From c8bc906ed52484917657d980e4eedbe5370bc05e Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@fedoraproject.org>
Date: Mar 17 2010 14:08:33 +0000
Subject: - Allow boinc to read kernel sysctl

- Fix snmp port definitions
- Allow apache to read anon_inodefs

---

diff --git a/policy-F13.patch b/policy-F13.patch
index f0e21ca..ab2fa06 100644
--- a/policy-F13.patch
+++ b/policy-F13.patch
@@ -2568,7 +2568,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.7.14/policy/modules/apps/gnome.if
 --- nsaserefpolicy/policy/modules/apps/gnome.if	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.7.14/policy/modules/apps/gnome.if	2010-03-12 09:30:00.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/apps/gnome.if	2010-03-17 08:37:44.000000000 -0400
 @@ -74,6 +74,24 @@
  
  ########################################
@@ -2594,7 +2594,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
  ##	manage gnome homedir content (.config)
  ## </summary>
  ## <param name="user_domain">
-@@ -84,10 +102,228 @@
+@@ -84,10 +102,246 @@
  #
  interface(`gnome_manage_config',`
  	gen_require(`
@@ -2729,6 +2729,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if
 +
 +########################################
 +## <summary>
++##	Append gconf home files
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`gnome_append_gconf_home_files',`
++	gen_require(`
++		type gconf_home_t;
++	')
++
++	append_files_pattern($1, gconf_home_t, gconf_home_t)
++')
++
++########################################
++## <summary>
 +##	manage gconf home files
 +## </summary>
 +## <param name="domain">
@@ -6093,7 +6111,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.7.14/policy/modules/kernel/corenetwork.te.in
 --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in	2010-03-08 14:49:44.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/kernel/corenetwork.te.in	2010-03-12 09:30:00.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/kernel/corenetwork.te.in	2010-03-16 10:29:41.000000000 -0400
 @@ -65,6 +65,7 @@
  type server_packet_t, packet_type, server_packet_type;
  
@@ -6171,7 +6189,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
  network_port(printer, tcp,515,s0)
  network_port(ptal, tcp,5703,s0)
  network_port(pulseaudio, tcp,4713,s0)
-@@ -176,6 +192,7 @@
+@@ -176,16 +192,18 @@
  network_port(rsync, tcp,873,s0, udp,873,s0)
  network_port(rwho, udp,513,s0)
  network_port(sap, tcp,9875,s0, udp,9875,s0)
@@ -6179,7 +6197,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
  network_port(sip, tcp,5060,s0, udp,5060,s0, tcp,5061,s0, udp,5061,s0)
  network_port(smbd, tcp,137-139,s0, tcp,445,s0)
  network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0)
-@@ -186,6 +203,7 @@
+-network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0, tcp, 1161, s0)
++network_port(snmp, tcp,161,s0, udp,161,s0, tcp,162,s0, udp,162,s0, tcp,199,s0, tcp, 1161, s0)
+ type socks_port_t, port_type; dnl network_port(socks) # no defined portcon
+ network_port(soundd, tcp,8000,s0, tcp,9433,s0, tcp, 16001, s0)
+ network_port(spamd, tcp,783,s0)
  network_port(speech, tcp,8036,s0)
  network_port(squid, udp,3401,s0, tcp,3401,s0, udp,4827,s0, tcp,4827,s0) # snmp and htcp
  network_port(ssh, tcp,22,s0)
@@ -6813,7 +6835,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  /var/lib/nfs/rpc_pipefs(/.*)?	<<none>>
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.7.14/policy/modules/kernel/files.if
 --- nsaserefpolicy/policy/modules/kernel/files.if	2010-03-03 23:26:37.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/kernel/files.if	2010-03-12 09:30:00.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/kernel/files.if	2010-03-17 08:58:55.000000000 -0400
 @@ -1053,10 +1053,8 @@
  	relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
  	relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 })
@@ -6827,7 +6849,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  
  	# satisfy the assertions:
  	seutil_relabelto_bin_policy($1)
-@@ -1428,6 +1426,24 @@
+@@ -1428,6 +1426,42 @@
  
  ########################################
  ## <summary>
@@ -6849,10 +6871,28 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
 +
 +########################################
 +## <summary>
++##	Write all mount points.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`files_write_all_mountpoints',`
++	gen_require(`
++		attribute mountpoint;
++	')
++
++	allow $1 mountpoint:dir write;
++')
++
++########################################
++## <summary>
  ##	List the contents of the root directory.
  ## </summary>
  ## <param name="domain">
-@@ -1552,6 +1568,24 @@
+@@ -1552,6 +1586,24 @@
  
