--- nsaserefpolicy/policy/modules/system/selinuxutil.fc	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/selinuxutil.fc	2008-08-14 13:53:54.000000000 -0400
@@ -38,7 +38,7 @@
 /usr/sbin/restorecond		--	gen_context(system_u:object_r:restorecond_exec_t,s0)
 /usr/sbin/run_init		--	gen_context(system_u:object_r:run_init_exec_t,s0)
 /usr/sbin/setfiles.*		--	gen_context(system_u:object_r:setfiles_exec_t,s0)
-/usr/sbin/setsebool		--	gen_context(system_u:object_r:semanage_exec_t,s0)
+/usr/sbin/setsebool		--	gen_context(system_u:object_r:setsebool_exec_t,s0)
 /usr/sbin/semanage		--	gen_context(system_u:object_r:semanage_exec_t,s0)
 /usr/sbin/semodule		--	gen_context(system_u:object_r:semanage_exec_t,s0)
 
@@ -46,3 +46,8 @@
 # /var/run
 #
 /var/run/restorecond\.pid	--	gen_context(system_u:object_r:restorecond_var_run_t,s0)
+
+#
+# /var/lib
+#
+/var/lib/selinux(/.*)?			gen_context(system_u:object_r:selinux_var_lib_t,s0)
--- nsaserefpolicy/policy/modules/system/selinuxutil.if	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/selinuxutil.if	2008-08-14 13:53:54.000000000 -0400
@@ -555,6 +555,59 @@
 
 ########################################
 ## <summary>
+##	Execute setfiles in the setfiles domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`seutil_domtrans_setfiles_mac',`
+	gen_require(`
+		type setfiles_mac_t, setfiles_exec_t;
+	')
+
+	files_search_usr($1)
+	corecmd_search_bin($1)
+	domtrans_pattern($1, setfiles_exec_t, setfiles_mac_t)
+')
+
+########################################
+## <summary>
+##	Execute setfiles in the setfiles_mac domain, and
+##	allow the specified role the setfiles_mac domain,
+##	and use the caller's terminal.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed the setfiles_mac domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the terminal allow the setfiles_mac domain to use.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`seutil_run_setfiles_mac',`
+	gen_require(`
+		type setfiles_mac_t;
+	')
+
+	seutil_domtrans_setfiles_mac($1)
+	role $2 types setfiles_mac_t;
+	allow setfiles_mac_t $3:chr_file rw_term_perms;
+')
+
+########################################
+## <summary>
 ##	Execute setfiles in the caller domain.
 ## </summary>
 ## <param name="domain">
@@ -589,7 +642,7 @@
 		type selinux_config_t;
 	')
 
-	dontaudit $1 selinux_config_t:dir search;
+	dontaudit $1 selinux_config_t:dir search_dir_perms;
 ')
 
 ########################################
@@ -608,7 +661,7 @@
 		type selinux_config_t;
 	')
 
-	dontaudit $1 selinux_config_t:dir search;
+	dontaudit $1 selinux_config_t:dir search_dir_perms;
 	dontaudit $1 selinux_config_t:file { getattr read };
 ')
 
@@ -700,6 +753,7 @@
 	')
 
 	files_search_etc($1)
+	manage_dirs_pattern($1, selinux_config_t, selinux_config_t)
 	manage_files_pattern($1,selinux_config_t,selinux_config_t)
 	read_lnk_files_pattern($1,selinux_config_t,selinux_config_t)
 ')
@@ -809,6 +863,28 @@
 
 ########################################
 ## <summary>
+##	dontaudit Read the file_contexts files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`seutil_dontaudit_read_file_contexts',`
+	gen_require(`
+		type selinux_config_t, default_context_t, file_context_t;
+	')
+
+	files_search_etc($1)
+	dontaudit $1 { selinux_config_t default_context_t }:dir search_dir_perms;
+	dontaudit $1 file_context_t:dir search_dir_perms;
+	dontaudit $1 file_context_t:file read_file_perms;
+')
+
+########################################
+## <summary>
 ##	Read and write the file_contexts files.
 ## </summary>
 ## <param name="domain">
@@ -999,6 +1075,26 @@
 
