Move all files out of the old contrib directory.

15 files changed, 2182 insertions, 0 deletions

diff --git a/policy/modules/system/daemontools.fc b/policy/modules/system/daemontools.fc
new file mode 100644
index 000000000..d5574cdc4
--- /dev/null
+++ b/policy/modules/system/daemontools.fc
@@ -0,0 +1,41 @@
+/service	-d	gen_context(system_u:object_r:svc_svc_t,s0)
+/service/.*	gen_context(system_u:object_r:svc_svc_t,s0)
+
+/usr/bin/envdir	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/usr/bin/envuidgid	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/usr/bin/fghack	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/usr/bin/multilog	--	gen_context(system_u:object_r:svc_multilog_exec_t,s0)
+/usr/bin/pgrphack	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/usr/bin/setlock	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/usr/bin/setuidgid	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/usr/bin/softlimit	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/usr/bin/svc	--	gen_context(system_u:object_r:svc_start_exec_t,s0)
+/usr/bin/svok	--	gen_context(system_u:object_r:svc_start_exec_t,s0)
+/usr/bin/svscan	--	gen_context(system_u:object_r:svc_start_exec_t,s0)
+/usr/bin/svscanboot	--	gen_context(system_u:object_r:svc_start_exec_t,s0)
+/usr/bin/supervise	--	gen_context(system_u:object_r:svc_start_exec_t,s0)
+
+/var/axfrdns(/.*)?	gen_context(system_u:object_r:svc_svc_t,s0)
+/var/axfrdns/run	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/var/axfrdns/log/run	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/var/axfrdns/env(/.*)?	gen_context(system_u:object_r:svc_conf_t,s0)
+
+/var/dnscache(/.*)?	gen_context(system_u:object_r:svc_svc_t,s0)
+/var/dnscache/env(/.*)?	gen_context(system_u:object_r:svc_conf_t,s0)
+/var/dnscache/run	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/var/dnscache/log/run	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+
+/var/qmail/supervise(/.*)?	gen_context(system_u:object_r:svc_svc_t,s0)
+/var/qmail/supervise/.*/run	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/var/qmail/supervise/.*/log/run	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+
+/var/service/.*	gen_context(system_u:object_r:svc_svc_t,s0)
+/var/service/.*/env(/.*)?	gen_context(system_u:object_r:svc_conf_t,s0)
+/var/service/.*/log/main(/.*)?	gen_context(system_u:object_r:svc_log_t,s0)
+/var/service/.*/log/run	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/var/service/.*/run.*	gen_context(system_u:object_r:svc_run_exec_t,s0)
+
+/var/tinydns(/.*)?	gen_context(system_u:object_r:svc_svc_t,s0)
+/var/tinydns/run	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/var/tinydns/log/run	--	gen_context(system_u:object_r:svc_run_exec_t,s0)
+/var/tinydns/env(/.*)?	gen_context(system_u:object_r:svc_conf_t,s0)
diff --git a/policy/modules/system/daemontools.if b/policy/modules/system/daemontools.if
new file mode 100644
index 000000000..54c71e1fc
--- /dev/null
+++ b/policy/modules/system/daemontools.if
@@ -0,0 +1,220 @@
+## <summary>Collection of tools for managing UNIX services.</summary>
+
+########################################
+## <summary>
+##	An ipc channel between the
+##	supervised domain and svc_start_t.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`daemontools_ipc_domain',`
+	gen_require(`
+		type svc_start_t;
+	')
+
+	allow $1 svc_start_t:process sigchld;
+	allow $1 svc_start_t:fd use;
+	allow $1 svc_start_t:fifo_file rw_fifo_file_perms;
+	allow svc_start_t $1:process signal;
+')
+
+########################################
+## <summary>
+##	Create a domain which can be
+##	started by daemontools.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Type to be used as a domain.
+##	</summary>
+## </param>
+## <param name="entrypoint">
+##	<summary>
+##	Type of the program to be used as an entry point to this domain.
+##	</summary>
+## </param>
+#
+interface(`daemontools_service_domain',`
+	gen_require(`
+		type svc_run_t;
+	')
+
+	domain_auto_transition_pattern(svc_run_t, $2, $1)
+	daemontools_ipc_domain($1)
+
+	allow svc_run_t $1:process signal;
+	allow $1 svc_run_t:fd use;
+')
+
+########################################
+## <summary>
+##	Execute svc start in the svc
+##	start domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`daemontools_domtrans_start',`
+	gen_require(`
+		type svc_start_t, svc_start_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, svc_start_exec_t, svc_start_t)
+')
+
+######################################
+## <summary>
+##	Execute svc start in the svc
+##	start domain, and allow the
+##	specified role the svc start domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`daemonstools_run_start',`
+	gen_require(`
+		attribute_role svc_start_roles;
+	')
+
+	daemontools_domtrans_start($1)
+	roleattribute $2 svc_start_roles;
+')
+
+########################################
+## <summary>
+##	Execute avc run in the svc run domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`daemontools_domtrans_run',`
+	gen_require(`
+		type svc_run_t, svc_run_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, svc_run_exec_t, svc_run_t)
+')
+
+######################################
+## <summary>
+##	Send child terminated signals
+##	to svc run.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`daemontools_sigchld_run',`
+	gen_require(`
+		type svc_run_t;
+	')
+
+	allow $1 svc_run_t:process sigchld;
+')
+
+########################################
+## <summary>
+##	Execute avc multilog in the svc
+##	multilog domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`daemontools_domtrans_multilog',`
+	gen_require(`
+		type svc_multilog_t, svc_multilog_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, svc_multilog_exec_t, svc_multilog_t)
+')
+
+######################################
+## <summary>
+##	Search svc svc directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`daemontools_search_svc_dir',`
+	gen_require(`
+		type svc_svc_t;
+	')
+
+	files_search_var($1)
+	allow $1 svc_svc_t:dir search_dir_perms;
+')
+
+########################################
+## <summary>
+##	Read svc avc files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`daemontools_read_svc',`
+	gen_require(`
+		type svc_svc_t;
+	')
+
+	files_search_var($1)
+	allow $1 svc_svc_t:dir list_dir_perms;
+	allow $1 svc_svc_t:file read_file_perms;
+')
+
+########################################
+## <summary>
+##	Create, read, write and delete
+##	svc svc content.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`daemontools_manage_svc',`
+	gen_require(`
+		type svc_svc_t;
+	')
+
+	files_search_var($1)
+	allow $1 svc_svc_t:dir manage_dir_perms;
+	allow $1 svc_svc_t:fifo_file manage_fifo_file_perms;
+	allow $1 svc_svc_t:file manage_file_perms;
+	allow $1 svc_svc_t:lnk_file manage_lnk_file_perms;
+')
diff --git a/policy/modules/system/daemontools.te b/policy/modules/system/daemontools.te
new file mode 100644
index 000000000..d355befc9
--- /dev/null
+++ b/policy/modules/system/daemontools.te
@@ -0,0 +1,127 @@
+policy_module(daemontools, 1.3.0)
+
+########################################
+#
+# Declarations
+#
+
+attribute_role svc_start_roles;
+roleattribute system_r svc_start_roles;
+
+type svc_conf_t;
+files_config_file(svc_conf_t)
+
+type svc_log_t;
+files_type(svc_log_t)
+
+type svc_multilog_t;
+type svc_multilog_exec_t;
+application_domain(svc_multilog_t, svc_multilog_exec_t)
+role system_r types svc_multilog_t;
+
+type svc_run_t;
+type svc_run_exec_t;
+application_domain(svc_run_t, svc_run_exec_t)
+role system_r types svc_run_t;
+
+type svc_start_t;
+type svc_start_exec_t;
+init_domain(svc_start_t, svc_start_exec_t)
+init_system_domain(svc_start_t, svc_start_exec_t)
+role svc_start_roles types svc_start_t;
+
+type svc_svc_t;
+files_type(svc_svc_t)
+
+########################################
+#
+# Multilog local policy
+#
+
+manage_files_pattern(svc_multilog_t, svc_svc_t, svc_svc_t)
+
+allow svc_multilog_t svc_start_t:process sigchld;
+allow svc_multilog_t svc_start_t:fd use;
+allow svc_multilog_t svc_start_t:fifo_file rw_fifo_file_perms;
+
+init_use_fds(svc_multilog_t)
+
+logging_manage_generic_logs(svc_multilog_t)
+
+########################################
+#
+# local policy for binaries that impose
+# a given environment to supervised daemons
+# ie. softlimit, setuidgid, envuidgid, envdir, fghack ..
