From bdb830255cf167d7a2c917a712dacca07249f7a1 Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@fedoraproject.org>
Date: Wed, 23 May 2007 18:35:37 +0000
Subject: [PATCH] - Fix for amands - Allow semanage to read pp files - Allow
 rhgb to read xdm_xserver_tmp

---
 policy-20070518.patch | 671 +++++++++++++++++++++++++++---------------
 selinux-policy.spec   |   7 +-
 2 files changed, 434 insertions(+), 244 deletions(-)

diff --git a/policy-20070518.patch b/policy-20070518.patch
index b9e43e2a..c56dde7a 100644
--- a/policy-20070518.patch
+++ b/policy-20070518.patch
@@ -1,6 +1,6 @@
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-2.6.5/man/man8/ftpd_selinux.8
 --- nsaserefpolicy/man/man8/ftpd_selinux.8	2007-04-02 10:58:34.000000000 -0400
-+++ serefpolicy-2.6.5/man/man8/ftpd_selinux.8	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/man/man8/ftpd_selinux.8	2007-05-22 14:41:13.000000000 -0400
 @@ -12,7 +12,7 @@
  .TP
  chcon -R -t public_content_t /var/ftp
@@ -12,7 +12,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 sere
  .TP
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-2.6.5/policy/flask/access_vectors
 --- nsaserefpolicy/policy/flask/access_vectors	2007-02-26 09:43:33.000000000 -0500
-+++ serefpolicy-2.6.5/policy/flask/access_vectors	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/flask/access_vectors	2007-05-22 14:41:13.000000000 -0400
 @@ -598,6 +598,8 @@
  	shmempwd
  	shmemgrp
@@ -33,7 +33,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors
  class key
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans serefpolicy-2.6.5/policy/global_booleans
 --- nsaserefpolicy/policy/global_booleans	2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.5/policy/global_booleans	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/global_booleans	2007-05-22 14:41:13.000000000 -0400
 @@ -4,7 +4,6 @@
  # file should be used.
  #
@@ -52,7 +52,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans seref
  ## <p>
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-2.6.5/policy/global_tunables
 --- nsaserefpolicy/policy/global_tunables	2007-03-26 16:24:14.000000000 -0400
-+++ serefpolicy-2.6.5/policy/global_tunables	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/global_tunables	2007-05-22 14:41:13.000000000 -0400
 @@ -102,12 +102,6 @@
  ## </desc>
  gen_tunable(use_samba_home_dirs,false)
@@ -81,7 +81,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.5/policy/mls
 --- nsaserefpolicy/policy/mls	2007-03-09 13:02:20.000000000 -0500
-+++ serefpolicy-2.6.5/policy/mls	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/mls	2007-05-22 14:41:13.000000000 -0400
 @@ -89,12 +89,14 @@
  mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton }
  	(( l1 eq l2 ) or
@@ -155,7 +155,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.5
  mlsconstrain association { polmatch }
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-2.6.5/policy/modules/admin/acct.te
 --- nsaserefpolicy/policy/modules/admin/acct.te	2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/acct.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/acct.te	2007-05-22 14:41:13.000000000 -0400
 @@ -9,6 +9,7 @@
  type acct_t;
  type acct_exec_t;
@@ -166,7 +166,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te
  logging_log_file(acct_data_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-2.6.5/policy/modules/admin/alsa.fc
 --- nsaserefpolicy/policy/modules/admin/alsa.fc	2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/admin/alsa.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/alsa.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -1,4 +1,7 @@
  
  /etc/alsa/pcm(/.*)?		gen_context(system_u:object_r:alsa_etc_rw_t,s0)
@@ -177,8 +177,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc
 +/sbin/alsactl 		--	gen_context(system_u:object_r:alsa_exec_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-2.6.5/policy/modules/admin/alsa.te
 --- nsaserefpolicy/policy/modules/admin/alsa.te	2007-01-02 12:57:51.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/admin/alsa.te	2007-05-18 11:59:15.000000000 -0400
-@@ -20,20 +20,23 @@
++++ serefpolicy-2.6.5/policy/modules/admin/alsa.te	2007-05-23 09:37:14.000000000 -0400
+@@ -20,20 +20,24 @@
  # Local policy
  #
  
@@ -193,6 +193,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te
 +dev_read_sound(alsa_t)
 +dev_write_sound(alsa_t)
 +
++files_etc_filetrans(alsa_t, alsa_etc_rw_t, file)
  manage_files_pattern(alsa_t,alsa_etc_rw_t,alsa_etc_rw_t)
  manage_lnk_files_pattern(alsa_t,alsa_etc_rw_t,alsa_etc_rw_t)
  
@@ -205,7 +206,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te
  
  libs_use_ld_so(alsa_t)
  libs_use_shared_libs(alsa_t)
-@@ -44,7 +47,17 @@
+@@ -44,7 +48,17 @@
  
  userdom_manage_unpriv_user_semaphores(alsa_t)
  userdom_manage_unpriv_user_shared_mem(alsa_t)
@@ -223,16 +224,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te
 +	hal_write_log(alsa_t)
 +')
 +
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.te serefpolicy-2.6.5/policy/modules/admin/amanda.te
+--- nsaserefpolicy/policy/modules/admin/amanda.te	2007-03-26 10:39:08.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/amanda.te	2007-05-23 11:17:15.000000000 -0400
+@@ -85,7 +85,7 @@
+ 
+ # access to amandas data structure
+ allow amanda_t amanda_data_t:dir { read search write };
+-allow amanda_t amanda_data_t:file { read write };
++allow amanda_t amanda_data_t:file manage_file_perms;
+ 
+ # access to amanda_dumpdates_t
+ allow amanda_t amanda_dumpdates_t:file { getattr lock read write };
+@@ -97,6 +97,9 @@
+ allow amanda_t amanda_gnutarlists_t:file manage_file_perms;
+ allow amanda_t amanda_gnutarlists_t:lnk_file manage_file_perms;
+ 
++manage_dirs_pattern(amanda_t,amanda_var_lib_t,amanda_var_lib_t)
++manage_files_pattern(amanda_t,amanda_var_lib_t,amanda_var_lib_t)
++
+ manage_files_pattern(amanda_t,amanda_log_t,amanda_log_t)
+ manage_dirs_pattern(amanda_t,amanda_log_t,amanda_log_t)
+ logging_log_filetrans(amanda_t,amanda_log_t,{ file dir })
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.fc serefpolicy-2.6.5/policy/modules/admin/amtu.fc
 --- nsaserefpolicy/policy/modules/admin/amtu.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/admin/amtu.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/amtu.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1,3 @@
 +
 +/usr/bin/amtu    --    gen_context(system_u:object_r:amtu_exec_t,s0)
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if serefpolicy-2.6.5/policy/modules/admin/amtu.if
 --- nsaserefpolicy/policy/modules/admin/amtu.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/admin/amtu.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/amtu.if	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1,53 @@
 +## <summary>
 +##	abstract Machine Test Utility 
@@ -289,7 +312,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te serefpolicy-2.6.5/policy/modules/admin/amtu.te
 --- nsaserefpolicy/policy/modules/admin/amtu.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/admin/amtu.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/amtu.te	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1,57 @@
 +policy_module(amtu,1.0.23)
 +
@@ -350,7 +373,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-2.6.5/policy/modules/admin/bootloader.te
 --- nsaserefpolicy/policy/modules/admin/bootloader.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/bootloader.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/bootloader.te	2007-05-22 14:41:13.000000000 -0400
 @@ -65,6 +65,8 @@
  files_tmp_filetrans(bootloader_t,bootloader_tmp_t,{ dir file lnk_file chr_file blk_file })
  # for tune2fs (cjp: ?)
@@ -370,7 +393,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa
  optional_policy(`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-2.6.5/policy/modules/admin/consoletype.te
 --- nsaserefpolicy/policy/modules/admin/consoletype.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/consoletype.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/consoletype.te	2007-05-22 14:41:13.000000000 -0400
 @@ -8,7 +8,12 @@
  
  type consoletype_t;
@@ -404,7 +427,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-2.6.5/policy/modules/admin/dmesg.te
 --- nsaserefpolicy/policy/modules/admin/dmesg.te	2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/admin/dmesg.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/dmesg.te	2007-05-22 14:41:13.000000000 -0400
 @@ -10,6 +10,7 @@
  	type dmesg_t;
  	type dmesg_exec_t;
@@ -415,7 +438,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.t
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-2.6.5/policy/modules/admin/kudzu.te
 --- nsaserefpolicy/policy/modules/admin/kudzu.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/kudzu.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/kudzu.te	2007-05-23 10:52:36.000000000 -0400
 @@ -21,8 +21,8 @@
  # Local policy
  #
@@ -436,9 +459,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t
  # kudzu will telinit to make init re-read
  # the inittab after configuring serial consoles
  init_telinit(kudzu_t)
+@@ -129,13 +131,6 @@
+         term_dontaudit_use_unallocated_ttys(kudzu_t)
+         term_dontaudit_use_generic_ptys(kudzu_t)
+         files_dontaudit_read_root_files(kudzu_t)
+-
+-	# cjp: this was originally in the else block
+-	# of ifdef userhelper.te, but it seems to
+-	# make more sense here.  also, require
+-	# blocks curently do not work in the
+-	# else block of optionals
+-	unconfined_domain(kudzu_t)
+ ')
+ 
+ optional_policy(`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-2.6.5/policy/modules/admin/logrotate.te
 --- nsaserefpolicy/policy/modules/admin/logrotate.te	2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/logrotate.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/logrotate.te	2007-05-23 10:52:49.000000000 -0400
 @@ -75,6 +75,7 @@
  mls_file_read_up(logrotate_t)
  mls_file_write_down(logrotate_t)
@@ -447,9 +484,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota
  
  selinux_get_fs_mount(logrotate_t)
  selinux_get_enforce_mode(logrotate_t)
+@@ -130,10 +131,6 @@
+ 	can_exec(logrotate_t, logrotate_exec_t)
+ ')
+ 
+-ifdef(`targeted_policy',`
+-	unconfined_domain(logrotate_t)
+-')
+-
+ optional_policy(`
+ 	acct_domtrans(logrotate_t)
+ 	acct_manage_data(logrotate_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-2.6.5/policy/modules/admin/logwatch.te
 --- nsaserefpolicy/policy/modules/admin/logwatch.te	2007-05-02 15:04:46.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/logwatch.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/logwatch.te	2007-05-22 14:41:13.000000000 -0400
 @@ -63,6 +63,8 @@
  files_search_mnt(logwatch_t)
  files_dontaudit_search_home(logwatch_t)
@@ -461,7 +509,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc
  fs_dontaudit_list_auto_mountpoints(logwatch_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-2.6.5/policy/modules/admin/netutils.te
 --- nsaserefpolicy/policy/modules/admin/netutils.te	2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/netutils.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/netutils.te	2007-05-22 14:41:13.000000000 -0400
 @@ -31,6 +31,7 @@
  type traceroute_t;
  type traceroute_exec_t;
@@ -472,7 +520,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil
  ########################################
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-2.6.5/policy/modules/admin/prelink.te
 --- nsaserefpolicy/policy/modules/admin/prelink.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/prelink.te	2007-05-21 11:37:45.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/prelink.te	2007-05-23 09:21:05.000000000 -0400
 @@ -26,7 +26,7 @@
  # Local policy
  #
@@ -482,9 +530,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink
  allow prelink_t self:process { execheap execmem execstack signal };
  allow prelink_t self:fifo_file rw_fifo_file_perms;
  
