diff --git a/refpolicy/policy/modules/system/selinux.fc b/refpolicy/policy/modules/system/selinux.fc
deleted file mode 100644
index fb39d898..00000000
--- a/refpolicy/policy/modules/system/selinux.fc
+++ /dev/null
@@ -1,40 +0,0 @@
-
-#
-# /etc
-#
-/etc/selinux(/.*)? context_template(system_u:object_r:selinux_config_t,s0)
-
-/etc/selinux/([^/]*/)?contexts(/.*)? context_template(system_u:object_r:default_context_t,s0)
-
-/etc/selinux/([^/]*/)?contexts/files(/.*)? context_template(system_u:object_r:file_context_t,s0)
-
-/etc/selinux/([^/]*/)?policy(/.*)? context_template(system_u:object_r:policy_config_t,s0)
-
-/etc/selinux/([^/]*/)?src(/.*)? context_template(system_u:object_r:policy_src_t,s0)
-
-#
-# /root
-#
-/root/\.default_contexts -- context_template(system_u:object_r:default_context_t,s0)
-
-#
-# /sbin
-#
-/sbin/load_policy -- context_template(system_u:object_r:load_policy_exec_t,s0)
-/sbin/restorecon -- context_template(system_u:object_r:restorecon_exec_t,s0)
-
-#
-# /usr
-#
-/usr/bin/checkpolicy -- context_template(system_u:object_r:checkpolicy_exec_t,s0)
-/usr/bin/newrole -- context_template(system_u:object_r:newrole_exec_t,s0)
-
-/usr/lib(64)?/selinux(/.*)? context_template(system_u:object_r:policy_src_t,s0)
-
-/usr/sbin/load_policy -- context_template(system_u:object_r:load_policy_exec_t,s0)
-/usr/sbin/run_init -- context_template(system_u:object_r:run_init_exec_t,s0)
-/usr/sbin/setfiles.* -- context_template(system_u:object_r:setfiles_exec_t,s0)
-
-ifdef(`distro_debian', `
-/usr/share/selinux(/.*)? context_template(system_u:object_r:policy_src_t,s0)
-')
diff --git a/refpolicy/policy/modules/system/selinux.if b/refpolicy/policy/modules/system/selinux.if
deleted file mode 100644
index 433d28ec..00000000
--- a/refpolicy/policy/modules/system/selinux.if
+++ /dev/null
@@ -1,744 +0,0 @@
-##
-## Policy for SELinux policy and userland applications.
-
-#######################################
-##
-##
-## Execute checkpolicy in the checkpolicy domain.
-##
-##
-## The type of the process performing this action.
-##
-##
-#
-define(`selinux_domtrans_checkpol',`
- gen_require(`$0'_depend)
-
- allow $1 checkpolicy_exec_t:file rx_file_perms;
- allow $1 checkpolicy_t:process transition;
- type_transition $1 checkpolicy_exec_t:process checkpolicy_t;
- dontaudit $1 checkpolicy_t:process { noatsecure siginh rlimitinh };
-
- allow $1 checkpolicy_t:fd use;
- allow checkpolicy_t $1:fd use;
- allow checkpolicy_t $1:fifo_file rw_file_perms;
- allow checkpolicy_t $1:process sigchld;
-')
-
-define(`selinux_domtrans_checkpol_depend',`
- type checkpolicy_t, checkpolicy_exec_t;
-
- class file rx_file_perms
- class process { transition noatsecure siginh rlimitinh sigchld sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
-########################################
-##
-##
-## Execute checkpolicy in the checkpolicy domain, and
-## allow the specified role the checkpolicy domain,
-## and use the caller's terminal.
-## Has a SIGCHLD signal backchannel.
-##
-##
-## The type of the process performing this action.
-##
-##
-## The role to be allowed the checkpolicy domain.
-##
-##
-## The type of the terminal allow the checkpolicy domain to use.
-##
-##
-#
-define(`selinux_run_checkpol',`
- gen_require(`$0'_depend)
-
- selinux_domtrans_checkpol($1)
- role $2 types checkpolicy_t;
- allow checkpolicy_t $3:chr_file { getattr read write ioctl };
-')
-
-define(`selinux_run_checkpol_depend',`
- type checkpolicy_t;
-
- class chr_file { getattr read write ioctl };
-')
-
-#######################################
-#
-# selinux_exec_checkpol(domain)
-#
-define(`selinux_exec_checkpol',`
- gen_require(`$0'_depend)
-
- can_exec($1,checkpolicy_exec_t)
-')
-
-define(`selinux_exec_checkpol_depend',`
- type checkpolicy_exec_t;
-
- class file { rx_file_perms execute_no_trans };
-')
-
-#######################################
-##
-##
-## Execute load_policy in the load_policy domain.
-##
-##
-## The type of the process performing this action.
