--- nsaserefpolicy/policy/modules/services/fail2ban.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/fail2ban.fc	2008-08-14 13:53:54.000000000 -0400
@@ -1,3 +1,7 @@
 /usr/bin/fail2ban	--	gen_context(system_u:object_r:fail2ban_exec_t,s0)
+/usr/bin/fail2ban-server --	gen_context(system_u:object_r:fail2ban_exec_t,s0)
 /var/log/fail2ban\.log	--	gen_context(system_u:object_r:fail2ban_log_t,s0)
 /var/run/fail2ban\.pid	--	gen_context(system_u:object_r:fail2ban_var_run_t,s0)
+/var/run/fail2ban\.sock	-s	gen_context(system_u:object_r:fail2ban_var_run_t,s0)
+/etc/rc.d/init.d/fail2ban	--	gen_context(system_u:object_r:fail2ban_script_exec_t,s0)
+
--- nsaserefpolicy/policy/modules/services/fail2ban.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/fail2ban.if	2008-08-14 14:33:00.000000000 -0400
@@ -78,3 +78,67 @@
 	files_search_pids($1)
 	allow $1 fail2ban_var_run_t:file read_file_perms;
 ')
+
+########################################
+## <summary>
+##	Execute fail2ban server in the fail2ban domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`fail2ban_script_domtrans',`
+	gen_require(`
+		type fail2ban_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, fail2ban_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an fail2ban environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the fail2ban domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`fail2ban_admin',`
+	gen_require(`
+		type fail2ban_t, fail2ban_log_t;
+		type fail2ban_var_run_t;
+		type fail2ban_script_exec_t;
+	')
+
+	allow $1 fail2ban_t:process { ptrace signal_perms };
+	ps_process_pattern($1, fail2ban_t)
+	        
+	# Allow fail2ban_t to restart the apache service
+	fail2ban_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 fail2ban_script_exec_t system_r;
+	allow $2 system_r;
+
+	logging_list_logs($1)
+        admin_pattern($1, fail2ban_log_t)
+
+	files_list_pids($1)
+        admin_pattern($1, fail2ban_var_run_t)
+')
--- nsaserefpolicy/policy/modules/services/fail2ban.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/fail2ban.te	2008-08-14 14:37:05.000000000 -0400
@@ -18,6 +18,9 @@
 type fail2ban_var_run_t;
 files_pid_file(fail2ban_var_run_t)
 
+type fail2ban_script_exec_t;
+init_script_type(fail2ban_script_exec_t)
+
 ########################################
 #
 # fail2ban local policy
@@ -25,7 +28,8 @@
 
 allow fail2ban_t self:process signal;
 allow fail2ban_t self:fifo_file rw_fifo_file_perms;
-allow fail2ban_t self:unix_stream_socket create_stream_socket_perms;
+allow fail2ban_t self:unix_stream_socket { connectto create_stream_socket_perms };
+allow fail2ban_t self:tcp_socket create_stream_socket_perms;
 
 # log files
 allow fail2ban_t fail2ban_log_t:dir setattr;
@@ -33,8 +37,9 @@
 logging_log_filetrans(fail2ban_t, fail2ban_log_t, file)
 
 # pid file
+manage_sock_files_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t)
 manage_files_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t)
-files_pid_filetrans(fail2ban_t, fail2ban_var_run_t, file)
+files_pid_filetrans(fail2ban_t, fail2ban_var_run_t, { file sock_file })
 
 kernel_read_system_state(fail2ban_t)
 
@@ -46,15 +51,32 @@
 domain_use_interactive_fds(fail2ban_t)
 
 files_read_etc_files(fail2ban_t)
+files_read_etc_runtime_files(fail2ban_t)
 files_read_usr_files(fail2ban_t)
+files_list_var(fail2ban_t)
+files_search_var_lib(fail2ban_t)
+
+fs_list_inotifyfs(fail2ban_t)
+fs_getattr_all_fs(fail2ban_t)
+
+corenet_all_recvfrom_unlabeled(fail2ban_t)
+corenet_all_recvfrom_netlabel(fail2ban_t)
+corenet_tcp_sendrecv_generic_if(fail2ban_t)
+corenet_tcp_sendrecv_all_nodes(fail2ban_t)
+corenet_tcp_sendrecv_all_ports(fail2ban_t)
+corenet_tcp_connect_whois_port(fail2ban_t)
+
+auth_use_nsswitch(fail2ban_t)
 
 libs_use_ld_so(fail2ban_t)
 libs_use_shared_libs(fail2ban_t)
 
-logging_read_generic_logs(fail2ban_t)
+logging_read_all_logs(fail2ban_t)
 
 miscfiles_read_localization(fail2ban_t)
 
+mta_send_mail(fail2ban_t)
+
 optional_policy(`
 	apache_read_log(fail2ban_t)
 ')
@@ -64,5 +86,9 @@
 ')
 
 optional_policy(`
+	gamin_exec(fail2ban_t)
+')
+
+optional_policy(`
 	iptables_domtrans(fail2ban_t)
 ')