+@@ -65,6 +65,7 @@
+ files_read_etc_files(prelink_t)
+ files_read_etc_runtime_files(prelink_t)
+ files_dontaudit_read_all_symlinks(prelink_t)
++files_manage_usr_files(prelink_t)
+ 
+ fs_getattr_xattr_fs(prelink_t)
+ 
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-2.6.5/policy/modules/admin/readahead.te
 --- nsaserefpolicy/policy/modules/admin/readahead.te	2007-01-02 12:57:51.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/admin/readahead.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/readahead.te	2007-05-22 14:41:13.000000000 -0400
 @@ -18,7 +18,8 @@
  # Local policy
  #
@@ -514,7 +570,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-2.6.5/policy/modules/admin/rpm.fc
 --- nsaserefpolicy/policy/modules/admin/rpm.fc	2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/admin/rpm.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/rpm.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -21,6 +21,9 @@
  /usr/sbin/pup			--	gen_context(system_u:object_r:rpm_exec_t,s0)
  /usr/sbin/rhn_check		--	gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -527,7 +583,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
  /var/lib/alternatives(/.*)?		gen_context(system_u:object_r:rpm_var_lib_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-2.6.5/policy/modules/admin/rpm.if
 --- nsaserefpolicy/policy/modules/admin/rpm.if	2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/rpm.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/rpm.if	2007-05-22 14:41:13.000000000 -0400
 @@ -224,8 +224,29 @@
  		type rpm_script_tmp_t;
  	')
@@ -608,7 +664,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-2.6.5/policy/modules/admin/rpm.te
 --- nsaserefpolicy/policy/modules/admin/rpm.te	2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/rpm.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/rpm.te	2007-05-22 14:41:13.000000000 -0400
 @@ -9,6 +9,8 @@
  type rpm_t;
  type rpm_exec_t;
@@ -620,7 +676,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
  domain_system_change_exemption(rpm_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-2.6.5/policy/modules/admin/sudo.if
 --- nsaserefpolicy/policy/modules/admin/sudo.if	2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/sudo.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/sudo.if	2007-05-22 14:41:13.000000000 -0400
 @@ -69,7 +69,6 @@
  	allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms;
  	allow $1_sudo_t self:unix_dgram_socket sendto;
@@ -669,7 +725,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-2.6.5/policy/modules/admin/su.if
 --- nsaserefpolicy/policy/modules/admin/su.if	2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/su.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/su.if	2007-05-22 14:41:13.000000000 -0400
 @@ -41,12 +41,11 @@
  
  	allow $2 $1_su_t:process signal;
@@ -744,7 +800,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-2.6.5/policy/modules/admin/usermanage.if
 --- nsaserefpolicy/policy/modules/admin/usermanage.if	2007-03-26 10:39:08.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/usermanage.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/usermanage.if	2007-05-22 14:41:13.000000000 -0400
 @@ -278,5 +278,5 @@
  		type crack_db_t;
  	')
@@ -754,7 +810,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-2.6.5/policy/modules/admin/usermanage.te
 --- nsaserefpolicy/policy/modules/admin/usermanage.te	2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/admin/usermanage.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/usermanage.te	2007-05-22 14:41:13.000000000 -0400
 @@ -198,7 +198,6 @@
  allow groupadd_t self:unix_stream_socket create_stream_socket_perms;
  allow groupadd_t self:unix_dgram_socket sendto;
@@ -890,7 +946,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-2.6.5/policy/modules/admin/vbetool.te
 --- nsaserefpolicy/policy/modules/admin/vbetool.te	2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/admin/vbetool.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/admin/vbetool.te	2007-05-22 14:41:13.000000000 -0400
 @@ -32,4 +32,5 @@
  
  optional_policy(`
@@ -899,7 +955,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-2.6.5/policy/modules/apps/gnome.if
 --- nsaserefpolicy/policy/modules/apps/gnome.if	2007-02-19 11:32:52.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/apps/gnome.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/apps/gnome.if	2007-05-22 14:41:13.000000000 -0400
 @@ -35,6 +35,7 @@
  template(`gnome_per_role_template',`
  	gen_require(`
@@ -955,7 +1011,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
  ##	This is a templated interface, and should only
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-2.6.5/policy/modules/apps/gpg.fc
 --- nsaserefpolicy/policy/modules/apps/gpg.fc	2006-11-16 17:15:07.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/apps/gpg.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/apps/gpg.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -7,6 +7,4 @@
  /usr/lib/gnupg/.*	--	gen_context(system_u:object_r:gpg_exec_t,s0)
  /usr/lib/gnupg/gpgkeys.* --	gen_context(system_u:object_r:gpg_helper_exec_t,s0)
@@ -965,7 +1021,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc s
 -')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-2.6.5/policy/modules/apps/java.if
 --- nsaserefpolicy/policy/modules/apps/java.if	2007-02-19 11:32:52.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/apps/java.if	2007-05-21 10:46:27.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/apps/java.if	2007-05-22 14:41:13.000000000 -0400
 @@ -224,3 +224,35 @@
  		refpolicywarn(`$0($1) has no effect in strict policy.')
  	')
@@ -1004,7 +1060,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.if serefpolicy-2.6.5/policy/modules/apps/loadkeys.if
 --- nsaserefpolicy/policy/modules/apps/loadkeys.if	2007-01-02 12:57:22.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/apps/loadkeys.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/apps/loadkeys.if	2007-05-22 14:41:13.000000000 -0400
 @@ -11,16 +11,12 @@
  ## </param>
  #
@@ -1073,7 +1129,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-2.6.5/policy/modules/apps/mozilla.if
 --- nsaserefpolicy/policy/modules/apps/mozilla.if	2007-03-26 16:24:09.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/apps/mozilla.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/apps/mozilla.if	2007-05-22 14:41:13.000000000 -0400
 @@ -150,6 +150,7 @@
  	corenet_dontaudit_tcp_bind_generic_port($1_mozilla_t)
  
@@ -1084,8 +1140,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
  	dev_dontaudit_rw_dri($1_mozilla_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-2.6.5/policy/modules/apps/slocate.te
 --- nsaserefpolicy/policy/modules/apps/slocate.te	2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/apps/slocate.te	2007-05-18 11:59:15.000000000 -0400
-@@ -39,11 +39,12 @@
++++ serefpolicy-2.6.5/policy/modules/apps/slocate.te	2007-05-23 09:29:08.000000000 -0400
+@@ -39,11 +39,13 @@
  
  files_list_all(locate_t)
  files_getattr_all_files(locate_t)
@@ -1096,12 +1152,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.
  fs_getattr_all_fs(locate_t)
 -fs_getattr_all_dirs(locate_t)
 +fs_getattr_all_files(locate_t)
++fs_list_all(locate_t)
  
  libs_use_shared_libs(locate_t)
  libs_use_ld_so(locate_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if serefpolicy-2.6.5/policy/modules/apps/uml.if
 --- nsaserefpolicy/policy/modules/apps/uml.if	2007-03-26 10:38:58.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/apps/uml.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/apps/uml.if	2007-05-22 14:41:13.000000000 -0400
 @@ -193,33 +193,6 @@
  		nis_use_ypbind($1_uml_t)
  	')
@@ -1138,7 +1195,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if s
  ########################################
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-2.6.5/policy/modules/kernel/corecommands.fc
 --- nsaserefpolicy/policy/modules/kernel/corecommands.fc	2007-04-11 15:52:53.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/kernel/corecommands.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/corecommands.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -36,6 +36,11 @@
  /etc/cipe/ip-up.*		--	gen_context(system_u:object_r:bin_t,s0)
  /etc/cipe/ip-down.*		--	gen_context(system_u:object_r:bin_t,s0)
@@ -1159,7 +1216,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-2.6.5/policy/modules/kernel/corecommands.if
 --- nsaserefpolicy/policy/modules/kernel/corecommands.if	2007-03-26 10:38:57.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/kernel/corecommands.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/corecommands.if	2007-05-22 14:41:13.000000000 -0400
 @@ -988,3 +988,23 @@
  
  	mmap_files_pattern($1,bin_t,exec_type)
@@ -1186,7 +1243,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-2.6.5/policy/modules/kernel/corenetwork.te.in
 --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in	2007-05-18 11:12:43.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/kernel/corenetwork.te.in	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/corenetwork.te.in	2007-05-22 14:41:13.000000000 -0400
 @@ -48,6 +48,11 @@
  type reserved_port_t, port_type, reserved_port_type;
  
@@ -1229,7 +1286,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-2.6.5/policy/modules/kernel/devices.fc
 --- nsaserefpolicy/policy/modules/kernel/devices.fc	2007-03-01 10:01:48.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/kernel/devices.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/devices.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -19,6 +19,7 @@
  /dev/evtchn		-c	gen_context(system_u:object_r:xen_device_t,s0)
  /dev/fb[0-9]*		-c	gen_context(system_u:object_r:framebuf_device_t,s0)
@@ -1249,7 +1306,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-2.6.5/policy/modules/kernel/devices.if
 --- nsaserefpolicy/policy/modules/kernel/devices.if	2007-05-07 14:50:42.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/kernel/devices.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/devices.if	2007-05-22 14:41:13.000000000 -0400
 @@ -2729,6 +2729,24 @@
  
  ########################################
@@ -1356,7 +1413,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-2.6.5/policy/modules/kernel/devices.te
 --- nsaserefpolicy/policy/modules/kernel/devices.te	2007-05-07 14:50:42.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/kernel/devices.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/devices.te	2007-05-22 14:41:13.000000000 -0400
 @@ -139,6 +139,12 @@
  #
  # Type for sound devices and mixers
@@ -1372,7 +1429,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-2.6.5/policy/modules/kernel/domain.if
 --- nsaserefpolicy/policy/modules/kernel/domain.if	2007-02-19 11:32:51.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/kernel/domain.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/domain.if	2007-05-22 14:41:13.000000000 -0400
 @@ -1254,3 +1254,21 @@
  	typeattribute $1 can_change_object_identity;
  	typeattribute $1 set_curr_context;
@@ -1397,7 +1454,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-2.6.5/policy/modules/kernel/domain.te
 --- nsaserefpolicy/policy/modules/kernel/domain.te	2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/kernel/domain.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/domain.te	2007-05-22 14:41:13.000000000 -0400
 @@ -6,6 +6,29 @@
  # Declarations
  #
@@ -1457,7 +1514,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-2.6.5/policy/modules/kernel/files.fc
 --- nsaserefpolicy/policy/modules/kernel/files.fc	2006-11-16 17:15:04.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/kernel/files.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/files.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -45,7 +45,6 @@
  /etc			-d	gen_context(system_u:object_r:etc_t,s0)
  /etc/.*				gen_context(system_u:object_r:etc_t,s0)
@@ -1476,7 +1533,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  /etc/nologin.*		--	gen_context(system_u:object_r:etc_runtime_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.6.5/policy/modules/kernel/files.if
 --- nsaserefpolicy/policy/modules/kernel/files.if	2007-02-26 14:17:21.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/kernel/files.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/files.if	2007-05-23 09:19:57.000000000 -0400
 @@ -343,8 +343,7 @@
  
  ########################################
@@ -1545,7 +1602,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -3310,6 +3326,24 @@
+@@ -3310,6 +3326,42 @@
  
