@@ -69678,13 +69829,11 @@ index 947bbc6..83c3900 100644
-type svirt_cache_t;
-files_type(svirt_cache_t)
-+virt_domain_template(svirt_prot_exec)
-+role system_r types svirt_prot_exec_t;
++virt_domain_template(svirt_nokvm)
++role system_r types svirt_nokvm_t;
- attribute virt_domain;
- attribute virt_image_type;
-+attribute virt_tmpfs_type;
-+
+-attribute virt_domain;
+-attribute virt_image_type;
+type qemu_exec_t;
+
+type virt_cache_t alias svirt_cache_t;
@@ -69692,7 +69841,7 @@ index 947bbc6..83c3900 100644
type virt_etc_t;
files_config_file(virt_etc_t)
-@@ -62,26 +100,37 @@ files_config_file(virt_etc_t)
+@@ -62,26 +110,37 @@ files_config_file(virt_etc_t)
type virt_etc_rw_t;
files_type(virt_etc_rw_t)
@@ -69733,7 +69882,7 @@ index 947bbc6..83c3900 100644
type virtd_t;
type virtd_exec_t;
-@@ -89,9 +138,17 @@ init_daemon_domain(virtd_t, virtd_exec_t)
+@@ -89,9 +148,17 @@ init_daemon_domain(virtd_t, virtd_exec_t)
domain_obj_id_change_exemption(virtd_t)
domain_subj_id_change_exemption(virtd_t)
@@ -69751,7 +69900,7 @@ index 947bbc6..83c3900 100644
ifdef(`enable_mcs',`
init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mcs_systemhigh)
')
-@@ -100,6 +157,46 @@ ifdef(`enable_mls',`
+@@ -100,29 +167,50 @@ ifdef(`enable_mls',`
init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mls_systemhigh)
')
@@ -69777,125 +69926,107 @@ index 947bbc6..83c3900 100644
+type virt_qemu_ga_log_t;
+logging_log_file(virt_qemu_ga_log_t)
+
-+########################################
-+#
+ ########################################
+ #
+-# svirt local policy
+# Declarations
-+#
+ #
+attribute svirt_lxc_domain;
-+
+
+-allow svirt_t self:udp_socket create_socket_perms;
+-
+-manage_dirs_pattern(svirt_t, svirt_cache_t, svirt_cache_t)
+-manage_files_pattern(svirt_t, svirt_cache_t, svirt_cache_t)
+-files_var_filetrans(svirt_t, svirt_cache_t, { file dir })
+type virtd_lxc_t;
+type virtd_lxc_exec_t;
+init_system_domain(virtd_lxc_t, virtd_lxc_exec_t)
-+
+
+-read_lnk_files_pattern(svirt_t, virt_image_t, virt_image_t)
+type virt_lxc_var_run_t;
+files_pid_file(virt_lxc_var_run_t)
+typealias virt_lxc_var_run_t alias virtd_lxc_var_run_t;
-+
+
+-allow svirt_t svirt_image_t:dir search_dir_perms;
+-manage_dirs_pattern(svirt_t, svirt_image_t, svirt_image_t)
+-manage_files_pattern(svirt_t, svirt_image_t, svirt_image_t)
+-fs_hugetlbfs_filetrans(svirt_t, svirt_image_t, file)
+-
+-list_dirs_pattern(svirt_t, virt_content_t, virt_content_t)
+-read_files_pattern(svirt_t, virt_content_t, virt_content_t)
+-dontaudit svirt_t virt_content_t:file write_file_perms;
+-dontaudit svirt_t virt_content_t:dir write;
+# virt lxc container files
+type svirt_lxc_file_t;
+files_mountpoint(svirt_lxc_file_t)
-+
- ########################################
- #
- # svirt local policy
-@@ -107,15 +204,13 @@ ifdef(`enable_mls',`
- allow svirt_t self:udp_socket create_socket_perms;
++########################################
++#
