-@@ -135,6 +113,7 @@
+@@ -135,6 +135,7 @@
type virt_var_run_t;
')
@@ -18356,7 +16495,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_files_pattern($1, virt_var_run_t, virt_var_run_t)
')
-@@ -272,11 +251,7 @@
+@@ -268,15 +269,16 @@
+ #
+ interface(`virt_manage_images',`
+ gen_require(`
+- type virt_image_t, virt_var_lib_t;
++ type virt_var_lib_t;
++ attribute virt_image_type;
')
virt_search_lib($1)
@@ -18365,11 +16510,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- manage_files_pattern($1, virt_image_t, virt_image_t)
- read_lnk_files_pattern($1, virt_image_t, virt_image_t)
- rw_blk_files_pattern($1, virt_image_t, virt_image_t)
-+ virtual_manage_image($1)
++ allow $1 virt_image_type:dir list_dir_perms;
++ manage_dirs_pattern($1, virt_image_type, virt_image_type)
++ manage_files_pattern($1, virt_image_type, virt_image_type)
++ read_lnk_files_pattern($1, virt_image_type, virt_image_type)
++ rw_blk_files_pattern($1, virt_image_type, virt_image_type)
tunable_policy(`virt_use_nfs',`
fs_manage_nfs_dirs($1)
-@@ -293,6 +268,41 @@
+@@ -293,6 +295,41 @@
########################################
##
@@ -18411,7 +16560,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## All of the rules required to administrate
## an virt environment
##
-@@ -327,3 +337,53 @@
+@@ -327,3 +364,54 @@
virt_manage_log($1)
')
@@ -18428,9 +16577,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+##
+#
+template(`virt_domain_template',`
++ gen_require(`
++ attribute virt_image_type;
++ attribute virt_domain;
++ ')
+
-+ type $1_t;
-+ virtual_domain($1_t)
++ type $1_t, virt_domain;
++ domain_type($1_t)
++ role system_r types $1_t;
+
+ type $1_tmp_t;
+ files_tmp_file($1_tmp_t)
@@ -18438,8 +16592,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ type $1_tmpfs_t;
+ files_tmpfs_file($1_tmpfs_t)
+
-+ type $1_image_t;
-+ virtual_image($1_image_t)
++ type $1_image_t, virt_image_type;
+
+ manage_dirs_pattern($1_t, $1_image_t, $1_image_t)
+ manage_files_pattern($1_t, $1_image_t, $1_image_t)
@@ -18455,78 +16608,62 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ manage_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t)
+ manage_lnk_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t)
+ fs_tmpfs_filetrans($1_t, $1_tmpfs_t, { dir file lnk_file })
-+ fs_getattr_tmpfs($1_t)
-+
-+ fs_read_noxattr_fs_files($1_t)
-+ fs_dontaudit_write_noxattr_fs_files($1_t)
+
+ optional_policy(`
++ xserver_rw_shm($1_t)
+ xserver_common_app($1_t)
-+ ')
-+')
-+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.24/policy/modules/services/virt.te
---- nsaserefpolicy/policy/modules/services/virt.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/services/virt.te 2009-07-28 13:42:19.000000000 -0400
-@@ -8,19 +8,38 @@
-
- ##
- ##
--## Allow virt to manage nfs files
-+## Allow svirt to manage nfs files
- ##
- ##
- gen_tunable(virt_use_nfs, false)
-
- ##
- ##
--## Allow virt to manage cifs files
-+## Allow svirt to manage cifs files
- ##
++ ')
++')
++
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.25/policy/modules/services/virt.te
+--- nsaserefpolicy/policy/modules/services/virt.te 2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/services/virt.te 2009-07-29 23:52:17.000000000 -0400
+@@ -20,6 +20,28 @@
##
gen_tunable(virt_use_samba, false)
--attribute virt_image_type;
+##
+##
-+## Allow svirt to use usb devices
++## Allow virt to use usb devices
+##
+##
+gen_tunable(virt_use_usb, true)
+
+##
+##
-+## Allow svirt to manage device configuration, (pci)
++## Allow virt to manage device configuration, (pci)
+##
+##
+gen_tunable(virt_manage_sysfs, false)
+
+##
+##
-+## Allow svirt to use serial/parallell communication ports
++## Allow virt to use serial/parallell communication ports
+##
+##
+gen_tunable(virt_use_comm, false)
++
++attribute virt_domain;
+ attribute virt_image_type;
type virt_etc_t;
- files_config_file(virt_etc_t)
-@@ -29,8 +48,13 @@
+@@ -29,9 +51,14 @@
files_type(virt_etc_rw_t)
# virt Image files
-type virt_image_t, virt_image_type; # customizable
--virt_image(virt_image_t)
+type virt_image_t; # customizable
-+virtual_image(virt_image_t)
-+
+ virt_image(virt_image_t)
+
+# virt Image files
-+type virt_content_t;
-+virtual_image(virt_content_t)
++type virt_content_t; # customizable
++virt_image(virt_content_t)
+userdom_user_home_content(virt_content_t)
-
++
type virt_log_t;
logging_log_file(virt_log_t)
-@@ -48,17 +72,40 @@
+
+@@ -48,17 +75,37 @@
type virtd_initrc_exec_t;
init_script_file(virtd_initrc_exec_t)
@@ -18561,28 +16698,25 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow virtd_t self:unix_stream_socket create_stream_socket_perms;
allow virtd_t self:tcp_socket create_stream_socket_perms;
-+manage_files_pattern(virtd_t, virt_image_t, virt_image_t)
-+manage_blk_files_pattern(virtd_t, virt_image_t, virt_image_t)
-+allow virtd_t virt_image_t:file { relabelfrom relabelto };
-+allow virtd_t virt_image_t:blk_file { relabelfrom relabelto };
++allow virtd_t virt_domain:process { setsched transition signal signull sigkill };
+
read_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
read_lnk_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
-@@ -67,7 +114,11 @@