  ########################################
  ## <summary>
@@ -1566,11 +1623,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
 +')
 +
 +########################################
++## <summary>
++##	Create, read, write, and delete files in the /usr directory.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`files_manage_usr_files',`
++	gen_require(`
++		type usr_t;
++	')
++
++	manage_files_pattern($1, usr_t, usr_t)
++')
++
++########################################
 +## <summary>
  ##	Get the attributes of files in /usr.
  ## </summary>
  ## <param name="domain">
-@@ -3637,7 +3671,7 @@
+@@ -3637,7 +3689,7 @@
  		type var_t;
  	')
  
@@ -1579,7 +1654,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -3993,7 +4027,7 @@
+@@ -3993,7 +4045,7 @@
  		type var_lock_t;
  	')
  
@@ -1588,7 +1663,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -4012,7 +4046,7 @@
+@@ -4012,7 +4064,7 @@
  		type var_t, var_lock_t;
  	')
  
@@ -1597,7 +1672,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -4181,7 +4215,7 @@
+@@ -4181,7 +4233,7 @@
  		type var_run_t;
  	')
  
@@ -1606,7 +1681,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -4529,6 +4563,8 @@
+@@ -4529,6 +4581,8 @@
  	# Need to give access to /selinux/member
  	selinux_compute_member($1)
  
@@ -1615,7 +1690,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  	# Need sys_admin capability for mounting
  	allow $1 self:capability { chown fsetid sys_admin };
  
-@@ -4551,6 +4587,8 @@
+@@ -4551,6 +4605,8 @@
  	# Default type for mountpoints
  	allow $1 poly_t:dir { create mounton };
  	fs_unmount_xattr_fs($1)
@@ -1624,7 +1699,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -4588,3 +4626,28 @@
+@@ -4588,3 +4644,28 @@
  
  	allow $1 { file_type -security_file_type }:dir manage_dir_perms;
  ')
@@ -1655,7 +1730,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-2.6.5/policy/modules/kernel/files.te
 --- nsaserefpolicy/policy/modules/kernel/files.te	2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/kernel/files.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/files.te	2007-05-22 14:41:13.000000000 -0400
 @@ -54,6 +54,7 @@
  files_type(etc_t)
  # compatibility aliases for removed types:
@@ -1666,7 +1741,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  # etc_runtime_t is the type of various
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-2.6.5/policy/modules/kernel/filesystem.if
 --- nsaserefpolicy/policy/modules/kernel/filesystem.if	2007-03-26 16:24:09.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/kernel/filesystem.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/filesystem.if	2007-05-22 14:41:13.000000000 -0400
 @@ -1096,6 +1096,24 @@
  
  ########################################
@@ -1744,7 +1819,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.6.5/policy/modules/kernel/filesystem.te
 --- nsaserefpolicy/policy/modules/kernel/filesystem.te	2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/kernel/filesystem.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/filesystem.te	2007-05-22 14:41:13.000000000 -0400
 @@ -54,17 +54,29 @@
  
  type capifs_t;
@@ -1801,7 +1876,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
  #
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-2.6.5/policy/modules/kernel/kernel.if
 --- nsaserefpolicy/policy/modules/kernel/kernel.if	2007-05-02 15:04:46.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/kernel/kernel.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/kernel.if	2007-05-22 14:41:13.000000000 -0400
 @@ -1848,6 +1848,26 @@
  
  ########################################
@@ -1841,7 +1916,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
  ########################################
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-2.6.5/policy/modules/kernel/kernel.te
 --- nsaserefpolicy/policy/modules/kernel/kernel.te	2007-05-02 15:04:46.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/kernel/kernel.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/kernel.te	2007-05-22 14:41:13.000000000 -0400
 @@ -146,6 +146,8 @@
  type unlabeled_t;
  sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
@@ -1861,7 +1936,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
  optional_policy(`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-2.6.5/policy/modules/kernel/mls.if
 --- nsaserefpolicy/policy/modules/kernel/mls.if	2006-11-16 17:15:04.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/kernel/mls.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/mls.if	2007-05-22 14:41:13.000000000 -0400
 @@ -154,6 +154,26 @@
  ########################################
  ## <summary>
@@ -1891,7 +1966,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if
  ## <param name="domain">
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-2.6.5/policy/modules/kernel/mls.te
 --- nsaserefpolicy/policy/modules/kernel/mls.te	2007-01-02 12:57:13.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/kernel/mls.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/mls.te	2007-05-22 14:41:13.000000000 -0400
 @@ -18,6 +18,7 @@
  attribute mlsnetreadtoclr;
  attribute mlsnetwrite;
@@ -1911,7 +1986,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te
  attribute privrangetrans;
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-2.6.5/policy/modules/kernel/selinux.if
 --- nsaserefpolicy/policy/modules/kernel/selinux.if	2007-02-27 14:37:10.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/kernel/selinux.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/selinux.if	2007-05-22 14:41:13.000000000 -0400
 @@ -51,6 +51,44 @@
  
  ########################################
@@ -1959,7 +2034,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu
  ## <param name="domain">
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-2.6.5/policy/modules/kernel/storage.if
 --- nsaserefpolicy/policy/modules/kernel/storage.if	2007-01-02 12:57:13.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/kernel/storage.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/storage.if	2007-05-22 14:41:13.000000000 -0400
 @@ -100,6 +100,7 @@
  
  	dev_list_all_dev_nodes($1)
@@ -1978,7 +2053,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-2.6.5/policy/modules/kernel/terminal.if
 --- nsaserefpolicy/policy/modules/kernel/terminal.if	2007-02-20 16:35:52.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/kernel/terminal.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/terminal.if	2007-05-22 14:41:13.000000000 -0400
 @@ -278,6 +278,25 @@
  
  ########################################
@@ -2016,7 +2091,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
  ########################################
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-2.6.5/policy/modules/kernel/terminal.te
 --- nsaserefpolicy/policy/modules/kernel/terminal.te	2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/kernel/terminal.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/kernel/terminal.te	2007-05-22 14:41:13.000000000 -0400
 @@ -28,6 +28,7 @@
  type devpts_t;
  files_mountpoint(devpts_t)
@@ -2027,7 +2102,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.fc serefpolicy-2.6.5/policy/modules/services/aide.fc
 --- nsaserefpolicy/policy/modules/services/aide.fc	2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/aide.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/aide.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -2,5 +2,5 @@
  
  /var/lib/aide(/.*)		gen_context(system_u:object_r:aide_db_t,mls_systemhigh)
@@ -2037,7 +2112,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide
 +/var/log/aide(/.*)?		gen_context(system_u:object_r:aide_log_t,mls_systemhigh)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.te serefpolicy-2.6.5/policy/modules/services/aide.te
 --- nsaserefpolicy/policy/modules/services/aide.te	2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/aide.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/aide.te	2007-05-22 14:41:13.000000000 -0400
 @@ -26,7 +26,7 @@
  
  allow aide_t self:capability { dac_override fowner };
@@ -2049,7 +2124,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide
  manage_files_pattern(aide_t,aide_db_t,aide_db_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.if serefpolicy-2.6.5/policy/modules/services/amavis.if
 --- nsaserefpolicy/policy/modules/services/amavis.if	2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/amavis.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/amavis.if	2007-05-22 14:41:13.000000000 -0400
 @@ -167,3 +167,22 @@
  	allow $1 amavis_var_run_t:file setattr;
  	files_search_pids($1)
@@ -2075,7 +2150,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-2.6.5/policy/modules/services/apache.fc
 --- nsaserefpolicy/policy/modules/services/apache.fc	2007-02-23 16:50:01.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/apache.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/apache.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -1,10 +1,5 @@
  # temporary hack till genhomedircon is fixed
 -ifdef(`targeted_policy',`
@@ -2109,7 +2184,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-2.6.5/policy/modules/services/apache.if
 --- nsaserefpolicy/policy/modules/services/apache.if	2007-04-02 10:58:34.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/apache.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/apache.if	2007-05-22 14:41:13.000000000 -0400
 @@ -18,10 +18,6 @@
  		attribute httpd_script_exec_type;
  		type httpd_t, httpd_suexec_t, httpd_log_t;
@@ -2178,7 +2253,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ')
  
  ########################################
-@@ -923,7 +937,7 @@
+@@ -836,6 +850,10 @@
+ 		type httpd_sys_script_t;
+ 	')
+ 
++	tunable_policy(`httpd_enable_cgi',`
++		domtrans_pattern($1, httpd_sys_script_exec_t, httpd_sys_script_t)
++	')
++
+ 	tunable_policy(`httpd_enable_cgi && httpd_unified',`
+ 		domtrans_pattern($1, httpdcontent, httpd_sys_script_t)
+ 	')
+@@ -923,7 +941,7 @@
  		type httpd_squirrelmail_t;
  	')
  
@@ -2187,7 +2273,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ')
  
  ########################################
-@@ -1000,3 +1014,140 @@
+@@ -1000,3 +1018,140 @@
  
  	allow $1 httpd_sys_script_t:dir search_dir_perms;
  ')
@@ -2330,8 +2416,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-2.6.5/policy/modules/services/apache.te
 --- nsaserefpolicy/policy/modules/services/apache.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/apache.te	2007-05-18 11:59:15.000000000 -0400
-@@ -106,6 +106,27 @@
++++ serefpolicy-2.6.5/policy/modules/services/apache.te	2007-05-23 14:17:56.000000000 -0400
+@@ -47,6 +47,13 @@
+ ## Allow http daemon to tcp connect
+ ## </p>
+ ## </desc>
++gen_tunable(httpd_can_sendmail,false)
++
++## <desc>
++## <p>
++## Allow http daemon to tcp connect
++## </p>
++## </desc>
+ gen_tunable(httpd_can_network_connect,false)
+ 
+ ## <desc>
+@@ -106,6 +113,27 @@
  ## </desc>
  gen_tunable(httpd_unified,false)
  
@@ -2359,7 +2459,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  attribute httpdcontent;
  
  # domains that can exec all users scripts
-@@ -257,6 +278,7 @@
+@@ -257,6 +285,7 @@
  allow httpd_t httpd_modules_t:dir list_dir_perms;
  mmap_files_pattern(httpd_t,httpd_modules_t,httpd_modules_t)
  read_files_pattern(httpd_t,httpd_modules_t,httpd_modules_t)
@@ -2367,7 +2467,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  
  apache_domtrans_rotatelogs(httpd_t)
  # Apache-httpd needs to be able to send signals to the log rotate procs.
-@@ -297,6 +319,7 @@
+@@ -297,6 +326,7 @@
  kernel_read_kernel_sysctls(httpd_t)
  # for modules that want to access /proc/meminfo
  kernel_read_system_state(httpd_t)
@@ -2375,7 +2475,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  
  corenet_non_ipsec_sendrecv(httpd_t)
  corenet_tcp_sendrecv_all_if(httpd_t)
-@@ -342,6 +365,9 @@
+@@ -342,6 +372,9 @@
  files_read_var_lib_symlinks(httpd_t)
  
  fs_search_auto_mountpoints(httpd_sys_script_t)
@@ -2385,7 +2485,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  
  libs_use_ld_so(httpd_t)
  libs_use_shared_libs(httpd_t)
-@@ -362,6 +388,10 @@
+@@ -362,6 +395,10 @@
  
  mta_send_mail(httpd_t)
  