+#
+
+allow svc_run_t self:capability { chown fsetid setgid setuid sys_resource };
+allow svc_run_t self:process setrlimit;
+allow svc_run_t self:fifo_file rw_fifo_file_perms;
+allow svc_run_t self:unix_stream_socket create_stream_socket_perms;
+
+allow svc_run_t svc_conf_t:dir list_dir_perms;
+allow svc_run_t svc_conf_t:file read_file_perms;
+
+allow svc_run_t svc_svc_t:dir list_dir_perms;
+allow svc_run_t svc_svc_t:file read_file_perms;
+
+can_exec(svc_run_t, svc_run_exec_t)
+
+domtrans_pattern(svc_run_t, svc_multilog_exec_t, svc_multilog_t)
+
+kernel_read_system_state(svc_run_t)
+
+dev_read_urand(svc_run_t)
+
+corecmd_exec_bin(svc_run_t)
+corecmd_exec_shell(svc_run_t)
+
+files_read_etc_files(svc_run_t)
+files_read_etc_runtime_files(svc_run_t)
+files_search_pids(svc_run_t)
+files_search_var_lib(svc_run_t)
+
+init_use_script_fds(svc_run_t)
+init_use_fds(svc_run_t)
+
+optional_policy(`
+	qmail_read_config(svc_run_t)
+')
+
+########################################
+#
+# local policy for service monitoring programs
+# ie svc, svscan, supervise ...
+#
+
+allow svc_start_t self:capability kill;
+allow svc_start_t self:fifo_file rw_fifo_file_perms;
+allow svc_start_t self:tcp_socket create_stream_socket_perms;
+
+allow svc_start_t svc_svc_t:dir manage_dir_perms;
+allow svc_start_t svc_svc_t:fifo_file manage_fifo_file_perms;
+allow svc_start_t svc_svc_t:file manage_file_perms;
+allow svc_start_t svc_svc_t:lnk_file manage_lnk_file_perms;
+
+allow svc_start_t svc_multilog_t:process signal;
+allow svc_start_t svc_run_t:process { signal setrlimit };
+
+can_exec(svc_start_t, svc_start_exec_t)
+
+domtrans_pattern(svc_start_t, svc_run_exec_t, svc_run_t)
+
+kernel_read_kernel_sysctls(svc_start_t)
+kernel_read_system_state(svc_start_t)
+
+corecmd_exec_bin(svc_start_t)
+corecmd_exec_shell(svc_start_t)
+
+files_read_etc_files(svc_start_t)
+files_read_etc_runtime_files(svc_start_t)
+files_search_var(svc_start_t)
+files_search_pids(svc_start_t)
+
+logging_send_syslog_msg(svc_start_t)
+
+miscfiles_read_localization(svc_start_t)
diff --git a/policy/modules/system/iscsi.fc b/policy/modules/system/iscsi.fc
new file mode 100644
index 000000000..9503952e2
--- /dev/null
+++ b/policy/modules/system/iscsi.fc
@@ -0,0 +1,19 @@
+/etc/rc\.d/init\.d/((iscsi)|(iscsid))	--	gen_context(system_u:object_r:iscsi_initrc_exec_t,s0)
+
+/usr/bin/iscsid		--	gen_context(system_u:object_r:iscsid_exec_t,s0)
+/usr/bin/brcm_iscsiuio	--	gen_context(system_u:object_r:iscsid_exec_t,s0)
+/usr/bin/iscsiuio	--	gen_context(system_u:object_r:iscsid_exec_t,s0)
+
+/usr/sbin/iscsid	--	gen_context(system_u:object_r:iscsid_exec_t,s0)
+/usr/sbin/brcm_iscsiuio	--	gen_context(system_u:object_r:iscsid_exec_t,s0)
+/usr/sbin/iscsiuio	--	gen_context(system_u:object_r:iscsid_exec_t,s0)
+
+/var/lib/iscsi(/.*)?	gen_context(system_u:object_r:iscsi_var_lib_t,s0)
+
+/var/lock/iscsi(/.*)?	gen_context(system_u:object_r:iscsi_lock_t,s0)
+
+/var/log/brcm-iscsi\.log.*	--	gen_context(system_u:object_r:iscsi_log_t,s0)
+/var/log/iscsiuio\.log.*	--	gen_context(system_u:object_r:iscsi_log_t,s0)
+
+/run/iscsid\.pid	--	gen_context(system_u:object_r:iscsi_var_run_t,s0)
+/run/iscsiuio\.pid	--	gen_context(system_u:object_r:iscsi_var_run_t,s0)
diff --git a/policy/modules/system/iscsi.if b/policy/modules/system/iscsi.if
new file mode 100644
index 000000000..44a891d2a
--- /dev/null
+++ b/policy/modules/system/iscsi.if
@@ -0,0 +1,124 @@
+## <summary>Establish connections to iSCSI devices.</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run iscsid.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`iscsid_domtrans',`
+	gen_require(`
+		type iscsid_t, iscsid_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, iscsid_exec_t, iscsid_t)
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete
+##	iscsid sempaphores.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`iscsi_manage_semaphores',`
+	gen_require(`
+		type iscsid_t;
+	')
+
+	allow $1 iscsid_t:sem create_sem_perms;
+')
+
+########################################
+## <summary>
+##	Connect to iscsid using a unix
+##	domain stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`iscsi_stream_connect',`
+	gen_require(`
+		type iscsid_t, iscsi_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	stream_connect_pattern($1, iscsi_var_lib_t, iscsi_var_lib_t, iscsid_t)
+')
+
+########################################
+## <summary>
+##	Read iscsid lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`iscsi_read_lib_files',`
+	gen_require(`
+		type iscsi_var_lib_t;
+	')
+
+	read_files_pattern($1, iscsi_var_lib_t, iscsi_var_lib_t)
+	allow $1 iscsi_var_lib_t:dir list_dir_perms;
+	files_search_var_lib($1)
+')
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an iscsi environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`iscsi_admin',`
+	gen_require(`
+		type iscsid_t, iscsi_lock_t, iscsi_log_t;
+		type iscsi_var_lib_t, iscsi_var_run_t, iscsi_tmp_t;
+		type iscsi_initrc_exec_t;
+	')
+
+	allow $1 iscsid_t:process { ptrace signal_perms };
+	ps_process_pattern($1, iscsid_t)
+
+	init_startstop_service($1, $2, iscsi_t, iscsi_initrc_exec_t)
+
+	logging_search_logs($1)
+	admin_pattern($1, iscsi_log_t)
+
+	files_search_locks($1)
+	admin_pattern($1, iscsi_lock_t)
+
+	files_search_var_lib($1)
+	admin_pattern($1, iscsi_var_lib_t)
+
+	files_search_pids($1)
+	admin_pattern($1, iscsi_var_run_t)
+
+	files_search_tmp($1)
+	admin_pattern($1, iscsi_tmp_t)
+')
diff --git a/policy/modules/system/iscsi.te b/policy/modules/system/iscsi.te
new file mode 100644
index 000000000..9457ef299
--- /dev/null
+++ b/policy/modules/system/iscsi.te
@@ -0,0 +1,107 @@
+policy_module(iscsi, 1.12.0)
+
+########################################
+#
+# Declarations
+#
+
+type iscsid_t;
+type iscsid_exec_t;
+init_daemon_domain(iscsid_t, iscsid_exec_t)
+init_abstract_socket_activation(iscsid_t)
+
+type iscsi_initrc_exec_t;
+init_script_file(iscsi_initrc_exec_t)
+
+type iscsi_lock_t;
+files_lock_file(iscsi_lock_t)
+
+type iscsi_log_t;
+logging_log_file(iscsi_log_t)
+
+type iscsi_tmp_t;
+files_tmp_file(iscsi_tmp_t)
+
+type iscsi_var_lib_t;
+files_type(iscsi_var_lib_t)
+
+type iscsi_var_run_t;
+files_pid_file(iscsi_var_run_t)
+
+########################################
+#
+# Local policy
+#
+
+allow iscsid_t self:capability { dac_override ipc_lock net_admin net_raw sys_admin sys_nice sys_resource };
+dontaudit iscsid_t self:capability sys_ptrace;
+allow iscsid_t self:process { setrlimit setsched signal };
+allow iscsid_t self:fifo_file rw_fifo_file_perms;
+allow iscsid_t self:unix_stream_socket { accept connectto listen };
+allow iscsid_t self:sem create_sem_perms;
+allow iscsid_t self:shm create_shm_perms;
+allow iscsid_t self:netlink_socket create_socket_perms;
+allow iscsid_t self:netlink_kobject_uevent_socket create_socket_perms;
+allow iscsid_t self:netlink_route_socket nlmsg_write;
+allow iscsid_t self:tcp_socket { listen accept };
+
+manage_dirs_pattern(iscsid_t, iscsi_lock_t, iscsi_lock_t)
