--- nsaserefpolicy/policy/modules/services/cron.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/cron.fc	2008-08-14 13:53:54.000000000 -0400
@@ -17,6 +17,8 @@
 /var/run/fcron\.fifo		-s	gen_context(system_u:object_r:crond_var_run_t,s0)
 /var/run/fcron\.pid		--	gen_context(system_u:object_r:crond_var_run_t,s0)
 
+/var/spool/anacron(/.*)			gen_context(system_u:object_r:system_cron_spool_t,s0)
+
 /var/spool/at			-d	gen_context(system_u:object_r:cron_spool_t,s0)
 /var/spool/at/spool		-d	gen_context(system_u:object_r:cron_spool_t,s0)
 /var/spool/at/[^/]*		--	<<none>>
@@ -45,3 +47,4 @@
 /var/spool/fcron/systab\.orig	--	gen_context(system_u:object_r:system_cron_spool_t,s0)
 /var/spool/fcron/systab		--	gen_context(system_u:object_r:system_cron_spool_t,s0)
 /var/spool/fcron/new\.systab	--	gen_context(system_u:object_r:system_cron_spool_t,s0)
+/var/lib/misc(/.*)?			gen_context(system_u:object_r:system_crond_var_lib_t,s0)
--- nsaserefpolicy/policy/modules/services/cron.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/cron.if	2008-08-14 13:53:54.000000000 -0400
@@ -35,39 +35,23 @@
 #
 template(`cron_per_role_template',`
 	gen_require(`
+		class context contains;
 		attribute cron_spool_type;
 		type crond_t, cron_spool_t, crontab_exec_t;
-		class dbus send_msg;
 	')
+	typealias $1_t alias $1_crond_t;
 
 	# Type of user crontabs once moved to cron spool.
 	type $1_cron_spool_t, cron_spool_type;
 	files_type($1_cron_spool_t)
 
-	type $1_crond_t;
-	domain_type($1_crond_t)
-	domain_cron_exemption_target($1_crond_t)
-	corecmd_shell_entry_type($1_crond_t)
-	role $3 types $1_crond_t;
+	domain_cron_exemption_target($1_t)
+	corecmd_shell_entry_type($1_t)
 
 	type $1_crontab_t;
 	application_domain($1_crontab_t, crontab_exec_t)
 	role $3 types $1_crontab_t;
 
-	type $1_crontab_tmp_t;
-	files_tmp_file($1_crontab_tmp_t)
-
-	##############################
-	#
-	# $1_crond_t local policy
-	#
-
-	allow $1_crond_t self:capability dac_override;
-	allow $1_crond_t self:process { signal_perms setsched };
-	allow $1_crond_t self:fifo_file rw_fifo_file_perms;
-	allow $1_crond_t self:unix_stream_socket create_stream_socket_perms;
-	allow $1_crond_t self:unix_dgram_socket create_socket_perms;
-
 	# The entrypoint interface is not used as this is not
 	# a regular entrypoint.  Since crontab files are
 	# not directly executed, crond must ensure that
@@ -75,116 +59,23 @@
 	# for the domain of the user cron job.  It
 	# performs an entrypoint permission check
 	# for this purpose.
-	allow $1_crond_t $1_cron_spool_t:file entrypoint;
+	allow $1_t $1_cron_spool_t:file entrypoint;
 