@@ -2396,7 +2496,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ifdef(`targeted_policy',`
  	term_dontaudit_use_unallocated_ttys(httpd_t)
  	term_dontaudit_use_generic_ptys(httpd_t)
-@@ -416,6 +446,10 @@
+@@ -389,6 +426,14 @@
+ 	corenet_tcp_connect_all_ports(httpd_t)
+ ')
+ 
++tunable_policy(`httpd_can_sendmail',`
++	# allow httpd to connect to mail servers
++	corenet_tcp_connect_smtp_port(httpd_t)
++	corenet_sendrecv_smtp_client_packets(httpd_t)
++	corenet_tcp_connect_pop_port(httpd_t)
++	corenet_sendrecv_pop_client_packets(httpd_t)
++')
++
+ tunable_policy(`httpd_can_network_connect_db',`
+ 	# allow httpd to connect to mysql/posgresql
+ 	corenet_tcp_connect_postgresql_port(httpd_t)
+@@ -416,6 +461,10 @@
  	allow httpd_t httpd_unconfined_script_exec_t:dir list_dir_perms;
  ')
  
@@ -2407,7 +2522,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
  	domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t)
  
-@@ -433,11 +467,21 @@
+@@ -433,11 +482,21 @@
  	fs_read_nfs_symlinks(httpd_t)
  ')
  
@@ -2429,7 +2544,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  tunable_policy(`httpd_ssi_exec',`
  	corecmd_shell_domtrans(httpd_t,httpd_sys_script_t)
  	allow httpd_sys_script_t httpd_t:fd use;
-@@ -668,6 +712,12 @@
+@@ -668,6 +727,12 @@
  	fs_exec_nfs_files(httpd_suexec_t)
  ')
  
@@ -2442,7 +2557,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
  	fs_read_cifs_files(httpd_suexec_t)
  	fs_read_cifs_symlinks(httpd_suexec_t)
-@@ -706,7 +756,8 @@
+@@ -706,7 +771,8 @@
  
  dontaudit httpd_sys_script_t httpd_config_t:dir search;
  
@@ -2452,7 +2567,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  
  allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
  read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t)
-@@ -730,11 +781,21 @@
+@@ -730,11 +796,21 @@
  	')
  ')
  
@@ -2474,7 +2589,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
  	fs_read_cifs_files(httpd_sys_script_t)
  	fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -788,3 +849,19 @@
+@@ -788,3 +864,19 @@
  	term_dontaudit_use_generic_ptys(httpd_rotatelogs_t)
  	term_dontaudit_use_unallocated_ttys(httpd_rotatelogs_t)
  ')
@@ -2496,7 +2611,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-2.6.5/policy/modules/services/apcupsd.fc
 --- nsaserefpolicy/policy/modules/services/apcupsd.fc	2007-05-07 11:11:55.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/apcupsd.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/apcupsd.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -3,3 +3,8 @@
  /var/log/apcupsd\.events.*	--	gen_context(system_u:object_r:apcupsd_log_t,s0)
  
@@ -2508,7 +2623,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
 +/var/www/apcupsd/upsstats.cgi		--	gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-2.6.5/policy/modules/services/apcupsd.if
 --- nsaserefpolicy/policy/modules/services/apcupsd.if	2007-05-07 11:11:55.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/apcupsd.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/apcupsd.if	2007-05-22 14:41:13.000000000 -0400
 @@ -79,3 +79,25 @@
  	allow $1 apcupsd_log_t:dir list_dir_perms;
  	allow $1 apcupsd_log_t:file { getattr append };
@@ -2537,10 +2652,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-2.6.5/policy/modules/services/apcupsd.te
 --- nsaserefpolicy/policy/modules/services/apcupsd.te	2007-05-18 11:12:43.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/apcupsd.te	2007-05-18 11:59:15.000000000 -0400
-@@ -66,3 +66,26 @@
- 	term_dontaudit_use_unallocated_ttys(apcupsd_t)
++++ serefpolicy-2.6.5/policy/modules/services/apcupsd.te	2007-05-22 14:51:55.000000000 -0400
+@@ -62,7 +62,34 @@
+ 
+ miscfiles_read_localization(apcupsd_t)
+ 
++# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240805
++term_use_unallocated_ttys(apcupsd_t)
++
+ ifdef(`targeted_policy',`
+-	term_dontaudit_use_unallocated_ttys(apcupsd_t)
  	term_dontaudit_use_generic_ptys(apcupsd_t)
++	unconfined_dontaudit_rw_pipes(apcupsd_t)
++
  ')
 +
 +########################################
@@ -2567,7 +2691,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-2.6.5/policy/modules/services/automount.te
 --- nsaserefpolicy/policy/modules/services/automount.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/automount.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/automount.te	2007-05-22 14:41:13.000000000 -0400
 @@ -69,6 +69,7 @@
  files_mounton_all_mountpoints(automount_t)
  files_mount_all_file_type_fs(automount_t)
@@ -2586,7 +2710,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto
  domain_use_interactive_fds(automount_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-2.6.5/policy/modules/services/avahi.te
 --- nsaserefpolicy/policy/modules/services/avahi.te	2007-05-03 08:50:57.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/avahi.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/avahi.te	2007-05-22 14:41:13.000000000 -0400
 @@ -18,7 +18,7 @@
  # Local policy
  #
@@ -2598,7 +2722,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah
  allow avahi_t self:fifo_file { read write };
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-2.6.5/policy/modules/services/bind.te
 --- nsaserefpolicy/policy/modules/services/bind.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/bind.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/bind.te	2007-05-22 14:41:13.000000000 -0400
 @@ -236,6 +236,7 @@
  corenet_tcp_sendrecv_all_nodes(ndc_t)
  corenet_tcp_sendrecv_all_ports(ndc_t)
@@ -2609,7 +2733,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind
  fs_getattr_xattr_fs(ndc_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-2.6.5/policy/modules/services/clamav.te
 --- nsaserefpolicy/policy/modules/services/clamav.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/clamav.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/clamav.te	2007-05-22 14:41:13.000000000 -0400
 @@ -126,6 +126,7 @@
  	amavis_read_lib_files(clamd_t)
  	amavis_read_spool_files(clamd_t)
@@ -2620,7 +2744,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam
  ########################################
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-2.6.5/policy/modules/services/consolekit.te
 --- nsaserefpolicy/policy/modules/services/consolekit.te	2007-05-04 12:19:22.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/consolekit.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/consolekit.te	2007-05-22 14:41:13.000000000 -0400
 @@ -10,7 +10,6 @@
  type consolekit_exec_t;
  init_daemon_domain(consolekit_t, consolekit_exec_t)
@@ -2665,7 +2789,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-2.6.5/policy/modules/services/cron.fc
 --- nsaserefpolicy/policy/modules/services/cron.fc	2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/cron.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cron.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -45,3 +45,4 @@
  /var/spool/fcron/systab\.orig	--	gen_context(system_u:object_r:system_cron_spool_t,s0)
  /var/spool/fcron/systab		--	gen_context(system_u:object_r:system_cron_spool_t,s0)
@@ -2673,7 +2797,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
 +/var/lib/misc(/.*)?			gen_context(system_u:object_r:crond_var_run_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-2.6.5/policy/modules/services/cron.if
 --- nsaserefpolicy/policy/modules/services/cron.if	2007-03-26 10:39:05.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/cron.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cron.if	2007-05-22 14:41:13.000000000 -0400
 @@ -35,6 +35,7 @@
  #
  template(`cron_per_role_template',`
@@ -2784,7 +2908,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
  		# fcron wants an instant update of a crontab change for the administrator
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-2.6.5/policy/modules/services/cron.te
 --- nsaserefpolicy/policy/modules/services/cron.te	2007-05-18 11:12:43.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/cron.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cron.te	2007-05-22 14:41:13.000000000 -0400
 @@ -42,6 +42,9 @@
  type cron_log_t;
  logging_log_file(cron_log_t)
@@ -2924,7 +3048,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-2.6.5/policy/modules/services/cups.fc
 --- nsaserefpolicy/policy/modules/services/cups.fc	2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/cups.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cups.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -8,6 +8,7 @@
  /etc/cups/ppd/.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
  /etc/cups/ppds\.dat	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
@@ -2935,7 +3059,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-2.6.5/policy/modules/services/cups.te
 --- nsaserefpolicy/policy/modules/services/cups.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/cups.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cups.te	2007-05-22 14:41:13.000000000 -0400
 @@ -93,8 +93,6 @@
  # generic socket here until appletalk socket is available in kernels
  allow cupsd_t self:socket create_socket_perms;
@@ -2997,7 +3121,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-2.6.5/policy/modules/services/cvs.te
 --- nsaserefpolicy/policy/modules/services/cvs.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/cvs.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cvs.te	2007-05-22 14:41:13.000000000 -0400
 @@ -16,6 +16,7 @@
  type cvs_t;
  type cvs_exec_t;
@@ -3008,7 +3132,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.
  type cvs_data_t; # customizable
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-2.6.5/policy/modules/services/cyrus.te
 --- nsaserefpolicy/policy/modules/services/cyrus.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/cyrus.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/cyrus.te	2007-05-22 14:41:13.000000000 -0400
 @@ -145,6 +145,7 @@
  
  optional_policy(`
@@ -3019,7 +3143,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru
  optional_policy(`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-2.6.5/policy/modules/services/dbus.if
 --- nsaserefpolicy/policy/modules/services/dbus.if	2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/dbus.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/dbus.if	2007-05-22 14:41:13.000000000 -0400
 @@ -49,6 +49,12 @@
  ## </param>
  #
@@ -3149,7 +3273,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-2.6.5/policy/modules/services/dbus.te
 --- nsaserefpolicy/policy/modules/services/dbus.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/dbus.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/dbus.te	2007-05-22 14:41:13.000000000 -0400
 @@ -40,8 +40,6 @@
  # Receive notifications of policy reloads and enforcing status changes.
  allow system_dbusd_t self:netlink_selinux_socket { create bind read };
@@ -3180,7 +3304,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-2.6.5/policy/modules/services/dhcp.te
 --- nsaserefpolicy/policy/modules/services/dhcp.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/dhcp.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/dhcp.te	2007-05-22 14:41:13.000000000 -0400
 @@ -119,6 +119,8 @@
  	dbus_system_bus_client_template(dhcpd,dhcpd_t)
  	dbus_connect_system_bus(dhcpd_t)
@@ -3192,7 +3316,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp
  optional_policy(`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-2.6.5/policy/modules/services/djbdns.te
 --- nsaserefpolicy/policy/modules/services/djbdns.te	2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/djbdns.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/djbdns.te	2007-05-22 14:41:13.000000000 -0400
 @@ -44,4 +44,7 @@
  libs_use_ld_so(djbdns_axfrdns_t)
  libs_use_shared_libs(djbdns_axfrdns_t)
@@ -3204,7 +3328,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbd
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-2.6.5/policy/modules/services/dovecot.fc
 --- nsaserefpolicy/policy/modules/services/dovecot.fc	2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/dovecot.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/dovecot.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -17,10 +17,12 @@
  
  ifdef(`distro_debian', `
@@ -3220,7 +3344,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
  #
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-2.6.5/policy/modules/services/dovecot.if
 --- nsaserefpolicy/policy/modules/services/dovecot.if	2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/dovecot.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/dovecot.if	2007-05-22 14:41:13.000000000 -0400
 @@ -18,3 +18,43 @@
  	manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
  	manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t)
@@ -3267,7 +3391,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-2.6.5/policy/modules/services/dovecot.te
 --- nsaserefpolicy/policy/modules/services/dovecot.te	2007-05-07 10:32:44.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/dovecot.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/dovecot.te	2007-05-22 14:41:13.000000000 -0400
 @@ -15,6 +15,12 @@
  domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t)
  role system_r types dovecot_auth_t;
@@ -3289,21 +3413,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
  
  userdom_dontaudit_use_unpriv_user_fds(dovecot_t)
  userdom_dontaudit_search_sysadm_home_dirs(dovecot_t)
-@@ -138,11 +143,11 @@
- ')
- 
- optional_policy(`
--	squid_dontaudit_search_cache(dovecot_t)
-+	udev_read_db(dovecot_t)
- ')
- 
- optional_policy(`
--	udev_read_db(dovecot_t)
-+	squid_dontaudit_search_cache(dovecot_t)
- ')
- 
- ########################################
-@@ -150,19 +155,20 @@
+@@ -150,25 +155,29 @@
  # dovecot auth local policy
  #
  
