--- nsaserefpolicy/policy/modules/services/apache.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/apache.fc	2008-08-14 13:53:54.000000000 -0400
@@ -1,10 +1,10 @@
-HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_ROLE_content_t,s0)
+HOME_DIR/((www)|(web)|(public_html)|(public_git))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0)
 
 /etc/apache(2)?(/.*)?			gen_context(system_u:object_r:httpd_config_t,s0)
 /etc/apache-ssl(2)?(/.*)?		gen_context(system_u:object_r:httpd_config_t,s0)
 /etc/htdig(/.*)?			gen_context(system_u:object_r:httpd_sys_content_t,s0)
-/etc/httpd			-d	gen_context(system_u:object_r:httpd_config_t,s0)
-/etc/httpd/conf.*			gen_context(system_u:object_r:httpd_config_t,s0)
+/etc/httpd(/.*)?			gen_context(system_u:object_r:httpd_config_t,s0)
+/etc/httpd/conf/keytab		--	gen_context(system_u:object_r:httpd_keytab_t,s0)
 /etc/httpd/logs				gen_context(system_u:object_r:httpd_log_t,s0)
 /etc/httpd/modules			gen_context(system_u:object_r:httpd_modules_t,s0)
 /etc/vhosts			--	gen_context(system_u:object_r:httpd_config_t,s0)
@@ -16,13 +16,13 @@
 
 /usr/lib/apache-ssl/.+		--	gen_context(system_u:object_r:httpd_exec_t,s0)
 /usr/lib/cgi-bin(/.*)?			gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
-/usr/lib/squid/cachemgr\.cgi	--	gen_context(system_u:object_r:httpd_exec_t,s0)
 /usr/lib(64)?/apache(/.*)?		gen_context(system_u:object_r:httpd_modules_t,s0)
 /usr/lib(64)?/apache2/modules(/.*)?	gen_context(system_u:object_r:httpd_modules_t,s0)
 /usr/lib(64)?/apache(2)?/suexec(2)? --	gen_context(system_u:object_r:httpd_suexec_exec_t,s0)
 /usr/lib(64)?/cgi-bin/(nph-)?cgiwrap(d)? -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0)
 /usr/lib(64)?/httpd(/.*)?		gen_context(system_u:object_r:httpd_modules_t,s0)
 
+/usr/bin/mongrel_rails		--	gen_context(system_u:object_r:httpd_exec_t,s0)
 /usr/sbin/apache(2)?		--	gen_context(system_u:object_r:httpd_exec_t,s0)
 /usr/sbin/apache-ssl(2)?	--	gen_context(system_u:object_r:httpd_exec_t,s0)
 /usr/sbin/httpd(\.worker)?	--	gen_context(system_u:object_r:httpd_exec_t,s0)
@@ -33,6 +33,7 @@
 /usr/sbin/httpd2-.*		--	gen_context(system_u:object_r:httpd_exec_t,s0)
 ')
 
+/usr/share/drupal(/.*)?			gen_context(system_u:object_r:httpd_sys_content_t,s0)
 /usr/share/htdig(/.*)?			gen_context(system_u:object_r:httpd_sys_content_t,s0)
 /usr/share/openca/htdocs(/.*)?		gen_context(system_u:object_r:httpd_sys_content_t,s0)
 /usr/share/selinux-policy[^/]*/html(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
@@ -48,6 +49,7 @@
 
 /var/lib/cacti/rra(/.*)?		gen_context(system_u:object_r:httpd_sys_content_t,s0)
 /var/lib/dav(/.*)?			gen_context(system_u:object_r:httpd_var_lib_t,s0)
+/var/lib/drupal(/.*)?			gen_context(system_u:object_r:httpd_sys_content_rw_t,s0)
 /var/lib/htdig(/.*)?			gen_context(system_u:object_r:httpd_sys_content_t,s0)
 /var/lib/httpd(/.*)?			gen_context(system_u:object_r:httpd_var_lib_t,s0)
 /var/lib/php/session(/.*)?		gen_context(system_u:object_r:httpd_var_run_t,s0)
@@ -51,8 +53,10 @@
 /var/lib/htdig(/.*)?			gen_context(system_u:object_r:httpd_sys_content_t,s0)
 /var/lib/httpd(/.*)?			gen_context(system_u:object_r:httpd_var_lib_t,s0)
 /var/lib/php/session(/.*)?		gen_context(system_u:object_r:httpd_var_run_t,s0)
+
 /var/lib/squirrelmail/prefs(/.*)?	gen_context(system_u:object_r:httpd_squirrelmail_t,s0)
 
