diff --git a/refpolicy/Changelog b/refpolicy/Changelog
index 1fdb9841..e8ad9268 100644
--- a/refpolicy/Changelog
+++ b/refpolicy/Changelog
@@ -71,6 +71,7 @@
 	perdition
 	postgrey
 	pxe
+	pyzor (Dan Walsh)
 	qmail (Petre Rodan)
 	resmgr
 	rhgb
diff --git a/refpolicy/policy/modules/apps/cdrecord.if b/refpolicy/policy/modules/apps/cdrecord.if
index 34644d63..f756bc42 100644
--- a/refpolicy/policy/modules/apps/cdrecord.if
+++ b/refpolicy/policy/modules/apps/cdrecord.if
@@ -152,7 +152,7 @@ template(`cdrecord_per_userdomain_template', `
 		files_dontaudit_list_tmp($1_cdrecord_t)
 		files_dontaudit_list_home($1_cdrecord_t)
 		fs_dontaudit_list_removable($1_cdrecord_t)
-		fs_donaudit_read_removable_files($1_cdrecord_t)
+		fs_dontaudit_read_removable_files($1_cdrecord_t)
 		userdom_dontaudit_list_user_tmp($1,$1_cdrecord_t)
 		userdom_dontaudit_read_user_tmp_files($1,$1_cdrecord_t)
 		userdom_dontaudit_list_user_home_dirs($1,$1_cdrecord_t)
diff --git a/refpolicy/policy/modules/apps/cdrecord.te b/refpolicy/policy/modules/apps/cdrecord.te
index 24ed72c2..8785b3ce 100644
--- a/refpolicy/policy/modules/apps/cdrecord.te
+++ b/refpolicy/policy/modules/apps/cdrecord.te
@@ -1,5 +1,5 @@
 
-policy_module(cdrecord,1.0.2)
+policy_module(cdrecord,1.0.3)
 
 ########################################
 #
diff --git a/refpolicy/policy/modules/apps/evolution.if b/refpolicy/policy/modules/apps/evolution.if
index 22b42314..7bc383e9 100644
--- a/refpolicy/policy/modules/apps/evolution.if
+++ b/refpolicy/policy/modules/apps/evolution.if
@@ -303,7 +303,7 @@ template(`evolution_per_userdomain_template',`
 		files_dontaudit_list_tmp($1_evolution_t)
 		files_dontaudit_list_home($1_evolution_t)
 		fs_dontaudit_list_removable($1_evolution_t)
-		fs_donaudit_read_removable_files($1_evolution_t)
+		fs_dontaudit_read_removable_files($1_evolution_t)
 		userdom_dontaudit_list_user_tmp($1,$1_evolution_t)
 		userdom_dontaudit_read_user_tmp_files($1,$1_evolution_t)
 		userdom_dontaudit_list_user_home_dirs($1,$1_evolution_t)
diff --git a/refpolicy/policy/modules/apps/evolution.te b/refpolicy/policy/modules/apps/evolution.te
index 9aa32cfd..1df5cfba 100644
--- a/refpolicy/policy/modules/apps/evolution.te
+++ b/refpolicy/policy/modules/apps/evolution.te
@@ -1,5 +1,5 @@
 
-policy_module(evolution,1.0.1)
+policy_module(evolution,1.0.2)
 
 ########################################
 #
diff --git a/refpolicy/policy/modules/apps/mono.te b/refpolicy/policy/modules/apps/mono.te
index c680ffc1..a30fc766 100644
--- a/refpolicy/policy/modules/apps/mono.te
+++ b/refpolicy/policy/modules/apps/mono.te
@@ -1,5 +1,5 @@
 
-policy_module(mono,1.1.2)
+policy_module(mono,1.1.3)
 
 ########################################
 #
@@ -20,7 +20,7 @@ domain_entry_file(mono_t,mono_exec_t)
 ifdef(`targeted_policy',`
 	allow mono_t self:process { execheap execmem };
 	unconfined_domain_noaudit(mono_t)
-	role system_r types mono_t;
+	unconfined_dbus_chat(mono_t)
 
 	init_dbus_chat_script(mono_t)
 
diff --git a/refpolicy/policy/modules/apps/mozilla.if b/refpolicy/policy/modules/apps/mozilla.if
index 3fc2844a..74bfc535 100644
--- a/refpolicy/policy/modules/apps/mozilla.if
+++ b/refpolicy/policy/modules/apps/mozilla.if
@@ -249,7 +249,7 @@ template(`mozilla_per_userdomain_template',`
 		files_dontaudit_list_tmp($1_mozilla_t)
 		files_dontaudit_list_home($1_mozilla_t)
 		fs_dontaudit_list_removable($1_mozilla_t)
-		fs_donaudit_read_removable_files($1_mozilla_t)
+		fs_dontaudit_read_removable_files($1_mozilla_t)
 		userdom_dontaudit_list_user_tmp($1,$1_mozilla_t)
 		userdom_dontaudit_read_user_tmp_files($1,$1_mozilla_t)
 		userdom_dontaudit_list_user_home_dirs($1,$1_mozilla_t)
diff --git a/refpolicy/policy/modules/apps/mozilla.te b/refpolicy/policy/modules/apps/mozilla.te
index 7d7e7efa..d5001e6b 100644
--- a/refpolicy/policy/modules/apps/mozilla.te
+++ b/refpolicy/policy/modules/apps/mozilla.te
@@ -1,5 +1,5 @@
 
