[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     ab7a58e91cc8306b92be288f15da64fa50c42064
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Wed Sep 26 09:32:13 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Sep 27 17:54:53 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=ab7a58e9

Changes to the cups policy module and relevant dependencies

Ported from Fedor with changes
Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>
Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/contrib/cups.fc     |   85 ++++++-----
 policy/modules/contrib/cups.if     |   68 +++++-----
 policy/modules/contrib/cups.te     |  279 +++++++++++++++++-------------------
 policy/modules/contrib/kerberos.if |   29 ++++
 policy/modules/contrib/kerberos.te |    2 +-
 policy/modules/contrib/samba.if    |   21 +++
 policy/modules/contrib/samba.te    |    2 +-
 7 files changed, 268 insertions(+), 218 deletions(-)

diff --git a/policy/modules/contrib/cups.fc b/policy/modules/contrib/cups.fc
index 848bb92..6f7a1cd 100644
--- a/policy/modules/contrib/cups.fc
+++ b/policy/modules/contrib/cups.fc
@@ -1,69 +1,76 @@
+/etc/alchemist/namespace/printconf(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 
-/etc/alchemist/namespace/printconf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-
-/etc/cups(/.*)?			gen_context(system_u:object_r:cupsd_etc_t,s0)
-/etc/cups/classes\.conf.* --	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-/etc/cups/cupsd\.conf.* --	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-/etc/cups/lpoptions.* 	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-/etc/cups/ppd(/.*)?		gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/etc/cups(/.*)?	gen_context(system_u:object_r:cupsd_etc_t,s0)
+/etc/cups/classes\.conf.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/etc/cups/cupsd\.conf.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/etc/cups/lpoptions.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/etc/cups/ppd(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 /etc/cups/ppds\.dat	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-/etc/cups/printers\.conf.* --	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-/etc/cups/subscriptions.* --	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-/etc/cups/certs		-d	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/etc/cups/printers\.conf.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/etc/cups/subscriptions.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/etc/cups/certs	-d	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 /etc/cups/certs/.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 /etc/rc\.d/init\.d/cups	--	gen_context(system_u:object_r:cupsd_initrc_exec_t,s0)
 
 /etc/cups/interfaces(/.*)?	gen_context(system_u:object_r:cupsd_interface_t,s0)
 
-/etc/hp(/.*)?			gen_context(system_u:object_r:hplip_etc_t,s0)
+/etc/hp(/.*)?	gen_context(system_u:object_r:hplip_etc_t,s0)
+
+/etc/printcap.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+
+/lib/udev/udev-configure-printer	--	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
+/usr/lib/udev/udev-configure-printer	--	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
 
-/etc/printcap.* 	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/opt/brother/Printers(.*/)?inf(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/opt/gutenprint/ppds(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 
-/lib/udev/udev-configure-printer -- gen_context(system_u:object_r:cupsd_config_exec_t,s0)
+/usr/bin/cups-config-daemon	--	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
+/usr/bin/hpijs	--	gen_context(system_u:object_r:hplip_exec_t,s0)
 
-/opt/gutenprint/ppds(/.*)? 	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/usr/Brother/fax/.*\.log.*	gen_context(system_u:object_r:cupsd_log_t,s0)
+/usr/Brother/(.*/)?inf(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/usr/Printer/(.*/)?inf(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 
-/usr/bin/cups-config-daemon --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
-/usr/bin/hpijs		--	gen_context(system_u:object_r:hplip_exec_t,s0)
+/usr/lib/cups/daemon/cups-lpd	--	gen_context(system_u:object_r:cupsd_lpd_exec_t,s0)
+/usr/lib/cups/backend/cups-pdf	--	gen_context(system_u:object_r:cups_pdf_exec_t,s0)
+/usr/lib/cups/backend/hp.*	--	gen_context(system_u:object_r:hplip_exec_t,s0)
 
-/usr/lib/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0)
-/usr/lib/cups/backend/cups-pdf -- gen_context(system_u:object_r:cups_pdf_exec_t,s0)
-/usr/lib/cups/backend/hp.* --	gen_context(system_u:object_r:hplip_exec_t,s0)
+/usr/libexec/cups-pk-helper-mechanism	--	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
+/usr/libexec/hal_lpadmin	--	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
 
-/usr/libexec/cups-pk-helper-mechanism -- gen_context(system_u:object_r:cupsd_config_exec_t,s0)
-/usr/libexec/hal_lpadmin --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
+/usr/local/linuxprinter/ppd(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 
 /usr/sbin/hp-[^/]+	--	gen_context(system_u:object_r:hplip_exec_t,s0)
-/usr/sbin/cupsd		--	gen_context(system_u:object_r:cupsd_exec_t,s0)
-/usr/sbin/hal_lpadmin --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
-/usr/sbin/hpiod		--	gen_context(system_u:object_r:hplip_exec_t,s0)
-/usr/sbin/printconf-backend --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
+/usr/sbin/cupsd	--	gen_context(system_u:object_r:cupsd_exec_t,s0)
+/usr/sbin/hal_lpadmin	--	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
+/usr/sbin/hpiod	--	gen_context(system_u:object_r:hplip_exec_t,s0)
+/usr/sbin/printconf-backend	--	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
 /usr/sbin/ptal-printd	--	gen_context(system_u:object_r:ptal_exec_t,s0)
 /usr/sbin/ptal-mlcd	--	gen_context(system_u:object_r:ptal_exec_t,s0)
 /usr/sbin/ptal-photod	--	gen_context(system_u:object_r:ptal_exec_t,s0)
 
-/usr/share/cups(/.*)?		gen_context(system_u:object_r:cupsd_etc_t,s0)
-/usr/share/foomatic/db/oldprinterids --	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-/usr/share/hplip/.*\.py --	gen_context(system_u:object_r:hplip_exec_t,s0)
+/usr/share/cups(/.*)?	gen_context(system_u:object_r:cupsd_etc_t,s0)
+/usr/share/foomatic/db/oldprinterids	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/usr/share/hplip/.*\.py	--	gen_context(system_u:object_r:hplip_exec_t,s0)
 
