--- nsaserefpolicy/policy/modules/services/networkmanager.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/networkmanager.fc	2008-08-14 13:53:54.000000000 -0400
@@ -1,7 +1,13 @@
 /usr/s?bin/NetworkManager	--	gen_context(system_u:object_r:NetworkManager_exec_t,s0)
 /usr/s?bin/wpa_supplicant	--	gen_context(system_u:object_r:NetworkManager_exec_t,s0)
+/usr/sbin/NetworkManagerDispatcher	--	gen_context(system_u:object_r:NetworkManager_exec_t,s0)
+/usr/sbin/nm-system-settings	--	gen_context(system_u:object_r:NetworkManager_exec_t,s0)
 
 /var/run/NetworkManager\.pid	--	gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
 /var/run/NetworkManager(/.*)?		gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
 /var/run/wpa_supplicant(/.*)?		gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
 /var/run/wpa_supplicant-global	-s	gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
+/var/run/nm-dhclient.*			gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
+
+/var/log/wpa_supplicant\.log.*	--	gen_context(system_u:object_r:NetworkManager_log_t,s0)
+/etc/NetworkManager/dispatcher.d(/.*)	gen_context(system_u:object_r:NetworkManager_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/networkmanager.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/networkmanager.if	2008-08-14 13:53:54.000000000 -0400
@@ -97,3 +97,58 @@
 	allow $1 NetworkManager_t:dbus send_msg;
 	allow NetworkManager_t $1:dbus send_msg;
 ')
+
+########################################
+## <summary>
+##	Send a generic signal to NetworkManager
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`networkmanager_signal',`
+	gen_require(`
+		type NetworkManager_t;
+	')
+
+	allow $1 NetworkManager_t:process signal;
+')
+
+########################################
+## <summary>
+##	Execute NetworkManager scripts with an automatic domain transition to initrc.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`networkmanager_init_script_domtrans_spec',`
+	gen_require(`
+		type NetworkManager_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, NetworkManager_script_exec_t)
+')
+
+########################################
+## <summary>
+##	Read NetworkManager PID files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`networkmanager_read_pid_files',`
+	gen_require(`
+		type NetworkManager_var_run_t;
+	')
+
+	files_search_pids($1)
+	allow $1 NetworkManager_var_run_t:file read_file_perms;
+')
--- nsaserefpolicy/policy/modules/services/networkmanager.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/networkmanager.te	2008-08-14 13:53:54.000000000 -0400
@@ -10,9 +10,16 @@
 type NetworkManager_exec_t;
 init_daemon_domain(NetworkManager_t, NetworkManager_exec_t)
 
+type NetworkManager_log_t;
+logging_log_file(NetworkManager_log_t)
+
 type NetworkManager_var_run_t;
 files_pid_file(NetworkManager_var_run_t)
 
+type NetworkManager_script_exec_t;
+init_script_type(NetworkManager_script_exec_t)
+init_script_domtrans_spec(NetworkManager_t, NetworkManager_script_exec_t)
+
 ########################################
 #
 # Local policy
@@ -20,9 +27,9 @@
 
 # networkmanager will ptrace itself if gdb is installed
 # and it receives a unexpected signal (rh bug #204161) 
-allow NetworkManager_t self:capability { kill setgid setuid dac_override net_admin net_raw net_bind_service ipc_lock };
+allow NetworkManager_t self:capability { chown fsetid kill setgid setuid sys_nice dac_override net_admin net_raw net_bind_service ipc_lock };
 dontaudit NetworkManager_t self:capability { sys_tty_config sys_ptrace };
-allow NetworkManager_t self:process { ptrace setcap setpgid getsched signal_perms };
+allow NetworkManager_t self:process { ptrace getcap setcap setpgid getsched setsched signal_perms };
 allow NetworkManager_t self:fifo_file rw_fifo_file_perms;
 allow NetworkManager_t self:unix_dgram_socket { sendto create_socket_perms };
 allow NetworkManager_t self:unix_stream_socket create_stream_socket_perms;
@@ -38,10 +45,14 @@
 manage_sock_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
 files_pid_filetrans(NetworkManager_t,NetworkManager_var_run_t, { dir file sock_file })
 