-policy_module(mozilla,1.0.1)
+policy_module(mozilla,1.0.2)
 
 ########################################
 #
diff --git a/refpolicy/policy/modules/apps/thunderbird.if b/refpolicy/policy/modules/apps/thunderbird.if
index 2d2080c2..54cee7eb 100644
--- a/refpolicy/policy/modules/apps/thunderbird.if
+++ b/refpolicy/policy/modules/apps/thunderbird.if
@@ -216,7 +216,7 @@ template(`thunderbird_per_userdomain_template',`
 		files_dontaudit_list_home($1_thunderbird_t)
 
 		fs_dontaudit_list_removable($1_thunderbird_t)
-		fs_donaudit_read_removable_files($1_thunderbird_t)
+		fs_dontaudit_read_removable_files($1_thunderbird_t)
 
 		userdom_dontaudit_list_user_tmp($1,$1_thunderbird_t)
 		userdom_dontaudit_read_user_tmp_files($1,$1_thunderbird_t)
diff --git a/refpolicy/policy/modules/apps/thunderbird.te b/refpolicy/policy/modules/apps/thunderbird.te
index 917a6275..ccd3ff04 100644
--- a/refpolicy/policy/modules/apps/thunderbird.te
+++ b/refpolicy/policy/modules/apps/thunderbird.te
@@ -1,5 +1,5 @@
 
-policy_module(thunderbird,1.0.1)
+policy_module(thunderbird,1.0.2)
 
 ########################################
 #
diff --git a/refpolicy/policy/modules/kernel/corenetwork.if.in b/refpolicy/policy/modules/kernel/corenetwork.if.in
index 1dd66cf6..a458c004 100644
--- a/refpolicy/policy/modules/kernel/corenetwork.if.in
+++ b/refpolicy/policy/modules/kernel/corenetwork.if.in
@@ -1242,6 +1242,80 @@ interface(`corenet_non_ipsec_sendrecv',`
 	kernel_sendrecv_unlabeled_association($1)
 ')
 
+########################################
+## <summary>
+##	Bind TCP sockets to all RPC ports.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`corenet_tcp_bind_all_rpc_ports',`
+	gen_require(`
+		attribute rpc_port_type;
+	')
+
+	allow $1 rpc_port_type:tcp_socket name_bind;
+	allow $1 self:capability net_bind_service;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to bind TCP sockets to all RPC ports.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process to not audit.
+##	</summary>
+## </param>
+#
+interface(`corenet_dontaudit_tcp_bind_all_rpc_ports',`
+	gen_require(`
+		attribute rpc_port_type;
+	')
+
+	dontaudit $1 rpc_port_type:tcp_socket name_bind;
+')
+
+########################################
+## <summary>
+##	Bind UDP sockets to all RPC ports.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`corenet_udp_bind_all_rpc_ports',`
+	gen_require(`
+		attribute rpc_port_type;
+	')
+
+	allow $1 rpc_port_type:udp_socket name_bind;
+	allow $1 self:capability net_bind_service;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to bind UDP sockets to all RPC ports.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process to not audit.
+##	</summary>
+## </param>
+#
+interface(`corenet_dontaudit_udp_bind_all_rpc_ports',`
+	gen_require(`
+		attribute rpc_port_type;
+	')
+
+	dontaudit $1 rpc_port_type:udp_socket name_bind;
+')
+
 ########################################
 ## <summary>
 ##	Unconfined access to network objects.
diff --git a/refpolicy/policy/modules/kernel/corenetwork.te.in b/refpolicy/policy/modules/kernel/corenetwork.te.in
index 2a1a0617..6e263526 100644
--- a/refpolicy/policy/modules/kernel/corenetwork.te.in
+++ b/refpolicy/policy/modules/kernel/corenetwork.te.in
@@ -1,5 +1,5 @@
 
-policy_module(corenetwork,1.1.6)
+policy_module(corenetwork,1.1.7)
 
 ########################################
 #
@@ -10,6 +10,7 @@ attribute netif_type;
 attribute node_type;
 attribute port_type;
 attribute reserved_port_type;
+attribute rpc_port_type;
 
 attribute corenet_unconfined_type;
 
diff --git a/refpolicy/policy/modules/kernel/corenetwork.te.m4 b/refpolicy/policy/modules/kernel/corenetwork.te.m4
index 1cc4569d..66658961 100644
--- a/refpolicy/policy/modules/kernel/corenetwork.te.m4
+++ b/refpolicy/policy/modules/kernel/corenetwork.te.m4
@@ -46,7 +46,11 @@ ifelse($4,`',`',`determine_reserved_capability_depend(shiftn(3,$*))')dnl end inn
 ') dnl end determine reserved capability depend
 
 define(`declare_ports',`dnl
-ifelse(eval($3 < 1024),1,`typeattribute $1 reserved_port_type;',`dnl')
+ifelse(eval($3 < 1024),1,`
+typeattribute $1 reserved_port_type;
+#bindresvport in glibc starts searching for reserved ports at 600
+ifelse(eval($3 >= 600),1,`typeattribute $1 rpc_port_type;',`dnl')
+',`dnl')
 portcon $2 $3 gen_context(system_u:object_r:$1,$4)
 ifelse(`$5',`',`',`declare_ports($1,shiftn(4,$*))')dnl
 ')
diff --git a/refpolicy/policy/modules/kernel/filesystem.if b/refpolicy/policy/modules/kernel/filesystem.if
index 3312c1ec..77772546 100644
--- a/refpolicy/policy/modules/kernel/filesystem.if
+++ b/refpolicy/policy/modules/kernel/filesystem.if
@@ -609,7 +609,7 @@ interface(`fs_read_noxattr_fs_files',`
 		attribute noxattrfs;
 	')
 
