--- nsaserefpolicy/policy/modules/apps/mozilla.fc	2008-08-07 11:15:03.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/apps/mozilla.fc	2008-08-14 13:53:54.000000000 -0400
@@ -1,8 +1,8 @@
-HOME_DIR/\.galeon(/.*)?			gen_context(system_u:object_r:ROLE_mozilla_home_t,s0)
-HOME_DIR/\.java(/.*)?			gen_context(system_u:object_r:ROLE_mozilla_home_t,s0)
-HOME_DIR/\.mozilla(/.*)?		gen_context(system_u:object_r:ROLE_mozilla_home_t,s0)
-HOME_DIR/\.netscape(/.*)?		gen_context(system_u:object_r:ROLE_mozilla_home_t,s0)
-HOME_DIR/\.phoenix(/.*)?		gen_context(system_u:object_r:ROLE_mozilla_home_t,s0)
+HOME_DIR/\.galeon(/.*)?			gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.java(/.*)?			gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.mozilla(/.*)?		gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.netscape(/.*)?		gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.phoenix(/.*)?		gen_context(system_u:object_r:mozilla_home_t,s0)
 
 #
 # /bin
@@ -17,7 +17,6 @@
 #
 # /etc
 #
-/etc/mozpluggerrc 		--	gen_context(system_u:object_r:mozilla_conf_t,s0)
 
 #
 # /lib
@@ -29,3 +28,5 @@
 /usr/lib(64)?/mozilla[^/]*/mozilla-.* -- gen_context(system_u:object_r:mozilla_exec_t,s0)
 /usr/lib(64)?/firefox[^/]*/mozilla-.* -- gen_context(system_u:object_r:mozilla_exec_t,s0)
 /usr/lib(64)?/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0)
+/usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0)
+/usr/lib64/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0)
--- nsaserefpolicy/policy/modules/apps/mozilla.if	2008-08-07 11:15:02.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/apps/mozilla.if	2008-08-14 13:53:54.000000000 -0400
@@ -35,7 +35,10 @@
 template(`mozilla_per_role_template',`
 	gen_require(`
 		type mozilla_conf_t, mozilla_exec_t;
+		type mozilla_home_t, mozilla_tmp_t;
 	')
+	gen_tunable(browser_confine_$1, false)
+	gen_tunable(browser_write_$1_data, false)
 
 	########################################
 	#
@@ -45,20 +48,24 @@
 	application_domain($1_mozilla_t, mozilla_exec_t)
 	role $3 types $1_mozilla_t;
 
-	type $1_mozilla_home_t alias $1_mozilla_rw_t;
-	files_poly_member($1_mozilla_home_t)
-	userdom_user_home_content($1, $1_mozilla_home_t)
-
 	type $1_mozilla_tmpfs_t;
 	files_tmpfs_file($1_mozilla_tmpfs_t)
 
+	typealias mozilla_home_t alias $1_mozilla_home_t;
+	typealias mozilla_tmp_t alias $1_mozilla_tmp_t;
+
+	########################################
+	#
+	# Local booleans
+	#
+
 	########################################
 	#
 	# Local policy
 	#
 
 	allow $1_mozilla_t self:capability { sys_nice setgid setuid };
-	allow $1_mozilla_t self:process { sigkill signal setsched getsched setrlimit };
+	allow $1_mozilla_t self:process { ptrace sigkill signal setsched getsched setrlimit };
 	allow $1_mozilla_t self:fifo_file rw_fifo_file_perms;
 	allow $1_mozilla_t self:shm { unix_read unix_write read write destroy create };
 	allow $1_mozilla_t self:sem create_sem_perms;
@@ -66,15 +73,19 @@
 	allow $1_mozilla_t self:unix_stream_socket { listen accept };
 	# Browse the web, connect to printer
 	allow $1_mozilla_t self:tcp_socket create_socket_perms;
-	allow $1_mozilla_t self:netlink_route_socket r_netlink_socket_perms;
 