 	# Permit a transition from the crond_t domain to this domain.
 	# The transition is requested explicitly by the modified crond 
 	# via setexeccon.  There is no way to set up an automatic
 	# transition, since crontabs are configuration files, not executables.
-	allow crond_t $1_crond_t:process transition;
-	dontaudit crond_t $1_crond_t:process { noatsecure siginh rlimitinh };
-	allow crond_t $1_crond_t:fd use;
-	allow $1_crond_t crond_t:fd use;
-	allow $1_crond_t crond_t:fifo_file rw_file_perms;
-	allow $1_crond_t crond_t:process sigchld;
-
-	kernel_read_system_state($1_crond_t)
-	kernel_read_kernel_sysctls($1_crond_t)
-
-	# ps does not need to access /boot when run from cron
-	files_dontaudit_search_boot($1_crond_t)
-
-	corenet_all_recvfrom_unlabeled($1_crond_t)
-	corenet_all_recvfrom_netlabel($1_crond_t)
-	corenet_tcp_sendrecv_all_if($1_crond_t)
-	corenet_udp_sendrecv_all_if($1_crond_t)
-	corenet_tcp_sendrecv_all_nodes($1_crond_t)
-	corenet_udp_sendrecv_all_nodes($1_crond_t)
-	corenet_tcp_sendrecv_all_ports($1_crond_t)
-	corenet_udp_sendrecv_all_ports($1_crond_t)
-	corenet_tcp_connect_all_ports($1_crond_t)
-	corenet_sendrecv_all_client_packets($1_crond_t)
-
-	dev_read_urand($1_crond_t)
-
-	fs_getattr_all_fs($1_crond_t)
-
-	corecmd_exec_all_executables($1_crond_t)
-
-	# quiet other ps operations
-	domain_dontaudit_read_all_domains_state($1_crond_t)
-	domain_dontaudit_getattr_all_domains($1_crond_t)
-
-	files_read_usr_files($1_crond_t)
-	files_exec_etc_files($1_crond_t)
-	# for nscd:
-	files_dontaudit_search_pids($1_crond_t)
-
-	libs_use_ld_so($1_crond_t)
-	libs_use_shared_libs($1_crond_t)
-	libs_exec_lib_files($1_crond_t)
-	libs_exec_ld_so($1_crond_t)
-
-	files_read_etc_runtime_files($1_crond_t)
-	files_read_var_files($1_crond_t)
-	files_search_spool($1_crond_t)
-
-	logging_search_logs($1_crond_t)
-
-	seutil_read_config($1_crond_t)
-
-	miscfiles_read_localization($1_crond_t)
-
-	userdom_manage_user_tmp_files($1, $1_crond_t)
-	userdom_manage_user_tmp_symlinks($1, $1_crond_t)
-	userdom_manage_user_tmp_pipes($1, $1_crond_t)
-	userdom_manage_user_tmp_sockets($1, $1_crond_t)
-	# Run scripts in user home directory and access shared libs.
-	userdom_exec_user_home_content_files($1, $1_crond_t)
-	# Access user files and dirs.
-#	userdom_manage_user_home_subdir_dirs($1,$1_crond_t)
-	userdom_manage_user_home_content_files($1, $1_crond_t)
-	userdom_manage_user_home_content_symlinks($1, $1_crond_t)
-	userdom_manage_user_home_content_pipes($1, $1_crond_t)
-	userdom_manage_user_home_content_sockets($1, $1_crond_t)
-#	userdom_user_home_dir_filetrans_user_home_content($1,$1_crond_t,notdevfile_class_set)
+	allow crond_t $1_t:process transition;
+	dontaudit crond_t $1_t:process { noatsecure siginh rlimitinh };
+	allow crond_t $1_t:fd use;
+	allow $1_t crond_t:fd use;
+	allow $1_t crond_t:fifo_file rw_file_perms;
+	allow $1_t crond_t:process sigchld;
 
 	tunable_policy(`fcron_crond', `
 		allow crond_t $1_cron_spool_t:file manage_file_perms;
 	')
 