-/var/cache/alchemist/printconf.* gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-/var/cache/foomatic(/.*)? 	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-/var/cache/cups(/.*)? 		gen_context(system_u:object_r:cupsd_rw_etc_t,mls_systemhigh)
+/var/cache/alchemist/printconf.*	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/var/cache/foomatic(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/var/cache/cups(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,mls_systemhigh)
 
 /var/lib/cups/certs	-d	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 /var/lib/cups/certs/.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 
-/var/lib/hp(/.*)?		gen_context(system_u:object_r:hplip_var_lib_t,s0)
+/var/lib/hp(/.*)?	gen_context(system_u:object_r:hplip_var_lib_t,s0)
 
-/var/log/cups(/.*)?		gen_context(system_u:object_r:cupsd_log_t,s0)
-/var/log/turboprint.*		gen_context(system_u:object_r:cupsd_log_t,s0)
+/var/log/cups(/.*)?	gen_context(system_u:object_r:cupsd_log_t,s0)
+/var/log/turboprint.*	gen_context(system_u:object_r:cupsd_log_t,s0)
 
-/var/ccpd(/.*)?			gen_context(system_u:object_r:cupsd_var_run_t,s0)
-/var/ekpd(/.*)?			gen_context(system_u:object_r:cupsd_var_run_t,s0)
-/var/run/cups(/.*)?		gen_context(system_u:object_r:cupsd_var_run_t,s0)
+/var/ccpd(/.*)?	gen_context(system_u:object_r:cupsd_var_run_t,s0)
+/var/ekpd(/.*)?	gen_context(system_u:object_r:cupsd_var_run_t,s0)
+/var/run/cups(/.*)?	gen_context(system_u:object_r:cupsd_var_run_t,s0)
 /var/run/hp.*\.pid	--	gen_context(system_u:object_r:hplip_var_run_t,s0)
 /var/run/hp.*\.port	--	gen_context(system_u:object_r:hplip_var_run_t,s0)
 /var/run/ptal-printd(/.*)?	gen_context(system_u:object_r:ptal_var_run_t,s0)
 /var/run/ptal-mlcd(/.*)?	gen_context(system_u:object_r:ptal_var_run_t,s0)
-/var/run/udev-configure-printer(/.*)? 	gen_context(system_u:object_r:cupsd_config_var_run_t,s0)
-/var/turboprint(/.*)?		gen_context(system_u:object_r:cupsd_var_run_t,s0)
+/var/run/udev-configure-printer(/.*)?	gen_context(system_u:object_r:cupsd_config_var_run_t,s0)
+/var/turboprint(/.*)?	gen_context(system_u:object_r:cupsd_var_run_t,s0)

diff --git a/policy/modules/contrib/cups.if b/policy/modules/contrib/cups.if
index 305ddf4..06da9a0 100644
--- a/policy/modules/contrib/cups.if
+++ b/policy/modules/contrib/cups.if
@@ -1,12 +1,18 @@
-## <summary>Common UNIX printing system</summary>
+## <summary>Common UNIX printing system.</summary>
 
 ########################################
 ## <summary>
-##	Setup cups to transtion to the cups backend domain
+##	Create a domain which can be
+##	started by cupsd.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-##	Domain allowed access.
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="entry_point">
+##	<summary>
+##	Type of the program to be used as an entry point to this domain.
 ##	</summary>
 ## </param>
 #
@@ -42,12 +48,14 @@ interface(`cups_domtrans',`
 		type cupsd_t, cupsd_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, cupsd_exec_t, cupsd_t)
 ')
 
 ########################################
 ## <summary>
-##	Connect to cupsd over an unix domain stream socket.
+##	Connect to cupsd over an unix
+##	domain stream socket.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -120,7 +128,8 @@ interface(`cups_read_pid_files',`
 
 ########################################
 ## <summary>
-##	Execute cups_config in the cups_config domain.
+##	Execute cups_config in the
+##	cups config domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -133,6 +142,7 @@ interface(`cups_domtrans_config',`
 		type cupsd_config_t, cupsd_config_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, cupsd_config_exec_t, cupsd_config_t)
 ')
 
@@ -193,8 +203,7 @@ interface(`cups_read_config',`
 	')
 
 	files_search_etc($1)
-	read_files_pattern($1, cupsd_etc_t, cupsd_etc_t)
-	read_files_pattern($1, cupsd_etc_t, cupsd_rw_etc_t)
+	read_files_pattern($1, cupsd_etc_t, { cupsd_etc_t cupsd_rw_etc_t })
 ')
 
 ########################################
@@ -277,7 +286,8 @@ interface(`cups_write_log',`
 
 ########################################
 ## <summary>
-##	Connect to ptal over an unix domain stream socket.
+##	Connect to ptal over an unix
+##	domain stream socket.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -296,8 +306,8 @@ interface(`cups_stream_connect_ptal',`
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate 
-##	an cups environment
+##	All of the rules required to
+##	administrate an cups environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -306,7 +316,7 @@ interface(`cups_stream_connect_ptal',`
 ## </param>
 ## <param name="role">
 ##	<summary>
-##	The role to be allowed to manage the cups domain.
+##	Role allowed access.
 ##	</summary>
 ## </param>
 ## <rolecap/>
@@ -316,43 +326,35 @@ interface(`cups_admin',`
 		type cupsd_t, cupsd_tmp_t, cupsd_lpd_tmp_t;
 		type cupsd_etc_t, cupsd_log_t, cupsd_spool_t;
 		type cupsd_config_var_run_t, cupsd_lpd_var_run_t;
-		type cupsd_var_run_t, ptal_etc_t;
-		type ptal_var_run_t, hplip_var_run_t;
-		type cupsd_initrc_exec_t;
+		type cupsd_var_run_t, ptal_etc_t, cupsd_rw_etc_t;
+		type ptal_var_run_t, hplip_var_run_t, cupsd_initrc_exec_t;
+		type cupsd_config_t, cupsd_lpd_t, cups_pdf_t;
+		type hplip_t, ptal_t;
 	')
 
