--- nsaserefpolicy/policy/modules/services/dnsmasq.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/dnsmasq.fc	2008-08-14 13:53:54.000000000 -0400
@@ -1,4 +1,7 @@
 /usr/sbin/dnsmasq		--	gen_context(system_u:object_r:dnsmasq_exec_t,s0)
 
 /var/lib/misc/dnsmasq\.leases	--	gen_context(system_u:object_r:dnsmasq_lease_t,s0)
+/var/lib/dnsmasq(/.*)?		gen_context(system_u:object_r:dnsmasq_lease_t,s0)
 /var/run/dnsmasq\.pid		--	gen_context(system_u:object_r:dnsmasq_var_run_t,s0)
+
+/etc/rc.d/init.d/dnsmasq	--	gen_context(system_u:object_r:dnsmasq_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/dnsmasq.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/dnsmasq.if	2008-08-14 13:53:54.000000000 -0400
@@ -1 +1,125 @@
 ## <summary>dnsmasq DNS forwarder and DHCP server</summary>
+
+########################################
+## <summary>
+##	Execute dnsmasq server in the dnsmasq domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`dnsmasq_domtrans',`
+	gen_require(`
+		type dnsmasq_exec_t;
+		type dnsmasq_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, dnsmasq_exec_t, dnsmasq_t)
+')
+
+########################################
+## <summary>
+##	Execute dnsmasq server in the dnsmasq domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`dnsmasq_script_domtrans',`
+	gen_require(`
+		type dnsmasq_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, dnsmasq_script_exec_t)
+')
+
+########################################
+## <summary>
+##	Send dnsmasq a signal
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`dnsmasq_signal',`
+	gen_require(`
+		type dnsmasq_t;
+	')
+
+	allow $1 dnsmasq_t:process signal;
+')
+
+########################################
+## <summary>
+##	Send dnsmasq a sigkill
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`dnsmasq_sigkill',`
+	gen_require(`
+		type dnsmasq_t;
+	')
+
+	allow $1 dnsmasq_t:process sigkill;
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an dnsmasq environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the dnsmasq domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`dnsmasq_admin',`
+	gen_require(`
+		type dnsmasq_t;
+		type dnsmasq_script_exec_t;
+		type dnsmasq_lease_t;
+		type dnsmasq_var_run_t;
+	')
+
+	allow $1 dnsmasq_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, dnsmasq_t, dnsmasq_t)
+	        
+	# Allow dnsmasq_t to restart the apache service
+	dnsmasq_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 dnsmasq_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_var_lib($1)
+        admin_pattern($1, dnsmasq_lease_t)
+
+	files_list_pids($1)
+        admin_pattern($1, dnsmasq_var_run_t)
+')
--- nsaserefpolicy/policy/modules/services/dnsmasq.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/dnsmasq.te	2008-08-14 13:53:54.000000000 -0400
@@ -16,6 +16,9 @@
 type dnsmasq_var_run_t;
 files_pid_file(dnsmasq_var_run_t)
 
+type dnsmasq_script_exec_t;
+init_script_type(dnsmasq_script_exec_t)
+
 ########################################
 #
 # Local policy
@@ -23,7 +26,7 @@
 
 allow dnsmasq_t self:capability { net_admin setgid setuid net_bind_service net_raw };
 dontaudit dnsmasq_t self:capability sys_tty_config;
-allow dnsmasq_t self:process { setcap signal_perms };
+allow dnsmasq_t self:process { getcap setcap signal_perms };
 allow dnsmasq_t self:fifo_file { read write };
 allow dnsmasq_t self:netlink_route_socket { bind create nlmsg_read read write };
 allow dnsmasq_t self:tcp_socket create_stream_socket_perms;
@@ -32,7 +35,7 @@
 allow dnsmasq_t self:rawip_socket create_socket_perms;
 
 # dhcp leases
-allow dnsmasq_t dnsmasq_lease_t:file manage_file_perms;
+manage_files_pattern(dnsmasq_t, dnsmasq_lease_t,  dnsmasq_lease_t)
 files_var_lib_filetrans(dnsmasq_t,dnsmasq_lease_t,file)
 
 manage_files_pattern(dnsmasq_t, dnsmasq_var_run_t, dnsmasq_var_run_t)
@@ -56,7 +59,7 @@
 corenet_udp_bind_all_nodes(dnsmasq_t)
 corenet_tcp_bind_dns_port(dnsmasq_t)
 corenet_udp_bind_dns_port(dnsmasq_t)
-corenet_udp_bind_dhcpd_port(dnsmasq_t)
+corenet_udp_bind_all_ports(dnsmasq_t)
 corenet_sendrecv_dns_server_packets(dnsmasq_t)
 corenet_sendrecv_dhcpd_server_packets(dnsmasq_t)
 
@@ -95,3 +98,7 @@
 optional_policy(`
 	udev_read_db(dnsmasq_t)
 ')
+
+optional_policy(`
+	virt_manage_lib_files(dnsmasq_t)
+')