 	# for bash - old mozilla binary
 	can_exec($1_mozilla_t, mozilla_exec_t)
 
+	domain_read_all_domains_state($1_mozilla_t)
+
+	fs_getattr_tmpfs($1_mozilla_t)
+	fs_manage_tmpfs_files($1_mozilla_t)
+
 	# X access, Home files
-	manage_dirs_pattern($1_mozilla_t, $1_mozilla_home_t, $1_mozilla_home_t)
-	manage_files_pattern($1_mozilla_t, $1_mozilla_home_t, $1_mozilla_home_t)
-	manage_lnk_files_pattern($1_mozilla_t, $1_mozilla_home_t, $1_mozilla_home_t)
+	manage_dirs_pattern($1_mozilla_t, mozilla_home_t, mozilla_home_t)
+	manage_files_pattern($1_mozilla_t, mozilla_home_t, mozilla_home_t)
+	manage_lnk_files_pattern($1_mozilla_t, mozilla_home_t, mozilla_home_t)
 	userdom_search_user_home_dirs($1, $1_mozilla_t)
 
 	# Mozpluggerrc
@@ -89,22 +100,47 @@
 	allow $2 $1_mozilla_t:unix_stream_socket connectto;
 
 	# X access, Home files
-	manage_dirs_pattern($2, $1_mozilla_home_t, $1_mozilla_home_t)
-	manage_files_pattern($2, $1_mozilla_home_t, $1_mozilla_home_t)
-	manage_lnk_files_pattern($2, $1_mozilla_home_t, $1_mozilla_home_t)
-	relabel_dirs_pattern($2, $1_mozilla_home_t, $1_mozilla_home_t)
-	relabel_files_pattern($2, $1_mozilla_home_t, $1_mozilla_home_t)
-	relabel_lnk_files_pattern($2, $1_mozilla_home_t, $1_mozilla_home_t)
-
-	manage_files_pattern($1_mozilla_t, $1_mozilla_tmpfs_t, $1_mozilla_tmpfs_t)
-	manage_lnk_files_pattern($1_mozilla_t, $1_mozilla_tmpfs_t, $1_mozilla_tmpfs_t)
-	manage_fifo_files_pattern($1_mozilla_t, $1_mozilla_tmpfs_t, $1_mozilla_tmpfs_t)
-	manage_sock_files_pattern($1_mozilla_t, $1_mozilla_tmpfs_t, $1_mozilla_tmpfs_t)
-	fs_tmpfs_filetrans($1_mozilla_t, $1_mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
+	manage_dirs_pattern($2, mozilla_home_t, mozilla_home_t)
+	manage_files_pattern($2, mozilla_home_t, mozilla_home_t)
+	manage_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t)
+	relabel_dirs_pattern($2, mozilla_home_t, mozilla_home_t)
+	relabel_files_pattern($2, mozilla_home_t, mozilla_home_t)
+	relabel_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t)
 
 	allow $1_mozilla_t $2:process signull;
 
+	tunable_policy(`browser_confine_$1',`
 	domain_auto_trans($2, mozilla_exec_t, $1_mozilla_t)
+	',`
+		can_exec($2, mozilla_exec_t)
+	')
+
+	unprivuser_read_home_content_files($1_mozilla_t)
+	unprivuser_read_home_content_symlinks($1_mozilla_t)
+	unprivuser_read_tmp_files($1_mozilla_t)
+	unprivuser_manage_tmp_dirs($1_mozilla_t)
+	unprivuser_manage_tmp_files($1_mozilla_t)
+	unprivuser_manage_tmp_sockets($1_mozilla_t)
+	userdom_tmp_filetrans_user_tmp($1, $1_mozilla_t, { file dir sock_file })
+	userdom_read_user_tmpfs_files($1, $1_mozilla_t)
+
+	ifdef(`enable_mls',`',`
+		fs_search_removable($1_mozilla_t)
+		fs_read_removable_files($1_mozilla_t)
+		fs_read_removable_symlinks($1_mozilla_t)
+	')
+
+	tunable_policy(`browser_write_$1_data',`
+		unprivuser_manage_home_content_dirs($1_mozilla_t)
+		unprivuser_manage_home_content_files($1_mozilla_t)
+		unprivuser_manage_home_content_symlinks($1_mozilla_t)
+		unprivuser_manage_home_content_pipes($1_mozilla_t)
+		unprivuser_home_dir_filetrans_home_content($1_mozilla_t, { file dir lnk_file })
+		',`
+		# helper apps will try to create .files
+		userdom_dontaudit_create_user_home_content_files($1, $1_mozilla_t)
+		userdom_user_home_dir_filetrans($1, $1_mozilla_t, $1_mozilla_home_t, dir)
+	')
 	# Unrestricted inheritance from the caller.
 	allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh };
 
