--- nsaserefpolicy/policy/modules/services/spamassassin.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/spamassassin.fc	2008-08-14 13:53:54.000000000 -0400
@@ -1,16 +1,22 @@
-HOME_DIR/\.spamassassin(/.*)?	gen_context(system_u:object_r:ROLE_spamassassin_home_t,s0)
+HOME_DIR/\.spamassassin(/.*)?	gen_context(system_u:object_r:spamc_home_t,s0)
 
 /usr/bin/sa-learn	--	gen_context(system_u:object_r:spamc_exec_t,s0)
-/usr/bin/spamassassin	--	gen_context(system_u:object_r:spamassassin_exec_t,s0)
+/usr/bin/spamassassin	--	gen_context(system_u:object_r:spamc_exec_t,s0)
 /usr/bin/spamc		--	gen_context(system_u:object_r:spamc_exec_t,s0)
 /usr/bin/spamd		--	gen_context(system_u:object_r:spamd_exec_t,s0)
 
 /usr/sbin/spamd		--	gen_context(system_u:object_r:spamd_exec_t,s0)
+/usr/sbin/spamass-milter --	gen_context(system_u:object_r:spamd_exec_t,s0)
 
 /var/lib/spamassassin(/.*)?	gen_context(system_u:object_r:spamd_var_lib_t,s0)
 
+/var/log/spamd\.log	--	gen_context(system_u:object_r:spamd_log_t,s0)
+
 /var/run/spamassassin(/.*)?	gen_context(system_u:object_r:spamd_var_run_t,s0)
-/var/run/spamass-milter(/.*)?	gen_context(system_u:object_r:spamd_var_run_t,s0)
+/var/run/spamass-milter.*	gen_context(system_u:object_r:spamd_var_run_t,s0)
+/var/spool/milter-regex(/.*)?	gen_context(system_u:object_r:spamd_var_run_t,s0)
 
 /var/spool/spamassassin(/.*)?	gen_context(system_u:object_r:spamd_spool_t,s0)
 /var/spool/spamd(/.*)?		gen_context(system_u:object_r:spamd_spool_t,s0)
+
+/etc/rc.d/init.d/spamd	--	gen_context(system_u:object_r:spamd_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/spamassassin.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/spamassassin.if	2008-08-14 13:53:54.000000000 -0400
@@ -34,10 +34,10 @@
 # cjp: when tunables are available, spamc stuff should be
 # toggled on activation of spamc, and similarly for spamd.
 template(`spamassassin_per_role_template',`
-
 	gen_require(`
 		type spamc_exec_t, spamassassin_exec_t;
-		type spamd_t, spamd_tmp_t;
+		type spamc_t, spamd_t, spamassassin_t, spamd_tmp_t;
+		type spamc_home_t, spamc_tmp_t;
 	')
 