 ########################################
 ## <summary>
+##	Execute a domain transition to run setsebool.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`seutil_domtrans_setsebool',`
+	gen_require(`
+		type setsebool_t, setsebool_exec_t;
+	')
+
+	files_search_usr($1)
+	corecmd_search_bin($1)
+	domtrans_pattern($1, setsebool_exec_t, setsebool_t)
+')
+
+########################################
+## <summary>
 ##	Execute semanage in the semanage domain, and
 ##	allow the specified role the semanage domain,
 ##	and use the caller's terminal.
@@ -1010,7 +1106,7 @@
 ## </param>
 ## <param name="role">
 ##	<summary>
-##	The role to be allowed the checkpolicy domain.
+##	The role to be allowed the semanage domain.
 ##	</summary>
 ## </param>
 ## <param name="terminal">
@@ -1026,14 +1122,45 @@
 	')
 
 	seutil_domtrans_semanage($1)
-	seutil_run_setfiles(semanage_t, $2, $3)
-	seutil_run_loadpolicy(semanage_t, $2, $3)
 	role $2 types semanage_t;
 	allow semanage_t $3:chr_file rw_term_perms;
 ')
 
 ########################################
 ## <summary>
+##	Execute setsebool in the semanage domain, and
+##	allow the specified role the semanage domain,
+##	and use the caller's terminal.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed the semanage domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the terminal allow the semanage domain to use.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`seutil_run_setsebool',`
+	gen_require(`
+		type semanage_t;
+	')
+
+	seutil_domtrans_setsebool($1)
+	role $2 types setsebool_t;
+	allow setsebool_t $3:chr_file rw_term_perms;
+')
+
+########################################
+## <summary>
 ##	Full management of the semanage
 ##	module store.
 ## </summary>
@@ -1145,3 +1272,260 @@
 	selinux_dontaudit_get_fs_mount($1)
 	seutil_dontaudit_read_config($1)
 ')
+
+#######################################
+## <summary>
+##	The per role template for the setsebool module.
+## </summary>
+## <desc>
+##	<p>
+##	This template creates a derived domains which are used
+##	for setsebool plugins that are executed by a browser.
+##	</p>
+##	<p>
+##	This template is invoked automatically for each user, and
+##	generally does not need to be invoked directly
+##	by policy writers.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="user_domain">
+##	<summary>
+##	The type of the user domain.
+##	</summary>
+## </param>
+## <param name="user_role">
+##	<summary>
+##	The role associated with the user domain.
+##	</summary>
+## </param>
+#
+template(`seutil_setsebool_per_role_template',`
+	gen_require(`
+		type setsebool_exec_t;
+	')
+
+	type $1_setsebool_t;
+	domain_type($1_setsebool_t)
+	domain_entry_file($1_setsebool_t, setsebool_exec_t)
+	role $3 types $1_setsebool_t;
+
+	files_search_usr($2)
+	corecmd_search_bin($2)
+	domtrans_pattern($2, setsebool_exec_t, $1_setsebool_t)
+	seutil_semanage_policy($1_setsebool_t)
+
+	# Need to define per type booleans
+	selinux_set_boolean($1_setsebool_t)
+
+	# Bug in semanage
+	seutil_domtrans_setfiles($1_setsebool_t)
+	seutil_manage_file_contexts($1_setsebool_t)
+	seutil_manage_default_contexts($1_setsebool_t)
+	seutil_manage_config($1_setsebool_t)
+')
+
+#######################################
+## <summary>
+##	All rules necessary to run semanage command
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`seutil_semanage_policy',`
+	gen_require(`
+		type semanage_tmp_t;
+		type policy_config_t;
+	')
+	allow $1 self:capability { dac_override audit_write sys_resource };
+	dontaudit $1 self:capability sys_tty_config;
+	allow $1 self:unix_stream_socket create_stream_socket_perms;
+	allow $1 self:unix_dgram_socket create_socket_perms;
+	logging_send_audit_msgs($1)
+
+	# Running genhomedircon requires this for finding all users
+	auth_use_nsswitch($1)
+
+	allow $1 policy_config_t:file { read write };
+
+	allow $1 semanage_tmp_t:dir manage_dir_perms;
+	allow $1 semanage_tmp_t:file manage_file_perms;
+	files_tmp_filetrans($1, semanage_tmp_t, { file dir })
+
+	kernel_read_system_state($1)
+	kernel_read_kernel_sysctls($1)
+
+	corecmd_exec_bin($1)
+	corecmd_exec_shell($1)
