 2007-05-08 09:59:33.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-2.6.5/policy/modules/kernel/corenetwork.te.in
+--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-05-18 11:12:43.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/corenetwork.te.in 2007-05-18 11:59:15.000000000 -0400
@@ -48,6 +48,11 @@
type reserved_port_t, port_type, reserved_port_type;
@@ -1174,15 +1199,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
# server_packet_t is the default type of IPv4 and IPv6 server packets.
#
type server_packet_t, packet_type, server_packet_type;
-@@ -60,6 +65,7 @@
- network_port(amanda, udp,10080,s0, tcp,10080,s0, udp,10081,s0, tcp,10081,s0, tcp,10082,s0, tcp,10083,s0)
- network_port(amavisd_recv, tcp,10024,s0)
- network_port(amavisd_send, tcp,10025,s0)
-+network_port(apcupsd, tcp,3551,s0, udp,3551,s0)
- network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0, udp,5060,s0)
- network_port(auth, tcp,113,s0)
- network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0)
-@@ -85,7 +91,7 @@
+@@ -86,7 +91,7 @@
network_port(http_cache, tcp,3128,s0, udp,3130,s0, tcp,8080,s0, tcp,8118,s0) # 8118 is for privoxy
network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0, tcp,8009,s0, tcp,8443,s0) #8443 is mod_nss default port
network_port(howl, tcp,5335,s0, udp,5353,s0)
@@ -1191,7 +1208,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
network_port(i18n_input, tcp,9010,s0)
network_port(imaze, tcp,5323,s0, udp,5323,s0)
network_port(inetd_child, tcp,7,s0, udp,7,s0, tcp,9,s0, udp,9,s0, tcp,13,s0, udp,13,s0, tcp,19,s0, udp,19,s0, tcp,37,s0, udp,37,s0, tcp,512,s0, tcp,543,s0, tcp,544,s0, tcp,891,s0, udp,891,s0, tcp,892,s0, udp,892,s0, tcp,2105,s0, tcp,5666,s0)
-@@ -100,7 +106,7 @@
+@@ -101,7 +106,7 @@
network_port(kerberos_master, tcp,4444,s0, udp,4444,s0)
network_port(kerberos, tcp,88,s0, udp,88,s0, tcp,750,s0, udp,750,s0)
network_port(ktalkd, udp,517,s0, udp,518,s0)
@@ -1200,7 +1217,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
type lrrd_port_t, port_type; dnl network_port(lrrd_port_t) # no defined portcon
network_port(lmtp, tcp,24,s0, udp,24,s0)
network_port(mail, tcp,2000,s0)
-@@ -159,6 +165,9 @@
+@@ -160,6 +165,9 @@
# Defaults for reserved ports. Earlier portcon entries take precedence;
# these entries just cover any remaining reserved ports not otherwise declared.
@@ -1210,9 +1227,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
portcon tcp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0)
portcon udp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-2.6.4/policy/modules/kernel/devices.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-2.6.5/policy/modules/kernel/devices.fc
--- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-03-01 10:01:48.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/kernel/devices.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/devices.fc 2007-05-18 11:59:15.000000000 -0400
@@ -19,6 +19,7 @@
/dev/evtchn -c gen_context(system_u:object_r:xen_device_t,s0)
/dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0)
@@ -1230,9 +1247,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
/dev/cpu/.* -c gen_context(system_u:object_r:cpu_device_t,s0)
/dev/cpu/mtrr -c gen_context(system_u:object_r:mtrr_device_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-2.6.4/policy/modules/kernel/devices.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-2.6.5/policy/modules/kernel/devices.if
--- nsaserefpolicy/policy/modules/kernel/devices.if 2007-05-07 14:50:42.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/kernel/devices.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/devices.if 2007-05-18 11:59:15.000000000 -0400
@@ -2729,6 +2729,24 @@
########################################
@@ -1337,9 +1354,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
+ manage_chr_files_pattern($1,device_t,smartcard_device_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-2.6.4/policy/modules/kernel/devices.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-2.6.5/policy/modules/kernel/devices.te
--- nsaserefpolicy/policy/modules/kernel/devices.te 2007-05-07 14:50:42.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/kernel/devices.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/devices.te 2007-05-18 11:59:15.000000000 -0400
@@ -139,6 +139,12 @@
#
# Type for sound devices and mixers
@@ -1353,9 +1370,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
type sound_device_t;
dev_node(sound_device_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-2.6.4/policy/modules/kernel/domain.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-2.6.5/policy/modules/kernel/domain.if
--- nsaserefpolicy/policy/modules/kernel/domain.if 2007-02-19 11:32:51.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/kernel/domain.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/domain.if 2007-05-18 11:59:15.000000000 -0400
@@ -1254,3 +1254,21 @@
typeattribute $1 can_change_object_identity;
typeattribute $1 set_curr_context;
@@ -1378,9 +1395,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
+
+ allow $1 domain:association { sendto recvfrom };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-2.6.4/policy/modules/kernel/domain.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-2.6.5/policy/modules/kernel/domain.te
--- nsaserefpolicy/policy/modules/kernel/domain.te 2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/kernel/domain.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/domain.te 2007-05-18 11:59:15.000000000 -0400
@@ -6,6 +6,29 @@
# Declarations
#
@@ -1438,9 +1455,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
+ ipsec_labeled(domain)
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-2.6.4/policy/modules/kernel/files.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-2.6.5/policy/modules/kernel/files.fc
--- nsaserefpolicy/policy/modules/kernel/files.fc 2006-11-16 17:15:04.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/kernel/files.fc 2007-05-16 17:44:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/files.fc 2007-05-18 11:59:15.000000000 -0400
@@ -45,7 +45,6 @@
/etc -d gen_context(system_u:object_r:etc_t,s0)
/etc/.* gen_context(system_u:object_r:etc_t,s0)
@@ -1457,9 +1474,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
/etc/motd -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/nohotplug -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/nologin.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.6.4/policy/modules/kernel/files.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.6.5/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2007-02-26 14:17:21.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/kernel/files.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/files.if 2007-05-18 11:59:15.000000000 -0400
@@ -343,8 +343,7 @@
########################################
@@ -1636,9 +1653,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
+ allow $1 root_t:dir rw_dir_perms;
+ allow $1 root_t:file { create getattr write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-2.6.4/policy/modules/kernel/filesystem.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-2.6.5/policy/modules/kernel/files.te
+--- nsaserefpolicy/policy/modules/kernel/files.te 2007-04-23 09:35:56.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/files.te 2007-05-18 11:59:15.000000000 -0400
+@@ -54,6 +54,7 @@
+ files_type(etc_t)
+ # compatibility aliases for removed types:
+ typealias etc_t alias automount_etc_t;
++typealias etc_t alias snmpd_etc_t;
+
+ #
+ # etc_runtime_t is the type of various
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-2.6.5/policy/modules/kernel/filesystem.if
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-03-26 16:24:09.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/filesystem.if 2007-05-18 11:59:15.000000000 -0400
@@ -1096,6 +1096,24 @@
########################################
@@ -1714,9 +1742,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
+
+ allow $1 fusefs_t:filesystem mount;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.6.4/policy/modules/kernel/filesystem.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.6.5/policy/modules/kernel/filesystem.te
--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.te 2007-05-16 11:07:59.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/filesystem.te 2007-05-18 11:59:15.000000000 -0400
@@ -54,17 +54,29 @@
type capifs_t;
@@ -1771,9 +1799,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
#
# tmpfs_t is the type for tmpfs filesystems
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-2.6.4/policy/modules/kernel/kernel.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-2.6.5/policy/modules/kernel/kernel.if
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-05-02 15:04:46.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/kernel/kernel.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/kernel.if 2007-05-18 11:59:15.000000000 -0400
@@ -1848,6 +1848,26 @@
########################################
@@ -1811,9 +1839,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-2.6.4/policy/modules/kernel/kernel.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-2.6.5/policy/modules/kernel/kernel.te
--- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-05-02 15:04:46.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/kernel/kernel.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/kernel.te 2007-05-18 11:59:15.000000000 -0400
@@ -146,6 +146,8 @@
type unlabeled_t;
sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
@@ -1831,9 +1859,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-2.6.4/policy/modules/kernel/mls.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-2.6.5/policy/modules/kernel/mls.if
--- nsaserefpolicy/policy/modules/kernel/mls.if 2006-11-16 17:15:04.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/kernel/mls.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/mls.if 2007-05-18 11:59:15.000000000 -0400
@@ -154,6 +154,26 @@
########################################
##
@@ -1861,9 +1889,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if
## for writing to sockets at any level.
##
##
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-2.6.4/policy/modules/kernel/mls.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-2.6.5/policy/modules/kernel/mls.te
--- nsaserefpolicy/policy/modules/kernel/mls.te 2007-01-02 12:57:13.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/kernel/mls.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/mls.te 2007-05-18 11:59:15.000000000 -0400
@@ -18,6 +18,7 @@
attribute mlsnetreadtoclr;
attribute mlsnetwrite;
@@ -1881,9 +1909,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te
attribute mlstrustedobject;
attribute privrangetrans;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-2.6.4/policy/modules/kernel/selinux.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-2.6.5/policy/modules/kernel/selinux.if
--- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-02-27 14:37:10.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/kernel/selinux.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/selinux.if 2007-05-18 11:59:15.000000000 -0400