 	##############################
@@ -45,278 +45,24 @@
 	# Declarations
 	#
 
-	type $1_spamc_t;
-	application_domain($1_spamc_t, spamc_exec_t)
-	role $3 types $1_spamc_t;
-
-	type $1_spamc_tmp_t;
-	files_tmp_file($1_spamc_tmp_t)
-
-	type $1_spamassassin_t;
-	application_domain($1_spamassassin_t, spamassassin_exec_t)
-	role $3 types $1_spamassassin_t;
-
-	type $1_spamassassin_home_t alias $1_spamassassin_rw_t;
-	userdom_user_home_content($1, $1_spamassassin_home_t)
-	files_poly_member($1_spamassassin_home_t)
-
-	type $1_spamassassin_tmp_t;
-	files_tmp_file($1_spamassassin_tmp_t)
-
-	##############################
-	#
-	# $1_spamc_t local policy
-	#
-
-	allow $1_spamc_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
-	allow $1_spamc_t self:fd use;
-	allow $1_spamc_t self:fifo_file rw_fifo_file_perms;
-	allow $1_spamc_t self:sock_file read_sock_file_perms;
-	allow $1_spamc_t self:shm create_shm_perms;
-	allow $1_spamc_t self:sem create_sem_perms;
-	allow $1_spamc_t self:msgq create_msgq_perms;
-	allow $1_spamc_t self:msg { send receive };
-	allow $1_spamc_t self:unix_dgram_socket create_socket_perms;
-	allow $1_spamc_t self:unix_stream_socket create_stream_socket_perms;
-	allow $1_spamc_t self:unix_dgram_socket sendto;
-	allow $1_spamc_t self:unix_stream_socket connectto;
-	allow $1_spamc_t self:tcp_socket create_stream_socket_perms;
-	allow $1_spamc_t self:udp_socket create_socket_perms;
-
-	manage_dirs_pattern($1_spamc_t, $1_spamc_tmp_t, $1_spamc_tmp_t)
-	manage_files_pattern($1_spamc_t, $1_spamc_tmp_t, $1_spamc_tmp_t)
-	files_tmp_filetrans($1_spamc_t, $1_spamc_tmp_t, { file dir })
-
-	# Allow connecting to a local spamd
-	allow $1_spamc_t spamd_t:unix_stream_socket connectto;
-	allow $1_spamc_t spamd_tmp_t:sock_file rw_file_perms;
-
-	domtrans_pattern($2, spamc_exec_t, $1_spamc_t)
-
-	kernel_read_kernel_sysctls($1_spamc_t)
-
-	corenet_all_recvfrom_unlabeled($1_spamc_t)
-	corenet_all_recvfrom_netlabel($1_spamc_t)
-	corenet_tcp_sendrecv_generic_if($1_spamc_t)
-	corenet_udp_sendrecv_generic_if($1_spamc_t)
-	corenet_tcp_sendrecv_all_nodes($1_spamc_t)
-	corenet_udp_sendrecv_all_nodes($1_spamc_t)
-	corenet_tcp_sendrecv_all_ports($1_spamc_t)
-	corenet_udp_sendrecv_all_ports($1_spamc_t)
-	corenet_tcp_connect_all_ports($1_spamc_t)
-	corenet_sendrecv_all_client_packets($1_spamc_t)
-
-	fs_search_auto_mountpoints($1_spamc_t)
-
-	# cjp: these should probably be removed:
-	corecmd_list_bin($1_spamc_t)
-	corecmd_read_bin_symlinks($1_spamc_t)
-	corecmd_read_bin_files($1_spamc_t)
-	corecmd_read_bin_pipes($1_spamc_t)
-	corecmd_read_bin_sockets($1_spamc_t)
-
-	domain_use_interactive_fds($1_spamc_t)
-
-	files_read_etc_files($1_spamc_t)
-	files_read_etc_runtime_files($1_spamc_t)
-	files_read_usr_files($1_spamc_t)
-	files_dontaudit_search_var($1_spamc_t)
-	# cjp: this may be removable:
-	files_list_home($1_spamc_t)
-
-	libs_use_ld_so($1_spamc_t)
-	libs_use_shared_libs($1_spamc_t)
-
-	logging_send_syslog_msg($1_spamc_t)
-
-	miscfiles_read_localization($1_spamc_t)
-
-	# cjp: this should probably be removed:
-	seutil_read_config($1_spamc_t)
-
-	sysnet_read_config($1_spamc_t)
-
-	userdom_use_unpriv_users_fds($1_spamc_t)
-	# cjp: this really should just be the
-	# terminal specific to the role
-	userdom_use_unpriv_users_ptys($1_spamc_t)
-
-	# cjp: this should probably be removed:
-	tunable_policy(`read_default_t',`
-		files_list_default($1_spamc_t)
-		files_read_default_files($1_spamc_t)
-		files_read_default_symlinks($1_spamc_t)
-		files_read_default_sockets($1_spamc_t)
-		files_read_default_pipes($1_spamc_t)
-	')
-
-	optional_policy(`
-		# Allow connection to spamd socket above
-		evolution_stream_connect($1, $1_spamc_t)
-	')
-
-	optional_policy(`
-		nis_use_ypbind($1_spamc_t)
-	')
-
-	optional_policy(`
-		nscd_socket_use($1_spamc_t)
-	')
-
-	optional_policy(`
-		mta_read_config($1_spamc_t)