++# svirt local policy
++#
+ corenet_udp_sendrecv_generic_if(svirt_t)
+ corenet_udp_sendrecv_generic_node(svirt_t)
+ corenet_udp_sendrecv_all_ports(svirt_t)
+@@ -131,67 +219,65 @@ corenet_udp_bind_all_ports(svirt_t)
+ corenet_tcp_bind_all_ports(svirt_t)
+ corenet_tcp_connect_all_ports(svirt_t)
--manage_dirs_pattern(svirt_t, svirt_cache_t, svirt_cache_t)
--manage_files_pattern(svirt_t, svirt_cache_t, svirt_cache_t)
--files_var_filetrans(svirt_t, svirt_cache_t, { file dir })
+-dev_list_sysfs(svirt_t)
-
- read_lnk_files_pattern(svirt_t, virt_image_t, virt_image_t)
-
- allow svirt_t svirt_image_t:dir search_dir_perms;
- manage_dirs_pattern(svirt_t, svirt_image_t, svirt_image_t)
- manage_files_pattern(svirt_t, svirt_image_t, svirt_image_t)
-+manage_fifo_files_pattern(svirt_t, svirt_image_t, svirt_image_t)
-+manage_sock_files_pattern(svirt_t, svirt_image_t, svirt_image_t)
- fs_hugetlbfs_filetrans(svirt_t, svirt_image_t, file)
-
- list_dirs_pattern(svirt_t, virt_content_t, virt_content_t)
-@@ -133,9 +228,17 @@ corenet_tcp_connect_all_ports(svirt_t)
-
- dev_list_sysfs(svirt_t)
-
-+fs_getattr_xattr_fs(svirt_t)
-+
- userdom_search_user_home_content(svirt_t)
- userdom_read_user_home_content_symlinks(svirt_t)
- userdom_read_all_users_state(svirt_t)
-+append_files_pattern(svirt_t, virt_home_t, virt_home_t)
-+manage_dirs_pattern(svirt_t, svirt_home_t, svirt_home_t)
-+manage_files_pattern(svirt_t, svirt_home_t, svirt_home_t)
-+manage_sock_files_pattern(svirt_t, svirt_home_t, svirt_home_t)
-+filetrans_pattern(svirt_t, virt_home_t, svirt_home_t, { dir sock_file file })
-+stream_connect_pattern(svirt_t, svirt_home_t, svirt_home_t, virtd_t)
-
- tunable_policy(`virt_use_comm',`
- term_use_unallocated_ttys(svirt_t)
-@@ -143,18 +246,26 @@ tunable_policy(`virt_use_comm',`
- ')
-
- tunable_policy(`virt_use_fusefs',`
+-userdom_search_user_home_content(svirt_t)
+-userdom_read_user_home_content_symlinks(svirt_t)
+-userdom_read_all_users_state(svirt_t)
+-
+-tunable_policy(`virt_use_comm',`
+- term_use_unallocated_ttys(svirt_t)
+- dev_rw_printer(svirt_t)
+-')
+-
+-tunable_policy(`virt_use_fusefs',`
- fs_read_fusefs_files(svirt_t)
-+ fs_manage_fusefs_dirs(svirt_t)
-+ fs_manage_fusefs_files(svirt_t)
- fs_read_fusefs_symlinks(svirt_t)
-+ fs_getattr_fusefs(svirt_t)
- ')
-
- tunable_policy(`virt_use_nfs',`
- fs_manage_nfs_dirs(svirt_t)
- fs_manage_nfs_files(svirt_t)
-+ fs_manage_nfs_named_sockets(svirt_t)
-+ fs_read_nfs_symlinks(svirt_t)
-+ fs_getattr_nfs(svirt_t)
- ')
-
- tunable_policy(`virt_use_samba',`
- fs_manage_cifs_dirs(svirt_t)
- fs_manage_cifs_files(svirt_t)
-+ fs_manage_cifs_named_sockets(svirt_t)
-+ fs_read_cifs_symlinks(virtd_t)
-+ fs_getattr_cifs(svirt_t)
- ')
-
- tunable_policy(`virt_use_sysfs',`
-@@ -163,11 +274,32 @@ tunable_policy(`virt_use_sysfs',`
-
- tunable_policy(`virt_use_usb',`
- dev_rw_usbfs(svirt_t)
-+ dev_read_sysfs(svirt_t)
- fs_manage_dos_dirs(svirt_t)