-##
-##
-#
-define(`selinux_domtrans_loadpol',`
- gen_require(`$0'_depend)
-
- allow $1 load_policy_exec_t:file rx_file_perms;
- allow $1 load_policy_t:process transition;
- type_transition $1 load_policy_exec_t:process load_policy_t;
- dontaudit $1 load_policy_t:process { noatsecure siginh rlimitinh };
-
- allow $1 load_policy_t:fd use;
- allow load_policy_t $1:fd use;
- allow load_policy_t $1:fifo_file rw_file_perms;
- allow load_policy_t $1:process sigchld;
-')
-
-define(`selinux_domtrans_loadpol_depend',`
- type load_policy_t, load_policy_exec_t;
-
- class file rx_file_perms;
- class process { transition noatsecure siginh rlimitinh sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
-########################################
-##
-##
-## Execute load_policy in the load_policy domain, and
-## allow the specified role the load_policy domain,
-## and use the caller's terminal.
-## Has a SIGCHLD signal backchannel.
-##
-##
-## The type of the process performing this action.
-##
-##
-## The role to be allowed the load_policy domain.
-##
-##
-## The type of the terminal allow the load_policy domain to use.
-##
-##
-#
-define(`selinux_run_loadpol',`
- gen_require(`$0'_depend)
-
- selinux_domtrans_loadpol($1)
- role $2 types load_policy_t;
- allow load_policy_t $3:chr_file { getattr read write ioctl };
-')
-
-define(`selinux_run_loadpol_depend',`
- type load_policy_t;
-
- class chr_file { getattr read write ioctl };
-')
-
-#######################################
-#
-# selinux_exec_loadpol(domain)
-#
-define(`selinux_exec_loadpol',`
- gen_require(`$0'_depend)
-
- can_exec($1,load_policy_exec_t)
-')
-
-define(`selinux_exec_loadpol_depend',`
- type load_policy_exec_t;
-
- class file { rx_file_perms execute_no_trans };
-')
-
-#######################################
-#
-# selinux_read_loadpol(domain)
-#
-define(`selinux_read_loadpol',`
- gen_require(`$0'_depend)
-
- allow $1 load_policy_exec_t:file r_file_perms;
-')
-
-define(`selinux_read_loadpol_depend',`
- type load_policy_exec_t;
-
- class file r_file_perms
-')
-
-#######################################
-##
-##
-## Execute newrole in the load_policy domain.
-##
-##
-## The type of the process performing this action.
-##
-##
-#
-define(`selinux_domtrans_newrole',`
- gen_require(`$0'_depend)
-
- allow $1 newrole_exec_t:file rx_file_perms;
- allow $1 newrole_t:process transition;
- type_transition $1 newrole_exec_t:process newrole_t;
- dontaudit $1 newrole_t:process { noatsecure siginh rlimitinh };
-
- allow $1 newrole_t:fd use;
- allow newrole_t $1:fd use;
- allow newrole_t $1:fifo_file rw_file_perms;
- allow newrole_t $1:process sigchld;
-')
-
-define(`selinux_domtrans_newrole_depend',`
- type newrole_t, newrole_exec_t;
-
- class file rx_file_perms;
- class process { transition noatsecure siginh rlimitinh sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
-########################################
-##
-##
-## Execute newrole in the newrole domain, and
-## allow the specified role the newrole domain,
-## and use the caller's terminal.
-##
-##
-## The type of the process performing this action.
-##
-##
-## The role to be allowed the newrole domain.
-##
-##
-## The type of the terminal allow the newrole domain to use.
-##
-##
-#
-define(`selinux_run_newrole',`
- gen_require(`$0'_depend)
-
- selinux_domtrans_newrole($1)
- role $2 types newrole_t;
- allow newrole_t $3:chr_file { getattr read write ioctl };
-')
-
-define(`selinux_run_newrole_depend',`
- type newrole_t;
-
- class chr_file { getattr read write ioctl };
-')
-
-#######################################
-#
-# selinux_exec_newrole(domain)
-#
-define(`selinux_exec_newrole',`
- gen_require(`$0'_depend)
-
- can_exec($1,newrole_exec_t)
-')
-
-define(`selinux_exec_newrole_depend',`
- type newrole_t, newrole_exec_t;
-
- class file { rx_file_perms execute_no_trans };
-')
-
-########################################
-##
-##
-## Do not audit the caller attempts to send
-## a signal to newrole.
-##
-##
-## The type of the process performing this action.
