--- nsaserefpolicy/policy/modules/system/sysnetwork.fc	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/sysnetwork.fc	2008-08-14 13:53:54.000000000 -0400
@@ -57,3 +57,5 @@
 ifdef(`distro_gentoo',`
 /var/lib/dhcpc(/.*)?		gen_context(system_u:object_r:dhcpc_state_t,s0)
 ')
+
+/etc/firestarter/firestarter\.sh gen_context(system_u:object_r:dhcpc_helper_exec_t,s0)
--- nsaserefpolicy/policy/modules/system/sysnetwork.if	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/sysnetwork.if	2008-08-14 13:53:54.000000000 -0400
@@ -553,6 +553,7 @@
 		type net_conf_t;
 	')
 
+	allow $1 self:netlink_route_socket r_netlink_socket_perms;
 	allow $1 self:tcp_socket create_socket_perms;
 	allow $1 self:udp_socket create_socket_perms;
 
@@ -569,6 +570,10 @@
 
 	files_search_etc($1)
 	allow $1 net_conf_t:file read_file_perms;
+
+	optional_policy(`
+		avahi_stream_connect($1)
+	')
 ')
 
 ########################################
@@ -598,6 +603,8 @@
 
 	files_search_etc($1)
 	allow $1 net_conf_t:file read_file_perms;
+	# LDAP Configuration using encrypted requires
+	dev_read_urand($1)
 ')
 
 ########################################
@@ -632,3 +639,49 @@
 	files_search_etc($1)
 	allow $1 net_conf_t:file read_file_perms;
 ')
+
+########################################
+## <summary>
+##	Do not audit attempts to use
+##	the dhcp file descriptors.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The domain sending the SIGCHLD.
+##	</summary>
+## </param>
+#
+interface(`sysnet_dontaudit_dhcpc_use_fds',`
+	gen_require(`
+		type dhcpc_t;
+	')
+
+	dontaudit $1 dhcpc_t:fd use;
+')
+
+########################################
+## <summary>
+##	Transition to system_r when execute an dhclient script
+## </summary>
+## <desc>
+##      <p>
+##	Execute dhclient script in a specified role
+##      </p>
+##      <p>
+##      No interprocess communication (signals, pipes,
+##      etc.) is provided by this interface since
+##      the domains are not owned by this module.
+##      </p>
+## </desc>
+## <param name="source_role">
+##	<summary>
+##	Role to transition from.
+##	</summary>
+## </param>
+interface(`sysnet_role_transition_dhcpc',`
+	gen_require(`
+		type dhcpc_exec_t;
+	')
+
+	role_transition $1 dhcpc_exec_t system_r;
+')
--- nsaserefpolicy/policy/modules/system/sysnetwork.te	2008-08-11 11:23:34.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/sysnetwork.te	2008-08-14 13:53:54.000000000 -0400
@@ -20,6 +20,10 @@
 init_daemon_domain(dhcpc_t,dhcpc_exec_t)
 role system_r types dhcpc_t;
 
+type dhcpc_helper_exec_t;
+init_script_type(dhcpc_helper_exec_t)
+init_script_domtrans_spec(dhcpc_t, dhcpc_helper_exec_t)
+
 type dhcpc_state_t;
 files_type(dhcpc_state_t)
 
@@ -41,16 +45,16 @@
 #
 # DHCP client local policy
 #
-allow dhcpc_t self:capability { dac_override fsetid net_admin net_raw net_bind_service sys_resource sys_tty_config };
+allow dhcpc_t self:capability { dac_override fsetid net_admin net_raw net_bind_service sys_nice sys_resource sys_tty_config };
 dontaudit dhcpc_t self:capability sys_tty_config;
 # for access("/etc/bashrc", X_OK) on Red Hat
 dontaudit dhcpc_t self:capability { dac_read_search sys_module };
-allow dhcpc_t self:process signal_perms;
+allow dhcpc_t self:process { ptrace signal_perms };
 allow dhcpc_t self:fifo_file rw_file_perms;
 allow dhcpc_t self:tcp_socket create_stream_socket_perms;
 allow dhcpc_t self:udp_socket create_socket_perms;
 allow dhcpc_t self:packet_socket create_socket_perms;
-allow dhcpc_t self:netlink_route_socket { create_socket_perms nlmsg_read nlmsg_write };
+allow dhcpc_t self:netlink_route_socket { create_socket_perms nlmsg_read };
 
 allow dhcpc_t dhcp_etc_t:dir list_dir_perms;
 read_lnk_files_pattern(dhcpc_t,dhcp_etc_t,dhcp_etc_t)
@@ -117,7 +121,7 @@
 corecmd_exec_shell(dhcpc_t)
 
 domain_use_interactive_fds(dhcpc_t)
-domain_dontaudit_list_all_domains_state(dhcpc_t)
+domain_dontaudit_read_all_domains_state(dhcpc_t)
 
 files_read_etc_files(dhcpc_t)
 files_read_etc_runtime_files(dhcpc_t)
@@ -136,8 +140,6 @@
 
 modutils_domtrans_insmod(dhcpc_t)
 