-	allow $1 noxattrfs:dir search;
+	allow $1 noxattrfs:dir search_dir_perms;
 	allow $1 noxattrfs:file r_file_perms;
 
 ')
@@ -629,7 +629,7 @@ interface(`fs_read_noxattr_fs_symlinks',`
 		attribute noxattrfs;
 	')
 
-	allow $1 noxattrfs:dir search;
+	allow $1 noxattrfs:dir search_dir_perms;
 	allow $1 noxattrfs:lnk_file r_file_perms;
 ')
 
@@ -1491,7 +1491,7 @@ interface(`fs_read_removable_files',`
 ##	</summary>
 ## </param>
 #
-interface(`fs_donaudit_read_removable_files',`
+interface(`fs_dontaudit_read_removable_files',`
 	gen_require(`
 		type removable_t;
 	')
@@ -3204,3 +3204,29 @@ interface(`fs_unconfined',`
 
 	typeattribute $1 filesystem_unconfined_type;
 ')
+
+########################################
+## <summary>
+##	Relabel all objets from filesystems that
+##	do not support extended attributes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_relabelfrom_noxattr_fs',`
+	gen_require(`
+		attribute noxattrfs;
+	')
+
+	allow $1 noxattrfs:dir { list_dir_perms relabelfrom };
+	allow $1 noxattrfs:file { getattr relabelfrom };
+	allow $1 noxattrfs:lnk_file { getattr relabelfrom };
+	allow $1 noxattrfs:fifo_file { getattr relabelfrom };
+	allow $1 noxattrfs:sock_file { getattr relabelfrom };
+	allow $1 noxattrfs:blk_file { getattr relabelfrom };
+	allow $1 noxattrfs:chr_file { getattr relabelfrom };
+')
+
diff --git a/refpolicy/policy/modules/kernel/filesystem.te b/refpolicy/policy/modules/kernel/filesystem.te
index f947f635..ce37304d 100644
--- a/refpolicy/policy/modules/kernel/filesystem.te
+++ b/refpolicy/policy/modules/kernel/filesystem.te
@@ -1,5 +1,5 @@
 
-policy_module(filesystem,1.3.6)
+policy_module(filesystem,1.3.7)
 
 ########################################
 #
diff --git a/refpolicy/policy/modules/services/amavis.te b/refpolicy/policy/modules/services/amavis.te
index c0847363..64812057 100644
--- a/refpolicy/policy/modules/services/amavis.te
+++ b/refpolicy/policy/modules/services/amavis.te
@@ -1,5 +1,5 @@
 
-policy_module(amavis,1.0.0)
+policy_module(amavis,1.0.1)
 
 ########################################
 #
@@ -142,6 +142,10 @@ optional_policy(`
 	ldap_use(amavis_t)
 ')
 
+optional_policy(`
+	pyzor_domtrans(amavis_t)
+')
+
 optional_policy(`
 	spamassassin_exec(amavis_t)
 	spamassassin_exec_client(amavis_t)
diff --git a/refpolicy/policy/modules/services/automount.te b/refpolicy/policy/modules/services/automount.te
index 62b2baf4..65fc610c 100644
--- a/refpolicy/policy/modules/services/automount.te
+++ b/refpolicy/policy/modules/services/automount.te
@@ -1,5 +1,5 @@
 
-policy_module(automount,1.2.2)
+policy_module(automount,1.2.3)
 
 ########################################
 #
@@ -86,6 +86,7 @@ corenet_dontaudit_tcp_connect_all_reserved_ports(automount_t)
 # Automount execs showmount when you browse /net.  This is required until
 # Someone writes a showmount policy
 corenet_tcp_bind_reserved_port(automount_t)
+corenet_tcp_bind_all_rpc_ports(automount_t)
 
 dev_read_sysfs(automount_t)
 # for SSP
diff --git a/refpolicy/policy/modules/services/cyrus.if b/refpolicy/policy/modules/services/cyrus.if
index 49647a4b..30d552e5 100644
--- a/refpolicy/policy/modules/services/cyrus.if
+++ b/refpolicy/policy/modules/services/cyrus.if
@@ -20,3 +20,25 @@ interface(`cyrus_manage_data',`
 	allow $1 cyrus_var_lib_t:dir rw_dir_perms;
 	allow $1 cyrus_var_lib_t:file manage_file_perms;
 ')
+
+
+########################################
+## <summary>
+##	Connect to Cyrus using a unix domain stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cyrus_stream_connect',`
+	gen_require(`
+		type cyrus_t, cyrus_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	allow $1 cyrus_var_lib_t:dir search;
+	allow $1 cyrus_var_lib_t:sock_file write;
+	allow $1 cyrus_t:unix_stream_socket connectto;
+')
diff --git a/refpolicy/policy/modules/services/cyrus.te b/refpolicy/policy/modules/services/cyrus.te
index 08ff84e6..bf2924b1 100644
--- a/refpolicy/policy/modules/services/cyrus.te
+++ b/refpolicy/policy/modules/services/cyrus.te
@@ -1,5 +1,5 @@
 
-policy_module(cyrus,1.1.0)
+policy_module(cyrus,1.1.1)
 
