--- nsaserefpolicy/policy/modules/kernel/filesystem.if	2008-08-14 13:08:27.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/kernel/filesystem.if	2008-08-14 13:53:54.000000000 -0400
@@ -535,6 +535,24 @@
 
 ########################################
 ## <summary>
+##	Mounton a CIFS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_mounton_cifs',`
+	gen_require(`
+		type cifs_t;
+	')
+
+	allow $1 cifs_t:dir mounton;
+')
+
+########################################
+## <summary>
 ##	Remount a CIFS or SMB network filesystem.
 ##	This allows some mount options to be changed.
 ## </summary>
@@ -737,6 +755,7 @@
 		attribute noxattrfs;
 	')
 
+	list_dirs_pattern($1, noxattrfs, noxattrfs)
 	read_files_pattern($1, noxattrfs, noxattrfs)
 ')
 
@@ -779,6 +798,25 @@
 ########################################
 ## <summary>
 ##	Do not audit attempts to read
+##	dirs on a CIFS or SMB filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`fs_dontaudit_list_cifs_dirs',`
+	gen_require(`
+		type cifs_t;
+	')
+
+	dontaudit $1 cifs_t:dir list_dir_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read
 ##	files on a CIFS or SMB filesystem.
 ## </summary>
 ## <param name="domain">
@@ -955,6 +993,46 @@
 
 ########################################
 ## <summary>
+##	Append files
+##	on a CIFS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`fs_append_cifs_files',`
+	gen_require(`
+		type cifs_t;
+	')
+
+	append_files_pattern($1, cifs_t, cifs_t)
+')
+
+########################################
+## <summary>
+##	dontaudit Append files
+##	on a CIFS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`fs_dontaudit_append_cifs_files',`
+	gen_require(`
+		type cifs_t;
+	')
+
+	dontaudit $1 cifs_t:file append;
+')
+
+########################################
+## <summary>
 ##	Do not audit attempts to create, read,
 ##	write, and delete files
 ##	on a CIFS or SMB network filesystem.
@@ -1209,6 +1287,25 @@
 
 ########################################
 ## <summary>
+##	Create, read, write, and delete dirs
+##	on a DOS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_manage_dos_dirs',`
+	gen_require(`
+		type dosfs_t;
+	')
+
+	manage_dirs_pattern($1, dosfs_t, dosfs_t)
+')
+
+########################################
+## <summary>
 ##	Create, read, write, and delete files
 ##	on a DOS filesystem.
 ## </summary>
@@ -1228,6 +1325,26 @@
 
 ########################################
 ## <summary>
+##	Read and write files on hugetlbfs files
+##	file systems.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_rw_hugetlbfs_files',`
+	gen_require(`
+		type hugetlbfs_t;
+
+	')
+
+	rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t)
+')
+
+########################################
+## <summary>
 ##	Read eventpollfs files.
 ## </summary>
 ## <desc>
@@ -1287,24 +1404,6 @@
 
 ########################################
 ## <summary>
-##	Read and write hugetlbfs files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`fs_rw_hugetlbfs_files',`
-	gen_require(`
-		type hugetlbfs_t;
-	')
-
-	rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t)
-')
-
-########################################
-## <summary>
 ##	Search inotifyfs filesystem. 
 ## </summary>
 ## <param name="domain">
@@ -1478,6 +1577,24 @@
 
 ########################################
 ## <summary>
+##	Mounton a NFS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_mounton_nfs',`
+	gen_require(`
+		type nfs_t;
+	')
+
+	allow $1 nfs_t:dir mounton;
+')
+
+########################################
+## <summary>
 ##	Remount a NFS filesystem.  This allows
 ##	some mount options to be changed.
 ## </summary>
@@ -1681,7 +1798,7 @@
 		type nfs_t;
 	')
 
-	dontaudit $1 nfs_t:file { read write };
+	dontaudit $1 nfs_t:file rw_file_perms;
 ')
 