  ########################################
  ## <summary>
@@ -6877,7 +6917,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ##	Remove entries from the root directory.
  ## </summary>
  ## <param name="domain">
-@@ -2209,6 +2243,24 @@
+@@ -1697,6 +1749,24 @@
+ 
+ ########################################
+ ## <summary>
++##	manage directories in /boot
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`files_manage_boot_dirs',`
++	gen_require(`
++		type boot_t;
++	')
++
++	allow $1 boot_t:dir manage_dir_perms;
++')
++
++########################################
++## <summary>
+ ##	Create a private type object in boot
+ ##	with an automatic type transition
+ ## </summary>
+@@ -1740,7 +1810,7 @@
+ 		type boot_t;
+ 	')
+ 
+-	manage_files_pattern($1, boot_t, boot_t)
++	read_files_pattern($1, boot_t, boot_t)
+ ')
+ 
+ ########################################
+@@ -2209,6 +2279,24 @@
  	allow $1 etc_t:dir rw_dir_perms;
  ')
  
@@ -6902,7 +6976,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ##########################################
  ## <summary>
  ## 	Manage generic directories in /etc
-@@ -2280,6 +2332,8 @@
+@@ -2280,6 +2368,8 @@
  	allow $1 etc_t:dir list_dir_perms;
  	read_files_pattern($1, etc_t, etc_t)
  	read_lnk_files_pattern($1, etc_t, etc_t)
@@ -6911,7 +6985,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -2362,6 +2416,24 @@
+@@ -2362,6 +2452,24 @@
  
  ########################################
  ## <summary>
@@ -6936,7 +7010,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ##	Execute generic files in /etc.
  ## </summary>
  ## <param name="domain">
-@@ -2789,6 +2861,101 @@
+@@ -2789,6 +2897,101 @@
  
  ########################################
  ## <summary>
@@ -7038,7 +7112,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ##	Create, read, write, and delete files
  ##	on new filesystems that have not yet been labeled.
  ## </summary>
-@@ -2899,6 +3066,7 @@
+@@ -2899,6 +3102,7 @@
  	')
  
  	allow $1 home_root_t:dir getattr;
@@ -7046,7 +7120,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -2919,6 +3087,7 @@
+@@ -2919,6 +3123,7 @@
  	')
  
  	dontaudit $1 home_root_t:dir getattr;
@@ -7054,7 +7128,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -2937,6 +3106,7 @@
+@@ -2937,6 +3142,7 @@
  	')
  
  	allow $1 home_root_t:dir search_dir_perms;
@@ -7062,7 +7136,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -2956,6 +3126,7 @@
+@@ -2956,6 +3162,7 @@
  	')
  
  	dontaudit $1 home_root_t:dir search_dir_perms;
@@ -7070,7 +7144,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -2975,6 +3146,7 @@
+@@ -2975,6 +3182,7 @@
  	')
  
  	dontaudit $1 home_root_t:dir list_dir_perms;
@@ -7078,7 +7152,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -2993,6 +3165,7 @@
+@@ -2993,6 +3201,7 @@
  	')
  
  	allow $1 home_root_t:dir list_dir_perms;
@@ -7086,7 +7160,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -3502,6 +3675,64 @@
+@@ -3502,6 +3711,64 @@
  	allow $1 readable_t:sock_file read_sock_file_perms;
  ')
  
@@ -7151,7 +7225,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ########################################
  ## <summary>
  ##	Allow the specified type to associate
-@@ -3687,6 +3918,32 @@
+@@ -3687,6 +3954,32 @@
  
  ########################################
  ## <summary>
@@ -7184,7 +7258,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ##	Manage temporary files and directories in /tmp.
  ## </summary>
  ## <param name="domain">
-@@ -3900,6 +4157,13 @@
+@@ -3900,6 +4193,13 @@
  	delete_lnk_files_pattern($1, tmpfile, tmpfile)
  	delete_fifo_files_pattern($1, tmpfile, tmpfile)
  	delete_sock_files_pattern($1, tmpfile, tmpfile)
@@ -7198,7 +7272,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -4008,7 +4272,7 @@
+@@ -4008,7 +4308,7 @@
  		type usr_t;
  	')
  
@@ -7207,7 +7281,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -4089,6 +4353,24 @@
+@@ -4089,6 +4389,24 @@
  
  ########################################
  ## <summary>
@@ -7232,7 +7306,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ##	dontaudit write of /usr files
  ## </summary>
  ## <param name="domain">
-@@ -5014,6 +5296,25 @@
+@@ -5014,6 +5332,25 @@
  	search_dirs_pattern($1, var_t, var_run_t)
  ')
  
@@ -7258,7 +7332,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ########################################
  ## <summary>
  ##	Do not audit attempts to search
-@@ -5073,6 +5374,24 @@
+@@ -5073,6 +5410,24 @@
  