- manage_lnk_files_pattern(virtd_t, virt_etc_rw_t, virt_etc_rw_t)
+@@ -68,6 +115,12 @@
filetrans_pattern(virtd_t, virt_etc_t, virt_etc_rw_t, dir)
--manage_files_pattern(virtd_t, virt_image_type, virt_image_type)
-+virtual_manage_image(virtd_t)
-+virtual_image_relabel(virtd_t)
+ manage_files_pattern(virtd_t, virt_image_type, virt_image_type)
++manage_blk_files_pattern(virtd_t, virt_image_type, virt_image_type)
++allow virtd_t virt_image_type:file { relabelfrom relabelto };
++allow virtd_t virt_image_type:blk_file { relabelfrom relabelto };
+
+manage_dirs_pattern(virtd_t, virt_content_t, virt_content_t)
+manage_files_pattern(virtd_t, virt_content_t, virt_content_t)
manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t)
manage_files_pattern(virtd_t, virt_log_t, virt_log_t)
-@@ -86,6 +137,7 @@
+@@ -86,6 +139,7 @@
kernel_read_network_state(virtd_t)
kernel_rw_net_sysctls(virtd_t)
kernel_load_module(virtd_t)
@@ -18590,7 +16724,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corecmd_exec_bin(virtd_t)
corecmd_exec_shell(virtd_t)
-@@ -96,30 +148,51 @@
+@@ -96,30 +150,51 @@
corenet_tcp_sendrecv_generic_node(virtd_t)
corenet_tcp_sendrecv_all_ports(virtd_t)
corenet_tcp_bind_generic_node(virtd_t)
@@ -18645,13 +16779,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
term_use_ptmx(virtd_t)
auth_use_nsswitch(virtd_t)
-@@ -129,7 +202,15 @@
+@@ -129,7 +204,14 @@
logging_send_syslog_msg(virtd_t)
+sysnet_domtrans_ifconfig(virtd_t)
-+
-+virtual_transition(virtd_t)
++sysnet_read_config(virtd_t)
+
+userdom_dontaudit_list_admin_dir(virtd_t)
+userdom_getattr_all_users(virtd_t)
@@ -18661,7 +16794,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
tunable_policy(`virt_use_nfs',`
fs_manage_nfs_dirs(virtd_t)
-@@ -167,22 +248,35 @@
+@@ -167,22 +249,35 @@
dnsmasq_domtrans(virtd_t)
dnsmasq_signal(virtd_t)
dnsmasq_kill(virtd_t)
@@ -18680,9 +16813,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+optional_policy(`
+ kerberos_keytab_template(virtd, virtd_t)
+')
-
- optional_policy(`
-- qemu_domtrans(virtd_t)
++
++optional_policy(`
+ lvm_domtrans(virtd_t)
+')
+
@@ -18692,8 +16824,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ policykit_domtrans_resolve(virtd_t)
+ policykit_read_lib(virtd_t)
+')
-+
-+optional_policy(`
+
+ optional_policy(`
+- qemu_domtrans(virtd_t)
+ qemu_spec_domtrans(virtd_t, svirt_t)
qemu_read_state(virtd_t)
qemu_signal(virtd_t)
@@ -18702,7 +16835,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-@@ -195,8 +289,94 @@
+@@ -195,8 +290,152 @@
xen_stream_connect(virtd_t)
xen_stream_connect_xenstore(virtd_t)
@@ -18797,9 +16930,67 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ xen_rw_image_files(svirt_t)
+')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.6.24/policy/modules/services/w3c.te
++########################################
++#
++# virtual domains common policy
++#
++
++allow virt_domain self:capability { kill dac_read_search dac_override };
++allow virt_domain self:process { execstack execmem signal getsched signull };
++
++allow virt_domain self:fifo_file rw_file_perms;
++allow virt_domain self:shm create_shm_perms;
++allow virt_domain self:unix_stream_socket create_stream_socket_perms;
++allow virt_domain self:unix_dgram_socket { create_socket_perms sendto };
++allow virt_domain self:tcp_socket create_stream_socket_perms;
++
++kernel_read_system_state(virt_domain)
++
++corenet_all_recvfrom_unlabeled(virt_domain)
++corenet_all_recvfrom_netlabel(virt_domain)
++corenet_tcp_sendrecv_generic_if(virt_domain)
++corenet_tcp_sendrecv_generic_node(virt_domain)
++corenet_tcp_sendrecv_all_ports(virt_domain)
++corenet_tcp_bind_generic_node(virt_domain)
++corenet_tcp_bind_vnc_port(virt_domain)
++corenet_rw_tun_tap_dev(virt_domain)
++
++dev_read_sound(virt_domain)
++dev_write_sound(virt_domain)
++dev_rw_ksm(virt_domain)
++dev_rw_kvm(virt_domain)
++dev_rw_qemu(virt_domain)
++
++domain_use_interactive_fds(virt_domain)
++
++files_read_etc_files(virt_domain)
++files_read_usr_files(virt_domain)
++files_read_var_files(virt_domain)
++files_search_all(virt_domain)
++
++fs_getattr_tmpfs(virt_domain)
++fs_rw_anon_inodefs_files(virt_domain)
++fs_rw_tmpfs_files(virt_domain)
++
++term_use_all_terms(virt_domain)
++term_getattr_pty_fs(virt_domain)
++term_use_generic_ptys(virt_domain)
++term_use_ptmx(virt_domain)
++
++auth_use_nsswitch(virt_domain)
++
++logging_send_syslog_msg(virt_domain)
++
++miscfiles_read_localization(virt_domain)
++
++optional_policy(`
++ virt_read_config(virt_domain)
++ virt_read_lib_files(virt_domain)
++ virt_read_content(virt_domain)
++')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.6.25/policy/modules/services/w3c.te
--- nsaserefpolicy/policy/modules/services/w3c.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/services/w3c.te 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/services/w3c.te 2009-07-29 21:34:35.000000000 -0400
@@ -8,11 +8,18 @@
apache_content_template(w3c_validator)
@@ -18819,9 +17010,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_connect_ftp_port(httpd_w3c_validator_script_t)
corenet_tcp_sendrecv_ftp_port(httpd_w3c_validator_script_t)
