--- nsaserefpolicy/policy/modules/services/automount.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/automount.fc	2008-08-14 13:53:54.000000000 -0400
@@ -12,4 +12,7 @@
 # /var
 #
 
-/var/run/autofs(/.*)?		gen_context(system_u:object_r:automount_var_run_t,s0)
+/var/run/autofs.*		gen_context(system_u:object_r:automount_var_run_t,s0)
+
+/etc/rc.d/init.d/autofs	--	gen_context(system_u:object_r:automount_script_exec_t,s0)
+
--- nsaserefpolicy/policy/modules/services/automount.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/automount.if	2008-08-14 13:53:54.000000000 -0400
@@ -74,3 +74,109 @@
 
 	dontaudit $1 automount_tmp_t:dir getattr;
 ')
+
+########################################
+## <summary>
+##	Do not audit attempts to file descriptors for automount.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`automount_dontaudit_use_fds',`
+	gen_require(`
+		type automount_t;
+	')
+
+	dontaudit $1 automount_t:fd use;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to write automount daemon unnamed pipes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`automount_dontaudit_write_pipes',`
+	gen_require(`
+		type automount_t;
+	')
+
+	dontaudit $1 automount_t:fifo_file write;
+')
+
+
+########################################
+## <summary>
+##	Execute automount server in the automount domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`automount_script_domtrans',`
+	gen_require(`
+		type automount_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, automount_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an automount environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the automount domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`automount_admin',`
+	gen_require(`
+		type automount_t;
+		type automount_script_exec_t;
+		type automount_lock_t;
+		type automount_tmp_t;
+		type automount_var_run_t;
+	')
+
+	allow $1 automount_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, automount_t, automount_t)
+	        
+	# Allow automount_t to restart the apache service
+	automount_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 automount_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_var($1)
+        admin_pattern($1, automount_lock_t)
+
+	files_list_tmp($1)
+        admin_pattern($1, automount_tmp_t)
+
+	files_list_pids($1)
+        admin_pattern($1, automount_var_run_t)
+')
--- nsaserefpolicy/policy/modules/services/automount.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/automount.te	2008-08-14 13:53:54.000000000 -0400
@@ -20,6 +20,9 @@
 files_tmp_file(automount_tmp_t)
 files_mountpoint(automount_tmp_t)
 
+type automount_script_exec_t;
+init_script_type(automount_script_exec_t)
+
 ########################################
 #
 # Local policy
@@ -35,8 +38,6 @@
 allow automount_t self:udp_socket create_socket_perms;
 allow automount_t self:rawip_socket create_socket_perms;
 
-allow automount_t self:netlink_route_socket r_netlink_socket_perms;
-
 can_exec(automount_t, automount_exec_t)
 
 allow automount_t automount_lock_t:file manage_file_perms;
@@ -52,7 +53,8 @@
 files_root_filetrans(automount_t, automount_tmp_t, dir)
 
 manage_files_pattern(automount_t, automount_var_run_t, automount_var_run_t)
-files_pid_filetrans(automount_t, automount_var_run_t, file)
+manage_fifo_files_pattern(automount_t, automount_var_run_t, automount_var_run_t)
+files_pid_filetrans(automount_t, automount_var_run_t, { file fifo_file })
 
 kernel_read_kernel_sysctls(automount_t)
 kernel_read_irq_sysctls(automount_t)
@@ -69,6 +71,7 @@
 files_mounton_all_mountpoints(automount_t)
 files_mount_all_file_type_fs(automount_t)
 files_unmount_all_file_type_fs(automount_t)
+files_manage_non_security_dirs(automount_t)
 
 fs_mount_all_fs(automount_t)
 fs_unmount_all_fs(automount_t)
@@ -98,6 +101,7 @@
 corenet_udp_bind_all_rpc_ports(automount_t)
 
 dev_read_sysfs(automount_t)
+dev_rw_autofs(automount_t)
 # for SSP
 dev_read_rand(automount_t)
 dev_read_urand(automount_t)
@@ -126,8 +130,12 @@
 fs_mount_autofs(automount_t)
 fs_manage_autofs_symlinks(automount_t)
 
+storage_rw_fuse(automount_t)
+
 term_dontaudit_getattr_pty_dirs(automount_t)
 
+auth_use_nsswitch(automount_t)
+
 libs_use_ld_so(automount_t)
 libs_use_shared_libs(automount_t)
 
@@ -140,12 +148,7 @@
 # Run mount in the mount_t domain.
 mount_domtrans(automount_t)
 
-sysnet_dns_name_resolve(automount_t)
-sysnet_use_ldap(automount_t)
-sysnet_read_config(automount_t)
-
 userdom_dontaudit_use_unpriv_user_fds(automount_t)
-
 sysadm_dontaudit_search_home_dirs(automount_t)
 
 optional_policy(`
@@ -157,17 +160,18 @@
 ')
 
 optional_policy(`
-	kerberos_read_keytab(automount_t)
+	kerberos_keytab_template(automount, automount_t)
 	kerberos_read_config(automount_t)
 	kerberos_dontaudit_write_config(automount_t)
 ')
 
 optional_policy(`
-	nis_use_ypbind(automount_t)
+	rpc_search_nfs_state_data(automount_t)
 ')
 
 optional_policy(`
-	rpc_search_nfs_state_data(automount_t)
+	samba_read_config(automount_t)
+	samba_manage_var_files(automount_t)
 ')
 
 optional_policy(`