+
+	dev_read_urand($1)
+
+	domain_use_interactive_fds($1)
+
+	files_read_etc_files($1)
+	files_read_etc_runtime_files($1)
+	files_read_usr_files($1)
+	files_list_pids($1)
+	fs_list_inotifyfs($1)
+	fs_getattr_all_fs($1)
+
+	mls_file_write_all_levels($1)
+	mls_file_read_all_levels($1)
+
+	selinux_getattr_fs($1)
+	selinux_validate_context($1)
+	selinux_get_enforce_mode($1)
+
+	term_use_all_terms($1)
+
+	libs_use_ld_so($1)
+	libs_use_shared_libs($1)
+
+	locallogin_use_fds($1)
+
+	logging_send_syslog_msg($1)
+
+	miscfiles_read_localization($1)
+
+	seutil_search_default_contexts($1)
+	seutil_domtrans_loadpolicy($1)
+	seutil_read_config($1)
+	seutil_manage_bin_policy($1)
+	seutil_use_newrole_fds($1)
+	seutil_manage_module_store($1)
+	seutil_get_semanage_trans_lock($1)
+	seutil_get_semanage_read_lock($1)
+
+	userdom_dontaudit_write_unpriv_user_home_content_files($1)
+
+	optional_policy(`
+		rpm_dontaudit_rw_tmp_files($1)
+		rpm_dontaudit_rw_pipes($1)
+	')
+')
+
+
+#######################################
+## <summary>
+##	All rules necessary to run setfiles command
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`seutil_setfiles',`
+
+allow $1 self:capability { dac_override dac_read_search fowner };
+dontaudit $1 self:capability sys_tty_config;
+allow $1 self:fifo_file rw_file_perms;
+dontaudit $1 self:dir relabelfrom;
+dontaudit $1 self:file relabelfrom;
+dontaudit $1 self:lnk_file relabelfrom;
+
+
+allow $1 { policy_src_t policy_config_t file_context_t default_context_t }:dir list_dir_perms;
+allow $1 { policy_src_t policy_config_t file_context_t default_context_t }:file read_file_perms;
+allow $1 { policy_src_t policy_config_t file_context_t default_context_t }:lnk_file { read_lnk_file_perms ioctl lock };
+
+logging_send_audit_msgs($1)
+
+kernel_read_system_state($1)
+kernel_relabelfrom_unlabeled_dirs($1)
+kernel_relabelfrom_unlabeled_files($1)
+kernel_relabelfrom_unlabeled_symlinks($1)
+kernel_relabelfrom_unlabeled_pipes($1)
+kernel_relabelfrom_unlabeled_sockets($1)
+kernel_use_fds($1)
+kernel_rw_pipes($1)
+kernel_rw_unix_dgram_sockets($1)
+kernel_dontaudit_list_all_proc($1)
+kernel_read_all_sysctls($1)
+kernel_read_network_state_symlinks($1)
+
+dev_relabel_all_dev_nodes($1)
+
+domain_use_interactive_fds($1)
+domain_read_all_domains_state($1)
+ 
+files_read_etc_runtime_files($1)
+files_read_etc_files($1)
+files_list_all($1)
+files_relabel_all_files($1)
+files_list_isid_type_dirs($1)
+files_read_isid_type_files($1)
+files_dontaudit_read_all_symlinks($1)
+
+fs_getattr_xattr_fs($1)
+fs_list_all($1)
+fs_getattr_all_files($1)
+fs_search_auto_mountpoints($1)
+fs_relabelfrom_noxattr_fs($1)
+
+mls_file_read_all_levels($1)
+mls_file_write_all_levels($1)
+mls_file_upgrade($1)
+mls_file_downgrade($1)
+
+selinux_validate_context($1)
+selinux_compute_access_vector($1)
+selinux_compute_create_context($1)
+selinux_compute_relabel_context($1)
+selinux_compute_user_contexts($1)
+
+term_use_all_terms($1)
+
+# this is to satisfy the assertion:
+auth_relabelto_shadow($1)
+
+init_use_fds($1)
+init_use_script_fds($1)
+init_use_script_ptys($1)
+init_exec_script_files($1)
+
+libs_use_ld_so($1)
+libs_use_shared_libs($1)
+
+logging_send_syslog_msg($1)
+
+miscfiles_read_localization($1)
+
+seutil_libselinux_linked($1)
+
+userdom_use_all_users_fds($1)
+# for config files in a home directory
+userdom_read_all_users_home_content_files($1)
+
+ifdef(`distro_debian',`
+	# udev tmpfs is populated with static device nodes
+	# and then relabeled afterwards; thus
+	# /dev/console has the tmpfs type
+	fs_rw_tmpfs_chr_files($1)
+')
+
+ifdef(`distro_redhat',`
+	fs_rw_tmpfs_chr_files($1)
+	fs_rw_tmpfs_blk_files($1)
+	fs_relabel_tmpfs_blk_file($1)
+	fs_relabel_tmpfs_chr_file($1)
+')
+
+ifdef(`distro_ubuntu',`
+	optional_policy(`
+		unconfined_domain($1)
+	')
+')
+
+optional_policy(`
+	hotplug_use_fds($1)
+')
+')
--- nsaserefpolicy/policy/modules/system/selinuxutil.te	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/selinuxutil.te	2008-08-14 13:53:54.000000000 -0400
@@ -23,6 +23,9 @@
 type selinux_config_t;
 files_type(selinux_config_t)
 