-##
-##
-#
-define(`selinux_dontaudit_newrole_signal',`
- gen_require(`$0'_depend)
-
- dontaudit $1 newrole_t:process signal;
-')
-
-define(`selinux_dontaudit_newrole_signal_depend',`
- type newrole_t;
-
- class process signal;
-')
-
-#######################################
-#
-# selinux_newrole_sigchld(domain)
-#
-define(`selinux_newrole_sigchld',`
- gen_require(`$0'_depend)
-
- allow $1 newrole_t:process sigchld;
-')
-
-define(`selinux_newrole_sigchld_depend',`
- type newrole_t;
-
- class process sigchld;
-')
-
-#######################################
-#
-# selinux_use_newrole_fd(domain)
-#
-define(`selinux_use_newrole_fd',`
- gen_require(`$0'_depend)
-
- allow $1 newrole_t:fd use;
-')
-
-define(`selinux_use_newrole_fd_depend',`
- type newrole_t;
-
- class fd use;
-')
-
-#######################################
-##
-##
-## Execute restorecon in the restorecon domain.
-##
-##
-## The type of the process performing this action.
-##
-##
-#
-define(`selinux_domtrans_restorecon',`
- gen_require(`$0'_depend)
-
- allow $1 restorecon_exec_t:file rx_file_perms;
- allow $1 restorecon_t:process transition;
- type_transition $1 restorecon_exec_t:process restorecon_t;
- dontaudit $1 restorecon_t:process { noatsecure siginh rlimitinh };
-
- allow $1 restorecon_t:fd use;
- allow restorecon_t $1:fd use;
- allow restorecon_t $1:fifo_file rw_file_perms;
- allow restorecon_t $1:process sigchld;
-')
-
-define(`selinux_domtrans_restorecon_depend',`
- type restorecon_t, restorecon_exec_t;
-
- class file rx_file_perms;
- class process { transition noatsecure siginh rlimitinh sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
-########################################
-##
-##
-## Execute restorecon in the restorecon domain, and
-## allow the specified role the restorecon domain,
-## and use the caller's terminal.
-##
-##
-## The type of the process performing this action.
-##
-##
-## The role to be allowed the restorecon domain.
-##
-##
-## The type of the terminal allow the restorecon domain to use.
-##
-##
-#
-define(`selinux_run_restorecon',`
- gen_require(`$0'_depend)
-
- selinux_domtrans_restorecon($1)
- role $2 types restorecon_t;
- allow restorecon_t $3:chr_file { getattr read write ioctl };
-')
-
-define(`selinux_run_restorecon_depend',`
- type restorecon_t;
-
- class chr_file { getattr read write ioctl };
-')
-
-#######################################
-#
-# selinux_exec_restorecon(domain)
-#
-define(`selinux_exec_restorecon',`
-gen_require(`$0'_depend)
- can_exec($1,restorecon_exec_t)
-')
-
-define(`selinux_exec_restorecon_depend',`
- type restorecon_t, restorecon_exec_t;
-
- class file { rx_file_perms execute_no_trans };
-')
-
-########################################
-##
-##
-## Execute run_init in the run_init domain.
-##
-##
-## The type of the process performing this action.
-##
-##
-#
-define(`selinux_domtrans_runinit',`
- gen_require(`$0'_depend)
-
- allow $1 run_init_exec_t:file rx_file_perms;
- allow $1 run_init_t:process transition;
- type_transition $1 run_init_exec_t:process run_init_t;
- dontaudit $1 run_init_t:process { noatsecure siginh rlimitinh };
-
- allow $1 run_init_t:fd use;
- allow run_init_t $1:fd use;
- allow run_init_t $1:fifo_file rw_file_perms;
- allow run_init_t $1:process sigchld;
-')
-
-define(`selinux_domtrans_runinit_depend',`
- type run_init_t, run_init_exec_t;
-
- class file rx_file_perms;
- class process { transition noatsecure siginh rlimitinh sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
-########################################
-##
-##
-## Execute run_init in the run_init domain, and
-## allow the specified role the run_init domain,
-## and use the caller's terminal.
-##
-##
-## The type of the process performing this action.
-##
-##
-## The role to be allowed the run_init domain.
-##
-##
-## The type of the terminal allow the run_init domain to use.
-##
-##
-#
-define(`selinux_run_runinit',`
- gen_require(`$0'_depend)
-
- selinux_domtrans_runinit($1)
- role $2 types run_init_t;
- allow run_init_t $3:chr_file { getattr read write ioctl };
-')
-
-define(`selinux_run_runinit_depend',`
- type run_init_t;
-
- class chr_file { getattr read write ioctl };
-')
-
-########################################
-#
-# selinux_use_runinit_fd(domain)
-#
-define(`selinux_use_runinit_fd',`
- gen_require(`$0'_depend)
-
- allow $1 run_init_t:fd use;
-')
-
-define(`selinux_use_runinit_fd_depend',`
- type run_init_t;
-
- class fd use;
-')
-
-########################################
-##
-##
-## Execute setfiles in the setfiles domain.
-##
-##
-## The type of the process performing this action.