  ########################################
  ## <summary>
@@ -7283,7 +7357,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ##	Create an object in the process ID directory, with a private type.
  ## </summary>
  ## <desc>
-@@ -5148,6 +5467,24 @@
+@@ -5148,6 +5503,24 @@
  
  ########################################
  ## <summary>
@@ -7308,7 +7382,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ##	Do not audit attempts to write to daemon runtime data files.
  ## </summary>
  ## <param name="domain">
-@@ -5201,6 +5538,7 @@
+@@ -5201,6 +5574,7 @@
  
  	list_dirs_pattern($1, var_t, pidfile)
  	read_files_pattern($1, pidfile, pidfile)
@@ -7316,7 +7390,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ')
  
  ########################################
-@@ -5269,6 +5607,24 @@
+@@ -5269,6 +5643,24 @@
  
  ########################################
  ## <summary>
@@ -7341,7 +7415,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  ##	Search the contents of generic spool
  ##	directories (/var/spool).
  ## </summary>
-@@ -5457,12 +5813,15 @@
+@@ -5457,12 +5849,15 @@
  	allow $1 poly_t:dir { create mounton };
  	fs_unmount_xattr_fs($1)
  
@@ -7358,7 +7432,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
  	')
  ')
  
-@@ -5483,3 +5842,211 @@
+@@ -5483,3 +5878,211 @@
  
  	typeattribute $1 files_unconfined_type;
  ')
@@ -7953,7 +8027,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.7.14/policy/modules/kernel/terminal.if
 --- nsaserefpolicy/policy/modules/kernel/terminal.if	2010-02-18 14:06:31.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/kernel/terminal.if	2010-03-12 09:30:00.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/kernel/terminal.if	2010-03-16 14:27:31.000000000 -0400
 @@ -292,9 +292,11 @@
  interface(`term_dontaudit_use_console',`
  	gen_require(`
@@ -7967,7 +8041,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
  ')
  
  ########################################
-@@ -829,7 +831,7 @@
+@@ -672,6 +674,25 @@
+ 
+ ########################################
+ ## <summary>
++##	Do not audit attempts to get attributes 
++##	on the pty multiplexor (/dev/ptmx).
++## </summary>
++## <param name="domain">
++##	<summary>
++##	The type of the process to not audit.
++##	</summary>
++## </param>
++#
++interface(`term_dontaudit_getattr_ptmx',`
++	gen_require(`
++		type ptmx_t;
++	')
++
++	dontaudit $1 ptmx_t:chr_file getattr;
++')
++
++########################################
++## <summary>
+ ##	Do not audit attempts to read and
+ ##	write the pty multiplexor (/dev/ptmx).
+ ## </summary>
+@@ -829,7 +850,7 @@
  		attribute ptynode;
  	')
  
@@ -7976,7 +8076,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
  ')
  
  ########################################
-@@ -1196,7 +1198,7 @@
+@@ -1196,7 +1217,7 @@
  		type tty_device_t;
  	')
  
@@ -7985,7 +8085,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
  ')
  
  ########################################
-@@ -1333,7 +1335,7 @@
+@@ -1333,7 +1354,7 @@
  		attribute ttynode;
  	')
  
@@ -11614,7 +11714,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.7.14/policy/modules/services/apache.te
 --- nsaserefpolicy/policy/modules/services/apache.te	2010-03-09 19:04:58.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/services/apache.te	2010-03-12 09:30:00.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/services/apache.te	2010-03-17 09:55:47.000000000 -0400
 @@ -19,6 +19,8 @@
  # Declarations
  #
@@ -11883,11 +11983,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  corenet_sendrecv_http_server_packets(httpd_t)
  # Signal self for shutdown
  corenet_tcp_connect_http_port(httpd_t)
-@@ -342,15 +417,15 @@
+@@ -342,15 +417,16 @@
  
  fs_getattr_all_fs(httpd_t)
  fs_search_auto_mountpoints(httpd_t)
 +fs_read_iso9660_files(httpd_t)
++fs_read_anon_inodefs_files(httpd_t)
  
  auth_use_nsswitch(httpd_t)
  
@@ -11902,7 +12003,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  files_read_usr_files(httpd_t)
  files_list_mnt(httpd_t)
  files_search_spool(httpd_t)
-@@ -365,6 +440,10 @@
+@@ -365,6 +441,10 @@
  files_read_var_lib_symlinks(httpd_t)
  
  fs_search_auto_mountpoints(httpd_sys_script_t)
@@ -11913,7 +12014,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  
  libs_read_lib_files(httpd_t)
  
-@@ -379,18 +458,33 @@
+@@ -379,18 +459,33 @@
  
  userdom_use_unpriv_users_fds(httpd_t)
  