+type selinux_var_lib_t;
+files_type(selinux_var_lib_t)
+
 type checkpolicy_t, can_write_binary_policy;
 type checkpolicy_exec_t;
 application_domain(checkpolicy_t, checkpolicy_exec_t)
@@ -75,7 +78,6 @@
 type restorecond_exec_t;
 init_daemon_domain(restorecond_t,restorecond_exec_t)
 domain_obj_id_change_exemption(restorecond_t)
-role system_r types restorecond_t;
 
 type restorecond_var_run_t;
 files_pid_file(restorecond_var_run_t)
@@ -92,6 +94,10 @@
 domain_interactive_fd(semanage_t)
 role system_r types semanage_t;
 
+type setsebool_t;
+type setsebool_exec_t;
+init_system_domain(setsebool_t, setsebool_exec_t)
+
 type semanage_store_t;
 files_type(semanage_store_t)
 
@@ -109,6 +115,11 @@
 init_system_domain(setfiles_t,setfiles_exec_t)
 domain_obj_id_change_exemption(setfiles_t)
 
+type setfiles_mac_t;
+domain_type(setfiles_mac_t)
+domain_entry_file(setfiles_mac_t, setfiles_exec_t)
+domain_obj_id_change_exemption(setfiles_mac_t)
+
 ########################################
 #
 # Checkpolicy local policy
@@ -168,6 +179,7 @@
 files_read_etc_runtime_files(load_policy_t)
 
 fs_getattr_xattr_fs(load_policy_t)
+fs_list_inotifyfs(load_policy_t)
 
 mls_file_read_all_levels(load_policy_t)
 