@@ -51,6 +51,44 @@
########################################
@@ -1929,9 +1957,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu
## Search selinuxfs.
##
##
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-2.6.4/policy/modules/kernel/storage.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-2.6.5/policy/modules/kernel/storage.if
--- nsaserefpolicy/policy/modules/kernel/storage.if 2007-01-02 12:57:13.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/kernel/storage.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/storage.if 2007-05-18 11:59:15.000000000 -0400
@@ -100,6 +100,7 @@
dev_list_all_dev_nodes($1)
@@ -1948,9 +1976,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag
typeattribute $1 fixed_disk_raw_write;
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-2.6.4/policy/modules/kernel/terminal.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-2.6.5/policy/modules/kernel/terminal.if
--- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-02-20 16:35:52.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/kernel/terminal.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/terminal.if 2007-05-18 11:59:15.000000000 -0400
@@ -278,6 +278,25 @@
########################################
@@ -1986,9 +2014,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-2.6.4/policy/modules/kernel/terminal.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-2.6.5/policy/modules/kernel/terminal.te
--- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/kernel/terminal.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/terminal.te 2007-05-18 11:59:15.000000000 -0400
@@ -28,6 +28,7 @@
type devpts_t;
files_mountpoint(devpts_t)
@@ -1997,9 +2025,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
fs_type(devpts_t)
fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0);
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.fc serefpolicy-2.6.4/policy/modules/services/aide.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.fc serefpolicy-2.6.5/policy/modules/services/aide.fc
--- nsaserefpolicy/policy/modules/services/aide.fc 2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/aide.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/aide.fc 2007-05-18 11:59:15.000000000 -0400
@@ -2,5 +2,5 @@
/var/lib/aide(/.*) gen_context(system_u:object_r:aide_db_t,mls_systemhigh)
@@ -2007,9 +2035,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide
-/var/log/aide(/.*)? gen_context(system_u:object_r:aide_log_t,mls_systemhigh)
/var/log/aide.log -- gen_context(system_u:object_r:aide_log_t,mls_systemhigh)
+/var/log/aide(/.*)? gen_context(system_u:object_r:aide_log_t,mls_systemhigh)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.te serefpolicy-2.6.4/policy/modules/services/aide.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.te serefpolicy-2.6.5/policy/modules/services/aide.te
--- nsaserefpolicy/policy/modules/services/aide.te 2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/aide.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/aide.te 2007-05-18 11:59:15.000000000 -0400
@@ -26,7 +26,7 @@
allow aide_t self:capability { dac_override fowner };
@@ -2019,9 +2047,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide
# database actions
manage_files_pattern(aide_t,aide_db_t,aide_db_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.if serefpolicy-2.6.4/policy/modules/services/amavis.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.if serefpolicy-2.6.5/policy/modules/services/amavis.if
--- nsaserefpolicy/policy/modules/services/amavis.if 2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/amavis.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/amavis.if 2007-05-18 11:59:15.000000000 -0400
@@ -167,3 +167,22 @@
allow $1 amavis_var_run_t:file setattr;
files_search_pids($1)
@@ -2045,9 +2073,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav
+ allow $1 amavis_var_run_t:file create_file_perms;
+ files_search_pids($1)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-2.6.4/policy/modules/services/apache.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-2.6.5/policy/modules/services/apache.fc
--- nsaserefpolicy/policy/modules/services/apache.fc 2007-02-23 16:50:01.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/apache.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/apache.fc 2007-05-18 11:59:15.000000000 -0400
@@ -1,10 +1,5 @@
# temporary hack till genhomedircon is fixed
-ifdef(`targeted_policy',`
@@ -2079,9 +2107,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+#viewvc file context
+/var/spool/viewvc(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t, s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-2.6.4/policy/modules/services/apache.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-2.6.5/policy/modules/services/apache.if
--- nsaserefpolicy/policy/modules/services/apache.if 2007-04-02 10:58:34.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/apache.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/apache.if 2007-05-18 11:59:15.000000000 -0400
@@ -18,10 +18,6 @@
attribute httpd_script_exec_type;
type httpd_t, httpd_suexec_t, httpd_log_t;
@@ -2300,9 +2328,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+ allow $1 httpd_bugzilla_content_t:dir search_dir_perms;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-2.6.4/policy/modules/services/apache.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-2.6.5/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/apache.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/apache.te 2007-05-18 11:59:15.000000000 -0400
@@ -106,6 +106,27 @@
##
gen_tunable(httpd_unified,false)
@@ -2466,9 +2494,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+ postgresql_stream_connect(httpd_bugzilla_script_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-2.6.4/policy/modules/services/apcupsd.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-2.6.5/policy/modules/services/apcupsd.fc
--- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-05-07 11:11:55.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/apcupsd.fc 2007-05-18 11:59:15.000000000 -0400
@@ -3,3 +3,8 @@
/var/log/apcupsd\.events.* -- gen_context(system_u:object_r:apcupsd_log_t,s0)
@@ -2478,9 +2506,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
+/var/www/apcupsd/upsfstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
+/var/www/apcupsd/upsimage.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
+/var/www/apcupsd/upsstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-2.6.4/policy/modules/services/apcupsd.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-2.6.5/policy/modules/services/apcupsd.if
--- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-05-07 11:11:55.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/apcupsd.if 2007-05-18 11:59:15.000000000 -0400
@@ -79,3 +79,25 @@
allow $1 apcupsd_log_t:dir list_dir_perms;
allow $1 apcupsd_log_t:file { getattr append };
@@ -2507,29 +2535,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
+ allow httpd_apcupsd_cgi_script_t $1:fifo_file rw_file_perms;
+ allow httpd_apcupsd_cgi_script_t $1:process sigchld;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-2.6.4/policy/modules/services/apcupsd.te
---- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-05-07 11:11:55.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.te 2007-05-08 09:59:33.000000000 -0400
-@@ -24,6 +24,7 @@
- # apcupsd local policy
- #
-
-+allow apcupsd_t self:process signal;
- allow apcupsd_t self:fifo_file rw_file_perms;
- allow apcupsd_t self:unix_stream_socket create_stream_socket_perms;
- allow apcupsd_t self:tcp_socket create_stream_socket_perms;
-@@ -43,8 +44,8 @@
- corenet_tcp_sendrecv_all_nodes(apcupsd_t)
- corenet_tcp_sendrecv_all_ports(apcupsd_t)
- corenet_tcp_bind_all_nodes(apcupsd_t)
--#corenet_tcp_bind_apcupsd_port(apcupsd_t)
--#corenet_sendrecv_apcupsd_server_packets(apcupsd_t)
-+corenet_tcp_bind_apcupsd_port(apcupsd_t)
-+corenet_sendrecv_apcupsd_server_packets(apcupsd_t)
-
- dev_rw_generic_usb_dev(apcupsd_t)
-
-@@ -65,3 +66,26 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-2.6.5/policy/modules/services/apcupsd.te
+--- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-05-18 11:12:43.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/apcupsd.te 2007-05-18 11:59:15.000000000 -0400
+@@ -66,3 +66,26 @@
term_dontaudit_use_unallocated_ttys(apcupsd_t)
term_dontaudit_use_generic_ptys(apcupsd_t)
')
@@ -2556,9 +2565,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
+corenet_udp_sendrecv_all_nodes(httpd_apcupsd_cgi_script_t)
+corenet_udp_sendrecv_all_ports(httpd_apcupsd_cgi_script_t)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-2.6.4/policy/modules/services/automount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-2.6.5/policy/modules/services/automount.te
--- nsaserefpolicy/policy/modules/services/automount.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/automount.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/automount.te 2007-05-18 11:59:15.000000000 -0400
@@ -69,6 +69,7 @@
files_mounton_all_mountpoints(automount_t)
files_mount_all_file_type_fs(automount_t)
@@ -2575,9 +2584,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto
dev_read_urand(automount_t)
domain_use_interactive_fds(automount_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-2.6.4/policy/modules/services/avahi.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-2.6.5/policy/modules/services/avahi.te
--- nsaserefpolicy/policy/modules/services/avahi.te 2007-05-03 08:50:57.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/avahi.te 2007-05-15 11:02:52.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/avahi.te 2007-05-18 11:59:15.000000000 -0400
@@ -18,7 +18,7 @@
# Local policy
#
@@ -2587,9 +2596,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah
dontaudit avahi_t self:capability sys_tty_config;
allow avahi_t self:process { setrlimit signal_perms setcap };
allow avahi_t self:fifo_file { read write };
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-2.6.4/policy/modules/services/bind.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-2.6.5/policy/modules/services/bind.te
--- nsaserefpolicy/policy/modules/services/bind.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/bind.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/bind.te 2007-05-18 11:59:15.000000000 -0400
@@ -236,6 +236,7 @@
corenet_tcp_sendrecv_all_nodes(ndc_t)
corenet_tcp_sendrecv_all_ports(ndc_t)
@@ -2598,9 +2607,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind
corenet_sendrecv_rndc_client_packets(ndc_t)
fs_getattr_xattr_fs(ndc_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-2.6.4/policy/modules/services/clamav.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-2.6.5/policy/modules/services/clamav.te
--- nsaserefpolicy/policy/modules/services/clamav.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/clamav.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/clamav.te 2007-05-18 11:59:15.000000000 -0400
@@ -126,6 +126,7 @@
amavis_read_lib_files(clamd_t)
amavis_read_spool_files(clamd_t)
@@ -2609,9 +2618,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam
')
########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-2.6.4/policy/modules/services/consolekit.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-2.6.5/policy/modules/services/consolekit.te
--- nsaserefpolicy/policy/modules/services/consolekit.te 2007-05-04 12:19:22.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/consolekit.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/consolekit.te 2007-05-18 11:59:15.000000000 -0400
@@ -10,7 +10,6 @@
type consolekit_exec_t;
init_daemon_domain(consolekit_t, consolekit_exec_t)
@@ -2654,17 +2663,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons
+ unconfined_ptrace(consolekit_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-2.6.4/policy/modules/services/cron.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-2.6.5/policy/modules/services/cron.fc
--- nsaserefpolicy/policy/modules/services/cron.fc 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/cron.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cron.fc 2007-05-18 11:59:15.000000000 -0400
@@ -45,3 +45,4 @@
/var/spool/fcron/systab\.orig -- gen_context(system_u:object_r:system_cron_spool_t,s0)
/var/spool/fcron/systab -- gen_context(system_u:object_r:system_cron_spool_t,s0)
/var/spool/fcron/new\.systab -- gen_context(system_u:object_r:system_cron_spool_t,s0)
+/var/lib/misc(/.*)? gen_context(system_u:object_r:crond_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-2.6.4/policy/modules/services/cron.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-2.6.5/policy/modules/services/cron.if
--- nsaserefpolicy/policy/modules/services/cron.if 2007-03-26 10:39:05.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/cron.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cron.if 2007-05-18 11:59:15.000000000 -0400
@@ -35,6 +35,7 @@
#
template(`cron_per_role_template',`
@@ -2773,9 +2782,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
tunable_policy(`fcron_crond',`
# fcron wants an instant update of a crontab change for the administrator
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-2.6.4/policy/modules/services/cron.te
---- nsaserefpolicy/policy/modules/services/cron.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/cron.te 2007-05-08 09:59:33.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-2.6.5/policy/modules/services/cron.te
+--- nsaserefpolicy/policy/modules/services/cron.te 2007-05-18 11:12:43.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cron.te 2007-05-18 11:59:15.000000000 -0400
@@ -42,6 +42,9 @@
type cron_log_t;
logging_log_file(cron_log_t)
@@ -2902,7 +2911,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
libs_use_ld_so(system_crond_t)
libs_use_shared_libs(system_crond_t)
-@@ -428,6 +456,10 @@
+@@ -427,6 +455,10 @@
')
optional_policy(`
@@ -2913,9 +2922,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
mrtg_append_create_logs(system_crond_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-2.6.4/policy/modules/services/cups.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-2.6.5/policy/modules/services/cups.fc
--- nsaserefpolicy/policy/modules/services/cups.fc 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/cups.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cups.fc 2007-05-18 11:59:15.000000000 -0400
@@ -8,6 +8,7 @@
/etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
/etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
@@ -2924,9 +2933,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
/etc/cups/certs -d gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
/etc/cups/certs/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-2.6.4/policy/modules/services/cups.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-2.6.5/policy/modules/services/cups.te
--- nsaserefpolicy/policy/modules/services/cups.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/cups.te 2007-05-11 18:40:14.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cups.te 2007-05-18 11:59:15.000000000 -0400
@@ -93,8 +93,6 @@
# generic socket here until appletalk socket is available in kernels
allow cupsd_t self:socket create_socket_perms;
@@ -2986,9 +2995,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
seutil_sigchld_newrole(cupsd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-2.6.4/policy/modules/services/cvs.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-2.6.5/policy/modules/services/cvs.te
--- nsaserefpolicy/policy/modules/services/cvs.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/cvs.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cvs.te 2007-05-18 11:59:15.000000000 -0400
@@ -16,6 +16,7 @@
type cvs_t;
type cvs_exec_t;
@@ -2997,9 +3006,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.