-##
-##
-#
-define(`selinux_domtrans_setfiles',`
- gen_require(`$0'_depend)
-
- allow $1 setfiles_exec_t:file rx_file_perms;
- allow $1 setfiles_t:process transition;
- type_transition $1 setfiles_exec_t:process setfiles_t;
- dontaudit $1 setfiles_t:process { noatsecure siginh rlimitinh };
-
- allow $1 setfiles_t:fd use;
- allow setfiles_t $1:fd use;
- allow setfiles_t $1:fifo_file rw_file_perms;
- allow setfiles_t $1:process sigchld;
-')
-
-define(`selinux_domtrans_setfiles_depend',`
- type setfiles_t, setfiles_exec_t;
-
- class file rx_file_perms;
- class process { transition noatsecure siginh rlimitinh sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
-########################################
-##
-##
-## Execute setfiles in the setfiles domain, and
-## allow the specified role the setfiles domain,
-## and use the caller's terminal.
-##
-##
-## The type of the process performing this action.
-##
-##
-## The role to be allowed the setfiles domain.
-##
-##
-## The type of the terminal allow the setfiles domain to use.
-##
-##
-#
-define(`selinux_run_setfiles',`
- gen_require(`$0'_depend)
-
- selinux_domtrans_setfiles($1)
- role $2 types setfiles_t;
- allow setfiles_t $3:chr_file { getattr read write ioctl };
-')
-
-define(`selinux_run_setfiles_depend',`
- type setfiles_t;
-
- class chr_file { getattr read write ioctl };
-')
-
-#######################################
-#
-# selinux_exec_setfiles(domain)
-#
-define(`selinux_exec_setfiles',`
- gen_require(`$0'_depend)
-
- can_exec($1,setfiles_exec_t)
-')
-
-define(`selinux_exec_setfiles_depend',`
- type setfiles_exec_t;
-
- class file { rx_file_perms execute_no_trans };
-')
-
-########################################
-#
-# selinux_read_config(domain)
-#
-define(`selinux_read_config',`
- gen_require(`$0'_depend)
-
- allow $1 selinux_config_t:dir r_dir_perms;
- allow $1 selinux_config_t:file r_file_perms;
-')
-
-define(`selinux_read_config_depend',`
- type selinux_config_t;
-
- class dir r_dir_perms;
- class file r_file_perms;
-')
-
-########################################
-#
-# selinux_read_default_contexts(domain)
-#
-define(`selinux_read_default_contexts',`
- gen_require(`$0'_depend)
-
- allow $1 selinux_config_t:dir search;
- allow $1 default_context_t:dir r_dir_perms;
- allow $1 default_context_t:file r_file_perms;
-')
-
-define(`selinux_read_default_contexts_depend',`
- type selinux_config_t, default_context_t;
-
- class dir r_dir_perms;
- class file r_file_perms;
-')
-
-########################################
-#
-# selinux_read_file_contexts(domain)
-#
-define(`selinux_read_file_contexts',`
- gen_require(`$0'_depend)
-
- allow $1 selinux_config_t:dir search;
- allow $1 file_context_t:dir r_dir_perms;
- allow $1 file_context_t:file r_file_perms;
-')
-
-define(`selinux_read_file_contexts_depend',`
- type selinux_config_t, file_context_t;
-
- class dir r_dir_perms;
- class file r_file_perms;
-')
-
-########################################
-#
-# selinux_read_binary_pol(domain)
-#
-define(`selinux_read_binary_pol',`
- gen_require(`$0'_depend)
-
- allow $1 policy_config_t:dir r_dir_perms;
- allow $1 policy_config_t:file r_file_perms;
-')
-
-define(`selinux_read_binary_pol_depend',`
- type policy_config_t;
-
- class dir r_dir_perms;
- class file r_file_perms;
-')
-
-########################################
-#
-# selinux_write_binary_pol(domain)
-#
-define(`selinux_write_binary_pol',`
- gen_require(`$0'_depend)
-
- allow $1 policy_config_t:dir rw_dir_perms;
- allow $1 policy_config_t:file { getattr create write unlink };
- typeattribute $1 can_write_binary_policy;
-')
-
-define(`selinux_write_binary_pol_depend',`
- attribute can_write_binary_policy;
-
- type policy_config_t;
-
- class dir rw_dir_perms;
- class file { getattr create write unlink };
-')
-
-########################################
-##
-##
-## Allow the caller to relabel a file to the binary policy type.
-##
-##
-## The type of the process performing this action.