corenet_tcp_connect_http_port(httpd_w3c_validator_script_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.6.24/policy/modules/services/xserver.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.6.25/policy/modules/services/xserver.fc
--- nsaserefpolicy/policy/modules/services/xserver.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/services/xserver.fc 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/services/xserver.fc 2009-07-29 21:34:35.000000000 -0400
@@ -3,12 +3,16 @@
#
HOME_DIR/\.fonts\.conf -- gen_context(system_u:object_r:user_fonts_config_t,s0)
@@ -18892,9 +17083,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
ifdef(`distro_suse',`
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.6.24/policy/modules/services/xserver.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.6.25/policy/modules/services/xserver.if
--- nsaserefpolicy/policy/modules/services/xserver.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/services/xserver.if 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/services/xserver.if 2009-07-29 21:34:35.000000000 -0400
@@ -90,7 +90,7 @@
allow $2 xauth_home_t:file manage_file_perms;
allow $2 xauth_home_t:file { relabelfrom relabelto };
@@ -19568,9 +17759,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow xdm_t $1:dbus send_msg;
+')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.24/policy/modules/services/xserver.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.25/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/services/xserver.te 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/services/xserver.te 2009-07-29 22:43:31.000000000 -0400
@@ -34,6 +34,13 @@
##
@@ -19968,8 +18159,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ ')
+
+ optional_policy(`
-+ devicekit_power_dbus_chat(xdm_t)
-+ devicekit_disk_dbus_chat(xdm_t)
++ devicekit_dbus_chat_disk(xdm_t)
++ devicekit_dbus_chat_power(xdm_t)
+ ')
+
+ optional_policy(`
@@ -20166,7 +18357,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-+ devicekit_power_signal(xserver_t)
++ devicekit_signal_power(xserver_t)
+')
+
+optional_policy(`
@@ -20224,19 +18415,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-@@ -856,6 +1027,11 @@
- rhgb_rw_tmpfs_files(xserver_t)
- ')
-
-+optional_policy(`
-+ rpm_dontaudit_rw_shm(xserver_t)
-+ rpm_rw_tmpfs_files(xserver_t)
-+')
-+
- ########################################
- #
- # Rules common to all X window domains
-@@ -881,6 +1057,8 @@
+@@ -881,6 +1052,8 @@
# X Server
# can read server-owned resources
allow x_domain xserver_t:x_resource read;
@@ -20245,7 +18424,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# can mess with own clients
allow x_domain self:x_client { manage destroy };
-@@ -905,6 +1083,8 @@
+@@ -905,6 +1078,8 @@
# operations allowed on my windows
allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@@ -20254,7 +18433,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# X Colormaps
# can use the default colormap
allow x_domain rootwindow_t:x_colormap { read use add_color };
-@@ -972,17 +1152,49 @@
+@@ -972,17 +1147,49 @@
allow xserver_unconfined_type { x_domain xserver_t }:x_resource *;
allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
@@ -20316,9 +18495,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-#
-allow xdm_t user_home_type:file unlink;
-') dnl end TODO
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.6.24/policy/modules/system/application.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.6.25/policy/modules/system/application.if
--- nsaserefpolicy/policy/modules/system/application.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/application.if 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/application.if 2009-07-29 21:34:35.000000000 -0400
@@ -2,7 +2,7 @@
########################################
@@ -20350,9 +18529,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+ allow $1 application_domain_type:process signull;
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.6.24/policy/modules/system/application.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.6.25/policy/modules/system/application.te
--- nsaserefpolicy/policy/modules/system/application.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/application.te 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/application.te 2009-07-29 21:34:35.000000000 -0400
@@ -7,7 +7,18 @@
# Executables to be run by user
attribute application_exec_type;
@@ -20372,9 +18551,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ sudo_sigchld(application_domain_type)
+')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.6.24/policy/modules/system/authlogin.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.6.25/policy/modules/system/authlogin.fc
--- nsaserefpolicy/policy/modules/system/authlogin.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/authlogin.fc 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/authlogin.fc 2009-07-29 21:34:35.000000000 -0400
@@ -7,12 +7,10 @@
/etc/passwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
/etc/shadow.* -- gen_context(system_u:object_r:shadow_t,s0)
@@ -20400,9 +18579,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/run/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
