Bulk addition of new selinux policies.

(Portage version: 2.1.9.25/cvs/Linux x86_64)

60 files changed, 1575 insertions, 0 deletions

diff --git a/sec-policy/selinux-alsa/ChangeLog b/sec-policy/selinux-alsa/ChangeLog
new file mode 100644
index 000000000000..f3991356e907
--- /dev/null
+++ b/sec-policy/selinux-alsa/ChangeLog
@@ -0,0 +1,13 @@
+# ChangeLog for sec-policy/selinux-alsa
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-alsa/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+  05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog:
+  Initial commit to portage.
+
+*selinux-alsa-2.20101213-r1 (22 Jan 2011)
+
+  22 Jan 2011; <swift@gentoo.org> +selinux-alsa-2.20101213-r1.ebuild,
+  +files/fix-alsa.patch:
+  Correct file context for alsactl command
+
diff --git a/sec-policy/selinux-alsa/files/fix-alsa.patch b/sec-policy/selinux-alsa/files/fix-alsa.patch
new file mode 100644
index 000000000000..385ca2d6367c
--- /dev/null
+++ b/sec-policy/selinux-alsa/files/fix-alsa.patch
@@ -0,0 +1,10 @@
+--- admin/alsa.fc	2010-09-03 17:23:05.000000000 +0200
++++ ../../../refpolicy/policy/modules/admin/alsa.fc	2011-01-15 20:28:15.015000008 +0100
+@@ -8,6 +8,7 @@
+ /etc/asound\.state	--	gen_context(system_u:object_r:alsa_etc_rw_t,s0)
+ 
+ /sbin/alsactl 		--	gen_context(system_u:object_r:alsa_exec_t,s0)
++/usr/sbin/alsactl	--	gen_context(system_u:object_r:alsa_exec_t,s0)
+ /sbin/salsa 		--	gen_context(system_u:object_r:alsa_exec_t,s0)
+ 
+ /usr/bin/ainit 		--	gen_context(system_u:object_r:alsa_exec_t,s0)
diff --git a/sec-policy/selinux-alsa/metadata.xml b/sec-policy/selinux-alsa/metadata.xml
new file mode 100644
index 000000000000..b6b56659e582
--- /dev/null
+++ b/sec-policy/selinux-alsa/metadata.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>hardened</herd>
+<maintainer>
+  <email>pebenito@gentoo.org</email>
+  <name>Chris PeBenito</name>
+  <description>Primary Maintainer</description>
+</maintainer>
+<longdescription>Gentoo SELinux policy for the ALSA tools</longdescription>
+</pkgmetadata>
diff --git a/sec-policy/selinux-alsa/selinux-alsa-2.20101213-r1.ebuild b/sec-policy/selinux-alsa/selinux-alsa-2.20101213-r1.ebuild
new file mode 100644
index 000000000000..64c8faff60d0
--- /dev/null
+++ b/sec-policy/selinux-alsa/selinux-alsa-2.20101213-r1.ebuild
@@ -0,0 +1,15 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-alsa/selinux-alsa-2.20101213-r1.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+IUSE=""
+
+MODS="alsa"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/fix-alsa.patch"
diff --git a/sec-policy/selinux-alsa/selinux-alsa-2.20101213.ebuild b/sec-policy/selinux-alsa/selinux-alsa-2.20101213.ebuild
new file mode 100644
index 000000000000..75f88b50b473
--- /dev/null
+++ b/sec-policy/selinux-alsa/selinux-alsa-2.20101213.ebuild
@@ -0,0 +1,13 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-alsa/selinux-alsa-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+IUSE=""
+
+MODS="alsa"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
diff --git a/sec-policy/selinux-gorg/ChangeLog b/sec-policy/selinux-gorg/ChangeLog
new file mode 100644
index 000000000000..087f7dd422e9
--- /dev/null
+++ b/sec-policy/selinux-gorg/ChangeLog
@@ -0,0 +1,13 @@
+# ChangeLog for sec-policy/selinux-gorg
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-gorg/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+  05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog:
+  Initial commit to portage.
+
+*selinux-gorg-2.20101213 (07 Jan 2011)
+
+  07 Jan 2011; <swift@gentoo.org> +selinux-gorg-2.20101213.ebuild,
+  +files/add-gorg.patch:
+  Adding gorg module
+
diff --git a/sec-policy/selinux-gorg/files/add-gorg.patch b/sec-policy/selinux-gorg/files/add-gorg.patch
new file mode 100644
index 000000000000..71e8cb10d02c
--- /dev/null
+++ b/sec-policy/selinux-gorg/files/add-gorg.patch
@@ -0,0 +1,68 @@
+--- services/gorg.te	1970-01-01 01:00:00.000000000 +0100
++++ ../../../refpolicy/policy/modules/services/gorg.te	2011-01-07 22:35:18.986000107 +0100
+@@ -0,0 +1,59 @@
++policy_module(gorg, 1.0.0)
++
++type gorg_t;
++type gorg_exec_t;
++typealias gorg_t alias { staff_gorg_t user_gorg_t };
++application_domain(gorg_t, gorg_exec_t)
++role staff_r types gorg_t;
++role user_r types gorg_t;
++
++type gorg_cache_t;
++files_type(gorg_cache_t);
++
++type gorg_config_t;
++files_type(gorg_config_t);
++
++# Allow gorg_t to put files in the gorg_cache_t location(s)
++manage_dirs_pattern(gorg_t, gorg_cache_t, gorg_cache_t)
++manage_files_pattern(gorg_t, gorg_cache_t, gorg_cache_t)
++
++# Allow gorg_t to read configuration file(s)
++allow gorg_t gorg_config_t:dir list_dir_perms;
++read_files_pattern(gorg_t, gorg_config_t, gorg_config_t)
++
++# gorg logs through /dev/log
++logging_send_syslog_msg(gorg_t)
++
++# Allow gorg to bind to port 8080 (http_cache_port_t)
++sysnet_read_config(gorg_t)
++sysnet_dns_name_resolve(gorg_t)
++corenet_all_recvfrom_unlabeled(gorg_t)
++corenet_all_recvfrom_netlabel(gorg_t)
++corenet_tcp_sendrecv_generic_if(gorg_t)
++corenet_tcp_sendrecv_generic_node(gorg_t)
++#corenet_tcp_sendrecv_all_ports(gorg_t)
++corenet_tcp_bind_generic_node(gorg_t)
++corenet_tcp_bind_http_cache_port(gorg_t)
++allow gorg_t self:netlink_route_socket { create_socket_perms nlmsg_read };
++allow gorg_t self:tcp_socket { listen accept };
++
++# Allow gorg read access to user home files (usually where cvs/git pull is stored)
++files_search_home(gorg_t)
++userdom_search_user_home_dirs(gorg_t)
++userdom_user_home_content(gorg_t)
++userdom_list_user_home_content(gorg_t)
++userdom_read_user_home_content_symlinks(gorg_t)
++userdom_read_user_home_content_files(gorg_t)
++
++# Local policy
++allow gorg_t self:fifo_file rw_fifo_file_perms;
++
++# Read /etc files (xml/catalog, hosts.conf, ...)
++files_read_etc_files(gorg_t)
++
++# Gorg is ruby, so be able to execute ruby
++corecmd_exec_bin(gorg_t)
++
++# Output to screen
++userdom_use_user_terminals(gorg_t)
++domain_use_interactive_fds(gorg_t)
+--- services/gorg.fc	1970-01-01 01:00:00.000000000 +0100
++++ ../../../refpolicy/policy/modules/services/gorg.fc	2011-01-07 22:35:22.840999786 +0100
+@@ -0,0 +1,3 @@
++/etc/gorg(/.*)?				gen_context(system_u:object_r:gorg_config_t,s0)
++/var/cache/gorg(/.*)?			gen_context(system_u:object_r:gorg_cache_t,s0)
++/usr/bin/gorg			--	gen_context(system_u:object_r:gorg_exec_t,s0)
diff --git a/sec-policy/selinux-gorg/metadata.xml b/sec-policy/selinux-gorg/metadata.xml
new file mode 100644
index 000000000000..22e4e153f44e
--- /dev/null
+++ b/sec-policy/selinux-gorg/metadata.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>hardened</herd>
+<maintainer>
+  <email>selinux@gentoo.org</email>
+</maintainer>
+<longdescription>Gentoo SELinux policy for gorg.</longdescription>
+</pkgmetadata>
+
diff --git a/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild b/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild
new file mode 100644
index 000000000000..45edb5aba2bf
--- /dev/null
+++ b/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild
@@ -0,0 +1,16 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+IUSE=""
+
+MODS="gorg"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/add-gorg.patch"
+RDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r3"
diff --git a/sec-policy/selinux-links/ChangeLog b/sec-policy/selinux-links/ChangeLog
new file mode 100644
index 000000000000..3fabe772f474
--- /dev/null
+++ b/sec-policy/selinux-links/ChangeLog
@@ -0,0 +1,13 @@
+# ChangeLog for sec-policy/selinux-links
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-links/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+  05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog:
+  Initial commit to portage.