-		sendmail_stub($1_spamc_t)
-	')
-
-	##############################
-	#
-	# $1_spamassassin_t local policy
-	#
-
-	allow $1_spamassassin_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
-	allow $1_spamassassin_t self:fd use;
-	allow $1_spamassassin_t self:fifo_file rw_fifo_file_perms;
-	allow $1_spamassassin_t self:sock_file read_sock_file_perms;
-	allow $1_spamassassin_t self:unix_dgram_socket create_socket_perms;
-	allow $1_spamassassin_t self:unix_stream_socket create_stream_socket_perms;
-	allow $1_spamassassin_t self:unix_dgram_socket sendto;
-	allow $1_spamassassin_t self:unix_stream_socket connectto;
-	allow $1_spamassassin_t self:shm create_shm_perms;
-	allow $1_spamassassin_t self:sem create_sem_perms;
-	allow $1_spamassassin_t self:msgq create_msgq_perms;
-	allow $1_spamassassin_t self:msg { send receive };
-
-	manage_dirs_pattern($1_spamassassin_t, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	manage_files_pattern($1_spamassassin_t, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	manage_lnk_files_pattern($1_spamassassin_t, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	manage_fifo_files_pattern($1_spamassassin_t, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	manage_sock_files_pattern($1_spamassassin_t, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	userdom_user_home_dir_filetrans($1,$1_spamassassin_t,$1_spamassassin_home_t, { dir file lnk_file sock_file fifo_file })
-
-	manage_dirs_pattern($1_spamassassin_t, $1_spamassassin_tmp_t, $1_spamassassin_tmp_t)
-	manage_files_pattern($1_spamassassin_t, $1_spamassassin_tmp_t, $1_spamassassin_tmp_t)
-	files_tmp_filetrans($1_spamassassin_t, $1_spamassassin_tmp_t, { file dir })
-
-	manage_dirs_pattern($2, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	manage_files_pattern($2, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	manage_lnk_files_pattern($2, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	relabel_dirs_pattern($2, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	relabel_files_pattern($2, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	relabel_lnk_files_pattern($2, $1_spamassassin_home_t, $1_spamassassin_home_t)
-
-	domtrans_pattern($2, spamassassin_exec_t, $1_spamassassin_t)
-
-	manage_dirs_pattern(spamd_t, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	manage_files_pattern(spamd_t, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	manage_lnk_files_pattern(spamd_t, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	manage_fifo_files_pattern(spamd_t, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	manage_sock_files_pattern(spamd_t, $1_spamassassin_home_t, $1_spamassassin_home_t)
-	userdom_user_home_dir_filetrans($1, spamd_t, $1_spamassassin_home_t, { dir file lnk_file sock_file fifo_file })
-
-	kernel_read_kernel_sysctls($1_spamassassin_t)
-
-	dev_read_urand($1_spamassassin_t)
-
-	fs_search_auto_mountpoints($1_spamassassin_t)
-
-	# this should probably be removed
-	corecmd_list_bin($1_spamassassin_t)
-	corecmd_read_bin_symlinks($1_spamassassin_t)
-	corecmd_read_bin_files($1_spamassassin_t)
-	corecmd_read_bin_pipes($1_spamassassin_t)
-	corecmd_read_bin_sockets($1_spamassassin_t)
-
-	domain_use_interactive_fds($1_spamassassin_t)
-
-	files_read_etc_files($1_spamassassin_t)
-	files_read_etc_runtime_files($1_spamassassin_t)
-	files_list_home($1_spamassassin_t)
-	files_read_usr_files($1_spamassassin_t)
-	files_dontaudit_search_var($1_spamassassin_t)
-
-	libs_use_ld_so($1_spamassassin_t)
-	libs_use_shared_libs($1_spamassassin_t)
-
-	logging_send_syslog_msg($1_spamassassin_t)
-
-	miscfiles_read_localization($1_spamassassin_t)
-
-	# cjp: this could probably be removed
-	seutil_read_config($1_spamassassin_t)
-
-	sysnet_dns_name_resolve($1_spamassassin_t)
+	typealias  spamc_t alias $1_spamc_t;
+	role $3 types spamc_t;
 