-	allow $1 cupsd_t:process { ptrace signal_perms };
-	ps_process_pattern($1, cupsd_t)
+	allow $1 { cupsd_t cupsd_config_t cupsd_lpd_t }:process { ptrace signal_perms };
+	allow $1 { cups_pdf_t hplip_t ptal_t }:process { ptrace signal_perms };
+	ps_process_pattern($1, { cupsd_t cupsd_config_t cupsd_lpd_t })
+	ps_process_pattern($1, { cups_pdf_t hplip_t ptal_t })
 
 	init_labeled_script_domtrans($1, cupsd_initrc_exec_t)
 	domain_system_change_exemption($1)
 	role_transition $2 cupsd_initrc_exec_t system_r;
 	allow $2 system_r;
 
-	admin_pattern($1, cupsd_etc_t)
 	files_list_etc($1)
+	admin_pattern($1, { cupsd_etc_t cupsd_rw_etc_t ptal_etc_t })
 
-	admin_pattern($1, cupsd_config_var_run_t)
-
-	admin_pattern($1, cupsd_log_t)
 	logging_list_logs($1)
+	admin_pattern($1, cupsd_log_t)
 
-	admin_pattern($1, cupsd_lpd_tmp_t)
-
-	admin_pattern($1, cupsd_lpd_var_run_t)
-
-	admin_pattern($1, cupsd_spool_t)
 	files_list_spool($1)
+	admin_pattern($1, cupsd_spool_t)
 
-	admin_pattern($1, cupsd_tmp_t)
 	files_list_tmp($1)
+	admin_pattern($1, { cupsd_tmp_t  cupsd_lpd_tmp_t })
 
-	admin_pattern($1, cupsd_var_run_t)
 	files_list_pids($1)
-
-	admin_pattern($1, hplip_var_run_t)
-
-	admin_pattern($1, ptal_etc_t)
-
-	admin_pattern($1, ptal_var_run_t)
+	admin_pattern($1, { cupsd_config_var_run_t cupsd_var_run_t hplip_var_run_t })
+	admin_pattern($1, { ptal_var_run_t cupsd_lpd_var_run_t })
 ')

diff --git a/policy/modules/contrib/cups.te b/policy/modules/contrib/cups.te
index 0f183b6..4565284 100644
--- a/policy/modules/contrib/cups.te
+++ b/policy/modules/contrib/cups.te
@@ -1,4 +1,4 @@
-policy_module(cups, 1.15.1)
+policy_module(cups, 1.15.2)
 
 ########################################
 #
@@ -15,6 +15,7 @@ files_pid_file(cupsd_config_var_run_t)
 type cupsd_t;
 type cupsd_exec_t;
 init_daemon_domain(cupsd_t, cupsd_exec_t)
+mls_trusted_object(cupsd_t)
 
 type cupsd_etc_t;
 files_config_file(cupsd_etc_t)
@@ -63,7 +64,6 @@ mls_trusted_object(cupsd_var_run_t)
 type hplip_t;
 type hplip_exec_t;
 init_daemon_domain(hplip_t, hplip_exec_t)
-# For CUPS to run as a backend
 cups_backend(hplip_t, hplip_exec_t)
 
 type hplip_etc_t;
@@ -101,27 +101,22 @@ ifdef(`enable_mls',`
 # Cups local policy
 #
 
-# /usr/lib/cups/backend/serial needs sys_admin(?!)
 allow cupsd_t self:capability { ipc_lock sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_rawio sys_resource sys_tty_config };
 dontaudit cupsd_t self:capability { sys_tty_config net_admin };
 allow cupsd_t self:capability2 block_suspend;
 allow cupsd_t self:process { getpgid setpgid setsched signal_perms };
 allow cupsd_t self:fifo_file rw_fifo_file_perms;
-allow cupsd_t self:unix_stream_socket { create_stream_socket_perms connectto };
-allow cupsd_t self:unix_dgram_socket create_socket_perms;
+allow cupsd_t self:unix_stream_socket { accept connectto listen };
 allow cupsd_t self:netlink_selinux_socket create_socket_perms;
 allow cupsd_t self:shm create_shm_perms;
 allow cupsd_t self:sem create_sem_perms;
-allow cupsd_t self:tcp_socket create_stream_socket_perms;
-allow cupsd_t self:udp_socket create_socket_perms;
+allow cupsd_t self:tcp_socket { accept listen };
 allow cupsd_t self:appletalk_socket create_socket_perms;
-# generic socket here until appletalk socket is available in kernels
-allow cupsd_t self:socket create_socket_perms;
 
-allow cupsd_t cupsd_etc_t:{ dir file } setattr;
+allow cupsd_t cupsd_etc_t:dir setattr_dir_perms;
+allow cupsd_t cupsd_etc_t:file setattr_file_perms;
 read_files_pattern(cupsd_t, cupsd_etc_t, cupsd_etc_t)
 read_lnk_files_pattern(cupsd_t, cupsd_etc_t, cupsd_etc_t)
-files_search_etc(cupsd_t)
 
 manage_files_pattern(cupsd_t, cupsd_interface_t, cupsd_interface_t)
 
@@ -130,28 +125,28 @@ manage_files_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t)
 filetrans_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t, file)
 files_var_filetrans(cupsd_t, cupsd_rw_etc_t, { dir file })
 
-# allow cups to execute its backend scripts
-can_exec(cupsd_t, cupsd_exec_t)
 allow cupsd_t cupsd_exec_t:dir search_dir_perms;
 allow cupsd_t cupsd_exec_t:lnk_file read_lnk_file_perms;
 
 allow cupsd_t cupsd_lock_t:file manage_file_perms;
 files_lock_filetrans(cupsd_t, cupsd_lock_t, file)
 
