diff --git a/refpolicy/Changelog b/refpolicy/Changelog
index a78314e4..f11c1c4f 100644
--- a/refpolicy/Changelog
+++ b/refpolicy/Changelog
@@ -12,6 +12,7 @@
quota
su
sudo
+ tcpd
tmpreaper
updfstab
diff --git a/refpolicy/policy/modules/services/inetd.if b/refpolicy/policy/modules/services/inetd.if
index 5ec77b3f..062f13fa 100644
--- a/refpolicy/policy/modules/services/inetd.if
+++ b/refpolicy/policy/modules/services/inetd.if
@@ -131,3 +131,28 @@ interface(`inetd_tcp_connect',`
#allow inetd_t kernel_t:tcp_socket recvfrom;
#allow $1 kernel_t:tcp_socket recvfrom;
')
+
+########################################
+##
+## Run inetd child process in the inet child domain
+##
+##
+## Domain allowed access.
+##
+#
+interface(`inetd_domtrans_child',`
+ gen_require(`
+ type inetd_child_t, inetd_child_exec_t;
+ class process sigchld;
+ class fd use;
+ class fifo_file rw_file_perms;
+ ')
+
+ corecmd_search_sbin($1)
+ domain_auto_trans($1,inetd_child_exec_t,inetd_child_t)
+
+ allow $1 inetd_child_t:fd use;
+ allow inetd_child_t $1:fd use;
+ allow inetd_child_t $1:fifo_file rw_file_perms;
+ allow inetd_child_t $1:process sigchld;
+')
diff --git a/refpolicy/policy/modules/services/tcpd.fc b/refpolicy/policy/modules/services/tcpd.fc
new file mode 100644
index 00000000..bbc4094d
--- /dev/null
+++ b/refpolicy/policy/modules/services/tcpd.fc
@@ -0,0 +1,2 @@
+
+/usr/sbin/tcpd -- context_template(system_u:object_r:tcpd_exec_t,s0)
diff --git a/refpolicy/policy/modules/services/tcpd.if b/refpolicy/policy/modules/services/tcpd.if
new file mode 100644
index 00000000..1e5176f7
--- /dev/null
+++ b/refpolicy/policy/modules/services/tcpd.if
@@ -0,0 +1 @@
+## Policy for TCP daemon.
diff --git a/refpolicy/policy/modules/services/tcpd.te b/refpolicy/policy/modules/services/tcpd.te
new file mode 100644
index 00000000..d19db5f4
--- /dev/null
+++ b/refpolicy/policy/modules/services/tcpd.te
@@ -0,0 +1,56 @@
+
+policy_module(tcpd,1.0)
+
+########################################
+#
+# Declarations
+#
+type tcpd_t;
+type tcpd_exec_t;
+inetd_tcp_service_domain(tcpd_t,tcpd_exec_t)
+role system_r types tcpd_t;
+
+type tcpd_tmp_t;
+files_tmp_file(tcpd_tmp_t)
+
+########################################
+#
+# Local policy
+#
+allow tcpd_t self:tcp_socket create_stream_socket_perms;
+
+allow tcpd_t tcpd_tmp_t:dir create_dir_perms;
+allow tcpd_t tcpd_tmp_t:file create_file_perms;
+files_create_tmp_files(tcpd_t, tcpd_tmp_t, { file dir })
+
+corenet_raw_sendrecv_all_if(tcpd_t)
+corenet_tcp_sendrecv_all_if(tcpd_t)
+corenet_raw_sendrecv_all_nodes(tcpd_t)
+corenet_tcp_sendrecv_all_nodes(tcpd_t)
+corenet_tcp_sendrecv_all_ports(tcpd_t)
+corenet_tcp_bind_all_nodes(tcpd_t)
+
+fs_getattr_xattr_fs(tcpd_t)
+
+# Run other daemons in the inetd child domain.
+corecmd_search_bin(tcpd_t)
+corecmd_search_sbin(tcpd_t)
+
+files_read_etc_files(tcpd_t)
+# no good reason for files_dontaudit_search_var, probably nscd
+files_dontaudit_search_var(tcpd_t)
+
+libs_use_ld_so(tcpd_t)
+libs_use_shared_libs(tcpd_t)
+
+logging_send_syslog_msg(tcpd_t)
+
+miscfiles_read_localization(tcpd_t)
+
+sysnet_read_config(tcpd_t)
+
+inetd_domtrans_child(tcpd_t)
+
+optional_policy(`nis.te',`
+ nis_use_ypbind(tcpd_t)
+')