role system_r types cvs_t;
type cvs_data_t; # customizable
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-2.6.4/policy/modules/services/cyrus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-2.6.5/policy/modules/services/cyrus.te
--- nsaserefpolicy/policy/modules/services/cyrus.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/cyrus.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cyrus.te 2007-05-18 11:59:15.000000000 -0400
@@ -145,6 +145,7 @@
optional_policy(`
@@ -3008,9 +3017,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-2.6.4/policy/modules/services/dbus.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-2.6.5/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/dbus.if 2007-05-14 15:57:48.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/dbus.if 2007-05-18 11:59:15.000000000 -0400
@@ -49,6 +49,12 @@
##
#
@@ -3138,9 +3147,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-2.6.4/policy/modules/services/dbus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-2.6.5/policy/modules/services/dbus.te
--- nsaserefpolicy/policy/modules/services/dbus.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/dbus.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/dbus.te 2007-05-18 11:59:15.000000000 -0400
@@ -40,8 +40,6 @@
# Receive notifications of policy reloads and enforcing status changes.
allow system_dbusd_t self:netlink_selinux_socket { create bind read };
@@ -3169,9 +3178,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
sysnet_domtrans_dhcpc(system_dbusd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-2.6.4/policy/modules/services/dhcp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-2.6.5/policy/modules/services/dhcp.te
--- nsaserefpolicy/policy/modules/services/dhcp.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/dhcp.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/dhcp.te 2007-05-18 11:59:15.000000000 -0400
@@ -119,6 +119,8 @@
dbus_system_bus_client_template(dhcpd,dhcpd_t)
dbus_connect_system_bus(dhcpd_t)
@@ -3181,9 +3190,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-2.6.4/policy/modules/services/djbdns.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-2.6.5/policy/modules/services/djbdns.te
--- nsaserefpolicy/policy/modules/services/djbdns.te 2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/djbdns.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/djbdns.te 2007-05-18 11:59:15.000000000 -0400
@@ -44,4 +44,7 @@
libs_use_ld_so(djbdns_axfrdns_t)
libs_use_shared_libs(djbdns_axfrdns_t)
@@ -3193,9 +3202,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbd
+ ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-2.6.4/policy/modules/services/dovecot.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-2.6.5/policy/modules/services/dovecot.fc
--- nsaserefpolicy/policy/modules/services/dovecot.fc 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/dovecot.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/dovecot.fc 2007-05-18 11:59:15.000000000 -0400
@@ -17,10 +17,12 @@
ifdef(`distro_debian', `
@@ -3209,9 +3218,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
')
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-2.6.4/policy/modules/services/dovecot.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-2.6.5/policy/modules/services/dovecot.if
--- nsaserefpolicy/policy/modules/services/dovecot.if 2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/dovecot.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/dovecot.if 2007-05-18 11:59:15.000000000 -0400
@@ -18,3 +18,43 @@
manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
@@ -3256,9 +3265,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
+ domtrans_pattern($1,dovecot_deliver_exec_t,dovecot_deliver_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-2.6.4/policy/modules/services/dovecot.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-2.6.5/policy/modules/services/dovecot.te
--- nsaserefpolicy/policy/modules/services/dovecot.te 2007-05-07 10:32:44.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/dovecot.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/dovecot.te 2007-05-18 11:59:15.000000000 -0400
@@ -15,6 +15,12 @@
domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t)
role system_r types dovecot_auth_t;
@@ -3377,9 +3386,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
+ term_dontaudit_use_unallocated_ttys(dovecot_deliver_t)
+ term_dontaudit_use_generic_ptys(dovecot_deliver_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-2.6.4/policy/modules/services/ftp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-2.6.5/policy/modules/services/ftp.te
--- nsaserefpolicy/policy/modules/services/ftp.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/ftp.te 2007-05-17 13:03:23.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/ftp.te 2007-05-18 11:59:15.000000000 -0400
@@ -168,6 +168,7 @@
libs_use_shared_libs(ftpd_t)
@@ -3404,9 +3413,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
')
tunable_policy(`ftp_home_dir && use_nfs_home_dirs',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-2.6.4/policy/modules/services/hal.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-2.6.5/policy/modules/services/hal.fc
--- nsaserefpolicy/policy/modules/services/hal.fc 2007-05-07 14:50:43.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/hal.fc 2007-05-10 16:08:49.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/hal.fc 2007-05-18 11:59:15.000000000 -0400
@@ -2,15 +2,20 @@
/etc/hal/device\.d/printer_remove\.hal -- gen_context(system_u:object_r:hald_exec_t,s0)
/etc/hal/capability\.d/printer_update\.hal -- gen_context(system_u:object_r:hald_exec_t,s0)
@@ -3433,9 +3442,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
+
+/var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0)
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-2.6.4/policy/modules/services/hal.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-2.6.5/policy/modules/services/hal.if
--- nsaserefpolicy/policy/modules/services/hal.if 2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/hal.if 2007-05-16 17:46:44.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/hal.if 2007-05-18 11:59:15.000000000 -0400
@@ -208,3 +208,98 @@
files_search_pids($1)
allow $1 hald_var_run_t:file rw_file_perms;
@@ -3535,9 +3544,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
+ allow $1 hald_t:process ptrace;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-2.6.4/policy/modules/services/hal.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-2.6.5/policy/modules/services/hal.te
--- nsaserefpolicy/policy/modules/services/hal.te 2007-05-07 14:50:43.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/hal.te 2007-05-16 18:05:54.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/hal.te 2007-05-18 11:59:15.000000000 -0400
@@ -61,8 +61,6 @@
# For backwards compatibility with older kernels
allow hald_t self:netlink_socket create_socket_perms;
@@ -3600,9 +3609,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
dev_setattr_sound_dev(hald_acl_t)
dev_setattr_generic_usb_dev(hald_acl_t)
dev_setattr_usbfs_files(hald_acl_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-2.6.4/policy/modules/services/inetd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-2.6.5/policy/modules/services/inetd.te
--- nsaserefpolicy/policy/modules/services/inetd.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/inetd.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/inetd.te 2007-05-18 11:59:15.000000000 -0400
@@ -135,8 +135,8 @@
mls_fd_use_all_levels(inetd_t)
mls_fd_share_all_levels(inetd_t)
@@ -3623,9 +3632,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
files_search_home(inetd_child_t)
manage_dirs_pattern(inetd_child_t,inetd_child_tmp_t,inetd_child_tmp_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-2.6.4/policy/modules/services/kerberos.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-2.6.5/policy/modules/services/kerberos.if
--- nsaserefpolicy/policy/modules/services/kerberos.if 2007-04-10 13:21:52.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/kerberos.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/kerberos.if 2007-05-18 11:59:15.000000000 -0400
@@ -33,43 +33,10 @@
#
interface(`kerberos_use',`
@@ -3772,9 +3781,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
-
+ allow $1 krb5_keytab_t:file read_file_perms;
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-2.6.4/policy/modules/services/kerberos.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-2.6.5/policy/modules/services/kerberos.te
--- nsaserefpolicy/policy/modules/services/kerberos.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/kerberos.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/kerberos.te 2007-05-18 11:59:15.000000000 -0400
@@ -5,6 +5,7 @@
#
# Declarations
@@ -3783,7 +3792,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
##
##
-@@ -248,3 +249,36 @@
+@@ -126,6 +127,7 @@
+ miscfiles_read_localization(kadmind_t)
+
+ sysnet_read_config(kadmind_t)
++sysnet_use_ldap(kadmind_t)
+
+ userdom_dontaudit_use_unpriv_user_fds(kadmind_t)
+ userdom_dontaudit_search_sysadm_home_dirs(kadmind_t)
+@@ -227,6 +229,7 @@
+ miscfiles_read_localization(krb5kdc_t)
+
+ sysnet_read_config(krb5kdc_t)
++sysnet_use_ldap(krb5kdc_t)
+
+ userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t)
+ userdom_dontaudit_search_sysadm_home_dirs(krb5kdc_t)
+@@ -248,3 +251,36 @@
optional_policy(`
udev_read_db(krb5kdc_t)
')
@@ -3820,9 +3845,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
+ pcscd_stream_connect(kerberosclient)
+ ')
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-2.6.4/policy/modules/services/mailman.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-2.6.5/policy/modules/services/mailman.if
--- nsaserefpolicy/policy/modules/services/mailman.if 2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/mailman.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/mailman.if 2007-05-18 11:59:15.000000000 -0400
@@ -275,6 +275,25 @@
#######################################
@@ -3849,38 +3874,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail
## Allow domain to read mailman archive files.
##
##
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-2.6.4/policy/modules/services/mta.if
---- nsaserefpolicy/policy/modules/services/mta.if 2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/mta.if 2007-05-08 09:59:33.000000000 -0400
-@@ -847,6 +847,25 @@
- manage_files_pattern($1,mqueue_spool_t,mqueue_spool_t)
- ')
-
-+########################################
-+##
-+## search mail queue dirs.
-+##
-+##
-+##
-+## Domain allowed access.
-+##
-+##
-+#
-+interface(`mta_search_queue',`
-+ gen_require(`
-+ type mqueue_spool_t;
-+ ')
-+
-+ files_search_spool($1)
-+ allow $1 mqueue_spool_t:dir search_dir_perms;
-+')
-+
- #######################################
- ##
- ## Read sendmail binary.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-2.6.4/policy/modules/services/mta.te
---- nsaserefpolicy/policy/modules/services/mta.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/mta.te 2007-05-08 09:59:33.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-2.6.5/policy/modules/services/mta.te
+--- nsaserefpolicy/policy/modules/services/mta.te 2007-05-18 11:12:43.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/mta.te 2007-05-18 11:59:15.000000000 -0400
@@ -27,6 +27,7 @@
type sendmail_exec_t;
@@ -3897,9 +3893,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
# apache should set close-on-exec
apache_dontaudit_append_log(system_mail_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-2.6.4/policy/modules/services/networkmanager.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-2.6.5/policy/modules/services/networkmanager.if
--- nsaserefpolicy/policy/modules/services/networkmanager.if 2006-11-16 17:15:20.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/networkmanager.if 2007-05-16 08:30:20.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/networkmanager.if 2007-05-18 11:59:15.000000000 -0400
@@ -78,3 +78,22 @@
allow $1 NetworkManager_t:dbus send_msg;
allow NetworkManager_t $1:dbus send_msg;
@@ -3923,9 +3919,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
+ domtrans_pattern($1,NetworkManager_exec_t,NetworkManager_t)
+
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.6.4/policy/modules/services/nis.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.6.5/policy/modules/services/nis.if
--- nsaserefpolicy/policy/modules/services/nis.if 2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/nis.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/nis.if 2007-05-18 11:59:15.000000000 -0400
@@ -48,8 +48,8 @@
corenet_udp_bind_all_nodes($1)
corenet_tcp_bind_generic_port($1)
@@ -3937,9 +3933,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
corenet_dontaudit_tcp_bind_all_ports($1)
corenet_dontaudit_udp_bind_all_ports($1)
corenet_tcp_connect_portmap_port($1)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-2.6.4/policy/modules/services/nis.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-2.6.5/policy/modules/services/nis.te
--- nsaserefpolicy/policy/modules/services/nis.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/nis.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/nis.te 2007-05-18 11:59:15.000000000 -0400
@@ -120,6 +120,13 @@
')
@@ -3972,9 +3968,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)
corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t)
corenet_tcp_connect_all_ports(ypxfr_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-2.6.4/policy/modules/services/nscd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-2.6.5/policy/modules/services/nscd.te
--- nsaserefpolicy/policy/modules/services/nscd.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/nscd.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/nscd.te 2007-05-18 11:59:15.000000000 -0400
@@ -28,14 +28,14 @@
# Local policy
#
@@ -4013,9 +4009,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd
+ ')
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-2.6.4/policy/modules/services/ntp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-2.6.5/policy/modules/services/ntp.te
--- nsaserefpolicy/policy/modules/services/ntp.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/ntp.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/ntp.te 2007-05-18 11:59:15.000000000 -0400
@@ -137,6 +137,10 @@
')
@@ -4027,9 +4023,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
seutil_sigchld_newrole(ntpd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-2.6.4/policy/modules/services/oddjob.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-2.6.5/policy/modules/services/oddjob.te
--- nsaserefpolicy/policy/modules/services/oddjob.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/oddjob.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/oddjob.te 2007-05-18 11:59:15.000000000 -0400
@@ -27,7 +27,7 @@
# oddjob local policy
#
@@ -4039,9 +4035,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj
allow oddjob_t self:process { setexec signal };
allow oddjob_t self:fifo_file { read write };
allow oddjob_t self:unix_stream_socket create_stream_socket_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.fc serefpolicy-2.6.4/policy/modules/services/openct.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.fc serefpolicy-2.6.5/policy/modules/services/openct.fc
--- nsaserefpolicy/policy/modules/services/openct.fc 2006-11-16 17:15:20.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/openct.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/openct.fc 2007-05-18 11:59:15.000000000 -0400
@@ -2,6 +2,7 @@
# /usr
#
@@ -4050,9 +4046,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
#
# /var
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.if serefpolicy-2.6.4/policy/modules/services/openct.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.if serefpolicy-2.6.5/policy/modules/services/openct.if
--- nsaserefpolicy/policy/modules/services/openct.if 2006-11-16 17:15:20.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/openct.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/openct.if 2007-05-18 11:59:15.000000000 -0400
@@ -1 +1,83 @@
-## Service for handling smart card readers.
