- Add tgtd policy

modules-minimum.conf

@@ -232,6 +232,13 @@ certwatch = module
 # 
 certmaster = module
 
+# Layer: services
+# Module: certmonger
+#
+# Certificate status monitor and PKI enrollment client
+# 
+certmonger = module
+
 # Layer: services
 # Module: cipe
 #
@@ -1555,6 +1562,13 @@ sysstat = module
 # 
 tcpd = module
 
+# Layer: services
+# Module: tgtd
+#
+# Linux Target Framework Daemon.
+# 
+tgtd = module
+
 # Layer: system
 # Module: udev
 #
@@ -1579,7 +1593,7 @@ unconfined = module
 # Layer: services
 # Module: ulogd
 #
-# 
+# netfilter/iptables ULOG daemon
 # 
 ulogd = module
 

modules-mls.conf

@@ -1372,6 +1372,13 @@ sysstat = module
 # 
 tcpd = module
 
+# Layer: services
+# Module: tgtd
+#
+# Linux Target Framework Daemon.
+# 
+tgtd = module
+
 # Layer: system
 # Module: udev
 #

modules-targeted.conf

@@ -232,6 +232,13 @@ certwatch = module
 # 
 certmaster = module
 
+# Layer: services
+# Module: certmonger
+#
+# Certificate status monitor and PKI enrollment client
+# 
+certmonger = module
+
 # Layer: services
 # Module: cipe
 #
@@ -1555,6 +1562,13 @@ sysstat = module
 # 
 tcpd = module
 
+# Layer: services
+# Module: tgtd
+#
+# Linux Target Framework Daemon.
+# 
+tgtd = module
+
 # Layer: system
 # Module: udev
 #
@@ -1579,7 +1593,7 @@ unconfined = module
 # Layer: services
 # Module: ulogd
 #
-# 
+# netfilter/iptables ULOG daemon
 # 
 ulogd = module
 

policy-F13.patch

@@ -1789,7 +1789,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ########################################
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.7.4/policy/modules/admin/tmpreaper.te
 --- nsaserefpolicy/policy/modules/admin/tmpreaper.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.4/policy/modules/admin/tmpreaper.te	2009-12-04 12:33:34.000000000 -0500
++++ serefpolicy-3.7.4/policy/modules/admin/tmpreaper.te	2009-12-11 15:00:25.000000000 -0500
 @@ -42,6 +42,7 @@
  cron_system_entry(tmpreaper_t, tmpreaper_exec_t)
  
@@ -1798,11 +1798,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	userdom_delete_user_home_content_dirs(tmpreaper_t)
  	userdom_delete_user_home_content_files(tmpreaper_t)
  	userdom_delete_user_home_content_symlinks(tmpreaper_t)
-@@ -52,6 +53,11 @@
+@@ -52,6 +53,12 @@
  ')
  
  optional_policy(`
 +	apache_delete_sys_content_rw(tmpreaper_t)
++	apache_list_cache(tmpreaper_t)
 +	apache_delete_cache(tmpreaper_t)
 +')
 +
@@ -1810,7 +1811,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	kismet_manage_log(tmpreaper_t)
  ')
  
-@@ -60,5 +66,9 @@
+@@ -60,5 +67,9 @@
  ')
  
  optional_policy(`
@@ -3562,7 +3563,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.7.4/policy/modules/apps/mozilla.te
 --- nsaserefpolicy/policy/modules/apps/mozilla.te	2009-12-04 09:43:33.000000000 -0500
-+++ serefpolicy-3.7.4/policy/modules/apps/mozilla.te	2009-12-10 15:39:39.000000000 -0500
++++ serefpolicy-3.7.4/policy/modules/apps/mozilla.te	2009-12-11 09:38:55.000000000 -0500
 @@ -91,6 +91,7 @@
  corenet_raw_sendrecv_generic_node(mozilla_t)
  corenet_tcp_sendrecv_http_port(mozilla_t)
@@ -6142,7 +6143,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  #network_node(multicast, s0 - mls_systemhigh, ff00::, ff00::)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.7.4/policy/modules/kernel/devices.if
 --- nsaserefpolicy/policy/modules/kernel/devices.if	2009-11-20 10:51:41.000000000 -0500
-+++ serefpolicy-3.7.4/policy/modules/kernel/devices.if	2009-12-10 14:19:30.000000000 -0500
++++ serefpolicy-3.7.4/policy/modules/kernel/devices.if	2009-12-11 14:54:55.000000000 -0500
 @@ -783,6 +783,24 @@
  