-manage_files_pattern(cupsd_t, cupsd_log_t, cupsd_log_t)
-allow cupsd_t cupsd_log_t:dir setattr;
+manage_dirs_pattern(cupsd_t, cupsd_log_t, cupsd_log_t)
+append_files_pattern(cupsd_t, cupsd_log_t, cupsd_log_t)
+create_files_pattern(cupsd_t, cupsd_log_t, cupsd_log_t)
+setattr_files_pattern(cupsd_t, cupsd_log_t, cupsd_log_t)
 logging_log_filetrans(cupsd_t, cupsd_log_t, { file dir })
 
 manage_dirs_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t)
 manage_files_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t)
 manage_fifo_files_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t)
-files_tmp_filetrans(cupsd_t, cupsd_tmp_t, { file dir fifo_file })
+files_tmp_filetrans(cupsd_t, cupsd_tmp_t, { dir fifo_file file })
 
-allow cupsd_t cupsd_var_run_t:dir setattr;
+manage_dirs_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
 manage_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
 manage_sock_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
 manage_fifo_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
-files_pid_filetrans(cupsd_t, cupsd_var_run_t, { file fifo_file })
+files_pid_filetrans(cupsd_t, cupsd_var_run_t, { dir fifo_file file })
 
 allow cupsd_t hplip_t:process { signal sigkill };
 
@@ -160,7 +155,9 @@ read_files_pattern(cupsd_t, hplip_etc_t, hplip_etc_t)
 allow cupsd_t hplip_var_run_t:file read_file_perms;
 
 stream_connect_pattern(cupsd_t, ptal_var_run_t, ptal_var_run_t, ptal_t)
-allow cupsd_t ptal_var_run_t : sock_file setattr;
+allow cupsd_t ptal_var_run_t:sock_file setattr_sock_file_perms;
+
+can_exec(cupsd_t, { cupsd_exec_t cupsd_interface_t })
 
 kernel_read_system_state(cupsd_t)
 kernel_read_network_state(cupsd_t)
@@ -179,6 +176,9 @@ corenet_tcp_sendrecv_all_ports(cupsd_t)
 corenet_udp_sendrecv_all_ports(cupsd_t)
 corenet_tcp_bind_generic_node(cupsd_t)
 corenet_udp_bind_generic_node(cupsd_t)
+
+corenet_sendrecv_all_server_packets(cupsd_t)
+corenet_sendrecv_all_client_packets(cupsd_t)
 corenet_tcp_bind_ipp_port(cupsd_t)
 corenet_udp_bind_ipp_port(cupsd_t)
 corenet_udp_bind_howl_port(cupsd_t)
@@ -190,56 +190,52 @@ corenet_sendrecv_hplip_client_packets(cupsd_t)
 corenet_sendrecv_ipp_client_packets(cupsd_t)
 corenet_sendrecv_ipp_server_packets(cupsd_t)
 
+corecmd_exec_bin(cupsd_t)
+corecmd_exec_shell(cupsd_t)
+
 dev_rw_printer(cupsd_t)
 dev_read_urand(cupsd_t)
 dev_read_sysfs(cupsd_t)
-dev_rw_input_dev(cupsd_t)	#447878
+dev_rw_input_dev(cupsd_t)
 dev_rw_generic_usb_dev(cupsd_t)
 dev_rw_usbfs(cupsd_t)
 dev_getattr_printer_dev(cupsd_t)
 
 domain_read_all_domains_state(cupsd_t)
-
-fs_getattr_all_fs(cupsd_t)
-fs_search_auto_mountpoints(cupsd_t)
-fs_search_fusefs(cupsd_t)
-fs_read_anon_inodefs_files(cupsd_t)
-
-mls_file_downgrade(cupsd_t)
-mls_file_write_all_levels(cupsd_t)
-mls_file_read_all_levels(cupsd_t)
-mls_rangetrans_target(cupsd_t)
-mls_socket_write_all_levels(cupsd_t)
-mls_fd_use_all_levels(cupsd_t)
-
-term_use_unallocated_ttys(cupsd_t)
-term_search_ptys(cupsd_t)
-
-# Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp
-corecmd_exec_shell(cupsd_t)
-corecmd_exec_bin(cupsd_t)
-
 domain_use_interactive_fds(cupsd_t)
 
+files_getattr_boot_dirs(cupsd_t)
 files_list_spool(cupsd_t)
-files_read_etc_files(cupsd_t)
 files_read_etc_runtime_files(cupsd_t)
-# read python modules
 files_read_usr_files(cupsd_t)
+files_exec_usr_files(cupsd_t)
 # for /var/lib/defoma
 files_read_var_lib_files(cupsd_t)
 files_list_world_readable(cupsd_t)
 files_read_world_readable_files(cupsd_t)
 files_read_world_readable_symlinks(cupsd_t)
-# Satisfy readahead
 files_read_var_files(cupsd_t)
 files_read_var_symlinks(cupsd_t)
+files_write_generic_pid_pipes(cupsd_t)
+files_dontaudit_getattr_all_tmp_files(cupsd_t)
+files_dontaudit_list_home(cupsd_t)
 # for /etc/printcap
 files_dontaudit_write_etc_files(cupsd_t)
-# smbspool seems to be iterating through all existing tmp files.
-# redhat bug #214953
-# cjp: this might be a broken behavior
-files_dontaudit_getattr_all_tmp_files(cupsd_t)
+
+fs_getattr_all_fs(cupsd_t)
+fs_search_auto_mountpoints(cupsd_t)
+fs_search_fusefs(cupsd_t)
+fs_read_anon_inodefs_files(cupsd_t)
+
+mls_fd_use_all_levels(cupsd_t)
+mls_file_downgrade(cupsd_t)
+mls_file_write_all_levels(cupsd_t)
+mls_file_read_all_levels(cupsd_t)
+mls_rangetrans_target(cupsd_t)
+mls_socket_write_all_levels(cupsd_t)
+
+term_search_ptys(cupsd_t)
+term_use_unallocated_ttys(cupsd_t)
 
 selinux_compute_access_vector(cupsd_t)
 selinux_validate_context(cupsd_t)
@@ -252,7 +248,6 @@ auth_dontaudit_read_pam_pid(cupsd_t)
 auth_rw_faillog(cupsd_t)
 auth_use_nsswitch(cupsd_t)
 
