- Allow cupsd_config to read user tmp

- Allow snmpd_t to signal itself
- Allow sysstat_t to makedir in sysstat_log_t

modules-minimum.conf

@@ -1759,6 +1759,13 @@ aide = module
 # 
 w3c = module
 
+# Layer: services
+# Module: plymouth
+#
+#  Plymouth
+# 
+plymouth = module
+
 # Layer: services
 # Module: portreserve
 #

modules-mls.conf

@@ -542,6 +542,13 @@ gnomeclock = module
 # 
 hal = module
 
+# Layer: services
+# Module: plymouth
+#
+#  Plymouth
+# 
+plymouth = module
+
 # Layer: services
 # Module: policykit
 #

modules-targeted.conf

@@ -1759,6 +1759,13 @@ aide = module
 # 
 w3c = module
 
+# Layer: services
+# Module: plymouth
+#
+#  Plymouth
+# 
+plymouth = module
+
 # Layer: services
 # Module: portreserve
 #

policy-F12.patch

@@ -4887,7 +4887,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  /var/named/chroot/dev/zero -c	gen_context(system_u:object_r:zero_device_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.32/policy/modules/kernel/devices.if
 --- nsaserefpolicy/policy/modules/kernel/devices.if	2009-08-28 14:58:20.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/kernel/devices.if	2009-09-21 08:39:30.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/kernel/devices.if	2009-09-30 13:17:45.000000000 -0400
 @@ -1692,6 +1692,78 @@
  
  ########################################
@@ -11496,7 +11496,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +/usr/local/linuxprinter/ppd(/.*)?      gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.6.32/policy/modules/services/cups.te
 --- nsaserefpolicy/policy/modules/services/cups.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/cups.te	2009-09-28 09:49:20.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/cups.te	2009-09-30 10:20:40.000000000 -0400
 @@ -23,6 +23,9 @@
  type cupsd_initrc_exec_t;
  init_script_file(cupsd_initrc_exec_t)
@@ -11559,7 +11559,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow cupsd_config_t self:fifo_file rw_fifo_file_perms;
  allow cupsd_config_t self:unix_stream_socket create_socket_perms;
  allow cupsd_config_t self:unix_dgram_socket create_socket_perms;
-@@ -419,12 +430,15 @@
+@@ -407,6 +418,7 @@
+ 
+ userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
+ userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
++userdom_read_user_tmp_files(cupsd_config_t)
+ 
+ cups_stream_connect(cupsd_config_t)
+ 
+@@ -419,12 +431,15 @@
  ')
  
  optional_policy(`
@@ -11577,7 +11585,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  	optional_policy(`
  		hal_dbus_chat(cupsd_config_t)
-@@ -446,6 +460,10 @@
+@@ -446,6 +461,10 @@
  ')
  
  optional_policy(`
@@ -11588,7 +11596,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	rpm_read_db(cupsd_config_t)
  ')
  
-@@ -542,6 +560,8 @@
+@@ -542,6 +561,8 @@
  manage_dirs_pattern(cups_pdf_t, cups_pdf_tmp_t, cups_pdf_tmp_t)
  files_tmp_filetrans(cups_pdf_t, cups_pdf_tmp_t, { file dir })
  
@@ -11597,7 +11605,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  kernel_read_system_state(cups_pdf_t)
  
  files_read_etc_files(cups_pdf_t)
-@@ -601,6 +621,9 @@
+@@ -601,6 +622,9 @@
  read_lnk_files_pattern(hplip_t, hplip_etc_t, hplip_etc_t)
  files_search_etc(hplip_t)
  
