--- nsaserefpolicy/policy/modules/services/prelude.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/prelude.fc	2008-08-14 13:53:54.000000000 -0400
@@ -5,7 +5,16 @@
 
 /var/lib/prelude-lml(/.*)?		gen_context(system_u:object_r:prelude_var_lib_t,s0)
 
+/var/log/prelude.*			gen_context(system_u:object_r:prelude_log_t,s0)
+
 /var/run/prelude-manager(/.*)?		gen_context(system_u:object_r:prelude_var_run_t,s0)
 
 /var/spool/prelude-manager(/.*)?	gen_context(system_u:object_r:prelude_spool_t,s0)
 /var/spool/prelude(/.*)?		gen_context(system_u:object_r:prelude_spool_t,s0)
+
+/usr/bin/prelude-lml   --      gen_context(system_u:object_r:prelude_lml_exec_t,s0)
+/var/run/prelude-lml.pid       --      gen_context(system_u:object_r:prelude_lml_var_run_t,s0)
+
+/etc/rc\.d/init\.d/prelude-lml --      gen_context(system_u:object_r:prelude_lml_script_exec_t,s0)
+/etc/rc\.d/init\.d/prelude-manager	--	gen_context(system_u:object_r:prelude_script_exec_t,s0)
+
--- nsaserefpolicy/policy/modules/services/prelude.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/prelude.if	2008-08-14 13:53:54.000000000 -0400
@@ -6,7 +6,7 @@
 ## </summary>
 ## <param name="domain">
 ## <summary>
-##	Domain allowed to transition.
+##	Domain allowed access.
 ## </summary>
 ## </param>
 #
@@ -42,7 +42,7 @@
 ## </summary>
 ## <param name="domain">
 ## <summary>
-##	Domain allowed acccess.
+##	Domain allowed to transition.
 ## </summary>
 ## </param>
 #
@@ -56,6 +56,81 @@
 
 ########################################
 ## <summary>
+##	Read the prelude spool files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`prelude_read_spool',`
+	gen_require(`
+		type prelude_spool_t;
+	')
+
+	files_search_spool($1)
+	read_files_pattern($1, prelude_spool_t, prelude_spool_t)
+')
+
+########################################
+## <summary>
+##	Read/Write to prelude-manager spool files.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`prelude_rw_spool',`
+	gen_require(`
+		type prelude_spool_t;
+	')
+
+	files_search_spool($1)
+	list_dirs_pattern($1, prelude_spool_t, prelude_spool_t)
+	rw_files_pattern($1, prelude_spool_t, prelude_spool_t)
+')
+
+########################################
+## <summary>
+##	Execute prelude server in the prelude domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`prelude_script_domtrans',`
+	gen_require(`
+		type prelude_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, prelude_script_exec_t)
+')
+
+########################################
+## <summary>
+##	Execute prelude lml server in the prelude lml domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`prelude_lml_script_domtrans',`
+	gen_require(`
+		type prelude_lml_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, prelude_lml_script_exec_t)
+')
+
+########################################
+## <summary>
 ##	All of the rules required to administrate 
 ##	an prelude environment
 ## </summary>
@@ -64,6 +139,16 @@
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the syslog domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
 ## <rolecap/>
 #
 interface(`prelude_admin',`
@@ -71,6 +156,11 @@
 		type prelude_t, prelude_spool_t;
 		type prelude_var_run_t, prelude_var_lib_t;
 		type prelude_audisp_t, prelude_audisp_var_run_t;
+		type prelude_script_exec_t;
+
+		type prelude_lml_t, prelude_lml_tmp_t;
+		type prelude_lml_var_run_t;
+		type prelude_lml_script_exec_t;
 	')
 
 	allow $1 prelude_t:process { ptrace signal_perms };
@@ -79,11 +169,23 @@
 	allow $1 prelude_audisp_t:process { ptrace signal_perms };
 	ps_process_pattern($1, prelude_audisp_t)
 
-	manage_files_pattern($1, prelude_spool_t, prelude_spool_t)
-
-	manage_files_pattern($1, prelude_var_lib_t, prelude_var_lib_t)
-
-	manage_files_pattern($1, prelude_var_run_t, prelude_var_run_t)
+	allow $1 prelude_lml_t:process { ptrace signal_perms };
+	ps_process_pattern($1, prelude_lml_t)
 