  ########################################
@@ -7067,8 +7068,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.7.4/policy/modules/kernel/files.te
 --- nsaserefpolicy/policy/modules/kernel/files.te	2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.7.4/policy/modules/kernel/files.te	2009-12-04 12:33:34.000000000 -0500
-@@ -43,6 +43,7 @@
++++ serefpolicy-3.7.4/policy/modules/kernel/files.te	2009-12-11 09:33:22.000000000 -0500
+@@ -12,6 +12,7 @@
+ attribute mountpoint;
+ attribute pidfile;
+ attribute configfile;
++attribute etcfile;
+ 
+ # For labeling types that are to be polyinstantiated
+ attribute polydir;
+@@ -43,6 +44,7 @@
  #
  type boot_t;
  files_mountpoint(boot_t)
@@ -7076,7 +7085,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  # default_t is the default type for files that do not
  # match any specification in the file_contexts configuration
-@@ -194,6 +195,7 @@
+@@ -194,6 +196,7 @@
  fs_associate_noxattr(file_type)
  fs_associate_tmpfs(file_type)
  fs_associate_ramfs(file_type)
@@ -7757,7 +7766,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.te serefpolicy-3.7.4/policy/modules/roles/sysadm.te
 --- nsaserefpolicy/policy/modules/roles/sysadm.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.4/policy/modules/roles/sysadm.te	2009-12-09 08:29:51.000000000 -0500
++++ serefpolicy-3.7.4/policy/modules/roles/sysadm.te	2009-12-11 15:18:11.000000000 -0500
 @@ -15,7 +15,7 @@
  
  role sysadm_r;
@@ -7800,7 +7809,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	backup_run(sysadm_t, sysadm_r)
  ')
  
-@@ -99,18 +97,10 @@
+@@ -99,15 +97,11 @@
  ')
  
  optional_policy(`
@@ -7813,13 +7822,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  optional_policy(`
 -	cdrecord_role(sysadm_r, sysadm_t)
--')
--
--optional_policy(`
- 	certwatch_run(sysadm_t, sysadm_r)
++	certmonger_dbus_chat(sysadm_t)
  ')
  
-@@ -127,7 +117,7 @@
+ optional_policy(`
+@@ -127,7 +121,7 @@
  ')
  
  optional_policy(`
@@ -7828,7 +7835,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -135,10 +125,6 @@
+@@ -135,10 +129,6 @@
  ')
  
  optional_policy(`
@@ -7839,7 +7846,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	dcc_run_cdcc(sysadm_t, sysadm_r)
  	dcc_run_client(sysadm_t, sysadm_r)
  	dcc_run_dbclean(sysadm_t, sysadm_r)
-@@ -166,10 +152,6 @@
+@@ -166,10 +156,6 @@
  ')
  
  optional_policy(`
@@ -7850,7 +7857,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	firstboot_run(sysadm_t, sysadm_r)
  ')
  
-@@ -178,22 +160,6 @@
+@@ -178,22 +164,6 @@
  ')
  
  optional_policy(`
@@ -7873,7 +7880,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	hostname_run(sysadm_t, sysadm_r)
  ')
  
-@@ -205,6 +171,9 @@
+@@ -205,6 +175,9 @@
  	ipsec_stream_connect(sysadm_t)
  	# for lsof
  	ipsec_getattr_key_sockets(sysadm_t)
@@ -7883,7 +7890,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -212,11 +181,7 @@
+@@ -212,11 +185,7 @@
  ')
  
  optional_policy(`
@@ -7896,7 +7903,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -228,10 +193,6 @@
+@@ -228,10 +197,6 @@
  ')
  
  optional_policy(`
@@ -7907,7 +7914,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	logrotate_run(sysadm_t, sysadm_r)
  ')
  