+
@@ -4138,9 +4134,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
+
+ allow $1 openct_t:process signull;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-2.6.4/policy/modules/services/openct.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-2.6.5/policy/modules/services/openct.te
--- nsaserefpolicy/policy/modules/services/openct.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/openct.te 2007-05-14 13:25:28.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/openct.te 2007-05-18 11:59:15.000000000 -0400
@@ -24,6 +24,8 @@
manage_files_pattern(openct_t,openct_var_run_t,openct_var_run_t)
files_pid_filetrans(openct_t,openct_var_run_t,file)
@@ -4159,9 +4155,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
domain_use_interactive_fds(openct_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.fc serefpolicy-2.6.4/policy/modules/services/openvpn.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.fc serefpolicy-2.6.5/policy/modules/services/openvpn.fc
--- nsaserefpolicy/policy/modules/services/openvpn.fc 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/openvpn.fc 2007-05-14 11:26:36.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/openvpn.fc 2007-05-18 11:59:15.000000000 -0400
@@ -11,5 +11,5 @@
#
# /var
@@ -4170,9 +4166,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
-/var/run/openvpn.* -- gen_context(system_u:object_r:openvpn_var_run_t,s0)
+/var/log/openvpn(/.*)? gen_context(system_u:object_r:openvpn_var_log_t,s0)
+/var/run/openvpn(/.*)? gen_context(system_u:object_r:openvpn_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-2.6.4/policy/modules/services/pcscd.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-2.6.5/policy/modules/services/pcscd.te
--- nsaserefpolicy/policy/modules/services/pcscd.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/pcscd.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/pcscd.te 2007-05-18 11:59:15.000000000 -0400
@@ -21,6 +21,7 @@
#
@@ -4195,9 +4191,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcsc
')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-2.6.4/policy/modules/services/pegasus.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-2.6.5/policy/modules/services/pegasus.if
--- nsaserefpolicy/policy/modules/services/pegasus.if 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/pegasus.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/pegasus.if 2007-05-18 11:59:15.000000000 -0400
@@ -1 +1,19 @@
## The Open Group Pegasus CIM/WBEM Server.
+
@@ -4218,9 +4214,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
+
+ domtrans_pattern($1,pegasus_exec_t,pegasus_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-2.6.4/policy/modules/services/pegasus.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-2.6.5/policy/modules/services/pegasus.te
--- nsaserefpolicy/policy/modules/services/pegasus.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/pegasus.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/pegasus.te 2007-05-18 11:59:15.000000000 -0400
@@ -38,8 +38,6 @@
allow pegasus_t self:unix_stream_socket create_stream_socket_perms;
allow pegasus_t self:tcp_socket create_stream_socket_perms;
@@ -4262,9 +4258,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-2.6.4/policy/modules/services/postfix.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-2.6.5/policy/modules/services/postfix.if
--- nsaserefpolicy/policy/modules/services/postfix.if 2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/postfix.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/postfix.if 2007-05-18 11:59:15.000000000 -0400
@@ -122,6 +122,7 @@
allow postfix_$1_t postfix_master_t:unix_stream_socket { connectto rw_stream_socket_perms };
allow postfix_$1_t self:tcp_socket create_socket_perms;
@@ -4296,9 +4292,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+ allow $1 postfix_private_t:dir list_dir_perms;
+ create_sock_files_pattern($1,postfix_private_t,postfix_private_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-2.6.4/policy/modules/services/postfix.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-2.6.5/policy/modules/services/postfix.te
--- nsaserefpolicy/policy/modules/services/postfix.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/postfix.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/postfix.te 2007-05-18 11:59:15.000000000 -0400
@@ -169,6 +169,8 @@
mta_rw_aliases(postfix_master_t)
mta_read_sendmail_bin(postfix_master_t)
@@ -4408,9 +4404,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+ dovecot_auth_stream_connect(postfix_smtpd_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-2.6.4/policy/modules/services/ppp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-2.6.5/policy/modules/services/ppp.te
--- nsaserefpolicy/policy/modules/services/ppp.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/ppp.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/ppp.te 2007-05-18 11:59:15.000000000 -0400
@@ -155,7 +155,7 @@
files_exec_etc_files(pppd_t)
@@ -4420,9 +4416,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.
files_dontaudit_write_etc_files(pppd_t)
# for scripts
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-2.6.4/policy/modules/services/procmail.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-2.6.5/policy/modules/services/procmail.te
--- nsaserefpolicy/policy/modules/services/procmail.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/procmail.te 2007-05-17 12:20:51.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/procmail.te 2007-05-18 11:59:15.000000000 -0400
@@ -10,6 +10,7 @@
type procmail_exec_t;
domain_type(procmail_t)
@@ -4454,9 +4450,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc
')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-2.6.4/policy/modules/services/pyzor.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-2.6.5/policy/modules/services/pyzor.te
--- nsaserefpolicy/policy/modules/services/pyzor.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/pyzor.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/pyzor.te 2007-05-18 11:59:15.000000000 -0400
@@ -54,6 +54,11 @@
corenet_udp_sendrecv_all_nodes(pyzor_t)
corenet_udp_sendrecv_all_ports(pyzor_t)
@@ -4485,9 +4481,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
spamassassin_read_spamd_tmp_files(pyzor_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-2.6.4/policy/modules/services/radius.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-2.6.5/policy/modules/services/radius.te
--- nsaserefpolicy/policy/modules/services/radius.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/radius.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/radius.te 2007-05-18 11:59:15.000000000 -0400
@@ -130,3 +130,7 @@
optional_policy(`
udev_read_db(radiusd_t)
@@ -4496,9 +4492,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi
+optional_policy(`
+ samba_read_var_files(radiusd_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-2.6.4/policy/modules/services/rlogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-2.6.5/policy/modules/services/rlogin.te
--- nsaserefpolicy/policy/modules/services/rlogin.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/rlogin.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rlogin.te 2007-05-18 11:59:15.000000000 -0400
@@ -64,6 +64,7 @@
fs_search_auto_mountpoints(rlogind_t)
@@ -4507,9 +4503,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog
auth_rw_login_records(rlogind_t)
auth_use_nsswitch(rlogind_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.fc serefpolicy-2.6.4/policy/modules/services/rpcbind.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.fc serefpolicy-2.6.5/policy/modules/services/rpcbind.fc
--- nsaserefpolicy/policy/modules/services/rpcbind.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.fc 2007-05-09 19:47:47.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rpcbind.fc 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1,6 @@
+
+/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0)
@@ -4517,9 +4513,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
+/var/run/rpc.statd.pid -- gen_context(system_u:object_r:rpcbind_var_run_t,s0)
+/var/run/rpcbind.sock -s gen_context(system_u:object_r:rpcbind_var_run_t,s0)
+/var/lib/rpcbind(/.*)? gen_context(system_u:object_r:rpcbind_var_lib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-2.6.4/policy/modules/services/rpcbind.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-2.6.5/policy/modules/services/rpcbind.if
--- nsaserefpolicy/policy/modules/services/rpcbind.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rpcbind.if 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1,104 @@
+
+## policy for rpcbind
@@ -4625,9 +4621,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
+ allow $1 rpcbind_var_lib_t:dir rw_dir_perms;
+ files_search_var_lib($1)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-2.6.4/policy/modules/services/rpcbind.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-2.6.5/policy/modules/services/rpcbind.te
--- nsaserefpolicy/policy/modules/services/rpcbind.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rpcbind.te 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1,83 @@
+policy_module(rpcbind,1.0.0)
+
@@ -4712,9 +4708,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-2.6.4/policy/modules/services/rpc.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-2.6.5/policy/modules/services/rpc.if
--- nsaserefpolicy/policy/modules/services/rpc.if 2007-03-20 23:38:10.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/rpc.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rpc.if 2007-05-18 11:59:15.000000000 -0400
@@ -89,8 +89,11 @@
# bind to arbitary unused ports
corenet_tcp_bind_generic_port($1_t)
@@ -4728,9 +4724,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
fs_rw_rpc_named_pipes($1_t)
fs_search_auto_mountpoints($1_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-2.6.4/policy/modules/services/rpc.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-2.6.5/policy/modules/services/rpc.te
--- nsaserefpolicy/policy/modules/services/rpc.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/rpc.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rpc.te 2007-05-18 11:59:15.000000000 -0400
@@ -79,6 +79,7 @@
optional_policy(`
@@ -4747,9 +4743,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
')
tunable_policy(`nfs_export_all_ro',`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-2.6.4/policy/modules/services/rsync.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-2.6.5/policy/modules/services/rsync.te
--- nsaserefpolicy/policy/modules/services/rsync.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/rsync.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rsync.te 2007-05-18 11:59:15.000000000 -0400
@@ -17,6 +17,7 @@
type rsync_t;
type rsync_exec_t;
@@ -4758,9 +4754,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn
role system_r types rsync_t;
type rsync_data_t;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-2.6.4/policy/modules/services/rwho.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-2.6.5/policy/modules/services/rwho.if
--- nsaserefpolicy/policy/modules/services/rwho.if 2007-04-30 22:35:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/rwho.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rwho.if 2007-05-18 11:59:15.000000000 -0400
@@ -1 +1,84 @@
-## Who is logged in on other machines?