@@ -11951,7 +12052,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ')
  ')
  
-@@ -398,32 +492,71 @@
+@@ -398,32 +493,71 @@
  	corenet_tcp_connect_all_ports(httpd_t)
  ')
  
@@ -12028,7 +12129,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ')
  
  tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -431,14 +564,21 @@
+@@ -431,14 +565,21 @@
  	fs_read_nfs_symlinks(httpd_t)
  ')
  
@@ -12053,7 +12154,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ')
  
  tunable_policy(`httpd_ssi_exec',`
-@@ -463,7 +603,18 @@
+@@ -463,7 +604,18 @@
  ')
  
  optional_policy(`
@@ -12072,7 +12173,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ')
  
  optional_policy(`
-@@ -475,8 +626,24 @@
+@@ -475,8 +627,24 @@
  ')
  
  optional_policy(`
@@ -12099,7 +12200,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ')
  
  optional_policy(`
-@@ -484,22 +651,19 @@
+@@ -484,22 +652,19 @@
  	mailman_domtrans_cgi(httpd_t)
  	# should have separate types for public and private archives
  	mailman_search_data(httpd_t)
@@ -12125,7 +12226,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ')
  
  optional_policy(`
-@@ -510,12 +674,23 @@
+@@ -510,12 +675,23 @@
  ')
  
  optional_policy(`
@@ -12149,7 +12250,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  	')
  ')
  
-@@ -524,6 +699,11 @@
+@@ -524,6 +700,11 @@
  ')
  
  optional_policy(`
@@ -12161,7 +12262,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  	snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
  	snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
  ')
-@@ -551,6 +731,23 @@
+@@ -551,6 +732,23 @@
  
  userdom_use_user_terminals(httpd_helper_t)
  
@@ -12185,7 +12286,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ########################################
  #
  # Apache PHP script local policy
-@@ -580,20 +777,32 @@
+@@ -580,20 +778,32 @@
  
  fs_search_auto_mountpoints(httpd_php_t)
  
@@ -12224,7 +12325,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ')
  
  ########################################
-@@ -611,23 +820,24 @@
+@@ -611,23 +821,24 @@
  append_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
  read_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
  
@@ -12253,7 +12354,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  
  files_read_etc_files(httpd_suexec_t)
  files_read_usr_files(httpd_suexec_t)
-@@ -640,6 +850,7 @@
+@@ -640,6 +851,7 @@
  logging_send_syslog_msg(httpd_suexec_t)
  
  miscfiles_read_localization(httpd_suexec_t)
@@ -12261,7 +12362,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  
  tunable_policy(`httpd_can_network_connect',`
  	allow httpd_suexec_t self:tcp_socket create_stream_socket_perms;
-@@ -647,22 +858,31 @@
+@@ -647,22 +859,31 @@
  
  	corenet_all_recvfrom_unlabeled(httpd_suexec_t)
  	corenet_all_recvfrom_netlabel(httpd_suexec_t)
@@ -12300,7 +12401,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ')
  
  tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -688,16 +908,16 @@
+@@ -688,16 +909,16 @@
  	dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
  ')
  
@@ -12321,7 +12422,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  
  dontaudit httpd_sys_script_t httpd_config_t:dir search;
  
-@@ -712,15 +932,29 @@
+@@ -712,15 +933,29 @@
  files_search_var_lib(httpd_sys_script_t)
  files_search_spool(httpd_sys_script_t)
  
@@ -12353,7 +12454,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ')
  
  tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -728,6 +962,35 @@
+@@ -728,6 +963,35 @@
  	fs_read_nfs_symlinks(httpd_sys_script_t)
  ')
  
@@ -12389,7 +12490,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
  	fs_read_cifs_files(httpd_sys_script_t)
  	fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -740,6 +1003,10 @@
+@@ -740,6 +1004,10 @@
  optional_policy(`
  	mysql_stream_connect(httpd_sys_script_t)
  	mysql_rw_db_sockets(httpd_sys_script_t)
@@ -12400,7 +12501,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  ')
  
  optional_policy(`
-@@ -751,6 +1018,8 @@
+@@ -751,6 +1019,8 @@
  # httpd_rotatelogs local policy
  #
  
