--- nsaserefpolicy/policy/modules/services/bluetooth.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/bluetooth.fc	2008-08-14 13:53:54.000000000 -0400
@@ -22,3 +22,8 @@
 #
 /var/lib/bluetooth(/.*)?	gen_context(system_u:object_r:bluetooth_var_lib_t,s0)
 /var/run/sdp		-s	gen_context(system_u:object_r:bluetooth_var_run_t,s0)
+/var/run/bluetoothd_address	gen_context(system_u:object_r:bluetooth_var_run_t,s0)
+
+/etc/rc.d/init.d/bluetooth --	gen_context(system_u:object_r:bluetooth_script_exec_t,s0)
+/etc/rc.d/init.d/dund	--	gen_context(system_u:object_r:bluetooth_script_exec_t,s0)
+/etc/rc.d/init.d/pand	--	gen_context(system_u:object_r:bluetooth_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/bluetooth.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/bluetooth.if	2008-08-14 13:53:54.000000000 -0400
@@ -226,3 +226,88 @@
 	dontaudit $1 bluetooth_helper_domain:dir search;
 	dontaudit $1 bluetooth_helper_domain:file { read getattr };
 ')
+
+########################################
+## <summary>
+##	Execute bluetooth server in the bluetooth domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`bluetooth_script_domtrans',`
+	gen_require(`
+		type bluetooth_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, bluetooth_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an bluetooth environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the bluetooth domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`bluetooth_admin',`
+	gen_require(`
+		type bluetooth_t;
+		type bluetooth_script_exec_t;
+		type bluetooth_tmp_t;
+		type bluetooth_lock_t;
+		type bluetooth_spool_t;
+		type bluetooth_var_lib_t;
+		type bluetooth_var_run_t;
+		type bluetooth_conf_t;
+		type bluetooth_conf_rw_t;
+
+	')
+
+	allow $1 bluetooth_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, bluetooth_t, bluetooth_t)
+	        
+	# Allow bluetooth_t to restart the apache service
+	bluetooth_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 bluetooth_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_tmp($1)
+        admin_pattern($1, bluetooth_tmp_t)
+
+	files_list_var($1)
+        admin_pattern($1, bluetooth_lock_t)
+
+	files_list_etc($1)
+        admin_pattern($1, bluetooth_conf_t)
+        admin_pattern($1, bluetooth_conf_rw_t)
+
+	files_list_spool($1)
+	admin_pattern($1, bluetooth_spool_t)
+
+	files_list_var_lib($1)
+        admin_pattern($1, bluetooth_var_lib_t)
+
+	files_list_pids($1)
+        admin_pattern($1, bluetooth_var_run_t)
+')
+
--- nsaserefpolicy/policy/modules/services/bluetooth.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/bluetooth.te	2008-08-14 13:53:54.000000000 -0400
@@ -32,19 +32,22 @@
 type bluetooth_var_run_t;
 files_pid_file(bluetooth_var_run_t)
 
+type bluetooth_script_exec_t;
+init_script_type(bluetooth_script_exec_t)
+
 ########################################
 #
 # Bluetooth services local policy
 #
 
-allow bluetooth_t self:capability { net_bind_service net_admin net_raw sys_tty_config ipc_lock };
+allow bluetooth_t self:capability { dac_override net_bind_service net_admin net_raw sys_tty_config ipc_lock };
 dontaudit bluetooth_t self:capability sys_tty_config;
 allow bluetooth_t self:process { getsched signal_perms };
 allow bluetooth_t self:fifo_file rw_fifo_file_perms;
 allow bluetooth_t self:shm create_shm_perms;
 allow bluetooth_t self:socket create_stream_socket_perms;
 allow bluetooth_t self:unix_dgram_socket create_socket_perms;
-allow bluetooth_t self:unix_stream_socket create_stream_socket_perms;
+allow bluetooth_t self:unix_stream_socket { connectto create_stream_socket_perms };
 allow bluetooth_t self:tcp_socket create_stream_socket_perms;
 allow bluetooth_t self:udp_socket create_socket_perms;
 
@@ -92,6 +95,7 @@
 dev_rw_usbfs(bluetooth_t)
 dev_rw_generic_usb_dev(bluetooth_t)
 dev_read_urand(bluetooth_t)
+dev_rw_input_dev(bluetooth_t)
 
 fs_getattr_all_fs(bluetooth_t)
 fs_search_auto_mountpoints(bluetooth_t)
@@ -110,6 +114,8 @@
 files_read_etc_runtime_files(bluetooth_t)
 files_read_usr_files(bluetooth_t)
 
+auth_use_nsswitch(bluetooth_t)
+
 libs_use_ld_so(bluetooth_t)
 libs_use_shared_libs(bluetooth_t)
 
@@ -117,11 +123,9 @@
 
 miscfiles_read_localization(bluetooth_t)
 miscfiles_read_fonts(bluetooth_t)
-
-sysnet_read_config(bluetooth_t)
+miscfiles_read_hwdata(bluetooth_t)
 
 userdom_dontaudit_use_unpriv_user_fds(bluetooth_t)
-
 sysadm_dontaudit_use_ptys(bluetooth_t)
 sysadm_dontaudit_search_home_dirs(bluetooth_t)
 
@@ -126,12 +130,13 @@
 sysadm_dontaudit_search_home_dirs(bluetooth_t)
 
 optional_policy(`
-	dbus_system_bus_client_template(bluetooth, bluetooth_t)
-	dbus_connect_system_bus(bluetooth_t)
+	cups_dbus_chat(bluetooth_t)
 ')
 
 optional_policy(`
-	nis_use_ypbind(bluetooth_t)
+	dbus_system_bus_client_template(bluetooth, bluetooth_t)
+	dbus_connect_system_bus(bluetooth_t)
+	dbus_system_domain(bluetooth_t, bluetooth_exec_t)
 ')
 
 optional_policy(`