+
+*selinux-links-2.20101213 (22 Jan 2011)
+
+  22 Jan 2011; <swift@gentoo.org> +selinux-links-2.20101213.ebuild,
+  +files/add-apps-links.patch, +metadata.xml:
+  Adding SELinux policy for links webbrowser
+
diff --git a/sec-policy/selinux-links/files/add-apps-links.patch b/sec-policy/selinux-links/files/add-apps-links.patch
new file mode 100644
index 000000000000..938ab975b74b
--- /dev/null
+++ b/sec-policy/selinux-links/files/add-apps-links.patch
@@ -0,0 +1,66 @@
+--- apps/links.te	1970-01-01 01:00:00.000000000 +0100
++++ apps/links.te	2011-01-22 15:01:55.272000135 +0100
+@@ -0,0 +1,58 @@
++policy_module(links, 1.0.0)
++
++############################
++# 
++# Declarations
++#
++
++type links_t;
++type links_exec_t;
++application_domain(links_t, links_exec_t)
++
++type links_home_t;
++typealias links_home_t alias { user_links_home_t staff_links_home_t sysadm_links_home_t };
++userdom_user_home_content(links_home_t)
++
++type links_tmpfs_t;
++typealias links_tmpfs_t alias { user_links_tmpfs_t staff_links_tmpfs_t sysadm_links_tmpfs_t };
++files_tmpfs_file(links_tmpfs_t)
++ubac_constrained(links_tmpfs_t)
++
++############################
++#
++# Policy
++#
++
++allow links_t self:process signal_perms;
++allow links_t self:unix_stream_socket create_stream_socket_perms;
++
++manage_dirs_pattern(links_t, links_home_t, links_home_t)
++manage_files_pattern(links_t, links_home_t, links_home_t)
++manage_lnk_files_pattern(links_t, links_home_t, links_home_t)
++manage_sock_files_pattern(links_t, links_home_t, links_home_t)
++manage_fifo_files_pattern(links_t, links_home_t, links_home_t)
++userdom_user_home_dir_filetrans(links_t, links_home_t, dir)
++
++manage_fifo_files_pattern(links_t, links_t, links_t)
++
++manage_files_pattern(links_t, links_tmpfs_t, links_tmpfs_t)
++manage_lnk_files_pattern(links_t, links_tmpfs_t, links_tmpfs_t)
++manage_fifo_files_pattern(links_t, links_tmpfs_t, links_tmpfs_t)
++manage_sock_files_pattern(links_t, links_tmpfs_t, links_tmpfs_t)
++fs_tmpfs_filetrans(links_t, links_tmpfs_t, { file lnk_file sock_file fifo_file })
++
++xserver_user_x_domain_template(links, links_t, links_tmpfs_t)
++
++domain_use_interactive_fds(links_t)
++
++userdom_manage_user_home_content_dirs(links_t)
++userdom_manage_user_home_content_files(links_t)
++
++auth_use_nsswitch(links_t)
++
++userdom_use_user_terminals(links_t)
++
++corenet_tcp_connect_http_port(links_t)
++
++miscfiles_read_localization(links_t)
++
+--- apps/links.fc	1970-01-01 01:00:00.000000000 +0100
++++ apps/links.fc	2011-01-16 10:50:48.058999501 +0100
+@@ -0,0 +1,2 @@
++/usr/bin/links         -- gen_context(system_u:object_r:links_exec_t,s0)
++HOME_DIR/\.links(/.*)?    gen_context(system_u:object_r:links_home_t,s0)
diff --git a/sec-policy/selinux-links/metadata.xml b/sec-policy/selinux-links/metadata.xml
new file mode 100644
index 000000000000..5cbd4e92a68d
--- /dev/null
+++ b/sec-policy/selinux-links/metadata.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>hardened</herd>
+<longdescription>Gentoo SELinux policy for the links web browser</longdescription>
+</pkgmetadata>
diff --git a/sec-policy/selinux-links/selinux-links-2.20101213.ebuild b/sec-policy/selinux-links/selinux-links-2.20101213.ebuild
new file mode 100644
index 000000000000..61eb85459d6c
--- /dev/null
+++ b/sec-policy/selinux-links/selinux-links-2.20101213.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-links/selinux-links-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+IUSE=""
+
+MODS="links"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+POLICY_PATCH="${FILESDIR}/add-apps-links.patch"
diff --git a/sec-policy/selinux-mozilla/ChangeLog b/sec-policy/selinux-mozilla/ChangeLog
new file mode 100644
index 000000000000..64ccd9257cdc
--- /dev/null
+++ b/sec-policy/selinux-mozilla/ChangeLog
@@ -0,0 +1,14 @@
+# ChangeLog for sec-policy/selinux-mozilla
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mozilla/ChangeLog,v 1.1 2011/02/05 20:41:05 blueness Exp $
+
+  05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog:
+  Initial commit to portage.
+
+*selinux-mozilla-2.20101213-r1 (22 Jan 2011)
+
+  22 Jan 2011; <swift@gentoo.org> +selinux-mozilla-2.20101213-r1.ebuild,
+  files/fix-mozilla.patch:
+  Support binary firefox, add call to alsa interface and support tmp type
+  for mozilla
+
diff --git a/sec-policy/selinux-mozilla/files/fix-mozilla.patch b/sec-policy/selinux-mozilla/files/fix-mozilla.patch
new file mode 100644
index 000000000000..bfa24856170a
--- /dev/null
+++ b/sec-policy/selinux-mozilla/files/fix-mozilla.patch
@@ -0,0 +1,57 @@
+--- apps/mozilla.te	2010-12-13 15:11:01.000000000 +0100
++++ ../../../refpolicy/policy/modules/apps/mozilla.te	2011-01-15 16:27:48.031000003 +0100
+@@ -33,6 +33,10 @@
+ files_tmpfs_file(mozilla_tmpfs_t)
+ ubac_constrained(mozilla_tmpfs_t)
+ 
++type mozilla_tmp_t;
++files_tmp_file(mozilla_tmp_t)
++ubac_constrained(mozilla_tmp_t)
++
+ ########################################
+ #
+ # Local policy
+@@ -68,6 +72,12 @@
+ manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
+ fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
+ 
++manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
++manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
++files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir } )
++userdom_manage_user_tmp_files(mozilla_t)
++userdom_manage_user_tmp_sockets(mozilla_t)
++
+ kernel_read_kernel_sysctls(mozilla_t)
+ kernel_read_network_state(mozilla_t)
+ # Access /proc, sysctl
+@@ -143,6 +153,7 @@
+ 
+ userdom_use_user_ptys(mozilla_t)
+ 
++
+ xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
+ xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
+ xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t)
+@@ -266,3 +277,7 @@
+ optional_policy(`
+ 	thunderbird_domtrans(mozilla_t)
+ ')
++
++optional_policy(`
++	alsa_read_rw_config(mozilla_t)
++')
+--- apps/mozilla.fc	2010-08-03 15:11:03.000000000 +0200
++++ ../../../refpolicy/policy/modules/apps/mozilla.fc	2011-01-02 22:23:34.407000019 +0100
+@@ -27,3 +27,12 @@
+ /usr/lib(64)?/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0)
+ /usr/lib/[^/]*firefox[^/]*/firefox --	gen_context(system_u:object_r:mozilla_exec_t,s0)
+ /usr/lib64/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0)
++
++ifdef(`distro_gentoo',`
++/usr/bin/firefox-bin	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
++/opt/firefox/libxul\.so	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
++/opt/firefox/firefox	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
++/opt/firefox/run-mozilla.sh	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
++/opt/firefox/firefox-bin	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
++/opt/firefox/plugin-container	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
++')
diff --git a/sec-policy/selinux-mozilla/metadata.xml b/sec-policy/selinux-mozilla/metadata.xml
new file mode 100644
index 000000000000..d1cc6baa448f
--- /dev/null
+++ b/sec-policy/selinux-mozilla/metadata.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>hardened</herd>
+<longdescription>Gentoo SELinux policy for mozilla</longdescription>
+</pkgmetadata>
diff --git a/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213-r1.ebuild b/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213-r1.ebuild
new file mode 100644
index 000000000000..df8f5aa9928f
--- /dev/null
+++ b/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213-r1.ebuild
@@ -0,0 +1,15 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213-r1.ebuild,v 1.1 2011/02/05 20:41:05 blueness Exp $
+
+IUSE=""
+
+MODS="mozilla"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/fix-mozilla.patch"
diff --git a/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213.ebuild b/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213.ebuild
new file mode 100644
index 000000000000..7045789cd713
--- /dev/null
+++ b/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213.ebuild
@@ -0,0 +1,15 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213.ebuild,v 1.1 2011/02/05 20:41:05 blueness Exp $
+
+IUSE=""
+
+MODS="mozilla"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/fix-mozilla.patch"
diff --git a/sec-policy/selinux-mplayer/ChangeLog b/sec-policy/selinux-mplayer/ChangeLog
new file mode 100644
index 000000000000..504d51545cce
--- /dev/null
+++ b/sec-policy/selinux-mplayer/ChangeLog
@@ -0,0 +1,13 @@
+# ChangeLog for sec-policy/selinux-mplayer
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mplayer/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+  05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog:
+  Initial commit to portage.