+/var/www(/.*)?/logs(/.*)?		gen_context(system_u:object_r:httpd_log_t,s0)
 /var/log/apache(2)?(/.*)?		gen_context(system_u:object_r:httpd_log_t,s0)
 /var/log/apache-ssl(2)?(/.*)?		gen_context(system_u:object_r:httpd_log_t,s0)
 /var/log/cacti(/.*)?			gen_context(system_u:object_r:httpd_log_t,s0)
@@ -66,10 +70,21 @@
 /var/run/gcache_port		-s	gen_context(system_u:object_r:httpd_var_run_t,s0)
 /var/run/httpd.*			gen_context(system_u:object_r:httpd_var_run_t,s0)
 
-/var/spool/gosa(/.*)?			gen_context(system_u:object_r:httpd_sys_script_rw_t,s0)
+/var/spool/gosa(/.*)?			gen_context(system_u:object_r:httpd_sys_content_rw_t,s0)
 /var/spool/squirrelmail(/.*)?		gen_context(system_u:object_r:squirrelmail_spool_t,s0)
 
 /var/www(/.*)?				gen_context(system_u:object_r:httpd_sys_content_t,s0)
 /var/www/cgi-bin(/.*)?			gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
+/var/www/[^/]*/cgi-bin(/.*)?		gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
 /var/www/icons(/.*)?			gen_context(system_u:object_r:httpd_sys_content_t,s0)
 /var/www/perl(/.*)?			gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
+
+#Bugzilla file context
+/usr/share/bugzilla(/.*)?	-d	gen_context(system_u:object_r:httpd_bugzilla_content_t,s0)
+/usr/share/bugzilla(/.*)?	--	gen_context(system_u:object_r:httpd_bugzilla_script_exec_t,s0)
+/var/lib/bugzilla(/.*)?			gen_context(system_u:object_r:httpd_bugzilla_content_rw_t,s0)
+#viewvc file context
+/var/spool/viewvc(/.*)?  		gen_context(system_u:object_r:httpd_sys_content_rw_t,s0)
+/var/www/html/[^/]*/cgi-bin(/.*)?	gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
+
+/etc/rc\.d/init\.d/httpd	--	gen_context(system_u:object_r:httpd_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/apache.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/apache.if	2008-08-14 13:53:54.000000000 -0400
@@ -13,21 +13,16 @@
 #
 template(`apache_content_template',`
 	gen_require(`
-		attribute httpdcontent;
 		attribute httpd_exec_scripts;
 		attribute httpd_script_exec_type;
 		type httpd_t, httpd_suexec_t, httpd_log_t;
 	')
-	# allow write access to public file transfer
-	# services files.
-	gen_tunable(allow_httpd_$1_script_anon_write, false)
-
 	#This type is for webpages
-	type httpd_$1_content_t, httpdcontent; # customizable
+	type httpd_$1_content_t;
 	files_type(httpd_$1_content_t)
 
 	# This type is used for .htaccess files
-	type httpd_$1_htaccess_t; # customizable;
+	type httpd_$1_htaccess_t;
 	files_type(httpd_$1_htaccess_t)
 
 	# Type that CGI scripts run as
@@ -42,20 +37,22 @@
 
 	# The following three are the only areas that 
 	# scripts can read, read/write, or append to
-	type httpd_$1_script_ro_t, httpdcontent; # customizable
-	files_type(httpd_$1_script_ro_t)
+	typealias httpd_$1_content_t alias httpd_$1_script_ro_t;
 