+
@@ -4847,9 +4843,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho
+ allow $1 rwho_spool_t:dir rw_dir_perms;
+ files_search_spool($1)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-2.6.4/policy/modules/services/samba.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-2.6.5/policy/modules/services/samba.fc
--- nsaserefpolicy/policy/modules/services/samba.fc 2007-02-23 16:50:01.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/samba.fc 2007-05-16 08:24:46.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/samba.fc 2007-05-18 11:59:15.000000000 -0400
@@ -3,6 +3,7 @@
# /etc
#
@@ -4868,9 +4864,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
/var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-2.6.4/policy/modules/services/samba.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-2.6.5/policy/modules/services/samba.if
--- nsaserefpolicy/policy/modules/services/samba.if 2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/samba.if 2007-05-17 13:05:00.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/samba.if 2007-05-18 11:59:15.000000000 -0400
@@ -177,6 +177,27 @@
########################################
@@ -5016,9 +5012,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
+ allow smbd_t samba_$1_script_exec_t:file ioctl;
+
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-2.6.4/policy/modules/services/samba.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-2.6.5/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/samba.te 2007-05-17 13:03:49.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/samba.te 2007-05-18 11:59:15.000000000 -0400
@@ -28,6 +28,35 @@
##
gen_tunable(samba_share_nfs,false)
@@ -5255,9 +5251,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-2.6.4/policy/modules/services/sasl.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-2.6.5/policy/modules/services/sasl.te
--- nsaserefpolicy/policy/modules/services/sasl.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/sasl.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/sasl.te 2007-05-18 11:59:15.000000000 -0400
@@ -63,6 +63,7 @@
selinux_compute_access_vector(saslauthd_t)
@@ -5266,48 +5262,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl
auth_use_nsswitch(saslauthd_t)
domain_use_interactive_fds(saslauthd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-2.6.4/policy/modules/services/sendmail.if
---- nsaserefpolicy/policy/modules/services/sendmail.if 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/sendmail.if 2007-05-08 09:59:33.000000000 -0400
-@@ -76,6 +76,26 @@
-
- ########################################
- ##
-+## read sendmail logs.
-+##
-+##
-+##
-+## Domain allowed access.
-+##
-+##
-+##
-+#
-+interface(`sendmail_read_log',`
-+ gen_require(`
-+ type sendmail_log_t;
-+ ')
-+
-+ logging_search_logs($1)
-+ read_files_pattern($1, sendmail_log_t, sendmail_log_t)
-+')
-+
-+########################################
-+##
- ## Create, read, write, and delete sendmail logs.
- ##
- ##
-@@ -91,7 +111,7 @@
- ')
-
- logging_search_logs($1)
-- allow $1 sendmail_log_t:file manage_file_perms;
-+ manage_files_pattern($1, sendmail_log_t, sendmail_log_t)
- ')
-
- ########################################
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-2.6.4/policy/modules/services/setroubleshoot.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-2.6.5/policy/modules/services/setroubleshoot.te
--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/setroubleshoot.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/setroubleshoot.te 2007-05-18 11:59:15.000000000 -0400
@@ -28,7 +28,7 @@
#
@@ -5317,9 +5274,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr
allow setroubleshootd_t self:fifo_file rw_fifo_file_perms;
allow setroubleshootd_t self:tcp_socket create_stream_socket_perms;
allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto };
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-2.6.4/policy/modules/services/smartmon.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-2.6.5/policy/modules/services/smartmon.te
--- nsaserefpolicy/policy/modules/services/smartmon.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/smartmon.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/smartmon.te 2007-05-18 11:59:15.000000000 -0400
@@ -60,6 +60,7 @@
fs_search_auto_mountpoints(fsdaemon_t)
@@ -5328,44 +5285,46 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar
storage_raw_read_fixed_disk(fsdaemon_t)
storage_raw_write_fixed_disk(fsdaemon_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-2.6.4/policy/modules/services/snmp.te
---- nsaserefpolicy/policy/modules/services/snmp.te 2007-05-07 10:32:44.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/snmp.te 2007-05-08 09:59:33.000000000 -0400
-@@ -26,7 +26,7 @@
- # Local policy
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-2.6.5/policy/modules/services/snmp.fc
+--- nsaserefpolicy/policy/modules/services/snmp.fc 2006-11-16 17:15:20.000000000 -0500
++++ serefpolicy-2.6.5/policy/modules/services/snmp.fc 2007-05-18 11:59:15.000000000 -0400
+@@ -1,11 +1,5 @@
+
#
- allow snmpd_t self:capability { dac_override kill net_admin sys_nice sys_tty_config };
--dontaudit snmpd_t self:capability sys_tty_config;
-+dontaudit snmpd_t self:capability { sys_module sys_tty_config };
- allow snmpd_t self:fifo_file rw_fifo_file_perms;
- allow snmpd_t self:unix_dgram_socket create_socket_perms;
- allow snmpd_t self:unix_stream_socket create_stream_socket_perms;
-@@ -135,18 +135,19 @@
+-# /etc
+-#
+-
+-/etc/snmp/snmp(trap)?d\.conf -- gen_context(system_u:object_r:snmpd_etc_t,s0)
+-
+-#
+ # /usr
+ #
+ /usr/sbin/snmp(trap)?d -- gen_context(system_u:object_r:snmpd_exec_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-2.6.5/policy/modules/services/snmp.te
+--- nsaserefpolicy/policy/modules/services/snmp.te 2007-05-18 11:12:43.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/snmp.te 2007-05-18 11:59:15.000000000 -0400
+@@ -9,9 +9,6 @@
+ type snmpd_exec_t;
+ init_daemon_domain(snmpd_t,snmpd_exec_t)
- optional_policy(`
- mta_read_config(snmpd_t)
-+ mta_search_queue(snmpd_t)
- ')
+-type snmpd_etc_t;
+-files_config_file(snmpd_etc_t)
+-
+ type snmpd_log_t;
+ logging_log_file(snmpd_log_t)
- optional_policy(`
-- nis_use_ypbind(snmpd_t)
-+ auth_use_nsswitch(snmpd_t)
- ')
+@@ -33,8 +30,6 @@
+ allow snmpd_t self:tcp_socket create_stream_socket_perms;
+ allow snmpd_t self:udp_socket connected_stream_socket_perms;
- optional_policy(`
-- nscd_socket_use(snmpd_t)
-+ rpc_search_nfs_state_data(snmpd_t)
- ')
+-allow snmpd_t snmpd_etc_t:file { getattr read };
+-
+ allow snmpd_t snmpd_log_t:file manage_file_perms;
+ logging_log_filetrans(snmpd_t,snmpd_log_t,file)
- optional_policy(`
-- rpc_search_nfs_state_data(snmpd_t)
-+ sendmail_read_log(snmpd_t)
- ')
-
- optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.6.4/policy/modules/services/spamassassin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.6.5/policy/modules/services/spamassassin.te
--- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/spamassassin.te 2007-05-14 13:42:25.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/spamassassin.te 2007-05-18 11:59:15.000000000 -0400
@@ -6,14 +6,12 @@
# Declarations
#
@@ -5419,18 +5378,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
nis_use_ypbind(spamd_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-2.6.4/policy/modules/services/squid.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-2.6.5/policy/modules/services/squid.fc
--- nsaserefpolicy/policy/modules/services/squid.fc 2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/squid.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/squid.fc 2007-05-18 11:59:15.000000000 -0400
@@ -12,3 +12,5 @@
/var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0)
/var/spool/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0)
+/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
+/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-2.6.4/policy/modules/services/squid.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-2.6.5/policy/modules/services/squid.te
--- nsaserefpolicy/policy/modules/services/squid.te 2007-05-07 10:32:44.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/squid.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/squid.te 2007-05-18 11:59:15.000000000 -0400
@@ -185,3 +185,12 @@
#squid requires the following when run in diskd mode, the recommended setting
allow squid_t tmpfs_t:file { read write };
@@ -5444,9 +5403,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
+ sysnet_read_config(httpd_squid_script_t)
+ corenet_non_ipsec_sendrecv(httpd_squid_script_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-2.6.4/policy/modules/services/ssh.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-2.6.5/policy/modules/services/ssh.if
--- nsaserefpolicy/policy/modules/services/ssh.if 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/ssh.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/ssh.if 2007-05-18 11:59:15.000000000 -0400
@@ -709,3 +709,42 @@
dontaudit $1 sshd_key_t:file { getattr read };
@@ -5490,9 +5449,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
+ dontaudit $2 $1_ssh_agent_t:fd use;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-2.6.4/policy/modules/services/ssh.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-2.6.5/policy/modules/services/ssh.te
--- nsaserefpolicy/policy/modules/services/ssh.te 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/ssh.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/ssh.te 2007-05-18 11:59:15.000000000 -0400
@@ -24,11 +24,11 @@
# Type for the ssh-agent executable.
@@ -5526,9 +5485,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
ifdef(`TODO',`
tunable_policy(`ssh_sysadm_login',`
# Relabel and access ptys created by sshd
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-2.6.4/policy/modules/services/tftp.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-2.6.5/policy/modules/services/tftp.te
--- nsaserefpolicy/policy/modules/services/tftp.te 2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/tftp.te 2007-05-14 16:13:37.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/tftp.te 2007-05-18 11:59:15.000000000 -0400
@@ -69,6 +69,7 @@
logging_send_syslog_msg(tftpd_t)
@@ -5542,20 +5501,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp
udev_read_db(tftpd_t)
')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-2.6.4/policy/modules/services/w3c.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-2.6.5/policy/modules/services/w3c.fc
--- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/w3c.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/w3c.fc 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1,2 @@
+/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0)
+/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-2.6.4/policy/modules/services/w3c.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-2.6.5/policy/modules/services/w3c.if
--- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/w3c.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/w3c.if 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1 @@
+## W3C
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-2.6.4/policy/modules/services/w3c.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-2.6.5/policy/modules/services/w3c.te
--- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/w3c.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/w3c.te 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1,14 @@
+policy_module(w3c,1.2.1)
+
@@ -5571,14 +5530,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.
+corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t)
+
+miscfiles_read_certs(httpd_w3c_validator_script_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-2.6.4/policy/modules/system/application.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-2.6.5/policy/modules/system/application.fc
--- nsaserefpolicy/policy/modules/system/application.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/application.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/application.fc 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1 @@
+# No application file contexts.
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-2.6.4/policy/modules/system/application.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-2.6.5/policy/modules/system/application.if
--- nsaserefpolicy/policy/modules/system/application.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/application.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/application.if 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1,104 @@
+## Policy for application domains
+
@@ -5684,9 +5643,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic
+ application_executable_file($2)
+ domain_entry_file($1,$2)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-2.6.4/policy/modules/system/application.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-2.6.5/policy/modules/system/application.te
--- nsaserefpolicy/policy/modules/system/application.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/application.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/application.te 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1,14 @@
+
+policy_module(application,1.0.0)
@@ -5702,9 +5661,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic
+ ssh_rw_stream_sockets(application_domain_type)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-2.6.4/policy/modules/system/authlogin.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-2.6.5/policy/modules/system/authlogin.fc
--- nsaserefpolicy/policy/modules/system/authlogin.fc 2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/authlogin.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/authlogin.fc 2007-05-18 11:59:15.000000000 -0400
@@ -14,6 +14,7 @@
/sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
@@ -5713,9 +5672,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
ifdef(`distro_suse', `
/sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-2.6.4/policy/modules/system/authlogin.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-2.6.5/policy/modules/system/authlogin.if
--- nsaserefpolicy/policy/modules/system/authlogin.if 2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/authlogin.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/authlogin.if 2007-05-18 11:59:15.000000000 -0400
@@ -27,11 +27,9 @@
domain_type($1_chkpwd_t)
domain_entry_file($1_chkpwd_t,chkpwd_exec_t)
@@ -5978,9 +5937,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+ auth_dontaudit_read_shadow($1)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-2.6.4/policy/modules/system/authlogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-2.6.5/policy/modules/system/authlogin.te
--- nsaserefpolicy/policy/modules/system/authlogin.te 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/authlogin.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/authlogin.te 2007-05-18 11:59:15.000000000 -0400
@@ -9,6 +9,13 @@
attribute can_read_shadow_passwords;
attribute can_write_shadow_passwords;
@@ -6043,9 +6002,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+optional_policy(`
+ nscd_socket_use(updpwd_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-2.6.4/policy/modules/system/clock.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-2.6.5/policy/modules/system/clock.te
--- nsaserefpolicy/policy/modules/system/clock.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/clock.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/clock.te 2007-05-18 11:59:15.000000000 -0400
@@ -26,8 +26,6 @@
allow hwclock_t self:process signal_perms;
allow hwclock_t self:fifo_file { getattr read write };
@@ -6063,9 +6022,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.