@@ -14100,6 +14108,395 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +	xen_stream_connect(pegasus_t)
 +	xen_stream_connect_xenstore(pegasus_t)
 +')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouth.fc serefpolicy-3.6.32/policy/modules/services/plymouth.fc
+--- nsaserefpolicy/policy/modules/services/plymouth.fc	1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/plymouth.fc	2009-09-30 13:21:52.000000000 -0400
+@@ -0,0 +1,5 @@
++/sbin/plymouthd				--	gen_context(system_u:object_r:plymouthd_exec_t, s0)
++/bin/plymouth				--	gen_context(system_u:object_r:plymouth_exec_t, s0)
++/var/spool/plymouth(/.*)?			gen_context(system_u:object_r:plymouthd_spool_t, s0)
++/var/lib/plymouth(/.*)?				gen_context(system_u:object_r:plymouthd_var_lib_t, s0)
++/var/run/plymouth(/.*)?				gen_context(system_u:object_r:plymouthd_var_run_t, s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouth.if serefpolicy-3.6.32/policy/modules/services/plymouth.if
+--- nsaserefpolicy/policy/modules/services/plymouth.if	1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/plymouth.if	2009-09-30 13:20:45.000000000 -0400
+@@ -0,0 +1,286 @@
++## <summary>policy for plymouthd</summary>
++
++########################################
++## <summary>
++##	Execute a domain transition to run plymouthd.
++## </summary>
++## <param name="domain">
++## <summary>
++##	Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`plymouth_domtrans', `
++	gen_require(`
++		type plymouthd_t, plymouthd_exec_t;
++	')
++
++	domtrans_pattern($1, plymouthd_exec_t, plymouthd_t)
++')
++
++########################################
++## <summary>
++##	Execute a domain transition to run plymouthd.
++## </summary>
++## <param name="domain">
++## <summary>
++##	Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`plymouth_domtrans_plymouth', `
++	gen_require(`
++		type plymouth_t, plymouth_exec_t;
++	')
++
++	domtrans_pattern($1, plymouth_exec_t, plymouth_t)
++')
++
++
++########################################
++## <summary>
++##	Read plymouthd PID files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`plymouth_read_pid_files', `
++	gen_require(`
++		type plymouthd_var_run_t;
++	')
++
++	files_search_pids($1)
++	allow $1 plymouthd_var_run_t:file read_file_perms;
++')
++
++########################################
++## <summary>
++##	Manage plymouthd var_run files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`plymouth_manage_var_run', `
++	gen_require(`
++		type plymouthd_var_run_t;
++	')
++
++         manage_dirs_pattern($1, plymouthd_var_run_t, plymouthd_var_run_t)
++         manage_files_pattern($1, plymouthd_var_run_t, plymouthd_var_run_t)
++         manage_lnk_files_pattern($1, plymouthd_var_run_t, plymouthd_var_run_t)
++')
++
++
++########################################
++## <summary>
++##	Search plymouthd lib directories.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`plymouth_search_lib', `
++	gen_require(`
++		type plymouthd_var_lib_t;
++	')
++
++	allow $1 plymouthd_var_lib_t:dir search_dir_perms;
++	files_search_var_lib($1)
++')
++
++########################################
++## <summary>
++##	Read plymouthd lib files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`plymouth_read_lib_files', `
++	gen_require(`
++		type plymouthd_var_lib_t;
++	')
++
++	files_search_var_lib($1)
++        read_files_pattern($1, plymouthd_var_lib_t, plymouthd_var_lib_t)
++')
++
++########################################
++## <summary>
++##	Create, read, write, and delete
++##	plymouthd lib files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`plymouth_manage_lib_files', `
++	gen_require(`
++		type plymouthd_var_lib_t;
++	')
++
++	files_search_var_lib($1)
++        manage_files_pattern($1, plymouthd_var_lib_t,  plymouthd_var_lib_t)
++')
++
++########################################
++## <summary>
++##	Manage plymouthd var_lib files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`plymouth_manage_var_lib', `
++	gen_require(`
++		type plymouthd_var_lib_t;
++	')
++
++         manage_dirs_pattern($1, plymouthd_var_lib_t, plymouthd_var_lib_t)
++         manage_files_pattern($1, plymouthd_var_lib_t, plymouthd_var_lib_t)
++         manage_lnk_files_pattern($1, plymouthd_var_lib_t, plymouthd_var_lib_t)
++')
++
++
++########################################
++## <summary>
++##	Search plymouthd spool directories.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`plymouth_search_spool', `
++	gen_require(`
++		type plymouthd_spool_t;
++	')
++
++	allow $1 plymouthd_spool_t:dir search_dir_perms;
++	files_search_spool($1)
++')
++
++########################################
++## <summary>
++##	Read plymouthd spool files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`plymouth_read_spool_files', `
++	gen_require(`
++		type plymouthd_spool_t;
++	')
++
++	files_search_spool($1)
++        read_files_pattern($1, plymouthd_spool_t, plymouthd_spool_t)
++')
++
++########################################
++## <summary>
++##	Create, read, write, and delete
++##	plymouthd spool files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`plymouth_manage_spool_files', `
++	gen_require(`
++		type plymouthd_spool_t;
++	')
++
++	files_search_spool($1)
++        manage_files_pattern($1, plymouthd_spool_t, plymouthd_spool_t)
++')
++
++########################################
++## <summary>