+manage_files_pattern(iscsid_t, iscsi_lock_t, iscsi_lock_t)
+files_lock_filetrans(iscsid_t, iscsi_lock_t, { dir file })
+
+allow iscsid_t iscsi_log_t:file { append_file_perms create_file_perms setattr_file_perms };
+logging_log_filetrans(iscsid_t, iscsi_log_t, file)
+
+manage_dirs_pattern(iscsid_t, iscsi_tmp_t, iscsi_tmp_t)
+manage_files_pattern(iscsid_t, iscsi_tmp_t, iscsi_tmp_t)
+fs_tmpfs_filetrans(iscsid_t, iscsi_tmp_t, { dir file })
+
+allow iscsid_t iscsi_var_lib_t:dir list_dir_perms;
+read_files_pattern(iscsid_t, iscsi_var_lib_t, iscsi_var_lib_t)
+read_lnk_files_pattern(iscsid_t, iscsi_var_lib_t, iscsi_var_lib_t)
+
+manage_files_pattern(iscsid_t, iscsi_var_run_t, iscsi_var_run_t)
+files_pid_filetrans(iscsid_t, iscsi_var_run_t, file)
+
+can_exec(iscsid_t, iscsid_exec_t)
+
+kernel_read_network_state(iscsid_t)
+kernel_read_system_state(iscsid_t)
+kernel_setsched(iscsid_t)
+
+corenet_all_recvfrom_unlabeled(iscsid_t)
+corenet_all_recvfrom_netlabel(iscsid_t)
+corenet_tcp_sendrecv_generic_if(iscsid_t)
+corenet_tcp_sendrecv_generic_node(iscsid_t)
+
+corenet_sendrecv_http_client_packets(iscsid_t)
+corenet_tcp_connect_http_port(iscsid_t)
+corenet_tcp_sendrecv_http_port(iscsid_t)
+
+corenet_sendrecv_iscsi_client_packets(iscsid_t)
+corenet_tcp_connect_iscsi_port(iscsid_t)
+corenet_tcp_sendrecv_iscsi_port(iscsid_t)
+
+corenet_sendrecv_isns_client_packets(iscsid_t)
+corenet_tcp_connect_isns_port(iscsid_t)
+corenet_tcp_sendrecv_isns_port(iscsid_t)
+
+dev_read_raw_memory(iscsid_t)
+dev_rw_sysfs(iscsid_t)
+dev_rw_userio_dev(iscsid_t)
+dev_write_raw_memory(iscsid_t)
+
+domain_use_interactive_fds(iscsid_t)
+domain_dontaudit_read_all_domains_state(iscsid_t)
+
+auth_use_nsswitch(iscsid_t)
+
+init_stream_connect_script(iscsid_t)
+
+logging_send_syslog_msg(iscsid_t)
+
+miscfiles_read_localization(iscsid_t)
+
+optional_policy(`
+	tgtd_manage_semaphores(iscsid_t)
+')
diff --git a/policy/modules/system/pcmcia.fc b/policy/modules/system/pcmcia.fc
new file mode 100644
index 000000000..f9fadf5f3
--- /dev/null
+++ b/policy/modules/system/pcmcia.fc
@@ -0,0 +1,12 @@
+/etc/apm/event\.d/pcmcia	--	gen_context(system_u:object_r:cardmgr_exec_t,s0)
+
+/usr/bin/cardctl	--	gen_context(system_u:object_r:cardctl_exec_t,s0)
+/usr/bin/cardmgr	--	gen_context(system_u:object_r:cardmgr_exec_t,s0)
+
+/usr/sbin/cardctl	--	gen_context(system_u:object_r:cardctl_exec_t,s0)
+/usr/sbin/cardmgr	--	gen_context(system_u:object_r:cardmgr_exec_t,s0)
+
+/var/lib/pcmcia(/.*)?	gen_context(system_u:object_r:cardmgr_var_run_t,s0)
+
+/run/cardmgr\.pid	--	gen_context(system_u:object_r:cardmgr_var_run_t,s0)
+/run/stab	--	gen_context(system_u:object_r:cardmgr_var_run_t,s0)
diff --git a/policy/modules/system/pcmcia.if b/policy/modules/system/pcmcia.if
new file mode 100644
index 000000000..965b4086f
--- /dev/null
+++ b/policy/modules/system/pcmcia.if
@@ -0,0 +1,159 @@
+## <summary>PCMCIA card management services.</summary>
+
+########################################
+## <summary>
+##	PCMCIA stub interface.  No access allowed.
+## </summary>
+## <param name="domain" unused="true">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pcmcia_stub',`
+	gen_require(`
+		type cardmgr_t;
+	')
+')
+
+########################################
+## <summary>
+##	Execute cardmgr in the cardmgr domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`pcmcia_domtrans_cardmgr',`
+	gen_require(`
+		type cardmgr_t, cardmgr_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, cardmgr_exec_t, cardmgr_t)
+')
+
+########################################
+## <summary>
+##	Inherit and use cardmgr file descriptors.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pcmcia_use_cardmgr_fds',`
+	gen_require(`
+		type cardmgr_t;
+	')
+
+	allow $1 cardmgr_t:fd use;
+')
+
+########################################
+## <summary>
+##	Execute cardctl in the cardmgr domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`pcmcia_domtrans_cardctl',`
+	gen_require(`
+		type cardmgr_t, cardctl_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, cardctl_exec_t, cardmgr_t)
+')
+
+########################################
+## <summary>
+##	Execute cardctl in the cardmgr
+##	domain, and allow the specified
+##	role the cardmgr domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`pcmcia_run_cardctl',`
+	gen_require(`
+		attribute_role cardmgr_roles;
+	')
+
+	pcmcia_domtrans_cardctl($1)
+	roleattribute $2 cardmgr_roles;
+')
+
+########################################
+## <summary>
+##	Read cardmgr pid files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pcmcia_read_pid',`
+	gen_require(`
+		type cardmgr_var_run_t;
+	')
+
+	files_search_pids($1)
+	read_files_pattern($1, cardmgr_var_run_t, cardmgr_var_run_t)
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete
+##	cardmgr pid files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pcmcia_manage_pid',`
+	gen_require(`
+		type cardmgr_var_run_t;
+	')
+
+	files_search_pids($1)
+	manage_files_pattern($1, cardmgr_var_run_t, cardmgr_var_run_t)
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete
+##	cardmgr runtime character nodes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pcmcia_manage_pid_chr_files',`
+	gen_require(`
+		type cardmgr_var_run_t;
+	')
+
+	files_search_pids($1)
+	manage_chr_files_pattern($1, cardmgr_var_run_t, cardmgr_var_run_t)
+')
diff --git a/policy/modules/system/pcmcia.te b/policy/modules/system/pcmcia.te
new file mode 100644
index 000000000..9074bcbd0
--- /dev/null
+++ b/policy/modules/system/pcmcia.te
@@ -0,0 +1,121 @@
+policy_module(pcmcia, 1.9.0)
+
+########################################
+#
+# Declarations
+#
+
+attribute_role cardmgr_roles;
+
+type cardmgr_t;
+type cardmgr_exec_t;
+init_daemon_domain(cardmgr_t, cardmgr_exec_t)
+
+type cardmgr_lnk_t;
+files_type(cardmgr_lnk_t)
+
+type cardmgr_var_lib_t;
+files_type(cardmgr_var_lib_t)
+
+type cardmgr_var_run_t;
+files_pid_file(cardmgr_var_run_t)
+
+type cardctl_exec_t;
+application_domain(cardmgr_t, cardctl_exec_t)
+role cardmgr_roles types cardmgr_t;
+
+########################################
+#
+# Local policy
+#
+
+allow cardmgr_t self:capability { dac_override dac_read_search mknod net_admin setuid sys_admin sys_nice sys_tty_config };
+dontaudit cardmgr_t self:capability sys_tty_config;
+allow cardmgr_t self:process signal_perms;
+allow cardmgr_t self:fifo_file rw_fifo_file_perms;
+allow cardmgr_t self:unix_stream_socket { accept listen };
+
+allow cardmgr_t cardmgr_lnk_t:lnk_file manage_lnk_file_perms;
+dev_filetrans(cardmgr_t, cardmgr_lnk_t, lnk_file)
+
+manage_files_pattern(cardmgr_t, cardmgr_var_lib_t, cardmgr_var_lib_t)
+files_var_lib_filetrans(cardmgr_t, cardmgr_var_lib_t, file)
+
+allow cardmgr_t cardmgr_var_run_t:file manage_file_perms;
+files_pid_filetrans(cardmgr_t, cardmgr_var_run_t, file)
+
+kernel_read_kernel_sysctls(cardmgr_t)
+kernel_read_system_state(cardmgr_t)
+kernel_dontaudit_getattr_message_if(cardmgr_t)
+
+corecmd_exec_all_executables(cardmgr_t)
+
+dev_getattr_all_chr_files(cardmgr_t)