-	userdom_use_unpriv_users_fds($1_spamassassin_t)
-	userdom_search_user_home_dirs($1,$1_spamassassin_t)
-	# cjp: this really should just be the
-	# terminal specific to the role
-	userdom_use_unpriv_users_ptys($1_spamassassin_t)
+	typealias  spamassassin_t alias $1_spamassassin_t;
+	role $3 types spamassassin_t;
 
-	# this should probably be removed:
-	tunable_policy(`read_default_t',`
-		files_list_default($1_spamassassin_t)
-		files_read_default_files($1_spamassassin_t)
-		files_read_default_symlinks($1_spamassassin_t)
-		files_read_default_sockets($1_spamassassin_t)
-		files_read_default_pipes($1_spamassassin_t)
-	')
-
-	# set tunable if you have spamassassin do DNS lookups
-	tunable_policy(`spamassassin_can_network',`
-		allow $1_spamassassin_t self:tcp_socket create_stream_socket_perms;
-		allow $1_spamassassin_t self:udp_socket create_socket_perms;
-
-		corenet_all_recvfrom_unlabeled($1_spamassassin_t)
-		corenet_all_recvfrom_netlabel($1_spamassassin_t)
-		corenet_tcp_sendrecv_generic_if($1_spamassassin_t)
-		corenet_udp_sendrecv_generic_if($1_spamassassin_t)
-		corenet_tcp_sendrecv_all_nodes($1_spamassassin_t)
-		corenet_udp_sendrecv_all_nodes($1_spamassassin_t)
-		corenet_tcp_sendrecv_all_ports($1_spamassassin_t)
-		corenet_udp_sendrecv_all_ports($1_spamassassin_t)
-		corenet_tcp_connect_all_ports($1_spamassassin_t)
-		corenet_sendrecv_all_client_packets($1_spamassassin_t)
-
-		sysnet_read_config($1_spamassassin_t)
-	')
-
-	tunable_policy(`spamd_enable_home_dirs',`
-		userdom_manage_user_home_content_dirs($1,spamd_t)
-		userdom_manage_user_home_content_files($1,spamd_t)
-		userdom_manage_user_home_content_symlinks($1,spamd_t)
-	')
+	typealias spamc_home_t alias $1_spamassassin_home_t;
+	typealias spamc_tmp_t alias $1_spamassassin_tmp_t;
+	typealias spamc_tmp_t alias $1_spamc_tmp_t;
+
+	manage_dirs_pattern($2, spamc_home_t, spamc_home_t)
+	manage_files_pattern($2, spamc_home_t, spamc_home_t)
+	manage_lnk_files_pattern($2, spamc_home_t, spamc_home_t)
+	relabel_dirs_pattern($2, spamc_home_t, spamc_home_t)
+	relabel_files_pattern($2, spamc_home_t, spamc_home_t)
+	relabel_lnk_files_pattern($2, spamc_home_t, spamc_home_t)
 
-	tunable_policy(`use_nfs_home_dirs',`
-		fs_manage_nfs_dirs($1_spamassassin_t)
-		fs_manage_nfs_files($1_spamassassin_t)
-		fs_manage_nfs_symlinks($1_spamassassin_t)
-	')
-
-	tunable_policy(`use_samba_home_dirs',`
-		fs_manage_cifs_dirs($1_spamassassin_t)
-		fs_manage_cifs_files($1_spamassassin_t)
-		fs_manage_cifs_symlinks($1_spamassassin_t)
-	')
-
-	optional_policy(`
-		# Write pid file and socket in ~/.evolution/cache/tmp
-		evolution_home_filetrans($1, spamd_t, spamd_tmp_t, { file sock_file })
-	')
-
-	optional_policy(`
-		# cjp: clearly some redundancy here
-
-		nis_use_ypbind($1_spamassassin_t)
-
-		tunable_policy(`spamassassin_can_network && allow_ypbind',`
-			nis_use_ypbind_uncond($1_spamassassin_t)
-		')
-	')
-
-	optional_policy(`
-		mta_read_config($1_spamassassin_t)
-		sendmail_stub($1_spamassassin_t)
-	')
+	domtrans_pattern($2, spamc_exec_t, spamc_t)
 ')
 