-# Read /usr/lib/gconv/gconv-modules.* and /usr/lib/python2.2/.*
 libs_read_lib_files(cupsd_t)
 libs_exec_lib_files(cupsd_t)
 
@@ -260,23 +255,16 @@ logging_send_audit_msgs(cupsd_t)
 logging_send_syslog_msg(cupsd_t)
 
 miscfiles_read_localization(cupsd_t)
-# invoking ghostscript needs to read fonts
 miscfiles_read_fonts(cupsd_t)
 miscfiles_setattr_fonts_cache_dirs(cupsd_t)
 
 seutil_read_config(cupsd_t)
+
 sysnet_exec_ifconfig(cupsd_t)
 
-files_dontaudit_list_home(cupsd_t)
 userdom_dontaudit_use_unpriv_user_fds(cupsd_t)
 userdom_dontaudit_search_user_home_content(cupsd_t)
 
-# Write to /var/spool/cups.
-lpd_manage_spool(cupsd_t)
-lpd_read_config(cupsd_t)
-lpd_exec_lpr(cupsd_t)
-lpd_relabel_spool(cupsd_t)
-
 optional_policy(`
 	apm_domtrans_client(cupsd_t)
 ')
@@ -312,17 +300,29 @@ optional_policy(`
 ')
 
 optional_policy(`
+	kerberos_manage_host_rcache(cupsd_t)
+	kerberos_tmp_filetrans_host_rcache(cupsd_t, file, "host_0")
+')
+
+optional_policy(`
 	logrotate_domtrans(cupsd_t)
 ')
 
 optional_policy(`
+	lpd_exec_lpr(cupsd_t)
+	lpd_manage_spool(cupsd_t)
+	lpd_read_config(cupsd_t)
+	lpd_relabel_spool(cupsd_t)
+')
+
+optional_policy(`
 	mta_send_mail(cupsd_t)
 ')
 
 optional_policy(`
-	# cups execs smbtool which reads samba_etc_t files
 	samba_read_config(cupsd_t)
 	samba_rw_var_files(cupsd_t)
+	samba_stream_connect_nmbd(cupsd_t)
 ')
 
 optional_policy(`
@@ -339,16 +339,14 @@ optional_policy(`
 
 ########################################
 #
-# Cups configuration daemon local policy
+# Configuration daemon local policy
 #
 
 allow cupsd_config_t self:capability { chown dac_override sys_tty_config };
 dontaudit cupsd_config_t self:capability sys_tty_config;
 allow cupsd_config_t self:process { getsched signal_perms };
 allow cupsd_config_t self:fifo_file rw_fifo_file_perms;
-allow cupsd_config_t self:unix_stream_socket create_socket_perms;
-allow cupsd_config_t self:unix_dgram_socket create_socket_perms;
-allow cupsd_config_t self:tcp_socket create_stream_socket_perms;
+allow cupsd_config_t self:tcp_socket { accept listen };
 
 allow cupsd_config_t cupsd_t:process signal;
 ps_process_pattern(cupsd_config_t, cupsd_t)
@@ -361,8 +359,6 @@ manage_files_pattern(cupsd_config_t, cupsd_rw_etc_t, cupsd_rw_etc_t)
 manage_lnk_files_pattern(cupsd_config_t, cupsd_rw_etc_t, cupsd_rw_etc_t)
 files_var_filetrans(cupsd_config_t, cupsd_rw_etc_t, file)
 
-can_exec(cupsd_config_t, cupsd_config_exec_t)
-
 allow cupsd_config_t cupsd_log_t:file rw_file_perms;
 
 manage_lnk_files_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
@@ -372,8 +368,13 @@ files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir })
 
 allow cupsd_config_t cupsd_var_run_t:file read_file_perms;
 
+manage_dirs_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t)
 manage_files_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t)
-files_pid_filetrans(cupsd_config_t, cupsd_config_var_run_t, file)
+files_pid_filetrans(cupsd_config_t, cupsd_config_var_run_t, { dir file })
+
+stream_connect_pattern(cupsd_config_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
+
+can_exec(cupsd_config_t, cupsd_config_exec_t)
 
 domtrans_pattern(cupsd_config_t, hplip_exec_t, hplip_t)
 
@@ -387,32 +388,29 @@ corenet_all_recvfrom_netlabel(cupsd_config_t)
 corenet_tcp_sendrecv_generic_if(cupsd_config_t)
 corenet_tcp_sendrecv_generic_node(cupsd_config_t)
 corenet_tcp_sendrecv_all_ports(cupsd_config_t)
-corenet_tcp_connect_all_ports(cupsd_config_t)
+
 corenet_sendrecv_all_client_packets(cupsd_config_t)
+corenet_tcp_connect_all_ports(cupsd_config_t)
+
+corecmd_exec_bin(cupsd_config_t)
+corecmd_exec_shell(cupsd_config_t)
 
 dev_read_sysfs(cupsd_config_t)
 dev_read_urand(cupsd_config_t)
 dev_read_rand(cupsd_config_t)
 dev_rw_generic_usb_dev(cupsd_config_t)
 
+files_read_etc_runtime_files(cupsd_config_t)
+files_read_usr_files(cupsd_config_t)
+files_read_var_symlinks(cupsd_config_t)
 files_search_all_mountpoints(cupsd_config_t)
 
 fs_getattr_all_fs(cupsd_config_t)
 fs_search_auto_mountpoints(cupsd_config_t)
 