- fs_manage_dos_files(svirt_t)
- ')
-
+- fs_read_fusefs_symlinks(svirt_t)
+-')
+-
+-tunable_policy(`virt_use_nfs',`
+- fs_manage_nfs_dirs(svirt_t)
+- fs_manage_nfs_files(svirt_t)
+-')
+-
+-tunable_policy(`virt_use_samba',`
+- fs_manage_cifs_dirs(svirt_t)
+- fs_manage_cifs_files(svirt_t)
+-')
+-
+-tunable_policy(`virt_use_sysfs',`
+- dev_rw_sysfs(svirt_t)
+-')
+-
+-tunable_policy(`virt_use_usb',`
+- dev_rw_usbfs(svirt_t)
+- fs_manage_dos_dirs(svirt_t)
+- fs_manage_dos_files(svirt_t)
+-')
+-
optional_policy(`
-+ tunable_policy(`virt_use_sanlock',`
-+ sanlock_stream_connect(svirt_t)
-+ ')
-+')
-+
-+tunable_policy(`virt_use_rawip',`
-+ allow svirt_t self:rawip_socket create_socket_perms;
-+')
-+
-+optional_policy(`
-+ tunable_policy(`virt_use_xserver',`
-+ xserver_stream_connect(svirt_t)
-+ ')
-+')
-+
-+optional_policy(`
-+ virt_domtrans_bridgehelper(svirt_t)
-+')
-+
-+optional_policy(`
xen_rw_image_files(svirt_t)
')
-@@ -176,22 +308,42 @@ optional_policy(`
++#######################################
++#
++# svirt_prot_exec local policy
++#
++
++allow svirt_nokvm_t self:process { execmem execstack };
++corenet_udp_sendrecv_generic_if(svirt_nokvm_t)
++corenet_udp_sendrecv_generic_node(svirt_nokvm_t)
++corenet_udp_sendrecv_all_ports(svirt_nokvm_t)
++corenet_udp_bind_generic_node(svirt_nokvm_t)
++corenet_udp_bind_all_ports(svirt_nokvm_t)
++corenet_tcp_bind_all_ports(svirt_nokvm_t)
++corenet_tcp_connect_all_ports(svirt_nokvm_t)
++
+ ########################################
+ #
# virtd local policy
#
@@ -69945,7 +70076,7 @@ index 947bbc6..83c3900 100644
read_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
read_lnk_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
-@@ -202,19 +354,28 @@ manage_lnk_files_pattern(virtd_t, virt_etc_rw_t, virt_etc_rw_t)
+@@ -202,19 +288,28 @@ manage_lnk_files_pattern(virtd_t, virt_etc_rw_t, virt_etc_rw_t)
filetrans_pattern(virtd_t, virt_etc_t, virt_etc_rw_t, dir)
manage_files_pattern(virtd_t, virt_image_type, virt_image_type)
@@ -69980,7 +70111,7 @@ index 947bbc6..83c3900 100644
manage_dirs_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t)
manage_files_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t)
manage_sock_files_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t)
-@@ -225,16 +386,22 @@ manage_files_pattern(virtd_t, virt_var_run_t, virt_var_run_t)
+@@ -225,16 +320,22 @@ manage_files_pattern(virtd_t, virt_var_run_t, virt_var_run_t)
manage_sock_files_pattern(virtd_t, virt_var_run_t, virt_var_run_t)
files_pid_filetrans(virtd_t, virt_var_run_t, { file dir })
@@ -70004,7 +70135,7 @@ index 947bbc6..83c3900 100644
corenet_all_recvfrom_netlabel(virtd_t)
corenet_tcp_sendrecv_generic_if(virtd_t)
corenet_tcp_sendrecv_generic_node(virtd_t)
-@@ -247,22 +414,31 @@ corenet_tcp_connect_soundd_port(virtd_t)
+@@ -247,22 +348,31 @@ corenet_tcp_connect_soundd_port(virtd_t)
corenet_rw_tun_tap_dev(virtd_t)
dev_rw_sysfs(virtd_t)