+
+*selinux-mplayer-2.20101213 (07 Jan 2011)
+
+  07 Jan 2011; <swift@gentoo.org> +selinux-mplayer-2.20101213.ebuild,
+  +files/fix-mplayer.patch:
+  Adding mplayer module
+
diff --git a/sec-policy/selinux-mplayer/files/fix-mplayer.patch b/sec-policy/selinux-mplayer/files/fix-mplayer.patch
new file mode 100644
index 000000000000..2e51c7b2ee11
--- /dev/null
+++ b/sec-policy/selinux-mplayer/files/fix-mplayer.patch
@@ -0,0 +1,20 @@
+--- apps/mplayer.te	2010-12-13 15:11:01.000000000 +0100
++++ ../../../refpolicy/policy/modules/apps/mplayer.te	2011-01-07 21:03:00.230000033 +0100
+@@ -197,6 +197,7 @@
+ dev_rwx_zero(mplayer_t)
+ # Access to DVD/CD/V4L
+ dev_read_video_dev(mplayer_t)
++dev_write_video_dev(mplayer_t)
+ # Audio, alsa.conf
+ dev_read_sound_mixer(mplayer_t)
+ dev_write_sound_mixer(mplayer_t)
+@@ -226,6 +227,9 @@
+ miscfiles_read_fonts(mplayer_t)
+ 
+ userdom_use_user_terminals(mplayer_t)
++domain_use_interactive_fds(mplayer_t)
++
++#
+ # Read media files
+ userdom_list_user_tmp(mplayer_t)
+ userdom_read_user_tmp_files(mplayer_t)
diff --git a/sec-policy/selinux-mplayer/metadata.xml b/sec-policy/selinux-mplayer/metadata.xml
new file mode 100644
index 000000000000..bcf7d6334eaf
--- /dev/null
+++ b/sec-policy/selinux-mplayer/metadata.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>hardened</herd>
+<maintainer>
+  <email>selinux@gentoo.org</email>
+</maintainer>
+<longdescription>Gentoo SELinux policy for mplayer.</longdescription>
+</pkgmetadata>
+
diff --git a/sec-policy/selinux-mplayer/selinux-mplayer-2.20101213.ebuild b/sec-policy/selinux-mplayer/selinux-mplayer-2.20101213.ebuild
new file mode 100644
index 000000000000..1d9f53e39e55
--- /dev/null
+++ b/sec-policy/selinux-mplayer/selinux-mplayer-2.20101213.ebuild
@@ -0,0 +1,15 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mplayer/selinux-mplayer-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+IUSE=""
+
+MODS="mplayer"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/fix-mplayer.patch"
diff --git a/sec-policy/selinux-mutt/ChangeLog b/sec-policy/selinux-mutt/ChangeLog
new file mode 100644
index 000000000000..8331d17dc539
--- /dev/null
+++ b/sec-policy/selinux-mutt/ChangeLog
@@ -0,0 +1,19 @@
+# ChangeLog for sec-policy/selinux-mutt
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mutt/ChangeLog,v 1.1 2011/02/05 20:41:03 blueness Exp $
+
+  05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog:
+  Initial commit to portage.
+
+*selinux-mutt-2.20101213-r1 (31 Jan 2011)
+
+  31 Jan 2011; <swift@gentoo.org> +files/add-apps-mutt-r1.patch,
+  +selinux-mutt-2.20101213-r1.ebuild:
+  Updates on policy, allow writes on user homedir for instance
+
+*selinux-mutt-2.20101213 (22 Jan 2011)
+
+  22 Jan 2011; <swift@gentoo.org> +selinux-mutt-2.20101213.ebuild,
+  +files/add-apps-mutt.patch, +metadata.xml:
+  Add SELinux policy module for mutt
+
diff --git a/sec-policy/selinux-mutt/files/add-apps-mutt-r1.patch b/sec-policy/selinux-mutt/files/add-apps-mutt-r1.patch
new file mode 100644
index 000000000000..d8127623373b
--- /dev/null
+++ b/sec-policy/selinux-mutt/files/add-apps-mutt-r1.patch
@@ -0,0 +1,84 @@
+--- apps/mutt.te	1970-01-01 01:00:00.000000000 +0100
++++ apps/mutt.te	2011-01-30 15:24:18.890000182 +0100
+@@ -0,0 +1,74 @@
++policy_module(mutt, 1.0.0)
++
++############################
++# 
++# Declarations
++#
++
++type mutt_t;
++type mutt_exec_t;
++application_domain(mutt_t, mutt_exec_t)
++ubac_constrained(mutt_t)
++
++type mutt_home_t;
++typealias mutt_home_t alias { user_mutt_home_t staff_mutt_home_t sysadm_mutt_home_t };
++userdom_user_home_content(mutt_home_t)
++
++type mutt_conf_t;
++typealias mutt_conf_t alias { user_mutt_conf_t staff_mutt_conf_t sysadm_mutt_conf_t };
++userdom_user_home_content(mutt_conf_t)
++
++type mutt_sys_conf_t;
++files_type(mutt_sys_conf_t)
++
++type mutt_tmp_t;
++typealias mutt_tmp_t alias { user_mutt_tmp_t staff_mutt_tmp_t sysadm_mutt_tmp_t };
++files_tmp_file(mutt_tmp_t)
++ubac_constrained(mutt_tmp_t)
++
++############################
++#
++# Local Policy Rules
++#
++
++allow mutt_t self:process signal_perms;
++
++
++manage_dirs_pattern(mutt_t, mutt_home_t, mutt_home_t)
++manage_files_pattern(mutt_t, mutt_home_t, mutt_home_t)
++userdom_user_home_dir_filetrans(mutt_t, mutt_home_t, dir)
++
++manage_dirs_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t)
++manage_files_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t)
++manage_fifo_files_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t)
++files_tmp_filetrans(mutt_t, mutt_tmp_t, { file dir })
++files_search_tmp(mutt_t)
++
++read_files_pattern(mutt_t, mutt_sys_conf_t, mutt_sys_conf_t)
++read_files_pattern(mutt_t, mutt_conf_t, mutt_conf_t)
++search_dirs_pattern(mutt_t, mutt_sys_conf_t, mutt_sys_conf_t)
++
++
++corecmd_exec_bin(mutt_t)
++corecmd_exec_shell(mutt_t)
++corenet_tcp_connect_pop_port(mutt_t)
++corenet_tcp_connect_smtp_port(mutt_t)
++dev_read_rand(mutt_t)
++dev_read_urand(mutt_t)
++domain_use_interactive_fds(mutt_t)
++files_read_usr_files(mutt_t)
++
++
++auth_use_nsswitch(mutt_t)
++miscfiles_read_localization(mutt_t)
++userdom_manage_user_home_content_files(mutt_t)
++userdom_manage_user_home_content_dirs(mutt_t)
++userdom_search_user_home_content(mutt_t)
++userdom_use_user_terminals(mutt_t)
++
++
++
++
++tunable_policy(`gentoo_try_dontaudit',`
++	kernel_dontaudit_search_sysctl(mutt_t)
++')
+--- apps/mutt.fc	1970-01-01 01:00:00.000000000 +0100
++++ apps/mutt.fc	2011-01-16 13:56:03.314000081 +0100
+@@ -0,0 +1,4 @@
++/usr/bin/mutt          -- gen_context(system_u:object_r:mutt_exec_t,s0)
++HOME_DIR/\.mutt(/.*)?     gen_context(system_u:object_r:mutt_home_t,s0)
++HOME_DIR/\.muttrc      -- gen_context(system_u:object_r:mutt_conf_t,s0)
++/etc/mutt(/.*)?           gen_context(system_u:object_r:mutt_sys_conf_t,s0)
diff --git a/sec-policy/selinux-mutt/files/add-apps-mutt.patch b/sec-policy/selinux-mutt/files/add-apps-mutt.patch
new file mode 100644
index 000000000000..4dd6e05b55b2
--- /dev/null
+++ b/sec-policy/selinux-mutt/files/add-apps-mutt.patch
@@ -0,0 +1,86 @@
+--- apps/mutt.te	1970-01-01 01:00:00.000000000 +0100
++++ apps/mutt.te	2011-01-22 15:22:46.330000061 +0100
+@@ -0,0 +1,76 @@
++policy_module(mutt, 1.0.0)
++
++############################
++# 
++# Declarations
++#
++
++type mutt_t;
++type mutt_exec_t;
++application_domain(mutt_t, mutt_exec_t)
++ubac_constrained(mutt_t)
++
++type mutt_home_t;
++typealias mutt_home_t alias { user_mutt_home_t staff_mutt_home_t sysadm_mutt_home_t };
++userdom_user_home_content(mutt_home_t)
++
++type mutt_conf_t;
++typealias mutt_conf_t alias { user_mutt_conf_t staff_mutt_conf_t sysadm_mutt_conf_t };
++userdom_user_home_content(mutt_conf_t)
++
++type mutt_sys_conf_t;
++files_type(mutt_sys_conf_t)
++
++type mutt_tmp_t;
++typealias mutt_tmp_t alias { user_mutt_tmp_t staff_mutt_tmp_t sysadm_mutt_tmp_t };
++files_tmp_file(mutt_tmp_t)
++ubac_constrained(mutt_tmp_t)
++
++############################
++#
++# Policy
++#
++
++allow mutt_t self:process signal_perms;
++#allow mutt_t self:unix_stream_socket create_stream_socket_perms;
++
++manage_dirs_pattern(mutt_t, mutt_home_t, mutt_home_t)
++manage_files_pattern(mutt_t, mutt_home_t, mutt_home_t)
++#manage_lnk_files_pattern(mutt_t, mutt_home_t, mutt_home_t)
++#manage_sock_files_pattern(mutt_t, mutt_home_t, mutt_home_t)
++#manage_fifo_files_pattern(mutt_t, mutt_home_t, mutt_home_t)
++userdom_user_home_dir_filetrans(mutt_t, mutt_home_t, dir)
++#manage_fifo_files_pattern(mutt_t, mutt_t, mutt_t)
++
++manage_dirs_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t)
++manage_files_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t)
++manage_fifo_files_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t)
++files_tmp_filetrans(mutt_t, mutt_tmp_t, { file dir })
++files_search_tmp(mutt_t)
++
++read_files_pattern(mutt_t, mutt_sys_conf_t, mutt_sys_conf_t)
++read_files_pattern(mutt_t, mutt_conf_t, mutt_conf_t)