-##
-##
-#
-define(`selinux_relabelto_binary_pol',`
- gen_require(`$0'_depend)
-
- allow $1 policy_config_t:file relabelto;
- typeattribute $1 can_relabelto_binary_policy;
-')
-
-define(`selinux_relabelto_binary_pol_depend',`
- attribute can_relabelto_binary_policy;
-
- type policy_config_t;
-
- class file relabelto;
-')
-
-########################################
-#
-# selinux_manage_binary_pol(domain)
-#
-define(`selinux_manage_binary_pol',`
- gen_require(`$0'_depend)
-
- # FIXME: search etc_t:dir
- allow $1 selinux_config_t:dir search;
- allow $1 policy_config_t:dir r_dir_perms;
- allow $1 policy_config_t:file create_file_perms;
- typeattribute $1 can_write_binary_policy;
-')
-
-define(`selinux_manage_binary_pol_depend',`
- attribute can_write_binary_policy;
-
- type selinux_config_t, policy_config_t;
- class dir create_dir_perms;
- class file create_file_perms;
-')
-
-########################################
-#
-# selinux_read_src_pol(domain)
-#
-define(`selinux_read_src_pol',`
- gen_require(`$0'_depend)
-
- # FIXME: search etc_t:dir
- allow $1 selinux_config_t:dir search;
- allow $1 policy_src_t:dir r_dir_perms;
- allow $1 policy_src_t:file r_file_perms;
-')
-
-define(`selinux_read_src_pol_depend',`
- type selinux_config_t, policy_src_t;
-
- class dir r_dir_perms;
- class file r_file_perms;
-')
-
-########################################
-#
-# selinux_manage_src_pol(domain)
-#
-define(`selinux_manage_src_pol',`
- gen_require(`$0'_depend)
-
- # FIXME: search etc_t:dir
- allow $1 selinux_config_t:dir search;
- allow $1 policy_src_t:dir create_dir_perms;
- allow $1 policy_src_t:file create_file_perms;
-')
-
-define(`selinux_manage_src_pol_depend',`
- type selinux_config_t, policy_src_t;
-
- class dir create_dir_perms;
- class file create_file_perms;
-')
-
-##
diff --git a/refpolicy/policy/modules/system/selinux.te b/refpolicy/policy/modules/system/selinux.te
deleted file mode 100644
index 6027d4ae..00000000
--- a/refpolicy/policy/modules/system/selinux.te
+++ /dev/null
@@ -1,467 +0,0 @@
-
-policy_module(selinux,1.0)
-
-########################################
-#
-# Declarations
-#
-
-attribute can_write_binary_policy;
-attribute can_relabelto_binary_policy;
-
-type checkpolicy_t, can_write_binary_policy;
-domain_type(checkpolicy_t)
-role system_r types checkpolicy_t;
-
-type checkpolicy_exec_t;
-domain_entry_file(checkpolicy_t,checkpolicy_exec_t)
-
-#
-# default_context_t is the type applied to
-# /etc/selinux/*/contexts/*
-#
-type default_context_t;
-files_file_type(default_context_t)
-
-#
-# file_context_t is the type applied to
-# /etc/selinux/*/contexts/files
-#
-type file_context_t;
-files_file_type(file_context_t)
-
-type load_policy_t;
-domain_type(load_policy_t)
-role system_r types load_policy_t;
-
-type load_policy_exec_t;
-domain_entry_file(load_policy_t,load_policy_exec_t)
-
-type newrole_t; # nscd_client_domain, mlsfileread, mlsfilewrite, mlsfileupgrade, mlsfiledowngrade, mlsprocsetsl;
-domain_role_change_exempt(newrole_t)
-domain_obj_id_change_exempt(newrole_t)
-domain_type(newrole_t)
-domain_wide_inherit_fd(newrole_t)
-
-type newrole_exec_t;
-domain_entry_file(newrole_t,newrole_exec_t)
-
-#
-# policy_config_t is the type of /etc/security/selinux/*
-# the security server policy configuration.
-#
-type policy_config_t;
-files_file_type(policy_config_t)
-
-neverallow ~can_relabelto_binary_policy policy_config_t:file relabelto;
-neverallow ~can_write_binary_policy policy_config_t:file { write append };
-
-#
-# policy_src_t is the type of the policy source
-# files.