-	# need a per-role version of this:
-	#optional_policy(`
-	#	mono_domtrans($1_crond_t)
-	#')
-
-	optional_policy(`
-		dbus_stub($1_crond_t)
-
-		allow $1_crond_t $2:dbus send_msg;
-	')		
-
-	optional_policy(`
-		nis_use_ypbind($1_crond_t)
-	')
-
-	ifdef(`TODO',`
-	optional_policy(`
-		create_dir_file($1_crond_t, httpd_$1_content_t)
-	')
-	allow $1_crond_t tmp_t:dir rw_dir_perms;
-	type_transition $1_crond_t $1_tmp_t:{ file lnk_file sock_file fifo_file } $1_tmp_t;
-
-	ifdef(`mta.te', `
-		domain_auto_trans($1_crond_t, sendmail_exec_t, $1_mail_t)
-		allow $1_crond_t sendmail_exec_t:lnk_file read_lnk_file_perms;
-
-		# $1_mail_t should only be reading from the cron fifo not needing to write
-		dontaudit $1_mail_t crond_t:fifo_file write;
-		allow mta_user_agent $1_crond_t:fd use;
-	')
-	') dnl endif TODO
-
 	##############################
 	#
 	# $1_crontab_t local policy
@@ -193,9 +84,13 @@
 	# dac_override is to create the file in the directory under /tmp
 	allow $1_crontab_t self:capability { fowner setuid setgid chown dac_override };
 	allow $1_crontab_t self:process signal_perms;
+	allow $1_crontab_t self:fifo_file rw_fifo_file_perms;
 
 	# Transition from the user domain to the derived domain.
 	domtrans_pattern($2, crontab_exec_t, $1_crontab_t)
+	allow $2 $1_crontab_t:fd use;
+
+	auth_domtrans_chk_passwd($1_crontab_t)
 
 	# crontab shows up in user ps
 	ps_process_pattern($2, $1_crontab_t)
@@ -206,9 +101,6 @@
 	# Allow crond to read those crontabs in cron spool.
 	allow crond_t $1_cron_spool_t:file manage_file_perms;
 
-	allow $1_crontab_t $1_crontab_tmp_t:file manage_file_perms;
-	files_tmp_filetrans($1_crontab_t, $1_crontab_tmp_t, file)
-
 	# create files in /var/spool/cron
 	manage_files_pattern($1_crontab_t, cron_spool_t, $1_cron_spool_t)
 	filetrans_pattern($1_crontab_t, cron_spool_t, $1_cron_spool_t,file)
@@ -227,27 +119,32 @@
 	# Run helper programs as the user domain
 	corecmd_bin_domtrans($1_crontab_t, $2)
 	corecmd_shell_domtrans($1_crontab_t, $2)
+	allow $2 $1_crontab_t:process sigchld;
 
 	domain_use_interactive_fds($1_crontab_t)
 
 	files_read_etc_files($1_crontab_t)
 	files_dontaudit_search_pids($1_crontab_t)
 
+	auth_use_nsswitch($1_crontab_t)
+
 	libs_use_ld_so($1_crontab_t)
 	libs_use_shared_libs($1_crontab_t)
 
 	logging_send_syslog_msg($1_crontab_t)
+	logging_send_audit_msgs($1_crontab_t)
 
 	miscfiles_read_localization($1_crontab_t)
 
 	seutil_read_config($1_crontab_t)
 
-	userdom_manage_user_tmp_dirs($1, $1_crontab_t)
-	userdom_manage_user_tmp_files($1, $1_crontab_t)
+	unprivuser_manage_tmp_dirs($1_crontab_t)
+	unprivuser_manage_tmp_files($1_crontab_t)
 	# Access terminals.
 	userdom_use_user_terminals($1, $1_crontab_t)
 	# Read user crontabs
 	userdom_read_user_home_content_files($1, $1_crontab_t)
+	userdom_transition_user_tmp($1, $1_crontab_t, { lnk_file file dir fifo_file })
 
 	tunable_policy(`fcron_crond',`
 		# fcron wants an instant update of a crontab change for the administrator
@@ -286,14 +183,12 @@
 template(`cron_admin_template',`
 	gen_require(`
 		attribute cron_spool_type;
-		type $1_crontab_t, $1_crond_t;
+		type $1_crontab_t;
 	')
 
 	# Allow our crontab domain to unlink a user cron spool file.
 	allow $1_crontab_t cron_spool_type:file { getattr read unlink };
 