++##	Allow domain to manage plymouthd spool files
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access
++##	</summary>
++## </param>
++#
++interface(`plymouth_manage_spool', `
++	gen_require(`
++		type plymouthd_spool_t;
++	')
++
++         manage_dirs_pattern($1, plymouthd_spool_t, plymouthd_spool_t)
++         manage_files_pattern($1, plymouthd_spool_t, plymouthd_spool_t)
++         manage_lnk_files_pattern($1, plymouthd_spool_t, plymouthd_spool_t)
++')
++
++########################################
++## <summary>
++##	All of the rules required to administrate 
++##	an plymouthd environment
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++## <param name="role">
++##	<summary>
++##	Role allowed access.
++##	</summary>
++## </param>
++## <rolecap/>
++#
++interface(`plymouth_admin', `
++	gen_require(`
++		type plymouthd_t;
++	')
++
++	allow $1 plymouthd_t:process { ptrace signal_perms getattr };
++	read_files_pattern($1, plymouthd_t, plymouthd_t)
++	        
++	plymouthd_manage_var_run($1)
++
++	plymouthd_manage_var_lib($1)
++
++	plymouthd_manage_spool($1)
++')
++
++########################################
++## <summary>
++##      Allow domain to Stream socket connect
++##	to Plymouth daemon.
++## </summary>
++## <param name="domain">
++##      <summary>
++##      Domain allowed access.
++##      </summary>
++## </param>
++#
++interface(`plymouth_stream_connect', `
++	gen_require(`
++		type plymouthd_t;
++	')
++
++	allow $1 plymouthd_t:unix_stream_socket connectto;
++')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouth.te serefpolicy-3.6.32/policy/modules/services/plymouth.te
+--- nsaserefpolicy/policy/modules/services/plymouth.te	1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/plymouth.te	2009-09-30 13:18:14.000000000 -0400
+@@ -0,0 +1,86 @@
++policy_module(plymouthd, 1.0.0)
++
++########################################
++#
++# Plymouthd private declarations
++#
++
++type plymouthd_t;
++type plymouthd_exec_t;
++init_daemon_domain(plymouthd_t, plymouthd_exec_t)
++
++permissive plymouthd_t;
++
++type plymouthd_var_run_t;
++files_pid_file(plymouthd_var_run_t)
++
++type plymouthd_var_lib_t;
++files_type(plymouthd_var_lib_t)
++
++type plymouthd_spool_t;
++files_type(plymouthd_spool_t)
++
++########################################
++#
++# Plymouth private declarations
++#
++
++type plymouth_t;
++type plymouth_exec_t;
++init_daemon_domain(plymouth_t, plymouth_exec_t)
++
++permissive plymouth_t;
++
++########################################
++#
++# Plymouthd private policy
++#
++
++allow plymouthd_t self:capability { sys_admin sys_tty_config };
++allow plymouthd_t self:process { signal };
++allow plymouthd_t self:fifo_file rw_fifo_file_perms;
++allow plymouthd_t self:unix_stream_socket create_stream_socket_perms;
++
++kernel_read_system_state(plymouthd_t)
++
++dev_rw_dri(plymouthd_t)
++dev_read_sysfs(plymouthd_t)
++
++domain_use_interactive_fds(plymouthd_t)
++
++files_read_etc_files(plymouthd_t)
++files_read_usr_files(plymouthd_t)
++
++miscfiles_read_localization(plymouthd_t)
++
++manage_dirs_pattern(plymouthd_t, plymouthd_var_run_t,  plymouthd_var_run_t)
++manage_files_pattern(plymouthd_t, plymouthd_var_run_t,  plymouthd_var_run_t)
++files_pid_filetrans(plymouthd_t,plymouthd_var_run_t, { file dir })
++
++manage_dirs_pattern(plymouthd_t, plymouthd_var_lib_t,  plymouthd_var_lib_t)
++manage_files_pattern(plymouthd_t, plymouthd_var_lib_t,  plymouthd_var_lib_t)
++files_var_lib_filetrans(plymouthd_t, plymouthd_var_lib_t, { file dir })
++
++manage_dirs_pattern(plymouthd_t, plymouthd_spool_t,  plymouthd_spool_t)
++manage_files_pattern(plymouthd_t, plymouthd_spool_t,  plymouthd_spool_t)
++manage_sock_files_pattern(plymouthd_t, plymouthd_spool_t,  plymouthd_spool_t)
++files_spool_filetrans(plymouthd_t,plymouthd_spool_t, { file dir sock_file })
++
++########################################
++#
++# Plymouth private policy
++#
++
++allow plymouth_t self:process { signal };
++allow plymouth_t self:fifo_file rw_file_perms;
++allow plymouth_t self:unix_stream_socket create_stream_socket_perms;
++
++kernel_stream_connect(plymouth_t)
++
++domain_use_interactive_fds(plymouth_t)
++
++files_read_etc_files(plymouth_t)
++
++miscfiles_read_localization(plymouth_t)
++
++plymouth_stream_connect(plymouth_t)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.fc serefpolicy-3.6.32/policy/modules/services/policykit.fc
 --- nsaserefpolicy/policy/modules/services/policykit.fc	2009-08-18 11:41:14.000000000 -0400
 +++ serefpolicy-3.6.32/policy/modules/services/policykit.fc	2009-09-16 10:03:09.000000000 -0400
@@ -14601,7 +14998,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.6.32/policy/modules/services/postfix.te
 --- nsaserefpolicy/policy/modules/services/postfix.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/postfix.te	2009-09-29 07:47:01.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/postfix.te	2009-09-29 17:17:09.000000000 -0400
 @@ -6,6 +6,15 @@
  # Declarations
  #
@@ -17074,7 +17471,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.6.32/policy/modules/services/sendmail.if
 --- nsaserefpolicy/policy/modules/services/sendmail.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/sendmail.if	2009-09-16 10:03:09.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/sendmail.if	2009-09-29 17:16:32.000000000 -0400
 @@ -59,20 +59,20 @@
  