++search_dirs_pattern(mutt_t, mutt_sys_conf_t, mutt_sys_conf_t)
++
++userdom_search_user_home_content(mutt_t)
++userdom_manage_user_home_content_files(mutt_t)
++userdom_manage_user_home_content_dirs(mutt_t)
++
++corecmd_exec_bin(mutt_t)
++corecmd_exec_shell(mutt_t)
++files_read_usr_files(mutt_t)
++
++domain_use_interactive_fds(mutt_t)
++
++auth_use_nsswitch(mutt_t)
++
++userdom_use_user_terminals(mutt_t)
++
++corenet_tcp_connect_pop_port(mutt_t)
++corenet_tcp_connect_smtp_port(mutt_t)
++
++miscfiles_read_localization(mutt_t)
++
++dev_read_rand(mutt_t)
++dev_read_urand(mutt_t)
++
+--- apps/mutt.fc	1970-01-01 01:00:00.000000000 +0100
++++ apps/mutt.fc	2011-01-16 13:56:03.314000081 +0100
+@@ -0,0 +1,4 @@
++/usr/bin/mutt          -- gen_context(system_u:object_r:mutt_exec_t,s0)
++HOME_DIR/\.mutt(/.*)?     gen_context(system_u:object_r:mutt_home_t,s0)
++HOME_DIR/\.muttrc      -- gen_context(system_u:object_r:mutt_conf_t,s0)
++/etc/mutt(/.*)?           gen_context(system_u:object_r:mutt_sys_conf_t,s0)
diff --git a/sec-policy/selinux-mutt/metadata.xml b/sec-policy/selinux-mutt/metadata.xml
new file mode 100644
index 000000000000..c89b0e8d6995
--- /dev/null
+++ b/sec-policy/selinux-mutt/metadata.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>hardened</herd>
+<longdescription>Gentoo SELinux policy for the mutt e-mail client</longdescription>
+</pkgmetadata>
diff --git a/sec-policy/selinux-mutt/selinux-mutt-2.20101213-r1.ebuild b/sec-policy/selinux-mutt/selinux-mutt-2.20101213-r1.ebuild
new file mode 100644
index 000000000000..89c6393e546d
--- /dev/null
+++ b/sec-policy/selinux-mutt/selinux-mutt-2.20101213-r1.ebuild
@@ -0,0 +1,15 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mutt/selinux-mutt-2.20101213-r1.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $
+
+IUSE=""
+
+MODS="mutt"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/add-apps-mutt-r1.patch"
diff --git a/sec-policy/selinux-mutt/selinux-mutt-2.20101213.ebuild b/sec-policy/selinux-mutt/selinux-mutt-2.20101213.ebuild
new file mode 100644
index 000000000000..82b5607af0ea
--- /dev/null
+++ b/sec-policy/selinux-mutt/selinux-mutt-2.20101213.ebuild
@@ -0,0 +1,15 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mutt/selinux-mutt-2.20101213.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $
+
+IUSE=""
+
+MODS="mutt"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/add-apps-mutt.patch"
diff --git a/sec-policy/selinux-networkmanager/ChangeLog b/sec-policy/selinux-networkmanager/ChangeLog
new file mode 100644
index 000000000000..6dd49c3ba62b
--- /dev/null
+++ b/sec-policy/selinux-networkmanager/ChangeLog
@@ -0,0 +1,7 @@
+# ChangeLog for sec-policy/selinux-networkmanager
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-networkmanager/ChangeLog,v 1.1 2011/02/05 20:41:05 blueness Exp $
+
+  05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog:
+  Initial commit to portage.
+
diff --git a/sec-policy/selinux-networkmanager/files/fix-networkmanager.patch b/sec-policy/selinux-networkmanager/files/fix-networkmanager.patch
new file mode 100644
index 000000000000..8c38757d1b44
--- /dev/null
+++ b/sec-policy/selinux-networkmanager/files/fix-networkmanager.patch
@@ -0,0 +1,75 @@
+--- services/networkmanager.te	2010-09-10 17:05:45.000000000 +0200
++++ ../../../refpolicy/policy/modules/services/networkmanager.te	2011-01-02 15:40:48.781999979 +0100
+@@ -28,6 +28,9 @@
+ type wpa_cli_exec_t;
+ init_system_domain(wpa_cli_t, wpa_cli_exec_t)
+ 
++type wpa_cli_var_run_t;
++files_pid_file(wpa_cli_var_run_t)
++
+ ########################################
+ #
+ # Local policy
+@@ -68,6 +71,11 @@
+ manage_sock_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
+ files_pid_filetrans(NetworkManager_t, NetworkManager_var_run_t, { dir file sock_file })
+ 
++manage_dirs_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t)
++manage_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t)
++manage_sock_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t)
++files_pid_filetrans(wpa_cli_t, wpa_cli_var_run_t, { dir file sock_file })
++
+ kernel_read_system_state(NetworkManager_t)
+ kernel_read_network_state(NetworkManager_t)
+ kernel_read_kernel_sysctls(NetworkManager_t)
+@@ -125,10 +133,12 @@
+ init_read_utmp(NetworkManager_t)
+ init_dontaudit_write_utmp(NetworkManager_t)
+ init_domtrans_script(NetworkManager_t)
++init_domtrans_script(wpa_cli_t)
+ 
+ auth_use_nsswitch(NetworkManager_t)
+ 
+ logging_send_syslog_msg(NetworkManager_t)
++logging_send_syslog_msg(wpa_cli_t)
+ 
+ miscfiles_read_localization(NetworkManager_t)
+ miscfiles_read_generic_certs(NetworkManager_t)
+@@ -149,6 +159,7 @@
+ 
+ userdom_dontaudit_use_unpriv_user_fds(NetworkManager_t)
+ userdom_dontaudit_use_user_ttys(NetworkManager_t)
++userdom_use_user_ttys(wpa_cli_t)
+ # Read gnome-keyring
+ userdom_read_user_home_content_files(NetworkManager_t)
+ 
+@@ -287,3 +298,20 @@
+ miscfiles_read_localization(wpa_cli_t)
+ 
+ term_dontaudit_use_console(wpa_cli_t)
++
++fs_search_tmpfs(wpa_cli_t)
++fs_search_tmpfs(NetworkManager_t)
++fs_rw_tmpfs_files(wpa_cli_t)
++fs_rw_tmpfs_files(NetworkManager_t)
++fs_manage_tmpfs_dirs(wpa_cli_t)
++fs_manage_tmpfs_sockets(wpa_cli_t)
++fs_manage_tmpfs_sockets(NetworkManager_t)
++getty_use_fds(wpa_cli_t)
++files_search_pids(wpa_cli_t)
++corecmd_exec_shell(wpa_cli_t)
++corecmd_exec_bin(wpa_cli_t)
++
++ifdef(`distro_gentoo',`
++	sysnet_domtrans_dhcpc(wpa_cli_t)
++	allow wpa_cli_t etc_t:file { getattr };
++')
+--- services/networkmanager.fc	2010-08-03 15:11:06.000000000 +0200
++++ ../../../refpolicy/policy/modules/services/networkmanager.fc	2011-01-02 17:30:48.448999997 +0100
+@@ -24,3 +24,6 @@
+ /var/run/nm-dhclient.*			gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
+ /var/run/wpa_supplicant(/.*)?		gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
+ /var/run/wpa_supplicant-global	-s	gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
++/var/run/wpa_cli-.*		--	gen_context(system_u:object_r:wpa_cli_var_run_t,s0)
++/etc/wpa_supplicant/wpa_cli.sh	--	gen_context(system_u:object_r:bin_t,s0)
++/usr/bin/wpa_cli		--	gen_context(system_u:object_r:wpa_cli_exec_t,s0)
diff --git a/sec-policy/selinux-networkmanager/metadata.xml b/sec-policy/selinux-networkmanager/metadata.xml
new file mode 100644
index 000000000000..1323c5ca543a
--- /dev/null
+++ b/sec-policy/selinux-networkmanager/metadata.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>hardened</herd>
+<longdescription>Gentoo SELinux policy for networkmanager</longdescription>
+</pkgmetadata>
diff --git a/sec-policy/selinux-networkmanager/selinux-networkmanager-2.20101213.ebuild b/sec-policy/selinux-networkmanager/selinux-networkmanager-2.20101213.ebuild
new file mode 100644
index 000000000000..4a59b6060946
--- /dev/null
+++ b/sec-policy/selinux-networkmanager/selinux-networkmanager-2.20101213.ebuild
@@ -0,0 +1,22 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-networkmanager/selinux-networkmanager-2.20101213.ebuild,v 1.1 2011/02/05 20:41:05 blueness Exp $
+
+IUSE=""
+
+MODS="networkmanager"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+MODDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r1"
+
+# Patch "fix-networkmanager.patch" contains:
+# - Support for wpa_cli. Gentoo's init scripts use wpa_cli to run the init
+#   scripts when wpa_supplicant has associated.
+# - Support running wpa_cli from commandline (requires
+#   selinux-base-policy-2.20101213-r1) due to patch to sysadm_t domain
+POLICY_PATCH="${FILESDIR}/fix-networkmanager.patch"
diff --git a/sec-policy/selinux-qemu/ChangeLog b/sec-policy/selinux-qemu/ChangeLog
new file mode 100644
index 000000000000..f9f57b57096c
--- /dev/null
+++ b/sec-policy/selinux-qemu/ChangeLog
@@ -0,0 +1,13 @@
+# ChangeLog for sec-policy/selinux-qemu
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-qemu/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+  05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog:
+  Initial commit to portage.