@@ -195,15 +207,6 @@
 	')
 ')
 
-ifdef(`hide_broken_symptoms',`
-	# cjp: cover up stray file descriptors.
-	dontaudit load_policy_t selinux_config_t:file write;
-
-	optional_policy(`
-		unconfined_dontaudit_read_pipes(load_policy_t)
-	')
-')
-
 ########################################
 #
 # Newrole local policy
@@ -221,7 +224,7 @@
 allow newrole_t self:msg { send receive };
 allow newrole_t self:unix_dgram_socket sendto;
 allow newrole_t self:unix_stream_socket { create_stream_socket_perms connectto };
-allow newrole_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
+logging_send_audit_msgs(newrole_t)
 
 read_files_pattern(newrole_t,default_context_t,default_context_t)
 read_lnk_files_pattern(newrole_t,default_context_t,default_context_t)
@@ -277,6 +280,7 @@
 libs_use_ld_so(newrole_t)
 libs_use_shared_libs(newrole_t)
 
+logging_send_audit_msgs(newrole_t)
 logging_send_syslog_msg(newrole_t)
 
 miscfiles_read_localization(newrole_t)
@@ -347,6 +351,8 @@
 
 seutil_libselinux_linked(restorecond_t)
 
+userdom_read_all_users_home_content_symlinks(restorecond_t)
+
 ifdef(`distro_ubuntu',`
 	optional_policy(`
 		unconfined_domain(restorecond_t)
@@ -365,7 +371,7 @@
 allow run_init_t self:process setexec;
 allow run_init_t self:capability setuid;
 allow run_init_t self:fifo_file rw_file_perms;
-allow run_init_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
+logging_send_audit_msgs(run_init_t)
 
 # often the administrator runs such programs from a directory that is owned
 # by a different user or has restrictive SE permissions, do not want to audit
@@ -396,7 +402,6 @@
 
 auth_use_nsswitch(run_init_t)
 auth_domtrans_chk_passwd(run_init_t)
-auth_domtrans_upd_passwd(run_init_t)
 auth_dontaudit_read_shadow(run_init_t)
 
 init_spec_domtrans_script(run_init_t)
@@ -435,64 +440,22 @@
 # semodule local policy
 #
 
-allow semanage_t self:capability { dac_override audit_write };
-allow semanage_t self:unix_stream_socket create_stream_socket_perms;
-allow semanage_t self:unix_dgram_socket create_socket_perms;
-allow semanage_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
-
-allow semanage_t policy_config_t:file { read write };
-
-allow semanage_t semanage_tmp_t:dir manage_dir_perms;
-allow semanage_t semanage_tmp_t:file manage_file_perms;
-files_tmp_filetrans(semanage_t, semanage_tmp_t, { file dir })
-
-kernel_read_system_state(semanage_t)
-kernel_read_kernel_sysctls(semanage_t)
+seutil_semanage_policy(semanage_t)
+allow semanage_t self:fifo_file rw_fifo_file_perms;
 
-corecmd_exec_bin(semanage_t)
+manage_dirs_pattern(semanage_t, selinux_var_lib_t,  selinux_var_lib_t)
+manage_files_pattern(semanage_t, selinux_var_lib_t,  selinux_var_lib_t)
 
-dev_read_urand(semanage_t)
-
-domain_use_interactive_fds(semanage_t)
-
-files_read_etc_files(semanage_t)
-files_read_etc_runtime_files(semanage_t)
-files_read_usr_files(semanage_t)
-files_list_pids(semanage_t)
-
-mls_file_write_all_levels(semanage_t)
-mls_file_read_all_levels(semanage_t)
-
-selinux_validate_context(semanage_t)
-selinux_get_enforce_mode(semanage_t)
-selinux_getattr_fs(semanage_t)
-# for setsebool:
 selinux_set_boolean(semanage_t)
+can_exec(semanage_t, semanage_exec_t)
 