 ########################################
@@ -332,10 +78,10 @@
 #
 interface(`spamassassin_exec',`
 	gen_require(`
-		type spamassassin_exec_t;
+		type spamc_exec_t;
 	')
 
-	can_exec($1, spamassassin_exec_t)
+	can_exec($1, spamc_exec_t)
 
 ')
 
@@ -398,11 +144,66 @@
 ## </param>
 #
 template(`spamassassin_domtrans_user_client',`
+	spamassassin_domtrans_spamc($2)
+')
+
+########################################
+## <summary>
+##      Execute spamassassin client in the spamassassin client domain.
+## </summary>
+## <desc>
+##	<p>
+##	This is a template and should only be called 
+##	from per user domain tempaltes.
+##	</p>
+## </desc>
+## <param name="domain">
+##      <summary>
+##      The type of the process performing this action.
+##      </summary>
+## </param>
+#
+interface(`spamassassin_domtrans_spamc',`
+	gen_require(`
+		type spamc_t, spamc_exec_t;
+	')
+
+	domtrans_pattern($1, spamc_exec_t, spamc_t)
+	allow $1 spamc_exec_t:file ioctl;
+')
+
+########################################
+## <summary>
+##	Read spamassassin per user homedir
+## </summary>
+## <desc>
+##	<p>
+##	Read spamassassin per user homedir
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`spamassassin_read_user_home_files',`
 	gen_require(`
-		type $1_spamc_t, spamc_exec_t;
+		type spamassassin_home_t;
 	')
 
-	domtrans_pattern($2, spamc_exec_t, $1_spamc_t)
+	allow $1 spamassassin_home_t:dir list_dir_perms;
+	allow $1 spamassassin_home_t:file read_file_perms;
 ')
 
 ########################################
@@ -446,11 +247,27 @@
 ## </param>
 #
 template(`spamassassin_domtrans_user_local_client',`
-	gen_require(`
-		type $1_spamassassin_t, spamassassin_exec_t;
+	spamassassin_domtrans($2)
 	')
 
-	domtrans_pattern($2, spamassassin_exec_t, $1_spamassassin_t)
+########################################
+## <summary>
+##      Execute spamassassin in the user spamassassin domain.
+## </summary>
+## <desc>
+##	<p>
+##	This is a template and should only be called 
+##	from per user domain tempaltes.
+##	</p>
+## </desc>
+## <param name="domain">
+##      <summary>
+##      The type of the process performing this action.
+##      </summary>
+## </param>
+#
+interface(`spamassassin_domtrans',`
+	spamassassin_domtrans_spamc($1)
 ')
 
 ########################################
@@ -469,6 +286,7 @@
 	')
 
 	files_search_var_lib($1)
+	list_dirs_pattern($1, spamd_var_lib_t, spamd_var_lib_t)
 	read_files_pattern($1, spamd_var_lib_t, spamd_var_lib_t)
 ')
 