+/var/run/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.6.24/policy/modules/system/authlogin.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.6.25/policy/modules/system/authlogin.if
--- nsaserefpolicy/policy/modules/system/authlogin.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/authlogin.if 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/authlogin.if 2009-07-29 21:34:35.000000000 -0400
@@ -40,17 +40,76 @@
##
##
@@ -20702,9 +18881,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.6.24/policy/modules/system/authlogin.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.6.25/policy/modules/system/authlogin.te
--- nsaserefpolicy/policy/modules/system/authlogin.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/authlogin.te 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/authlogin.te 2009-07-29 21:34:35.000000000 -0400
@@ -125,9 +125,18 @@
')
@@ -20724,9 +18903,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
#
# PAM local policy
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.6.24/policy/modules/system/fstools.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.6.25/policy/modules/system/fstools.fc
--- nsaserefpolicy/policy/modules/system/fstools.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/fstools.fc 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/fstools.fc 2009-07-29 21:34:35.000000000 -0400
@@ -1,4 +1,3 @@
-/sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -20740,9 +18919,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.6.24/policy/modules/system/fstools.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.6.25/policy/modules/system/fstools.te
--- nsaserefpolicy/policy/modules/system/fstools.te 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/fstools.te 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/fstools.te 2009-07-29 21:34:35.000000000 -0400
@@ -97,6 +97,10 @@
fs_getattr_tmpfs_dirs(fsadm_t)
fs_read_tmpfs_symlinks(fsadm_t)
@@ -20771,9 +18950,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ xen_rw_image_files(fsadm_t)
')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.6.24/policy/modules/system/hostname.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.6.25/policy/modules/system/hostname.te
--- nsaserefpolicy/policy/modules/system/hostname.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/hostname.te 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/hostname.te 2009-07-29 21:34:35.000000000 -0400
@@ -8,7 +8,9 @@
type hostname_t;
@@ -20785,9 +18964,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
role system_r types hostname_t;
########################################
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.fc serefpolicy-3.6.24/policy/modules/system/init.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.fc serefpolicy-3.6.25/policy/modules/system/init.fc
--- nsaserefpolicy/policy/modules/system/init.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/init.fc 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/init.fc 2009-07-29 21:34:35.000000000 -0400
@@ -4,10 +4,10 @@
/etc/init\.d/.* -- gen_context(system_u:object_r:initrc_exec_t,s0)
@@ -20810,9 +18989,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
#
# /var
#
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.6.24/policy/modules/system/init.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.6.25/policy/modules/system/init.if
--- nsaserefpolicy/policy/modules/system/init.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/init.if 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/init.if 2009-07-29 21:34:35.000000000 -0400
@@ -174,6 +174,7 @@
role system_r types $1;
@@ -21021,9 +19200,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow $1 init_t:unix_dgram_socket sendto;
+ allow init_t $1:unix_dgram_socket sendto;
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.24/policy/modules/system/init.te
---- nsaserefpolicy/policy/modules/system/init.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/init.te 2009-07-28 13:42:19.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.25/policy/modules/system/init.te
+--- nsaserefpolicy/policy/modules/system/init.te 2009-07-29 22:34:34.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/init.te 2009-07-29 21:34:35.000000000 -0400
+@@ -1,5 +1,5 @@
+
+-policy_module(init, 1.13.2)
++policy_module(init, 1.13.1)
+
+ gen_require(`
+ class passwd rootok;
@@ -17,6 +17,20 @@
##
gen_tunable(init_upstart, false)
@@ -21045,7 +19231,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# used for direct running of init scripts
# by admin domains
attribute direct_run_init;
-@@ -88,7 +102,7 @@
+@@ -64,6 +78,7 @@
+ # of the below init_upstart tunable
+ # but this has a typeattribute in it
+ corecmd_shell_entry_type(initrc_t)
++corecmd_bin_entry_type(initrc_t)
+
+ type initrc_devpts_t;
+ term_pty(initrc_devpts_t)
+@@ -88,7 +103,7 @@
#
# Use capabilities. old rule:
@@ -21054,7 +19248,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# is ~sys_module really needed? observed:
# sys_boot
# sys_tty_config
-@@ -101,7 +115,7 @@
+@@ -101,7 +116,7 @@
# Re-exec itself
can_exec(init_t, init_exec_t)
@@ -21063,7 +19257,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# For /var/run/shutdown.pid.