  ########################################
@@ -17811,7 +18208,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ##	All of the rules required to administrate 
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.6.32/policy/modules/services/snmp.te
 --- nsaserefpolicy/policy/modules/services/snmp.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/snmp.te	2009-09-16 10:03:09.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/snmp.te	2009-09-29 17:04:42.000000000 -0400
+@@ -27,7 +27,7 @@
+ #
+ allow snmpd_t self:capability { dac_override kill ipc_lock sys_ptrace net_admin sys_nice sys_tty_config };
+ dontaudit snmpd_t self:capability { sys_module sys_tty_config };
+-allow snmpd_t self:process { getsched setsched };
++allow snmpd_t self:process { signal_perms getsched setsched };
+ allow snmpd_t self:fifo_file rw_fifo_file_perms;
+ allow snmpd_t self:unix_dgram_socket create_socket_perms;
+ allow snmpd_t self:unix_stream_socket create_stream_socket_perms;
 @@ -72,6 +72,8 @@
  corenet_udp_bind_snmp_port(snmpd_t)
  corenet_sendrecv_snmp_server_packets(snmpd_t)
@@ -18930,8 +19336,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	dbus_connect_system_bus(sssd_t)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.6.32/policy/modules/services/sysstat.te
 --- nsaserefpolicy/policy/modules/services/sysstat.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/sysstat.te	2009-09-16 10:03:09.000000000 -0400
-@@ -19,7 +19,7 @@
++++ serefpolicy-3.6.32/policy/modules/services/sysstat.te	2009-09-29 17:13:34.000000000 -0400
+@@ -19,14 +19,15 @@
  # Local policy
  #
  