-	manage_files_pattern($1, prelude_audisp_var_run_t, prelude_audisp_var_run_t)
+	# Allow prelude_t to restart the apache service
+	prelude_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 prelude_script_exec_t system_r;
+	allow $2 system_r;
+
+	# Allow prelude_t to restart the apache service
+	prelude_lml_script_domtrans($1)
+	role_transition $2 prelude_lml_script_exec_t system_r;
+
+        admin_pattern($1, prelude_spool_t)
+        admin_pattern($1, prelude_var_lib_t)
+        admin_pattern($1, prelude_var_run_t)
+	admin_pattern($1, prelude_audisp_var_run_t)
+        admin_pattern($1, prelude_lml_tmp_t)
+        admin_pattern($1, prelude_lml_var_run_t)
 ')
--- nsaserefpolicy/policy/modules/services/prelude.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/prelude.te	2008-08-14 13:53:54.000000000 -0400
@@ -13,18 +13,40 @@
 type prelude_spool_t;
 files_type(prelude_spool_t)
 
+type prelude_log_t;
+logging_log_file(prelude_log_t)
+
 type prelude_var_run_t;
 files_pid_file(prelude_var_run_t)
 
 type prelude_var_lib_t;
 files_type(prelude_var_lib_t)
 
+type prelude_script_exec_t;
+init_script_type(prelude_script_exec_t)
+
 type prelude_audisp_t;
 type prelude_audisp_exec_t;
 init_daemon_domain(prelude_audisp_t, prelude_audisp_exec_t)
+typealias prelude_audisp_t alias audisp_prelude_t;
+typealias prelude_audisp_exec_t alias audisp_prelude_exec_t;
 
 type prelude_audisp_var_run_t;
 files_pid_file(prelude_audisp_var_run_t)
+typealias prelude_audisp_var_run_t alias audisp_prelude_var_run_t;
+
+type prelude_lml_t;
+type prelude_lml_exec_t;
+init_daemon_domain(prelude_lml_t, prelude_lml_exec_t)
+
+type prelude_lml_script_exec_t;
+init_script_type(prelude_lml_script_exec_t)
+
+type prelude_lml_var_run_t;
+files_pid_file(prelude_lml_var_run_t)
+
+type prelude_lml_tmp_t;
+files_tmp_file(prelude_lml_tmp_t)
 
 ########################################
 #
@@ -49,6 +71,9 @@
 manage_sock_files_pattern(prelude_t, prelude_var_run_t, prelude_var_run_t)
 files_pid_filetrans(prelude_t, prelude_var_run_t, file)
 
+manage_files_pattern(prelude_t, prelude_log_t, prelude_log_t)
+logging_log_filetrans(prelude_t, prelude_log_t, file)
+
 corecmd_search_bin(prelude_t)
 
 corenet_all_recvfrom_unlabeled(prelude_t)
@@ -56,6 +81,8 @@
 corenet_tcp_sendrecv_all_if(prelude_t)
 corenet_tcp_sendrecv_all_nodes(prelude_t)
 corenet_tcp_bind_all_nodes(prelude_t)
+corenet_tcp_bind_prelude_port(prelude_t)
+corenet_tcp_connect_prelude_port(prelude_t)
 
 dev_read_rand(prelude_t)
 dev_read_urand(prelude_t)
@@ -66,6 +93,8 @@
 files_read_etc_files(prelude_t)
 files_read_usr_files(prelude_t)
 
+fs_rw_anon_inodefs_files(prelude_t)
+
 auth_use_nsswitch(prelude_t)
 
 libs_use_ld_so(prelude_t)
@@ -110,6 +139,7 @@
 corenet_tcp_sendrecv_all_if(prelude_audisp_t)
 corenet_tcp_sendrecv_all_nodes(prelude_audisp_t)
 corenet_tcp_bind_all_nodes(prelude_audisp_t)
+corenet_tcp_connect_prelude_port(prelude_audisp_t)
 
 dev_read_rand(prelude_audisp_t)
 dev_read_urand(prelude_audisp_t)
@@ -123,9 +153,84 @@
 libs_use_shared_libs(prelude_audisp_t)
 
 logging_send_syslog_msg(prelude_audisp_t)
+logging_audisp_system_domain(prelude_audisp_t, prelude_audisp_exec_t)
 
 miscfiles_read_localization(prelude_audisp_t)
 