@@ -12409,7 +12510,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
  manage_files_pattern(httpd_rotatelogs_t, httpd_log_t, httpd_log_t)
  
  kernel_read_kernel_sysctls(httpd_rotatelogs_t)
-@@ -770,11 +1039,88 @@
+@@ -770,11 +1040,88 @@
  
  tunable_policy(`httpd_enable_cgi && httpd_unified',`
  	allow httpd_user_script_t httpdcontent:file entrypoint;
@@ -12992,8 +13093,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.te serefpolicy-3.7.14/policy/modules/services/boinc.te
 --- nsaserefpolicy/policy/modules/services/boinc.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/services/boinc.te	2010-03-15 14:49:29.000000000 -0400
-@@ -0,0 +1,76 @@
++++ serefpolicy-3.7.14/policy/modules/services/boinc.te	2010-03-16 14:27:36.000000000 -0400
+@@ -0,0 +1,80 @@
 +
 +policy_module(boinc,1.0.0)
 +
@@ -13039,6 +13140,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
 +files_var_lib_filetrans(boinc_t, boinc_var_lib_t, { file dir } )
 +
 +kernel_read_system_state(boinc_t)
++kernel_read_kernel_sysctls(boinc_t)
 +
 +corecmd_exec_bin(boinc_t)
 +corecmd_exec_shell(boinc_t)
@@ -13065,11 +13167,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
 +
 +fs_getattr_all_fs(boinc_t)
 +
++term_dontaudit_getattr_ptmx(boinc_t)
++
 +miscfiles_read_localization(boinc_t)
 +
 +logging_send_syslog_msg(boinc_t)
 +
 +sysnet_dns_name_resolve(boinc_t)
++
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.fc serefpolicy-3.7.14/policy/modules/services/cachefilesd.fc
 --- nsaserefpolicy/policy/modules/services/cachefilesd.fc	1969-12-31 19:00:00.000000000 -0500
 +++ serefpolicy-3.7.14/policy/modules/services/cachefilesd.fc	2010-03-12 09:30:00.000000000 -0500
@@ -15731,7 +15836,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devi
  	allow $1 devicekit_t:process { ptrace signal_perms getattr };
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.7.14/policy/modules/services/devicekit.te
 --- nsaserefpolicy/policy/modules/services/devicekit.te	2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.7.14/policy/modules/services/devicekit.te	2010-03-15 17:07:58.000000000 -0400
++++ serefpolicy-3.7.14/policy/modules/services/devicekit.te	2010-03-17 08:59:10.000000000 -0400
 @@ -42,6 +42,8 @@
  
  files_read_etc_files(devicekit_t)
@@ -15753,7 +15858,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devi
  
  manage_dirs_pattern(devicekit_disk_t, devicekit_tmp_t, devicekit_tmp_t)
  manage_files_pattern(devicekit_disk_t, devicekit_tmp_t, devicekit_tmp_t)
-@@ -71,29 +75,61 @@
+@@ -71,29 +75,62 @@
  manage_files_pattern(devicekit_disk_t, devicekit_var_lib_t, devicekit_var_lib_t)
  files_var_lib_filetrans(devicekit_disk_t, devicekit_var_lib_t, dir)
  
@@ -15791,6 +15896,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devi
 +files_getattr_all_sockets(devicekit_disk_t)
 +files_getattr_all_mountpoints(devicekit_disk_t)
 +files_getattr_all_files(devicekit_disk_t)
++files_manage_boot_dirs(devicekit_disk_t)
 +files_manage_isid_type_dirs(devicekit_disk_t)
  files_manage_mnt_dirs(devicekit_disk_t)
  files_read_etc_files(devicekit_disk_t)
@@ -15817,7 +15923,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devi
  auth_use_nsswitch(devicekit_disk_t)
  
  miscfiles_read_localization(devicekit_disk_t)
-@@ -102,6 +138,16 @@
+@@ -102,6 +139,16 @@
  userdom_search_user_home_dirs(devicekit_disk_t)
  
  optional_policy(`
@@ -15834,7 +15940,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devi
  	fstools_domtrans(devicekit_disk_t)
  ')
  
-@@ -110,28 +156,27 @@
+@@ -110,28 +157,27 @@
  ')
  
  optional_policy(`
@@ -15872,7 +15978,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devi
  ')
  
  ########################################
-@@ -139,9 +184,11 @@
+@@ -139,9 +185,11 @@
  # DeviceKit-Power local policy
  #
  
@@ -15885,7 +15991,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devi
  
  manage_dirs_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t)
  manage_files_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t)
-@@ -151,6 +198,8 @@
+@@ -151,6 +199,8 @@
  kernel_read_system_state(devicekit_power_t)
  kernel_rw_hotplug_sysctls(devicekit_power_t)
  kernel_rw_kernel_sysctl(devicekit_power_t)
@@ -15894,7 +16000,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devi
  
  corecmd_exec_bin(devicekit_power_t)
  corecmd_exec_shell(devicekit_power_t)
-@@ -159,7 +208,9 @@
+@@ -159,7 +209,9 @@
  
  domain_read_all_domains_state(devicekit_power_t)
  
@@ -15904,7 +16010,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devi
  dev_rw_netcontrol(devicekit_power_t)
  dev_rw_sysfs(devicekit_power_t)
  