 ########################################
 #
diff --git a/refpolicy/policy/modules/services/postfix.te b/refpolicy/policy/modules/services/postfix.te
index ec3a7243..94db81e1 100644
--- a/refpolicy/policy/modules/services/postfix.te
+++ b/refpolicy/policy/modules/services/postfix.te
@@ -1,5 +1,5 @@
 
-policy_module(postfix,1.2.3)
+policy_module(postfix,1.2.4)
 
 ########################################
 #
@@ -171,6 +171,10 @@ sysnet_read_config(postfix_master_t)
 mta_rw_aliases(postfix_master_t)
 mta_read_sendmail_bin(postfix_master_t)
 
+optional_policy(`
+	cyrus_stream_connect(postfix_master_t)
+')
+
 optional_policy(`
 #	for postalias
 	mailman_manage_data_files(postfix_master_t)
@@ -390,6 +394,7 @@ allow postfix_pickup_t postfix_private_t:sock_file write;
 allow postfix_pickup_t postfix_public_t:fifo_file rw_file_perms;
 allow postfix_pickup_t postfix_public_t:sock_file rw_file_perms;
 
+postfix_list_spool(postfix_pickup_t)
 allow postfix_pickup_t postfix_spool_maildrop_t:dir rw_dir_perms;
 allow postfix_pickup_t postfix_spool_maildrop_t:file r_file_perms;
 allow postfix_pickup_t postfix_spool_maildrop_t:file unlink;
@@ -430,6 +435,7 @@ allow postfix_postdrop_t self:udp_socket create_socket_perms;
 allow postfix_postdrop_t postfix_public_t:dir search;
 allow postfix_postdrop_t postfix_public_t:fifo_file rw_file_perms;
 
+postfix_list_spool(postfix_postdrop_t)
 allow postfix_postdrop_t postfix_spool_maildrop_t:dir rw_dir_perms;
 allow postfix_postdrop_t postfix_spool_maildrop_t:file create_file_perms;
 
@@ -538,6 +544,8 @@ allow postfix_showq_t postfix_master_t:unix_stream_socket { accept rw_socket_per
 
 allow postfix_showq_t postfix_spool_t:file r_file_perms;
 
+postfix_list_spool(postfix_showq_t)
+
 allow postfix_showq_t postfix_spool_maildrop_t:dir { getattr read search };
 allow postfix_showq_t postfix_spool_maildrop_t:file { read getattr };
 allow postfix_showq_t postfix_spool_maildrop_t:lnk_file { getattr read };
diff --git a/refpolicy/policy/modules/services/procmail.te b/refpolicy/policy/modules/services/procmail.te
index e3a84336..faa439c2 100644
--- a/refpolicy/policy/modules/services/procmail.te
+++ b/refpolicy/policy/modules/services/procmail.te
@@ -1,5 +1,5 @@
 
-policy_module(procmail,1.2.0)
+policy_module(procmail,1.2.1)
 
 ########################################
 #
@@ -93,15 +93,19 @@ optional_policy(`
 	postfix_dontaudit_use_fds(procmail_t)
 ')
 
+optional_policy(`
+	pyzor_domtrans(procmail_t)
+')
+
 optional_policy(`
 	mta_read_config(procmail_t)
+	sendmail_domtrans(procmail_t)
 	sendmail_rw_tcp_sockets(procmail_t)
 	sendmail_rw_unix_stream_sockets(procmail_t)
 ')
 
 optional_policy(`
 	corenet_udp_bind_generic_port(procmail_t)
-	corenet_tcp_connect_spamd_port(procmail_t)
 
 	files_getattr_tmp_dirs(procmail_t)
 