-@@ -255,14 +216,6 @@
+@@ -255,14 +220,6 @@
  ')
  
  optional_policy(`
@@ -7922,7 +7929,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	mta_role(sysadm_r, sysadm_t)
  ')
  
-@@ -290,11 +243,6 @@
+@@ -290,11 +247,6 @@
  ')
  
  optional_policy(`
@@ -7934,7 +7941,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	pcmcia_run_cardctl(sysadm_t, sysadm_r)
  ')
  
-@@ -308,7 +256,7 @@
+@@ -308,7 +260,7 @@
  ')
  
  optional_policy(`
@@ -7943,7 +7950,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -320,10 +268,6 @@
+@@ -320,10 +272,6 @@
  ')
  
  optional_policy(`
@@ -7954,7 +7961,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	rpc_domtrans_nfsd(sysadm_t)
  ')
  
-@@ -332,10 +276,6 @@
+@@ -332,10 +280,6 @@
  ')
  
  optional_policy(`
@@ -7965,7 +7972,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	rsync_exec(sysadm_t)
  ')
  
-@@ -345,10 +285,6 @@
+@@ -345,10 +289,6 @@
  ')
  
  optional_policy(`
@@ -7976,7 +7983,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	secadm_role_change(sysadm_r)
  ')
  
-@@ -358,35 +294,15 @@
+@@ -358,35 +298,15 @@
  ')
  
  optional_policy(`
@@ -8012,7 +8019,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	tripwire_run_siggen(sysadm_t, sysadm_r)
  	tripwire_run_tripwire(sysadm_t, sysadm_r)
  	tripwire_run_twadmin(sysadm_t, sysadm_r)
-@@ -394,18 +310,10 @@
+@@ -394,18 +314,10 @@
  ')
  
  optional_policy(`
@@ -8031,7 +8038,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	unconfined_domtrans(sysadm_t)
  ')
  
-@@ -418,17 +326,13 @@
+@@ -418,17 +330,13 @@
  ')
  
  optional_policy(`
@@ -8050,7 +8057,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -440,13 +343,16 @@
+@@ -440,13 +347,16 @@
  ')
  
  optional_policy(`
@@ -8084,7 +8091,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.if serefpolicy-3.7.4/policy/modules/roles/unconfineduser.if
 --- nsaserefpolicy/policy/modules/roles/unconfineduser.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.7.4/policy/modules/roles/unconfineduser.if	2009-12-04 12:33:34.000000000 -0500
++++ serefpolicy-3.7.4/policy/modules/roles/unconfineduser.if	2009-12-11 11:30:20.000000000 -0500
 @@ -0,0 +1,667 @@
 +## <summary>Unconfiend user role</summary>
 +
@@ -9634,7 +9641,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	All of the rules required to administrate 
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.te serefpolicy-3.7.4/policy/modules/services/abrt.te
 --- nsaserefpolicy/policy/modules/services/abrt.te	2009-09-16 09:09:20.000000000 -0400
-+++ serefpolicy-3.7.4/policy/modules/services/abrt.te	2009-12-10 13:04:52.000000000 -0500
++++ serefpolicy-3.7.4/policy/modules/services/abrt.te	2009-12-11 11:26:03.000000000 -0500
 @@ -33,12 +33,25 @@
  type abrt_var_run_t;
  files_pid_file(abrt_var_run_t)
@@ -10225,7 +10232,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.7.4/policy/modules/services/apache.if
 --- nsaserefpolicy/policy/modules/services/apache.if	2009-07-28 15:51:13.000000000 -0400
-+++ serefpolicy-3.7.4/policy/modules/services/apache.if	2009-12-04 12:33:34.000000000 -0500
++++ serefpolicy-3.7.4/policy/modules/services/apache.if	2009-12-11 15:00:30.000000000 -0500
 @@ -13,21 +13,16 @@
  #
  template(`apache_content_template',`
@@ -10548,10 +10555,29 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	TCP sockets.
  ## </summary>
  ## <param name="domain">
-@@ -503,6 +462,67 @@
+@@ -503,6 +462,86 @@
  