-	type httpd_$1_script_rw_t, httpdcontent; # customizable
-	files_type(httpd_$1_script_rw_t)
+	type httpd_$1_content_rw_t;
+	files_type(httpd_$1_content_rw_t)
+	typealias httpd_$1_content_rw_t alias httpd_$1_script_rw_t;
 
-	type httpd_$1_script_ra_t, httpdcontent; # customizable
-	files_type(httpd_$1_script_ra_t)
+	type httpd_$1_content_ra_t;
+	files_type(httpd_$1_content_ra_t)
+	typealias httpd_$1_content_ra_t alias httpd_$1_script_ra_t;
 
-	allow httpd_t httpd_$1_htaccess_t:file read_file_perms;
+	read_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_htaccess_t)
 
 	domtrans_pattern(httpd_suexec_t, httpd_$1_script_exec_t, httpd_$1_script_t)
 
-	allow httpd_suexec_t { httpd_$1_content_t httpd_$1_script_ro_t httpd_$1_script_rw_t httpd_$1_script_exec_t }:dir search_dir_perms;
+	allow httpd_suexec_t { httpd_$1_content_t httpd_$1_content_rw_t httpd_$1_script_exec_t }:dir search_dir_perms;
+	allow httpd_t { httpd_$1_content_t httpd_$1_content_rw_t httpd_$1_script_exec_t }:dir search_dir_perms;
 
 	allow httpd_$1_script_t self:fifo_file rw_file_perms;
 	allow httpd_$1_script_t self:unix_stream_socket connectto;
@@ -65,29 +62,26 @@
 	dontaudit httpd_$1_script_t httpd_t:unix_stream_socket { read write };
 
 	# Allow the script process to search the cgi directory, and users directory
-	allow httpd_$1_script_t httpd_$1_content_t:dir search_dir_perms;
+	allow httpd_$1_script_t httpd_$1_content_t:dir list_dir_perms;
+	read_files_pattern(httpd_$1_script_t, httpd_$1_content_t, httpd_$1_content_t)
+	read_lnk_files_pattern(httpd_$1_script_t, httpd_$1_content_t, httpd_$1_content_t)
 
 	append_files_pattern(httpd_$1_script_t, httpd_log_t, httpd_log_t)
 	logging_search_logs(httpd_$1_script_t)
 
 	can_exec(httpd_$1_script_t, httpd_$1_script_exec_t)
-	allow httpd_$1_script_t httpd_$1_script_exec_t:dir search_dir_perms;
+	allow httpd_$1_script_t httpd_$1_script_exec_t:dir list_dir_perms;
 
-	allow httpd_$1_script_t httpd_$1_script_ra_t:dir { list_dir_perms add_entry_dir_perms };
-	read_files_pattern(httpd_$1_script_t, httpd_$1_script_ra_t, httpd_$1_script_ra_t)
-	append_files_pattern(httpd_$1_script_t, httpd_$1_script_ra_t, httpd_$1_script_ra_t)
-	read_lnk_files_pattern(httpd_$1_script_t, httpd_$1_script_ra_t, httpd_$1_script_ra_t)
-
-	allow httpd_$1_script_t httpd_$1_script_ro_t:dir list_dir_perms;
-	read_files_pattern(httpd_$1_script_t,httpd_$1_script_ro_t,httpd_$1_script_ro_t)
-	read_lnk_files_pattern(httpd_$1_script_t,httpd_$1_script_ro_t,httpd_$1_script_ro_t)
-
-	manage_dirs_pattern(httpd_$1_script_t, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-	manage_files_pattern(httpd_$1_script_t, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-	manage_lnk_files_pattern(httpd_$1_script_t, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-	manage_fifo_files_pattern(httpd_$1_script_t, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-	manage_sock_files_pattern(httpd_$1_script_t, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-	files_tmp_filetrans(httpd_$1_script_t, httpd_$1_script_rw_t, { dir file lnk_file sock_file fifo_file })
+	allow httpd_$1_script_t httpd_$1_content_ra_t:dir { list_dir_perms add_entry_dir_perms };
+	read_files_pattern(httpd_$1_script_t, httpd_$1_content_ra_t, httpd_$1_content_ra_t)
+	append_files_pattern(httpd_$1_script_t, httpd_$1_content_ra_t, httpd_$1_content_ra_t)
+	read_lnk_files_pattern(httpd_$1_script_t, httpd_$1_content_ra_t, httpd_$1_content_ra_t)
+
+	manage_dirs_pattern(httpd_$1_script_t, httpd_$1_content_rw_t, httpd_$1_content_rw_t)
+	manage_files_pattern(httpd_$1_script_t, httpd_$1_content_rw_t, httpd_$1_content_rw_t)
+	manage_lnk_files_pattern(httpd_$1_script_t, httpd_$1_content_rw_t, httpd_$1_content_rw_t)
+	manage_fifo_files_pattern(httpd_$1_script_t, httpd_$1_content_rw_t, httpd_$1_content_rw_t)
+	manage_sock_files_pattern(httpd_$1_script_t, httpd_$1_content_rw_t, httpd_$1_content_rw_t)
 