+sysnet_dns_name_resolve(prelude_audisp_t)
+
+########################################
+#
+# prelude_lml local declarations
+#
+
+# Init script handling
+# Test me
+domain_use_interactive_fds(prelude_lml_t)
+
+allow prelude_lml_t self:tcp_socket { write getattr setopt read create connect };
+allow prelude_lml_t self:unix_dgram_socket { write create connect };
+allow prelude_lml_t self:fifo_file rw_fifo_file_perms;
+allow prelude_lml_t self:unix_stream_socket connectto;
+
+files_list_tmp(prelude_lml_t)
+manage_dirs_pattern(prelude_lml_t, prelude_lml_tmp_t, prelude_lml_tmp_t)
+manage_files_pattern(prelude_lml_t, prelude_lml_tmp_t, prelude_lml_tmp_t)
+files_tmp_filetrans(prelude_lml_t, prelude_lml_tmp_t, { file dir })
+
+files_search_spool(prelude_lml_t)
+manage_dirs_pattern(prelude_lml_t, prelude_spool_t, prelude_spool_t)
+manage_files_pattern(prelude_lml_t, prelude_spool_t, prelude_spool_t)
+
+files_search_var_lib(prelude_lml_t)
+manage_dirs_pattern(prelude_lml_t, prelude_var_lib_t, prelude_var_lib_t)
+manage_files_pattern(prelude_lml_t, prelude_var_lib_t, prelude_var_lib_t)
+
+manage_files_pattern(prelude_lml_t, prelude_lml_var_run_t, prelude_lml_var_run_t)
+files_pid_filetrans(prelude_lml_t, prelude_lml_var_run_t, file)
+
+corecmd_search_bin(prelude_lml_t)
+
+corenet_tcp_sendrecv_generic_if(prelude_lml_t)
+corenet_tcp_sendrecv_all_nodes(prelude_lml_t)
+corenet_tcp_recvfrom_netlabel(prelude_lml_t)
+corenet_tcp_recvfrom_unlabeled(prelude_lml_t)
+corenet_sendrecv_unlabeled_packets(prelude_lml_t)
+corenet_tcp_connect_prelude_port(prelude_lml_t)
+
+dev_read_rand(prelude_lml_t)
+dev_read_urand(prelude_lml_t)
+
+files_list_etc(prelude_lml_t)
+files_read_etc_files(prelude_lml_t)
+files_read_etc_runtime_files(prelude_lml_t)
+
+files_search_spool(prelude_lml_t)
+files_search_usr(prelude_lml_t)
+files_search_var_lib(prelude_lml_t)
+
+fs_list_inotifyfs(prelude_lml_t)
+
+auth_use_nsswitch(prelude_lml_t)
+
+libs_use_ld_so(prelude_lml_t)
+libs_use_shared_libs(prelude_lml_t)
+libs_exec_lib_files(prelude_lml_t)
+libs_read_lib_files(prelude_lml_t)
+
+logging_send_syslog_msg(prelude_lml_t)
+logging_read_generic_logs(prelude_lml_t)
+
+miscfiles_read_localization(prelude_lml_t)
+
+optional_policy(`
+	gamin_exec(prelude_lml_t)
+')
+
+optional_policy(`
+	apache_read_log(prelude_lml_t)
+')
+
 ########################################
 #
 # prewikka_cgi Declarations
@@ -135,6 +240,12 @@
 	apache_content_template(prewikka)
 	files_read_etc_files(httpd_prewikka_script_t)
 
+	auth_use_nsswitch(httpd_prewikka_script_t)
+
+	logging_send_syslog_msg(httpd_prewikka_script_t)
+
+	can_exec(httpd_prewikka_script_t, httpd_prewikka_script_exec_t)
+
 	optional_policy(`
 		mysql_search_db(httpd_prewikka_script_t)
 		mysql_stream_connect(httpd_prewikka_script_t)