@@ -528,3 +346,133 @@
 
 	dontaudit $1 spamd_tmp_t:sock_file getattr;
 ')
+
+########################################
+## <summary>
+##	Connect to run spamd.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to connect.
+##	</summary>
+## </param>
+#
+interface(`spamd_stream_connect',`
+	gen_require(`
+		type spamd_t, spamd_var_run_t;
+	')
+
+	stream_connect_pattern($1, spamd_var_run_t, spamd_var_run_t, spamd_t)
+')
+
+
+########################################
+## <summary>
+##	Execute spamassassin server in the spamassassin domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`spamassassin_spamd_script_domtrans',`
+	gen_require(`
+		type spamd_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, spamd_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an spamassassin environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the spamassassin domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`spamassassin_spamd_admin',`
+	gen_require(`
+		type spamd_t;
+		type spamd_script_exec_t;
+		type spamd_tmp_t;
+		type spamd_log_t;
+		type spamd_spool_t;
+		type spamd_var_lib_t;
+		type spamd_var_run_t;
+	')
+
+	allow $1 spamd_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, spamd_t, spamd_t)
+	        
+	# Allow spamd_t to restart the apache service
+	spamassassin_spamd_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 spamd_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_tmp($1)
+        admin_pattern($1, spamd_tmp_t)
+
+	logging_list_logs($1)
+        admin_pattern($1, spamd_log_t)
+
+	files_list_spool($1)
+	admin_pattern($1, spamd_spool_t)
+
+	files_list_var_lib($1)
+        admin_pattern($1, spamd_var_lib_t)
+
+	files_list_pids($1)
+        admin_pattern($1, spamd_var_run_t)
+')
+
+########################################
+## <summary>
+##	Read spamassassin per user homedir
+## </summary>
+## <desc>
+##	<p>
+##	Read spamassassin per user homedir
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`spamassassin_manage_user_home_files',`
+	gen_require(`
+		type spamc_home_t;
+	')
+
+	manage_files_pattern($1, spamc_home_t, spamc_home_t)
+	razor_manage_user_home_files(user, $1)
+')
--- nsaserefpolicy/policy/modules/services/spamassassin.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/spamassassin.te	2008-08-14 13:53:54.000000000 -0400
@@ -21,8 +21,10 @@
 gen_tunable(spamd_enable_home_dirs, true)
 
 # spamassassin client executable
+type spamc_t;
 type spamc_exec_t;
-application_executable_file(spamc_exec_t)
+application_domain(spamc_t, spamc_exec_t)
+role system_r types spamc_t;
 
 type spamd_t;
 type spamd_exec_t;
@@ -31,6 +33,9 @@
 type spamd_spool_t;
 files_type(spamd_spool_t)
 
+type spamd_log_t;
+logging_log_file(spamd_log_t)
+
 type spamd_tmp_t;
 files_tmp_file(spamd_tmp_t)
 
@@ -41,8 +46,23 @@
 type spamd_var_run_t;
 files_pid_file(spamd_var_run_t)
 
-type spamassassin_exec_t;
-application_executable_file(spamassassin_exec_t)
+type spamd_script_exec_t;
+init_script_type(spamd_script_exec_t)
+
+type spamd_etc_t;
+files_config_file(spamd_etc_t)
+
+typealias spamc_exec_t  alias spamassassin_exec_t;
+typealias spamc_t alias spamassassin_t;
+
+type spamc_home_t;
+userdom_user_home_content(user, spamc_home_t)
+typealias spamc_home_t alias spamassassin_home_t;
+typealias spamc_home_t alias user_spamassassin_home_t;
+
+type spamc_tmp_t;
+files_tmp_file(spamc_tmp_t)
+typealias spamc_tmp_t alias spamassassin_tmp_t;
 
 ########################################
 #
@@ -53,7 +73,7 @@
 # setuids to the user running spamc.  Comment this if you are not
 # using this ability.
 
-allow spamd_t self:capability { setuid setgid dac_override sys_tty_config };
+allow spamd_t self:capability { kill setuid setgid dac_override sys_tty_config };
 dontaudit spamd_t self:capability sys_tty_config;
 allow spamd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 allow spamd_t self:fd use;
@@ -69,7 +89,9 @@
 allow spamd_t self:unix_stream_socket connectto;
 allow spamd_t self:tcp_socket create_stream_socket_perms;
 allow spamd_t self:udp_socket create_socket_perms;
-allow spamd_t self:netlink_route_socket r_netlink_socket_perms;
+
+manage_files_pattern(spamd_t, spamd_log_t, spamd_log_t)
+logging_log_filetrans(spamd_t, spamd_log_t, file)
 
 manage_dirs_pattern(spamd_t, spamd_spool_t, spamd_spool_t)
 manage_files_pattern(spamd_t, spamd_spool_t, spamd_spool_t)
@@ -81,10 +103,11 @@
 