diff --git a/refpolicy/policy/modules/services/pyzor.fc b/refpolicy/policy/modules/services/pyzor.fc
new file mode 100644
index 00000000..0fdbe3a4
--- /dev/null
+++ b/refpolicy/policy/modules/services/pyzor.fc
@@ -0,0 +1,9 @@
+HOME_DIR/\.pyzor(/.*)?		gen_context(system_u:object_r:ROLE_pyzor_home_t,s0)
+
+/etc/pyzor(/.*)?		gen_context(system_u:object_r:pyzor_etc_t, s0)
+
+/usr/bin/pyzor		--	gen_context(system_u:object_r:pyzor_exec_t,s0)
+/usr/bin/pyzord		--	gen_context(system_u:object_r:pyzord_exec_t,s0)
+
+/var/lib/pyzord(/.*)?		gen_context(system_u:object_r:pyzor_var_lib_t,s0)
+/var/log/pyzord.log	--	gen_context(system_u:object_r:pyzord_log_t,s0)
diff --git a/refpolicy/policy/modules/services/pyzor.if b/refpolicy/policy/modules/services/pyzor.if
new file mode 100644
index 00000000..9d38ba11
--- /dev/null
+++ b/refpolicy/policy/modules/services/pyzor.if
@@ -0,0 +1,46 @@
+## <summary>Pyzor is a distributed, collaborative spam detection and filtering network.</summary>
+
+########################################
+## <summary>
+##	Execute pyzor with a domain transition.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pyzor_domtrans',`
+	gen_require(`
+		type pyzor_exec_t, pyzor_t;
+	')
+
+	files_search_usr($1)
+	corecmd_search_bin($1)
+	domain_auto_trans($1,pyzor_exec_t,pyzor_t)
+
+	allow $1 pyzor_t:fd use;
+	allow pyzor_t $1:fd use;
+	allow pyzor_t $1:fifo_file rw_file_perms;
+	allow pyzor_t $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Execute pyzor in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pyzor_exec',`
+	gen_require(`
+		type pyzor_exec_t;
+	')
+
+	files_search_usr($1)
+	corecmd_search_bin($1)
+	can_exec($1,pyzor_exec_t)
+')
diff --git a/refpolicy/policy/modules/services/pyzor.te b/refpolicy/policy/modules/services/pyzor.te
new file mode 100644
index 00000000..72f9ffae
--- /dev/null
+++ b/refpolicy/policy/modules/services/pyzor.te
@@ -0,0 +1,116 @@
+
+policy_module(pyzor,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type pyzor_t;
+type pyzor_exec_t;
+domain_type(pyzor_t)
+domain_entry_file(pyzor_t,pyzor_exec_t)
+role system_r types pyzor_t;
+
+type pyzord_t;
+type pyzord_exec_t;
+domain_type(pyzord_t)
+init_daemon_domain(pyzord_t,pyzord_exec_t)
+
+type pyzor_etc_t;
+files_type(pyzor_etc_t)
+
+type pyzord_log_t;
+logging_log_file(pyzord_log_t)
+
+type pyzor_var_lib_t;
+files_type(pyzor_var_lib_t)
+
+########################################
+#
+# Pyzor local policy
+#
+
+allow pyzor_t pyzor_var_lib_t:dir r_dir_perms;
+allow pyzor_t pyzor_var_lib_t:file r_file_perms;
+files_search_var_lib(pyzor_t)
+
+files_read_etc_files(pyzor_t)
+
+auth_use_nsswitch(pyzor_t)
+
+libs_use_ld_so(pyzor_t)
+libs_use_shared_libs(pyzor_t)
+
+miscfiles_read_localization(pyzor_t)
+
+optional_policy(`
+	amavis_manage_lib_files(pyzor_t)
+')
+
+optional_policy(`
+	spamassassin_read_spamd_tmp_files(pyzor_t)
+')
+
+########################################
+#
+# Pyzord local policy
+#
+
+allow pyzord_t self:udp_socket create_socket_perms;
+
+allow pyzord_t pyzor_var_lib_t:file create_file_perms;
+allow pyzord_t pyzor_var_lib_t:dir { rw_dir_perms setattr };
+files_var_lib_filetrans(pyzord_t,pyzor_var_lib_t,{ file dir })
+
+allow pyzord_t pyzor_etc_t:file create_file_perms;
+allow pyzord_t pyzor_etc_t:dir r_dir_perms;
+
+can_exec(pyzord_t,pyzor_exec_t)
+
+allow pyzord_t pyzord_log_t:file create_file_perms;
+allow pyzord_t pyzord_log_t:dir { rw_dir_perms setattr };
+logging_log_filetrans(pyzord_t,pyzord_log_t, { file dir } )
+
+kernel_read_kernel_sysctls(pyzord_t)
+kernel_read_system_state(pyzord_t)
+
+dev_read_urand(pyzord_t)
+
+corecmd_exec_bin(pyzord_t)
+
+corenet_raw_sendrecv_all_if(pyzord_t)
+corenet_udp_sendrecv_all_if(pyzord_t)
+corenet_udp_sendrecv_all_nodes(pyzord_t)
+corenet_raw_sendrecv_all_nodes(pyzord_t)
+corenet_udp_sendrecv_all_ports(pyzord_t)
+corenet_non_ipsec_sendrecv(pyzord_t)
+corenet_udp_bind_all_nodes(pyzord_t)
+corenet_udp_bind_pyzor_port(pyzord_t)
+
+files_read_etc_files(pyzord_t)
+
+term_dontaudit_use_generic_ptys(pyzord_t)
+
+auth_use_nsswitch(pyzord_t)
+
+libs_use_ld_so(pyzord_t)
+libs_use_shared_libs(pyzord_t)
+
+miscfiles_read_localization(pyzord_t)
+
+# only works until we define a different type for maildir
+userdom_priveleged_home_dir_manager(pyzord_t)
+# Do not audit attempts to access /root.
+userdom_dontaudit_search_sysadm_home_dirs(pyzord_t)
+userdom_dontaudit_search_staff_home_dirs(pyzord_t)
+
+mta_manage_spool(pyzord_t)
+
+optional_policy(`
+	logging_send_syslog_msg(pyzord_t)
+')
+
+optional_policy(`
+	nscd_socket_use(pyzord_t)
+')
diff --git a/refpolicy/policy/modules/services/rpc.te b/refpolicy/policy/modules/services/rpc.te
index 731fe261..1f55f3fe 100644
--- a/refpolicy/policy/modules/services/rpc.te
+++ b/refpolicy/policy/modules/services/rpc.te
@@ -1,5 +1,5 @@
 
-policy_module(rpc,1.2.2)
+policy_module(rpc,1.2.3)
 
 ########################################
 #
@@ -52,6 +52,9 @@ kernel_read_sysctl(rpcd_t)
 corenet_udp_bind_generic_port(rpcd_t)
 corenet_udp_bind_reserved_port(rpcd_t)
 
+dev_read_urand(rpcd_t)
+dev_read_rand(rpcd_t)
+
 fs_list_rpc(rpcd_t)
 fs_read_rpc_files(rpcd_t)
 fs_read_rpc_symlinks(rpcd_t)
@@ -61,6 +64,8 @@ term_use_controlling_term(rpcd_t)
 # cjp: this should really have its own type
 files_manage_mounttab(rpcd_t)
 