-corecmd_exec_bin(cupsd_config_t)
-corecmd_exec_shell(cupsd_config_t)
-
 domain_use_interactive_fds(cupsd_config_t)
-# killall causes the following
 domain_dontaudit_search_all_domains_state(cupsd_config_t)
 
-files_read_usr_files(cupsd_config_t)
-files_read_etc_files(cupsd_config_t)
-files_read_etc_runtime_files(cupsd_config_t)
-files_read_var_symlinks(cupsd_config_t)
-
-# Alternatives asks for this
 init_getattr_all_script_files(cupsd_config_t)
 
 auth_use_nsswitch(cupsd_config_t)
@@ -426,16 +424,9 @@ seutil_dontaudit_search_config(cupsd_config_t)
 
 userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
 userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
-
-cups_stream_connect(cupsd_config_t)
-
-lpd_read_config(cupsd_config_t)
-
-ifdef(`distro_redhat',`
-	optional_policy(`
-		rpm_read_db(cupsd_config_t)
-	')
-')
+userdom_read_all_users_state(cupsd_config_t)
+userdom_read_user_tmp_symlinks(cupsd_config_t)
+userdom_rw_user_tmp_files(cupsd_config_t)
 
 optional_policy(`
 	term_use_generic_ptys(cupsd_config_t)
@@ -451,6 +442,10 @@ optional_policy(`
 	optional_policy(`
 		hal_dbus_chat(cupsd_config_t)
 	')
+
+	optional_policy(`
+		policykit_dbus_chat(cupsd_config_t)
+	')
 ')
 
 optional_policy(`
@@ -468,8 +463,7 @@ optional_policy(`
 ')
 
 optional_policy(`
-	policykit_dbus_chat(cupsd_config_t)
-	userdom_read_all_users_state(cupsd_config_t)
+	lpd_read_config(cupsd_config_t)
 ')
 
 optional_policy(`
@@ -490,23 +484,14 @@ optional_policy(`
 
 ########################################
 #
-# Cups lpd support
+# Lpd local policy
 #
 
+allow cupsd_lpd_t self:capability { setuid setgid };
 allow cupsd_lpd_t self:process signal_perms;
 allow cupsd_lpd_t self:fifo_file rw_fifo_file_perms;
-allow cupsd_lpd_t self:tcp_socket connected_stream_socket_perms;
-allow cupsd_lpd_t self:udp_socket create_socket_perms;
-
-# for identd
-# cjp: this should probably only be inetd_child rules?
+allow cupsd_lpd_t self:tcp_socket { accept listen };
 allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
-allow cupsd_lpd_t self:capability { setuid setgid };
-files_search_home(cupsd_lpd_t)
-optional_policy(`
-	kerberos_use(cupsd_lpd_t)
-')
-#end for identd
 
 allow cupsd_lpd_t cupsd_etc_t:dir list_dir_perms;
 read_files_pattern(cupsd_lpd_t, cupsd_etc_t, cupsd_etc_t)
@@ -518,11 +503,13 @@ read_lnk_files_pattern(cupsd_lpd_t, cupsd_rw_etc_t, cupsd_rw_etc_t)
 
 manage_dirs_pattern(cupsd_lpd_t, cupsd_lpd_tmp_t, cupsd_lpd_tmp_t)
 manage_files_pattern(cupsd_lpd_t, cupsd_lpd_tmp_t, cupsd_lpd_tmp_t)
-files_tmp_filetrans(cupsd_lpd_t, cupsd_lpd_tmp_t, { file dir })
+files_tmp_filetrans(cupsd_lpd_t, cupsd_lpd_tmp_t, { dir file })
 
 manage_files_pattern(cupsd_lpd_t, cupsd_lpd_var_run_t, cupsd_lpd_var_run_t)
 files_pid_filetrans(cupsd_lpd_t, cupsd_lpd_var_run_t, file)
 
+stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
+
 kernel_read_kernel_sysctls(cupsd_lpd_t)
 kernel_read_system_state(cupsd_lpd_t)
 kernel_read_network_state(cupsd_lpd_t)
@@ -530,21 +517,18 @@ kernel_read_network_state(cupsd_lpd_t)
 corenet_all_recvfrom_unlabeled(cupsd_lpd_t)
 corenet_all_recvfrom_netlabel(cupsd_lpd_t)
 corenet_tcp_sendrecv_generic_if(cupsd_lpd_t)
-corenet_udp_sendrecv_generic_if(cupsd_lpd_t)
 corenet_tcp_sendrecv_generic_node(cupsd_lpd_t)
-corenet_udp_sendrecv_generic_node(cupsd_lpd_t)
-corenet_tcp_sendrecv_all_ports(cupsd_lpd_t)
-corenet_udp_sendrecv_all_ports(cupsd_lpd_t)
-corenet_tcp_bind_generic_node(cupsd_lpd_t)
-corenet_udp_bind_generic_node(cupsd_lpd_t)
+
+corenet_sendrecv_ipp_client_packets(cupsd_lpd_t)
 corenet_tcp_connect_ipp_port(cupsd_lpd_t)
+corenet_tcp_sendrecv_ipp_port(cupsd_lpd_t)
 
 dev_read_urand(cupsd_lpd_t)
 dev_read_rand(cupsd_lpd_t)
 
 fs_getattr_xattr_fs(cupsd_lpd_t)
 
-files_read_etc_files(cupsd_lpd_t)
+files_search_home(cupsd_lpd_t)
 
 auth_use_nsswitch(cupsd_lpd_t)
 
@@ -553,48 +537,43 @@ logging_send_syslog_msg(cupsd_lpd_t)
 miscfiles_read_localization(cupsd_lpd_t)
 miscfiles_setattr_fonts_cache_dirs(cupsd_lpd_t)
 
-cups_stream_connect(cupsd_lpd_t)
-
 optional_policy(`
 	inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t)
 ')
 