 # var/lib files for spamd
 allow spamd_t spamd_var_lib_t:dir list_dir_perms;
-read_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t)
+manage_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t)
 
 manage_dirs_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
 manage_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
+manage_sock_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
 files_pid_filetrans(spamd_t, spamd_var_run_t, { dir file })
 
 kernel_read_all_sysctls(spamd_t)
@@ -134,6 +157,8 @@
 
 init_dontaudit_rw_utmp(spamd_t)
 
+auth_use_nsswitch(spamd_t)
+
 libs_use_ld_so(spamd_t)
 libs_use_shared_libs(spamd_t)
 
@@ -141,20 +166,40 @@
 
 miscfiles_read_localization(spamd_t)
 
-sysnet_read_config(spamd_t)
-sysnet_use_ldap(spamd_t)
-sysnet_dns_name_resolve(spamd_t)
-
 userdom_use_unpriv_users_fds(spamd_t)
 userdom_search_unpriv_users_home_dirs(spamd_t)
-
 sysadm_dontaudit_search_home_dirs(spamd_t)
 
+manage_dirs_pattern(spamd_t, spamc_home_t, spamc_home_t)
+manage_files_pattern(spamd_t, spamc_home_t, spamc_home_t)
+manage_lnk_files_pattern(spamd_t, spamc_home_t, spamc_home_t)
+manage_fifo_files_pattern(spamd_t, spamc_home_t, spamc_home_t)
+manage_sock_files_pattern(spamd_t, spamc_home_t, spamc_home_t)
+userdom_user_home_dir_filetrans(user, spamd_t, spamc_home_t, { dir file lnk_file sock_file fifo_file })
+
+optional_policy(`
+	# Write pid file and socket in ~/.evolution/cache/tmp
+	evolution_home_filetrans(user, spamd_t, spamd_tmp_t, { file sock_file })
+')
+
+optional_policy(`
+	exim_manage_spool_dirs(spamd_t)
+	exim_manage_spool_files(spamd_t)
+')
+
+tunable_policy(`spamd_enable_home_dirs',`
+	unprivuser_manage_home_content_dirs(spamd_t)
+	unprivuser_manage_home_content_files(spamd_t)
+	unprivuser_manage_home_content_symlinks(spamd_t)
+')
+
 tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_dirs(spamd_t)
 	fs_manage_nfs_files(spamd_t)
 ')
 
 tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_dirs(spamd_t)
 	fs_manage_cifs_files(spamd_t)
 ')
 
@@ -172,6 +217,7 @@
 
 optional_policy(`
 	dcc_domtrans_client(spamd_t)
+	dcc_signal_client(spamd_t)
 	dcc_stream_connect_dccifd(spamd_t)
 ')
 
@@ -181,10 +227,6 @@
 ')
 
 optional_policy(`
-	nis_use_ypbind(spamd_t)
-')
-
-optional_policy(`
 	postfix_read_config(spamd_t)
 ')
 
@@ -199,6 +241,10 @@
 
 optional_policy(`
 	razor_domtrans(spamd_t)
+	razor_read_lib_files(spamd_t)
+	tunable_policy(`spamd_enable_home_dirs',`
+		razor_manage_user_home_files(user, spamd_t)
+	')
 ')
 