+miscfiles_read_certs(rpcd_t)
+
 seutil_dontaudit_search_config(rpcd_t)
 
 portmap_udp_chat(rpcd_t) 
diff --git a/refpolicy/policy/modules/services/spamassassin.te b/refpolicy/policy/modules/services/spamassassin.te
index e8c4a398..7a79a7db 100644
--- a/refpolicy/policy/modules/services/spamassassin.te
+++ b/refpolicy/policy/modules/services/spamassassin.te
@@ -1,5 +1,5 @@
 
-policy_module(spamassassin,1.3.3)
+policy_module(spamassassin,1.3.4)
 
 ########################################
 #
@@ -139,11 +139,11 @@ tunable_policy(`use_samba_home_dirs',`
 ')
 
 optional_policy(`
-	cron_system_entry(spamd_t,spamd_exec_t)
+	amavis_manage_lib_files(spamd_t)
 ')
 
 optional_policy(`
-	amavis_manage_lib_files(spamd_t)
+	cron_system_entry(spamd_t,spamd_exec_t)
 ')
 
 optional_policy(`
@@ -154,6 +154,14 @@ optional_policy(`
 	nis_use_ypbind(spamd_t)
 ')
 
+optional_policy(`
+	postgresql_stream_connect(spamd_t)
+')
+
+optional_policy(`
+	pyzor_domtrans(spamd_t)
+')
+
 optional_policy(`
 	seutil_sigchld_newrole(spamd_t)
 ')
@@ -166,13 +174,3 @@ optional_policy(`
 optional_policy(`
 	udev_read_db(spamd_t)
 ')
-
-ifdef(`TODO',`
-optional_policy(`
-# for bayes tokens
-allow spamd_t var_lib_t:dir { getattr search };
-allow spamd_t amavisd_lib_t:dir rw_dir_perms;
-allow spamd_t amavisd_lib_t:file create_file_perms;
-allow spamd_t amavisd_lib_t:lnk_file create_lnk_perms;
-')
-') dnl end TODO
diff --git a/refpolicy/policy/modules/system/authlogin.te b/refpolicy/policy/modules/system/authlogin.te
index 9a72969c..ee058836 100644
--- a/refpolicy/policy/modules/system/authlogin.te
+++ b/refpolicy/policy/modules/system/authlogin.te
@@ -1,5 +1,5 @@
 
-policy_module(authlogin,1.3.2)
+policy_module(authlogin,1.3.3)
 
 ########################################
 #
@@ -188,6 +188,8 @@ storage_getattr_scsi_generic_dev(pam_console_t)
 storage_setattr_scsi_generic_dev(pam_console_t)
 
 term_use_console(pam_console_t)
+term_use_all_user_ttys(pam_console_t)
+term_use_all_user_ptys(pam_console_t)
 term_setattr_console(pam_console_t)
 term_getattr_unallocated_ttys(pam_console_t)
 term_setattr_unallocated_ttys(pam_console_t)
diff --git a/refpolicy/policy/modules/system/libraries.fc b/refpolicy/policy/modules/system/libraries.fc
index e459ef7a..55ef8f44 100644
--- a/refpolicy/policy/modules/system/libraries.fc
+++ b/refpolicy/policy/modules/system/libraries.fc
@@ -75,6 +75,7 @@ ifdef(`distro_gentoo',`
 
 /usr/(.*/)?lib(64)?(/.*)?/nvidia/.*\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib(64)?/libsipphoneapi\.so.*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/ati-fglrx/.*\.so(\..*)?	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib(64)?/(nvidia/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib(64)?/libGLU\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib(64)?/libjs\.so.*     		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -84,9 +85,9 @@ ifdef(`distro_gentoo',`
 /usr/lib(64)?/nvidia-graphics(-[^/]*/)?libnvidia.*\.so(\.[^/]*)*              --      	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib(64)?/nvidia-graphics(-[^/]*/)?libXvMCNVIDIA\.so.*            --      	gen_context(system_u:object_r:textrel_shlib_t,s0)
 
+/usr/(local/)?.*\.so(\.[^/]*)*		--	gen_context(system_u:object_r:shlib_t,s0)
 /usr/(local/)?lib(64)?/wine/.*\.so  	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/(local/)?lib/libfame-.*\.so.*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/local/.*\.so(\.[^/]*)*		--	gen_context(system_u:object_r:shlib_t,s0)
 
 /usr/NX/lib/libXcomp.so.*		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/NX/lib/libjpeg.so.* 		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -195,10 +196,12 @@ HOME_DIR/.*/plugins/libflashplayer\.so.* --	gen_context(system_u:object_r:textre
 
 # Java, Sun Microsystems (JPackage SRPM)
 /usr/(.*/)?jre.*/libdeploy.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/(.*/)?jre.*/libjvm.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/(local/)?(.*/)?jre.*/libjvm.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 
 /usr/(local/)?Adobe/(.*/)?intellinux/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/(local/)?acroread/(.*/)?intellinux/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/(local/)?Adobe/(.*/)?lib/[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/(local/)?acroread/(.*/)?lib/[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/(local/)?Adobe/.*\.api		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/(.*/)?intellinux/SPPlugins/ADMPlugin\.apl -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 ') dnl end distro_redhat
diff --git a/refpolicy/policy/modules/system/libraries.te b/refpolicy/policy/modules/system/libraries.te
index ba068bef..3617fc0f 100644
--- a/refpolicy/policy/modules/system/libraries.te
+++ b/refpolicy/policy/modules/system/libraries.te
@@ -1,5 +1,5 @@
 