+
+*selinux-qemu-2.20101213 (22 Jan 2011)
+
+  22 Jan 2011; <swift@gentoo.org> +selinux-qemu-2.20101213.ebuild,
+  +files/fix-apps-qemu.patch, +metadata.xml:
+  Adding SELinux policy for QEMU
+
diff --git a/sec-policy/selinux-qemu/files/fix-apps-qemu.patch b/sec-policy/selinux-qemu/files/fix-apps-qemu.patch
new file mode 100644
index 000000000000..9e15caa1923a
--- /dev/null
+++ b/sec-policy/selinux-qemu/files/fix-apps-qemu.patch
@@ -0,0 +1,21 @@
+--- apps/qemu.te	2010-12-13 15:11:01.000000000 +0100
++++ apps/qemu.te	2011-01-22 21:35:19.555999967 +0100
+@@ -56,6 +56,10 @@
+ userdom_search_user_home_content(qemu_t)
+ userdom_read_user_tmpfs_files(qemu_t)
+ 
++allow qemu_t self:socket create_socket_perms;
++
++kernel_request_load_module(qemu_t)
++
+ tunable_policy(`qemu_full_network',`
+ 	allow qemu_t self:udp_socket create_socket_perms;
+ 
+@@ -116,3 +120,7 @@
+ 	allow unconfined_qemu_t self:process { execstack execmem };
+ 	allow unconfined_qemu_t qemu_exec_t:file execmod;
+ ')
++
++optional_policy(`
++	vde_connect(qemu_t)
++')
diff --git a/sec-policy/selinux-qemu/metadata.xml b/sec-policy/selinux-qemu/metadata.xml
new file mode 100644
index 000000000000..d53a19c789c7
--- /dev/null
+++ b/sec-policy/selinux-qemu/metadata.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>hardened</herd>
+<longdescription>Gentoo SELinux policy for the QEMU tools</longdescription>
+</pkgmetadata>
diff --git a/sec-policy/selinux-qemu/selinux-qemu-2.20101213.ebuild b/sec-policy/selinux-qemu/selinux-qemu-2.20101213.ebuild
new file mode 100644
index 000000000000..08bf6a50ac05
--- /dev/null
+++ b/sec-policy/selinux-qemu/selinux-qemu-2.20101213.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-qemu/selinux-qemu-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+IUSE=""
+
+MODS="qemu"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+POLICY_PATCH="${FILESDIR}/fix-apps-qemu.patch"
diff --git a/sec-policy/selinux-skype/ChangeLog b/sec-policy/selinux-skype/ChangeLog
new file mode 100644
index 000000000000..9a6d1e425f67
--- /dev/null
+++ b/sec-policy/selinux-skype/ChangeLog
@@ -0,0 +1,19 @@
+# ChangeLog for sec-policy/selinux-skype
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-skype/ChangeLog,v 1.1 2011/02/05 20:41:03 blueness Exp $
+
+  05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog:
+  Initial commit to portage.
+
+*selinux-skype-2.20101213-r2 (31 Jan 2011)
+
+  31 Jan 2011; <swift@gentoo.org> +files/add-apps-skype-r2.patch,
+  +selinux-skype-2.20101213-r2.ebuild:
+  Allow userhome access, set some dontaudits etc.
+
+*selinux-skype-2.20101213-r1 (22 Jan 2011)
+
+  22 Jan 2011; <swift@gentoo.org> +selinux-skype-2.20101213-r1.ebuild,
+  +files/add-apps-skype.patch:
+  Update skype module to 'comply' with suggested approach for domains
+
diff --git a/sec-policy/selinux-skype/files/add-apps-skype-r2.patch b/sec-policy/selinux-skype/files/add-apps-skype-r2.patch
new file mode 100644
index 000000000000..95b6674334f1
--- /dev/null
+++ b/sec-policy/selinux-skype/files/add-apps-skype-r2.patch
@@ -0,0 +1,106 @@
+--- apps/skype.te	1970-01-01 01:00:00.000000000 +0100
++++ apps/skype.te	2011-01-30 16:17:19.481000177 +0100
+@@ -0,0 +1,97 @@
++policy_module(skype, 0.0.2)
++
++############################
++# 
++# Declarations
++#
++
++type skype_t;
++type skype_exec_t;
++application_domain(skype_t, skype_exec_t)
++
++type skype_home_t;
++
++type skype_tmpfs_t;
++files_tmpfs_file(skype_tmpfs_t)
++ubac_constrained(skype_tmpfs_t)
++
++############################
++#
++# Policy
++#
++
++allow skype_t self:process { getsched setsched execmem };
++allow skype_t self:fifo_file rw_fifo_file_perms;
++allow skype_t self:unix_stream_socket create_socket_perms;
++allow skype_t self:sem create_sem_perms;
++allow skype_t self:tcp_socket create_stream_socket_perms;
++
++
++manage_dirs_pattern(skype_t, skype_home_t, skype_home_t)
++manage_files_pattern(skype_t, skype_home_t, skype_home_t)
++manage_lnk_files_pattern(skype_t, skype_home_t, skype_home_t)
++userdom_user_home_dir_filetrans(skype_t, skype_home_t, dir)
++userdom_user_home_content(skype_home_t)
++
++manage_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++manage_lnk_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++manage_fifo_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++manage_sock_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++fs_tmpfs_filetrans(skype_t, skype_tmpfs_t, { file lnk_file sock_file fifo_file })
++
++
++kernel_read_system_state(skype_t)
++
++can_exec(skype_t, skype_exec_t)
++corecmd_exec_bin(skype_t)
++corecmd_exec_shell(skype_t)
++corenet_all_recvfrom_netlabel(skype_t)
++corenet_all_recvfrom_unlabeled(skype_t)
++corenet_tcp_bind_generic_node(skype_t)
++corenet_udp_bind_generic_node(skype_t)
++corenet_tcp_bind_generic_port(skype_t) 
++corenet_udp_bind_generic_port(skype_t) 
++corenet_tcp_connect_generic_port(skype_t)
++corenet_tcp_connect_http_port(skype_t)
++corenet_tcp_sendrecv_http_port(skype_t)
++corenet_sendrecv_http_client_packets(skype_t)
++dev_read_sound(skype_t)
++dev_read_video_dev(skype_t)
++dev_write_sound(skype_t)
++dev_write_video_dev(skype_t)
++files_read_etc_files(skype_t)
++files_read_usr_files(skype_t)
++
++
++auth_use_nsswitch(skype_t)
++domain_use_interactive_fds(skype_t)
++libs_use_ld_so(skype_t)
++miscfiles_dontaudit_setattr_fonts_dirs(skype_t)
++miscfiles_read_localization(skype_t)
++userdom_manage_user_home_content_dirs(skype_t)
++userdom_manage_user_home_content_files(skype_t)
++userdom_use_user_terminals(skype_t)
++
++
++xserver_user_x_domain_template(skype, skype_t, skype_tmpfs_t)
++
++tunable_policy(`gentoo_try_dontaudit',`
++	dev_dontaudit_search_sysfs(skype_t)
++	fs_dontaudit_getattr_xattr_fs(skype_t)
++')
++
++optional_policy(`
++	tunable_policy(`gentoo_try_dontaudit',`
++		mozilla_dontaudit_manage_user_home_files(skype_t)
++	')
++')
++
++optional_policy(`
++	alsa_read_rw_config(skype_t)
++')
++
++optional_policy(`
++	dbus_system_bus_client(skype_t)
++	dbus_session_bus_client(skype_t)
++')
++
+--- apps/skype.fc	1970-01-01 01:00:00.000000000 +0100
++++ apps/skype.fc	2011-01-09 21:27:25.364999962 +0100
+@@ -0,0 +1,3 @@
++/usr/bin/skype         -- gen_context(system_u:object_r:skype_exec_t,s0)
++/opt/skype/skype       -- gen_context(system_u:object_r:skype_exec_t,s0)
++HOME_DIR/\.Skype(/.*)?    gen_context(system_u:object_r:skype_home_t,s0)
diff --git a/sec-policy/selinux-skype/files/add-apps-skype.patch b/sec-policy/selinux-skype/files/add-apps-skype.patch
new file mode 100644
index 000000000000..1fc492a733fa
--- /dev/null
+++ b/sec-policy/selinux-skype/files/add-apps-skype.patch
@@ -0,0 +1,102 @@
+--- apps/skype.te	1970-01-01 01:00:00.000000000 +0100
++++ apps/skype.te	2011-01-22 14:21:31.257000064 +0100
+@@ -0,0 +1,93 @@
++policy_module(skype, 1.0.1)
++
++############################
++# 
++# Declarations
++#
++
++type skype_t;
++type skype_exec_t;
++application_domain(skype_t, skype_exec_t)
++
++type skype_home_t;
++userdom_user_home_content(skype_home_t)
++
++type skype_tmpfs_t;
++files_tmpfs_file(skype_tmpfs_t)
++ubac_constrained(skype_tmpfs_t)
++
++############################
++#
++# Policy
++#
++
++allow skype_t self:process { getsched setsched };
++allow skype_t self:fifo_file rw_fifo_file_perms;
++allow skype_t self:unix_stream_socket create_socket_perms;
++allow skype_t self:sem create_sem_perms;
++
++manage_dirs_pattern(skype_t, skype_home_t, skype_home_t)
++manage_files_pattern(skype_t, skype_home_t, skype_home_t)
++manage_lnk_files_pattern(skype_t, skype_home_t, skype_home_t)
++userdom_user_home_dir_filetrans(skype_t, skype_home_t, dir)
++
++userdom_manage_user_home_content_dirs(skype_t)
++userdom_manage_user_home_content_files(skype_t)
++
++manage_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++manage_lnk_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++manage_fifo_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++manage_sock_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++fs_tmpfs_filetrans(skype_t, skype_tmpfs_t, { file lnk_file sock_file fifo_file })
++
++can_exec(skype_t, skype_exec_t)
++
++kernel_read_system_state(skype_t)
++
++corecmd_exec_bin(skype_t)