@@ -112,17 +148,20 @@
 	ps_process_pattern($2, $1_mozilla_t)
 	allow $2 $1_mozilla_t:process signal_perms;
 	
+	kernel_read_fs_sysctls($1_mozilla_t)
 	kernel_read_kernel_sysctls($1_mozilla_t)
 	kernel_read_network_state($1_mozilla_t)
 	# Access /proc, sysctl
-	kernel_read_system_state($1_mozilla_t)
-	kernel_read_net_sysctls($1_mozilla_t)
+	kernel_dontaudit_read_system_state($1_mozilla_t)
+#	kernel_read_system_state($1_mozilla_t)
+#	kernel_read_net_sysctls($1_mozilla_t)
 
 	# Look for plugins 
 	corecmd_list_bin($1_mozilla_t)
 	# for bash - old mozilla binary
 	corecmd_exec_shell($1_mozilla_t)
 	corecmd_exec_bin($1_mozilla_t)
+	application_exec($1_mozilla_t)
 
 	# Browse the web, connect to printer
 	corenet_all_recvfrom_unlabeled($1_mozilla_t)
@@ -139,7 +178,6 @@
 	corenet_tcp_connect_http_cache_port($1_mozilla_t)
 	corenet_tcp_connect_ftp_port($1_mozilla_t)
 	corenet_tcp_connect_ipp_port($1_mozilla_t)
-	corenet_tcp_connect_generic_port($1_mozilla_t)
 	corenet_sendrecv_http_client_packets($1_mozilla_t)
 	corenet_sendrecv_http_cache_client_packets($1_mozilla_t)
 	corenet_sendrecv_ftp_client_packets($1_mozilla_t)
@@ -165,13 +203,28 @@
 	files_read_var_files($1_mozilla_t)
 	files_read_var_symlinks($1_mozilla_t)
  	files_dontaudit_getattr_boot_dirs($1_mozilla_t)
+	files_dontaudit_list_non_security($1_mozilla_t)
+	files_dontaudit_getattr_non_security_files($1_mozilla_t)
+	files_dontaudit_getattr_non_security_symlinks($1_mozilla_t)
+	files_dontaudit_getattr_non_security_pipes($1_mozilla_t)
+	files_dontaudit_getattr_non_security_sockets($1_mozilla_t)
+
+	dev_dontaudit_getattr_all_blk_files($1_mozilla_t)
+	dev_dontaudit_getattr_all_chr_files($1_mozilla_t)
 
 	fs_search_auto_mountpoints($1_mozilla_t)
 	fs_list_inotifyfs($1_mozilla_t)
+	fs_manage_dos_dirs($1_mozilla_t)
+	fs_manage_dos_files($1_mozilla_t)
 	fs_rw_tmpfs_files($1_mozilla_t)
+	fs_read_noxattr_fs_files($1_mozilla_t)
+
+	selinux_dontaudit_getattr_fs($1_mozilla_t)
 
 	term_dontaudit_getattr_pty_dirs($1_mozilla_t)
 	
+	auth_use_nsswitch($1_mozilla_t)
+
 	libs_use_ld_so($1_mozilla_t)
 	libs_use_shared_libs($1_mozilla_t)
 
@@ -180,16 +233,8 @@
 	miscfiles_read_fonts($1_mozilla_t)
 	miscfiles_read_localization($1_mozilla_t)
 
-	# Browse the web, connect to printer
-	sysnet_dns_name_resolve($1_mozilla_t)
-	sysnet_read_config($1_mozilla_t)
-	
-	userdom_manage_user_home_content_dirs($1, $1_mozilla_t)
-	userdom_manage_user_home_content_files($1, $1_mozilla_t)
-	userdom_manage_user_home_content_symlinks($1, $1_mozilla_t)
-	userdom_manage_user_tmp_dirs($1, $1_mozilla_t)
-	userdom_manage_user_tmp_files($1, $1_mozilla_t)
-	userdom_manage_user_tmp_sockets($1, $1_mozilla_t)
+	userdom_dontaudit_read_user_tmp_files($1, $1_mozilla_t)
+	userdom_dontaudit_use_user_terminals($1, $1_mozilla_t)
 	
 	xserver_user_x_domain_template($1, $1_mozilla, $1_mozilla_t, $1_mozilla_tmpfs_t)
 	xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
@@ -211,131 +256,8 @@
 		fs_manage_cifs_symlinks($1_mozilla_t)
 	')
 