  ########################################
  ## <summary>
++##	Allow the specified domain to list
++##	Apache cache.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`apache_list_cache',`
++	gen_require(`
++		type httpd_cache_t;
++	')
++
++	list_dirs_pattern($1, httpd_cache_t, httpd_cache_t)
++')
++
++########################################
++## <summary>
 +##	Allow the specified domain to delete
 +##	Apache cache.
 +## </summary>
@@ -10616,7 +10642,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	Allow the specified domain to read
  ##	apache configuration files.
  ## </summary>
-@@ -579,7 +599,7 @@
+@@ -579,7 +618,7 @@
  ## </param>
  ## <param name="role">
  ##	<summary>
@@ -10625,7 +10651,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	</summary>
  ## </param>
  ## <rolecap/>
-@@ -715,6 +735,7 @@
+@@ -715,6 +754,7 @@
  	')
  
  	allow $1 httpd_modules_t:dir list_dir_perms;
@@ -10633,7 +10659,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  ########################################
-@@ -782,6 +803,32 @@
+@@ -782,6 +822,32 @@
  
  ########################################
  ## <summary>
@@ -10666,7 +10692,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	Execute all web scripts in the system
  ##	script domain.
  ## </summary>
-@@ -791,16 +838,18 @@
+@@ -791,16 +857,18 @@
  ##	</summary>
  ## </param>
  #
@@ -10689,7 +10715,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	')
  ')
  
-@@ -859,6 +908,8 @@
+@@ -859,6 +927,8 @@
  ##	</summary>
  ## </param>
  #
@@ -10698,7 +10724,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  interface(`apache_run_all_scripts',`
  	gen_require(`
  		attribute httpd_exec_scripts, httpd_script_domains;
-@@ -884,7 +935,7 @@
+@@ -884,7 +954,7 @@
  		type httpd_squirrelmail_t;
  	')
  
@@ -10707,7 +10733,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  ########################################
-@@ -1043,6 +1094,44 @@
+@@ -1043,6 +1113,44 @@
  
  ########################################
  ## <summary>
@@ -10752,7 +10778,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	All of the rules required to administrate an apache environment
  ## </summary>
  ## <param name="prefix">
-@@ -1072,11 +1161,17 @@
+@@ -1072,11 +1180,17 @@
  		type httpd_modules_t, httpd_lock_t;
  		type httpd_var_run_t, httpd_php_tmp_t;
  		type httpd_suexec_tmp_t, httpd_tmp_t;
@@ -10770,7 +10796,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	apache_manage_all_content($1)
  	miscfiles_manage_public_files($1)
  
-@@ -1096,12 +1191,57 @@
+@@ -1096,12 +1210,57 @@
  
  	kernel_search_proc($1)
  	allow $1 httpd_t:dir list_dir_perms;
@@ -12003,7 +12029,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	All of the rules required to administrate 
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.7.4/policy/modules/services/bluetooth.te
 --- nsaserefpolicy/policy/modules/services/bluetooth.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.4/policy/modules/services/bluetooth.te	2009-12-04 12:33:34.000000000 -0500
++++ serefpolicy-3.7.4/policy/modules/services/bluetooth.te	2009-12-11 14:46:18.000000000 -0500
 @@ -54,9 +54,9 @@
  # Bluetooth services local policy
  #
@@ -12174,6 +12200,315 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow certmaster_t self:tcp_socket create_stream_socket_perms;
  