@@ -70038,7 +70169,7 @@ index 947bbc6..83c3900 100644
fs_list_auto_mountpoints(virtd_t)
fs_getattr_xattr_fs(virtd_t)
-@@ -270,6 +446,18 @@ fs_rw_anon_inodefs_files(virtd_t)
+@@ -270,6 +380,18 @@ fs_rw_anon_inodefs_files(virtd_t)
fs_list_inotifyfs(virtd_t)
fs_manage_cgroup_dirs(virtd_t)
fs_rw_cgroup_files(virtd_t)
@@ -70057,7 +70188,7 @@ index 947bbc6..83c3900 100644
mcs_process_set_categories(virtd_t)
-@@ -284,7 +472,8 @@ term_use_ptmx(virtd_t)
+@@ -284,7 +406,8 @@ term_use_ptmx(virtd_t)
auth_use_nsswitch(virtd_t)
@@ -70067,7 +70198,7 @@ index 947bbc6..83c3900 100644
miscfiles_read_generic_certs(virtd_t)
miscfiles_read_hwdata(virtd_t)
-@@ -293,17 +482,33 @@ modutils_read_module_config(virtd_t)
+@@ -293,17 +416,33 @@ modutils_read_module_config(virtd_t)
modutils_manage_module_config(virtd_t)
logging_send_syslog_msg(virtd_t)
@@ -70101,7 +70232,7 @@ index 947bbc6..83c3900 100644
tunable_policy(`virt_use_nfs',`
fs_manage_nfs_dirs(virtd_t)
-@@ -322,6 +527,10 @@ optional_policy(`
+@@ -322,6 +461,10 @@ optional_policy(`
')
optional_policy(`
@@ -70112,7 +70243,7 @@ index 947bbc6..83c3900 100644
dbus_system_bus_client(virtd_t)
optional_policy(`
-@@ -335,19 +544,34 @@ optional_policy(`
+@@ -335,19 +478,34 @@ optional_policy(`
optional_policy(`
hal_dbus_chat(virtd_t)
')
@@ -70148,7 +70279,7 @@ index 947bbc6..83c3900 100644
# Manages /etc/sysconfig/system-config-firewall
iptables_manage_config(virtd_t)
-@@ -362,6 +586,12 @@ optional_policy(`
+@@ -362,6 +520,12 @@ optional_policy(`
')
optional_policy(`
@@ -70161,7 +70292,7 @@ index 947bbc6..83c3900 100644
policykit_dbus_chat(virtd_t)
policykit_domtrans_auth(virtd_t)
policykit_domtrans_resolve(virtd_t)
-@@ -369,11 +599,11 @@ optional_policy(`
+@@ -369,11 +533,11 @@ optional_policy(`
')
optional_policy(`
@@ -70178,7 +70309,7 @@ index 947bbc6..83c3900 100644
')
optional_policy(`
-@@ -384,6 +614,7 @@ optional_policy(`
+@@ -384,6 +548,7 @@ optional_policy(`
kernel_read_xen_state(virtd_t)
kernel_write_xen_state(virtd_t)
@@ -70186,10 +70317,11 @@ index 947bbc6..83c3900 100644
xen_stream_connect(virtd_t)
xen_stream_connect_xenstore(virtd_t)
xen_read_image_files(virtd_t)
-@@ -403,34 +634,48 @@ optional_policy(`
+@@ -402,35 +567,84 @@ optional_policy(`
+ #
# virtual domains common policy
#
-
+-
-allow virt_domain self:capability { dac_read_search dac_override kill };
-allow virt_domain self:process { execmem execstack signal getsched signull };
-allow virt_domain self:fifo_file rw_file_perms;
@@ -70199,11 +70331,48 @@ index 947bbc6..83c3900 100644
allow virt_domain self:unix_stream_socket create_stream_socket_perms;
allow virt_domain self:unix_dgram_socket { create_socket_perms sendto };
allow virt_domain self:tcp_socket create_stream_socket_perms;
-
++allow virt_domain self:udp_socket create_socket_perms;
++
++list_dirs_pattern(virt_domain, virt_content_t, virt_content_t)
++read_files_pattern(virt_domain, virt_content_t, virt_content_t)