-#
-type policy_src_t;
-files_file_type(policy_src_t)
-
-type restorecon_t, can_relabelto_binary_policy;
-type restorecon_exec_t;
-domain_obj_id_change_exempt(restorecon_t)
-init_system_domain(restorecon_t,restorecon_exec_t)
-role system_r types restorecon_t;
-
-type run_init_t;
-domain_type(run_init_t)
-
-type run_init_exec_t;
-domain_entry_file(run_init_t,run_init_exec_t)
-
-#
-# selinux_config_t is the type applied to
-# /etc/selinux/config
-#
-type selinux_config_t;
-files_file_type(selinux_config_t)
-
-type setfiles_t, can_relabelto_binary_policy;
-domain_obj_id_change_exempt(setfiles_t)
-domain_type(setfiles_t)
-role system_r types setfiles_t;
-
-type setfiles_exec_t;
-domain_entry_file(setfiles_t,setfiles_exec_t)
-
-########################################
-#
-# Checkpolicy local policy
-#
-
-allow checkpolicy_t self:capability dac_override;
-
-# able to create and modify binary policy files
-allow checkpolicy_t policy_config_t:dir rw_dir_perms;
-allow checkpolicy_t policy_config_t:file create_file_perms;
-
-# allow test policies to be created in src directories
-allow checkpolicy_t policy_src_t:dir rw_dir_perms;
-type_transition checkpolicy_t policy_src_t:file policy_config_t;
-
-# only allow read of policy source files
-allow checkpolicy_t policy_src_t:dir r_dir_perms;
-allow checkpolicy_t policy_src_t:file r_file_perms;
-allow checkpolicy_t policy_src_t:lnk_file r_file_perms;
-allow checkpolicy_t selinux_config_t:dir search;
-
-fs_getattr_xattr_fs(checkpolicy_t)
-
-term_use_console(checkpolicy_t)
-
-domain_use_wide_inherit_fd(checkpolicy_t)
-
-# directory search permissions for path to source and binary policy files
-files_search_etc(checkpolicy_t)
-
-init_use_fd(checkpolicy_t)
-init_use_script_pty(checkpolicy_t)
-
-libs_use_ld_so(checkpolicy_t)
-libs_use_shared_libs(checkpolicy_t)
-
-userdom_use_all_user_fd(checkpolicy_t)
-
-ifdef(`TODO',`
-# Read the devpts root directory.
-ifdef(`sshd.te',`allow checkpolicy_t sshd_devpts_t:dir r_dir_perms;')
-') dnl endif TODO
-
-########################################
-#
-# Load_policy local policy
-#
-
-allow load_policy_t self:capability dac_override;
-
-# only allow read of policy config files
-allow load_policy_t policy_src_t:dir search;
-allow load_policy_t policy_config_t:dir r_dir_perms;
-allow load_policy_t policy_config_t:notdevfile_class_set r_file_perms;
-
-allow load_policy_t selinux_config_t:dir r_dir_perms;
-allow load_policy_t selinux_config_t:file r_file_perms;
-allow load_policy_t selinux_config_t:lnk_file r_file_perms;
-
-kernel_get_selinuxfs_mount_point(load_policy_t)
-kernel_load_policy(load_policy_t)
-kernel_set_boolean(load_policy_t)
-
-fs_getattr_xattr_fs(load_policy_t)
-
-term_use_console(load_policy_t)
-term_list_ptys(load_policy_t)
-
-init_use_script_fd(load_policy_t)
-init_use_script_pty(load_policy_t)
-
-domain_use_wide_inherit_fd(load_policy_t)
-
-files_search_etc(load_policy_t)
-
-libs_use_ld_so(load_policy_t)
-libs_use_shared_libs(load_policy_t)
-
-miscfiles_read_localization(load_policy_t)
-
-userdom_use_all_user_fd(load_policy_t)
-
-########################################
-#
-# Newrole local policy
-#
-
-allow newrole_t self:capability { setuid setgid net_bind_service dac_override };
-
-allow newrole_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem dyntransition };
-allow newrole_t self:process setexec;
-allow newrole_t self:fd use;
-allow newrole_t self:fifo_file rw_file_perms;
-allow newrole_t self:unix_dgram_socket sendto;
-allow newrole_t self:unix_stream_socket connectto;
-allow newrole_t self:shm create_shm_perms;
-allow newrole_t self:sem create_sem_perms;
-allow newrole_t self:msgq create_msgq_perms;
-allow newrole_t self:msg { send receive };
-
-allow newrole_t { selinux_config_t default_context_t }:dir r_dir_perms;
-allow newrole_t { selinux_config_t default_context_t }:file r_file_perms;
-allow newrole_t { selinux_config_t default_context_t }:lnk_file r_file_perms;
-
-kernel_read_system_state(newrole_t)
-kernel_read_kernel_sysctl(newrole_t)
-kernel_get_selinuxfs_mount_point(newrole_t)
-kernel_validate_context(newrole_t)
-kernel_compute_access_vector(newrole_t)
-kernel_compute_create_context(newrole_t)
-kernel_compute_relabel_context(newrole_t)
-kernel_compute_reachable_user_contexts(newrole_t)
-
-dev_read_urand(newrole_t)
-
-fs_getattr_xattr_fs(newrole_t)
-
-term_use_all_user_ttys(newrole_t)
-term_use_all_user_ptys(newrole_t)
-
-auth_domtrans_chk_passwd(newrole_t)
-
-domain_use_wide_inherit_fd(newrole_t)
-
-# Write to utmp.
-init_rw_script_pid(newrole_t)
-
-files_read_generic_etc_files(newrole_t)
-
-libs_use_ld_so(newrole_t)
-libs_use_shared_libs(newrole_t)
-
-logging_send_syslog_msg(newrole_t)
-
-miscfiles_read_localization(newrole_t)
-
-userdom_use_unpriv_users_fd(newrole_t)
-
-ifdef(`TODO',`
-
-can_ypbind(newrole)
-ifdef(`automount.te', `
-allow newrole_t autofs_t:dir { search getattr };
-')
-
-# for when the user types "exec newrole" at the command line
-allow newrole_t privfd:process sigchld;
-
-# Execute /sbin/pwdb_chkpwd to check the password.