 	kernel_dontaudit_search_sysctl(httpd_$1_script_t)
 	kernel_dontaudit_search_kernel_sysctl(httpd_$1_script_t)
@@ -96,6 +90,7 @@
 	dev_read_urand(httpd_$1_script_t)
 
 	corecmd_exec_all_executables(httpd_$1_script_t)
+	application_exec_all(httpd_$1_script_t)
 
 	files_exec_etc_files(httpd_$1_script_t)
 	files_read_etc_files(httpd_$1_script_t)
@@ -111,34 +106,21 @@
 
 	seutil_dontaudit_search_config(httpd_$1_script_t)
 
-	tunable_policy(`httpd_enable_cgi && httpd_unified',`
-		allow httpd_$1_script_t httpdcontent:file entrypoint;
-
-		manage_dirs_pattern(httpd_$1_script_t, httpdcontent, httpdcontent)
-		manage_files_pattern(httpd_$1_script_t, httpdcontent, httpdcontent)
-		manage_lnk_files_pattern(httpd_$1_script_t, httpdcontent, httpdcontent)
-		can_exec(httpd_$1_script_t, httpdcontent)
-	')
-
-	tunable_policy(`allow_httpd_$1_script_anon_write',`
-		miscfiles_manage_public_files(httpd_$1_script_t)
-	') 
-
 	# Allow the web server to run scripts and serve pages
 	tunable_policy(`httpd_builtin_scripting',`
-		manage_dirs_pattern(httpd_t, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-		manage_files_pattern(httpd_t, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-		manage_lnk_files_pattern(httpd_t, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-		rw_sock_files_pattern(httpd_t, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-
-		allow httpd_t httpd_$1_script_ra_t:dir { list_dir_perms add_entry_dir_perms };
-		read_files_pattern(httpd_t, httpd_$1_script_ra_t, httpd_$1_script_ra_t)
-		append_files_pattern(httpd_t, httpd_$1_script_ra_t, httpd_$1_script_ra_t)
-		read_lnk_files_pattern(httpd_t, httpd_$1_script_ra_t, httpd_$1_script_ra_t)
-
-		allow httpd_t httpd_$1_script_ro_t:dir list_dir_perms;
-		read_files_pattern(httpd_t, httpd_$1_script_ro_t, httpd_$1_script_ro_t)
-		read_lnk_files_pattern(httpd_t, httpd_$1_script_ro_t, httpd_$1_script_ro_t)
+		manage_dirs_pattern(httpd_t, httpd_$1_content_rw_t, httpd_$1_content_rw_t)
+		manage_files_pattern(httpd_t, httpd_$1_content_rw_t, httpd_$1_content_rw_t)
+		manage_lnk_files_pattern(httpd_t, httpd_$1_content_rw_t, httpd_$1_content_rw_t)
+		rw_sock_files_pattern(httpd_t, httpd_$1_content_rw_t, httpd_$1_content_rw_t)
+
+		allow httpd_t httpd_$1_content_ra_t:dir { list_dir_perms add_entry_dir_perms };
+		read_files_pattern(httpd_t, httpd_$1_content_ra_t, httpd_$1_content_ra_t)
+		append_files_pattern(httpd_t, httpd_$1_content_ra_t, httpd_$1_content_ra_t)
+		read_lnk_files_pattern(httpd_t, httpd_$1_content_ra_t, httpd_$1_content_ra_t)
+
+		allow httpd_t httpd_$1_content_t:dir list_dir_perms;
+		read_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_content_t)
+		read_lnk_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_content_t)
 