-@@ -167,12 +218,17 @@
+@@ -167,12 +219,17 @@
  files_read_etc_files(devicekit_power_t)
  files_read_usr_files(devicekit_power_t)
  
@@ -15922,7 +16028,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devi
  userdom_read_all_users_state(devicekit_power_t)
  
  optional_policy(`
-@@ -180,6 +236,10 @@
+@@ -180,6 +237,10 @@
  ')
  
  optional_policy(`
@@ -15933,7 +16039,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devi
  	dbus_system_bus_client(devicekit_power_t)
  
  	allow devicekit_power_t devicekit_t:dbus send_msg;
-@@ -203,17 +263,23 @@
+@@ -203,17 +264,23 @@
  
  optional_policy(`
  	hal_domtrans_mac(devicekit_power_t)
@@ -27184,7 +27290,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.
  corenet_tcp_connect_http_port(httpd_w3c_validator_script_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.7.14/policy/modules/services/xserver.fc
 --- nsaserefpolicy/policy/modules/services/xserver.fc	2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.7.14/policy/modules/services/xserver.fc	2010-03-12 09:30:01.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/services/xserver.fc	2010-03-16 16:05:59.000000000 -0400
 @@ -3,12 +3,21 @@
  #
  HOME_DIR/\.fonts\.conf	--	gen_context(system_u:object_r:user_fonts_config_t,s0)
@@ -27236,8 +27342,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  #
  
  /usr/(s)?bin/gdm-binary	--	gen_context(system_u:object_r:xdm_exec_t,s0)
-+/usr/bin/lxdm				gen_context(system_u:object_r:xdm_exec_t,s0)
-+/usr/bin/lxdm-binary			gen_context(system_u:object_r:xdm_exec_t,s0)
++/usr/(s)?bin/lxdm	--	gen_context(system_u:object_r:xdm_exec_t,s0)
++/usr/(s)?bin/lxdm-binary --	gen_context(system_u:object_r:xdm_exec_t,s0)
  /usr/(s)?bin/[xgkw]dm	--	gen_context(system_u:object_r:xdm_exec_t,s0)
  /usr/bin/gpe-dm		--	gen_context(system_u:object_r:xdm_exec_t,s0)
  /usr/bin/iceauth	--	gen_context(system_u:object_r:iceauth_exec_t,s0)
@@ -27802,7 +27908,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.7.14/policy/modules/services/xserver.te
 --- nsaserefpolicy/policy/modules/services/xserver.te	2010-02-12 10:33:09.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/services/xserver.te	2010-03-15 17:15:49.000000000 -0400
++++ serefpolicy-3.7.14/policy/modules/services/xserver.te	2010-03-17 08:37:53.000000000 -0400
 @@ -36,6 +36,13 @@
  
  ## <desc>
@@ -28304,7 +28410,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  ')
  
  optional_policy(`
-@@ -520,12 +663,49 @@
+@@ -520,12 +663,50 @@
  ')
  
  optional_policy(`
@@ -28348,13 +28454,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  optional_policy(`
 +	gnome_read_gconf_config(xdm_t)
 +	gnome_read_config(xdm_t)
++	gnome_append_gconf_home_files(xdm_t)
 +')
 +
 +optional_policy(`
  	hostname_exec(xdm_t)
  ')
  
-@@ -543,9 +723,43 @@
+@@ -543,20 +724,59 @@
  ')
  
  optional_policy(`
@@ -28398,7 +28505,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  optional_policy(`
  	seutil_sigchld_newrole(xdm_t)
  ')
-@@ -555,8 +769,9 @@
+ 
+ optional_policy(`
++	shutdown_domtrans(xdm_t)
++')
++
++optional_policy(`
+ 	udev_read_db(xdm_t)
  ')
  
  optional_policy(`
@@ -28410,7 +28523,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  
  	ifndef(`distro_redhat',`
  		allow xdm_t self:process { execheap execmem };
-@@ -565,7 +780,6 @@
+@@ -565,7 +785,6 @@
  	ifdef(`distro_rhel4',`
  		allow xdm_t self:process { execheap execmem };
  	')
@@ -28418,7 +28531,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  
  optional_policy(`
  	userhelper_dontaudit_search_config(xdm_t)
-@@ -576,6 +790,10 @@
+@@ -576,6 +795,10 @@
  ')
  
  optional_policy(`
@@ -28429,7 +28542,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  	xfs_stream_connect(xdm_t)
  ')
  
-@@ -600,10 +818,9 @@
+@@ -600,10 +823,9 @@
  # execheap needed until the X module loader is fixed.
  # NVIDIA Needs execstack
  