@@ -3326,7 +3436,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
  
  allow dovecot_auth_t dovecot_var_run_t:dir r_dir_perms;
  
-@@ -177,6 +183,7 @@
+ kernel_read_all_sysctls(dovecot_auth_t)
+ kernel_read_system_state(dovecot_auth_t)
+ 
++logging_send_syslog_msg(dovecot_auth_t)
++logging_send_audit_msg(dovecot_auth_t)
++
+ dev_read_urand(dovecot_auth_t)
+ 
+ auth_domtrans_chk_passwd(dovecot_auth_t)
+@@ -177,6 +186,7 @@
  files_read_etc_files(dovecot_auth_t)
  files_read_etc_runtime_files(dovecot_auth_t)
  files_search_pids(dovecot_auth_t)
@@ -3334,7 +3453,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
  files_read_usr_symlinks(dovecot_auth_t)
  files_search_tmp(dovecot_auth_t)
  files_read_var_lib_files(dovecot_t)
-@@ -191,6 +198,7 @@
+@@ -191,11 +201,48 @@
  seutil_dontaudit_search_config(dovecot_auth_t)
  
  sysnet_dns_name_resolve(dovecot_auth_t)
@@ -3342,12 +3461,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
  
  optional_policy(`
  	kerberos_use(dovecot_auth_t)
-@@ -199,3 +207,43 @@
- optional_policy(`
- 	logging_send_syslog_msg(dovecot_auth_t)
  ')
-+
-+optional_policy(`
+ 
+ optional_policy(`
+-	logging_send_syslog_msg(dovecot_auth_t)
 +	mysql_search_db(dovecot_auth_t)
 +	mysql_stream_connect(dovecot_auth_t)
 +')
@@ -3385,10 +3502,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove
 +ifdef(`targeted_policy',`
 +	term_dontaudit_use_unallocated_ttys(dovecot_deliver_t)
 +	term_dontaudit_use_generic_ptys(dovecot_deliver_t)
-+')
+ ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-2.6.5/policy/modules/services/ftp.te
 --- nsaserefpolicy/policy/modules/services/ftp.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/ftp.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/ftp.te	2007-05-22 14:41:13.000000000 -0400
 @@ -168,6 +168,7 @@
  libs_use_shared_libs(ftpd_t)
  
@@ -3415,7 +3532,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
  tunable_policy(`ftp_home_dir && use_nfs_home_dirs',`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-2.6.5/policy/modules/services/hal.fc
 --- nsaserefpolicy/policy/modules/services/hal.fc	2007-05-07 14:50:43.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/hal.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/hal.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -2,15 +2,20 @@
  /etc/hal/device\.d/printer_remove\.hal -- 	gen_context(system_u:object_r:hald_exec_t,s0)
  /etc/hal/capability\.d/printer_update\.hal --	gen_context(system_u:object_r:hald_exec_t,s0)
@@ -3444,7 +3561,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-2.6.5/policy/modules/services/hal.if
 --- nsaserefpolicy/policy/modules/services/hal.if	2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/hal.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/hal.if	2007-05-22 14:41:13.000000000 -0400
 @@ -208,3 +208,98 @@
  	files_search_pids($1)
  	allow $1 hald_var_run_t:file rw_file_perms;
@@ -3546,7 +3663,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-2.6.5/policy/modules/services/hal.te
 --- nsaserefpolicy/policy/modules/services/hal.te	2007-05-07 14:50:43.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/hal.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/hal.te	2007-05-22 14:41:13.000000000 -0400
 @@ -61,8 +61,6 @@
  # For backwards compatibility with older kernels
  allow hald_t self:netlink_socket create_socket_perms;
@@ -3611,7 +3728,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
  dev_setattr_usbfs_files(hald_acl_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-2.6.5/policy/modules/services/inetd.te
 --- nsaserefpolicy/policy/modules/services/inetd.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/inetd.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/inetd.te	2007-05-22 14:41:13.000000000 -0400
 @@ -135,8 +135,8 @@
  mls_fd_use_all_levels(inetd_t)
  mls_fd_share_all_levels(inetd_t)
@@ -3634,7 +3751,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
  manage_dirs_pattern(inetd_child_t,inetd_child_tmp_t,inetd_child_tmp_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-2.6.5/policy/modules/services/kerberos.if
 --- nsaserefpolicy/policy/modules/services/kerberos.if	2007-04-10 13:21:52.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/kerberos.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/kerberos.if	2007-05-22 14:41:13.000000000 -0400
 @@ -33,43 +33,10 @@
  #
  interface(`kerberos_use',`
@@ -3783,7 +3900,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-2.6.5/policy/modules/services/kerberos.te
 --- nsaserefpolicy/policy/modules/services/kerberos.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/kerberos.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/kerberos.te	2007-05-22 14:41:13.000000000 -0400
 @@ -5,6 +5,7 @@
  #
  # Declarations
@@ -3847,7 +3964,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-2.6.5/policy/modules/services/mailman.if
 --- nsaserefpolicy/policy/modules/services/mailman.if	2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/mailman.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/mailman.if	2007-05-22 14:41:13.000000000 -0400
 @@ -275,6 +275,25 @@
  
  #######################################
@@ -3876,7 +3993,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail
  ## <param name="domain">
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-2.6.5/policy/modules/services/mta.te
 --- nsaserefpolicy/policy/modules/services/mta.te	2007-05-18 11:12:43.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/mta.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/mta.te	2007-05-22 14:41:13.000000000 -0400
 @@ -27,6 +27,7 @@
  
  type sendmail_exec_t;
@@ -3895,7 +4012,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
  	apache_dontaudit_append_log(system_mail_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-2.6.5/policy/modules/services/networkmanager.if
 --- nsaserefpolicy/policy/modules/services/networkmanager.if	2006-11-16 17:15:20.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/networkmanager.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/networkmanager.if	2007-05-22 14:41:13.000000000 -0400
 @@ -78,3 +78,22 @@
  	allow $1 NetworkManager_t:dbus send_msg;
  	allow NetworkManager_t $1:dbus send_msg;
@@ -3921,7 +4038,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.6.5/policy/modules/services/nis.if
 --- nsaserefpolicy/policy/modules/services/nis.if	2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/nis.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/nis.if	2007-05-22 14:41:13.000000000 -0400
 @@ -48,8 +48,8 @@
  	corenet_udp_bind_all_nodes($1)
  	corenet_tcp_bind_generic_port($1)
@@ -3935,7 +4052,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
  	corenet_tcp_connect_portmap_port($1)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-2.6.5/policy/modules/services/nis.te
 --- nsaserefpolicy/policy/modules/services/nis.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/nis.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/nis.te	2007-05-22 14:41:13.000000000 -0400
 @@ -120,6 +120,13 @@
  ')
  
@@ -3970,7 +4087,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.
  corenet_tcp_connect_all_ports(ypxfr_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-2.6.5/policy/modules/services/nscd.te
 --- nsaserefpolicy/policy/modules/services/nscd.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/nscd.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/nscd.te	2007-05-22 14:41:13.000000000 -0400
 @@ -28,14 +28,14 @@
  # Local policy
  #
@@ -4011,7 +4128,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-2.6.5/policy/modules/services/ntp.te
 --- nsaserefpolicy/policy/modules/services/ntp.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/ntp.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/ntp.te	2007-05-22 14:41:13.000000000 -0400
 @@ -137,6 +137,10 @@
  ')
  
@@ -4025,7 +4142,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-2.6.5/policy/modules/services/oddjob.te
 --- nsaserefpolicy/policy/modules/services/oddjob.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/oddjob.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/oddjob.te	2007-05-22 14:41:13.000000000 -0400
 @@ -27,7 +27,7 @@
  # oddjob local policy
  #
@@ -4037,7 +4154,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj
  allow oddjob_t self:unix_stream_socket create_stream_socket_perms;
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.fc serefpolicy-2.6.5/policy/modules/services/openct.fc
 --- nsaserefpolicy/policy/modules/services/openct.fc	2006-11-16 17:15:20.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/openct.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/openct.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -2,6 +2,7 @@
  # /usr
  #
@@ -4048,7 +4165,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
  # /var
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.if serefpolicy-2.6.5/policy/modules/services/openct.if
 --- nsaserefpolicy/policy/modules/services/openct.if	2006-11-16 17:15:20.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/openct.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/openct.if	2007-05-22 14:41:13.000000000 -0400
 @@ -1 +1,83 @@
 -## <summary>Service for handling smart card readers.</summary>
 +
@@ -4136,8 +4253,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-2.6.5/policy/modules/services/openct.te
 --- nsaserefpolicy/policy/modules/services/openct.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/openct.te	2007-05-18 11:59:15.000000000 -0400
-@@ -24,6 +24,8 @@
++++ serefpolicy-2.6.5/policy/modules/services/openct.te	2007-05-23 09:21:48.000000000 -0400
+@@ -21,9 +21,13 @@
+ dontaudit openct_t self:capability sys_tty_config;
+ allow openct_t self:process signal_perms;
+ 
++can_exec(openct_t,openct_exec_t)
++
  manage_files_pattern(openct_t,openct_var_run_t,openct_var_run_t)
  files_pid_filetrans(openct_t,openct_var_run_t,file)
  
@@ -4146,7 +4268,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
  kernel_read_kernel_sysctls(openct_t)
  kernel_list_proc(openct_t)
  kernel_read_proc_symlinks(openct_t)
-@@ -31,6 +33,8 @@
+@@ -31,6 +35,8 @@
  dev_read_sysfs(openct_t)
  # openct asks for this
  dev_rw_usbfs(openct_t)
@@ -4157,7 +4279,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.fc serefpolicy-2.6.5/policy/modules/services/openvpn.fc
 --- nsaserefpolicy/policy/modules/services/openvpn.fc	2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/openvpn.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/openvpn.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -11,5 +11,5 @@
  #
  # /var
@@ -4168,7 +4290,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
 +/var/run/openvpn(/.*)?		gen_context(system_u:object_r:openvpn_var_run_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-2.6.5/policy/modules/services/pcscd.te
 --- nsaserefpolicy/policy/modules/services/pcscd.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/pcscd.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/pcscd.te	2007-05-22 14:41:13.000000000 -0400
 @@ -21,6 +21,7 @@
  #
  