+manage_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_t)
+logging_log_filetrans(NetworkManager_t, NetworkManager_log_t, file)
+
 kernel_read_system_state(NetworkManager_t)
 kernel_read_network_state(NetworkManager_t)
 kernel_read_kernel_sysctls(NetworkManager_t)
 kernel_load_module(NetworkManager_t)
+kernel_read_debugfs(NetworkManager_t)
 
 corenet_all_recvfrom_unlabeled(NetworkManager_t)
 corenet_all_recvfrom_netlabel(NetworkManager_t)
@@ -64,9 +75,11 @@
 dev_read_sysfs(NetworkManager_t)
 dev_read_rand(NetworkManager_t)
 dev_read_urand(NetworkManager_t)
+dev_dontaudit_getattr_generic_blk_files(NetworkManager_t)
 
 fs_getattr_all_fs(NetworkManager_t)
 fs_search_auto_mountpoints(NetworkManager_t)
+fs_list_inotifyfs(NetworkManager_t)
 
 mls_file_read_all_levels(NetworkManager_t)
 
@@ -82,10 +95,16 @@
 files_read_etc_files(NetworkManager_t)
 files_read_etc_runtime_files(NetworkManager_t)
 files_read_usr_files(NetworkManager_t)
+files_list_tmp(NetworkManager_t)
+
+storage_getattr_fixed_disk_dev(NetworkManager_t)
 
 init_read_utmp(NetworkManager_t)
+init_dontaudit_write_utmp(NetworkManager_t)
 init_domtrans_script(NetworkManager_t)
 
+auth_use_nsswitch(NetworkManager_t)
+
 libs_use_ld_so(NetworkManager_t)
 libs_use_shared_libs(NetworkManager_t)
 
@@ -112,9 +131,12 @@
 userdom_dontaudit_use_unpriv_users_ttys(NetworkManager_t)
 # Read gnome-keyring
 userdom_read_unpriv_users_home_content_files(NetworkManager_t)
+unprivuser_stream_connect(NetworkManager_t)
 
 sysadm_dontaudit_search_home_dirs(NetworkManager_t)
 
+cron_read_system_job_lib_files(NetworkManager_t)
+
 optional_policy(`
 	bind_domtrans(NetworkManager_t)
 	bind_manage_cache(NetworkManager_t)
@@ -130,21 +152,21 @@
 ')
 
 optional_policy(`
-	dbus_system_bus_client_template(NetworkManager, NetworkManager_t)
-	dbus_connect_system_bus(NetworkManager_t)
+	dbus_system_domain(NetworkManager_t, NetworkManager_exec_t)
 ')
 
 optional_policy(`
-	howl_signal(NetworkManager_t)
+	hal_write_log(NetworkManager_t)
 ')
 
 optional_policy(`
-	nis_use_ypbind(NetworkManager_t)
+	howl_signal(NetworkManager_t)
 ')
 
 optional_policy(`
-	nscd_socket_use(NetworkManager_t)
 	nscd_signal(NetworkManager_t)
+	nscd_script_domtrans(NetworkManager_t)
+	nscd_domtrans(NetworkManager_t)
 ')
 
 optional_policy(`
@@ -156,19 +178,26 @@
 	ppp_domtrans(NetworkManager_t)
 	ppp_read_pid_files(NetworkManager_t)
 	ppp_signal(NetworkManager_t)
+	ppp_signull(NetworkManager_t)
+	ppp_read_config(NetworkManager_t)
 ')
 
 optional_policy(`
-	seutil_sigchld_newrole(NetworkManager_t)
+	# Dispatcher starting and stoping ntp
+	ntp_script_domtrans(NetworkManager_t)
 ')
 
 optional_policy(`
-	udev_read_db(NetworkManager_t)
+	rpm_read_db(NetworkManager_t)
+	rpm_dontaudit_manage_db(NetworkManager_t)
 ')
 
 optional_policy(`
-	# Read gnome-keyring
-	unconfined_read_home_content_files(NetworkManager_t)
+	seutil_sigchld_newrole(NetworkManager_t)
+')
+
+optional_policy(`
+	udev_read_db(NetworkManager_t)
 ')
 
 optional_policy(`