+dev_getattr_all_blk_files(cardmgr_t)
+dev_filetrans_cardmgr(cardmgr_t)
+dev_manage_cardmgr_dev(cardmgr_t)
+dev_read_sysfs(cardmgr_t)
+dev_read_urand(cardmgr_t)
+
+domain_getattr_confined_domains(cardmgr_t)
+domain_read_confined_domains_state(cardmgr_t)
+domain_use_interactive_fds(cardmgr_t)
+domain_dontaudit_ptrace_confined_domains(cardmgr_t)
+domain_dontaudit_getattr_all_pipes(cardmgr_t)
+domain_dontaudit_getattr_all_sockets(cardmgr_t)
+
+files_exec_etc_files(cardmgr_t)
+files_list_usr(cardmgr_t)
+files_read_etc_runtime_files(cardmgr_t)
+files_read_var_lib_files(cardmgr_t)
+files_search_kernel_modules(cardmgr_t)
+files_search_home(cardmgr_t)
+files_dontaudit_getattr_all_dirs(cardmgr_t)
+files_dontaudit_getattr_all_files(cardmgr_t)
+files_dontaudit_getattr_all_symlinks(cardmgr_t)
+files_dontaudit_getattr_all_pipes(cardmgr_t)
+files_dontaudit_getattr_all_sockets(cardmgr_t)
+
+fs_getattr_all_fs(cardmgr_t)
+fs_search_auto_mountpoints(cardmgr_t)
+
+term_use_unallocated_ttys(cardmgr_t)
+term_getattr_all_ttys(cardmgr_t)
+term_dontaudit_getattr_all_ptys(cardmgr_t)
+
+libs_exec_ld_so(cardmgr_t)
+libs_exec_lib_files(cardmgr_t)
+
+logging_send_syslog_msg(cardmgr_t)
+
+miscfiles_read_localization(cardmgr_t)
+
+modutils_domtrans(cardmgr_t)
+
+sysnet_domtrans_ifconfig(cardmgr_t)
+sysnet_etc_filetrans_config(cardmgr_t)
+sysnet_manage_config(cardmgr_t)
+
+userdom_use_user_terminals(cardmgr_t)
+userdom_dontaudit_use_unpriv_user_fds(cardmgr_t)
+userdom_dontaudit_search_user_home_dirs(cardmgr_t)
+
+optional_policy(`
+	seutil_dontaudit_read_config(cardmgr_t)
+	seutil_sigchld_newrole(cardmgr_t)
+')
+
+optional_policy(`
+	sysnet_domtrans_dhcpc(cardmgr_t)
+	sysnet_read_dhcpc_pid(cardmgr_t)
+	sysnet_delete_dhcpc_pid(cardmgr_t)
+	sysnet_kill_dhcpc(cardmgr_t)
+	sysnet_sigchld_dhcpc(cardmgr_t)
+	sysnet_signal_dhcpc(cardmgr_t)
+	sysnet_signull_dhcpc(cardmgr_t)
+	sysnet_sigstop_dhcpc(cardmgr_t)
+')
+
+optional_policy(`
+	udev_read_db(cardmgr_t)
+')
diff --git a/policy/modules/system/raid.fc b/policy/modules/system/raid.fc
new file mode 100644
index 000000000..323a88652
--- /dev/null
+++ b/policy/modules/system/raid.fc
@@ -0,0 +1,26 @@
+/dev/\.mdadm\.map	--	gen_context(system_u:object_r:mdadm_var_run_t,s0)
+/dev/md/.*	--	gen_context(system_u:object_r:mdadm_var_run_t,s0)
+
+/etc/rc\.d/init\.d/mdmonitor	--	gen_context(system_u:object_r:mdadm_initrc_exec_t,s0)
+
+/usr/bin/iprdump	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+/usr/bin/iprinit	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+/usr/bin/iprupdate	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+/usr/bin/mdadm	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+/usr/bin/mdmon	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+/usr/bin/mdmpd	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+/usr/bin/raid-check	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+
+# Systemd unit files
+/usr/lib/systemd/system/[^/]*mdadm-.*	--	gen_context(system_u:object_r:mdadm_unit_t,s0)
+/usr/lib/systemd/system/[^/]*mdmon.*	--	gen_context(system_u:object_r:mdadm_unit_t,s0)
+
+/usr/sbin/iprdump	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+/usr/sbin/iprinit	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+/usr/sbin/iprupdate	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+/usr/sbin/mdadm	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+/usr/sbin/mdmon	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+/usr/sbin/mdmpd	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+/usr/sbin/raid-check	--	gen_context(system_u:object_r:mdadm_exec_t,s0)
+
+/run/mdadm(/.*)?	gen_context(system_u:object_r:mdadm_var_run_t,s0)
diff --git a/policy/modules/system/raid.if b/policy/modules/system/raid.if
new file mode 100644
index 000000000..091c805ed
--- /dev/null
+++ b/policy/modules/system/raid.if
@@ -0,0 +1,98 @@
+## <summary>RAID array management tools.</summary>
+
+########################################
+## <summary>
+##	Execute software raid tools in
+##	the mdadm domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`raid_domtrans_mdadm',`
+	gen_require(`
+		type mdadm_t, mdadm_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, mdadm_exec_t, mdadm_t)
+')
+
+######################################
+## <summary>
+##	Execute mdadm in the mdadm
+##	domain, and allow the specified
+##	role the mdadm domain.
+## </summary>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`raid_run_mdadm',`
+	gen_require(`
+		attribute_role mdadm_roles;
+	')
+
+	raid_domtrans_mdadm($2)
+	roleattribute $1 mdadm_roles;
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete
+##	mdadm pid files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`raid_manage_mdadm_pid',`
+	gen_require(`
+		type mdadm_var_run_t;
+	')
+
+	files_search_pids($1)
+	allow $1 mdadm_var_run_t:file manage_file_perms;
+')
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an mdadm environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`raid_admin_mdadm',`
+	gen_require(`
+		type mdadm_t, mdadm_initrc_exec_t, mdadm_var_run_t;
+	')
+
+	allow $1 mdadm_t:process { ptrace signal_perms };
+	ps_process_pattern($1, mdadm_t)
+
+	init_startstop_service($1, $2, mdadm_t, mdadm_initrc_exec_t)
+
+	files_search_pids($1)
+	admin_pattern($1, mdadm_var_run_t)
+')
diff --git a/policy/modules/system/raid.te b/policy/modules/system/raid.te
new file mode 100644
index 000000000..4b9a6af1d
--- /dev/null
+++ b/policy/modules/system/raid.te
@@ -0,0 +1,110 @@
+policy_module(raid, 1.18.0)
+
+########################################
+#
+# Declarations
+#
+
+attribute_role mdadm_roles;
+
+type mdadm_t;
+type mdadm_exec_t;
+init_daemon_domain(mdadm_t, mdadm_exec_t)
+role mdadm_roles types mdadm_t;
+
+type mdadm_initrc_exec_t;
+init_script_file(mdadm_initrc_exec_t)
+
+type mdadm_unit_t;
+init_unit_file(mdadm_unit_t)
+
+type mdadm_var_run_t alias mdadm_map_t;
+files_pid_file(mdadm_var_run_t)
+dev_associate(mdadm_var_run_t)
+
+########################################
+#
+# Local policy
+#
+
+allow mdadm_t self:capability { dac_override ipc_lock sys_admin };
+dontaudit mdadm_t self:capability sys_tty_config;
+allow mdadm_t self:process { getsched setsched signal_perms };
+allow mdadm_t self:fifo_file rw_fifo_file_perms;
+allow mdadm_t self:netlink_kobject_uevent_socket create_socket_perms;
+
+manage_dirs_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)
+manage_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)
+manage_lnk_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)
+manage_sock_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)
+dev_filetrans(mdadm_t, mdadm_var_run_t, file)
+files_pid_filetrans(mdadm_t, mdadm_var_run_t, { dir file })
+
+kernel_getattr_core_if(mdadm_t)
+kernel_read_system_state(mdadm_t)
+kernel_read_kernel_sysctls(mdadm_t)
+kernel_request_load_module(mdadm_t)
+kernel_rw_software_raid_state(mdadm_t)
+
+corecmd_exec_bin(mdadm_t)
+corecmd_exec_shell(mdadm_t)
+
+dev_rw_sysfs(mdadm_t)
+dev_dontaudit_getattr_all_blk_files(mdadm_t)