allow init_t init_var_run_t:file manage_file_perms;
-@@ -167,6 +181,8 @@
+@@ -167,6 +182,8 @@
miscfiles_read_localization(init_t)
@@ -21072,7 +19266,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
ifdef(`distro_gentoo',`
allow init_t self:process { getcap setcap };
')
-@@ -189,6 +205,14 @@
+@@ -189,6 +206,14 @@
')
optional_policy(`
@@ -21087,7 +19281,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
nscd_socket_use(init_t)
')
-@@ -202,9 +226,10 @@
+@@ -202,9 +227,10 @@
#
allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@@ -21095,11 +19289,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+allow initrc_t self:capability ~{ audit_control audit_write sys_admin sys_module };
dontaudit initrc_t self:capability sys_module; # sysctl is triggering this
allow initrc_t self:passwd rootok;
-+allow initrc_t self:key { search };
++allow initrc_t self:key manage_key_perms;
# Allow IPC with self
allow initrc_t self:unix_dgram_socket create_socket_perms;
-@@ -217,7 +242,8 @@
+@@ -217,7 +243,8 @@
term_create_pty(initrc_t, initrc_devpts_t)
# Going to single user mode
@@ -21109,7 +19303,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
can_exec(initrc_t, init_script_file_type)
-@@ -230,10 +256,16 @@
+@@ -230,10 +257,16 @@
allow initrc_t initrc_var_run_t:file manage_file_perms;
files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@@ -21128,7 +19322,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_tmp_filetrans(initrc_t, initrc_tmp_t, { file dir })
init_write_initctl(initrc_t)
-@@ -249,15 +281,19 @@
+@@ -249,15 +282,19 @@
kernel_rw_all_sysctls(initrc_t)
# for lsof which is used by alsa shutdown:
kernel_dontaudit_getattr_message_if(initrc_t)
@@ -21152,7 +19346,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_sendrecv_all_ports(initrc_t)
corenet_udp_sendrecv_all_ports(initrc_t)
corenet_tcp_connect_all_ports(initrc_t)
-@@ -270,17 +306,22 @@
+@@ -270,17 +307,22 @@
dev_rw_sysfs(initrc_t)
dev_list_usbfs(initrc_t)
dev_read_framebuffer(initrc_t)
@@ -21176,7 +19370,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
fs_register_binary_executable_type(initrc_t)
# rhgb-console writes to ramfs
fs_write_ramfs_pipes(initrc_t)
-@@ -328,7 +369,7 @@
+@@ -328,7 +370,7 @@
domain_sigchld_all_domains(initrc_t)
domain_read_all_domains_state(initrc_t)
domain_getattr_all_domains(initrc_t)
@@ -21185,7 +19379,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domain_getsession_all_domains(initrc_t)
domain_use_interactive_fds(initrc_t)
# for lsof which is used by alsa shutdown:
-@@ -343,14 +384,15 @@
+@@ -343,14 +385,15 @@
files_getattr_all_pipes(initrc_t)
files_getattr_all_sockets(initrc_t)
files_purge_tmp(initrc_t)
@@ -21203,7 +19397,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_exec_etc_files(initrc_t)
files_read_usr_files(initrc_t)
files_manage_urandom_seed(initrc_t)
-@@ -366,7 +408,9 @@
+@@ -366,7 +409,9 @@
libs_rw_ld_so_cache(initrc_t)
libs_exec_lib_files(initrc_t)
@@ -21213,7 +19407,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_send_syslog_msg(initrc_t)
logging_manage_generic_logs(initrc_t)
logging_read_all_logs(initrc_t)
-@@ -451,11 +495,9 @@
+@@ -425,8 +470,6 @@
+ # init scripts touch this
+ clock_dontaudit_write_adjtime(initrc_t)
+
+- logging_send_audit_msgs(initrc_t)
+-
+ # for integrated run_init to read run_init_type.
+ # happens during boot (/sbin/rc execs init scripts)
+ seutil_read_default_contexts(initrc_t)
+@@ -453,11 +496,9 @@
# Red Hat systems seem to have a stray
# fd open from the initrd
@@ -21226,7 +19429,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# These seem to be from the initrd
# during device initialization:
dev_create_generic_dirs(initrc_t)
-@@ -465,6 +507,7 @@
+@@ -467,6 +508,7 @@
storage_raw_read_fixed_disk(initrc_t)
storage_raw_write_fixed_disk(initrc_t)
@@ -21234,7 +19437,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_create_boot_flag(initrc_t)
files_rw_boot_symlinks(initrc_t)
# wants to read /.fonts directory
-@@ -498,6 +541,7 @@
+@@ -500,6 +542,7 @@
optional_policy(`
#for /etc/rc.d/init.d/nfs to create /etc/exports
rpc_write_exports(initrc_t)
@@ -21242,7 +19445,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-@@ -516,6 +560,33 @@
+@@ -518,6 +561,33 @@
')
')
@@ -21276,7 +19479,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t)
-@@ -570,6 +641,10 @@
+@@ -572,6 +642,10 @@
dbus_read_config(initrc_t)
optional_policy(`
@@ -21287,7 +19490,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
networkmanager_dbus_chat(initrc_t)
')
')
-@@ -591,6 +666,10 @@
+@@ -593,6 +667,10 @@
')
optional_policy(`
@@ -21298,7 +19501,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dev_read_usbfs(initrc_t)
# init scripts run /etc/hotplug/usb.rc
-@@ -647,20 +726,20 @@
+@@ -649,20 +727,20 @@
')
optional_policy(`
@@ -21325,7 +19528,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
ifdef(`distro_redhat',`
-@@ -669,6 +748,7 @@
+@@ -671,6 +749,7 @@
mysql_stream_connect(initrc_t)
mysql_write_log(initrc_t)
@@ -21333,7 +19536,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-@@ -719,8 +799,6 @@
+@@ -699,7 +778,6 @@
+ ')
+
+ optional_policy(`
+- corecmd_shell_entry_type(initrc_t)
+ fs_write_ramfs_sockets(initrc_t)
+ fs_search_ramfs(initrc_t)
+
+@@ -721,8 +799,6 @@
# bash tries ioctl for some reason
files_dontaudit_ioctl_all_pids(initrc_t)
@@ -21342,7 +19553,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-@@ -733,10 +811,12 @@
+@@ -735,10 +811,12 @@
squid_manage_logs(initrc_t)
')
@@ -21355,7 +19566,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
ssh_dontaudit_read_server_keys(initrc_t)
-@@ -754,6 +834,11 @@
+@@ -756,6 +834,11 @@
uml_setattr_util_sockets(initrc_t)
')
@@ -21367,7 +19578,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
unconfined_domain(initrc_t)
-@@ -765,6 +850,13 @@
+@@ -767,6 +850,13 @@
optional_policy(`
mono_domtrans(initrc_t)
')
@@ -21381,7 +19592,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
-@@ -790,3 +882,35 @@
+@@ -792,3 +882,31 @@
optional_policy(`
zebra_read_config(initrc_t)
')
@@ -21399,10 +19610,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+
+optional_policy(`
-+ rpm_dontaudit_rw_pipes(daemon)
-+')
-+
-+optional_policy(`
+ xserver_rw_xdm_home_files(daemon)
+ tunable_policy(`use_nfs_home_dirs',`
+ fs_dontaudit_rw_nfs_files(daemon)
@@ -21417,18 +19624,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+optional_policy(`
+ fail2ban_read_lib_files(daemon)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.fc serefpolicy-3.6.24/policy/modules/system/ipsec.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.fc serefpolicy-3.6.25/policy/modules/system/ipsec.fc
--- nsaserefpolicy/policy/modules/system/ipsec.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/ipsec.fc 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/ipsec.fc 2009-07-29 21:34:35.000000000 -0400
@@ -1,3 +1,5 @@