-	# Uploads, local html
-	tunable_policy(`mozilla_read_content && use_nfs_home_dirs',`
-		fs_list_auto_mountpoints($1_mozilla_t)
-		files_list_home($1_mozilla_t)
-		fs_read_nfs_files($1_mozilla_t)
-		fs_read_nfs_symlinks($1_mozilla_t)
-	
-	',`
-		files_dontaudit_list_home($1_mozilla_t)
-		fs_dontaudit_list_auto_mountpoints($1_mozilla_t)
-		fs_dontaudit_read_nfs_files($1_mozilla_t)
-		fs_dontaudit_list_nfs($1_mozilla_t)
-	')
-
-	tunable_policy(`mozilla_read_content && use_samba_home_dirs',`
-		fs_list_auto_mountpoints($1_mozilla_t)
-		files_list_home($1_mozilla_t)
-		fs_read_cifs_files($1_mozilla_t)
-		fs_read_cifs_symlinks($1_mozilla_t)
-	',`
-		files_dontaudit_list_home($1_mozilla_t)
-		fs_dontaudit_list_auto_mountpoints($1_mozilla_t)
-		fs_dontaudit_read_cifs_files($1_mozilla_t)
-		fs_dontaudit_list_cifs($1_mozilla_t)
-	')
-
-	tunable_policy(`mozilla_read_content',`
-		userdom_list_user_tmp($1, $1_mozilla_t)
-		userdom_read_user_tmp_files($1, $1_mozilla_t)
-		userdom_read_user_tmp_symlinks($1, $1_mozilla_t)
-		userdom_search_user_home_dirs($1, $1_mozilla_t)
-		userdom_read_user_home_content_files($1, $1_mozilla_t)
-		userdom_read_user_home_content_symlinks($1, $1_mozilla_t)
-		
-		ifdef(`enable_mls',`',`
-			fs_search_removable($1_mozilla_t)
-			fs_read_removable_files($1_mozilla_t)
-			fs_read_removable_symlinks($1_mozilla_t)
-		')
-	',`
-		files_dontaudit_list_tmp($1_mozilla_t)
-		files_dontaudit_list_home($1_mozilla_t)
-		fs_dontaudit_list_removable($1_mozilla_t)
-		fs_dontaudit_read_removable_files($1_mozilla_t)
-		userdom_dontaudit_list_user_tmp($1, $1_mozilla_t)
-		userdom_dontaudit_read_user_tmp_files($1, $1_mozilla_t)
-		userdom_dontaudit_list_user_home_dirs($1, $1_mozilla_t)
-		userdom_dontaudit_read_user_home_content_files($1, $1_mozilla_t)
-	')
-
-	tunable_policy(`mozilla_read_content && read_default_t',`
-		files_list_default($1_mozilla_t)
-		files_read_default_files($1_mozilla_t)
-		files_read_default_symlinks($1_mozilla_t)
-	',`
-		files_dontaudit_read_default_files($1_mozilla_t)
-		files_dontaudit_list_default($1_mozilla_t)
-	')
-
-	tunable_policy(`mozilla_read_content && read_untrusted_content',`
-		files_list_tmp($1_mozilla_t)
-		files_list_home($1_mozilla_t)
-		userdom_search_user_home_dirs($1, $1_mozilla_t)
-	
-		userdom_list_user_untrusted_content($1, $1_mozilla_t)
-		userdom_read_user_untrusted_content_files($1, $1_mozilla_t)
-		userdom_read_user_untrusted_content_symlinks($1, $1_mozilla_t)