+dev_dontaudit_getattr_all_chr_files(mdadm_t)
+dev_read_realtime_clock(mdadm_t)
+dev_read_raw_memory(mdadm_t)
+
+domain_use_interactive_fds(mdadm_t)
+
+files_read_etc_files(mdadm_t)
+files_read_etc_runtime_files(mdadm_t)
+files_dontaudit_getattr_all_files(mdadm_t)
+
+fs_getattr_all_fs(mdadm_t)
+fs_list_auto_mountpoints(mdadm_t)
+fs_list_hugetlbfs(mdadm_t)
+fs_read_efivarfs_files(mdadm_t)
+fs_rw_cgroup_files(mdadm_t)
+fs_dontaudit_list_tmpfs(mdadm_t)
+
+mls_file_read_all_levels(mdadm_t)
+mls_file_write_all_levels(mdadm_t)
+
+storage_dev_filetrans_fixed_disk(mdadm_t)
+storage_manage_fixed_disk(mdadm_t)
+storage_read_scsi_generic(mdadm_t)
+storage_write_scsi_generic(mdadm_t)
+
+term_dontaudit_list_ptys(mdadm_t)
+term_dontaudit_use_unallocated_ttys(mdadm_t)
+
+init_dontaudit_getattr_initctl(mdadm_t)
+
+logging_send_syslog_msg(mdadm_t)
+
+miscfiles_read_localization(mdadm_t)
+
+userdom_dontaudit_use_unpriv_user_fds(mdadm_t)
+userdom_dontaudit_search_user_home_content(mdadm_t)
+userdom_dontaudit_use_user_terminals(mdadm_t)
+
+optional_policy(`
+	cron_system_entry(mdadm_t, mdadm_exec_t)
+')
+
+optional_policy(`
+	gpm_dontaudit_getattr_gpmctl(mdadm_t)
+')
+
+optional_policy(`
+	mta_send_mail(mdadm_t)
+')
+
+optional_policy(`
+	seutil_sigchld_newrole(mdadm_t)
+')
+
+optional_policy(`
+	udev_read_db(mdadm_t)
+')
diff --git a/policy/modules/system/xen.fc b/policy/modules/system/xen.fc
new file mode 100644
index 000000000..ac5439f98
--- /dev/null
+++ b/policy/modules/system/xen.fc
@@ -0,0 +1,51 @@
+/dev/xen/tapctrl.*	-p	gen_context(system_u:object_r:xenctl_t,s0)
+
+/usr/lib/xen-[^/]*/bin/xenconsoled	--	gen_context(system_u:object_r:xenconsoled_exec_t,s0)
+/usr/lib/xen-[^/]*/bin/xend	--	gen_context(system_u:object_r:xend_exec_t,s0)
+/usr/lib/xen-[^/]*/bin/xenstored	--	gen_context(system_u:object_r:xenstored_exec_t,s0)
+/usr/lib/xen-[^/]*/bin/xl	--	gen_context(system_u:object_r:xm_exec_t,s0)
+/usr/lib/xen-[^/]*/bin/xm	--	gen_context(system_u:object_r:xm_exec_t,s0)
+/usr/lib/xen-[^/]*/xl --	gen_context(system_u:object_r:xm_exec_t,s0)
+
+/usr/bin/blktapctrl	--	gen_context(system_u:object_r:blktap_exec_t,s0)
+/usr/bin/evtchnd	--	gen_context(system_u:object_r:evtchnd_exec_t,s0)
+/usr/bin/tapdisk	--	gen_context(system_u:object_r:blktap_exec_t,s0)
+/usr/bin/xenconsoled	--	gen_context(system_u:object_r:xenconsoled_exec_t,s0)
+/usr/bin/xend	--	gen_context(system_u:object_r:xend_exec_t,s0)
+/usr/bin/xenstored	--	gen_context(system_u:object_r:xenstored_exec_t,s0)
+/usr/bin/xl	--	gen_context(system_u:object_r:xm_exec_t,s0)
+/usr/bin/xm	--	gen_context(system_u:object_r:xm_exec_t,s0)
+
+/usr/sbin/blktapctrl	--	gen_context(system_u:object_r:blktap_exec_t,s0)
+/usr/sbin/evtchnd	--	gen_context(system_u:object_r:evtchnd_exec_t,s0)
+/usr/sbin/tapdisk	--	gen_context(system_u:object_r:blktap_exec_t,s0)
+/usr/sbin/xenconsoled	--	gen_context(system_u:object_r:xenconsoled_exec_t,s0)
+/usr/sbin/xend	--	gen_context(system_u:object_r:xend_exec_t,s0)
+/usr/sbin/xenstored	--	gen_context(system_u:object_r:xenstored_exec_t,s0)
+/usr/sbin/xl	--	gen_context(system_u:object_r:xm_exec_t,s0)
+/usr/sbin/xm	--	gen_context(system_u:object_r:xm_exec_t,s0)
+
+/var/lib/xen(/.*)?	gen_context(system_u:object_r:xend_var_lib_t,s0)
+/var/lib/xen/images(/.*)?	gen_context(system_u:object_r:xen_image_t,s0)
+/var/lib/xend(/.*)?	gen_context(system_u:object_r:xend_var_lib_t,s0)
+/var/lib/xenstored(/.*)?	gen_context(system_u:object_r:xenstored_var_lib_t,s0)
+
+/var/lock/xl	--	gen_context(system_u:object_r:xen_lock_t,s0)
+
+/var/log/evtchnd\.log.*	--	gen_context(system_u:object_r:evtchnd_var_log_t,s0)
+/var/log/xen(/.*)?	gen_context(system_u:object_r:xend_var_log_t,s0)
+/var/log/xen-hotplug\.log.*	--	gen_context(system_u:object_r:xend_var_log_t,s0)
+/var/log/xend\.log.*	--	gen_context(system_u:object_r:xend_var_log_t,s0)
+/var/log/xend-debug\.log.*	--	gen_context(system_u:object_r:xend_var_log_t,s0)
+
+/run/evtchnd	-s	gen_context(system_u:object_r:evtchnd_var_run_t,s0)
+/run/evtchnd\.pid	--	gen_context(system_u:object_r:evtchnd_var_run_t,s0)
+/run/xenconsoled\.pid	--	gen_context(system_u:object_r:xenconsoled_var_run_t,s0)
+/run/xend(/.*)?	gen_context(system_u:object_r:xend_var_run_t,s0)
+/run/xen		-d	gen_context(system_u:object_r:xend_var_run_t,s0)
+/run/xend\.pid	--	gen_context(system_u:object_r:xend_var_run_t,s0)
+/run/xenner(/.*)?	gen_context(system_u:object_r:xend_var_run_t,s0)
+/run/xenstore\.pid	--	gen_context(system_u:object_r:xenstored_var_run_t,s0)
+/run/xenstored(/.*)?	gen_context(system_u:object_r:xenstored_var_run_t,s0)
+
+/xen(/.*)?	gen_context(system_u:object_r:xen_image_t,s0)
diff --git a/policy/modules/system/xen.if b/policy/modules/system/xen.if
new file mode 100644
index 000000000..441162920
--- /dev/null
+++ b/policy/modules/system/xen.if
@@ -0,0 +1,325 @@
+## <summary>Xen hypervisor.</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run xend.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`xen_domtrans',`
+	gen_require(`
+		type xend_t, xend_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, xend_exec_t, xend_t)
+')
+
+########################################
+## <summary>
+##	Execute xend in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xen_exec',`
+	gen_require(`
+		type xend_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, xend_exec_t)
+')
+
+########################################
+## <summary>
+##	Inherit and use xen file descriptors.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xen_use_fds',`
+	gen_require(`
+		type xend_t;
+	')
+
+	allow $1 xend_t:fd use;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to inherit
+##	xen file descriptors.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`xen_dontaudit_use_fds',`
+	gen_require(`
+		type xend_t;
+	')
+
+	dontaudit $1 xend_t:fd use;
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete
+##	xend image directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xen_manage_image_dirs',`
+	gen_require(`
+		type xend_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	manage_dirs_pattern($1, xend_var_lib_t, xend_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Read xend image files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xen_read_image_files',`
+	gen_require(`
+		type xen_image_t, xend_var_lib_t;
+	')
+
+	files_list_var_lib($1)
+	list_dirs_pattern($1, xend_var_lib_t, xend_var_lib_t)
+	read_files_pattern($1, { xend_var_lib_t xen_image_t }, xen_image_t)
+')
+
+########################################
+## <summary>
+##	Read and write xend image files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xen_rw_image_files',`
+	gen_require(`
+		type xen_image_t, xend_var_lib_t;
+	')
+
+	files_list_var_lib($1)
+	allow $1 xend_var_lib_t:dir search_dir_perms;
+	rw_files_pattern($1, xen_image_t, xen_image_t)
+')
+
+########################################
+## <summary>
+##	Append xend log files.
+## </summary>
+## <param name="domain">
+## 	<summary>
+##	Domain allowed access.