@@ -18940,6 +19346,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  dontaudit sysstat_t self:capability sys_admin;
  allow sysstat_t self:fifo_file rw_fifo_file_perms;
  
+ can_exec(sysstat_t, sysstat_exec_t)
+ 
++manage_dirs_pattern(sysstat_t,sysstat_log_t,sysstat_log_t)
+ manage_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
+-read_lnk_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
++manage_lnk_files_pattern(sysstat_t,sysstat_log_t,sysstat_log_t)
+ logging_log_filetrans(sysstat_t, sysstat_log_t, { file dir })
+ 
+ # get info from /proc
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp.te serefpolicy-3.6.32/policy/modules/services/uucp.te
 --- nsaserefpolicy/policy/modules/services/uucp.te	2009-08-14 16:14:31.000000000 -0400
 +++ serefpolicy-3.6.32/policy/modules/services/uucp.te	2009-09-16 10:03:09.000000000 -0400
@@ -20337,7 +20752,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.32/policy/modules/services/xserver.te
 --- nsaserefpolicy/policy/modules/services/xserver.te	2009-08-28 14:58:20.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/xserver.te	2009-09-29 15:34:33.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/xserver.te	2009-09-30 13:28:34.000000000 -0400
 @@ -34,6 +34,13 @@
  
  ## <desc>
@@ -20753,7 +21168,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	hostname_exec(xdm_t)
  ')
  
-@@ -542,6 +652,34 @@
+@@ -542,6 +652,38 @@
  ')
  
  optional_policy(`
@@ -20769,6 +21184,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
 +')
 +
 +optional_policy(`
++	plymouth_search_spool(xdm_t)
++')
++
++optional_policy(`
 +	pulseaudio_exec(xdm_t)
 +	pulseaudio_dbus_chat(xdm_t)
 +')
@@ -20788,7 +21207,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	seutil_sigchld_newrole(xdm_t)
  ')
  
-@@ -550,8 +688,9 @@
+@@ -550,8 +692,9 @@
  ')
  
  optional_policy(`
@@ -20800,7 +21219,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  	ifndef(`distro_redhat',`
  		allow xdm_t self:process { execheap execmem };
-@@ -560,7 +699,6 @@
+@@ -560,7 +703,6 @@
  	ifdef(`distro_rhel4',`
  		allow xdm_t self:process { execheap execmem };
  	')
@@ -20808,7 +21227,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  optional_policy(`
  	userhelper_dontaudit_search_config(xdm_t)
-@@ -571,6 +709,10 @@
+@@ -571,6 +713,10 @@
  ')
  
  optional_policy(`
@@ -20819,7 +21238,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	xfs_stream_connect(xdm_t)
  ')
  
-@@ -587,10 +729,9 @@
+@@ -587,10 +733,9 @@
  # execheap needed until the X module loader is fixed.
  # NVIDIA Needs execstack
  
@@ -20831,7 +21250,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  allow xserver_t self:fd use;
  allow xserver_t self:fifo_file rw_fifo_file_perms;
  allow xserver_t self:sock_file read_sock_file_perms;
-@@ -602,9 +743,12 @@
+@@ -602,9 +747,12 @@
  allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
  allow xserver_t self:tcp_socket create_stream_socket_perms;
  allow xserver_t self:udp_socket create_socket_perms;
@@ -20844,7 +21263,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  allow xserver_t { input_xevent_t input_xevent_type }:x_event send;
  
-@@ -616,13 +760,14 @@
+@@ -616,13 +764,14 @@
  type_transition xserver_t xserver_t:{ x_drawable x_colormap } rootwindow_t;
  
  allow xserver_t { rootwindow_t x_domain }:x_drawable send;
@@ -20860,7 +21279,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
  manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
-@@ -635,9 +780,19 @@
+@@ -635,9 +784,19 @@
  manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
  files_search_var_lib(xserver_t)
  