++dontaudit virt_domain virt_content_t:file write_file_perms;
++dontaudit virt_domain virt_content_t:dir write;
++
++userdom_search_user_home_content(virt_domain)
++userdom_read_user_home_content_symlinks(virt_domain)
++userdom_read_all_users_state(virt_domain)
++append_files_pattern(virt_domain, virt_home_t, virt_home_t)
++manage_dirs_pattern(virt_domain, svirt_home_t, svirt_home_t)
++manage_files_pattern(virt_domain, svirt_home_t, svirt_home_t)
++manage_sock_files_pattern(virt_domain, svirt_home_t, svirt_home_t)
++filetrans_pattern(virt_domain, virt_home_t, svirt_home_t, { dir sock_file file })
++stream_connect_pattern(virt_domain, svirt_home_t, svirt_home_t, virtd_t)
++
+manage_dirs_pattern(virt_domain, virt_cache_t, virt_cache_t)
+manage_files_pattern(virt_domain, virt_cache_t, virt_cache_t)
+files_var_filetrans(virt_domain, virt_cache_t, { file dir })
+
++read_lnk_files_pattern(virt_domain, virt_image_t, virt_image_t)
++
++manage_dirs_pattern(virt_domain, svirt_image_t, svirt_image_t)
++manage_files_pattern(virt_domain, svirt_image_t, svirt_image_t)
++manage_fifo_files_pattern(virt_domain, svirt_image_t, svirt_image_t)
++read_lnk_files_pattern(virt_domain, svirt_image_t, svirt_image_t)
++rw_chr_files_pattern(virt_domain, svirt_image_t, svirt_image_t)
++rw_blk_files_pattern(virt_domain, svirt_image_t, svirt_image_t)
++fs_hugetlbfs_filetrans(virt_domain, svirt_image_t, file)
++
++manage_dirs_pattern(virt_domain, svirt_tmp_t, svirt_tmp_t)
++manage_files_pattern(virt_domain, svirt_tmp_t, svirt_tmp_t)
++manage_lnk_files_pattern(virt_domain, svirt_tmp_t, svirt_tmp_t)
++files_tmp_filetrans(virt_domain, svirt_tmp_t, { file dir lnk_file })
++userdom_user_tmp_filetrans(virt_domain, svirt_tmp_t, { dir file lnk_file })
++
++manage_dirs_pattern(virt_domain, svirt_tmpfs_t, svirt_tmpfs_t)
++manage_files_pattern(virt_domain, svirt_tmpfs_t, svirt_tmpfs_t)
++manage_lnk_files_pattern(virt_domain, svirt_tmpfs_t, svirt_tmpfs_t)
++fs_tmpfs_filetrans(virt_domain, svirt_tmpfs_t, { dir file lnk_file })
++
+manage_dirs_pattern(virt_domain, qemu_var_run_t, qemu_var_run_t)
+manage_files_pattern(virt_domain, qemu_var_run_t, qemu_var_run_t)
+manage_sock_files_pattern(virt_domain, qemu_var_run_t, qemu_var_run_t)
@@ -70214,14 +70383,13 @@ index 947bbc6..83c3900 100644
+dontaudit virtd_t virt_domain:process { siginh noatsecure rlimitinh };
+
+dontaudit virt_domain virt_tmpfs_type:file { read write };
-+
+
append_files_pattern(virt_domain, virt_log_t, virt_log_t)
append_files_pattern(virt_domain, virt_var_lib_t, virt_var_lib_t)
-kernel_read_system_state(virt_domain)
-+fs_getattr_xattr_fs(virt_domain)
-
+-
corecmd_exec_bin(virt_domain)
corecmd_exec_shell(virt_domain)
@@ -70237,12 +70405,13 @@ index 947bbc6..83c3900 100644
corenet_tcp_connect_virt_migration_port(virt_domain)
+corenet_rw_inherited_tun_tap_dev(virt_domain)
++dev_list_sysfs(virt_domain)
+dev_getattr_fs(virt_domain)