++corecmd_exec_shell(skype_t)
++
++corenet_all_recvfrom_netlabel(skype_t)
++corenet_all_recvfrom_unlabeled(skype_t)
++corenet_tcp_bind_generic_node(skype_t)
++corenet_udp_bind_generic_node(skype_t)
++corenet_tcp_bind_generic_port(skype_t) 
++corenet_udp_bind_generic_port(skype_t) 
++corenet_tcp_connect_generic_port(skype_t)
++corenet_tcp_connect_http_port(skype_t)
++corenet_tcp_sendrecv_http_port(skype_t)
++corenet_sendrecv_http_client_packets(skype_t)
++allow skype_t self:tcp_socket create_stream_socket_perms;
++
++dev_read_video_dev(skype_t)
++dev_write_video_dev(skype_t)
++dev_read_sound(skype_t)
++dev_write_sound(skype_t)
++
++domain_use_interactive_fds(skype_t)
++
++files_read_etc_files(skype_t)
++files_read_usr_files(skype_t)
++
++auth_use_nsswitch(skype_t)
++
++libs_use_ld_so(skype_t)
++
++miscfiles_read_localization(skype_t)
++miscfiles_dontaudit_setattr_fonts_dirs(skype_t)
++
++userdom_use_user_terminals(skype_t)
++
++xserver_user_x_domain_template(skype, skype_t, skype_tmpfs_t)
++
++allow skype_t self:process { execmem };
++
++optional_policy(`
++	alsa_read_rw_config(skype_t)
++')
++
++optional_policy(`
++	dbus_system_bus_client(skype_t)
++	dbus_session_bus_client(skype_t)
++')
++
+--- apps/skype.fc	1970-01-01 01:00:00.000000000 +0100
++++ apps/skype.fc	2011-01-09 21:27:25.364999962 +0100
+@@ -0,0 +1,3 @@
++/usr/bin/skype         -- gen_context(system_u:object_r:skype_exec_t,s0)
++/opt/skype/skype       -- gen_context(system_u:object_r:skype_exec_t,s0)
++HOME_DIR/\.Skype(/.*)?    gen_context(system_u:object_r:skype_home_t,s0)
diff --git a/sec-policy/selinux-skype/files/add-skype.patch b/sec-policy/selinux-skype/files/add-skype.patch
new file mode 100644
index 000000000000..493ef2232a64
--- /dev/null
+++ b/sec-policy/selinux-skype/files/add-skype.patch
@@ -0,0 +1,103 @@
+--- apps/skype.te	1970-01-01 01:00:00.000000000 +0100
++++ ../../../refpolicy/policy/modules/apps/skype.te	2011-01-08 00:23:10.900000094 +0100
+@@ -0,0 +1,94 @@
++policy_module(skype, 1.0.0)
++
++############################
++# 
++# Declarations
++#
++
++
++type skype_t;
++type skype_exec_t;
++typealias skype_t alias { user_skype_t staff_skype_t sysadm_skype_t };
++application_domain(skype_t, skype_exec_t)
++
++type skype_home_t;
++typealias skype_home_t alias { user_skype_home_t staff_skype_home_t sysadm_skype_home_t };
++userdom_user_home_content(skype_home_t)
++
++type skype_tmpfs_t;
++typealias skype_tmpfs_t alias { user_skype_tmpfs_t staff_skype_tmpfs_t sysadm_skype_tmpfs_t };
++files_tmpfs_file(skype_tmpfs_t)
++ubac_constrained(skype_tmpfs_t)
++
++############################
++#
++# Local policy
++#
++
++# Looks as if the binary needs this; for the time being use the tunable policy
++tunable_policy(`allow_execmem',`
++	allow skype_t self:process { execmem };
++')
++
++# Manage ~/.Skype
++manage_dirs_pattern(skype_t, skype_home_t, skype_home_t)
++manage_files_pattern(skype_t, skype_home_t, skype_home_t)
++manage_lnk_files_pattern(skype_t, skype_home_t, skype_home_t)
++userdom_user_home_dir_filetrans(skype_t, skype_home_t, dir)
++userdom_search_user_home_dirs(skype_t)
++
++# Declare access permissions on skype_tmpfs_t domain for X sessions
++manage_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++manage_lnk_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++manage_fifo_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++manage_sock_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++fs_tmpfs_filetrans(skype_t, skype_tmpfs_t, { file lnk_file sock_file fifo_file })
++
++# Be able to call skype from a terminal (debugging)
++userdom_use_user_terminals(skype_t)
++domain_use_interactive_fds(skype_t)
++
++corecmd_exec_bin(skype_t)
++corecmd_exec_shell(skype_t)
++can_exec(skype_t, skype_exec_t)
++#exec_files_pattern(skype_t, skype_exec_t, skype_exec_t)
++libs_use_ld_so(skype_t)
++files_read_usr_symlinks(skype_t)
++
++# This is an X application
++xserver_user_x_domain_template(skype, skype_t, skype_tmpfs_t)
++
++files_search_var_lib(skype_t)
++miscfiles_read_fonts(skype_t)
++miscfiles_read_localization(skype_t)
++miscfiles_dontaudit_setattr_fonts_dirs(skype_t)
++dbus_system_bus_client(skype_t)
++files_read_etc_files(skype_t)
++libs_read_lib_files(skype_t)
++
++corenet_tcp_bind_generic_node(skype_t)
++corenet_udp_bind_generic_node(skype_t)
++corenet_tcp_bind_generic_port(skype_t)
++corenet_udp_bind_generic_port(skype_t)
++corenet_tcp_connect_generic_port(skype_t)
++corenet_tcp_connect_http_port(skype_t)
++
++dev_read_video_dev(skype_t)
++dev_write_video_dev(skype_t)
++dev_read_sound(skype_t)
++dev_write_sound(skype_t)
++alsa_read_rw_config(skype_t)
++
++files_read_usr_files(skype_t)
++kernel_read_system_state(skype_t)
++sysnet_read_config(skype_t)
++
++# Self 
++allow skype_t self:process { getsched };
++allow skype_t self:unix_stream_socket create_socket_perms;
++allow skype_t self:udp_socket create_stream_socket_perms;
++allow skype_t self:tcp_socket create_stream_socket_perms;
++allow skype_t self:sem create_sem_perms;
++allow skype_t self:netlink_route_socket rw_netlink_socket_perms;
++allow skype_t self:fifo_file rw_fifo_file_perms;
++
+--- apps/skype.fc	1970-01-01 01:00:00.000000000 +0100
++++ ../../../refpolicy/policy/modules/apps/skype.fc	2011-01-07 21:46:47.603999891 +0100
+@@ -0,0 +1,3 @@
++/usr/bin/skype         -- gen_context(system_u:object_r:skype_exec_t,s0)
++/opt/skype/skype       -- gen_context(system_u:object_r:skype_exec_t,s0)
++HOME_DIR/\.Skype(/.*)?    gen_context(system_u:object_r:skype_home_t,s0)
diff --git a/sec-policy/selinux-skype/metadata.xml b/sec-policy/selinux-skype/metadata.xml
new file mode 100644
index 000000000000..3d9f93061222
--- /dev/null
+++ b/sec-policy/selinux-skype/metadata.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>hardened</herd>
+<maintainer>
+  <email>selinux@gentoo.org</email>
+</maintainer>
+<longdescription>Gentoo SELinux policy for skype.</longdescription>
+</pkgmetadata>
+
diff --git a/sec-policy/selinux-skype/selinux-skype-2.20101213-r1.ebuild b/sec-policy/selinux-skype/selinux-skype-2.20101213-r1.ebuild
new file mode 100644
index 000000000000..00f463e78458
--- /dev/null
+++ b/sec-policy/selinux-skype/selinux-skype-2.20101213-r1.ebuild
@@ -0,0 +1,16 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-skype/selinux-skype-2.20101213-r1.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $
+
+IUSE=""
+
+MODS="skype"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/add-apps-skype.patch"
+RDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r4"
diff --git a/sec-policy/selinux-skype/selinux-skype-2.20101213-r2.ebuild b/sec-policy/selinux-skype/selinux-skype-2.20101213-r2.ebuild
new file mode 100644
index 000000000000..d4f1b790446b
--- /dev/null
+++ b/sec-policy/selinux-skype/selinux-skype-2.20101213-r2.ebuild
@@ -0,0 +1,16 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-skype/selinux-skype-2.20101213-r2.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $
+
+IUSE=""
+
+MODS="skype"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/add-apps-skype-r2.patch"
+RDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r4"
diff --git a/sec-policy/selinux-skype/selinux-skype-2.20101213.ebuild b/sec-policy/selinux-skype/selinux-skype-2.20101213.ebuild
new file mode 100644
index 000000000000..d08539a83afb
--- /dev/null
+++ b/sec-policy/selinux-skype/selinux-skype-2.20101213.ebuild
@@ -0,0 +1,16 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-skype/selinux-skype-2.20101213.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $
+
+IUSE=""
+
+MODS="skype"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/add-skype.patch"
+RDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r3"
diff --git a/sec-policy/selinux-vde/ChangeLog b/sec-policy/selinux-vde/ChangeLog
new file mode 100644
index 000000000000..f8be44be88ba
--- /dev/null
+++ b/sec-policy/selinux-vde/ChangeLog
@@ -0,0 +1,13 @@
+# ChangeLog for sec-policy/selinux-vde
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-vde/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+  05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog:
+  Initial commit to portage.