+## 	</summary>
+## </param>
+#
+interface(`xen_append_log',`
+	gen_require(`
+		type xend_var_log_t;
+	')
+
+	logging_search_logs($1)
+	append_files_pattern($1, xend_var_log_t, xend_var_log_t)
+	dontaudit $1 xend_var_log_t:file write;
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete
+##	xend log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xen_manage_log',`
+	gen_require(`
+		type xend_var_log_t;
+	')
+
+	logging_search_logs($1)
+	manage_dirs_pattern($1, xend_var_log_t, xend_var_log_t)
+	manage_files_pattern($1, xend_var_log_t, xend_var_log_t)
+')
+
+#######################################
+## <summary>
+##	Read xenstored pid files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xen_read_xenstored_pid_files',`
+	gen_require(`
+		type xenstored_var_run_t;
+	')
+
+	files_search_pids($1)
+	read_files_pattern($1, xenstored_var_run_t, xenstored_var_run_t)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read and write
+##	Xen unix domain stream sockets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`xen_dontaudit_rw_unix_stream_sockets',`
+	gen_require(`
+		type xend_t;
+	')
+
+	dontaudit $1 xend_t:unix_stream_socket { read write };
+')
+
+########################################
+## <summary>
+##	Connect to xenstored with a unix
+##	domain stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xen_stream_connect_xenstore',`
+	gen_require(`
+		type xenstored_t, xenstored_var_run_t;
+	')
+
+	files_search_pids($1)
+	stream_connect_pattern($1, xenstored_var_run_t, xenstored_var_run_t, xenstored_t)
+')
+
+########################################
+## <summary>
+##	Connect to xend with a unix
+##	domain stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xen_stream_connect',`
+	gen_require(`
+		type xend_t, xend_var_run_t, xend_var_lib_t;
+	')
+
+	files_search_pids($1)
+	stream_connect_pattern($1, xend_var_run_t, xend_var_run_t, xend_t)
+
+	files_search_var_lib($1)
+	stream_connect_pattern($1, xend_var_lib_t, xend_var_lib_t, xend_t)
+')
+
+########################################
+## <summary>
+##	Create in a xend_var_run_t directory
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="private type">
+##      <summary>
+##      The type of the object to be created.
+##      </summary>
+## </param>
+## <param name="object">
+##      <summary>
+##      The object class of the object being created.
+##      </summary>
+## </param>
+#
+interface(`xen_pid_filetrans',`
+	gen_require(`
+		type xend_var_run_t;
+	')
+
+	filetrans_pattern($1, xend_var_run_t, $2, $3)
+')
+
+########################################
+## <summary>
+##	Execute a domain transition to run xm.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`xen_domtrans_xm',`
+	gen_require(`
+		type xm_t, xm_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, xm_exec_t, xm_t)
+')
+
+########################################
+## <summary>
+##	Connect to xm with a unix
+##	domain stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xen_stream_connect_xm',`
+	gen_require(`
+		type xm_t;
+	')
+
+	files_search_pids($1)
+	stream_connect_pattern($1, xenstored_var_run_t, xenstored_var_run_t, xm_t)
+')
diff --git a/policy/modules/system/xen.te b/policy/modules/system/xen.te
new file mode 100644
index 000000000..04dd1ea74
--- /dev/null
+++ b/policy/modules/system/xen.te
@@ -0,0 +1,642 @@
+policy_module(xen, 1.16.0)
+
+########################################
+#
+# Declarations
+#
+
+## <desc>
+##	<p>
+##	Determine whether xend can
+##	run blktapctrl and tapdisk.
+## </p>
+## </desc>
+gen_tunable(xend_run_blktap, false)
+
+## <desc>
+##	<p>
+##	Determine whether xen can
+##	use fusefs file systems.
+##	</p>
+## </desc>
+gen_tunable(xen_use_fusefs, false)
+
+## <desc>
+##	<p>
+##	Determine whether xen can
+##	use nfs file systems.
+##	</p>
+## </desc>
+gen_tunable(xen_use_nfs, false)
+
+## <desc>
+##	<p>
+##	Determine whether xen can
+##	use samba file systems.
+##	</p>
+## </desc>
+gen_tunable(xen_use_samba, false)
+
+type blktap_t;
+type blktap_exec_t;
+domain_type(blktap_t)
+domain_entry_file(blktap_t, blktap_exec_t)
+role system_r types blktap_t;
+
+type blktap_var_run_t;
+files_pid_file(blktap_var_run_t)
+
+type evtchnd_t;
+type evtchnd_exec_t;
+init_daemon_domain(evtchnd_t, evtchnd_exec_t)
+
+type evtchnd_var_log_t;
+logging_log_file(evtchnd_var_log_t)
+
+type evtchnd_var_run_t;
+files_pid_file(evtchnd_var_run_t)
+
+type xen_devpts_t;
+term_pty(xen_devpts_t)
+files_type(xen_devpts_t)
+
+type xen_image_t; # customizable
+files_type(xen_image_t)
+dev_node(xen_image_t)
+
+optional_policy(`
+	virt_image(xen_image_t)
+')
+
+type xenctl_t;
+files_type(xenctl_t)
+
+type xend_t;
+type xend_exec_t;
+init_daemon_domain(xend_t, xend_exec_t)
+
+type xen_lock_t;
+files_lock_file(xen_lock_t)
+
+type xend_tmp_t;
+files_tmp_file(xend_tmp_t)
+
+type xend_var_lib_t;
+files_type(xend_var_lib_t)
+files_mountpoint(xend_var_lib_t)
+
+type xend_var_log_t;
+logging_log_file(xend_var_log_t)
+
+type xend_var_run_t;
+files_pid_file(xend_var_run_t)
+files_mountpoint(xend_var_run_t)
+
+type xenstored_t;
+type xenstored_exec_t;
+init_daemon_domain(xenstored_t, xenstored_exec_t)
+
+type xenstored_tmp_t;
+files_tmp_file(xenstored_tmp_t)
+
+type xenstored_var_lib_t;
+files_type(xenstored_var_lib_t)
+files_mountpoint(xenstored_var_lib_t)
+
+type xenstored_var_log_t;
+logging_log_file(xenstored_var_log_t)
+
+type xenstored_var_run_t;
+files_pid_file(xenstored_var_run_t)
+init_daemon_pid_file(xenstored_var_run_t, dir, "xenstored")
+
+type xenconsoled_t;
+type xenconsoled_exec_t;
+init_daemon_domain(xenconsoled_t, xenconsoled_exec_t)
+
+type xenconsoled_var_run_t;
+files_pid_file(xenconsoled_var_run_t)
+
+type xm_t;
+type xm_exec_t;
+init_system_domain(xm_t, xm_exec_t)
+
+########################################
+#
+# blktap local policy
+#
+
+tunable_policy(`xend_run_blktap',`
+	domtrans_pattern(xend_t, blktap_exec_t, blktap_t)
+
+	allow blktap_t self:fifo_file { read write };
+
+	dev_read_sysfs(blktap_t)
+	dev_rw_xen(blktap_t)
+
+	files_read_etc_files(blktap_t)
+
+	logging_send_syslog_msg(blktap_t)
+
+	miscfiles_read_localization(blktap_t)
+
+	xen_stream_connect_xenstore(blktap_t)
+',`
+	dontaudit xend_t blktap_exec_t:file { execute execute_no_trans };
+')
+
+#######################################
+#
+# evtchnd local policy
+#
+
+manage_dirs_pattern(evtchnd_t, evtchnd_var_log_t, evtchnd_var_log_t)
+append_files_pattern(evtchnd_t, evtchnd_var_log_t, evtchnd_var_log_t)
+create_files_pattern(evtchnd_t, evtchnd_var_log_t, evtchnd_var_log_t)
+setattr_files_pattern(evtchnd_t, evtchnd_var_log_t, evtchnd_var_log_t)
+logging_log_filetrans(evtchnd_t, evtchnd_var_log_t, { file dir })
+
+manage_dirs_pattern(evtchnd_t, evtchnd_var_run_t, evtchnd_var_run_t)
+manage_files_pattern(evtchnd_t, evtchnd_var_run_t, evtchnd_var_run_t)
+manage_sock_files_pattern(evtchnd_t, evtchnd_var_run_t, evtchnd_var_run_t)
+files_pid_filetrans(evtchnd_t, evtchnd_var_run_t, { file sock_file dir })
+