 		allow httpd_t httpd_$1_content_t:dir list_dir_perms;
 		read_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_content_t)
@@ -151,9 +133,13 @@
 		# privileged users run the script:
 		domtrans_pattern(httpd_exec_scripts, httpd_$1_script_exec_t, httpd_$1_script_t)
 
+		allow httpd_exec_scripts httpd_$1_script_exec_t:file read_file_perms;
+
 		# apache runs the script:
 		domtrans_pattern(httpd_t, httpd_$1_script_exec_t, httpd_$1_script_t)
 
+		allow httpd_t httpd_$1_script_exec_t:file read_file_perms;
+
 		allow httpd_t httpd_$1_script_t:process { signal sigkill sigstop };
 		allow httpd_t httpd_$1_script_exec_t:dir list_dir_perms;
 
@@ -177,50 +163,6 @@
 		miscfiles_read_localization(httpd_$1_script_t)
 	')
 
-	tunable_policy(`httpd_enable_cgi && httpd_can_network_connect_db',`
-		allow httpd_$1_script_t self:tcp_socket create_stream_socket_perms;
-		allow httpd_$1_script_t self:udp_socket create_socket_perms;
-
-		corenet_all_recvfrom_unlabeled(httpd_$1_script_t)
-		corenet_all_recvfrom_netlabel(httpd_$1_script_t)
-		corenet_tcp_sendrecv_all_if(httpd_$1_script_t)
-		corenet_udp_sendrecv_all_if(httpd_$1_script_t)
-		corenet_tcp_sendrecv_all_nodes(httpd_$1_script_t)
-		corenet_udp_sendrecv_all_nodes(httpd_$1_script_t)
-		corenet_tcp_sendrecv_all_ports(httpd_$1_script_t)
-		corenet_udp_sendrecv_all_ports(httpd_$1_script_t)
-
-		sysnet_read_config(httpd_$1_script_t)
-	')
-
-	tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
-		allow httpd_$1_script_t self:tcp_socket create_stream_socket_perms;
-		allow httpd_$1_script_t self:udp_socket create_socket_perms;
-
-		corenet_all_recvfrom_unlabeled(httpd_$1_script_t)
-		corenet_all_recvfrom_netlabel(httpd_$1_script_t)
-		corenet_tcp_sendrecv_all_if(httpd_$1_script_t)
-		corenet_udp_sendrecv_all_if(httpd_$1_script_t)
-		corenet_tcp_sendrecv_all_nodes(httpd_$1_script_t)
-		corenet_udp_sendrecv_all_nodes(httpd_$1_script_t)
-		corenet_tcp_sendrecv_all_ports(httpd_$1_script_t)
-		corenet_udp_sendrecv_all_ports(httpd_$1_script_t)
-		corenet_tcp_connect_all_ports(httpd_$1_script_t)
-		corenet_sendrecv_all_client_packets(httpd_$1_script_t)
-
-		sysnet_read_config(httpd_$1_script_t)
-	')
-
-	optional_policy(`
-		mta_send_mail(httpd_$1_script_t)
-	')
-
-	optional_policy(`
-		tunable_policy(`httpd_enable_cgi && httpd_can_network_connect_db',`
-			mysql_tcp_connect(httpd_$1_script_t)
-		')
-	')
-
 	optional_policy(`
 		tunable_policy(`httpd_enable_cgi && allow_ypbind',`
 			nis_use_ypbind_uncond(httpd_$1_script_t)
@@ -229,10 +171,6 @@
 
 	optional_policy(`
 		postgresql_unpriv_client(httpd_$1_script_t)
-
-		tunable_policy(`httpd_enable_cgi && httpd_can_network_connect_db',`
-			postgresql_tcp_connect(httpd_$1_script_t)
-		')
 	')
 