-term_use_all_terms(semanage_t)
-
-# Running genhomedircon requires this for finding all users
-auth_use_nsswitch(semanage_t)
-
-libs_use_ld_so(semanage_t)
-libs_use_shared_libs(semanage_t)
+# Admins are creating pp files in random locations
+auth_read_all_files_except_shadow(semanage_t)
 
-locallogin_use_fds(semanage_t)
-
-logging_send_syslog_msg(semanage_t)
-
-miscfiles_read_localization(semanage_t)
-
-seutil_libselinux_linked(semanage_t)
 seutil_manage_file_contexts(semanage_t)
 seutil_manage_config(semanage_t)
 seutil_domtrans_setfiles(semanage_t)
-seutil_domtrans_loadpolicy(semanage_t)
-seutil_manage_bin_policy(semanage_t)
-seutil_use_newrole_fds(semanage_t)
-seutil_manage_module_store(semanage_t)
-seutil_get_semanage_trans_lock(semanage_t)
-seutil_get_semanage_read_lock(semanage_t)
+
 # netfilter_contexts:
 seutil_manage_default_contexts(semanage_t)
 
@@ -501,12 +464,21 @@
 	files_read_var_lib_symlinks(semanage_t)
 ')
 
+optional_policy(`
+	sysadm_search_home_dirs(semanage_t)
+')
+
 ifdef(`distro_ubuntu',`
 	optional_policy(`
 		unconfined_domain(semanage_t)
 	')
 ')
 
+optional_policy(`
+	#signal mcstrans on reload
+	init_spec_domtrans_script(semanage_t)
+')
+
 # cjp: need a more general way to handle this:
 ifdef(`enable_mls',`
 	# read secadm tmp files
@@ -514,121 +486,42 @@
 	# Handle pp files created in homedir and /tmp
 	sysadm_read_home_content_files(semanage_t)
 	sysadm_read_tmp_files(semanage_t)
-
-	optional_policy(`
-		unconfined_read_home_content_files(semanage_t)
-		unconfined_read_tmp_files(semanage_t)
-	')
+	userdom_read_unpriv_users_home_content_files(semanage_t)
+	userdom_read_unpriv_users_tmp_files(semanage_t)
 ')
 
 ########################################
 #
-# Setfiles local policy
+# setsebool local policy
 #
+seutil_semanage_policy(setsebool_t)
+selinux_set_boolean(setsebool_t)
 