  # config files
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.fc serefpolicy-3.7.4/policy/modules/services/certmonger.fc
+--- nsaserefpolicy/policy/modules/services/certmonger.fc	1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.7.4/policy/modules/services/certmonger.fc	2009-12-11 14:28:45.000000000 -0500
+@@ -0,0 +1,6 @@
++/etc/rc\.d/init\.d/certmonger	--	gen_context(system_u:object_r:certmonger_initrc_exec_t,s0)
++
++/usr/sbin/certmonger	--	gen_context(system_u:object_r:certmonger_exec_t,s0)
++
++/var/run/certmonger.pid		--	gen_context(system_u:object_r:certmonger_var_run_t,s0)
++/var/lib/certmonger(/.*)?			gen_context(system_u:object_r:certmonger_var_lib_t,s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.if serefpolicy-3.7.4/policy/modules/services/certmonger.if
+--- nsaserefpolicy/policy/modules/services/certmonger.if	1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.7.4/policy/modules/services/certmonger.if	2009-12-11 14:32:30.000000000 -0500
+@@ -0,0 +1,217 @@
++
++## <summary>Certificate status monitor and PKI enrollment client</summary>
++
++########################################
++## <summary>
++##	Execute a domain transition to run certmonger.
++## </summary>
++## <param name="domain">
++## <summary>
++##	Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`certmonger_domtrans',`
++	gen_require(`
++		type certmonger_t, certmonger_exec_t;
++	')
++
++	domtrans_pattern($1, certmonger_exec_t, certmonger_t)
++')
++
++
++########################################
++## <summary>
++##	Execute certmonger server in the certmonger domain.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	The type of the process performing this action.
++##	</summary>
++## </param>
++#
++interface(`certmonger_initrc_domtrans',`
++	gen_require(`
++		type certmonger_initrc_exec_t;
++	')
++
++	init_labeled_script_domtrans($1, certmonger_initrc_exec_t)
++')
++
++########################################
++## <summary>
++##	Read certmonger PID files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`certmonger_read_pid_files',`
++	gen_require(`
++		type certmonger_var_run_t;
++	')
++
++	files_search_pids($1)
++	allow $1 certmonger_var_run_t:file read_file_perms;
++')
++
++########################################
++## <summary>
++##	Manage certmonger var_run files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`certmonger_manage_var_run',`
++	gen_require(`
++		type certmonger_var_run_t;
++	')
++
++         manage_dirs_pattern($1, certmonger_var_run_t, certmonger_var_run_t)
++         manage_files_pattern($1, certmonger_var_run_t, certmonger_var_run_t)
++         manage_lnk_files_pattern($1, certmonger_var_run_t, certmonger_var_run_t)
++')
++
++
++########################################
++## <summary>
++##	Search certmonger lib directories.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`certmonger_search_lib',`
++	gen_require(`
++		type certmonger_var_lib_t;
++	')
++
++	allow $1 certmonger_var_lib_t:dir search_dir_perms;
++	files_search_var_lib($1)
++')
++
++########################################
++## <summary>
++##	Read certmonger lib files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`certmonger_read_lib_files',`
++	gen_require(`
++		type certmonger_var_lib_t;
++	')
++
++	files_search_var_lib($1)
++        read_files_pattern($1, certmonger_var_lib_t, certmonger_var_lib_t)
++')
++
++########################################
++## <summary>
++##	Create, read, write, and delete
++##	certmonger lib files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`certmonger_manage_lib_files',`
++	gen_require(`
++		type certmonger_var_lib_t;
++	')
++
++	files_search_var_lib($1)
++        manage_files_pattern($1, certmonger_var_lib_t,  certmonger_var_lib_t)
++')
++
++########################################
++## <summary>
++##	Manage certmonger var_lib files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`certmonger_manage_var_lib',`
++	gen_require(`
++		type certmonger_var_lib_t;
++	')
++
++         manage_dirs_pattern($1, certmonger_var_lib_t, certmonger_var_lib_t)
++         manage_files_pattern($1, certmonger_var_lib_t, certmonger_var_lib_t)
++         manage_lnk_files_pattern($1, certmonger_var_lib_t, certmonger_var_lib_t)
++')
++
++
++########################################
++## <summary>
++##	Send and receive messages from
++##	certmonger over dbus.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`certmonger_dbus_chat',`
