diff --git a/imaze.fc b/imaze.fc
index 8d455ba..16f104c 100644
--- a/imaze.fc
+++ b/imaze.fc
@@ -1,4 +1,7 @@
-/usr/games/imazesrv -- gen_context(system_u:object_r:imazesrv_exec_t,s0)
-/usr/share/games/imaze(/.*)? gen_context(system_u:object_r:imazesrv_data_t,s0)
+/usr/games/imazesrv -- gen_context(system_u:object_r:imazesrv_exec_t,s0)
-/var/log/imaze\.log -- gen_context(system_u:object_r:imazesrv_log_t,s0)
+/usr/share/games/imaze(/.*)? gen_context(system_u:object_r:imazesrv_data_t,s0)
+
+/var/log/imaze\.log.* -- gen_context(system_u:object_r:imazesrv_log_t,s0)
+
+/var/run/imaze\.pid -- gen_context(system_u:object_r:imazesrv_var_run_t,s0)
diff --git a/imaze.if b/imaze.if
index 8eb9ec3..db53881 100644
--- a/imaze.if
+++ b/imaze.if
@@ -1 +1 @@
-## iMaze game server
+## iMaze game server.
diff --git a/imaze.te b/imaze.te
index 0778af8..05387d1 100644
--- a/imaze.te
+++ b/imaze.te
@@ -1,4 +1,4 @@
-policy_module(imaze, 1.7.0)
+policy_module(imaze, 1.7.1)
########################################
#
@@ -7,14 +7,12 @@ policy_module(imaze, 1.7.0)
type imazesrv_t;
type imazesrv_exec_t;
+application_executable_file(imazesrv_exec_t)
init_daemon_domain(imazesrv_t, imazesrv_exec_t)
type imazesrv_data_t;
files_type(imazesrv_data_t)
-type imazesrv_data_labs_t;
-files_type(imazesrv_data_labs_t)
-
type imazesrv_log_t;
logging_log_file(imazesrv_log_t)
@@ -28,30 +26,23 @@ files_pid_file(imazesrv_var_run_t)
dontaudit imazesrv_t self:capability sys_tty_config;
allow imazesrv_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
-allow imazesrv_t self:fd use;
allow imazesrv_t self:fifo_file rw_fifo_file_perms;
-allow imazesrv_t self:unix_dgram_socket { create_socket_perms sendto };
-allow imazesrv_t self:unix_stream_socket { create_stream_socket_perms connectto };
-allow imazesrv_t self:shm create_shm_perms;
-allow imazesrv_t self:sem create_sem_perms;
-allow imazesrv_t self:msgq create_msgq_perms;
-allow imazesrv_t self:msg { send receive };
-allow imazesrv_t self:tcp_socket create_stream_socket_perms;
-allow imazesrv_t self:udp_socket create_socket_perms;
+allow imazesrv_t self:tcp_socket { accept listen };
+allow imazesrv_t self:unix_dgram_socket sendto;
+allow imazesrv_t self:unix_stream_socket { accept connectto listen };
allow imazesrv_t imazesrv_data_t:dir list_dir_perms;
read_files_pattern(imazesrv_t, imazesrv_data_t, imazesrv_data_t)
read_lnk_files_pattern(imazesrv_t, imazesrv_data_t, imazesrv_data_t)
-allow imazesrv_t imazesrv_log_t:file manage_file_perms;
-allow imazesrv_t imazesrv_log_t:dir add_entry_dir_perms;
+allow imazesrv_t imazesrv_log_t:file { append_file_perms create_file_perms setattr_file_perms };
logging_log_filetrans(imazesrv_t, imazesrv_log_t, file)
manage_files_pattern(imazesrv_t, imazesrv_var_run_t, imazesrv_var_run_t)
files_pid_filetrans(imazesrv_t, imazesrv_var_run_t, file)
-kernel_read_kernel_sysctls(imazesrv_t)
kernel_list_proc(imazesrv_t)
+kernel_read_kernel_sysctls(imazesrv_t)
kernel_read_proc_symlinks(imazesrv_t)
corenet_all_recvfrom_unlabeled(imazesrv_t)
@@ -60,37 +51,32 @@ corenet_tcp_sendrecv_generic_if(imazesrv_t)
corenet_udp_sendrecv_generic_if(imazesrv_t)
corenet_tcp_sendrecv_generic_node(imazesrv_t)
corenet_udp_sendrecv_generic_node(imazesrv_t)
-corenet_tcp_sendrecv_all_ports(imazesrv_t)
-corenet_udp_sendrecv_all_ports(imazesrv_t)
corenet_tcp_bind_generic_node(imazesrv_t)
corenet_udp_bind_generic_node(imazesrv_t)
+
+corenet_sendrecv_imaze_server_packets(imazesrv_t)
corenet_tcp_bind_imaze_port(imazesrv_t)
+corenet_tcp_sendrecv_imaze_port(imazesrv_t)
corenet_udp_bind_imaze_port(imazesrv_t)
-corenet_sendrecv_imaze_server_packets(imazesrv_t)
+corenet_udp_sendrecv_imaze_port(imazesrv_t)
dev_read_sysfs(imazesrv_t)
domain_use_interactive_fds(imazesrv_t)
-files_read_etc_files(imazesrv_t)
-
fs_getattr_all_fs(imazesrv_t)
fs_search_auto_mountpoints(imazesrv_t)
+auth_use_nsswitch(imazesrv_t)
+
logging_send_syslog_msg(imazesrv_t)
miscfiles_read_localization(imazesrv_t)
-sysnet_read_config(imazesrv_t)
-
userdom_use_unpriv_users_fds(imazesrv_t)
userdom_dontaudit_search_user_home_dirs(imazesrv_t)
optional_policy(`
- nis_use_ypbind(imazesrv_t)
-')
-
-optional_policy(`
seutil_sigchld_newrole(imazesrv_t)
')