-		userdom_list_user_tmp_untrusted_content($1, $1_mozilla_t)
-		userdom_read_user_tmp_untrusted_content_files($1, $1_mozilla_t)
-		userdom_read_user_tmp_untrusted_content_symlinks($1, $1_mozilla_t)
-	',`
-		files_dontaudit_list_tmp($1_mozilla_t)
-		files_dontaudit_list_home($1_mozilla_t)
-		userdom_dontaudit_list_user_home_dirs($1, $1_mozilla_t)
-		userdom_dontaudit_list_user_untrusted_content($1, $1_mozilla_t)
-		userdom_dontaudit_read_user_untrusted_content_files($1, $1_mozilla_t)
-		userdom_dontaudit_list_user_tmp_untrusted_content($1, $1_mozilla_t)
-		userdom_dontaudit_read_user_tmp_untrusted_content_files($1, $1_mozilla_t)
-	')
-
-	# Save web pages
-	tunable_policy(`write_untrusted_content && use_nfs_home_dirs',`
-		files_search_home($1_mozilla_t)
-
-		fs_search_auto_mountpoints($1_mozilla_t)
-		fs_manage_nfs_dirs($1_mozilla_t)
-		fs_manage_nfs_files($1_mozilla_t)
-		fs_manage_nfs_symlinks($1_mozilla_t)
-	',`
-		fs_dontaudit_list_auto_mountpoints($1_mozilla_t)
-		fs_dontaudit_manage_nfs_dirs($1_mozilla_t)
-		fs_dontaudit_manage_nfs_files($1_mozilla_t)
-	')
-
-	tunable_policy(`write_untrusted_content && use_samba_home_dirs',`
-		files_search_home($1_mozilla_t)
-
-		fs_search_auto_mountpoints($1_mozilla_t)
-		fs_manage_cifs_dirs($1_mozilla_t)
-		fs_manage_cifs_files($1_mozilla_t)
-		fs_manage_cifs_symlinks($1_mozilla_t)
-	',`
-		fs_dontaudit_list_auto_mountpoints($1_mozilla_t)
-		fs_dontaudit_manage_cifs_dirs($1_mozilla_t)
-		fs_dontaudit_manage_cifs_files($1_mozilla_t)
-	')
-
-	tunable_policy(`write_untrusted_content',`
-		files_search_home($1_mozilla_t)
-		userdom_manage_user_untrusted_content_tmp_files($1, $1_mozilla_t)
-		files_tmp_filetrans($1_mozilla_t, $1_untrusted_content_tmp_t, file)
-		files_tmp_filetrans($1_mozilla_t, $1_untrusted_content_tmp_t, dir)
-
-		userdom_manage_user_untrusted_content_files($1, $1_mozilla_t)
-		userdom_user_home_dir_filetrans($1, $1_mozilla_t, $1_untrusted_content_tmp_t, { file dir })
-		userdom_user_home_content_filetrans($1, $1_mozilla_t, $1_untrusted_content_tmp_t, { file dir })
-		',`
-		files_dontaudit_list_home($1_mozilla_t)
-		files_dontaudit_list_tmp($1_mozilla_t)
-
-		userdom_dontaudit_list_user_home_dirs($1, $1_mozilla_t)
-		userdom_dontaudit_manage_user_tmp_dirs($1, $1_mozilla_t)
-		userdom_dontaudit_manage_user_tmp_files($1, $1_mozilla_t)
-		userdom_dontaudit_manage_user_home_content_dirs($1, $1_mozilla_t)
-
+	optional_policy(`
+		alsa_read_rw_config($1_mozilla_t)
 	')
 