miscfiles_read_localization(hwclock_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-2.6.4/policy/modules/system/fstools.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-2.6.5/policy/modules/system/fstools.fc
--- nsaserefpolicy/policy/modules/system/fstools.fc 2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/fstools.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/fstools.fc 2007-05-18 11:59:15.000000000 -0400
@@ -19,7 +19,6 @@
/sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -6074,9 +6033,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-2.6.4/policy/modules/system/fstools.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-2.6.5/policy/modules/system/fstools.te
--- nsaserefpolicy/policy/modules/system/fstools.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/fstools.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/fstools.te 2007-05-18 11:59:15.000000000 -0400
@@ -9,6 +9,7 @@
type fsadm_t;
type fsadm_exec_t;
@@ -6085,9 +6044,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
role system_r types fsadm_t;
type fsadm_log_t;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-2.6.4/policy/modules/system/fusermount.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-2.6.5/policy/modules/system/fusermount.fc
--- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/fusermount.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/fusermount.fc 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1,6 @@
+# fusermount executable will have:
+# label: system_u:object_r:fusermount_exec_t
@@ -6095,9 +6054,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+# MCS categories:
+
+/usr/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-2.6.4/policy/modules/system/fusermount.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-2.6.5/policy/modules/system/fusermount.if
--- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/fusermount.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/fusermount.if 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1,41 @@
+## policy for fusermount
+
@@ -6141,9 +6100,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+ allow $1 fusermount_t:fd use;
+')
\ No newline at end of file
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-2.6.4/policy/modules/system/fusermount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-2.6.5/policy/modules/system/fusermount.te
--- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/fusermount.te 2007-05-14 15:36:32.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/fusermount.te 2007-05-18 11:59:15.000000000 -0400
@@ -0,0 +1,51 @@
+policy_module(fusermount,1.0.0)
+
@@ -6196,9 +6155,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
+ term_use_console(fusermount_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-2.6.4/policy/modules/system/getty.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-2.6.5/policy/modules/system/getty.te
--- nsaserefpolicy/policy/modules/system/getty.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/getty.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/getty.te 2007-05-18 11:59:15.000000000 -0400
@@ -33,7 +33,8 @@
#
@@ -6209,9 +6168,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.
dontaudit getty_t self:capability sys_tty_config;
allow getty_t self:process { getpgid setpgid getsession signal_perms };
allow getty_t self:fifo_file rw_fifo_file_perms;
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-2.6.4/policy/modules/system/hostname.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-2.6.5/policy/modules/system/hostname.te
--- nsaserefpolicy/policy/modules/system/hostname.te 2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/hostname.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/hostname.te 2007-05-18 11:59:15.000000000 -0400
@@ -8,8 +8,12 @@
type hostname_t;
@@ -6238,9 +6197,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna
+optional_policy(`
+ unconfined_dontaudit_rw_pipes(hostname_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-2.6.4/policy/modules/system/init.if
---- nsaserefpolicy/policy/modules/system/init.if 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/init.if 2007-05-08 09:59:33.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-2.6.5/policy/modules/system/init.if
+--- nsaserefpolicy/policy/modules/system/init.if 2007-05-18 11:12:44.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/init.if 2007-05-18 11:59:15.000000000 -0400
@@ -194,11 +194,14 @@
gen_require(`
type initrc_t;
@@ -6256,7 +6215,57 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
role system_r types $1;
domtrans_pattern(initrc_t,$2,$1)
-@@ -1088,7 +1091,7 @@
+@@ -300,6 +303,9 @@
+ interface(`init_getpgid',`
+ gen_require(`
+ type init_t;
++
++ # cjp: remove this when init_t decl is moved back to this module
++ attribute direct_run_init;
+ ')
+
+ allow $1 init_t:process getpgid;
+@@ -318,6 +324,9 @@
+ interface(`init_signull',`
+ gen_require(`
+ type init_t;
++
++ # cjp: remove this when init_t decl is moved back to this module
++ attribute direct_run_init;
+ ')
+
+ allow $1 init_t:process signull;
+@@ -336,6 +345,9 @@
+ interface(`init_sigchld',`
+ gen_require(`
+ type init_t;
++
++ # cjp: remove this when init_t decl is moved back to this module
++ attribute direct_run_init;
+ ')
+
+ allow $1 init_t:process sigchld;
+@@ -354,6 +366,9 @@
+ interface(`init_use_fds',`
+ gen_require(`
+ type init_t;
++
++ # cjp: remove this when init_t decl is moved back to this module
++ attribute direct_run_init;
+ ')
+
+ allow $1 init_t:fd use;
+@@ -373,6 +388,9 @@
+ interface(`init_dontaudit_use_fds',`
+ gen_require(`
+ type init_t;
++
++ # cjp: remove this when init_t decl is moved back to this module
++ attribute direct_run_init;
+ ')
+
+ dontaudit $1 init_t:fd use;
+@@ -1073,7 +1091,7 @@
')
files_search_tmp($1)
@@ -6265,7 +6274,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
')
########################################
-@@ -1269,3 +1272,42 @@
+@@ -1254,3 +1272,42 @@
files_search_pids($1)
allow $1 initrc_var_run_t:file manage_file_perms;
')
@@ -6308,9 +6317,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
+
+ allow $1 init_t:process ptrace;
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-2.6.4/policy/modules/system/init.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-2.6.5/policy/modules/system/init.te
--- nsaserefpolicy/policy/modules/system/init.te 2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/init.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/init.te 2007-05-18 11:59:15.000000000 -0400
@@ -10,13 +10,20 @@
# Declarations
#
@@ -6408,9 +6417,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-2.6.4/policy/modules/system/ipsec.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-2.6.5/policy/modules/system/ipsec.if
--- nsaserefpolicy/policy/modules/system/ipsec.if 2007-03-26 16:24:13.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/ipsec.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/ipsec.if 2007-05-18 11:59:15.000000000 -0400
@@ -114,6 +114,26 @@
########################################
@@ -6438,9 +6447,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
## Execute racoon in the racoon domain.
##
##
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-2.6.4/policy/modules/system/ipsec.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-2.6.5/policy/modules/system/ipsec.te
--- nsaserefpolicy/policy/modules/system/ipsec.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/ipsec.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/ipsec.te 2007-05-18 11:59:15.000000000 -0400
@@ -289,6 +289,7 @@
allow racoon_t self:netlink_selinux_socket { bind create read };
allow racoon_t self:udp_socket create_socket_perms;
@@ -6449,9 +6458,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
# manage pid file
manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-2.6.4/policy/modules/system/iptables.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-2.6.5/policy/modules/system/iptables.te
--- nsaserefpolicy/policy/modules/system/iptables.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/iptables.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/iptables.te 2007-05-18 11:59:15.000000000 -0400
@@ -56,6 +56,7 @@
domain_use_interactive_fds(iptables_t)
@@ -6468,9 +6477,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl
+optional_policy(`
+ fail2ban_append_log(iptables_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-2.6.4/policy/modules/system/libraries.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-2.6.5/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2007-05-04 12:19:22.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/libraries.fc 2007-05-14 14:18:52.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/libraries.fc 2007-05-18 11:59:15.000000000 -0400
@@ -81,8 +81,8 @@
/opt/cisco-vpnclient/lib/libvpnapi\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/opt/netbeans(.*/)?jdk.*/linux/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -6499,9 +6508,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
/usr/lib(64)?/(nvidia/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/fglrx/libGL\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/libGLU\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-2.6.4/policy/modules/system/libraries.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-2.6.5/policy/modules/system/libraries.te
--- nsaserefpolicy/policy/modules/system/libraries.te 2007-05-04 12:19:23.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/libraries.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/libraries.te 2007-05-18 11:59:15.000000000 -0400
@@ -62,7 +62,8 @@
manage_dirs_pattern(ldconfig_t,ldconfig_tmp_t,ldconfig_tmp_t)
@@ -6520,9 +6529,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-2.6.4/policy/modules/system/locallogin.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-2.6.5/policy/modules/system/locallogin.te
--- nsaserefpolicy/policy/modules/system/locallogin.te 2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/locallogin.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/locallogin.te 2007-05-18 11:59:15.000000000 -0400
@@ -48,6 +48,8 @@
allow local_login_t self:msgq create_msgq_perms;
allow local_login_t self:msg { send receive };
@@ -6563,9 +6572,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall
gpm_getattr_gpmctl(local_login_t)
gpm_setattr_gpmctl(local_login_t)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-2.6.4/policy/modules/system/logging.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-2.6.5/policy/modules/system/logging.if
--- nsaserefpolicy/policy/modules/system/logging.if 2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/logging.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/logging.if 2007-05-18 11:59:15.000000000 -0400
@@ -302,6 +302,25 @@
########################################
@@ -6732,9 +6741,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+ typeattribute $1 can_send_audit_msg;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-2.6.4/policy/modules/system/logging.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-2.6.5/policy/modules/system/logging.te
--- nsaserefpolicy/policy/modules/system/logging.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/logging.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/logging.te 2007-05-18 11:59:15.000000000 -0400
@@ -7,10 +7,15 @@
#
@@ -6820,9 +6829,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
files_read_etc_runtime_files(syslogd_t)
# /initrd is not umounted before minilog starts
files_dontaudit_search_isid_type_dirs(syslogd_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-2.6.4/policy/modules/system/lvm.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-2.6.5/policy/modules/system/lvm.fc
--- nsaserefpolicy/policy/modules/system/lvm.fc 2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/lvm.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/lvm.fc 2007-05-18 11:59:15.000000000 -0400