+/etc/rc\.d/init\.d/ipsec -- gen_context(system_u:object_r:ipsec_initrc_exec_t,s0)
+
/etc/ipsec\.secrets -- gen_context(system_u:object_r:ipsec_key_file_t,s0)
/etc/ipsec\.conf -- gen_context(system_u:object_r:ipsec_conf_file_t,s0)
/etc/racoon/psk\.txt -- gen_context(system_u:object_r:ipsec_key_file_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.6.24/policy/modules/system/ipsec.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.6.25/policy/modules/system/ipsec.if
--- nsaserefpolicy/policy/modules/system/ipsec.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/ipsec.if 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/ipsec.if 2009-07-29 21:34:35.000000000 -0400
@@ -229,3 +229,28 @@
ipsec_domtrans_setkey($1)
role $2 types setkey_t;
@@ -21458,9 +19665,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ ipsec_domtrans_racoon($1)
+ role $2 types racoon_t;
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.6.24/policy/modules/system/ipsec.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.6.25/policy/modules/system/ipsec.te
--- nsaserefpolicy/policy/modules/system/ipsec.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/ipsec.te 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/ipsec.te 2009-07-29 21:34:35.000000000 -0400
@@ -15,6 +15,9 @@
type ipsec_conf_file_t;
files_type(ipsec_conf_file_t)
@@ -21561,9 +19768,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# allow setkey to set the context for ipsec SAs and policy.
ipsec_setcontext_default_spd(setkey_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.fc serefpolicy-3.6.24/policy/modules/system/iptables.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.fc serefpolicy-3.6.25/policy/modules/system/iptables.fc
--- nsaserefpolicy/policy/modules/system/iptables.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/iptables.fc 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/iptables.fc 2009-07-29 21:34:35.000000000 -0400
@@ -1,9 +1,10 @@
-/sbin/ip6tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
@@ -21580,9 +19787,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/usr/sbin/iptables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/var/lib/shorewall(/.*)? -- gen_context(system_u:object_r:iptables_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.6.24/policy/modules/system/iptables.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.6.25/policy/modules/system/iptables.te
--- nsaserefpolicy/policy/modules/system/iptables.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/iptables.te 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/iptables.te 2009-07-29 21:34:35.000000000 -0400
@@ -53,6 +53,7 @@
mls_file_read_all_levels(iptables_t)
@@ -21602,9 +19809,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
rhgb_dontaudit_use_ptys(iptables_t)
')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.if serefpolicy-3.6.24/policy/modules/system/iscsi.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.if serefpolicy-3.6.25/policy/modules/system/iscsi.if
--- nsaserefpolicy/policy/modules/system/iscsi.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/iscsi.if 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/iscsi.if 2009-07-29 21:34:35.000000000 -0400
@@ -17,3 +17,43 @@
domtrans_pattern($1, iscsid_exec_t, iscsid_t)
@@ -21649,9 +19856,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ stream_connect_pattern($1,iscsi_var_lib_t,iscsi_var_lib_t,iscsid_t)
+')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.6.24/policy/modules/system/iscsi.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.6.25/policy/modules/system/iscsi.te
--- nsaserefpolicy/policy/modules/system/iscsi.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/iscsi.te 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/iscsi.te 2009-07-29 21:34:35.000000000 -0400
@@ -55,6 +55,7 @@
files_pid_filetrans(iscsid_t, iscsi_var_run_t, file)
@@ -21675,9 +19882,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-sysnet_dns_name_resolve(iscsid_t)
+miscfiles_read_localization(iscsid_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.6.24/policy/modules/system/libraries.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.6.25/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/libraries.fc 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/libraries.fc 2009-07-29 23:41:18.000000000 -0400
@@ -60,12 +60,15 @@
#
# /opt
@@ -21719,7 +19926,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/usr/(.*/)?java/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/(.*/)?java/.+\.jar -- gen_context(system_u:object_r:lib_t,s0)
-@@ -115,25 +121,35 @@
+@@ -115,25 +121,29 @@
/usr/(.*/)?nvidia/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -21732,32 +19939,38 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/usr/lib64/vlc/codec/libdmo_plugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib64/vlc/codec/librealaudio_plugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+
-+/usr/lib(64)?/libavfilter\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-+
/usr/(.*/)?lib(64)?(/.*)?/nvidia/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?(/.*)?/nvidia/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/libsipphoneapi\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/ati-fglrx/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /usr/lib(64)?/(nvidia/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/(nvidia/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/lib(64)?/fglrx/libGL\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/lib(64)?/libjackserver\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/libGLU\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/fglrx/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /usr/lib(64)?/libGLU\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-+/usr/lib(64)?/libjackserver\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/libjs\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /usr/lib(64)?/libx264\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/libx264\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/sse2/libx264\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?(/.*)?/libnvidia.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?(/.*)?/nvidia_drv.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/nvidia-graphics(-[^/]*/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/nvidia-graphics(-[^/]*/)?libnvidia.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/nvidia-graphics(-[^/]*/)?libXvMCNVIDIA\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /usr/lib(64)?/xorg/libGL\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/xorg/libGL\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/(nvidia/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/xorg/modules/glesx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/xulrunner-[^/]*/libgtkembedmoz\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/xulrunner-[^/]*/libxul\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -169,11 +185,13 @@