+########################################
+#
+# xend local policy
+#
+
+allow xend_t self:capability { dac_override ipc_lock net_admin net_raw setuid sys_admin sys_nice sys_rawio sys_resource sys_tty_config };
+dontaudit xend_t self:capability { sys_ptrace };
+allow xend_t self:process { setrlimit signal sigkill };
+dontaudit xend_t self:process ptrace;
+allow xend_t self:fifo_file rw_fifo_file_perms;
+allow xend_t self:unix_stream_socket { accept listen };
+allow xend_t self:tcp_socket { accept listen };
+allow xend_t self:packet_socket create_socket_perms;
+allow xend_t self:tun_socket create_socket_perms;
+
+allow xend_t xen_image_t:dir list_dir_perms;
+manage_dirs_pattern(xend_t, xen_image_t, xen_image_t)
+manage_fifo_files_pattern(xend_t, xen_image_t, xen_image_t)
+manage_files_pattern(xend_t, xen_image_t, xen_image_t)
+read_lnk_files_pattern(xend_t, xen_image_t, xen_image_t)
+read_sock_files_pattern(xend_t, xen_image_t, xen_image_t)
+rw_chr_files_pattern(xend_t, xen_image_t, xen_image_t)
+rw_blk_files_pattern(xend_t, xen_image_t, xen_image_t)
+fs_hugetlbfs_filetrans(xend_t, xen_image_t, file)
+
+allow xend_t xenctl_t:fifo_file manage_fifo_file_perms;
+dev_filetrans(xend_t, xenctl_t, fifo_file)
+
+manage_files_pattern(xend_t, xend_tmp_t, xend_tmp_t)
+manage_dirs_pattern(xend_t, xend_tmp_t, xend_tmp_t)
+files_tmp_filetrans(xend_t, xend_tmp_t, { file dir })
+
+manage_dirs_pattern(xend_t, xend_var_run_t, xend_var_run_t)
+manage_files_pattern(xend_t, xend_var_run_t, xend_var_run_t)
+manage_sock_files_pattern(xend_t, xend_var_run_t, xend_var_run_t)
+manage_fifo_files_pattern(xend_t, xend_var_run_t, xend_var_run_t)
+files_pid_filetrans(xend_t, xend_var_run_t, { file sock_file fifo_file dir })
+
+manage_dirs_pattern(xend_t, xend_var_log_t, xend_var_log_t)
+append_files_pattern(xend_t, xend_var_log_t, xend_var_log_t)
+create_files_pattern(xend_t, xend_var_log_t, xend_var_log_t)
+setattr_files_pattern(xend_t, xend_var_log_t, xend_var_log_t)
+manage_sock_files_pattern(xend_t, xend_var_log_t, xend_var_log_t)
+logging_log_filetrans(xend_t, xend_var_log_t, { sock_file file dir })
+
+manage_dirs_pattern(xend_t, xend_var_lib_t, xend_var_lib_t)
+manage_files_pattern(xend_t, xend_var_lib_t, xend_var_lib_t)
+manage_sock_files_pattern(xend_t, xend_var_lib_t, xend_var_lib_t)
+manage_fifo_files_pattern(xend_t, xend_var_lib_t, xend_var_lib_t)
+files_var_lib_filetrans(xend_t, xend_var_lib_t, { file dir })
+
+manage_files_pattern(xend_t, xenstored_var_run_t, xenstored_var_run_t)
+
+allow xend_t xenstored_var_lib_t:dir list_dir_perms;
+
+domtrans_pattern(xend_t, xenconsoled_exec_t, xenconsoled_t)
+domtrans_pattern(xend_t, xenstored_exec_t, xenstored_t)
+
+xen_stream_connect_xenstore(xend_t)
+
+kernel_read_kernel_sysctls(xend_t)
+kernel_read_system_state(xend_t)
+kernel_write_xen_state(xend_t)
+kernel_read_xen_state(xend_t)
+kernel_rw_net_sysctls(xend_t)
+kernel_read_network_state(xend_t)
+kernel_read_vm_sysctls(xend_t)
+
+corecmd_exec_bin(xend_t)
+corecmd_exec_shell(xend_t)
+
+corenet_all_recvfrom_unlabeled(xend_t)
+corenet_all_recvfrom_netlabel(xend_t)
+corenet_tcp_sendrecv_generic_if(xend_t)
+corenet_tcp_sendrecv_generic_node(xend_t)
+corenet_tcp_sendrecv_all_ports(xend_t)
+corenet_tcp_bind_generic_node(xend_t)
+
+corenet_sendrecv_xen_server_packets(xend_t)
+corenet_tcp_bind_xen_port(xend_t)
+
+corenet_sendrecv_soundd_server_packets(xend_t)
+corenet_tcp_bind_soundd_port(xend_t)
+
+corenet_sendrecv_generic_server_packets(xend_t)
+corenet_tcp_bind_generic_port(xend_t)
+
+corenet_sendrecv_vnc_server_packets(xend_t)
+corenet_tcp_bind_vnc_port(xend_t)
+
+corenet_sendrecv_xserver_client_packets(xend_t)
+corenet_tcp_connect_xserver_port(xend_t)
+
+corenet_sendrecv_xen_client_packets(xend_t)
+corenet_tcp_connect_xen_port(xend_t)
+
+corenet_rw_tun_tap_dev(xend_t)
+
+dev_getattr_all_chr_files(xend_t)
+dev_read_urand(xend_t)
+dev_filetrans_xen(xend_t)
+dev_rw_sysfs(xend_t)
+dev_rw_xen(xend_t)
+
+domain_dontaudit_read_all_domains_state(xend_t)
+domain_dontaudit_ptrace_all_domains(xend_t)
+
+files_read_etc_files(xend_t)
+files_read_kernel_symbol_table(xend_t)
+files_read_kernel_img(xend_t)
+files_manage_etc_runtime_files(xend_t)
+files_etc_filetrans_etc_runtime(xend_t, file)
+files_read_usr_files(xend_t)
+files_read_default_symlinks(xend_t)
+files_search_mnt(xend_t)
+
+fs_getattr_all_fs(xend_t)
+fs_list_auto_mountpoints(xend_t)
+fs_read_dos_files(xend_t)
+fs_read_removable_blk_files(xend_t)
+fs_manage_xenfs_dirs(xend_t)
+fs_manage_xenfs_files(xend_t)
+
+storage_read_scsi_generic(xend_t)
+# for lsscsi
+storage_getattr_fixed_disk_dev(xend_t)
+
+term_setattr_generic_ptys(xend_t)
+term_getattr_all_ptys(xend_t)
+term_setattr_all_ptys(xend_t)
+term_use_generic_ptys(xend_t)
+term_use_ptmx(xend_t)
+term_getattr_pty_fs(xend_t)
+
+init_stream_connect_script(xend_t)
+
+locallogin_dontaudit_use_fds(xend_t)
+
+logging_send_syslog_msg(xend_t)
+
+miscfiles_read_localization(xend_t)
+miscfiles_read_hwdata(xend_t)
+
+sysnet_domtrans_dhcpc(xend_t)
+sysnet_signal_dhcpc(xend_t)
+sysnet_domtrans_ifconfig(xend_t)
+sysnet_dns_name_resolve(xend_t)
+sysnet_delete_dhcpc_pid(xend_t)
+sysnet_read_dhcpc_pid(xend_t)
+sysnet_rw_dhcp_config(xend_t)
+
+userdom_dontaudit_search_user_home_dirs(xend_t)
+
+tunable_policy(`xen_use_fusefs',`
+	fs_manage_fusefs_dirs(xend_t)
+	fs_manage_fusefs_files(xend_t)
+	fs_read_fusefs_symlinks(xend_t)
+')
+
+tunable_policy(`xen_use_nfs',`
+	fs_manage_nfs_dirs(xend_t)
+	fs_manage_nfs_files(xend_t)
+	fs_read_nfs_symlinks(xend_t)
+')
+
+tunable_policy(`xen_use_samba',`
+	fs_manage_cifs_dirs(xend_t)
+	fs_manage_cifs_files(xend_t)
+	fs_read_cifs_symlinks(xend_t)
+')
+
+optional_policy(`
+	brctl_domtrans(xend_t)
+')
+
+optional_policy(`
+	consoletype_exec(xend_t)
+')
+
+optional_policy(`
+	lvm_domtrans(xend_t)
+')
+
+optional_policy(`
+	mount_domtrans(xend_t)
+')
+
+optional_policy(`
+	netutils_domtrans(xend_t)
+')
+
+optional_policy(`
+	ptchown_exec(xend_t)
+')
+
+optional_policy(`
+	virt_search_images(xend_t)
+	virt_read_config(xend_t)
+')
+
+########################################
+#
+# Xen console local policy
+#
+
+allow xenconsoled_t self:capability { dac_override fsetid ipc_lock };
+allow xenconsoled_t self:process setrlimit;
+allow xenconsoled_t self:unix_stream_socket create_stream_socket_perms;
+allow xenconsoled_t self:fifo_file rw_fifo_file_perms;
+
+allow xenconsoled_t xen_devpts_t:chr_file { rw_term_perms setattr_chr_file_perms };
+
+manage_dirs_pattern(xenconsoled_t, xend_var_log_t, xend_var_log_t)
+append_files_pattern(xenconsoled_t, xend_var_log_t, xend_var_log_t)
+create_files_pattern(xenconsoled_t, xend_var_log_t, xend_var_log_t)
+setattr_files_pattern(xenconsoled_t, xend_var_log_t, xend_var_log_t)
+
+manage_files_pattern(xenconsoled_t, xenconsoled_var_run_t, xenconsoled_var_run_t)
+manage_sock_files_pattern(xenconsoled_t, xenconsoled_var_run_t, xenconsoled_var_run_t)
+files_pid_filetrans(xenconsoled_t, xenconsoled_var_run_t, { file sock_file })
+