@@ -20880,7 +21299,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  kernel_read_system_state(xserver_t)
  kernel_read_device_sysctls(xserver_t)
-@@ -671,7 +826,6 @@
+@@ -671,7 +830,6 @@
  dev_rw_agp(xserver_t)
  dev_rw_framebuffer(xserver_t)
  dev_manage_dri_dev(xserver_t)
@@ -20888,7 +21307,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  dev_create_generic_dirs(xserver_t)
  dev_setattr_generic_dirs(xserver_t)
  # raw memory access is needed if not using the frame buffer
-@@ -681,9 +835,12 @@
+@@ -681,9 +839,12 @@
  dev_rw_xserver_misc(xserver_t)
  # read events - the synaptics touchpad driver reads raw events
  dev_rw_input_dev(xserver_t)
@@ -20902,7 +21321,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  files_read_etc_files(xserver_t)
  files_read_etc_runtime_files(xserver_t)
-@@ -698,8 +855,12 @@
+@@ -698,8 +859,12 @@
  fs_search_nfs(xserver_t)
  fs_search_auto_mountpoints(xserver_t)
  fs_search_ramfs(xserver_t)
@@ -20915,7 +21334,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  selinux_validate_context(xserver_t)
  selinux_compute_access_vector(xserver_t)
-@@ -721,6 +882,7 @@
+@@ -721,6 +886,7 @@
  
  miscfiles_read_localization(xserver_t)
  miscfiles_read_fonts(xserver_t)
@@ -20923,7 +21342,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  modutils_domtrans_insmod(xserver_t)
  
-@@ -743,7 +905,7 @@
+@@ -743,7 +909,7 @@
  ')
  
  ifdef(`enable_mls',`
@@ -20932,7 +21351,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	range_transition xserver_t xserver_t:x_drawable s0 - mls_systemhigh;
  ')
  
-@@ -775,12 +937,20 @@
+@@ -775,12 +941,20 @@
  ')
  
  optional_policy(`
@@ -20954,7 +21373,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  	unconfined_domtrans(xserver_t)
  ')
  
-@@ -807,7 +977,7 @@
+@@ -807,7 +981,7 @@
  allow xserver_t xdm_var_lib_t:file { getattr read };
  dontaudit xserver_t xdm_var_lib_t:dir search;
  
@@ -20963,7 +21382,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  
  # Label pid and temporary files with derived types.
  manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
-@@ -828,9 +998,14 @@
+@@ -828,9 +1002,14 @@
  # to read ROLE_home_t - examine this in more detail
  # (xauth?)
  userdom_read_user_home_content_files(xserver_t)
@@ -20978,7 +21397,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  tunable_policy(`use_nfs_home_dirs',`
  	fs_manage_nfs_dirs(xserver_t)
  	fs_manage_nfs_files(xserver_t)
-@@ -845,11 +1020,14 @@
+@@ -845,11 +1024,14 @@
  
  optional_policy(`
  	dbus_system_bus_client(xserver_t)
@@ -20994,7 +21413,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  ')
  
  optional_policy(`
-@@ -882,6 +1060,8 @@
+@@ -882,6 +1064,8 @@
  # X Server
  # can read server-owned resources
  allow x_domain xserver_t:x_resource read;
@@ -21003,7 +21422,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # can mess with own clients
  allow x_domain self:x_client { manage destroy };
  
-@@ -906,6 +1086,8 @@
+@@ -906,6 +1090,8 @@
  # operations allowed on my windows
  allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
  
@@ -21012,7 +21431,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
  # X Colormaps
  # can use the default colormap
  allow x_domain rootwindow_t:x_colormap { read use add_color };
-@@ -973,17 +1155,49 @@
+@@ -973,17 +1159,49 @@
  allow xserver_unconfined_type { x_domain xserver_t }:x_resource *;
  allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
  

selinux-policy.spec

@@ -20,7 +20,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.6.32
-Release: 12%{?dist}
+Release: 13%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -448,6 +448,11 @@ exit 0
 %endif
 
 %changelog
+* Tue Sep 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-13
+- Allow cupsd_config to read user tmp
+- Allow snmpd_t to signal itself
+- Allow sysstat_t to makedir in sysstat_log_t
+
 * Fri Sep 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-12
 - Update rhcs policy