+@@ -143,7 +153,6 @@
+ /usr/NX/lib/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/NX/lib/libjpeg\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+
+-/usr/X11R6/lib/libGL\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/X11R6/lib/libXvMCNVIDIA\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+
+ /usr/x11R6/lib/modules/extensions/libglx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+@@ -169,11 +178,13 @@
# Fedora Core packages: gstreamer-plugins, compat-libstdc++, Glide3, libdv
# HelixPlayer, SDL, xorg-x11, xorg-x11-libs, Hermes, valgrind, openoffice.org-libs, httpd - php
/usr/lib(64)?/gstreamer-.*/[^/]*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -21772,33 +19985,44 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/usr/lib/maxima/[^/]+/binary-gcl/maxima -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/mozilla/plugins/libvlcplugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/nx/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -188,12 +206,15 @@
- /usr/lib(64)?/libdv\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+@@ -185,15 +196,13 @@
+ /usr/lib(64)?/libg\+\+\.so\.2\.7\.2\.8 -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/libglide3\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/libglide3-v[0-9]*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/libdv\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/helix/plugins/[^/]*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/helix/codecs/[^/]*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-+/usr/lib(64)?/libswscale\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /usr/lib(64)?/libSDL-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/libSDL-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/xorg/modules/dri/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/X11R6/lib/modules/dri/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/dri/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/X11R6/lib/libOSMesa\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-+/usr/X11R6/lib/libOSMesa.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/X11R6/lib/libfglrx_gamma\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib/libfglrx_gamma\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-+/usr/lib(64)?/libOSMesa.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/libHermes\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/valgrind/hp2ps -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/valgrind/stage2 -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -234,7 +255,7 @@
+@@ -228,31 +237,24 @@
+ /usr/lib(64)?/ladspa/sc3_1427\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/ladspa/sc4_1882\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/ladspa/se4_1883\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/libImlib2\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/ocaml/stublibs/dllnums\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/httpd/modules/libphp5\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/php/modules/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
# Livna.org packages: xmms-mp3, ffmpeg, xvidcore, xine-lib, gsm, lame
-/usr/lib(64)?.*/libmpg123\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?.*/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/codecs/drv[1-9c]\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /usr/lib(64)?/libpostproc\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /usr/lib(64)?/libavformat.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -247,12 +268,13 @@
+-/usr/lib(64)?/libpostproc\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/libavformat.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/libavcodec.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/libavutil.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/libxvidcore\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/xine/plugins/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/libgsm\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-/usr/lib(64)?/libmp3lame\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
# Flash plugin, Macromedia
HOME_DIR/\.mozilla(/.*)?/plugins/libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -21814,7 +20038,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Jai, Sun Microsystems (Jpackage SPRM)
/usr/lib(64)?/libmlib_jai\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -268,6 +290,9 @@
+@@ -268,6 +270,9 @@
/usr/lib(64)?/vmware/lib(/.*)?/HConfig\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/vmware/(.*/)?VmPerl\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -21824,7 +20048,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Java, Sun Microsystems (JPackage SRPM)
/usr/(.*/)?jre.*/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/local/(.*/)?jre.*/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -292,6 +317,8 @@
+@@ -292,6 +297,8 @@
/usr/lib/acroread/(.*/)?lib/[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/acroread/.+\.api -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/acroread/(.*/)?ADMPlugin\.apl -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -21833,7 +20057,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') dnl end distro_redhat
#
-@@ -304,10 +331,50 @@
+@@ -304,10 +311,74 @@
/var/mailman/pythonlib(/.*)?/.+\.so(\..*)? -- gen_context(system_u:object_r:lib_t,s0)
@@ -21849,7 +20073,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/spool/postfix/usr(/.*)? gen_context(system_u:object_r:lib_t,s0)
/var/spool/postfix/lib(64)?/ld.*\.so.* -- gen_context(system_u:object_r:ld_so_t,s0)
+
-+/usr/lib(64)?/libavdevice\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/libmythavcodec-[^/]+\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+
+/usr/lib/jvm/java(.*/)bin(/.*)?/.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -21859,8 +20082,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+/opt/novell/groupwise/client/lib/libgwapijni\.so\.1 -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+
-+/usr/lib(64)?/libmpeg2\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-+
+/usr/lib(64)?/sse2/.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/i686/.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/google-earth/.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -21871,6 +20092,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/usr/lib/oracle/.*/lib/libnnz.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+
+/opt/(.*/)?oracle/(.*/)?libnnz.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libnnz11.so(\.[^/]*)* gen_context(system_u:object_r:textrel_shlib_t,s0)
+
