--- nsaserefpolicy/policy/modules/system/modutils.if	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/modutils.if	2008-08-14 13:53:54.000000000 -0400
@@ -66,6 +66,25 @@
 
 ########################################
 ## <summary>
+##	Unlink a file with the configuration options used when
+##	loading modules.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`modutils_unlink_module_config',`
+	gen_require(`
+		type modules_conf_t;
+	')
+
+	allow $1 modules_conf_t:file unlink;
+')
+
+########################################
+## <summary>
 ##	Unconditionally execute insmod in the insmod domain.
 ## </summary>
 ## <param name="domain">
@@ -275,6 +294,7 @@
 	modutils_domtrans_update_mods($1)
 	role $2 types update_modules_t;
 	allow update_modules_t $3:chr_file rw_term_perms;
+	modutils_run_insmod(update_modules_t, $2, $3)
 ')
 
 ########################################
--- nsaserefpolicy/policy/modules/system/modutils.te	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/modutils.te	2008-08-14 13:53:54.000000000 -0400
@@ -22,6 +22,8 @@
 type insmod_exec_t;
 application_domain(insmod_t,insmod_exec_t)
 mls_file_write_all_levels(insmod_t)
+mls_process_write_to_clearance(insmod_t)
+
 role system_r types insmod_t;
 
 type depmod_t;
@@ -42,7 +44,7 @@
 # insmod local policy
 #
 
-allow insmod_t self:capability { dac_override net_raw sys_tty_config };
+allow insmod_t self:capability { dac_override mknod net_raw sys_nice sys_tty_config };
 allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
 
 allow insmod_t self:udp_socket create_socket_perms; 
@@ -55,6 +57,7 @@
 
 kernel_load_module(insmod_t)
 kernel_read_system_state(insmod_t)
+kernel_read_network_state(insmod_t)
 kernel_write_proc_files(insmod_t)
 kernel_mount_debugfs(insmod_t)
 kernel_mount_kvmfs(insmod_t)
@@ -63,6 +66,7 @@
 kernel_read_kernel_sysctls(insmod_t)
 kernel_rw_kernel_sysctl(insmod_t)
 kernel_read_hotplug_sysctls(insmod_t)
+kernel_setsched(insmod_t)
 
 files_read_kernel_modules(insmod_t)
 # for locking: (cjp: ????)
@@ -76,9 +80,7 @@
 dev_read_sound(insmod_t)
 dev_write_sound(insmod_t)
 dev_rw_apm_bios(insmod_t)
-# cjp: why is this needed?  insmod cannot mounton any dir
-# and it also transitions to mount
-dev_mount_usbfs(insmod_t)
+dev_create_generic_chr_files(insmod_t)
 
 fs_getattr_xattr_fs(insmod_t)
 
@@ -101,6 +103,8 @@
 init_use_fds(insmod_t)
 init_use_script_fds(insmod_t)
 init_use_script_ptys(insmod_t)
+init_spec_domtrans_script(insmod_t)
+init_rw_script_tmp_files(insmod_t)
 
 libs_use_ld_so(insmod_t)
 libs_use_shared_libs(insmod_t)
@@ -112,17 +116,32 @@
 
 seutil_read_file_contexts(insmod_t)
 
-ifdef(`distro_ubuntu',`
 	optional_policy(`
 		unconfined_domain(insmod_t)
 	')
-')
+
+term_dontaudit_use_unallocated_ttys(insmod_t)
+userdom_dontaudit_search_users_home_dirs(insmod_t)
+sysadm_dontaudit_search_home_dirs(insmod_t)
+fs_dontaudit_use_tmpfs_chr_dev(insmod_t)
 
 if( ! secure_mode_insmod ) {
 	kernel_domtrans_to(insmod_t,insmod_exec_t)
 }
 
 optional_policy(`
+	alsa_domtrans(insmod_t)
+')
+
+optional_policy(`
+	firstboot_dontaudit_rw_pipes(insmod_t)
+')
+
+optional_policy(`
+	hal_write_log(insmod_t)
+')
+
+optional_policy(`
 	hotplug_search_config(insmod_t)
 ')
 
@@ -155,10 +174,12 @@
 
 optional_policy(`
 	rpm_rw_pipes(insmod_t)
+	rpm_read_script_tmp_files(insmod_t)
 ')
 
 optional_policy(`
 	unconfined_dontaudit_rw_pipes(insmod_t)
+	unconfined_dontaudit_use_terminals(insmod_t)
 ')
 
 optional_policy(`
@@ -185,6 +206,7 @@
 
 files_read_kernel_symbol_table(depmod_t)
 files_read_kernel_modules(depmod_t)
+files_delete_kernel_modules(depmod_t)
 
 fs_getattr_xattr_fs(depmod_t)
 
@@ -208,9 +230,11 @@
 
 # Read System.map from home directories.
 files_list_home(depmod_t)
-staff_read_home_content_files(depmod_t)
+unprivuser_read_home_content_files(depmod_t)
 sysadm_read_home_content_files(depmod_t)
 
+sysadm_dontaudit_use_terms(depmod_t)
+
 ifdef(`distro_ubuntu',`
 	optional_policy(`
 		unconfined_domain(depmod_t)
@@ -219,11 +243,13 @@
 
 optional_policy(`
 	# Read System.map from home directories.
-	unconfined_read_home_content_files(depmod_t)
+	unconfined_dontaudit_use_terminals(depmod_t)
+	unconfined_domain(depmod_t)
 ')
 
 optional_policy(`
 	rpm_rw_pipes(depmod_t)
+	rpm_manage_script_tmp_files(depmod_t)
 ')
 
 #################################
