--- nsaserefpolicy/policy/modules/admin/rpm.fc	2008-08-07 11:15:13.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/admin/rpm.fc	2008-08-14 13:53:54.000000000 -0400
@@ -11,7 +11,8 @@
 
 /usr/sbin/system-install-packages --	gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/sbin/yum-updatesd		--	gen_context(system_u:object_r:rpm_exec_t,s0)
-
+/usr/sbin/packagekitd		--	gen_context(system_u:object_r:rpm_exec_t,s0)
+/usr/libexec/yumDBUSBackend.py	--	gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/share/yumex/yumex		--	gen_context(system_u:object_r:rpm_exec_t,s0)
 
 ifdef(`distro_redhat', `
@@ -21,6 +22,9 @@
 /usr/sbin/pup			--	gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/sbin/rhn_check		--	gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/sbin/up2date		--	gen_context(system_u:object_r:rpm_exec_t,s0)
+/usr/sbin/synaptic		--	gen_context(system_u:object_r:rpm_exec_t,s0)
+/usr/bin/apt-get		--	gen_context(system_u:object_r:rpm_exec_t,s0)
+/usr/bin/apt-shell		--	gen_context(system_u:object_r:rpm_exec_t,s0)
 ')
 
 /var/lib/alternatives(/.*)?		gen_context(system_u:object_r:rpm_var_lib_t,s0)
@@ -29,6 +33,7 @@
 
 /var/log/rpmpkgs.*		--	gen_context(system_u:object_r:rpm_log_t,s0)
 /var/log/yum\.log.*		--	gen_context(system_u:object_r:rpm_log_t,s0)
+/var/run/yum.*			--	gen_context(system_u:object_r:rpm_var_run_t,s0)
 
 # SuSE
 ifdef(`distro_suse', `
--- nsaserefpolicy/policy/modules/admin/rpm.if	2008-08-07 11:15:13.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/admin/rpm.if	2008-08-14 13:53:54.000000000 -0400
@@ -152,6 +152,24 @@
 
 ########################################
 ## <summary>
+##	dontaudit read and write an unnamed RPM pipe.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`rpm_dontaudit_rw_pipes',`
+	gen_require(`
+		type rpm_t;
+	')
+
+	dontaudit $1 rpm_t:fifo_file rw_fifo_file_perms;
+')
+
+########################################
+## <summary>
 ##	Send and receive messages from
 ##	rpm over dbus.
 ## </summary>
@@ -173,6 +191,48 @@
 
 ########################################
 ## <summary>
+##	dontaudit attempts to Send and receive messages from
+##	rpm over dbus.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`rpm_dontaudit_dbus_chat',`
+	gen_require(`
+		type rpm_t;
+		class dbus send_msg;
+	')
+
+	dontaudit $1 rpm_t:dbus send_msg;
+	dontaudit rpm_t $1:dbus send_msg;
+')
+
+########################################
+## <summary>
+##	Send and receive messages from
+##	rpm_script over dbus.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`rpm_script_dbus_chat',`
+	gen_require(`
+		type rpm_script_t;
+		class dbus send_msg;
+	')
+
+	allow $1 rpm_script_t:dbus send_msg;
+	allow rpm_script_t $1:dbus send_msg;
+')
+
+########################################
+## <summary>
 ##	Create, read, write, and delete the RPM log.
 ## </summary>
 ## <param name="domain">
@@ -210,6 +270,24 @@
 
 ########################################
 ## <summary>
+##	dontaudit and use file descriptors from RPM scripts.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`rpm_dontaudit_use_script_fds',`
+	gen_require(`
+		type rpm_script_t;
+	')
+
+	dontaudit $1 rpm_script_t:fd use;
+')
+
+########################################
+## <summary>
 ##	Create, read, write, and delete RPM
 ##	script temporary files.
 ## </summary>
@@ -225,7 +303,29 @@
 	')
 
 	files_search_tmp($1)
+	manage_dirs_pattern($1, rpm_script_tmp_t, rpm_script_tmp_t)
 	manage_files_pattern($1, rpm_script_tmp_t, rpm_script_tmp_t)
+	manage_lnk_files_pattern($1, rpm_script_tmp_t, rpm_script_tmp_t)
+')
+
+########################################
+## <summary>
+##	read, RPM
+##	script temporary files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`rpm_read_script_tmp_files',`
+	gen_require(`
+		type rpm_script_tmp_t;
+	')
+
+	read_files_pattern($1, rpm_script_tmp_t, rpm_script_tmp_t)
+	read_lnk_files_pattern($1, rpm_script_tmp_t, rpm_script_tmp_t)
 ')
 
