##
## Allow qemu to connect fully to the network
-@@ -13,28 +15,151 @@
+@@ -13,28 +15,153 @@
##
gen_tunable(qemu_full_network, false)
@@ -3799,6 +3800,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+storage_raw_write_removable_device(qemu_t)
+storage_raw_read_removable_device(qemu_t)
++
++userdom_search_user_home_content(qemu_t)
+
tunable_policy(`qemu_full_network',`
allow qemu_t self:udp_socket create_socket_perms;
@@ -5158,7 +5161,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## all protocols (TCP, UDP, etc)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.6.3/policy/modules/kernel/domain.te
--- nsaserefpolicy/policy/modules/kernel/domain.te 2009-01-05 15:39:38.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/kernel/domain.te 2009-01-19 13:10:02.000000000 -0500
++++ serefpolicy-3.6.3/policy/modules/kernel/domain.te 2009-01-30 07:56:48.000000000 -0500
@@ -5,6 +5,13 @@
#
# Declarations
@@ -5220,7 +5223,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow unconfined_domain_type domain:lnk_file { read_lnk_file_perms ioctl lock };
# act on all domains keys
-@@ -153,3 +170,39 @@
+@@ -153,3 +170,34 @@
# receive from all domains over labeled networking
domain_all_recvfrom_all_domains(unconfined_domain_type)
@@ -5234,15 +5237,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ cron_dontaudit_write_system_job_tmp_files(domain)
+ cron_rw_pipes(domain)
+ifdef(`hide_broken_symptoms',`
-+ cron_dontaudit_rw_tcp_sockets(domain)
+ allow domain domain:key { link search };
+')
+')
+
-+ifdef(`hide_broken_symptoms',`
-+ dbus_dontaudit_system_bus_rw_tcp_sockets(domain)
-+')
-+
+optional_policy(`
+ rpm_rw_pipes(domain)
+ rpm_dontaudit_use_script_fds(domain)
@@ -17626,7 +17624,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/usr/sbin/postkick -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.6.3/policy/modules/services/postfix.if
--- nsaserefpolicy/policy/modules/services/postfix.if 2009-01-19 11:06:49.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/services/postfix.if 2009-01-19 13:10:02.000000000 -0500
++++ serefpolicy-3.6.3/policy/modules/services/postfix.if 2009-01-30 08:30:01.000000000 -0500
@@ -46,6 +46,7 @@
allow postfix_$1_t postfix_etc_t:dir list_dir_perms;
@@ -17647,7 +17645,33 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_search_etc($1)
')
-@@ -378,7 +378,7 @@
+@@ -232,6 +232,25 @@
+
+ ########################################
+ ##