-allow newrole_t sbin_t:dir r_dir_perms;
-
-# Execute shells
-allow newrole_t bin_t:dir r_dir_perms;
-allow newrole_t bin_t:lnk_file read;
-
-# Allow newrole_t to transition to user domains.
-bool secure_mode false;
-domain_trans(newrole_t, shell_exec_t, unpriv_userdomain)
-if(!secure_mode)
-{
- # if we are not in secure mode then we can transition to sysadm_t
- domain_trans(newrole_t, shell_exec_t, sysadm_t)
-}
-
-# Read /var.
-allow newrole_t var_t:dir r_dir_perms;
-allow newrole_t var_t:notdevfile_class_set r_file_perms;
-
-# Relabel terminals.
-allow newrole_t { ttyfile ptyfile }:chr_file { relabelfrom relabelto };
-
-ifdef(`gnome-pty-helper.te', `allow newrole_t gphdomain:fd use;')
-
-# for some PAM modules and for cwd
-dontaudit newrole_t { home_root_t home_type }:dir search;
-') dnl ifdef TODO
-
-########################################
-#
-# Restorecon local policy
-#
-
-allow restorecon_t self:capability { dac_override dac_read_search fowner };
-
-allow restorecon_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:dir r_dir_perms;
-allow restorecon_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:file r_file_perms;
-allow restorecon_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:lnk_file r_file_perms;
-
-kernel_use_fd(restorecon_t)
-kernel_read_system_state(restorecon_t)
-kernel_get_selinuxfs_mount_point(restorecon_t)
-kernel_validate_context(restorecon_t)
-kernel_compute_access_vector(restorecon_t)
-kernel_compute_create_context(restorecon_t)
-kernel_compute_relabel_context(restorecon_t)
-kernel_compute_reachable_user_contexts(restorecon_t)
-
-fs_getattr_xattr_fs(restorecon_t)
-
-term_use_unallocated_tty(restorecon_t)
-
-init_use_fd(restorecon_t)
-init_use_script_pty(restorecon_t)
-
-domain_use_wide_inherit_fd(restorecon_t)
-
-files_read_etc_runtime_files(restorecon_t)
-files_read_generic_etc_files(restorecon_t)
-
-libs_use_ld_so(restorecon_t)
-libs_use_shared_libs(restorecon_t)
-
-logging_send_syslog_msg(restorecon_t)
-
-userdom_use_all_user_fd(restorecon_t)
-
-optional_policy(`hotplug.te',`
- hotplug_use_fd(restorecon_t)
-')
-
-# relabeling rules
-kernel_relabel_unlabeled(restorecon_t)
-dev_relabel_all_dev_nodes(restorecon_t)
-
-files_relabel_all_files(restorecon_t)
-files_list_all_dirs(restorecon_t)
-# this is to satisfy the assertion:
-auth_relabelto_shadow(restorecon_t)
-
-ifdef(`distro_redhat', `
-fs_use_tmpfs_character_devices(restorecon_t)
-fs_use_tmpfs_block_devices(restorecon_t)
-fs_relabel_tmpfs_block_devices(restorecon_t)
-fs_relabel_tmpfs_character_devices(restorecon_t)
-')
-
-ifdef(`TODO',`
-
-# for upgrading glibc and other shared objects - without this the upgrade
-# scripts will put things in a state such that restorecon can not be run!
