--- nsaserefpolicy/policy/modules/services/ntp.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/ntp.fc	2008-08-25 10:50:15.000000000 -0400
@@ -17,3 +17,8 @@
 /var/log/xntpd.*		--	gen_context(system_u:object_r:ntpd_log_t,s0)
 
 /var/run/ntpd\.pid		--	gen_context(system_u:object_r:ntpd_var_run_t,s0)
+
+/etc/ntp/crypto(/.*)?         gen_context(system_u:object_r:ntpd_key_t,s0)
+/etc/ntp/keys              -- gen_context(system_u:object_r:ntpd_key_t,s0)
+
+/etc/rc\.d/init\.d/ntpd	--	gen_context(system_u:object_r:ntpd_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/ntp.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/ntp.if	2008-08-25 10:50:15.000000000 -0400
@@ -53,3 +53,72 @@
 	corecmd_search_bin($1)
 	domtrans_pattern($1, ntpdate_exec_t, ntpd_t)
 ')
+
+########################################
+## <summary>
+##	Execute ntp server in the ntpd domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`ntp_script_domtrans',`
+	gen_require(`
+		type ntpd_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, ntpd_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an ntp environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the ntp domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`ntp_admin',`
+	gen_require(`
+		type ntp_t, ntp_tmp_t, ntp_log_t;
+		type ntp_key_t, ntp_var_lib_t, ntp_var_run_t;
+		type ntp_script_exec_t;
+	')
+
+	allow $1 ntp_t:process { ptrace signal_perms getattr };
+	ps_process_pattern($1, ntp_t)
+	        
+	# Allow ntp_t to restart the apache service
+	ntp_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 ntp_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_tmp($1)
+        admin_pattern($1, ntp_tmp_t)
+
+	logging_list_logs($1)
+        admin_pattern($1, ntp_log_t)
+
+	admin_pattern($1, ntp_key_t)
+
+	files_list_pids($1)
+        admin_pattern($1, ntp_var_run_t)
+')
+
--- nsaserefpolicy/policy/modules/services/ntp.te	2008-08-25 09:12:31.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/ntp.te	2008-08-25 11:45:10.000000000 -0400
@@ -25,6 +25,12 @@
 type ntpdate_exec_t;
 init_system_domain(ntpd_t, ntpdate_exec_t)
 
+type ntpd_key_t;
+files_type(ntpd_key_t)
+
+type ntpd_script_exec_t;
+init_script_type(ntpd_script_exec_t)
+
 ########################################
 #
 # Local policy
@@ -34,8 +40,9 @@
 # ntpdate wants sys_nice
 allow ntpd_t self:capability { chown dac_override kill setgid setuid sys_time ipc_lock sys_chroot sys_nice sys_resource };
 dontaudit ntpd_t self:capability { net_admin sys_tty_config fsetid sys_nice };
-allow ntpd_t self:process { signal_perms setcap setsched setrlimit };
+allow ntpd_t self:process { signal_perms getcap setcap setsched setrlimit };
 allow ntpd_t self:fifo_file { read write getattr };
+allow ntpd_t self:shm create_shm_perms;
 allow ntpd_t self:unix_dgram_socket create_socket_perms;
 allow ntpd_t self:unix_stream_socket create_socket_perms;
 allow ntpd_t self:tcp_socket create_stream_socket_perms;
@@ -49,6 +56,8 @@
 manage_files_pattern(ntpd_t,ntpd_log_t,ntpd_log_t)
 logging_log_filetrans(ntpd_t,ntpd_log_t,{ file dir })
 
+read_files_pattern(ntpd_t, ntpd_key_t, ntpd_key_t)
+
 # for some reason it creates a file in /tmp
 manage_dirs_pattern(ntpd_t, ntpd_tmp_t, ntpd_tmp_t)
 manage_files_pattern(ntpd_t, ntpd_tmp_t, ntpd_tmp_t)
@@ -82,6 +91,8 @@
 
 fs_getattr_all_fs(ntpd_t)
 fs_search_auto_mountpoints(ntpd_t)
+# Necessary to communicate with gpsd devices
+fs_rw_tmpfs_files(ntpd_t)
 
 auth_use_nsswitch(ntpd_t)
 
@@ -105,9 +116,15 @@
 
 miscfiles_read_localization(ntpd_t)
 
-userdom_dontaudit_use_unpriv_user_fds(ntpd_t)
+sysnet_dontaudit_dhcpc_use_fds(ntpd_t)
+
+term_use_ptmx(ntpd_t)
 
+userdom_dontaudit_use_unpriv_user_fds(ntpd_t)
 sysadm_list_home_dirs(ntpd_t)
+sysadm_dontaudit_list_home_dirs(ntpd_t)
+unprivuser_dontaudit_append_home_content_files(ntpd_t)
+unprivuser_dontaudit_read_home_content_files(ntpd_t)
 
 optional_policy(`
 	# for cron jobs
@@ -121,6 +138,10 @@
 ')
 
 optional_policy(`
+	hal_dontaudit_write_log(ntpd_t)
+')
+
+optional_policy(`
 	logrotate_exec(ntpd_t)
 ')
 
