smartmon patch from Dan Walsh.

policy/modules/kernel/devices.if

@@ -145,6 +145,24 @@ interface(`dev_add_entry_generic_dirs',`
 	allow $1 device_t:dir add_entry_dir_perms;
 ')
 
+########################################
+## <summary>
+##	Add entries to directories in /dev.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to add entries.
+##	</summary>
+## </param>
+#
+interface(`dev_remove_entry_generic_dirs',`
+	gen_require(`
+		type device_t;
+	')
+
+	allow $1 device_t:dir del_entry_dir_perms;
+')
+
 ########################################
 ## <summary>
 ##	Create a directory in the device directory.

policy/modules/kernel/devices.te

@@ -1,5 +1,5 @@
 
-policy_module(devices, 1.9.1)
+policy_module(devices, 1.9.2)
 
 ########################################
 #

policy/modules/kernel/storage.if

@@ -188,6 +188,44 @@ interface(`storage_raw_rw_fixed_disk',`
 	storage_raw_write_fixed_disk($1)
 ')
 
+########################################
+## <summary>
+##	Allow the caller to create fixed disk device nodes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`storage_create_fixed_disk_dev',`
+	gen_require(`
+		type fixed_disk_device_t;
+	')
+
+	allow $1 fixed_disk_device_t:blk_file create_blk_file_perms;
+	dev_add_entry_generic_dirs($1)
+')
+
+########################################
+## <summary>
+##	Allow the caller to create fixed disk device nodes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`storage_delete_fixed_disk_dev',`
+	gen_require(`
+		type fixed_disk_device_t;
+	')
+
+	allow $1 fixed_disk_device_t:blk_file delete_blk_file_perms;
+	dev_remove_entry_generic_dirs($1)
+')
+
 ########################################
 ## <summary>
 ##	Create, read, write, and delete fixed disk device nodes.

policy/modules/kernel/storage.te

@@ -1,5 +1,5 @@
 
-policy_module(storage, 1.7.1)
+policy_module(storage, 1.7.2)
 
 ########################################
 #

policy/modules/services/smartmon.te

@@ -1,11 +1,19 @@
 
-policy_module(smartmon, 1.9.0)
+policy_module(smartmon, 1.9.1)
 
 ########################################
 #
 # Declarations
 #
 
+## <desc>
+## <p>
+## Enable additional permissions needed to support
+## devices on 3ware controllers.
+## </p>
+## </desc>
+gen_tunable(smartmon_3ware, false)
+
 type fsdaemon_t;
 type fsdaemon_exec_t;
 init_daemon_domain(fsdaemon_t, fsdaemon_exec_t)
@@ -19,14 +27,18 @@ files_pid_file(fsdaemon_var_run_t)
 type fsdaemon_tmp_t;
 files_tmp_file(fsdaemon_tmp_t)
 
+ifdef(`enable_mls',`
+	init_ranged_daemon_domain(fsdaemon_t, fsdaemon_exec_t, mls_systemhigh)
+')
+
 ########################################
 #
 # Local policy
 #
 
-allow fsdaemon_t self:capability { setgid sys_rawio sys_admin };
+allow fsdaemon_t self:capability { setpcap setgid sys_rawio sys_admin };
 dontaudit fsdaemon_t self:capability sys_tty_config;
-allow fsdaemon_t self:process signal_perms;
+allow fsdaemon_t self:process { getcap setcap signal_perms };
 allow fsdaemon_t self:fifo_file rw_fifo_file_perms;
 allow fsdaemon_t self:unix_dgram_socket create_socket_perms;
 allow fsdaemon_t self:unix_stream_socket create_stream_socket_perms;
@@ -66,6 +78,7 @@ fs_getattr_all_fs(fsdaemon_t)
 fs_search_auto_mountpoints(fsdaemon_t)
 
 mls_file_read_all_levels(fsdaemon_t)
+#mls_rangetrans_target(fsdaemon_t)
 
 storage_raw_read_fixed_disk(fsdaemon_t)
 storage_raw_write_fixed_disk(fsdaemon_t)
@@ -80,19 +93,29 @@ logging_send_syslog_msg(fsdaemon_t)
 
 miscfiles_read_localization(fsdaemon_t)
 
+seutil_sigchld_newrole(fsdaemon_t)
+
 sysnet_dns_name_resolve(fsdaemon_t)
 
 userdom_dontaudit_use_unpriv_user_fds(fsdaemon_t)
 userdom_dontaudit_search_user_home_dirs(fsdaemon_t)
 
+tunable_policy(`smartmon_3ware',`
+	allow fsdaemon_t self:process setfscreate;
+
+	storage_create_fixed_disk_dev(fsdaemon_t)
+	storage_delete_fixed_disk_dev(fsdaemon_t)
+	storage_dev_filetrans_fixed_disk(fsdaemon_t)
+
+	selinux_validate_context(fsdaemon_t)
+
+	seutil_read_file_contexts(fsdaemon_t)
+')
+
 optional_policy(`
 	mta_send_mail(fsdaemon_t)
 ')
 
-optional_policy(`
-	seutil_sigchld_newrole(fsdaemon_t)
-')
-
 optional_policy(`
 	udev_read_db(fsdaemon_t)
 ')