+/opt/matlab.*\.so(\.[^/]*)* gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/matlab.*\.so(\.[^/]*)* gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -21884,9 +20106,35 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/usr/lib(64)?/ICAClient/.*\.so(\.[^/]*)* gen_context(system_u:object_r:textrel_shlib_t,s0)
+
+/usr/lib(64)?/midori/.*\.so(\.[^/]*)* gen_context(system_u:object_r:textrel_shlib_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.if serefpolicy-3.6.24/policy/modules/system/libraries.if
++
++
++
++ifdef(`fixed',`
++/usr/lib(64)?/libavfilter\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libavdevice\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libavformat.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libavcodec.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libavutil.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libdv\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libGLU\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/xorg/libGL\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/X11R6/lib/libGL\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libgsm\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libImlib2\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libjackserver\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libmp3lame\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/X11R6/lib/libOSMesa.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libOSMesa.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libmpeg2\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libpostproc\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libSDL-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libswscale\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libx264\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libxvidcore\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.if serefpolicy-3.6.25/policy/modules/system/libraries.if
--- nsaserefpolicy/policy/modules/system/libraries.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/libraries.if 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/libraries.if 2009-07-29 21:34:35.000000000 -0400
@@ -60,7 +60,7 @@
type lib_t, ld_so_t, ld_so_cache_t;
')
@@ -21914,9 +20162,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow $1 lib_t:dir list_dir_perms;
read_lnk_files_pattern($1, lib_t, { lib_t textrel_shlib_t })
mmap_files_pattern($1, lib_t, { lib_t textrel_shlib_t })
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.6.24/policy/modules/system/libraries.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.6.25/policy/modules/system/libraries.te
--- nsaserefpolicy/policy/modules/system/libraries.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/libraries.te 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/libraries.te 2009-07-29 21:34:35.000000000 -0400
@@ -52,11 +52,11 @@
# ldconfig local policy
#
@@ -21962,20 +20210,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
ifdef(`hide_broken_symptoms',`
optional_policy(`
unconfined_dontaudit_rw_tcp_sockets(ldconfig_t)
-@@ -116,4 +124,10 @@
- # and executes ldconfig on it. If you dont allow this kernel installs
+@@ -117,3 +125,7 @@
# blow up.
rpm_manage_script_tmp_files(ldconfig_t)
-+ # smart package manager needs the following for the same reason
-+ rpm_rw_tmp_files(ldconfig_t)
-+')
+ ')
+
+optional_policy(`
+ unconfined_domain(ldconfig_t)
- ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.6.24/policy/modules/system/locallogin.te
++')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.6.25/policy/modules/system/locallogin.te
--- nsaserefpolicy/policy/modules/system/locallogin.te 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/locallogin.te 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/locallogin.te 2009-07-29 21:34:35.000000000 -0400
@@ -67,6 +67,7 @@
dev_setattr_power_mgmt_dev(local_login_t)
dev_getattr_sound_dev(local_login_t)
@@ -22054,9 +20299,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-optional_policy(`
- nscd_socket_use(sulogin_t)
-')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.6.24/policy/modules/system/logging.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.6.25/policy/modules/system/logging.fc
--- nsaserefpolicy/policy/modules/system/logging.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/logging.fc 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/logging.fc 2009-07-29 21:34:35.000000000 -0400
@@ -53,15 +53,18 @@
/var/named/chroot/var/log -d gen_context(system_u:object_r:var_log_t,s0)
')
@@ -22080,9 +20325,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.6.24/policy/modules/system/logging.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.6.25/policy/modules/system/logging.if
--- nsaserefpolicy/policy/modules/system/logging.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/logging.if 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/logging.if 2009-07-29 21:34:35.000000000 -0400
@@ -623,7 +623,7 @@
')
@@ -22101,9 +20346,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.6.24/policy/modules/system/logging.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.6.25/policy/modules/system/logging.te
--- nsaserefpolicy/policy/modules/system/logging.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/logging.te 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/logging.te 2009-07-29 21:34:35.000000000 -0400
@@ -126,7 +126,7 @@
allow auditd_t self:process { signal_perms setpgid setsched };
allow auditd_t self:file rw_file_perms;
@@ -22196,9 +20441,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow syslogd_t self:udp_socket create_socket_perms;
allow syslogd_t self:tcp_socket create_stream_socket_perms;
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.6.24/policy/modules/system/lvm.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.6.25/policy/modules/system/lvm.te
--- nsaserefpolicy/policy/modules/system/lvm.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/lvm.te 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/lvm.te 2009-07-29 21:34:35.000000000 -0400
@@ -10,6 +10,9 @@
type clvmd_exec_t;
init_daemon_domain(clvmd_t, clvmd_exec_t)
@@ -22285,9 +20530,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
modutils_domtrans_insmod(lvm_t)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.6.24/policy/modules/system/miscfiles.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.6.25/policy/modules/system/miscfiles.if
--- nsaserefpolicy/policy/modules/system/miscfiles.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.24/policy/modules/system/miscfiles.if 2009-07-28 13:42:19.000000000 -0400
++++ serefpolicy-3.6.25/policy/modules/system/miscfiles.if 2009-07-29 21:34:35.000000000 -0400
@@ -87,6 +87,25 @@
########################################
@@ -22314,9 +20559,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Do not audit attempts to write fonts.
##
##