-allow setfiles_t self:capability { dac_override dac_read_search fowner };
-dontaudit setfiles_t self:capability sys_tty_config;
-allow setfiles_t self:fifo_file rw_file_perms;
-
-allow setfiles_t { policy_src_t policy_config_t file_context_t default_context_t }:dir list_dir_perms;
-allow setfiles_t { policy_src_t policy_config_t file_context_t default_context_t }:file read_file_perms;
-allow setfiles_t { policy_src_t policy_config_t file_context_t default_context_t }:lnk_file { read_lnk_file_perms ioctl lock };
-
-kernel_read_system_state(setfiles_t)
-kernel_relabelfrom_unlabeled_dirs(setfiles_t)
-kernel_relabelfrom_unlabeled_files(setfiles_t)
-kernel_relabelfrom_unlabeled_symlinks(setfiles_t)
-kernel_relabelfrom_unlabeled_pipes(setfiles_t)
-kernel_relabelfrom_unlabeled_sockets(setfiles_t)
-kernel_use_fds(setfiles_t)
-kernel_rw_pipes(setfiles_t)
-kernel_rw_unix_dgram_sockets(setfiles_t)
-kernel_dontaudit_list_all_proc(setfiles_t)
-kernel_dontaudit_list_all_sysctls(setfiles_t)
-
-dev_relabel_all_dev_nodes(setfiles_t)
-
-domain_use_interactive_fds(setfiles_t)
-domain_dontaudit_search_all_domains_state(setfiles_t)
-
-files_read_etc_runtime_files(setfiles_t)
-files_read_etc_files(setfiles_t)
-files_list_all(setfiles_t)
-files_relabel_all_files(setfiles_t)
-
-fs_getattr_xattr_fs(setfiles_t)
-fs_list_all(setfiles_t)
-fs_search_auto_mountpoints(setfiles_t)
-fs_relabelfrom_noxattr_fs(setfiles_t)
-
-mls_file_read_all_levels(setfiles_t)
-mls_file_write_all_levels(setfiles_t)
-mls_file_upgrade(setfiles_t)
-mls_file_downgrade(setfiles_t)
-
-selinux_validate_context(setfiles_t)
-selinux_compute_access_vector(setfiles_t)
-selinux_compute_create_context(setfiles_t)
-selinux_compute_relabel_context(setfiles_t)
-selinux_compute_user_contexts(setfiles_t)
-
-term_use_all_user_ttys(setfiles_t)
-term_use_all_user_ptys(setfiles_t)
-term_use_unallocated_ttys(setfiles_t)
-
-# this is to satisfy the assertion:
-auth_relabelto_shadow(setfiles_t)
-
-init_use_fds(setfiles_t)
-init_use_script_fds(setfiles_t)
-init_use_script_ptys(setfiles_t)
-init_exec_script_files(setfiles_t)
-
-libs_use_ld_so(setfiles_t)
-libs_use_shared_libs(setfiles_t)
-
-logging_send_syslog_msg(setfiles_t)
-
-miscfiles_read_localization(setfiles_t)
-
-seutil_libselinux_linked(setfiles_t)
-
-userdom_use_all_users_fds(setfiles_t)
-# for config files in a home directory
-userdom_read_all_users_home_content_files(setfiles_t)
+init_dontaudit_use_fds(setsebool_t)
 
-ifdef(`distro_debian',`
-	# udev tmpfs is populated with static device nodes
-	# and then relabeled afterwards; thus
-	# /dev/console has the tmpfs type
-	fs_rw_tmpfs_chr_files(setfiles_t)
-')
+# Bug in semanage
+seutil_domtrans_setfiles(setsebool_t)
+seutil_manage_file_contexts(setsebool_t)
+seutil_manage_default_contexts(setsebool_t)
+seutil_manage_config(setsebool_t)
 
-ifdef(`distro_redhat', `
-	fs_rw_tmpfs_chr_files(setfiles_t)
-	fs_rw_tmpfs_blk_files(setfiles_t)
-	fs_relabel_tmpfs_blk_file(setfiles_t)
-	fs_relabel_tmpfs_chr_file(setfiles_t)
-')
+########################################
+#
+# Setfiles local policy
+#
 
-ifdef(`distro_ubuntu',`
-	optional_policy(`
-		unconfined_domain(setfiles_t)
-	')
-')
+seutil_setfiles(setfiles_t)
+# During boot in Rawhide
+term_use_generic_ptys(setfiles_t)
 
-ifdef(`hide_broken_symptoms',`
 	optional_policy(`
-		udev_dontaudit_rw_dgram_sockets(setfiles_t)
+	cron_system_entry(setfiles_t, setfiles_exec_t)
 	')
 
-	# cjp: cover up stray file descriptors.
-	optional_policy(`
-		unconfined_dontaudit_read_pipes(setfiles_t)
-		unconfined_dontaudit_rw_tcp_sockets(setfiles_t)
-	')
-')
+seutil_setfiles(setfiles_mac_t)
+allow setfiles_mac_t self:capability2 mac_admin;
+kernel_relabelto_unlabeled(setfiles_mac_t)
 
 optional_policy(`
-	hotplug_use_fds(setfiles_t)
+	unconfined_domain(setfiles_mac_t)
 ')