@@ -4193,7 +4315,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcsc
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-2.6.5/policy/modules/services/pegasus.if
 --- nsaserefpolicy/policy/modules/services/pegasus.if	2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/pegasus.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/pegasus.if	2007-05-22 14:41:13.000000000 -0400
 @@ -1 +1,19 @@
  ## <summary>The Open Group Pegasus CIM/WBEM Server.</summary>
 +
@@ -4216,7 +4338,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-2.6.5/policy/modules/services/pegasus.te
 --- nsaserefpolicy/policy/modules/services/pegasus.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/pegasus.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/pegasus.te	2007-05-22 14:41:13.000000000 -0400
 @@ -38,8 +38,6 @@
  allow pegasus_t self:unix_stream_socket create_stream_socket_perms;
  allow pegasus_t self:tcp_socket create_stream_socket_perms;
@@ -4260,7 +4382,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
  optional_policy(`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-2.6.5/policy/modules/services/postfix.if
 --- nsaserefpolicy/policy/modules/services/postfix.if	2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/postfix.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/postfix.if	2007-05-22 14:41:13.000000000 -0400
 @@ -122,6 +122,7 @@
  	allow postfix_$1_t postfix_master_t:unix_stream_socket { connectto rw_stream_socket_perms };
  	allow postfix_$1_t self:tcp_socket create_socket_perms;
@@ -4294,7 +4416,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-2.6.5/policy/modules/services/postfix.te
 --- nsaserefpolicy/policy/modules/services/postfix.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/postfix.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/postfix.te	2007-05-22 14:41:13.000000000 -0400
 @@ -169,6 +169,8 @@
  mta_rw_aliases(postfix_master_t)
  mta_read_sendmail_bin(postfix_master_t)
@@ -4406,7 +4528,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-2.6.5/policy/modules/services/ppp.te
 --- nsaserefpolicy/policy/modules/services/ppp.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/ppp.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/ppp.te	2007-05-22 14:41:13.000000000 -0400
 @@ -155,7 +155,7 @@
  
  files_exec_etc_files(pppd_t)
@@ -4418,7 +4540,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.
  # for scripts
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-2.6.5/policy/modules/services/procmail.te
 --- nsaserefpolicy/policy/modules/services/procmail.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/procmail.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/procmail.te	2007-05-22 14:41:13.000000000 -0400
 @@ -10,6 +10,7 @@
  type procmail_exec_t;
  domain_type(procmail_t)
@@ -4452,7 +4574,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-2.6.5/policy/modules/services/pyzor.te
 --- nsaserefpolicy/policy/modules/services/pyzor.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/pyzor.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/pyzor.te	2007-05-22 14:41:13.000000000 -0400
 @@ -54,6 +54,11 @@
  corenet_udp_sendrecv_all_nodes(pyzor_t)
  corenet_udp_sendrecv_all_ports(pyzor_t)
@@ -4483,7 +4605,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-2.6.5/policy/modules/services/radius.te
 --- nsaserefpolicy/policy/modules/services/radius.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/radius.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/radius.te	2007-05-22 14:41:13.000000000 -0400
 @@ -130,3 +130,7 @@
  optional_policy(`
  	udev_read_db(radiusd_t)
@@ -4494,7 +4616,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-2.6.5/policy/modules/services/rlogin.te
 --- nsaserefpolicy/policy/modules/services/rlogin.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/rlogin.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rlogin.te	2007-05-22 14:41:13.000000000 -0400
 @@ -64,6 +64,7 @@
  fs_search_auto_mountpoints(rlogind_t)
  
@@ -4505,7 +4627,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.fc serefpolicy-2.6.5/policy/modules/services/rpcbind.fc
 --- nsaserefpolicy/policy/modules/services/rpcbind.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/rpcbind.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rpcbind.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1,6 @@
 +
 +/sbin/rpcbind		--	gen_context(system_u:object_r:rpcbind_exec_t,s0)
@@ -4515,7 +4637,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
 +/var/lib/rpcbind(/.*)?			gen_context(system_u:object_r:rpcbind_var_lib_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-2.6.5/policy/modules/services/rpcbind.if
 --- nsaserefpolicy/policy/modules/services/rpcbind.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/rpcbind.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rpcbind.if	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1,104 @@
 +
 +## <summary>policy for rpcbind</summary>
@@ -4623,7 +4745,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-2.6.5/policy/modules/services/rpcbind.te
 --- nsaserefpolicy/policy/modules/services/rpcbind.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/rpcbind.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rpcbind.te	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1,83 @@
 +policy_module(rpcbind,1.0.0)
 +
@@ -4710,7 +4832,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-2.6.5/policy/modules/services/rpc.if
 --- nsaserefpolicy/policy/modules/services/rpc.if	2007-03-20 23:38:10.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/rpc.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rpc.if	2007-05-22 14:41:13.000000000 -0400
 @@ -89,8 +89,11 @@
  	# bind to arbitary unused ports
  	corenet_tcp_bind_generic_port($1_t)
@@ -4726,7 +4848,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
  	fs_search_auto_mountpoints($1_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-2.6.5/policy/modules/services/rpc.te
 --- nsaserefpolicy/policy/modules/services/rpc.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/rpc.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rpc.te	2007-05-22 14:41:13.000000000 -0400
 @@ -79,6 +79,7 @@
  
  optional_policy(`
@@ -4745,7 +4867,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
  tunable_policy(`nfs_export_all_ro',`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-2.6.5/policy/modules/services/rsync.te
 --- nsaserefpolicy/policy/modules/services/rsync.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/rsync.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rsync.te	2007-05-22 14:41:13.000000000 -0400
 @@ -17,6 +17,7 @@
  type rsync_t;
  type rsync_exec_t;
@@ -4756,7 +4878,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn
  type rsync_data_t;
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-2.6.5/policy/modules/services/rwho.if
 --- nsaserefpolicy/policy/modules/services/rwho.if	2007-04-30 22:35:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/rwho.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/rwho.if	2007-05-22 14:41:13.000000000 -0400
 @@ -1 +1,84 @@
 -## <summary>Who is logged in on other machines?</summary>
 +
@@ -4845,7 +4967,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-2.6.5/policy/modules/services/samba.fc
 --- nsaserefpolicy/policy/modules/services/samba.fc	2007-02-23 16:50:01.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/samba.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/samba.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -3,6 +3,7 @@
  # /etc
  #
@@ -4866,7 +4988,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-2.6.5/policy/modules/services/samba.if
 --- nsaserefpolicy/policy/modules/services/samba.if	2007-01-02 12:57:43.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/samba.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/samba.if	2007-05-22 14:41:13.000000000 -0400
 @@ -177,6 +177,27 @@
  
  ########################################
@@ -5014,7 +5136,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-2.6.5/policy/modules/services/samba.te
 --- nsaserefpolicy/policy/modules/services/samba.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/samba.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/samba.te	2007-05-23 11:15:09.000000000 -0400
 @@ -28,6 +28,35 @@
  ## </desc>
  gen_tunable(samba_share_nfs,false)
@@ -5249,11 +5371,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
 +tunable_policy(`samba_run_unconfined',`
 +	domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t)
 +')
-+
++unconfined_domain(samba_unconfined_script_t)
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-2.6.5/policy/modules/services/sasl.te
 --- nsaserefpolicy/policy/modules/services/sasl.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/sasl.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/sasl.te	2007-05-22 14:41:13.000000000 -0400
 @@ -63,6 +63,7 @@
  selinux_compute_access_vector(saslauthd_t)
  
@@ -5262,9 +5384,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl
  auth_use_nsswitch(saslauthd_t)
  
  domain_use_interactive_fds(saslauthd_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-2.6.5/policy/modules/services/sendmail.te
+--- nsaserefpolicy/policy/modules/services/sendmail.te	2007-05-18 11:12:43.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/sendmail.te	2007-05-23 10:53:14.000000000 -0400
+@@ -107,7 +107,6 @@
+ mta_manage_spool(sendmail_t)
+ 
+ ifdef(`targeted_policy',`
+-	unconfined_domain(sendmail_t)
+ 	term_dontaudit_use_unallocated_ttys(sendmail_t)
+ 	term_dontaudit_use_generic_ptys(sendmail_t)
+ 	files_dontaudit_read_root_files(sendmail_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-2.6.5/policy/modules/services/setroubleshoot.te
 --- nsaserefpolicy/policy/modules/services/setroubleshoot.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/setroubleshoot.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/setroubleshoot.te	2007-05-22 14:41:13.000000000 -0400
 @@ -28,7 +28,7 @@
  #
  
@@ -5276,7 +5409,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr
  allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto };
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-2.6.5/policy/modules/services/smartmon.te
 --- nsaserefpolicy/policy/modules/services/smartmon.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/smartmon.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/smartmon.te	2007-05-22 14:41:13.000000000 -0400
 @@ -60,6 +60,7 @@
  fs_search_auto_mountpoints(fsdaemon_t)
  
@@ -5287,7 +5420,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar
  storage_raw_write_fixed_disk(fsdaemon_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-2.6.5/policy/modules/services/snmp.fc
 --- nsaserefpolicy/policy/modules/services/snmp.fc	2006-11-16 17:15:20.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/snmp.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/snmp.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -1,11 +1,5 @@
  
  #
@@ -5302,7 +5435,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp
  /usr/sbin/snmp(trap)?d	--	gen_context(system_u:object_r:snmpd_exec_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-2.6.5/policy/modules/services/snmp.te
 --- nsaserefpolicy/policy/modules/services/snmp.te	2007-05-18 11:12:43.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/snmp.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/snmp.te	2007-05-22 14:41:13.000000000 -0400
 @@ -9,9 +9,6 @@
  type snmpd_exec_t;
  init_daemon_domain(snmpd_t,snmpd_exec_t)
@@ -5324,7 +5457,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.6.5/policy/modules/services/spamassassin.te
 --- nsaserefpolicy/policy/modules/services/spamassassin.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/spamassassin.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/spamassassin.te	2007-05-22 14:41:13.000000000 -0400
 @@ -6,14 +6,12 @@
  # Declarations
  #
@@ -5380,7 +5513,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-2.6.5/policy/modules/services/squid.fc
 --- nsaserefpolicy/policy/modules/services/squid.fc	2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/squid.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/squid.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -12,3 +12,5 @@
  /var/run/squid\.pid	--	gen_context(system_u:object_r:squid_var_run_t,s0)
  
@@ -5389,7 +5522,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
 +/usr/lib64/squid/cachemgr\.cgi	--	gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-2.6.5/policy/modules/services/squid.te
 --- nsaserefpolicy/policy/modules/services/squid.te	2007-05-07 10:32:44.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/squid.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/squid.te	2007-05-22 14:41:13.000000000 -0400
 @@ -185,3 +185,12 @@
  #squid requires the following when run in diskd mode, the recommended setting
  allow squid_t tmpfs_t:file { read write };
@@ -5405,7 +5538,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-2.6.5/policy/modules/services/ssh.if
 --- nsaserefpolicy/policy/modules/services/ssh.if	2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/ssh.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/ssh.if	2007-05-22 14:41:13.000000000 -0400
 @@ -709,3 +709,42 @@
  
  	dontaudit $1 sshd_key_t:file { getattr read };
@@ -5451,7 +5584,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-2.6.5/policy/modules/services/ssh.te
 --- nsaserefpolicy/policy/modules/services/ssh.te	2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/ssh.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/ssh.te	2007-05-22 14:41:13.000000000 -0400
 @@ -24,11 +24,11 @@
  