++	gen_require(`
++		type certmonger_t;
++		class dbus send_msg;
++	')
++
++	allow $1 certmonger_t:dbus send_msg;
++	allow certmonger_t $1:dbus send_msg;
++')
++
++########################################
++## <summary>
++##	All of the rules required to administrate 
++##	an certmonger environment
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++## <param name="role">
++##	<summary>
++##	Role allowed access.
++##	</summary>
++## </param>
++## <rolecap/>
++#
++interface(`certmonger_admin',`
++	gen_require(`
++		type certmonger_t, certmonger_initrc_exec_t;
++	')
++
++	allow $1 certmonger_t:process { ptrace signal_perms getattr };
++	read_files_pattern($1, certmonger_t, certmonger_t)
++
++	# Allow certmonger_t to restart the apache service
++	certmonger_initrc_domtrans($1)
++	domain_system_change_exemption($1)
++	role_transition $2 certmonger_initrc_exec_t system_r;
++	allow $2 system_r;
++
++	files_search_var_lib($1)
++	admin_pattern($1, cermonger_var_lib_t)
++
++	files_search_pids($1)
++	admin_pattern($1, cermonger_var_run_t)
++')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.te serefpolicy-3.7.4/policy/modules/services/certmonger.te
+--- nsaserefpolicy/policy/modules/services/certmonger.te	1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.7.4/policy/modules/services/certmonger.te	2009-12-11 14:28:19.000000000 -0500
+@@ -0,0 +1,74 @@
++policy_module(certmonger,1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type certmonger_t;
++type certmonger_exec_t;
++init_daemon_domain(certmonger_t, certmonger_exec_t)
++
++permissive certmonger_t;
++
++type certmonger_initrc_exec_t;
++init_script_file(certmonger_initrc_exec_t)
++
++type certmonger_var_run_t;
++files_pid_file(certmonger_var_run_t)
++
++type certmonger_var_lib_t;
++files_type(certmonger_var_lib_t)
++
++########################################
++#
++# certmonger local policy
++#
++
++allow certmonger_t self:capability { kill sys_nice };
++allow certmonger_t self:process { fork getsched setsched sigkill };
++allow certmonger_t self:fifo_file rw_file_perms;
++allow certmonger_t self:unix_stream_socket create_stream_socket_perms;
++allow certmonger_t self:tcp_socket create_stream_socket_perms;
++allow certmonger_t self:netlink_route_socket r_netlink_socket_perms;
++
++manage_dirs_pattern(certmonger_t, certmonger_var_run_t,  certmonger_var_run_t)
++manage_files_pattern(certmonger_t, certmonger_var_run_t,  certmonger_var_run_t)
++files_pid_filetrans(certmonger_t, certmonger_var_run_t, { file dir })
++
++manage_dirs_pattern(certmonger_t, certmonger_var_lib_t,  certmonger_var_lib_t)
++manage_files_pattern(certmonger_t, certmonger_var_lib_t,  certmonger_var_lib_t)
++files_var_lib_filetrans(certmonger_t, certmonger_var_lib_t, { file dir } )
++
++domain_use_interactive_fds(certmonger_t)
++
++corenet_tcp_sendrecv_generic_if(certmonger_t)
++corenet_tcp_sendrecv_generic_node(certmonger_t)
++corenet_tcp_sendrecv_all_ports(certmonger_t)
++corenet_tcp_connect_certmaster_port(certmonger_t)
++
++dev_read_urand(certmonger_t)
++
++files_read_etc_files(certmonger_t)
++files_read_usr_files(certmonger_t)
++files_list_tmp(certmonger_t)
++
++miscfiles_read_localization(certmonger_t)
++miscfiles_manage_cert_files(certmonger_t)
++
++logging_send_syslog_msg(certmonger_t)
++
++sysnet_dns_name_resolve(certmonger_t)
++
++optional_policy(`
++	dbus_system_bus_client(certmonger_t)
++	dbus_connect_system_bus(certmonger_t)
++')
++
++optional_policy(`
++	kerberos_use(certmonger_t)
++')
++
++optional_policy(`
++	unconfined_dbus_send(certmonger_t)
++')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chronyd.fc serefpolicy-3.7.4/policy/modules/services/chronyd.fc
 --- nsaserefpolicy/policy/modules/services/chronyd.fc	1969-12-31 19:00:00.000000000 -0500
 +++ serefpolicy-3.7.4/policy/modules/services/chronyd.fc	2009-12-04 12:33:34.000000000 -0500
@@ -24440,7 +24775,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.7.4/policy/modules/services/virt.te
 --- nsaserefpolicy/policy/modules/services/virt.te	2009-11-17 10:54:26.000000000 -0500
-+++ serefpolicy-3.7.4/policy/modules/services/virt.te	2009-12-04 12:33:34.000000000 -0500
++++ serefpolicy-3.7.4/policy/modules/services/virt.te	2009-12-11 14:52:36.000000000 -0500
 @@ -20,6 +20,28 @@
  ## </desc>
  gen_tunable(virt_use_samba, false)
@@ -24486,7 +24821,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  type virt_log_t;
  logging_log_file(virt_log_t)
  