-	logging_read_generic_logs($1_crond_t)
-
 	# Manipulate other users crontab.
 	selinux_get_fs_mount($1_crontab_t)
 	selinux_validate_context($1_crontab_t)
@@ -421,6 +316,24 @@
 
 ########################################
 ## <summary>
+##	Allow read/write unix stream sockets from the system cron jobs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cron_rw_system_stream_sockets',`
+	gen_require(`
+		type system_crond_t;
+	')
+
+	allow $1 system_crond_t:unix_stream_socket { read write };
+')
+
+########################################
+## <summary>
 ##	Read and write a cron daemon unnamed pipe.
 ## </summary>
 ## <param name="domain">
@@ -439,7 +352,7 @@
 
 ########################################
 ## <summary>
-##	Read, and write cron daemon TCP sockets.
+##	Read temporary files from cron.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -447,7 +360,26 @@
 ##	</summary>
 ## </param>
 #
-interface(`cron_rw_tcp_sockets',`
+interface(`cron_read_tmp_files',`
+	gen_require(`
+		type crond_tmp_t;
+	')
+
+	files_search_tmp($1)
+	allow $1 crond_tmp_t:file read_file_perms;
+')
+
+########################################
+## <summary>
+##	Dontaudit Read, and write cron daemon TCP sockets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cron_dontaudit_rw_tcp_sockets',`
 	gen_require(`
 		type crond_t;
 	')
@@ -559,11 +491,14 @@
 #
 interface(`cron_read_system_job_tmp_files',`
 	gen_require(`
-		type system_crond_tmp_t;
+		type system_crond_tmp_t, cron_var_run_t;
 	')
 
 	files_search_tmp($1)
 	allow $1 system_crond_tmp_t:file read_file_perms;
+
+	files_search_pids($1)
+	allow $1 cron_var_run_t:file read_file_perms;
 ')
 
 ########################################
@@ -584,3 +519,44 @@
 
 	dontaudit $1 system_crond_tmp_t:file append;
 ')
+
+
+########################################
+## <summary>
+##	Do not audit attempts to write temporary
+##	files from the system cron jobs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`cron_dontaudit_write_system_job_tmp_files',`
+	gen_require(`
+		type system_crond_tmp_t;
+		type system_crond_var_run_t;
+	')
+
+	dontaudit $1 system_crond_tmp_t:file write_file_perms;
+	dontaudit $1 cron_var_run_t:file write_file_perms;
+')
+
+########################################
+## <summary>
+##	Read temporary files from the system cron jobs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cron_read_system_job_lib_files',`
+	gen_require(`
+		type system_crond_var_lib_t;
+	')
+
+
+	read_files_pattern($1, system_crond_var_lib_t,  system_crond_var_lib_t)
+')
--- nsaserefpolicy/policy/modules/services/cron.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/cron.te	2008-08-14 13:53:54.000000000 -0400
@@ -12,14 +12,6 @@
 
 ## <desc>
 ## <p>
-## Allow system cron jobs to relabel filesystem
-## for restoring file contexts.
-## </p>
-## </desc>
-gen_tunable(cron_can_relabel, false)
-
-## <desc>
-## <p>
 ## Enable extra rules in the cron domain
 ## to support fcron.
 ## </p>
@@ -38,6 +30,10 @@
 type cron_var_lib_t;
 files_type(cron_var_lib_t)
 
+# var/lib files
+type cron_var_run_t;
+files_type(cron_var_run_t)
+
 # var/log files
 type cron_log_t;
 logging_log_file(cron_log_t)
@@ -50,6 +46,7 @@
 
 type crond_tmp_t;
 files_tmp_file(crond_tmp_t)
+files_poly_parent(crond_tmp_t)
 
 type crond_var_run_t;
 files_pid_file(crond_var_run_t)
@@ -71,6 +68,12 @@
 type system_crond_tmp_t;
 files_tmp_file(system_crond_tmp_t)
 