  # Type for the ssh-agent executable.
@@ -5487,7 +5620,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.
  	# Relabel and access ptys created by sshd
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-2.6.5/policy/modules/services/tftp.te
 --- nsaserefpolicy/policy/modules/services/tftp.te	2007-04-23 09:36:01.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/services/tftp.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/tftp.te	2007-05-22 14:41:13.000000000 -0400
 @@ -69,6 +69,7 @@
  logging_send_syslog_msg(tftpd_t)
  
@@ -5503,18 +5636,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-2.6.5/policy/modules/services/w3c.fc
 --- nsaserefpolicy/policy/modules/services/w3c.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/w3c.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/w3c.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1,2 @@
 +/usr/share/w3c-markup-validator(/.*)?		gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0)
 +/usr/share/w3c-markup-validator/cgi-bin(/.*)?	gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-2.6.5/policy/modules/services/w3c.if
 --- nsaserefpolicy/policy/modules/services/w3c.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/w3c.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/w3c.if	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1 @@
 +## <summary>W3C</summary>
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-2.6.5/policy/modules/services/w3c.te
 --- nsaserefpolicy/policy/modules/services/w3c.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/services/w3c.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/w3c.te	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1,14 @@
 +policy_module(w3c,1.2.1)
 +
@@ -5530,14 +5663,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.
 +corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t)
 +
 +miscfiles_read_certs(httpd_w3c_validator_script_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-2.6.5/policy/modules/services/xserver.if
+--- nsaserefpolicy/policy/modules/services/xserver.if	2007-05-04 12:19:22.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/services/xserver.if	2007-05-23 09:18:39.000000000 -0400
+@@ -1136,7 +1136,7 @@
+ 		type xdm_xserver_tmp_t;
+ 	')
+ 
+-	allow $1 xdm_xserver_tmp_t:file { getattr read };
++	read_files_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t)
+ ')
+ 
+ ########################################
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-2.6.5/policy/modules/system/application.fc
 --- nsaserefpolicy/policy/modules/system/application.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/application.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/application.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1 @@
 +# No application file contexts.
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-2.6.5/policy/modules/system/application.if
 --- nsaserefpolicy/policy/modules/system/application.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/application.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/application.if	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1,104 @@
 +## <summary>Policy for application domains</summary>
 +
@@ -5645,7 +5790,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-2.6.5/policy/modules/system/application.te
 --- nsaserefpolicy/policy/modules/system/application.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/application.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/application.te	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1,14 @@
 +
 +policy_module(application,1.0.0)
@@ -5663,7 +5808,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-2.6.5/policy/modules/system/authlogin.fc
 --- nsaserefpolicy/policy/modules/system/authlogin.fc	2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/authlogin.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/authlogin.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -14,6 +14,7 @@
  /sbin/pam_timestamp_check --	gen_context(system_u:object_r:pam_exec_t,s0)
  /sbin/unix_chkpwd	--	gen_context(system_u:object_r:chkpwd_exec_t,s0)
@@ -5674,7 +5819,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-2.6.5/policy/modules/system/authlogin.if
 --- nsaserefpolicy/policy/modules/system/authlogin.if	2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/authlogin.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/authlogin.if	2007-05-22 14:41:13.000000000 -0400
 @@ -27,11 +27,9 @@
  	domain_type($1_chkpwd_t)
  	domain_entry_file($1_chkpwd_t,chkpwd_exec_t)
@@ -5939,7 +6084,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-2.6.5/policy/modules/system/authlogin.te
 --- nsaserefpolicy/policy/modules/system/authlogin.te	2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/authlogin.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/authlogin.te	2007-05-22 14:41:13.000000000 -0400
 @@ -9,6 +9,13 @@
  attribute can_read_shadow_passwords;
  attribute can_write_shadow_passwords;
@@ -6004,7 +6149,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-2.6.5/policy/modules/system/clock.te
 --- nsaserefpolicy/policy/modules/system/clock.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/clock.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/clock.te	2007-05-22 14:41:13.000000000 -0400
 @@ -26,8 +26,6 @@
  allow hwclock_t self:process signal_perms;
  allow hwclock_t self:fifo_file { getattr read write };
@@ -6024,7 +6169,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-2.6.5/policy/modules/system/fstools.fc
 --- nsaserefpolicy/policy/modules/system/fstools.fc	2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/fstools.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/fstools.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -19,7 +19,6 @@
  /sbin/mkfs.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/mkraid		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -6035,7 +6180,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
  /sbin/partx		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-2.6.5/policy/modules/system/fstools.te
 --- nsaserefpolicy/policy/modules/system/fstools.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/fstools.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/fstools.te	2007-05-22 14:41:13.000000000 -0400
 @@ -9,6 +9,7 @@
  type fsadm_t;
  type fsadm_exec_t;
@@ -6046,7 +6191,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
  type fsadm_log_t;
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-2.6.5/policy/modules/system/fusermount.fc
 --- nsaserefpolicy/policy/modules/system/fusermount.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/fusermount.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/fusermount.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1,6 @@
 +# fusermount executable will have:
 +# label: system_u:object_r:fusermount_exec_t
@@ -6056,7 +6201,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
 +/usr/bin/fusermount		--	gen_context(system_u:object_r:fusermount_exec_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-2.6.5/policy/modules/system/fusermount.if
 --- nsaserefpolicy/policy/modules/system/fusermount.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/fusermount.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/fusermount.if	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1,41 @@
 +## <summary>policy for fusermount</summary>
 +
@@ -6102,7 +6247,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
 \ No newline at end of file
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-2.6.5/policy/modules/system/fusermount.te
 --- nsaserefpolicy/policy/modules/system/fusermount.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/fusermount.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/fusermount.te	2007-05-22 14:41:13.000000000 -0400
 @@ -0,0 +1,51 @@
 +policy_module(fusermount,1.0.0)
 +
@@ -6157,7 +6302,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-2.6.5/policy/modules/system/getty.te
 --- nsaserefpolicy/policy/modules/system/getty.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/getty.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/getty.te	2007-05-22 14:41:13.000000000 -0400
 @@ -33,7 +33,8 @@
  #
  
@@ -6170,7 +6315,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.
  allow getty_t self:fifo_file rw_fifo_file_perms;
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-2.6.5/policy/modules/system/hostname.te
 --- nsaserefpolicy/policy/modules/system/hostname.te	2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/hostname.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/hostname.te	2007-05-22 14:41:13.000000000 -0400
 @@ -8,8 +8,12 @@
  
  type hostname_t;
@@ -6199,7 +6344,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-2.6.5/policy/modules/system/init.if
 --- nsaserefpolicy/policy/modules/system/init.if	2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/init.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/init.if	2007-05-22 14:41:13.000000000 -0400
 @@ -194,11 +194,14 @@
  	gen_require(`
  		type initrc_t;
@@ -6319,7 +6464,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-2.6.5/policy/modules/system/init.te
 --- nsaserefpolicy/policy/modules/system/init.te	2007-04-30 10:41:38.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/init.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/init.te	2007-05-22 14:41:13.000000000 -0400
 @@ -10,13 +10,20 @@
  # Declarations
  #
@@ -6419,7 +6564,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
  optional_policy(`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-2.6.5/policy/modules/system/ipsec.if
 --- nsaserefpolicy/policy/modules/system/ipsec.if	2007-03-26 16:24:13.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/ipsec.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/ipsec.if	2007-05-22 14:41:13.000000000 -0400
 @@ -114,6 +114,26 @@
  
  ########################################
@@ -6449,7 +6594,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
  ## <param name="domain">
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-2.6.5/policy/modules/system/ipsec.te
 --- nsaserefpolicy/policy/modules/system/ipsec.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/ipsec.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/ipsec.te	2007-05-22 14:41:13.000000000 -0400
 @@ -289,6 +289,7 @@
  allow racoon_t self:netlink_selinux_socket { bind create read };
  allow racoon_t self:udp_socket create_socket_perms;
@@ -6460,7 +6605,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
  manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-2.6.5/policy/modules/system/iptables.te
 --- nsaserefpolicy/policy/modules/system/iptables.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/iptables.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/iptables.te	2007-05-22 14:41:13.000000000 -0400
 @@ -56,6 +56,7 @@
  domain_use_interactive_fds(iptables_t)
  
@@ -6479,7 +6624,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-2.6.5/policy/modules/system/libraries.fc
 --- nsaserefpolicy/policy/modules/system/libraries.fc	2007-05-04 12:19:22.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/libraries.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/libraries.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -81,8 +81,8 @@
  /opt/cisco-vpnclient/lib/libvpnapi\.so	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
  /opt/netbeans(.*/)?jdk.*/linux/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -6510,7 +6655,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
  /usr/lib(64)?/libGLU\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-2.6.5/policy/modules/system/libraries.te
 --- nsaserefpolicy/policy/modules/system/libraries.te	2007-05-04 12:19:23.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/libraries.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/libraries.te	2007-05-22 14:41:13.000000000 -0400
 @@ -62,7 +62,8 @@
  
  manage_dirs_pattern(ldconfig_t,ldconfig_tmp_t,ldconfig_tmp_t)
@@ -6531,7 +6676,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
  optional_policy(`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-2.6.5/policy/modules/system/locallogin.te
 --- nsaserefpolicy/policy/modules/system/locallogin.te	2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/locallogin.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/locallogin.te	2007-05-22 14:41:13.000000000 -0400
 @@ -48,6 +48,8 @@
  allow local_login_t self:msgq create_msgq_perms;
  allow local_login_t self:msg { send receive };
@@ -6574,8 +6719,34 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-2.6.5/policy/modules/system/logging.if
 --- nsaserefpolicy/policy/modules/system/logging.if	2007-03-26 10:39:07.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/logging.if	2007-05-18 11:59:15.000000000 -0400
-@@ -302,6 +302,25 @@
++++ serefpolicy-2.6.5/policy/modules/system/logging.if	2007-05-22 14:41:13.000000000 -0400
+@@ -223,6 +223,25 @@
+ 
+ ########################################
+ ## <summary>
++##	Execute klogd in the klog domain.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`logging_domtrans_klog',`
++	gen_require(`
++		type klogd_t, klogd_exec_t;
++	')
++
++	corecmd_search_bin($1)
++	domtrans_pattern($1,klogd_exec_t,klogd_t)
++')
++
++########################################
++## <summary>
+ ##	Create an object in the log directory, with a private
+ ##	type using a type transition.
+ ## </summary>
+@@ -302,6 +321,25 @@
  
  ########################################
  ## <summary>
@@ -6601,7 +6772,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
  ##	Allows the domain to open a file in the
  ##	log directory, but does not allow the listing
  ##	of the contents of the log directory.
-@@ -436,7 +455,7 @@
+@@ -436,7 +474,7 @@
  
  	files_search_var($1)
  	allow $1 var_log_t:dir list_dir_perms;
@@ -6610,7 +6781,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
  ')
  
  ########################################
-@@ -480,6 +499,8 @@
+@@ -480,6 +518,8 @@
  	files_search_var($1)
  	manage_files_pattern($1,logfile,logfile)
  	read_lnk_files_pattern($1,logfile,logfile)
@@ -6619,7 +6790,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
  ')
  
  ########################################
-@@ -563,3 +584,121 @@
+@@ -563,3 +603,121 @@
  	files_search_var($1)
  	manage_files_pattern($1,var_log_t,var_log_t)
  ')
@@ -6743,7 +6914,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-2.6.5/policy/modules/system/logging.te
 --- nsaserefpolicy/policy/modules/system/logging.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/logging.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/logging.te	2007-05-22 14:41:13.000000000 -0400
 @@ -7,10 +7,15 @@
  #
  