 	optional_policy(`
@@ -350,57 +272,48 @@
 	optional_policy(`
 		cups_read_rw_config($1_mozilla_t)
 		cups_dbus_chat($1_mozilla_t)
+		cups_stream_connect($1_mozilla_t)
 	')
 
 	optional_policy(`
 		dbus_system_bus_client_template($1_mozilla, $1_mozilla_t)
-		dbus_user_bus_client_template($1, $1_mozilla, $1_mozilla_t)
+#		dbus_user_bus_client_template($1, $1_mozilla, $1_mozilla_t)
 	')
 
 	optional_policy(`
-		gnome_stream_connect_gconf_template($1, $1_mozilla_t)
+		networkmanager_dbus_chat($1_mozilla_t)
 	')
 
 	optional_policy(`
-		java_domtrans_user_javaplugin($1, $1_mozilla_t)
+		gnome_exec_gconf($1_mozilla_t)
 	')
 
 	optional_policy(`
-		lpd_domtrans_user_lpr($1, $1_mozilla_t)
+		java_plugin_per_role_template($1, $1_mozilla_t, $1_r)
 	')
 
+#	optional_policy(`
+#		openoffice_plugin_per_role_template($1, $1_mozilla_t, $1_r)
+#	')
+
 	optional_policy(`
-		mplayer_domtrans_user_mplayer($1, $1_mozilla_t)
-		mplayer_read_user_home_files($1, $1_mozilla_t)
+		lpd_domtrans_user_lpr($1, $1_mozilla_t)
 	')
 
 	optional_policy(`
-		nscd_socket_use($1_mozilla_t)
+		nsplugin_domtrans_user($1, $1_mozilla_t)
+		nsplugin_domtrans_user_config($1, $1_mozilla_t)
 	')
 
 	optional_policy(`
-		thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t)
+		mplayer_domtrans_mplayer($1, $1_mozilla_t)
+		mplayer_read_user_home_files($1, $1_mozilla_t)
 	')
 
-	ifdef(`TODO',`
-		#NOTE commented out in strict.
-		######### Launch email client, and make webcal links work
-		#ifdef(`evolution.te', `
-		#domain_auto_trans($1_mozilla_t, evolution_exec_t, $1_evolution_t)
-		#domain_auto_trans($1_mozilla_t, evolution_webcal_exec_t, $1_evolution_webcal_t)
-		#')
-	
-		# Macros for mozilla/mozilla (or other browser) domains.
-		# FIXME: Rules were removed to centralize policy in a gnome_app macro
-		# A similar thing might be necessary for mozilla compiled without GNOME
-		# support (is this possible?). 
-
-		# GNOME integration
 		optional_policy(`
-			gnome_application($1_mozilla, $1)
-			gnome_file_dialog($1_mozilla, $1)
-		')
+		thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t)
 	')
+
 ')
 
 ########################################
@@ -430,11 +343,11 @@
 #
 template(`mozilla_read_user_home_files',`
 	gen_require(`
-		type $1_mozilla_home_t;
+		type mozilla_home_t;
 	')
 
-	allow $2 $1_mozilla_home_t:dir list_dir_perms;
-	allow $2 $1_mozilla_home_t:file read_file_perms;
+	allow $2 mozilla_home_t:dir list_dir_perms;
+	allow $2 mozilla_home_t:file read_file_perms;
 ')
 
 ########################################
@@ -464,11 +377,10 @@
 #
 template(`mozilla_write_user_home_files',`
 	gen_require(`
-		type $1_mozilla_home_t;
+		type mozilla_home_t;
 	')
 
-	allow $2 $1_mozilla_home_t:dir list_dir_perms;
-	allow $2 $1_mozilla_home_t:file write;
+	write_files_pattern($2, mozilla_home_t, mozilla_home_t)
 ')
 
 ########################################
@@ -573,3 +485,27 @@
 
 	allow $2 $1_mozilla_t:tcp_socket rw_socket_perms;
 ')
+
+########################################
+## <summary>
+##	mozilla connection template.
+## </summary>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="user_domain">
+##	<summary>
+##	The type of the user domain.
+##	</summary>
+## </param>
+#
+template(`mozilla_stream_connect_template',`
+	gen_require(`
+		type $1_mozilla_t;
+	')
+
+	allow $2 $1_mozilla_t:unix_stream_socket connectto;
+')
--- nsaserefpolicy/policy/modules/apps/mozilla.te	2008-08-07 11:15:03.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/apps/mozilla.te	2008-08-14 13:53:54.000000000 -0400
@@ -6,15 +6,20 @@
 # Declarations
 #
 
-## <desc>
-## <p>
-## Control mozilla content access
-## </p>
-## </desc>
-gen_tunable(mozilla_read_content, false)
-
 type mozilla_conf_t;
 files_config_file(mozilla_conf_t)
 
 type mozilla_exec_t;
 application_executable_file(mozilla_exec_t)
+
+type mozilla_home_t alias user_mozilla_rw_t;
+files_poly_member(mozilla_home_t)
+userdom_user_home_content(user, mozilla_home_t)
+
+type mozilla_tmp_t;
+files_tmp_file(mozilla_tmp_t)
+
+typealias mozilla_home_t alias unconfined_mozilla_home_t;
+typealias mozilla_tmp_t alias unconfined_mozilla_tmp_t;
+typealias mozilla_home_t alias user_mozilla_home_t;
+typealias mozilla_tmp_t alias user_mozilla_tmp_t;