 ########################################
@@ -2002,6 +2119,47 @@
 
 ########################################
 ## <summary>
+##	Append files
+##	on a NFS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`fs_append_nfs_files',`
+	gen_require(`
+		type nfs_t;
+	')
+
+	append_files_pattern($1, nfs_t, nfs_t)
+')
+
+########################################
+## <summary>
+##	dontaudit Append files
+##	on a NFS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`fs_dontaudit_append_nfs_files',`
+	gen_require(`
+		type nfs_t;
+	')
+
+	dontaudit $1 nfs_t:file append;
+')
+
+
+########################################
+## <summary>
 ##	Do not audit attempts to create,
 ##	read, write, and delete files
 ##	on a NFS filesystem.
@@ -2996,6 +3154,7 @@
 		type tmpfs_t;
 	')
 
+	dontaudit $1 tmpfs_t:dir rw_dir_perms;
 	dontaudit $1 tmpfs_t:file rw_file_perms;
 ')
 
@@ -3132,6 +3291,25 @@
 
 ########################################
 ## <summary>
+##	Read and write block nodes on removable filesystems.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_rw_removable_blk_files',`
+	gen_require(`
+		type removable_t;
+	')
+
+	allow $1 removable_t:dir list_dir_perms;
+	rw_blk_files_pattern($1, removable_t, removable_t)
+')
+
+########################################
+## <summary>
 ##	Relabel block nodes on tmpfs filesystems.
 ## </summary>
 ## <param name="domain">
@@ -3317,6 +3495,7 @@
 	')
 
 	allow $1 filesystem_type:filesystem getattr;
+	files_getattr_all_file_type_fs($1)
 ')
 
 ########################################
@@ -3644,3 +3823,123 @@
 	relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs)
 	relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs)
 ')
+
+########################################
+## <summary>
+##	Search directories
+##	on a FUSEFS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`fs_search_fusefs_dirs',`
+	gen_require(`
+		type fusefs_t;
+	')
+
+	allow $1 fusefs_t:dir search_dir_perms;
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete directories
+##	on a FUSEFS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`fs_manage_fusefs_dirs',`
+	gen_require(`
+		type fusefs_t;
+	')
+
+	allow $1 fusefs_t:dir manage_dir_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to create, read,
+##	write, and delete directories
+##	on a FUSEFS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`fs_dontaudit_manage_fusefs_dirs',`
+	gen_require(`
+		type fusefs_t;
+	')
+
+	dontaudit $1 fusefs_t:dir manage_dir_perms;
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete files
+##	on a FUSEFS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`fs_manage_fusefs_files',`
+	gen_require(`
+		type fusefs_t;
+	')
+
+	manage_files_pattern($1, fusefs_t, fusefs_t)
+')
+
+########################################
+## <summary>
+##	Read symbolic links on a FUSEFS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_read_fusefs_symlinks',`
+	gen_require(`
+		type fusefs_t;
+	')
+
+	allow $1 fusefs_t:dir list_dir_perms;
+	read_lnk_files_pattern($1, fusefs_t, fusefs_t)
+')
+
+
+########################################
+## <summary>
+##	Do not audit attempts to create,
+##	read, write, and delete files
+##	on a FUSEFS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`fs_dontaudit_manage_fusefs_files',`
+	gen_require(`
+		type fusefs_t;
+	')
+
+	dontaudit $1 fusefs_t:file manage_file_perms;
+')
--- nsaserefpolicy/policy/modules/kernel/filesystem.te	2008-08-14 13:08:27.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/kernel/filesystem.te	2008-08-14 13:53:54.000000000 -0400
@@ -21,7 +21,6 @@
 
 # Use xattrs for the following filesystem types.
 # Requires that a security xattr handler exist for the filesystem.
-fs_use_xattr ecryptfs gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr encfs gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr ext3 gen_context(system_u:object_r:fs_t,s0);
@@ -76,6 +75,11 @@
 allow cpusetfs_t self:filesystem associate;
 genfscon cpuset / gen_context(system_u:object_r:cpusetfs_t,s0)
 
+type ecryptfs_t;
+fs_noxattr_type(ecryptfs_t)
+files_mountpoint(ecryptfs_t)
+genfscon ecryptfs / gen_context(system_u:object_r:ecryptfs_t,s0)
+
 type eventpollfs_t;
 fs_type(eventpollfs_t)
 # change to task SID 20060628
@@ -241,6 +245,7 @@
 genfscon lustre / gen_context(system_u:object_r:nfs_t,s0)
 genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
 genfscon panfs / gen_context(system_u:object_r:nfs_t,s0)
+genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
 
 ########################################
 #