+dev_read_generic_symlinks(virt_domain)
dev_read_rand(virt_domain)
dev_read_sound(virt_domain)
dev_read_urand(virt_domain)
-@@ -438,10 +683,11 @@ dev_write_sound(virt_domain)
+@@ -438,34 +652,591 @@ dev_write_sound(virt_domain)
dev_rw_ksm(virt_domain)
dev_rw_kvm(virt_domain)
dev_rw_qemu(virt_domain)
@@ -70255,7 +70424,8 @@ index 947bbc6..83c3900 100644
files_read_usr_files(virt_domain)
files_read_var_files(virt_domain)
files_search_all(virt_domain)
-@@ -449,23 +695,525 @@ files_search_all(virt_domain)
+
++fs_getattr_xattr_fs(virt_domain)
fs_getattr_tmpfs(virt_domain)
fs_rw_anon_inodefs_files(virt_domain)
fs_rw_tmpfs_files(virt_domain)
@@ -70263,12 +70433,12 @@ index 947bbc6..83c3900 100644
+fs_rw_inherited_nfs_files(virt_domain)
+fs_rw_inherited_cifs_files(virt_domain)
+fs_rw_inherited_noxattr_fs_files(virt_domain)
-
--term_use_all_terms(virt_domain)
++
+# I think we need these for now.
+miscfiles_read_public_files(virt_domain)
+storage_raw_read_removable_device(virt_domain)
-+
+
+-term_use_all_terms(virt_domain)
+term_use_all_inherited_terms(virt_domain)
term_getattr_pty_fs(virt_domain)
term_use_generic_ptys(virt_domain)
@@ -70297,7 +70467,67 @@ index 947bbc6..83c3900 100644
virt_read_lib_files(virt_domain)
virt_read_content(virt_domain)
virt_stream_connect(virt_domain)
- ')
++ virt_domtrans_bridgehelper(virt_domain)
++')
++
++optional_policy(`
++ xserver_rw_shm(virt_domain)
++')
++
++tunable_policy(`virt_use_comm',`
++ term_use_unallocated_ttys(virt_domain)
++ dev_rw_printer(virt_domain)
++')
++
++tunable_policy(`virt_use_fusefs',`
++ fs_manage_fusefs_dirs(virt_domain)
++ fs_manage_fusefs_files(virt_domain)
++ fs_read_fusefs_symlinks(virt_domain)
++ fs_getattr_fusefs(virt_domain)
++')
++
++tunable_policy(`virt_use_nfs',`
++ fs_manage_nfs_dirs(virt_domain)
++ fs_manage_nfs_files(virt_domain)
++ fs_manage_nfs_named_sockets(virt_domain)
++ fs_read_nfs_symlinks(virt_domain)
++ fs_getattr_nfs(virt_domain)
++')
++
++tunable_policy(`virt_use_samba',`
++ fs_manage_cifs_dirs(virt_domain)
++ fs_manage_cifs_files(virt_domain)
++ fs_manage_cifs_named_sockets(virt_domain)
++ fs_read_cifs_symlinks(virt_domain)
++ fs_getattr_cifs(virt_domain)
++')
++
++tunable_policy(`virt_use_sysfs',`
++ dev_rw_sysfs(virt_domain)
++')
++
++tunable_policy(`virt_use_usb',`
++ dev_rw_usbfs(virt_domain)
++ dev_read_sysfs(virt_domain)
++ fs_manage_dos_dirs(virt_domain)
++ fs_manage_dos_files(virt_domain)
++')
++
++optional_policy(`
++ tunable_policy(`virt_use_sanlock',`
++ sanlock_stream_connect(virt_domain)
++ ')
++')
++
++tunable_policy(`virt_use_rawip',`
++ allow virt_domain self:rawip_socket create_socket_perms;
++')
++
++optional_policy(`
++ tunable_policy(`virt_use_xserver',`
++ xserver_stream_connect(virt_domain)
++ ')
++')
+
+########################################
+#
@@ -70694,13 +70924,6 @@ index 947bbc6..83c3900 100644
+
+userdom_use_inherited_user_ptys(svirt_lxc_net_t)
+