@@ -28441,7 +28554,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  allow xserver_t self:fd use;
  allow xserver_t self:fifo_file rw_fifo_file_perms;
  allow xserver_t self:sock_file read_sock_file_perms;
-@@ -615,6 +832,18 @@
+@@ -615,6 +837,18 @@
  allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
  allow xserver_t self:tcp_socket create_stream_socket_perms;
  allow xserver_t self:udp_socket create_socket_perms;
@@ -28460,7 +28573,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  
  manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
  manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
-@@ -634,12 +863,19 @@
+@@ -634,12 +868,19 @@
  manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
  files_search_var_lib(xserver_t)
  
@@ -28482,7 +28595,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  
  kernel_read_system_state(xserver_t)
  kernel_read_device_sysctls(xserver_t)
-@@ -673,7 +909,6 @@
+@@ -673,7 +914,6 @@
  dev_rw_agp(xserver_t)
  dev_rw_framebuffer(xserver_t)
  dev_manage_dri_dev(xserver_t)
@@ -28490,7 +28603,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  dev_create_generic_dirs(xserver_t)
  dev_setattr_generic_dirs(xserver_t)
  # raw memory access is needed if not using the frame buffer
-@@ -683,9 +918,12 @@
+@@ -683,9 +923,12 @@
  dev_rw_xserver_misc(xserver_t)
  # read events - the synaptics touchpad driver reads raw events
  dev_rw_input_dev(xserver_t)
@@ -28504,7 +28617,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  
  files_read_etc_files(xserver_t)
  files_read_etc_runtime_files(xserver_t)
-@@ -700,8 +938,13 @@
+@@ -700,8 +943,13 @@
  fs_search_nfs(xserver_t)
  fs_search_auto_mountpoints(xserver_t)
  fs_search_ramfs(xserver_t)
@@ -28518,7 +28631,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  
  selinux_validate_context(xserver_t)
  selinux_compute_access_vector(xserver_t)
-@@ -723,11 +966,14 @@
+@@ -723,11 +971,14 @@
  
  miscfiles_read_localization(xserver_t)
  miscfiles_read_fonts(xserver_t)
@@ -28533,7 +28646,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  
  userdom_search_user_home_dirs(xserver_t)
  userdom_use_user_ttys(xserver_t)
-@@ -779,12 +1025,24 @@
+@@ -779,12 +1030,24 @@
  ')
  
  optional_policy(`
@@ -28559,7 +28672,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  	unconfined_domtrans(xserver_t)
  ')
  
-@@ -811,7 +1069,7 @@
+@@ -811,7 +1074,7 @@
  allow xserver_t xdm_var_lib_t:file { getattr read };
  dontaudit xserver_t xdm_var_lib_t:dir search;
  
@@ -28568,7 +28681,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  
  # Label pid and temporary files with derived types.
  manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
-@@ -832,9 +1090,14 @@
+@@ -832,9 +1095,14 @@
  # to read ROLE_home_t - examine this in more detail
  # (xauth?)
  userdom_read_user_home_content_files(xserver_t)
@@ -28583,7 +28696,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  tunable_policy(`use_nfs_home_dirs',`
  	fs_manage_nfs_dirs(xserver_t)
  	fs_manage_nfs_files(xserver_t)
-@@ -849,11 +1112,14 @@
+@@ -849,11 +1117,14 @@
  
  optional_policy(`
  	dbus_system_bus_client(xserver_t)
@@ -28600,7 +28713,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
  ')
  
  optional_policy(`
-@@ -999,3 +1265,33 @@
+@@ -999,3 +1270,33 @@
  allow xserver_unconfined_type xextension_type:x_extension *;
  allow xserver_unconfined_type { x_domain xserver_t }:x_resource *;
  allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
@@ -31768,7 +31881,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.7.14/policy/modules/system/mount.te
 --- nsaserefpolicy/policy/modules/system/mount.te	2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.14/policy/modules/system/mount.te	2010-03-12 09:30:01.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/system/mount.te	2010-03-16 17:04:35.000000000 -0400
 @@ -18,8 +18,15 @@
  init_system_domain(mount_t, mount_exec_t)
  role system_r types mount_t;
@@ -31818,7 +31931,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
  
  allow mount_t mount_loopback_t:file read_file_perms;
  