-policy_module(libraries,1.3.5)
+policy_module(libraries,1.3.6)
 
 ########################################
 #
diff --git a/refpolicy/policy/modules/system/lvm.te b/refpolicy/policy/modules/system/lvm.te
index 1628962f..18b8a366 100644
--- a/refpolicy/policy/modules/system/lvm.te
+++ b/refpolicy/policy/modules/system/lvm.te
@@ -1,5 +1,5 @@
 
-policy_module(lvm,1.3.1)
+policy_module(lvm,1.3.2)
 
 ########################################
 #
@@ -205,9 +205,10 @@ dev_create_generic_dirs(lvm_t)
 fs_getattr_xattr_fs(lvm_t)
 fs_search_auto_mountpoints(lvm_t)
 fs_read_tmpfs_symlinks(lvm_t)
-fs_donaudit_read_removable_files(lvm_t)
+fs_dontaudit_read_removable_files(lvm_t)
 
 storage_relabel_fixed_disk(lvm_t)
+storage_dontaudit_read_removable_device(lvm_t)
 # LVM creates block devices in /dev/mapper or /dev/<vg>
 # depending on its version
 # LVM(2) needs to create directores (/dev/mapper, /dev/<vg>)
diff --git a/refpolicy/policy/modules/system/mount.te b/refpolicy/policy/modules/system/mount.te
index 8c9c1817..779b2e68 100644
--- a/refpolicy/policy/modules/system/mount.te
+++ b/refpolicy/policy/modules/system/mount.te
@@ -1,5 +1,5 @@
 
-policy_module(mount,1.3.4)
+policy_module(mount,1.3.5)
 
 ########################################
 #
@@ -127,6 +127,8 @@ optional_policy(`
 	corenet_udp_bind_generic_port(mount_t)
 	corenet_tcp_bind_reserved_port(mount_t)
 	corenet_udp_bind_reserved_port(mount_t)
+	corenet_tcp_bind_all_rpc_ports(mount_t)
+	corenet_udp_bind_all_rpc_ports(mount_t)
 	corenet_tcp_connect_all_ports(mount_t)
 
 	fs_search_rpc(mount_t)
diff --git a/refpolicy/policy/modules/system/selinuxutil.te b/refpolicy/policy/modules/system/selinuxutil.te
index ae09a1cd..57d13e8f 100644
--- a/refpolicy/policy/modules/system/selinuxutil.te
+++ b/refpolicy/policy/modules/system/selinuxutil.te
@@ -1,5 +1,5 @@
 
-policy_module(selinuxutil,1.2.4)
+policy_module(selinuxutil,1.2.5)
 
 gen_require(`
 	bool secure_mode;
@@ -393,6 +393,8 @@ logging_send_syslog_msg(restorecon_t)
 userdom_use_all_users_fds(restorecon_t)
 
 files_relabel_all_files(restorecon_t)
+fs_relabelfrom_noxattr_fs(restorecon_t)
+
 files_list_all(restorecon_t)
 # this is to satisfy the assertion:
 auth_relabelto_shadow(restorecon_t)
@@ -427,6 +429,7 @@ files_pid_filetrans(restorecond_t,restorecond_var_run_t, file)
 
 auth_relabel_all_files_except_shadow(restorecond_t )
 auth_read_all_files_except_shadow(restorecond_t)
+fs_relabelfrom_noxattr_fs(restorecond_t)
 
 kernel_use_fds(restorecond_t)
 kernel_rw_pipes(restorecond_t)
@@ -627,6 +630,7 @@ files_read_etc_runtime_files(setfiles_t)
 files_read_etc_files(setfiles_t)
 files_list_all(setfiles_t)
 files_relabel_all_files(setfiles_t)
+fs_relabelfrom_noxattr_fs(setfiles_t)
 
 logging_send_syslog_msg(setfiles_t)
 
diff --git a/refpolicy/policy/modules/system/sysnetwork.te b/refpolicy/policy/modules/system/sysnetwork.te
index 65e8c5de..757d842d 100644
--- a/refpolicy/policy/modules/system/sysnetwork.te
+++ b/refpolicy/policy/modules/system/sysnetwork.te
@@ -1,5 +1,5 @@
 
-policy_module(sysnetwork,1.1.2)
+policy_module(sysnetwork,1.1.3)
 
 ########################################
 #
@@ -286,6 +286,7 @@ kernel_use_fds(ifconfig_t)
 kernel_read_system_state(ifconfig_t)
 kernel_read_network_state(ifconfig_t)
 kernel_search_network_sysctl(ifconfig_t)
+kernel_rw_net_sysctls(ifconfig_t)
 
 corenet_rw_tun_tap_dev(ifconfig_t)
 
diff --git a/refpolicy/policy/modules/system/unconfined.if b/refpolicy/policy/modules/system/unconfined.if
index 236e7ffc..ded1e2db 100644
--- a/refpolicy/policy/modules/system/unconfined.if
+++ b/refpolicy/policy/modules/system/unconfined.if
@@ -379,6 +379,27 @@ interface(`unconfined_dbus_send',`
 	allow $1 unconfined_t:dbus send_msg;
 ')
 