+
+*selinux-vde-2.20101213 (22 Jan 2011)
+
+  22 Jan 2011; <swift@gentoo.org> +selinux-vde-2.20101213.ebuild,
+  +files/add-services-vde.patch, +metadata.xml:
+  Adding SELinux policy module for VDE
+
diff --git a/sec-policy/selinux-vde/files/add-services-vde.patch b/sec-policy/selinux-vde/files/add-services-vde.patch
new file mode 100644
index 000000000000..df49d872b1cc
--- /dev/null
+++ b/sec-policy/selinux-vde/files/add-services-vde.patch
@@ -0,0 +1,69 @@
+--- services/vde.te	1970-01-01 01:00:00.000000000 +0100
++++ services/vde.te	2011-01-22 22:20:13.375000222 +0100
+@@ -0,0 +1,56 @@
++policy_module(vde, 0.0.1)
++
++########################################
++#
++# Declarations
++#
++
++type vde_t;
++type vde_exec_t;
++init_daemon_domain(vde_t, vde_exec_t)
++
++type vde_initrc_exec_t;
++init_script_file(vde_initrc_exec_t)
++
++type vde_conf_t;
++files_type(vde_conf_t);
++
++type vde_var_lib_t;
++files_type(vde_var_lib_t)
++
++type vde_var_run_t;
++files_pid_file(vde_var_run_t)
++
++type vde_tmp_t;
++files_tmp_file(vde_tmp_t)
++
++########################################
++#
++# Local policy
++#
++
++allow vde_t self:process { signal_perms getcap setcap };
++allow vde_t self:capability { chown net_admin dac_override fowner fsetid };
++
++allow vde_t vde_tmp_t:sock_file manage_sock_file_perms;
++allow vde_t self:unix_stream_socket {  create_stream_socket_perms connectto };
++allow vde_t self:unix_dgram_socket create_socket_perms;
++files_tmp_filetrans(vde_t, vde_tmp_t, sock_file)
++
++manage_dirs_pattern(vde_t, vde_var_run_t, vde_var_run_t)
++manage_files_pattern(vde_t, vde_var_run_t, vde_var_run_t)
++manage_sock_files_pattern(vde_t, vde_var_run_t, vde_var_run_t)
++files_pid_filetrans(vde_t, vde_var_run_t, { dir file sock_file unix_dgram_socket })
++
++files_read_etc_files(vde_t)
++
++allow vde_t vde_conf_t:dir list_dir_perms;
++read_files_pattern(vde_t, vde_conf_t, vde_conf_t)
++read_lnk_files_pattern(vde_t, vde_conf_t, vde_conf_t)
++
++domain_use_interactive_fds(vde_t)
++userdom_use_user_terminals(vde_t)
++miscfiles_read_localization(vde_t)
++corenet_rw_tun_tap_dev(vde_t)
++
++logging_send_syslog_msg(vde_t)
+--- services/vde.fc	1970-01-01 01:00:00.000000000 +0100
++++ services/vde.fc	2011-01-22 21:23:05.129000146 +0100
+@@ -0,0 +1,7 @@
++/etc/init.d/vde		--	gen_context(system_u:object_r:vde_initrc_exec_t,s0)
++/usr/bin/vde_switch	--	gen_context(system_u:object_r:vde_exec_t,s0)
++/usr/sbin/vde_tunctl	--	gen_context(system_u:object_r:vde_exec_t,s0)
++/etc/vde2(/.*)?			gen_context(system_u:object_r:vde_conf_t,s0)
++/etc/vde2/libvdemgmt(/.*)?	gen_context(system_u:object_r:vde_conf_t,s0)
++/var/run/vde\.ctl(/.*)?		gen_context(system_u:object_r:vde_var_run_t,s0)
++/tmp/vde.[0-9-]*	-s	gen_context(system_u:object_r:vde_tmp_t,s0)
diff --git a/sec-policy/selinux-vde/metadata.xml b/sec-policy/selinux-vde/metadata.xml
new file mode 100644
index 000000000000..d7aecab0e9e9
--- /dev/null
+++ b/sec-policy/selinux-vde/metadata.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>hardened</herd>
+<longdescription>Gentoo SELinux policy for the Virtual Distributed Ethernet switching tools</longdescription>
+</pkgmetadata>
diff --git a/sec-policy/selinux-vde/selinux-vde-2.20101213.ebuild b/sec-policy/selinux-vde/selinux-vde-2.20101213.ebuild
new file mode 100644
index 000000000000..85d80bf0424b
--- /dev/null
+++ b/sec-policy/selinux-vde/selinux-vde-2.20101213.ebuild
@@ -0,0 +1,15 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-vde/selinux-vde-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+IUSE=""
+
+MODS="vde"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for Virtual Distributed Ethernet switch"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/add-services-vde.patch"
diff --git a/sec-policy/selinux-xfce4/ChangeLog b/sec-policy/selinux-xfce4/ChangeLog
new file mode 100644
index 000000000000..05ee6b71a29b
--- /dev/null
+++ b/sec-policy/selinux-xfce4/ChangeLog
@@ -0,0 +1,14 @@
+# ChangeLog for sec-policy/selinux-xfce4
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-xfce4/ChangeLog,v 1.1 2011/02/05 20:41:05 blueness Exp $
+
+  05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog:
+  Initial commit to portage.
+
+*selinux-xfce4-2.20101213 (22 Jan 2011)
+
+  22 Jan 2011; <swift@gentoo.org> +files/add-apps-xfce4.patch,
+  +selinux-xfce4-2.20101213.ebuild, +metadata.xml:
+  Adding Gentoo SELinux module for xfce4 desktop environment, currently
+  limited to relabelling of proper files
+
diff --git a/sec-policy/selinux-xfce4/files/add-apps-xfce4.patch b/sec-policy/selinux-xfce4/files/add-apps-xfce4.patch
new file mode 100644
index 000000000000..7761cde11b44
--- /dev/null
+++ b/sec-policy/selinux-xfce4/files/add-apps-xfce4.patch
@@ -0,0 +1,17 @@
+--- apps/xfce4.te	1970-01-01 01:00:00.000000000 +0100
++++ apps/xfce4.te	2011-01-22 13:18:24.079000051 +0100
+@@ -0,0 +1,2 @@
++policy_module(xfce, 0.0.1)
++
+--- apps/xfce4.fc	1970-01-01 01:00:00.000000000 +0100
++++ apps/xfce4.fc	2011-01-22 13:22:10.602000045 +0100
+@@ -0,0 +1,9 @@
++/usr/lib(64)?/xfce4/session/xfsm-shutdown-helper 	-- gen_context(system_u:object_r:bin_t,s0)
++/usr/lib(64)?/xfce4/session/balou-export-theme		-- gen_context(system_u:object_r:bin_t,s0)
++/usr/lib(64)?/xfce4/session/balou-install-theme 	-- gen_context(system_u:object_r:bin_t,s0)
++/usr/lib(64)?/xfce4/xfwm4/helper-dialog 	-- gen_context(system_u:object_r:bin_t,s0)
++/usr/lib(64)?/xfce4/xfconf/xfconfd 	-- gen_context(system_u:object_r:bin_t,s0)
++/usr/lib(64)?/xfce4/panel/wrapper 	-- gen_context(system_u:object_r:bin_t,s0)
++/usr/lib(64)?/xfce4/panel/migrate 	-- gen_context(system_u:object_r:bin_t,s0)
++/usr/lib(64)?/xfce4/exo-1/exo-helper-1 	-- gen_context(system_u:object_r:bin_t,s0)
++/usr/lib(64)?/xfce4/exo-1/exo-compose-mail-1 	-- gen_context(system_u:object_r:bin_t,s0)
diff --git a/sec-policy/selinux-xfce4/metadata.xml b/sec-policy/selinux-xfce4/metadata.xml
new file mode 100644
index 000000000000..256a3148c890
--- /dev/null
+++ b/sec-policy/selinux-xfce4/metadata.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>hardened</herd>
+<longdescription>Gentoo SELinux policy for the XFCE4 desktop environment</longdescription>
+</pkgmetadata>
diff --git a/sec-policy/selinux-xfce4/selinux-xfce4-2.20101213.ebuild b/sec-policy/selinux-xfce4/selinux-xfce4-2.20101213.ebuild
new file mode 100644
index 000000000000..34c9e34e6de5
--- /dev/null
+++ b/sec-policy/selinux-xfce4/selinux-xfce4-2.20101213.ebuild
@@ -0,0 +1,15 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-xfce4/selinux-xfce4-2.20101213.ebuild,v 1.1 2011/02/05 20:41:05 blueness Exp $
+
+IUSE=""
+
+MODS="xfce4"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for XFCE4 desktop environment"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/add-apps-xfce4.patch"
diff --git a/sec-policy/selinux-xserver/ChangeLog b/sec-policy/selinux-xserver/ChangeLog
new file mode 100644
index 000000000000..5afe2fcb59a4
--- /dev/null
+++ b/sec-policy/selinux-xserver/ChangeLog
@@ -0,0 +1,19 @@
+# ChangeLog for sec-policy/selinux-xserver
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-xserver/ChangeLog,v 1.1 2011/02/05 20:41:03 blueness Exp $
+
+  05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog:
+  Initial commit to portage.
+
+*selinux-xserver-2.20101213-r2 (02 Feb 2011)
+
+  02 Feb 2011; <swift@gentoo.org> +files/fix-services-xserver-r2.patch,
+  +selinux-xserver-2.20101213-r2.ebuild:
+  Allow use of ttys (improves console logging)
+
+*selinux-xserver-2.20101213-r1 (31 Jan 2011)
+
+  31 Jan 2011; <swift@gentoo.org> +files/fix-services-xserver-r1.patch,
+  +selinux-xserver-2.20101213-r1.ebuild:
+  Fix large timewait issues with xserver policy
+
diff --git a/sec-policy/selinux-xserver/files/fix-services-xserver-r1.patch b/sec-policy/selinux-xserver/files/fix-services-xserver-r1.patch
new file mode 100644
index 000000000000..75046d36a321
--- /dev/null
+++ b/sec-policy/selinux-xserver/files/fix-services-xserver-r1.patch
@@ -0,0 +1,50 @@
+--- services/xserver.te	2010-12-13 15:11:02.000000000 +0100
++++ services/xserver.te	2011-01-30 15:04:32.722000186 +0100
+@@ -234,9 +234,11 @@
+ 
+ allow xdm_t iceauth_home_t:file read_file_perms;
+ 
++files_search_tmp(iceauth_t)
+ fs_search_auto_mountpoints(iceauth_t)
+ 
+ userdom_use_user_terminals(iceauth_t)
++userdom_read_user_tmp_files(iceauth_t)
+ 
+ tunable_policy(`use_nfs_home_dirs',`
+ 	fs_manage_nfs_files(iceauth_t)
+@@ -279,6 +281,7 @@
+ 
+ userdom_use_user_terminals(xauth_t)
+ userdom_read_user_tmp_files(xauth_t)
++userdom_read_user_tmp_files(xserver_t)
+ 
+ xserver_rw_xdm_tmp_files(xauth_t)
+ 
+@@ -588,6 +591,9 @@
+ allow xserver_t { root_xdrawable_t x_domain }:x_drawable send;
+ allow xserver_t input_xevent_t:x_event send;
+ 
++# Allow X to process keyboard events
++udev_read_db(xserver_t)
++
+ # setuid/setgid for the wrapper program to change UID
+ # sys_rawio is for iopl access - should not be needed for frame-buffer
+ # sys_admin, locking shared mem?  chowning IPC message queues or semaphores?