-allow restorecon_t lib_t:file { read execute };
-
-allow restorecon_t fs_type:dir r_dir_perms;
-
-allow restorecon_t device_t:file { read write };
-allow restorecon_t kernel_t:fifo_file { read write };
-') dnl endif TODO
-
-#################################
-#
-# Run_init local policy
-#
-
-kernel_get_selinuxfs_mount_point(run_init_t)
-kernel_validate_context(run_init_t)
-kernel_compute_access_vector(run_init_t)
-kernel_compute_create_context(run_init_t)
-kernel_compute_relabel_context(run_init_t)
-kernel_compute_reachable_user_contexts(run_init_t)
-
-ifdef(`targeted_policy',`',`
- allow run_init_t self:process setexec;
- allow run_init_t self:capability setuid;
-
- allow run_init_t self:fifo_file rw_file_perms;
-
- # often the administrator runs such programs from a directory that is owned
- # by a different user or has restrictive SE permissions, do not want to audit
- # the failed access to the current directory
- dontaudit run_init_t self:capability { dac_override dac_read_search };
-
- fs_getattr_xattr_fs(run_init_t)
-
- dev_dontaudit_list_all_dev_nodes(run_init_t)
-
- term_dontaudit_list_ptys(run_init_t)
-
- auth_domtrans_chk_passwd(run_init_t)
- auth_dontaudit_read_shadow(run_init_t)
-
- corecmd_exec_bin(run_init_t)
- corecmd_exec_shell(run_init_t)
-
- domain_use_wide_inherit_fd(run_init_t)
-
- files_read_generic_etc_files(run_init_t)
- files_dontaudit_search_all_dirs(run_init_t)
-
- init_domtrans_script(run_init_t)
- # for utmp
- init_rw_script_pid(run_init_t)
-
- libs_use_ld_so(run_init_t)
- libs_use_shared_libs(run_init_t)
-
- selinux_read_config(run_init_t)
- selinux_read_default_contexts(run_init_t)
-
- miscfiles_read_localization(run_init_t)
-
- logging_send_syslog_msg(run_init_t)
-') dnl end ifdef targeted policy
-
-ifdef(`TODO',`
-
-ifdef(`distro_gentoo', `
- # Gentoo integrated run_init+open_init_pty-runscript:
- domain_auto_trans(sysadm_t,initrc_exec_t,run_init_t)
- domain_entry_file(run_init_t,initrc_exec_t)
-')
-') dnl end TODO
-
-########################################
-#
-# Setfiles local policy
-#
-
-allow setfiles_t self:capability { dac_override dac_read_search fowner };
-
-allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:dir r_dir_perms;
-allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:file r_file_perms;
-allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:lnk_file r_file_perms;
-
-kernel_read_system_state(setfiles_t)
-kernel_get_selinuxfs_mount_point(setfiles_t)
-kernel_validate_context(setfiles_t)
-kernel_compute_access_vector(setfiles_t)
-kernel_compute_create_context(setfiles_t)
-kernel_compute_relabel_context(setfiles_t)
-kernel_compute_reachable_user_contexts(setfiles_t)
-
-fs_getattr_xattr_fs(setfiles_t)
-
-term_use_all_user_ttys(setfiles_t)
-term_use_all_user_ptys(setfiles_t)
-term_use_unallocated_tty(setfiles_t)
-
-init_use_fd(setfiles_t)
-init_use_script_fd(setfiles_t)
-init_use_script_pty(setfiles_t)
-
-domain_use_wide_inherit_fd(setfiles_t)
-
-libs_use_ld_so(setfiles_t)
-libs_use_shared_libs(setfiles_t)
-
-files_read_etc_runtime_files(setfiles_t)
-files_read_generic_etc_files(setfiles_t)
-
-logging_send_syslog_msg(setfiles_t)
-
-miscfiles_read_localization(setfiles_t)
-
-userdom_use_all_user_fd(setfiles_t)
-# for config files in a home directory
-userdom_read_all_user_data(setfiles_t)
-
-# relabeling rules
-kernel_relabel_unlabeled(setfiles_t)
-dev_relabel_all_dev_nodes(setfiles_t)
-files_list_all_dirs(setfiles_t)
-files_relabel_all_files(setfiles_t)
-# this is to satisfy the assertion:
-auth_relabelto_shadow(setfiles_t)
-
-ifdef(`TODO',`
-# for upgrading glibc and other shared objects - without this the upgrade
-# scripts will put things in a state such that setfiles can not be run!
-allow setfiles_t lib_t:file { read execute };
-
-allow setfiles_t unlabeled_t:dir read;
-
-allow setfiles_t fs_type:dir r_dir_perms;
-
-') dnl endif TODO
diff --git a/refpolicy/policy/modules/system/selinuxutil.fc b/refpolicy/policy/modules/system/selinuxutil.fc
index fb39d898..13db3858 100644
--- a/refpolicy/policy/modules/system/selinuxutil.fc
+++ b/refpolicy/policy/modules/system/selinuxutil.fc
@@ -1,3 +1,4 @@
+# SELinux userland utilities
#
# /etc
diff --git a/refpolicy/policy/modules/system/selinuxutil.if b/refpolicy/policy/modules/system/selinuxutil.if
index 433d28ec..5a4a99f6 100644
--- a/refpolicy/policy/modules/system/selinuxutil.if
+++ b/refpolicy/policy/modules/system/selinuxutil.if
@@ -1,4 +1,4 @@
-##
+##
## Policy for SELinux policy and userland applications.
#######################################
diff --git a/refpolicy/policy/modules/system/selinuxutil.te b/refpolicy/policy/modules/system/selinuxutil.te
index 6027d4ae..81aea9ab 100644
--- a/refpolicy/policy/modules/system/selinuxutil.te
+++ b/refpolicy/policy/modules/system/selinuxutil.te
@@ -1,5 +1,5 @@
-policy_module(selinux,1.0)
+policy_module(selinuxutil,1.0)
########################################
#