 ########################################
 #
-# cups_pdf local policy
+# Pdf local policy
 #
 
 allow cups_pdf_t self:capability { chown fowner fsetid setuid setgid dac_override };
-allow cups_pdf_t self:fifo_file rw_file_perms;
+allow cups_pdf_t self:fifo_file rw_fifo_file_perms;
 allow cups_pdf_t self:unix_stream_socket create_stream_socket_perms;
 
 manage_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
 
 manage_files_pattern(cups_pdf_t, cups_pdf_tmp_t, cups_pdf_tmp_t)
 manage_dirs_pattern(cups_pdf_t, cups_pdf_tmp_t, cups_pdf_tmp_t)
-files_tmp_filetrans(cups_pdf_t, cups_pdf_tmp_t, { file dir })
+files_tmp_filetrans(cups_pdf_t, cups_pdf_tmp_t, { dir file })
 
 fs_rw_anon_inodefs_files(cups_pdf_t)
 
 kernel_read_system_state(cups_pdf_t)
 
-files_read_etc_files(cups_pdf_t)
 files_read_usr_files(cups_pdf_t)
 
-corecmd_exec_shell(cups_pdf_t)
 corecmd_exec_bin(cups_pdf_t)
+corecmd_exec_shell(cups_pdf_t)
 
 auth_use_nsswitch(cups_pdf_t)
 
 miscfiles_read_localization(cups_pdf_t)
 miscfiles_read_fonts(cups_pdf_t)
+miscfiles_setattr_fonts_cache_dirs(cups_pdf_t)
 
-userdom_home_filetrans_user_home_dir(cups_pdf_t)
 userdom_manage_user_home_content_dirs(cups_pdf_t)
 userdom_manage_user_home_content_files(cups_pdf_t)
-
-lpd_manage_spool(cups_pdf_t)
-
+userdom_home_filetrans_user_home_dir(cups_pdf_t)
 
 tunable_policy(`use_nfs_home_dirs',`
 	fs_search_auto_mountpoints(cups_pdf_t)
@@ -607,6 +586,10 @@ tunable_policy(`use_samba_home_dirs',`
 	fs_manage_cifs_files(cups_pdf_t)
 ')
 
+optional_policy(`
+	lpd_manage_spool(cups_pdf_t)
+')
+
 ########################################
 #
 # HPLIP local policy
@@ -617,34 +600,32 @@ allow hplip_t self:capability { dac_override dac_read_search net_raw };
 dontaudit hplip_t self:capability sys_tty_config;
 allow hplip_t self:fifo_file rw_fifo_file_perms;
 allow hplip_t self:process signal_perms;
-allow hplip_t self:unix_dgram_socket create_socket_perms;
-allow hplip_t self:unix_stream_socket create_socket_perms;
 allow hplip_t self:netlink_route_socket r_netlink_socket_perms;
 allow hplip_t self:tcp_socket create_stream_socket_perms;
 allow hplip_t self:udp_socket create_socket_perms;
 allow hplip_t self:rawip_socket create_socket_perms;
 
 allow hplip_t cupsd_etc_t:dir search_dir_perms;
+
 manage_dirs_pattern(hplip_t, cupsd_tmp_t, cupsd_tmp_t)
 manage_files_pattern(hplip_t, cupsd_tmp_t, cupsd_tmp_t)
-files_tmp_filetrans(hplip_t, cupsd_tmp_t, { file dir })
-
-cups_stream_connect(hplip_t)
+files_tmp_filetrans(hplip_t, cupsd_tmp_t, { dir file })
 
 allow hplip_t hplip_etc_t:dir list_dir_perms;
 read_files_pattern(hplip_t, hplip_etc_t, hplip_etc_t)
 read_lnk_files_pattern(hplip_t, hplip_etc_t, hplip_etc_t)
-files_search_etc(hplip_t)
 
 manage_files_pattern(hplip_t, hplip_var_lib_t, hplip_var_lib_t)
 manage_lnk_files_pattern(hplip_t, hplip_var_lib_t, hplip_var_lib_t)
 
 manage_fifo_files_pattern(hplip_t, hplip_tmp_t, hplip_tmp_t)
-files_tmp_filetrans(hplip_t, hplip_tmp_t, fifo_file )
+files_tmp_filetrans(hplip_t, hplip_tmp_t, fifo_file)
 
 manage_files_pattern(hplip_t, hplip_var_run_t, hplip_var_run_t)
 files_pid_filetrans(hplip_t, hplip_var_run_t, file)
 
+stream_connect_pattern(hplip_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
+
 kernel_read_system_state(hplip_t)
 kernel_read_kernel_sysctls(hplip_t)
 
@@ -660,13 +641,20 @@ corenet_tcp_sendrecv_all_ports(hplip_t)
 corenet_udp_sendrecv_all_ports(hplip_t)
 corenet_tcp_bind_generic_node(hplip_t)
 corenet_udp_bind_generic_node(hplip_t)
+
+corenet_sendrecv_hplip_client_packets(hplip_t)
+corenet_receive_hplip_server_packets(hplip_t)
 corenet_tcp_bind_hplip_port(hplip_t)
 corenet_tcp_connect_hplip_port(hplip_t)
+
+corenet_sendrecv_ipp_client_packets(hplip_t)
 corenet_tcp_connect_ipp_port(hplip_t)
-corenet_sendrecv_hplip_client_packets(hplip_t)
-corenet_receive_hplip_server_packets(hplip_t)
+
+corenet_sendrecv_howl_server_packets(hplip_t)
 corenet_udp_bind_howl_port(hplip_t)
 
+corecmd_exec_bin(hplip_t)
+
 dev_read_sysfs(hplip_t)
 dev_rw_printer(hplip_t)
 dev_read_urand(hplip_t)
@@ -674,19 +662,16 @@ dev_read_rand(hplip_t)
 dev_rw_generic_usb_dev(hplip_t)
 dev_rw_usbfs(hplip_t)
 