 optional_policy(`
@@ -213,3 +259,121 @@
 optional_policy(`
 	udev_read_db(spamd_t)
 ')
+
+##############################
+#
+# spamc_t local policy
+#
+
+allow spamc_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
+allow spamc_t self:fd use;
+allow spamc_t self:fifo_file rw_fifo_file_perms;
+allow spamc_t self:sock_file read_sock_file_perms;
+allow spamc_t self:unix_dgram_socket create_socket_perms;
+allow spamc_t self:unix_stream_socket create_stream_socket_perms;
+allow spamc_t self:unix_dgram_socket sendto;
+allow spamc_t self:unix_stream_socket connectto;
+allow spamc_t self:shm create_shm_perms;
+allow spamc_t self:sem create_sem_perms;
+allow spamc_t self:msgq create_msgq_perms;
+allow spamc_t self:msg { send receive };
+allow spamc_t self:tcp_socket create_stream_socket_perms;
+allow spamc_t self:udp_socket create_socket_perms;
+
+# Allow connecting to a local spamd
+allow spamc_t spamd_t:unix_stream_socket connectto;
+allow spamc_t spamd_tmp_t:sock_file rw_file_perms;
+
+manage_dirs_pattern(spamc_t, spamc_home_t, spamc_home_t)
+manage_files_pattern(spamc_t, spamc_home_t, spamc_home_t)
+manage_lnk_files_pattern(spamc_t, spamc_home_t, spamc_home_t)
+manage_fifo_files_pattern(spamc_t, spamc_home_t, spamc_home_t)
+manage_sock_files_pattern(spamc_t, spamc_home_t, spamc_home_t)
+userdom_user_home_dir_filetrans($1, spamc_t, spamc_home_t, { dir file lnk_file sock_file fifo_file })
+
+manage_dirs_pattern(spamc_t, spamc_tmp_t, spamc_tmp_t)
+manage_files_pattern(spamc_t, spamc_tmp_t, spamc_tmp_t)
+files_tmp_filetrans(spamc_t, spamc_tmp_t, { file dir })
+
+kernel_read_kernel_sysctls(spamc_t)
+kernel_read_system_state(spamc_t)
+
+dev_read_urand(spamc_t)
+
+files_list_var_lib(spamc_t)
+read_files_pattern(spamc_t, spamd_var_lib_t, spamd_var_lib_t)
+
+fs_search_auto_mountpoints(spamc_t)
+
+domain_use_interactive_fds(spamc_t)
+
+files_read_etc_files(spamc_t)
+files_read_etc_runtime_files(spamc_t)
+files_read_usr_files(spamc_t)
+files_list_home(spamc_t)
+files_read_usr_files(spamc_t)
+files_dontaudit_search_var(spamc_t)
+
+auth_use_nsswitch(spamc_t)
+
+libs_use_ld_so(spamc_t)
+libs_use_shared_libs(spamc_t)
+
+logging_send_syslog_msg(spamc_t)
+
+miscfiles_read_localization(spamc_t)
+
+# cjp: this really should just be the
+# terminal specific to the role
+userdom_use_unpriv_users_ptys(spamc_t)
+
+userdom_use_unpriv_users_fds(spamc_t)
+userdom_search_user_home_dirs(user, spamc_t)
+userdom_list_user_files(user, spamc_t)
+# cjp: this really should just be the
+# terminal specific to the role
+userdom_use_unpriv_users_ptys(spamc_t)
+
+# set tunable if you have spamc do DNS lookups
+tunable_policy(`spamassassin_can_network',`
+	allow spamc_t self:tcp_socket create_stream_socket_perms;
+	allow spamc_t self:udp_socket create_socket_perms;
+
+	corenet_all_recvfrom_unlabeled(spamc_t)
+	corenet_all_recvfrom_netlabel(spamc_t)
+	corenet_tcp_sendrecv_generic_if(spamc_t)
+	corenet_udp_sendrecv_generic_if(spamc_t)
+	corenet_tcp_sendrecv_all_nodes(spamc_t)
+	corenet_udp_sendrecv_all_nodes(spamc_t)
+	corenet_tcp_sendrecv_all_ports(spamc_t)
+	corenet_udp_sendrecv_all_ports(spamc_t)
+	corenet_tcp_connect_all_ports(spamc_t)
+	corenet_sendrecv_all_client_packets(spamc_t)
+	corenet_udp_bind_generic_port(spamc_t)
+
+	sysnet_read_config(spamc_t)
+')
+
+tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_dirs(spamc_t)
+	fs_manage_nfs_files(spamc_t)
+	fs_manage_nfs_symlinks(spamc_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_dirs(spamc_t)
+	fs_manage_cifs_files(spamc_t)
+	fs_manage_cifs_symlinks(spamc_t)
+')
+
+optional_policy(`
+	# Allow connection to spamd socket above
+	evolution_stream_connect(user, spamc_t)
+')
+
+optional_policy(`
+	mta_read_config(spamc_t)
+	mta_read_queue(spamc_t)
+	sendmail_stub(spamc_t)
+	sendmail_rw_pipes(spamc_t)
+')