-@@ -48,27 +75,55 @@
+@@ -48,27 +75,56 @@
  type virtd_initrc_exec_t;
  init_script_file(virtd_initrc_exec_t)
  
@@ -24520,6 +24855,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow virtd_t self:tcp_socket create_stream_socket_perms;
 -allow virtd_t self:tun_socket create;
 +allow virtd_t self:tun_socket create_socket_perms;
++allow virtd_t self:netlink_kobject_uevent_socket create_socket_perms;
 +
 +allow virtd_t virt_domain:process { getattr getsched setsched transition signal signull sigkill };
  
@@ -24546,7 +24882,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t)
  manage_files_pattern(virtd_t, virt_log_t, virt_log_t)
-@@ -76,6 +131,7 @@
+@@ -76,6 +132,7 @@
  
  manage_dirs_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t)
  manage_files_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t)
@@ -24554,7 +24890,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  files_var_lib_filetrans(virtd_t, virt_var_lib_t, { file dir })
  
  manage_dirs_pattern(virtd_t, virt_var_run_t, virt_var_run_t)
-@@ -86,7 +142,8 @@
+@@ -86,7 +143,8 @@
  kernel_read_system_state(virtd_t)
  kernel_read_network_state(virtd_t)
  kernel_rw_net_sysctls(virtd_t)
@@ -24564,7 +24900,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  corecmd_exec_bin(virtd_t)
  corecmd_exec_shell(virtd_t)
-@@ -97,30 +154,50 @@
+@@ -97,40 +155,75 @@
  corenet_tcp_sendrecv_generic_node(virtd_t)
  corenet_tcp_sendrecv_all_ports(virtd_t)
  corenet_tcp_bind_generic_node(virtd_t)
@@ -24576,10 +24912,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  corenet_rw_tun_tap_dev(virtd_t)
  
 -dev_read_sysfs(virtd_t)
-+dev_rw_sysfs(virtd_t)
++dev_getattr_all_chr_files(virtd_t)
  dev_read_rand(virtd_t)
 +dev_rw_kvm(virtd_t)
-+dev_getattr_all_chr_files(virtd_t)
++dev_rw_mtrr(virtd_t)
++dev_rw_sysfs(virtd_t)
  
  # Init script handling
  domain_use_interactive_fds(virtd_t)
@@ -24618,14 +24955,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  term_use_ptmx(virtd_t)
  
  auth_use_nsswitch(virtd_t)
-@@ -128,9 +205,22 @@
- miscfiles_read_localization(virtd_t)
- miscfiles_read_certs(virtd_t)
  
+-miscfiles_read_localization(virtd_t)
+ miscfiles_read_certs(virtd_t)
++miscfiles_read_hwdata(virtd_t)
++miscfiles_read_localization(virtd_t)
++
 +modutils_read_module_deps(virtd_t)
 +modutils_read_module_config(virtd_t)
 +modutils_manage_module_config(virtd_t)
-+
+ 
  logging_send_syslog_msg(virtd_t)
  