-@@ -47,21 +71,38 @@
+@@ -47,30 +71,49 @@
  
  files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
  
@@ -31858,8 +31971,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
  
  files_search_all(mount_t)
  files_read_etc_files(mount_t)
-@@ -70,7 +111,7 @@
+ files_manage_etc_runtime_files(mount_t)
+ files_etc_filetrans_etc_runtime(mount_t, file)
  files_mounton_all_mountpoints(mount_t)
++# ntfs-3g checks whether the mountpoint is writable before mounting
++files_write_all_mountpoints(mount_t)
  files_unmount_rootfs(mount_t)
  # These rules need to be generalized.  Only admin, initrc should have it:
 -files_relabelto_all_file_type_fs(mount_t)
@@ -31867,7 +31983,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
  files_mount_all_file_type_fs(mount_t)
  files_unmount_all_file_type_fs(mount_t)
  # for when /etc/mtab loses its type
-@@ -80,15 +121,18 @@
+@@ -80,15 +123,18 @@
  files_read_usr_files(mount_t)
  files_list_mnt(mount_t)
  
@@ -31889,7 +32005,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
  
  mls_file_read_all_levels(mount_t)
  mls_file_write_all_levels(mount_t)
-@@ -99,6 +143,7 @@
+@@ -99,6 +145,7 @@
  storage_raw_write_fixed_disk(mount_t)
  storage_raw_read_removable_device(mount_t)
  storage_raw_write_removable_device(mount_t)
@@ -31897,7 +32013,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
  
  term_use_all_terms(mount_t)
  
-@@ -107,6 +152,8 @@
+@@ -107,6 +154,8 @@
  init_use_fds(mount_t)
  init_use_script_ptys(mount_t)
  init_dontaudit_getattr_initctl(mount_t)
@@ -31906,7 +32022,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
  
  logging_send_syslog_msg(mount_t)
  
-@@ -117,6 +164,8 @@
+@@ -117,6 +166,8 @@
  seutil_read_config(mount_t)
  
  userdom_use_all_users_fds(mount_t)
@@ -31915,7 +32031,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
  
  ifdef(`distro_redhat',`
  	optional_policy(`
-@@ -132,10 +181,17 @@
+@@ -132,10 +183,17 @@
  	')
  ')
  
@@ -31933,7 +32049,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
  ')
  
  optional_policy(`
-@@ -165,6 +221,8 @@
+@@ -165,6 +223,8 @@
  	fs_search_rpc(mount_t)
  
  	rpc_stub(mount_t)
@@ -31942,7 +32058,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
  ')
  
  optional_policy(`
-@@ -172,6 +230,25 @@
+@@ -172,6 +232,25 @@
  ')
  
  optional_policy(`
@@ -31968,7 +32084,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
  	ifdef(`hide_broken_symptoms',`
  		# for a bug in the X server
  		rhgb_dontaudit_rw_stream_sockets(mount_t)
-@@ -179,6 +256,11 @@
+@@ -179,6 +258,11 @@
  	')
  ')
  
@@ -31980,7 +32096,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
  # for kernel package installation
  optional_policy(`
  	rpm_rw_pipes(mount_t)
-@@ -186,6 +268,19 @@
+@@ -186,6 +270,19 @@
  
  optional_policy(`
  	samba_domtrans_smbmount(mount_t)
@@ -32000,7 +32116,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.
  ')
  
  ########################################
-@@ -195,5 +290,41 @@
+@@ -195,5 +292,41 @@
  
  optional_policy(`
  	files_etc_filetrans_etc_runtime(unconfined_mount_t, file)
@@ -33546,8 +33662,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.f
 +/var/run/libgpod(/.*)?	        gen_context(system_u:object_r:udev_var_run_t,s0)    
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.if serefpolicy-3.7.14/policy/modules/system/udev.if
 --- nsaserefpolicy/policy/modules/system/udev.if	2010-03-03 23:26:37.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/system/udev.if	2010-03-12 09:30:01.000000000 -0500
-@@ -192,6 +192,7 @@
++++ serefpolicy-3.7.14/policy/modules/system/udev.if	2010-03-16 15:36:01.000000000 -0400
+@@ -20,6 +20,24 @@
+ 
+ ########################################
+ ## <summary>
++##	Send kill signals to udev.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`udev_kill',`
++	gen_require(`
++		type udev_t;
++	')
++
++	allow $1 udev_t:process sigkill;
++')
++
++########################################
++## <summary>
+ ##	Execute udev in the udev domain.
+ ## </summary>
+ ## <param name="domain">
+@@ -192,6 +210,7 @@
  
  	dev_list_all_dev_nodes($1)
  	allow $1 udev_tbl_t:file rw_file_perms;
diff --git a/selinux-policy.spec b/selinux-policy.spec
index f9409ff..93f58eb 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -20,7 +20,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.7.14
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -466,6 +466,12 @@ exit 0
 %endif
 
 %changelog
+* Tue Mar 16 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-5
+- Allow boinc to read kernel sysctl
+- Fix snmp port definitions
+- Allow apache to read anon_inodefs
+
+
 * Sun Mar 14 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-4
 - Allow shutdown dac_override