-staff_dontaudit_search_home_dirs(dhcpc_t)
-
 ifdef(`distro_redhat', `
 	files_exec_etc_files(dhcpc_t)
 ')
@@ -186,14 +188,12 @@
 ')
 
 optional_policy(`
-	nis_use_ypbind(dhcpc_t)
-	nis_signal_ypbind(dhcpc_t)
-	nis_read_ypbind_pid(dhcpc_t)
-	nis_delete_ypbind_pid(dhcpc_t)
-
-	# dhclient sometimes starts ypbind
-	init_exec_script_files(dhcpc_t)
-	nis_domtrans_ypbind(dhcpc_t)
+	networkmanager_domtrans(dhcpc_t)
+	networkmanager_read_pid_files(dhcpc_t)
+')
+
+optional_policy(`
+	nis_script_domtrans(dhcpc_t)
 ')
 
 optional_policy(`
@@ -202,9 +202,7 @@
 ')
 
 optional_policy(`
-	# dhclient sometimes starts ntpd
-	init_exec_script_files(dhcpc_t)
-	ntp_domtrans(dhcpc_t)
+	ntp_script_domtrans(dhcpc_t)
 ')
 
 optional_policy(`
@@ -215,6 +213,11 @@
 optional_policy(`
 	seutil_sigchld_newrole(dhcpc_t)
 	seutil_dontaudit_search_config(dhcpc_t)
+	seutil_domtrans_setfiles(dhcpc_t)
+')
+
+optional_policy(`
+	sysadm_dontaudit_search_home_dirs(dhcpc_t)
 ')
 
 optional_policy(`
@@ -226,6 +229,10 @@
 ')
 
 optional_policy(`
+	vmware_append_log(dhcpc_t)
+')
+
+optional_policy(`
 	kernel_read_xen_state(dhcpc_t)
 	kernel_write_xen_state(dhcpc_t)
 	xen_append_log(dhcpc_t)
@@ -239,7 +246,6 @@
 
 allow ifconfig_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack };
 allow ifconfig_t self:capability { net_raw net_admin sys_tty_config };
-dontaudit ifconfig_t self:capability sys_module;
 
 allow ifconfig_t self:fd use;
 allow ifconfig_t self:fifo_file rw_fifo_file_perms;
@@ -253,6 +259,7 @@
 allow ifconfig_t self:sem create_sem_perms;
 allow ifconfig_t self:msgq create_msgq_perms;
 allow ifconfig_t self:msg { send receive };
+allow ifconfig_t net_conf_t:file read_file_perms;
 
 # Create UDP sockets, necessary when called from dhcpc
 allow ifconfig_t self:udp_socket create_socket_perms;
@@ -262,13 +269,19 @@
 allow ifconfig_t self:netlink_route_socket create_netlink_socket_perms;
 allow ifconfig_t self:netlink_xfrm_socket { create_netlink_socket_perms nlmsg_read };
 allow ifconfig_t self:tcp_socket { create ioctl };
+
+read_files_pattern(ifconfig_t,dhcpc_state_t,dhcpc_state_t)
+
 files_read_etc_files(ifconfig_t);
 
 kernel_use_fds(ifconfig_t)
 kernel_read_system_state(ifconfig_t)
 kernel_read_network_state(ifconfig_t)
 kernel_search_network_sysctl(ifconfig_t)
+kernel_search_debugfs(ifconfig_t)
 kernel_rw_net_sysctls(ifconfig_t)
+# This should be put inside a boolean, but can not because of attributes
+kernel_load_module(ifconfig_t)
 
 corenet_rw_tun_tap_dev(ifconfig_t)
 
@@ -279,8 +292,11 @@
 fs_getattr_xattr_fs(ifconfig_t)
 fs_search_auto_mountpoints(ifconfig_t)
 
+selinux_dontaudit_getattr_fs(ifconfig_t)
+
 term_dontaudit_use_all_user_ttys(ifconfig_t)
 term_dontaudit_use_all_user_ptys(ifconfig_t)
+term_dontaudit_use_ptmx(ifconfig_t)
 
 domain_use_interactive_fds(ifconfig_t)
 
@@ -320,11 +336,11 @@
 ')
 
 optional_policy(`
-	ipsec_write_pid(ifconfig_t)
+	netutils_domtrans(dhcpc_t)
 ')
 
 optional_policy(`
-	netutils_domtrans(dhcpc_t)
+	ipsec_write_pid(ifconfig_t)
 ')
 
 optional_policy(`
@@ -336,6 +352,14 @@
 ')
 
 optional_policy(`
+	unconfined_dontaudit_rw_pipes(ifconfig_t)
+')
+
+optional_policy(`
+	vmware_append_log(ifconfig_t)
+')
+
+optional_policy(`
 	kernel_read_xen_state(ifconfig_t)
 	kernel_write_xen_state(ifconfig_t)
 	xen_append_log(ifconfig_t)