-+#######################################
-+#
-+# svirt_prot_exec local policy
-+#
-+
-+allow svirt_prot_exec_t self:process { execmem execstack };
-+
+########################################
+#
+# virt_qmf local policy
@@ -70783,7 +71006,7 @@ index 947bbc6..83c3900 100644
+
+optional_policy(`
+ devicekit_manage_pid_files(virt_qemu_ga_t)
-+')
+ ')
diff --git a/vlock.te b/vlock.te
index 2511093..669dc13 100644
--- a/vlock.te
@@ -71794,7 +72017,7 @@ index 77d41b6..cc73c96 100644
files_search_pids($1)
diff --git a/xen.te b/xen.te
-index 07033bb..08d37ba 100644
+index 07033bb..5e3cb73 100644
--- a/xen.te
+++ b/xen.te
@@ -4,6 +4,7 @@ policy_module(xen, 1.12.0)
@@ -71988,6 +72211,15 @@ index 07033bb..08d37ba 100644
########################################
#
# Xen console local policy
+@@ -359,7 +381,7 @@ allow xenconsoled_t self:process setrlimit;
+ allow xenconsoled_t self:unix_stream_socket create_stream_socket_perms;
+ allow xenconsoled_t self:fifo_file rw_fifo_file_perms;
+
+-allow xenconsoled_t xen_devpts_t:chr_file rw_term_perms;
++allow xenconsoled_t xen_devpts_t:chr_file { rw_term_perms setattr };
+
+ # pid file
+ manage_files_pattern(xenconsoled_t, xenconsoled_var_run_t, xenconsoled_var_run_t)
@@ -374,8 +396,6 @@ dev_rw_xen(xenconsoled_t)
dev_filetrans_xen(xenconsoled_t)
dev_rw_sysfs(xenconsoled_t)
@@ -71997,15 +72229,16 @@ index 07033bb..08d37ba 100644
files_read_etc_files(xenconsoled_t)
files_read_usr_files(xenconsoled_t)
-@@ -390,7 +410,6 @@ term_use_console(xenconsoled_t)
+@@ -390,7 +410,7 @@ term_use_console(xenconsoled_t)
init_use_fds(xenconsoled_t)
init_use_script_ptys(xenconsoled_t)
-miscfiles_read_localization(xenconsoled_t)
++auth_read_passwd(xenconsoled_t)
xen_manage_log(xenconsoled_t)
xen_stream_connect_xenstore(xenconsoled_t)
-@@ -413,9 +432,10 @@ manage_dirs_pattern(xenstored_t, xenstored_tmp_t, xenstored_tmp_t)
+@@ -413,9 +433,10 @@ manage_dirs_pattern(xenstored_t, xenstored_tmp_t, xenstored_tmp_t)
files_tmp_filetrans(xenstored_t, xenstored_tmp_t, { file dir })
# pid file
@@ -72017,7 +72250,7 @@ index 07033bb..08d37ba 100644
# log files
manage_dirs_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t)
-@@ -442,111 +462,24 @@ files_read_etc_files(xenstored_t)
+@@ -442,111 +463,24 @@ files_read_etc_files(xenstored_t)
files_read_usr_files(xenstored_t)
@@ -72131,7 +72364,7 @@ index 07033bb..08d37ba 100644
#Should have a boolean wrapping these
fs_list_auto_mountpoints(xend_t)
files_search_mnt(xend_t)
-@@ -559,8 +492,4 @@ optional_policy(`
+@@ -559,8 +493,4 @@ optional_policy(`
fs_manage_nfs_files(xend_t)
fs_read_nfs_symlinks(xend_t)
')
diff --git a/selinux-policy.spec b/selinux-policy.spec
index da03fb8..cd0b2f0 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.11.1
-Release: 53%{?dist}
+Release: 54%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -523,6 +523,20 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Thu Nov 15 2012 Miroslav Grepl