-fs_getattr_all_fs(hplip_t)
-fs_search_auto_mountpoints(hplip_t)
-fs_rw_anon_inodefs_files(hplip_t)
-
-# for python
-corecmd_exec_bin(hplip_t)
-
 domain_use_interactive_fds(hplip_t)
 
 files_read_etc_files(hplip_t)
 files_read_etc_runtime_files(hplip_t)
 files_read_usr_files(hplip_t)
 
+fs_getattr_all_fs(hplip_t)
+fs_search_auto_mountpoints(hplip_t)
+fs_rw_anon_inodefs_files(hplip_t)
+
 logging_send_syslog_msg(hplip_t)
 
 miscfiles_read_localization(hplip_t)
@@ -697,11 +682,17 @@ userdom_dontaudit_use_unpriv_user_fds(hplip_t)
 userdom_dontaudit_search_user_home_dirs(hplip_t)
 userdom_dontaudit_search_user_home_content(hplip_t)
 
-lpd_read_config(hplip_t)
-lpd_manage_spool(hplip_t)
-
 optional_policy(`
 	dbus_system_bus_client(hplip_t)
+
+	optional_policy(`
+		userdom_dbus_send_all_users(hplip_t)
+	')
+')
+
+optional_policy(`
+	lpd_read_config(hplip_t)
+	lpd_manage_spool(hplip_t)
 ')
 
 optional_policy(`
@@ -724,14 +715,12 @@ optional_policy(`
 allow ptal_t self:capability { chown sys_rawio };
 dontaudit ptal_t self:capability sys_tty_config;
 allow ptal_t self:fifo_file rw_fifo_file_perms;
-allow ptal_t self:unix_dgram_socket create_socket_perms;
-allow ptal_t self:unix_stream_socket create_stream_socket_perms;
+allow ptal_t self:unix_stream_socket { accept listen };
 allow ptal_t self:tcp_socket create_stream_socket_perms;
 
 allow ptal_t ptal_etc_t:dir list_dir_perms;
 read_files_pattern(ptal_t, ptal_etc_t, ptal_etc_t)
 read_lnk_files_pattern(ptal_t, ptal_etc_t, ptal_etc_t)
-files_search_etc(ptal_t)
 
 manage_dirs_pattern(ptal_t, ptal_var_run_t, ptal_var_run_t)
 manage_files_pattern(ptal_t, ptal_var_run_t, ptal_var_run_t)
@@ -748,22 +737,24 @@ corenet_all_recvfrom_unlabeled(ptal_t)
 corenet_all_recvfrom_netlabel(ptal_t)
 corenet_tcp_sendrecv_generic_if(ptal_t)
 corenet_tcp_sendrecv_generic_node(ptal_t)
-corenet_tcp_sendrecv_all_ports(ptal_t)
 corenet_tcp_bind_generic_node(ptal_t)
+
+corenet_sendrecv_ptal_server_packets(ptal_t)
 corenet_tcp_bind_ptal_port(ptal_t)
+corenet_tcp_sendrecv_ptal_port(ptal_t)
 
 dev_read_sysfs(ptal_t)
 dev_read_usbfs(ptal_t)
 dev_rw_printer(ptal_t)
 
-fs_getattr_all_fs(ptal_t)
-fs_search_auto_mountpoints(ptal_t)
-
 domain_use_interactive_fds(ptal_t)
 
 files_read_etc_files(ptal_t)
 files_read_etc_runtime_files(ptal_t)
 
+fs_getattr_all_fs(ptal_t)
+fs_search_auto_mountpoints(ptal_t)
+
 logging_send_syslog_msg(ptal_t)
 
 miscfiles_read_localization(ptal_t)

diff --git a/policy/modules/contrib/kerberos.if b/policy/modules/contrib/kerberos.if
index 604f67b..399b604 100644
--- a/policy/modules/contrib/kerberos.if
+++ b/policy/modules/contrib/kerberos.if
@@ -296,6 +296,35 @@ interface(`kerberos_manage_host_rcache',`
 
 ########################################
 ## <summary>
+##	Create objects in generic temporary
+##	directories with host rcache type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	Class of the object being created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`kerberos_tmp_filetrans_host_rcache',`
+	gen_require(`
+		type krb5_host_rcache_t;
+	')
+
+	files_tmp_filetrans($1, krb5_host_rcache_t, $2, $3)
+')
+
+########################################
+## <summary>
 ##	Connect to krb524 service
 ## </summary>
 ## <param name="domain">

diff --git a/policy/modules/contrib/kerberos.te b/policy/modules/contrib/kerberos.te
index 6a95faf..794c90d 100644
--- a/policy/modules/contrib/kerberos.te
+++ b/policy/modules/contrib/kerberos.te
@@ -1,4 +1,4 @@
-policy_module(kerberos, 1.11.0)
+policy_module(kerberos, 1.11.1)
 
 ########################################
 #

diff --git a/policy/modules/contrib/samba.if b/policy/modules/contrib/samba.if
index 82cb169..ce060c5 100644
--- a/policy/modules/contrib/samba.if
+++ b/policy/modules/contrib/samba.if
@@ -42,6 +42,27 @@ interface(`samba_signal_nmbd',`
 
 ########################################
 ## <summary>
+##	Connect to nmbd with a unix domain
+##	stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`samba_stream_connect_nmbd',`
+	gen_require(`
+		type samba_var_t, nmbd_t, nmbd_var_run_t;
+	')
+
+	files_search_pids($1)
+	allow $1 samba_var_t:dir search_dir_perms;
+	stream_connect_pattern($1, nmbd_var_run_t, nmbd_var_run_t, nmbd_t)
+')
+
+########################################
+## <summary>
 ##	Execute samba server in the samba domain.
 ## </summary>
 ## <param name="domain">

diff --git a/policy/modules/contrib/samba.te b/policy/modules/contrib/samba.te
index 905883f..6a97c25 100644
--- a/policy/modules/contrib/samba.te
+++ b/policy/modules/contrib/samba.te
@@ -1,4 +1,4 @@
-policy_module(samba, 1.15.0)
+policy_module(samba, 1.15.1)
 
 #################################
 #