@@ -6831,7 +7002,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
  files_dontaudit_search_isid_type_dirs(syslogd_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-2.6.5/policy/modules/system/lvm.fc
 --- nsaserefpolicy/policy/modules/system/lvm.fc	2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/lvm.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/lvm.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -15,6 +15,7 @@
  #
  /etc/lvm(/.*)?			gen_context(system_u:object_r:lvm_etc_t,s0)
@@ -6842,7 +7013,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc
  /etc/lvm/lock(/.*)?		gen_context(system_u:object_r:lvm_lock_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-2.6.5/policy/modules/system/lvm.te
 --- nsaserefpolicy/policy/modules/system/lvm.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/lvm.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/lvm.te	2007-05-23 13:27:59.000000000 -0400
 @@ -16,6 +16,7 @@
  type lvm_t;
  type lvm_exec_t;
@@ -6879,8 +7050,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
  
  term_getattr_all_user_ttys(lvm_t)
  term_list_ptys(lvm_t)
-@@ -307,3 +313,8 @@
+@@ -305,5 +311,15 @@
+ ')
+ 
  optional_policy(`
++	modutils_domtrans_insmod(lvm_t)
++')
++
++optional_policy(`
  	udev_read_db(lvm_t)
  ')
 +
@@ -6888,9 +7065,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
 +	xen_append_log(lvm_t)
 +	xen_dontaudit_rw_unix_stream_sockets(lvm_t)
 +')
++
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-2.6.5/policy/modules/system/modutils.te
 --- nsaserefpolicy/policy/modules/system/modutils.te	2007-05-02 15:04:46.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/modutils.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/modutils.te	2007-05-22 14:41:13.000000000 -0400
 @@ -102,6 +102,7 @@
  init_use_fds(insmod_t)
  init_use_script_fds(insmod_t)
@@ -6932,7 +7110,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-2.6.5/policy/modules/system/mount.fc
 --- nsaserefpolicy/policy/modules/system/mount.fc	2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/mount.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/mount.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -1,4 +1,3 @@
  /bin/mount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
  /bin/umount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
@@ -6941,7 +7119,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
 +/sbin/mount.ntfs-3g		--	gen_context(system_u:object_r:mount_ntfs_exec_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-2.6.5/policy/modules/system/mount.if
 --- nsaserefpolicy/policy/modules/system/mount.if	2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/mount.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/mount.if	2007-05-22 14:41:13.000000000 -0400
 @@ -143,3 +143,40 @@
  		mount_domtrans($1)
  	')
@@ -6985,7 +7163,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-2.6.5/policy/modules/system/mount.te
 --- nsaserefpolicy/policy/modules/system/mount.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/mount.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/mount.te	2007-05-22 14:41:13.000000000 -0400
 @@ -9,6 +9,13 @@
  ifdef(`targeted_policy',`
  ## <desc>
@@ -7096,7 +7274,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-2.6.5/policy/modules/system/netlabel.te
 --- nsaserefpolicy/policy/modules/system/netlabel.te	2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/netlabel.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/netlabel.te	2007-05-22 14:41:13.000000000 -0400
 @@ -20,6 +20,10 @@
  allow netlabel_mgmt_t self:capability net_admin;
  allow netlabel_mgmt_t self:netlink_socket create_socket_perms;
@@ -7110,7 +7288,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlab
  libs_use_ld_so(netlabel_mgmt_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-2.6.5/policy/modules/system/raid.te
 --- nsaserefpolicy/policy/modules/system/raid.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/raid.te	2007-05-21 13:31:21.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/raid.te	2007-05-22 14:41:13.000000000 -0400
 @@ -19,7 +19,7 @@
  # Local policy
  #
@@ -7130,7 +7308,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-2.6.5/policy/modules/system/selinuxutil.fc
 --- nsaserefpolicy/policy/modules/system/selinuxutil.fc	2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/selinuxutil.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/selinuxutil.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -40,6 +40,7 @@
  /usr/sbin/setfiles.*		--	gen_context(system_u:object_r:setfiles_exec_t,s0)
  /usr/sbin/setsebool		--	gen_context(system_u:object_r:semanage_exec_t,s0)
@@ -7141,7 +7319,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
  #
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-2.6.5/policy/modules/system/selinuxutil.if
 --- nsaserefpolicy/policy/modules/system/selinuxutil.if	2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/selinuxutil.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/selinuxutil.if	2007-05-22 14:41:13.000000000 -0400
 @@ -432,6 +432,7 @@
  	role $2 types run_init_t;
  	allow run_init_t $3:chr_file rw_term_perms;
@@ -7152,7 +7330,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
  ########################################
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-2.6.5/policy/modules/system/selinuxutil.te
 --- nsaserefpolicy/policy/modules/system/selinuxutil.te	2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/selinuxutil.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/selinuxutil.te	2007-05-23 10:42:16.000000000 -0400
 @@ -1,10 +1,8 @@
  
  policy_module(selinuxutil,1.5.1)
@@ -7324,7 +7502,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
  
  dev_read_urand(semanage_t)
  
-@@ -518,6 +523,15 @@
+@@ -492,6 +497,8 @@
+ 
+ # Running genhomedircon requires this for finding all users
+ auth_use_nsswitch(semanage_t)
++# Admins are creating pp files in random locations
++auth_read_all_files_except_shadow(semanage_t)
+ 
+ libs_use_ld_so(semanage_t)
+ libs_use_shared_libs(semanage_t)
+@@ -518,6 +525,15 @@
  
  userdom_search_sysadm_home_dirs(semanage_t)
  
@@ -7342,7 +7529,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
  	# read secadm tmp files
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-2.6.5/policy/modules/system/sysnetwork.te
 --- nsaserefpolicy/policy/modules/system/sysnetwork.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/sysnetwork.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/sysnetwork.te	2007-05-22 14:41:13.000000000 -0400
 @@ -164,6 +164,10 @@
  	dbus_connect_system_bus(dhcpc_t)
  	dbus_send_system_bus(dhcpc_t)
@@ -7364,7 +7551,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
  optional_policy(`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-2.6.5/policy/modules/system/udev.te
 --- nsaserefpolicy/policy/modules/system/udev.te	2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/udev.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/udev.te	2007-05-22 14:41:13.000000000 -0400
 @@ -83,12 +83,19 @@
  kernel_dgram_send(udev_t)
  kernel_signal(udev_t)
@@ -7412,7 +7599,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-2.6.5/policy/modules/system/unconfined.fc
 --- nsaserefpolicy/policy/modules/system/unconfined.fc	2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/unconfined.fc	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/unconfined.fc	2007-05-22 14:41:13.000000000 -0400
 @@ -10,4 +10,5 @@
  /usr/bin/valgrind 		--	gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
  /usr/local/RealPlayer/realplay\.bin --	gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
@@ -7421,7 +7608,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-2.6.5/policy/modules/system/unconfined.if
 --- nsaserefpolicy/policy/modules/system/unconfined.if	2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/unconfined.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/unconfined.if	2007-05-22 14:41:13.000000000 -0400
 @@ -18,7 +18,7 @@
  	')
  
@@ -7482,7 +7669,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-2.6.5/policy/modules/system/unconfined.te
 --- nsaserefpolicy/policy/modules/system/unconfined.te	2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/unconfined.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/unconfined.te	2007-05-22 14:41:13.000000000 -0400
 @@ -6,6 +6,15 @@
  # Declarations
  #
@@ -7567,7 +7754,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
  		init_dbus_chat_script(unconfined_execmem_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.6.5/policy/modules/system/userdomain.if
 --- nsaserefpolicy/policy/modules/system/userdomain.if	2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/userdomain.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/userdomain.if	2007-05-22 14:41:13.000000000 -0400
 @@ -114,6 +114,18 @@
  		# Allow making the stack executable via mprotect.
  		allow $1_t self:process execstack;
@@ -8115,7 +8302,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.6.5/policy/modules/system/userdomain.te
 --- nsaserefpolicy/policy/modules/system/userdomain.te	2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/userdomain.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/userdomain.te	2007-05-22 14:41:13.000000000 -0400
 @@ -15,7 +15,6 @@
  # Declarations
  #
@@ -8294,7 +8481,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-2.6.5/policy/modules/system/xen.if
 --- nsaserefpolicy/policy/modules/system/xen.if	2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-2.6.5/policy/modules/system/xen.if	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/xen.if	2007-05-22 14:41:13.000000000 -0400
 @@ -72,12 +72,35 @@
  	')
  
@@ -8359,7 +8546,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-2.6.5/policy/modules/system/xen.te
 --- nsaserefpolicy/policy/modules/system/xen.te	2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.5/policy/modules/system/xen.te	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/modules/system/xen.te	2007-05-22 14:41:13.000000000 -0400
 @@ -25,6 +25,10 @@
  domain_type(xend_t)
  init_daemon_domain(xend_t, xend_exec_t)
@@ -8465,7 +8652,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
 +fs_read_dos_files(xend_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-2.6.5/policy/support/misc_patterns.spt
 --- nsaserefpolicy/policy/support/misc_patterns.spt	2007-01-02 12:57:51.000000000 -0500
-+++ serefpolicy-2.6.5/policy/support/misc_patterns.spt	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/support/misc_patterns.spt	2007-05-22 14:41:13.000000000 -0400
 @@ -41,11 +41,6 @@
  #
  # Other process permissions
@@ -8480,7 +8667,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns
  	allow $1 $2:{ file lnk_file } { read getattr };
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-2.6.5/policy/support/obj_perm_sets.spt
 --- nsaserefpolicy/policy/support/obj_perm_sets.spt	2007-05-04 12:19:23.000000000 -0400
-+++ serefpolicy-2.6.5/policy/support/obj_perm_sets.spt	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/policy/support/obj_perm_sets.spt	2007-05-22 14:41:13.000000000 -0400
 @@ -203,7 +203,6 @@
  define(`add_entry_dir_perms',`{ getattr search lock ioctl write add_name }')
  define(`del_entry_dir_perms',`{ getattr search lock ioctl write remove_name }')
@@ -8514,7 +8701,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-2.6.5/Rules.modular
 --- nsaserefpolicy/Rules.modular	2007-03-22 14:30:10.000000000 -0400
-+++ serefpolicy-2.6.5/Rules.modular	2007-05-18 11:59:15.000000000 -0400
++++ serefpolicy-2.6.5/Rules.modular	2007-05-22 14:41:13.000000000 -0400
 @@ -167,7 +167,7 @@
  # these have to run individually because order matters:
  	$(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
diff --git a/selinux-policy.spec b/selinux-policy.spec
index f559dc00..2a9bd2f8 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -17,7 +17,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 2.6.5
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPL
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -359,7 +359,10 @@ semodule -b base.pp -r bootloader -r clock -r dpkg -r fstools -r hotplug -r init
 %endif
 
 %changelog
-* Fri May 18 2007 Dan Walsh <dwalsh@redhat.com> 2.6.5-1
+* Fri May 18 2007 Dan Walsh <dwalsh@redhat.com> 2.6.5-2
+- Fix for amands
+- Allow semanage to read pp files
+- Allow rhgb to read xdm_xserver_tmp
 
 * Fri May 18 2007 Dan Walsh <dwalsh@redhat.com> 2.6.4-7
 - Allow kerberos servers to use ldap for backing store