+type system_crond_var_lib_t;
+files_type(system_crond_var_lib_t)
+
+type system_crond_var_run_t;
+files_pid_file(system_crond_var_run_t)
+
 ifdef(`enable_mcs',`
 	init_ranged_daemon_domain(crond_t,crond_exec_t,s0 - mcs_systemhigh)
 ')
@@ -80,7 +83,7 @@
 # Cron Local policy
 #
 
-allow crond_t self:capability { dac_override setgid setuid sys_nice dac_read_search audit_control };
+allow crond_t self:capability { dac_override setgid setuid sys_nice dac_read_search };
 dontaudit crond_t self:capability { sys_resource sys_tty_config };
 allow crond_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 allow crond_t self:process { setexec setfscreate };
@@ -99,15 +102,14 @@
 allow crond_t crond_var_run_t:file manage_file_perms;
 files_pid_filetrans(crond_t,crond_var_run_t,file)
 
-allow crond_t cron_spool_t:dir rw_dir_perms;
-allow crond_t cron_spool_t:file read_file_perms;
+manage_files_pattern(crond_t, cron_spool_t, cron_spool_t)
 
 manage_dirs_pattern(crond_t, crond_tmp_t, crond_tmp_t)
 manage_files_pattern(crond_t, crond_tmp_t, crond_tmp_t)
 files_tmp_filetrans(crond_t, crond_tmp_t, { file dir })
 
-allow crond_t system_cron_spool_t:dir list_dir_perms;
-allow crond_t system_cron_spool_t:file read_file_perms;
+list_dirs_pattern(crond_t, system_cron_spool_t, system_cron_spool_t)
+read_files_pattern(crond_t, system_cron_spool_t, system_cron_spool_t)
 
 kernel_read_kernel_sysctls(crond_t)
 kernel_search_key(crond_t)
@@ -133,6 +135,8 @@
 corecmd_read_bin_symlinks(crond_t)
 
 domain_use_interactive_fds(crond_t)
+domain_subj_id_change_exemption(crond_t)
+domain_role_change_exemption(crond_t)
 
 files_read_etc_files(crond_t)
 files_read_generic_spool(crond_t)
@@ -142,13 +146,16 @@
 files_search_default(crond_t)
 
 init_rw_utmp(crond_t)
+init_spec_domtrans_script(crond_t)
 
 auth_use_nsswitch(crond_t)
 
 libs_use_ld_so(crond_t)
 libs_use_shared_libs(crond_t)
 
+logging_send_audit_msgs(crond_t)
 logging_send_syslog_msg(crond_t)
+logging_set_loginuid(crond_t)
 
 seutil_read_config(crond_t)
 seutil_read_default_contexts(crond_t)
@@ -180,21 +187,45 @@
 	')
 ')
 
+tunable_policy(`allow_polyinstantiation',`
+	allow crond_t self:capability fowner;
+	files_search_tmp(crond_t)
+	files_polyinstantiate_all(crond_t)
+')
+
+optional_policy(`
+	apache_search_sys_content(crond_t)
+')
+
 optional_policy(`
 	locallogin_search_keys(crond_t)
 	locallogin_link_keys(crond_t)
 ')
 
+optional_policy(`
+	# these should probably be unconfined_crond_t
+	init_dbus_send_script(crond_t)
+')
+
+optional_policy(`
+	mono_domtrans(crond_t)
+')
+
 tunable_policy(`fcron_crond', `
 	allow crond_t system_cron_spool_t:file manage_file_perms;
 ')
 
 optional_policy(`
+	amanda_search_var_lib(crond_t)
+')
+
+optional_policy(`
 	amavis_search_lib(crond_t)
 ')
 
 optional_policy(`
-	hal_dbus_send(crond_t)
+	hal_dbus_chat(crond_t)
+	hal_dbus_chat(system_crond_t)
 ')
 
 optional_policy(`
@@ -236,6 +267,9 @@
 allow system_crond_t cron_var_lib_t:file manage_file_perms;
 files_var_lib_filetrans(system_crond_t, cron_var_lib_t, file)
 