+@@ -610,6 +616,7 @@
+ allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
+ allow xserver_t self:tcp_socket create_stream_socket_perms;
+ allow xserver_t self:udp_socket create_socket_perms;
++allow xserver_t self:netlink_kobject_uevent_socket create_socket_perms;
+ 
+ manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
+ manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
+--- services/xserver.fc	2010-08-03 15:11:09.000000000 +0200
++++ services/xserver.fc	2011-01-03 23:07:16.852000013 +0100
+@@ -5,6 +5,7 @@
+ HOME_DIR/\.fonts(/.*)?		gen_context(system_u:object_r:user_fonts_t,s0)
+ HOME_DIR/\.fonts/auto(/.*)?	gen_context(system_u:object_r:user_fonts_cache_t,s0)
+ HOME_DIR/\.fonts\.cache-.* --	gen_context(system_u:object_r:user_fonts_cache_t,s0)
++HOME_DIR/\.fontconfig(/.*)?	gen_context(system_u:object_r:user_fonts_cache_t,s0)
+ HOME_DIR/\.ICEauthority.* --	gen_context(system_u:object_r:iceauth_home_t,s0)
+ HOME_DIR/\.xauth.*	--	gen_context(system_u:object_r:xauth_home_t,s0)
+ HOME_DIR/\.Xauthority.*	--	gen_context(system_u:object_r:xauth_home_t,s0)
diff --git a/sec-policy/selinux-xserver/files/fix-services-xserver-r2.patch b/sec-policy/selinux-xserver/files/fix-services-xserver-r2.patch
new file mode 100644
index 000000000000..3c73d86c19f8
--- /dev/null
+++ b/sec-policy/selinux-xserver/files/fix-services-xserver-r2.patch
@@ -0,0 +1,52 @@
+--- services/xserver.te	2010-12-13 15:11:02.000000000 +0100
++++ services/xserver.te	2011-02-01 18:16:07.421000056 +0100
+@@ -234,9 +234,13 @@
+ 
+ allow xdm_t iceauth_home_t:file read_file_perms;
+ 
++files_search_tmp(iceauth_t)
+ fs_search_auto_mountpoints(iceauth_t)
+ 
+ userdom_use_user_terminals(iceauth_t)
++userdom_read_user_tmp_files(iceauth_t)
++
++getty_use_fds(iceauth_t)
+ 
+ tunable_policy(`use_nfs_home_dirs',`
+ 	fs_manage_nfs_files(iceauth_t)
+@@ -279,6 +283,7 @@
+ 
+ userdom_use_user_terminals(xauth_t)
+ userdom_read_user_tmp_files(xauth_t)
++userdom_read_user_tmp_files(xserver_t)
+ 
+ xserver_rw_xdm_tmp_files(xauth_t)
+ 
+@@ -588,6 +593,9 @@
+ allow xserver_t { root_xdrawable_t x_domain }:x_drawable send;
+ allow xserver_t input_xevent_t:x_event send;
+ 
++# Allow X to process keyboard events
++udev_read_db(xserver_t)
++
+ # setuid/setgid for the wrapper program to change UID
+ # sys_rawio is for iopl access - should not be needed for frame-buffer
+ # sys_admin, locking shared mem?  chowning IPC message queues or semaphores?
+@@ -610,6 +618,7 @@
+ allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
+ allow xserver_t self:tcp_socket create_stream_socket_perms;
+ allow xserver_t self:udp_socket create_socket_perms;
++allow xserver_t self:netlink_kobject_uevent_socket create_socket_perms;
+ 
+ manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
+ manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
+--- services/xserver.fc	2010-08-03 15:11:09.000000000 +0200
++++ services/xserver.fc	2011-01-03 23:07:16.852000013 +0100
+@@ -5,6 +5,7 @@
+ HOME_DIR/\.fonts(/.*)?		gen_context(system_u:object_r:user_fonts_t,s0)
+ HOME_DIR/\.fonts/auto(/.*)?	gen_context(system_u:object_r:user_fonts_cache_t,s0)
+ HOME_DIR/\.fonts\.cache-.* --	gen_context(system_u:object_r:user_fonts_cache_t,s0)
++HOME_DIR/\.fontconfig(/.*)?	gen_context(system_u:object_r:user_fonts_cache_t,s0)
+ HOME_DIR/\.ICEauthority.* --	gen_context(system_u:object_r:iceauth_home_t,s0)
+ HOME_DIR/\.xauth.*	--	gen_context(system_u:object_r:xauth_home_t,s0)
+ HOME_DIR/\.Xauthority.*	--	gen_context(system_u:object_r:xauth_home_t,s0)
diff --git a/sec-policy/selinux-xserver/files/fix-xserver.patch b/sec-policy/selinux-xserver/files/fix-xserver.patch
new file mode 100644
index 000000000000..4f6edf3def21
--- /dev/null
+++ b/sec-policy/selinux-xserver/files/fix-xserver.patch
@@ -0,0 +1,38 @@
+--- services/xserver.te	2010-12-13 15:11:02.000000000 +0100
++++ ../../../refpolicy/policy/modules/services/xserver.te	2011-01-02 18:21:17.682000037 +0100
+@@ -279,6 +279,7 @@
+ 
+ userdom_use_user_terminals(xauth_t)
+ userdom_read_user_tmp_files(xauth_t)
++userdom_read_user_tmp_files(xserver_t)
+ 
+ xserver_rw_xdm_tmp_files(xauth_t)
+ 
+@@ -588,6 +589,9 @@
+ allow xserver_t { root_xdrawable_t x_domain }:x_drawable send;
+ allow xserver_t input_xevent_t:x_event send;
+ 
++# Allow X to process keyboard events
++udev_read_db(xserver_t)
++
+ # setuid/setgid for the wrapper program to change UID
+ # sys_rawio is for iopl access - should not be needed for frame-buffer
+ # sys_admin, locking shared mem?  chowning IPC message queues or semaphores?
+@@ -610,6 +614,7 @@
+ allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
+ allow xserver_t self:tcp_socket create_stream_socket_perms;
+ allow xserver_t self:udp_socket create_socket_perms;
++allow xserver_t self:netlink_kobject_uevent_socket create_socket_perms;
+ 
+ manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
+ manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
+--- services/xserver.fc	2010-08-03 15:11:09.000000000 +0200
++++ ../../../refpolicy/policy/modules/services/xserver.fc	2011-01-03 23:07:16.852000013 +0100
+@@ -5,6 +5,7 @@
+ HOME_DIR/\.fonts(/.*)?		gen_context(system_u:object_r:user_fonts_t,s0)
+ HOME_DIR/\.fonts/auto(/.*)?	gen_context(system_u:object_r:user_fonts_cache_t,s0)
+ HOME_DIR/\.fonts\.cache-.* --	gen_context(system_u:object_r:user_fonts_cache_t,s0)
++HOME_DIR/\.fontconfig(/.*)?	gen_context(system_u:object_r:user_fonts_cache_t,s0)
+ HOME_DIR/\.ICEauthority.* --	gen_context(system_u:object_r:iceauth_home_t,s0)
+ HOME_DIR/\.xauth.*	--	gen_context(system_u:object_r:xauth_home_t,s0)
+ HOME_DIR/\.Xauthority.*	--	gen_context(system_u:object_r:xauth_home_t,s0)
diff --git a/sec-policy/selinux-xserver/metadata.xml b/sec-policy/selinux-xserver/metadata.xml
new file mode 100644
index 000000000000..e768672448a3
--- /dev/null
+++ b/sec-policy/selinux-xserver/metadata.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>hardened</herd>
+<longdescription>Gentoo SELinux policy for the Xorg server</longdescription>
+</pkgmetadata>
diff --git a/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r1.ebuild b/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r1.ebuild
new file mode 100644
index 000000000000..63f27f96a095
--- /dev/null
+++ b/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r1.ebuild
@@ -0,0 +1,15 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r1.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $
+
+IUSE=""
+
+MODS="xserver"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/fix-services-xserver-r1.patch"
diff --git a/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r2.ebuild b/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r2.ebuild
new file mode 100644
index 000000000000..57ff047fa8ee
--- /dev/null
+++ b/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r2.ebuild
@@ -0,0 +1,15 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r2.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $
+
+IUSE=""
+
+MODS="xserver"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/fix-services-xserver-r2.patch"
diff --git a/sec-policy/selinux-xserver/selinux-xserver-2.20101213.ebuild b/sec-policy/selinux-xserver/selinux-xserver-2.20101213.ebuild
new file mode 100644
index 000000000000..453800b67d3b
--- /dev/null
+++ b/sec-policy/selinux-xserver/selinux-xserver-2.20101213.ebuild
@@ -0,0 +1,15 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-xserver/selinux-xserver-2.20101213.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $
+
+IUSE=""
+
+MODS="xserver"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/fix-xserver.patch"