+########################################
+## <summary>
+##	Send and receive messages from
+##	unconfined_t over dbus.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unconfined_dbus_chat',`
+	gen_require(`
+		type unconfined_t;
+		class dbus send_msg;
+	')
+
+	allow $1 unconfined_t:dbus send_msg;
+	allow unconfined_t $1:dbus send_msg;
+')
+
 ########################################
 ## <summary>
 ##	Add an alias type to the unconfined domain.
diff --git a/refpolicy/policy/modules/system/unconfined.te b/refpolicy/policy/modules/system/unconfined.te
index 2f947d57..f522e146 100644
--- a/refpolicy/policy/modules/system/unconfined.te
+++ b/refpolicy/policy/modules/system/unconfined.te
@@ -1,5 +1,5 @@
 
-policy_module(unconfined,1.3.7)
+policy_module(unconfined,1.3.8)
 
 ########################################
 #
diff --git a/refpolicy/policy/modules/system/xen.fc b/refpolicy/policy/modules/system/xen.fc
index 0f4f3d77..e7cf1471 100644
--- a/refpolicy/policy/modules/system/xen.fc
+++ b/refpolicy/policy/modules/system/xen.fc
@@ -1,6 +1,7 @@
 /usr/sbin/xenconsoled	--	gen_context(system_u:object_r:xenconsoled_exec_t,s0)
 /usr/sbin/xend		--	gen_context(system_u:object_r:xend_exec_t,s0)
 /usr/sbin/xenstored	--	gen_context(system_u:object_r:xenstored_exec_t,s0)
+/usr/sbin/xm		--	gen_context(system_u:object_r:xm_exec_t,s0)
 
 /var/lib/xen(/.*)?		gen_context(system_u:object_r:xend_var_lib_t,s0)
 /var/lib/xend(/.*)?		gen_context(system_u:object_r:xend_var_lib_t,s0)
diff --git a/refpolicy/policy/modules/system/xen.if b/refpolicy/policy/modules/system/xen.if
index 89f2d22c..7393a2ad 100644
--- a/refpolicy/policy/modules/system/xen.if
+++ b/refpolicy/policy/modules/system/xen.if
@@ -48,11 +48,12 @@ interface(`xen_append_log',`
 ########################################
 ## <summary>
 ##	Do not audit attempts to read and write
-##	Xen unix domain stream sockets.
+##	Xen unix domain stream sockets.  These
+##	are leaked file descriptors.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-##	Domain to don't audit.
+##	Domain to not audit.
 ##	</summary>
 ## </param>
 #
@@ -84,3 +85,45 @@ interface(`xen_stream_connect_xenstore',`
 	allow $1 xenstored_var_run_t:sock_file { getattr write };
 	allow $1 xenstored_t:unix_stream_socket connectto;
 ')
+
+########################################
+## <summary>
+##	Connect to xend over an unix domain stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xen_stream_connect',`
+	gen_require(`
+		type xend_t, xend_var_run_t;
+	')
+
+	files_search_pids($1)
+	allow $1 xend_var_run_t:dir search;
+	allow $1 xend_var_run_t:sock_file { getattr write };
+	allow $1 xend_t:unix_stream_socket connectto;
+')
+
+########################################
+## <summary>
+##	Execute a domain transition to run xm.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`xen_domtrans_xm',`
+	gen_requires(`
+		type xm_t, xm_exec_t;
+	')
+
+	domain_auto_trans($1,xm_exec_t,xm_t)
+	allow xm_t $1:fd use;
+	allow xm_t:$1:fifo_file rw_file_perms;
+	allow xm_t $1:process sigchld;
+')
diff --git a/refpolicy/policy/modules/system/xen.te b/refpolicy/policy/modules/system/xen.te
index c25adebc..e4ca619f 100644
--- a/refpolicy/policy/modules/system/xen.te
+++ b/refpolicy/policy/modules/system/xen.te
@@ -1,5 +1,5 @@
 
-policy_module(xen,1.0.2)
+policy_module(xen,1.0.3)
 
 ########################################
 #
@@ -54,6 +54,11 @@ role system_r types xenconsoled_t;
 type xenconsoled_var_run_t;
 files_pid_file(xenconsoled_var_run_t)
 
+type xm_t;
+type xm_exec_t;
+domain_type(xm_t)
+init_daemon_domain(xm_t, xm_exec_t)
+
 ########################################
 #
 # xend local policy
@@ -224,3 +229,37 @@ libs_use_shared_libs(xenstored_t)
 miscfiles_read_localization(xenstored_t)
 
 xen_append_log(xenstored_t)
+
+########################################
+#
+# xm local policy
+#
+
+allow xm_t self:capability dac_override;
+# internal communication is often done using fifo and unix sockets.
+allow xm_t self:fifo_file { read write };
+allow xm_t self:unix_stream_socket create_stream_socket_perms;
+
+kernel_read_system_state(xm_t)
+kernel_read_kernel_sysctls(xm_t)
+kernel_read_xen_state(xm_t)
+kernel_write_xen_state(xm_t)
+
+corecmd_exec_bin(xm_t)
+corecmd_exec_sbin(xm_t)
+
+dev_read_urand(xm_t)
+
+# Some common macros (you might be able to remove some)
+files_read_etc_files(xm_t)
+
+term_use_all_terms(xm_t)
+
+libs_use_ld_so(xm_t)
+libs_use_shared_libs(xm_t)
+
+miscfiles_read_localization(xm_t)
+
+xen_append_log(xm_t)
+xen_stream_connect(xm_t)
+xen_stream_connect_xenstore(xm_t)