@@ -15,6 +15,7 @@
#
/etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0)
@@ -6831,9 +6840,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc
/etc/lvm/archive(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0)
/etc/lvm/backup(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0)
/etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-2.6.4/policy/modules/system/lvm.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-2.6.5/policy/modules/system/lvm.te
--- nsaserefpolicy/policy/modules/system/lvm.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/lvm.te 2007-05-14 13:22:54.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/lvm.te 2007-05-18 11:59:15.000000000 -0400
@@ -16,6 +16,7 @@
type lvm_t;
type lvm_exec_t;
@@ -6879,9 +6888,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
+ xen_append_log(lvm_t)
+ xen_dontaudit_rw_unix_stream_sockets(lvm_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-2.6.4/policy/modules/system/modutils.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-2.6.5/policy/modules/system/modutils.te
--- nsaserefpolicy/policy/modules/system/modutils.te 2007-05-02 15:04:46.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/modutils.te 2007-05-16 17:09:16.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/modutils.te 2007-05-18 11:59:15.000000000 -0400
@@ -102,6 +102,7 @@
init_use_fds(insmod_t)
init_use_script_fds(insmod_t)
@@ -6921,18 +6930,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
fs_getattr_xattr_fs(depmod_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-2.6.4/policy/modules/system/mount.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-2.6.5/policy/modules/system/mount.fc
--- nsaserefpolicy/policy/modules/system/mount.fc 2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/mount.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/mount.fc 2007-05-18 11:59:15.000000000 -0400
@@ -1,4 +1,3 @@
/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
-
-/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0)
+/sbin/mount.ntfs-3g -- gen_context(system_u:object_r:mount_ntfs_exec_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-2.6.4/policy/modules/system/mount.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-2.6.5/policy/modules/system/mount.if
--- nsaserefpolicy/policy/modules/system/mount.if 2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/mount.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/mount.if 2007-05-18 11:59:15.000000000 -0400
@@ -143,3 +143,40 @@
mount_domtrans($1)
')
@@ -6974,9 +6983,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
+
+ allow $1 mount_ntfs_t:unix_stream_socket { read write };
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-2.6.4/policy/modules/system/mount.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-2.6.5/policy/modules/system/mount.te
--- nsaserefpolicy/policy/modules/system/mount.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/mount.te 2007-05-14 15:36:25.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/mount.te 2007-05-18 11:59:15.000000000 -0400
@@ -9,6 +9,13 @@
ifdef(`targeted_policy',`
##
@@ -7085,9 +7094,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
+ term_use_generic_ptys(mount_ntfs_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-2.6.4/policy/modules/system/netlabel.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-2.6.5/policy/modules/system/netlabel.te
--- nsaserefpolicy/policy/modules/system/netlabel.te 2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/netlabel.te 2007-05-15 21:07:39.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/netlabel.te 2007-05-18 11:59:15.000000000 -0400
@@ -20,6 +20,10 @@
allow netlabel_mgmt_t self:capability net_admin;
allow netlabel_mgmt_t self:netlink_socket create_socket_perms;
@@ -7099,9 +7108,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlab
kernel_read_network_state(netlabel_mgmt_t)
libs_use_ld_so(netlabel_mgmt_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-2.6.4/policy/modules/system/raid.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-2.6.5/policy/modules/system/raid.te
--- nsaserefpolicy/policy/modules/system/raid.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/raid.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/raid.te 2007-05-21 13:31:21.000000000 -0400
+@@ -19,7 +19,7 @@
+ # Local policy
+ #
+
+-allow mdadm_t self:capability { dac_override sys_admin ipc_lock };
++allow mdadm_t self:capability { dac_override mknod sys_admin ipc_lock };
+ dontaudit mdadm_t self:capability sys_tty_config;
+ allow mdadm_t self:process { sigchld sigkill sigstop signull signal };
+ allow mdadm_t self:fifo_file rw_fifo_file_perms;
@@ -46,6 +46,7 @@
# RAID block device access
storage_manage_fixed_disk(mdadm_t)
@@ -7110,9 +7128,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t
term_dontaudit_list_ptys(mdadm_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-2.6.4/policy/modules/system/selinuxutil.fc
---- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.fc 2007-05-08 09:59:33.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-2.6.5/policy/modules/system/selinuxutil.fc
+--- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-18 11:12:44.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/selinuxutil.fc 2007-05-18 11:59:15.000000000 -0400
@@ -40,6 +40,7 @@
/usr/sbin/setfiles.* -- gen_context(system_u:object_r:setfiles_exec_t,s0)
/usr/sbin/setsebool -- gen_context(system_u:object_r:semanage_exec_t,s0)
@@ -7121,10 +7139,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
/usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0)
#
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-2.6.4/policy/modules/system/selinuxutil.if
---- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.if 2007-05-08 09:59:33.000000000 -0400
-@@ -445,6 +445,7 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-2.6.5/policy/modules/system/selinuxutil.if
+--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-05-18 11:12:44.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/selinuxutil.if 2007-05-18 11:59:15.000000000 -0400
+@@ -432,6 +432,7 @@
role $2 types run_init_t;
allow run_init_t $3:chr_file rw_term_perms;
allow $2 system_r;
@@ -7132,38 +7150,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
')
########################################
-@@ -616,7 +617,7 @@
- gen_require(`
- type selinux_config_t;
- ')
--
-+ selinux_dontaudit_getattr_fs($1)
- dontaudit $1 selinux_config_t:dir search;
- dontaudit $1 selinux_config_t:file { getattr read };
- ')
-@@ -637,6 +638,8 @@
- type selinux_config_t;
- ')
-
-+ selinux_getattr_fs($1)
-+
- files_search_etc($1)
- allow $1 selinux_config_t:dir list_dir_perms;
- read_files_pattern($1,selinux_config_t,selinux_config_t)
-@@ -682,6 +685,7 @@
- ')
-
- files_search_etc($1)
-+ allow $1 selinux_config_t:dir rmdir;
- manage_files_pattern($1,selinux_config_t,selinux_config_t)
- read_lnk_files_pattern($1,selinux_config_t,selinux_config_t)
- ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-2.6.4/policy/modules/system/selinuxutil.te
---- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.te 2007-05-11 18:23:21.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-2.6.5/policy/modules/system/selinuxutil.te
+--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-05-18 11:12:44.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/selinuxutil.te 2007-05-18 11:59:15.000000000 -0400
@@ -1,10 +1,8 @@
- policy_module(selinuxutil,1.5.0)
+ policy_module(selinuxutil,1.5.1)
-ifdef(`strict_policy',`
- gen_require(`
@@ -7188,14 +7180,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
#
# default_context_t is the type applied to
-@@ -83,31 +79,34 @@
- type restorecon_exec_t;
- domain_obj_id_change_exemption(restorecon_t)
- init_system_domain(restorecon_t,restorecon_exec_t)
-+application_domain(restorecon_t,restorecon_exec_t)
- role system_r types restorecon_t;
-
- type restorecond_t;
+@@ -83,25 +79,27 @@
type restorecond_exec_t;
init_daemon_domain(restorecond_t,restorecond_exec_t)
domain_obj_id_change_exemption(restorecond_t)
@@ -7230,7 +7215,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
type semanage_store_t;
files_type(semanage_store_t)
-@@ -195,6 +194,7 @@
+@@ -115,9 +113,12 @@
+ files_type(semanage_trans_lock_t)
+
+ type setfiles_t alias restorecon_t, can_relabelto_binary_policy;
+-type setfiles_exec_t alias restorecon_exec_t;
+-init_system_domain(setfiles_t,setfiles_exec_t)
+ domain_obj_id_change_exemption(setfiles_t)
++domain_type(setfiles_t)
++role system_r types setfiles_t;
++
++type setfiles_exec_t;
++domain_entry_file(setfiles_t,setfiles_exec_t)
+
+ ifdef(`distro_redhat',`
+ init_system_domain(setfiles_t,setfiles_exec_t)
+@@ -186,6 +187,7 @@
fs_getattr_xattr_fs(load_policy_t)
mls_file_read_up(load_policy_t)
@@ -7238,7 +7238,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
selinux_get_fs_mount(load_policy_t)
selinux_load_policy(load_policy_t)
-@@ -217,7 +217,7 @@
+@@ -208,7 +210,7 @@
# cjp: cover up stray file descriptors.
dontaudit load_policy_t selinux_config_t:file write;
optional_policy(`
@@ -7247,7 +7247,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
')
')
-@@ -243,7 +243,7 @@
+@@ -234,7 +236,7 @@
allow newrole_t self:msg { send receive };
allow newrole_t self:unix_dgram_socket sendto;
allow newrole_t self:unix_stream_socket { create_stream_socket_perms connectto };
@@ -7256,7 +7256,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
read_files_pattern(newrole_t,selinux_config_t,selinux_config_t)
read_lnk_files_pattern(newrole_t,selinux_config_t,selinux_config_t)
-@@ -281,6 +281,7 @@
+@@ -272,6 +274,7 @@
term_dontaudit_use_unallocated_ttys(newrole_t)
auth_domtrans_chk_passwd(newrole_t)
@@ -7264,7 +7264,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
auth_rw_faillog(newrole_t)
corecmd_list_bin(newrole_t)
-@@ -310,15 +311,13 @@
+@@ -301,15 +304,13 @@
userdom_dontaudit_search_all_users_home_content(newrole_t)
userdom_search_all_users_home_dirs(newrole_t)
@@ -7287,22 +7287,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
tunable_policy(`allow_polyinstantiation',`
files_polyinstantiate_all(newrole_t)
-@@ -426,6 +425,14 @@
- hotplug_use_fds(restorecon_t)
- ')
-
-+optional_policy(`
-+ rpm_dontaudit_rw_tmp_files(restorecon_t)
-+')
-+
-+optional_policy(`
-+ xen_dontaudit_use_fds(restorecon_t)
-+')
-+
- ########################################
- #
- # Restorecond local policy
-@@ -490,7 +497,7 @@
+@@ -387,7 +388,7 @@
allow run_init_t self:process setexec;
allow run_init_t self:capability setuid;
allow run_init_t self:fifo_file rw_file_perms;
@@ -7311,7 +7296,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
# often the administrator runs such programs from a directory that is owned
# by a different user or has restrictive SE permissions, do not want to audit
-@@ -504,6 +511,7 @@
+@@ -401,6 +402,7 @@
term_dontaudit_list_ptys(run_init_t)
auth_domtrans_chk_passwd(run_init_t)
@@ -7319,7 +7304,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
auth_dontaudit_read_shadow(run_init_t)
corecmd_exec_bin(run_init_t)
-@@ -560,7 +568,7 @@
+@@ -457,7 +459,7 @@
allow semanage_t self:capability { dac_override audit_write };
allow semanage_t self:unix_stream_socket create_stream_socket_perms;
allow semanage_t self:unix_dgram_socket create_socket_perms;
@@ -7328,7 +7313,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
allow semanage_t policy_config_t:file { read write };
-@@ -571,7 +579,10 @@
+@@ -468,7 +470,10 @@
kernel_read_system_state(semanage_t)
kernel_read_kernel_sysctls(semanage_t)
@@ -7339,7 +7324,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
dev_read_urand(semanage_t)
-@@ -621,6 +632,15 @@
+@@ -518,6 +523,15 @@
userdom_search_sysadm_home_dirs(semanage_t)
@@ -7355,19 +7340,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
# cjp: need a more general way to handle this:
ifdef(`enable_mls',`
# read secadm tmp files
-@@ -700,6 +720,8 @@
- ifdef(`hide_broken_symptoms',`
- # cjp: cover up stray file descriptors.