+kernel_read_kernel_sysctls(xenconsoled_t)
+kernel_write_xen_state(xenconsoled_t)
+kernel_read_xen_state(xenconsoled_t)
+
+dev_rw_xen(xenconsoled_t)
+dev_filetrans_xen(xenconsoled_t)
+dev_rw_sysfs(xenconsoled_t)
+
+domain_dontaudit_ptrace_all_domains(xenconsoled_t)
+
+files_read_etc_files(xenconsoled_t)
+files_read_usr_files(xenconsoled_t)
+
+fs_list_tmpfs(xenconsoled_t)
+fs_manage_xenfs_dirs(xenconsoled_t)
+fs_manage_xenfs_files(xenconsoled_t)
+
+term_create_pty(xenconsoled_t, xen_devpts_t)
+term_use_generic_ptys(xenconsoled_t)
+term_use_console(xenconsoled_t)
+
+init_use_fds(xenconsoled_t)
+init_use_script_ptys(xenconsoled_t)
+
+logging_search_logs(xenconsoled_t)
+
+miscfiles_read_localization(xenconsoled_t)
+
+xen_stream_connect_xenstore(xenconsoled_t)
+
+optional_policy(`
+	ptchown_domtrans(xenconsoled_t)
+')
+
+########################################
+#
+# Xen store local policy
+#
+
+allow xenstored_t self:capability { dac_override ipc_lock sys_resource };
+allow xenstored_t self:unix_stream_socket { accept listen };
+
+manage_files_pattern(xenstored_t, xenstored_tmp_t, xenstored_tmp_t)
+manage_dirs_pattern(xenstored_t, xenstored_tmp_t, xenstored_tmp_t)
+files_tmp_filetrans(xenstored_t, xenstored_tmp_t, { file dir })
+
+manage_dirs_pattern(xenstored_t, xenstored_var_run_t, xenstored_var_run_t)
+manage_files_pattern(xenstored_t, xenstored_var_run_t, xenstored_var_run_t)
+manage_sock_files_pattern(xenstored_t, xenstored_var_run_t, xenstored_var_run_t)
+files_pid_filetrans(xenstored_t, xenstored_var_run_t, { file sock_file dir })
+
+manage_dirs_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t)
+append_files_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t)
+create_files_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t)
+setattr_files_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t)
+manage_sock_files_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t)
+logging_log_filetrans(xenstored_t, xenstored_var_log_t, { sock_file file dir })
+
+manage_dirs_pattern(xenstored_t, xenstored_var_lib_t, xenstored_var_lib_t)
+manage_files_pattern(xenstored_t, xenstored_var_lib_t, xenstored_var_lib_t)
+manage_sock_files_pattern(xenstored_t, xenstored_var_lib_t, xenstored_var_lib_t)
+files_var_lib_filetrans(xenstored_t, xenstored_var_lib_t, { file dir sock_file })
+
+stream_connect_pattern(xenstored_t, evtchnd_var_run_t, evtchnd_var_run_t, evtchnd_t)
+
+kernel_write_xen_state(xenstored_t)
+kernel_read_xen_state(xenstored_t)
+
+corecmd_search_bin(xenstored_t)
+
+dev_filetrans_xen(xenstored_t)
+dev_rw_xen(xenstored_t)
+dev_read_sysfs(xenstored_t)
+
+files_read_etc_files(xenstored_t)
+files_read_usr_files(xenstored_t)
+
+fs_search_xenfs(xenstored_t)
+fs_manage_xenfs_files(xenstored_t)
+
+term_use_generic_ptys(xenstored_t)
+
+init_use_fds(xenstored_t)
+init_use_script_ptys(xenstored_t)
+
+logging_send_syslog_msg(xenstored_t)
+
+miscfiles_read_localization(xenstored_t)
+
+xen_append_log(xenstored_t)
+
+########################################
+#
+# xm local policy
+#
+
+allow xm_t self:capability { dac_override ipc_lock net_admin setpcap sys_nice sys_tty_config };
+allow xm_t self:process { getcap getsched setsched setcap signal sigkill };
+allow xm_t self:fifo_file rw_fifo_file_perms;
+allow xm_t self:unix_stream_socket { accept connectto listen };
+allow xm_t self:tcp_socket { accept listen };
+
+allow xm_t xend_var_run_t:dir rw_dir_perms;
+
+allow xm_t xen_lock_t:file manage_file_perms;
+files_lock_filetrans(xm_t, xen_lock_t, file)
+
+manage_files_pattern(xm_t, xend_var_log_t, xend_var_log_t)
+
+manage_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t)
+manage_fifo_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t)
+manage_sock_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t)
+
+manage_files_pattern(xm_t, xen_image_t, xen_image_t)
+manage_blk_files_pattern(xm_t, xen_image_t, xen_image_t)
+manage_lnk_files_pattern(xm_t, xen_image_t, xen_image_t)
+
+read_files_pattern(xm_t, xenstored_var_run_t, xenstored_var_run_t)
+
+xen_manage_image_dirs(xm_t)
+xen_append_log(xm_t)
+xen_domtrans(xm_t)
+xen_stream_connect(xm_t)
+xen_stream_connect_xenstore(xm_t)
+
+can_exec(xm_t, xm_exec_t)
+
+kernel_load_module(xm_t)
+kernel_request_load_module(xm_t)
+kernel_read_system_state(xm_t)
+kernel_read_network_state(xm_t)
+kernel_read_kernel_sysctls(xm_t)
+kernel_read_sysctl(xm_t)
+kernel_read_xen_state(xm_t)
+kernel_write_xen_state(xm_t)
+
+corecmd_exec_bin(xm_t)
+corecmd_exec_shell(xm_t)
+
+corenet_all_recvfrom_unlabeled(xm_t)
+corenet_all_recvfrom_netlabel(xm_t)
+corenet_tcp_sendrecv_generic_if(xm_t)
+corenet_tcp_sendrecv_generic_node(xm_t)
+
+corenet_sendrecv_soundd_client_packets(xm_t)
+corenet_tcp_connect_soundd_port(xm_t)
+corenet_tcp_sendrecv_soundd_port(xm_t)
+
+dev_read_rand(xm_t)
+dev_read_urand(xm_t)
+dev_read_sysfs(xm_t)
+
+domain_use_interactive_fds(xm_t)
+
+files_read_etc_runtime_files(xm_t)
+files_read_etc_files(xm_t)
+files_read_kernel_img(xm_t)
+files_read_usr_files(xm_t)
+files_search_pids(xm_t)
+files_search_var_lib(xm_t)
+files_list_mnt(xm_t)
+files_list_tmp(xm_t)
+
+fs_getattr_all_fs(xm_t)
+fs_manage_xenfs_dirs(xm_t)
+fs_manage_xenfs_files(xm_t)
+fs_search_auto_mountpoints(xm_t)
+
+storage_raw_read_fixed_disk(xm_t)
+
+term_use_all_terms(xm_t)
+
+init_stream_connect_script(xm_t)
+init_rw_script_stream_sockets(xm_t)
+init_use_fds(xm_t)
+
+logging_send_syslog_msg(xm_t)
+
+miscfiles_read_localization(xm_t)
+
+sysnet_dns_name_resolve(xm_t)
+sysnet_domtrans_ifconfig(xm_t)
+
+# for vif-bridge to write to /run/xen-hotplug/iptables
+# maybe we need a different label for /run/xen-hotplug
+udev_manage_pid_files(xm_t)
+
+userdom_dontaudit_search_user_home_content(xm_t)
+
+tunable_policy(`xen_use_fusefs',`
+	fs_manage_fusefs_dirs(xm_t)
+	fs_manage_fusefs_files(xm_t)
+	fs_read_fusefs_symlinks(xm_t)
+')
+
+tunable_policy(`xen_use_nfs',`
+	fs_manage_nfs_dirs(xm_t)
+	fs_manage_nfs_files(xm_t)
+	fs_read_nfs_symlinks(xm_t)
+')
+
+tunable_policy(`xen_use_samba',`
+	fs_manage_cifs_dirs(xm_t)
+	fs_manage_cifs_files(xm_t)
+	fs_read_cifs_symlinks(xm_t)
+')
+
+optional_policy(`
+	qemu_domtrans(xm_t)
+	qemu_signal(xm_t)
+	qemu_stream_connect(xm_t)
+	qemu_delete_pid_sock_file(xm_t)
+')
+
+optional_policy(`
+	iptables_domtrans(xm_t)
+')
+
+optional_policy(`
+	cron_system_entry(xm_t, xm_exec_t)
+')
+
+optional_policy(`
+	dbus_system_bus_client(xm_t)
+
+	optional_policy(`
+		hal_dbus_chat(xm_t)
+	')
+')
+
+optional_policy(`
+	rpm_exec(xm_t)
+')
+
+optional_policy(`
+	vhostmd_rw_tmpfs_files(xm_t)
+	vhostmd_stream_connect(xm_t)
+	vhostmd_dontaudit_rw_stream_connect(xm_t)
+')
+
+optional_policy(`
+	virt_domtrans(xm_t)
+	virt_manage_images(xm_t)
+	virt_manage_config(xm_t)
+	virt_stream_connect(xm_t)
+')
+
+optional_policy(`
+	ssh_basic_client_template(xm, xm_t, system_r)
+
+	kernel_read_xen_state(xm_ssh_t)
+	kernel_write_xen_state(xm_ssh_t)
+
+	files_search_tmp(xm_ssh_t)
+
+	fs_manage_xenfs_dirs(xm_ssh_t)
+	fs_manage_xenfs_files(xm_ssh_t)
+')