 +sysnet_domtrans_ifconfig(virtd_t)
@@ -24641,7 +24980,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  tunable_policy(`virt_use_nfs',`
  	fs_manage_nfs_dirs(virtd_t)
-@@ -168,22 +258,36 @@
+@@ -168,22 +261,36 @@
  	dnsmasq_domtrans(virtd_t)
  	dnsmasq_signal(virtd_t)
  	dnsmasq_kill(virtd_t)
@@ -24652,6 +24991,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  optional_policy(`
  	iptables_domtrans(virtd_t)
 +	iptables_initrc_domtrans(virtd_t)
++')
++
++optional_policy(`
++	kerberos_keytab_template(virtd, virtd_t)
  ')
  
 -#optional_policy(`
@@ -24659,11 +25002,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 -#	polkit_domtrans_resolve(virtd_t)
 -#')
 +optional_policy(`
-+	kerberos_keytab_template(virtd, virtd_t)
-+')
- 
- optional_policy(`
--	qemu_domtrans(virtd_t)
 +	lvm_domtrans(virtd_t)
 +')
 +
@@ -24673,8 +25011,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	policykit_domtrans_resolve(virtd_t)
 +	policykit_read_lib(virtd_t)
 +')
-+
-+optional_policy(`
+ 
+ optional_policy(`
+-	qemu_domtrans(virtd_t)
 +	qemu_spec_domtrans(virtd_t, svirt_t)
  	qemu_read_state(virtd_t)
  	qemu_signal(virtd_t)
@@ -24683,7 +25022,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -196,8 +300,152 @@
+@@ -196,8 +303,152 @@
  
  	xen_stream_connect(virtd_t)
  	xen_stream_connect_xenstore(virtd_t)

selinux-policy.spec

@@ -13,14 +13,14 @@
 %if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}
 %define BUILD_MLS 1
 %endif
-%define POLICYVER 23
-%define libsepolver 2.0.20-1
-%define POLICYCOREUTILSVER 2.0.71-2
-%define CHECKPOLICYVER 2.0.16-3
+%define POLICYVER 24
+%define libsepolver 2.0.41-1
+%define POLICYCOREUTILSVER 2.0.78-3
+%define CHECKPOLICYVER 2.0.21-1
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.7.4
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -181,7 +181,7 @@ FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
 selinuxenabled; \
 if [ $? = 0  -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \
 	fixfiles -C ${FILE_CONTEXT}.pre restore; \
-	restorecon -R /var/log /var/run 2> /dev/null; \
+        restorecon -R /root /var/log /var/run /var/lib 2> /dev/null;\
 	rm -f ${FILE_CONTEXT}.pre; \
 fi; 
 
@@ -317,7 +317,7 @@ SELinux Reference policy targeted base module.
 if [ $1 -eq 1 ]; then
    packages="%{expand:%%moduleList targeted}"
    %loadpolicy targeted $packages
-   restorecon -R /root /var/log /var/run 2> /dev/null
+   restorecon -R /root /var/log /var/run /var/lib 2> /dev/null
 else
    semodule -n -s targeted -r moilscanner -r mailscanner -r gamin -r audio_entropy -r iscsid -r polkit_auth -r polkit -r rtkit_daemon -r ModemManager 2>/dev/null
    packages="%{expand:%%moduleList targeted}"
@@ -373,7 +373,7 @@ semanage -S minimum -i - << __eof
 login -m  -s unconfined_u -r s0-s0:c0.c1023 __default__
 login -m  -s unconfined_u -r s0-s0:c0.c1023 root
 __eof
-restorecon -R /root /var/log /var/run 2> /dev/null
+restorecon -R /root /var/log /var/run /var/lib 2> /dev/null
 else
 %relabel minimum
 fi
@@ -449,6 +449,9 @@ exit 0
 %endif
 
 %changelog
+* Fri Dec 11 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-2
+- Add tgtd policy
+
 * Fri Dec 4 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-1
 - Update to upstream release