+allow system_crond_t cron_var_run_t:file manage_file_perms;
+files_pid_filetrans(system_crond_t, cron_var_run_t, file)
+
 allow system_crond_t system_cron_spool_t:file read_file_perms;
 # The entrypoint interface is not used as this is not
 # a regular entrypoint.  Since crontab files are
@@ -267,9 +301,13 @@
 filetrans_pattern(system_crond_t, crond_tmp_t, system_crond_tmp_t, { file lnk_file })
 files_tmp_filetrans(system_crond_t, system_crond_tmp_t, file)
 
+# var/lib files for system_crond
+files_search_var_lib(system_crond_t)
+manage_files_pattern(system_crond_t, system_crond_var_lib_t, system_crond_var_lib_t)
+
 # Read from /var/spool/cron.
 allow system_crond_t cron_spool_t:dir list_dir_perms;
-allow system_crond_t cron_spool_t:file read_file_perms;
+allow system_crond_t cron_spool_t:file rw_file_perms;
 
 kernel_read_kernel_sysctls(system_crond_t)
 kernel_read_system_state(system_crond_t)
@@ -323,7 +361,8 @@
 init_read_utmp(system_crond_t)
 init_dontaudit_rw_utmp(system_crond_t)
 # prelink tells init to restart it self, we either need to allow or dontaudit
-init_write_initctl(system_crond_t)
+init_telinit(system_crond_t)
+init_spec_domtrans_script(system_crond_t)
 
 auth_use_nsswitch(system_crond_t)
 
@@ -333,6 +372,7 @@
 libs_exec_ld_so(system_crond_t)
 
 logging_read_generic_logs(system_crond_t)
+logging_send_audit_msgs(system_crond_t)
 logging_send_syslog_msg(system_crond_t)
 
 miscfiles_read_localization(system_crond_t)
@@ -348,18 +388,6 @@
 	')
 ')
 
-tunable_policy(`cron_can_relabel',`
-	seutil_domtrans_setfiles(system_crond_t)
-',`
-	selinux_get_fs_mount(system_crond_t)
-	selinux_validate_context(system_crond_t)
-	selinux_compute_access_vector(system_crond_t)
-	selinux_compute_create_context(system_crond_t)
-	selinux_compute_relabel_context(system_crond_t)
-	selinux_compute_user_contexts(system_crond_t)
-	seutil_read_file_contexts(system_crond_t)
-')
-
 optional_policy(`
 	# Needed for certwatch
 	apache_exec_modules(system_crond_t)
@@ -383,6 +411,14 @@
 ')
 
 optional_policy(`
+	lpd_list_spool(system_crond_t)
+')
+
+optional_policy(`
+	mono_domtrans(system_crond_t)
+')
+
+optional_policy(`
 	mrtg_append_create_logs(system_crond_t)
 ')
 
@@ -415,8 +451,7 @@
 ')
 
 optional_policy(`
-	# cjp: why?
-	squid_domtrans(system_crond_t)
+	spamassassin_manage_lib_files(system_crond_t)
 ')
 
 optional_policy(`
@@ -424,15 +459,12 @@
 ')
 
 optional_policy(`
+	unconfined_dbus_send(crond_t)
+	unconfined_shell_domtrans(crond_t)
+	unconfined_domain(crond_t)
 	unconfined_domain(system_crond_t)
-
-	userdom_priveleged_home_dir_manager(system_crond_t)
 ')
 
-ifdef(`TODO',`
-ifdef(`mta.te', `
-allow system_crond_t mail_spool_t:lnk_file read;
-allow mta_user_agent system_crond_t:fd use;
-r_dir_file(system_mail_t, crond_tmp_t)
+optional_policy(`
+	userdom_priveleged_home_dir_manager(system_crond_t)
 ')
-') dnl end TODO