 ########################################
@@ -289,3 +389,157 @@
 	dontaudit $1 rpm_var_lib_t:file manage_file_perms;
 	dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
 ')
+
+
+########################################
+## <summary>
+##	Allow application to transition to rpm_script domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`rpm_transition_script',`
+	gen_require(`
+		type rpm_script_t;
+	')
+
+	allow $1 rpm_script_t:process transition;
+
+	allow $1 rpm_script_t:fd use;
+	allow rpm_script_t $1:fd use;
+	allow rpm_script_t $1:fifo_file rw_fifo_file_perms;
+	allow rpm_script_t $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	allow domain to read, 
+##	write RPM tmp files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`rpm_rw_tmp_files',`
+	gen_require(`
+		type rpm_tmp_t;
+	')
+
+	allow $1 rpm_tmp_t:file rw_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read, 
+##	write RPM tmp files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`rpm_dontaudit_rw_tmp_files',`
+	gen_require(`
+		type rpm_tmp_t;
+	')
+
+	dontaudit $1 rpm_tmp_t:file rw_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read, 
+##	write RPM shm
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`rpm_dontaudit_rw_shm',`
+	gen_require(`
+		type rpm_t;
+	')
+
+	dontaudit $1 rpm_t:shm rw_shm_perms;
+')
+
+########################################
+## <summary>
+##	Read/write rpm tmpfs files.
+## </summary>
+## <desc>
+##	<p>
+##	Read/write rpm tmpfs files.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`rpm_rw_tmpfs_files',`
+	gen_require(`
+		type rpm_tmpfs_t;
+	')
+
+	fs_search_tmpfs($1)
+	allow $1 rpm_tmpfs_t:dir list_dir_perms;
+	rw_files_pattern($1, rpm_tmpfs_t, rpm_tmpfs_t)
+	read_lnk_files_pattern($1, rpm_tmpfs_t, rpm_tmpfs_t)
+')
+
+########################################
+## <summary>
+##	Transition to system_r when execute an rpm script
+## </summary>
+## <desc>
+##      <p>
+##	Execute rpm script in a specified role
+##      </p>
+##      <p>
+##      No interprocess communication (signals, pipes,
+##      etc.) is provided by this interface since
+##      the domains are not owned by this module.
+##      </p>
+## </desc>
+## <param name="source_role">
+##	<summary>
+##	Role to transition from.
+##	</summary>
+## </param>
+interface(`rpm_role_transition',`
+	gen_require(`
+		type rpm_exec_t;
+	')
+
+	role_transition $1 rpm_exec_t system_r;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to write, and delete the 
+##	RPM var run files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`rpm_dontaudit_write_pid_files',`
+	gen_require(`
+		type rpm_var_run_t;
+	')
+
+	dontaudit $1 rpm_var_run_t:file write_file_perms;
+')
+
--- nsaserefpolicy/policy/modules/admin/rpm.te	2008-08-07 11:15:13.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/admin/rpm.te	2008-08-14 13:53:54.000000000 -0400
@@ -31,6 +31,9 @@
 files_type(rpm_var_lib_t)
 typealias rpm_var_lib_t alias var_lib_rpm_t;
 
+type rpm_var_run_t;
+files_pid_file(rpm_var_run_t)
+
 type rpm_script_t;
 type rpm_script_exec_t;
 domain_obj_id_change_exemption(rpm_script_t)
@@ -89,6 +92,9 @@
 manage_files_pattern(rpm_t, rpm_var_lib_t, rpm_var_lib_t)
 files_var_lib_filetrans(rpm_t, rpm_var_lib_t, dir)
 
+manage_files_pattern(rpm_t, rpm_var_run_t, rpm_var_run_t)
+files_pid_filetrans(rpm_t, rpm_var_run_t, file)
+
 kernel_read_system_state(rpm_t)
 kernel_read_kernel_sysctls(rpm_t)
 
@@ -179,10 +185,20 @@
 ')
 
 optional_policy(`
+	optional_policy(`
 	hal_dbus_chat(rpm_t)
 ')
 
 optional_policy(`
+		networkmanager_dbus_chat(rpm_t)
+	')
+
+	optional_policy(`
+		dbus_system_domain(rpm_t, rpm_exec_t)
+	')
+')
+
+optional_policy(`
 	prelink_domtrans(rpm_t)
 ')
 
@@ -190,6 +206,7 @@
 	unconfined_domain(rpm_t)
 	# yum-updatesd requires this
 	unconfined_dbus_chat(rpm_t)
+	unconfined_dbus_chat(rpm_script_t)
 ')
 
 ifdef(`TODO',`
@@ -216,7 +233,7 @@
 #
 
 allow rpm_script_t self:capability { chown dac_override dac_read_search fowner fsetid setgid setuid ipc_lock sys_chroot sys_nice mknod kill };
-allow rpm_script_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
+allow rpm_script_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execheap };
 allow rpm_script_t self:fd use;
 allow rpm_script_t self:fifo_file rw_fifo_file_perms;
 allow rpm_script_t self:unix_dgram_socket create_socket_perms;
@@ -317,6 +334,7 @@
 seutil_domtrans_loadpolicy(rpm_script_t)
 seutil_domtrans_setfiles(rpm_script_t)
 seutil_domtrans_semanage(rpm_script_t)
+seutil_domtrans_setsebool(rpm_script_t)
 
 userdom_use_all_users_fds(rpm_script_t)
 
@@ -342,6 +360,7 @@
 optional_policy(`
 	unconfined_domain(rpm_script_t)
 	unconfined_domtrans(rpm_script_t)
+	unconfined_execmem_domtrans(rpm_script_t)
 
 	optional_policy(`
 		java_domtrans(rpm_script_t)
@@ -352,6 +371,11 @@
 	')
 ')
 
+#optional_policy(`
+#	gamin_domtrans(rpm_t)
+#	gamin_stream_connect(rpm_t)
+#')
+
 optional_policy(`
 	usermanage_domtrans_groupadd(rpm_script_t)
 	usermanage_domtrans_useradd(rpm_script_t)