- optional_policy(`
-- unconfined_dontaudit_read_pipes(setfiles_t)
-+ unconfined_dontaudit_rw_pipes(setfiles_t)
- ')
- ')
-+
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-2.6.4/policy/modules/system/sysnetwork.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-2.6.5/policy/modules/system/sysnetwork.te
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/sysnetwork.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/sysnetwork.te 2007-05-18 11:59:15.000000000 -0400
@@ -164,6 +164,10 @@
dbus_connect_system_bus(dhcpc_t)
dbus_send_system_bus(dhcpc_t)
@@ -7383,13 +7358,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
optional_policy(`
seutil_sigchld_newrole(dhcpc_t)
seutil_dontaudit_search_config(dhcpc_t)
-+ seutil_domtrans_restorecon(dhcpc_t)
++ seutil_domtrans_setfiles(dhcpc_t)
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-2.6.4/policy/modules/system/udev.te
---- nsaserefpolicy/policy/modules/system/udev.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/udev.te 2007-05-11 18:19:28.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-2.6.5/policy/modules/system/udev.te
+--- nsaserefpolicy/policy/modules/system/udev.te 2007-05-18 11:12:44.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/udev.te 2007-05-18 11:59:15.000000000 -0400
@@ -83,12 +83,19 @@
kernel_dgram_send(udev_t)
kernel_signal(udev_t)
@@ -7435,18 +7410,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-2.6.4/policy/modules/system/unconfined.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-2.6.5/policy/modules/system/unconfined.fc
--- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/unconfined.fc 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/unconfined.fc 2007-05-18 11:59:15.000000000 -0400
@@ -10,4 +10,5 @@
/usr/bin/valgrind -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
/usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
/usr/lib/ia32el/ia32x_loader -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
+/usr/bin/vmware.* -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-2.6.4/policy/modules/system/unconfined.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-2.6.5/policy/modules/system/unconfined.if
--- nsaserefpolicy/policy/modules/system/unconfined.if 2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/unconfined.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/unconfined.if 2007-05-18 11:59:15.000000000 -0400
@@ -18,7 +18,7 @@
')
@@ -7471,15 +7446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
kernel_unconfined($1)
corenet_unconfined($1)
-@@ -61,7 +61,6 @@
- # auditallow $1 self:process execstack;
- ')
-
--
- optional_policy(`
- auth_unconfined($1)
- ')
-@@ -78,6 +77,10 @@
+@@ -78,6 +78,10 @@
')
optional_policy(`
@@ -7490,7 +7457,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
nscd_unconfined($1)
')
-@@ -556,3 +559,22 @@
+@@ -556,3 +560,22 @@
allow $1 unconfined_t:dbus acquire_svc;
')
@@ -7513,9 +7480,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
+ allow $1 unconfined_t:process ptrace;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-2.6.4/policy/modules/system/unconfined.te
---- nsaserefpolicy/policy/modules/system/unconfined.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/unconfined.te 2007-05-16 08:28:37.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-2.6.5/policy/modules/system/unconfined.te
+--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-05-18 11:12:44.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/unconfined.te 2007-05-18 11:59:15.000000000 -0400
@@ -6,6 +6,15 @@
# Declarations
#
@@ -7598,9 +7565,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
dbus_stub(unconfined_execmem_t)
init_dbus_chat_script(unconfined_execmem_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.6.4/policy/modules/system/userdomain.if
---- nsaserefpolicy/policy/modules/system/userdomain.if 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/userdomain.if 2007-05-08 09:59:33.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.6.5/policy/modules/system/userdomain.if
+--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-05-18 11:12:44.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/userdomain.if 2007-05-18 11:59:15.000000000 -0400
@@ -114,6 +114,18 @@
# Allow making the stack executable via mprotect.
allow $1_t self:process execstack;
@@ -7721,7 +7688,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
kernel_getattr_message_if($1_t)
-@@ -1353,11 +1386,7 @@
+@@ -1352,11 +1385,7 @@
##
#
template(`userdom_role_change_generic_user',`
@@ -7734,7 +7701,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1384,11 +1413,7 @@
+@@ -1383,11 +1412,7 @@
##
#
template(`userdom_role_change_from_generic_user',`
@@ -7747,7 +7714,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1414,11 +1439,7 @@
+@@ -1413,11 +1438,7 @@
##
#
template(`userdom_role_change_staff',`
@@ -7760,7 +7727,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1445,11 +1466,7 @@
+@@ -1444,11 +1465,7 @@
##
#
template(`userdom_role_change_from_staff',`
@@ -7773,7 +7740,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1475,11 +1492,7 @@
+@@ -1474,11 +1491,7 @@
##
#
template(`userdom_role_change_sysadm',`
@@ -7786,7 +7753,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1506,11 +1519,7 @@
+@@ -1505,11 +1518,7 @@
##
#
template(`userdom_role_change_from_sysadm',`
@@ -7799,7 +7766,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1698,13 +1707,11 @@
+@@ -1697,13 +1706,11 @@
##
#
template(`userdom_setattr_user_ptys',`
@@ -7817,7 +7784,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1733,13 +1740,11 @@
+@@ -1732,13 +1739,11 @@
##
#
template(`userdom_create_user_pty',`
@@ -7835,7 +7802,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -3624,13 +3629,12 @@
+@@ -3623,13 +3628,12 @@
template(`userdom_setattr_user_ttys',`
ifdef(`targeted_policy',`
term_setattr_unallocated_ttys($2)
@@ -7854,7 +7821,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -3661,13 +3665,12 @@
+@@ -3660,13 +3664,12 @@
template(`userdom_use_user_ttys',`
ifdef(`targeted_policy',`
term_use_unallocated_ttys($2)
@@ -7873,7 +7840,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -3696,18 +3699,13 @@
+@@ -3695,18 +3698,13 @@
##
#
template(`userdom_use_user_terminals',`
@@ -7898,7 +7865,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -5353,14 +5351,13 @@
+@@ -5352,14 +5350,13 @@
interface(`userdom_use_unpriv_users_ptys',`
ifdef(`targeted_policy',`
term_use_generic_ptys($1)
@@ -7919,7 +7886,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -5377,13 +5374,13 @@
+@@ -5376,13 +5373,13 @@
interface(`userdom_dontaudit_use_unpriv_users_ptys',`
ifdef(`targeted_policy',`
term_dontaudit_use_generic_ptys($1)
@@ -7938,7 +7905,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -5436,13 +5433,12 @@
+@@ -5435,13 +5432,12 @@
interface(`userdom_list_unpriv_users_tmp',`
ifdef(`targeted_policy',`
files_list_tmp($1)
@@ -7957,7 +7924,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -5458,13 +5454,12 @@
+@@ -5457,13 +5453,12 @@
interface(`userdom_read_unpriv_users_tmp_files',`
ifdef(`targeted_policy',`
files_read_generic_tmp_files($1)
@@ -7976,7 +7943,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -5480,13 +5475,12 @@
+@@ -5479,13 +5474,12 @@
interface(`userdom_read_unpriv_users_tmp_symlinks',`
ifdef(`targeted_policy',`
files_read_generic_tmp_symlinks($1)
@@ -7995,7 +7962,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -5520,13 +5514,12 @@
+@@ -5519,13 +5513,12 @@
interface(`userdom_use_unpriv_users_ttys',`
ifdef(`targeted_policy',`
term_use_unallocated_ttys($1)
@@ -8014,7 +7981,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -5543,13 +5536,12 @@
+@@ -5542,13 +5535,12 @@
interface(`userdom_dontaudit_use_unpriv_users_ttys',`
ifdef(`targeted_policy',`
term_dontaudit_use_unallocated_ttys($1)
@@ -8033,7 +8000,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -5721,3 +5713,112 @@
+@@ -5720,3 +5712,112 @@
allow $1 user_home_dir_t:dir manage_dir_perms;
files_home_filetrans($1,user_home_dir_t,dir)
')
@@ -8146,9 +8113,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ allow $1 userdomain:process ptrace;
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.6.4/policy/modules/system/userdomain.te
---- nsaserefpolicy/policy/modules/system/userdomain.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/userdomain.te 2007-05-08 09:59:33.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.6.5/policy/modules/system/userdomain.te
+--- nsaserefpolicy/policy/modules/system/userdomain.te 2007-05-18 11:12:44.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/userdomain.te 2007-05-18 11:59:15.000000000 -0400
@@ -15,7 +15,6 @@
# Declarations
#
@@ -8325,9 +8292,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+tunable_policy(`allow_console_login', `
+ term_use_console(userdomain)
')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-2.6.4/policy/modules/system/xen.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-2.6.5/policy/modules/system/xen.if
--- nsaserefpolicy/policy/modules/system/xen.if 2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/system/xen.if 2007-05-14 15:38:19.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/xen.if 2007-05-18 11:59:15.000000000 -0400
@@ -72,12 +72,35 @@
')
@@ -8390,9 +8357,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if
+ read_files_pattern($1,xen_image_t,xen_image_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-2.6.4/policy/modules/system/xen.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-2.6.5/policy/modules/system/xen.te
--- nsaserefpolicy/policy/modules/system/xen.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/xen.te 2007-05-14 15:40:20.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/xen.te 2007-05-18 11:59:15.000000000 -0400
@@ -25,6 +25,10 @@
domain_type(xend_t)
init_daemon_domain(xend_t, xend_exec_t)
@@ -8496,9 +8463,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
+fs_read_nfs_files(xend_t)
+fs_getattr_all_fs(xend_t)
+fs_read_dos_files(xend_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-2.6.4/policy/support/misc_patterns.spt
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-2.6.5/policy/support/misc_patterns.spt
--- nsaserefpolicy/policy/support/misc_patterns.spt 2007-01-02 12:57:51.000000000 -0500
-+++ serefpolicy-2.6.4/policy/support/misc_patterns.spt 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/policy/support/misc_patterns.spt 2007-05-18 11:59:15.000000000 -0400
@@ -41,11 +41,6 @@
#
# Other process permissions
@@ -8511,9 +8478,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns
define(`ps_process_pattern',`
allow $1 $2:dir { search getattr read };
allow $1 $2:{ file lnk_file } { read getattr };
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-2.6.4/policy/support/obj_perm_sets.spt
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-2.6.5/policy/support/obj_perm_sets.spt
--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-05-04 12:19:23.000000000 -0400
-+++ serefpolicy-2.6.4/policy/support/obj_perm_sets.spt 2007-05-16 14:13:26.000000000 -0400
++++ serefpolicy-2.6.5/policy/support/obj_perm_sets.spt 2007-05-18 11:59:15.000000000 -0400
@@ -203,7 +203,6 @@
define(`add_entry_dir_perms',`{ getattr search lock ioctl write add_name }')
define(`del_entry_dir_perms',`{ getattr search lock ioctl write remove_name }')
@@ -8545,9 +8512,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
+define(`all_association', `{ sendto recvfrom setcontext polmatch } ')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-2.6.4/Rules.modular
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-2.6.5/Rules.modular
--- nsaserefpolicy/Rules.modular 2007-03-22 14:30:10.000000000 -0400
-+++ serefpolicy-2.6.4/Rules.modular 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.5/Rules.modular 2007-05-18 11:59:15.000000000 -0400
@@ -167,7 +167,7 @@
# these have to run individually because order matters:
$(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
diff --git a/selinux-policy.spec b/selinux-policy.spec
index e0b3c929..f559dc00 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -16,12 +16,12 @@
%define CHECKPOLICYVER 2.0.1-2
Summary: SELinux policy configuration
Name: selinux-policy
-Version: 2.6.4
-Release: 6%{?dist}
+Version: 2.6.5
+Release: 1%{?dist}
License: GPL
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
-patch: policy-20070501.patch
+patch: policy-20070518.patch
Source1: modules-targeted.conf
Source2: booleans-targeted.conf
Source3: Makefile.devel
@@ -168,7 +168,7 @@ fi;
%description
SELinux Reference Policy - modular.
-Based off of reference policy: Checked out revision 2282.
+Based off of reference policy: Checked out revision 2300.
%prep
%setup -q -n serefpolicy-%{version}
@@ -359,6 +359,11 @@ semodule -b base.pp -r bootloader -r clock -r dpkg -r fstools -r hotplug -r init
%endif
%changelog
+* Fri May 18 2007 Dan Walsh 2.6.5-1
+
+* Fri May 18 2007 Dan Walsh 2.6.4-7
+- Allow kerberos servers to use ldap for backing store
+
* Thu May 17 2007 Dan Walsh 2.6.4-6
- allow alsactl to read kernel state
diff --git a/sources b/sources
index 190097aa..4ad9163a 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-035120385d3629c367967f20db3f9cd6 serefpolicy-2.6.4.tgz
+15d095e645523b8d4aa36ee2f4093a2f serefpolicy-2.6.5.tgz