 	optional_policy(`
@@ -275,72 +213,77 @@
 template(`apache_per_role_template', `
 	gen_require(`
 		attribute httpdcontent, httpd_script_domains;
-		attribute httpd_exec_scripts, httpd_user_content_type;
-		attribute httpd_user_script_exec_type;
-		type httpd_t, httpd_suexec_t, httpd_log_t;
+		attribute httpd_exec_scripts;
+		type httpd_t, httpd_suexec_t, httpd_log_t, httpd_sys_script_t;
+		type httpd_user_content_t;
+		type httpd_user_script_t;
+		type httpd_user_content_ra_t;
+		type httpd_user_content_rw_t;
+		type httpd_user_content_t;
+		type httpd_user_script_exec_t;
+		type httpd_user_htaccess_t;
+	')
+
+
+	ifelse(`$1',`user',`',`
+		typealias httpd_user_content_t alias httpd_$1_script_t;
+		typealias httpd_user_content_ra_t alias httpd_$1_script_ra_t;
+		typealias httpd_user_content_rw_t alias httpd_$1_script_rw_t;
+		typealias httpd_user_content_t alias httpd_$1_script_ro_t;
+		typealias httpd_user_script_exec_t alias httpd_$1_script_exec_t;
+		typealias httpd_user_htaccess_t alias httpd_$1_htaccess_t;
 	')
 
-	apache_content_template($1)
 
-	typeattribute httpd_$1_content_t httpd_user_content_type;
-	typeattribute httpd_$1_script_ra_t httpd_user_content_type;
-	typeattribute httpd_$1_script_rw_t httpd_user_content_type;
-	typeattribute httpd_$1_script_ro_t httpd_user_content_type;
-	typeattribute httpd_$1_script_exec_t httpd_user_script_exec_type;
-
-	typeattribute httpd_$1_script_t httpd_script_domains;
-	userdom_user_home_content($1,httpd_$1_content_t)
-
-	role $3 types httpd_$1_script_t;
-
-	allow $2 httpd_$1_content_t:{ dir file lnk_file } { relabelto relabelfrom };
-
-	allow $2 httpd_$1_htaccess_t:file { manage_file_perms relabelto relabelfrom };
-
-	manage_dirs_pattern($2, httpd_$1_script_ra_t, httpd_$1_script_ra_t)
-	manage_files_pattern($2, httpd_$1_script_ra_t, httpd_$1_script_ra_t)
-	manage_lnk_files_pattern($2, httpd_$1_script_ra_t, httpd_$1_script_ra_t)
-	relabel_dirs_pattern($2, httpd_$1_script_ra_t, httpd_$1_script_ra_t)
-	relabel_files_pattern($2, httpd_$1_script_ra_t, httpd_$1_script_ra_t)
-	relabel_lnk_files_pattern($2, httpd_$1_script_ra_t, httpd_$1_script_ra_t)
-
-	manage_dirs_pattern($2, httpd_$1_script_ro_t, httpd_$1_script_ro_t)
-	manage_files_pattern($2, httpd_$1_script_ro_t, httpd_$1_script_ro_t)
-	manage_lnk_files_pattern($2, httpd_$1_script_ro_t, httpd_$1_script_ro_t)
-	relabel_dirs_pattern($2, httpd_$1_script_ro_t, httpd_$1_script_ro_t)
-	relabel_files_pattern($2, httpd_$1_script_ro_t, httpd_$1_script_ro_t)
-	relabel_lnk_files_pattern($2, httpd_$1_script_ro_t, httpd_$1_script_ro_t)
-
-	manage_dirs_pattern($2, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-	manage_files_pattern($2, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-	manage_lnk_files_pattern($2, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-	relabel_dirs_pattern($2, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-	relabel_files_pattern($2, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-	relabel_lnk_files_pattern($2, httpd_$1_script_rw_t, httpd_$1_script_rw_t)
-
-	manage_dirs_pattern($2, httpd_$1_script_exec_t, httpd_$1_script_exec_t)
-	manage_files_pattern($2, httpd_$1_script_exec_t, httpd_$1_script_exec_t)
-	manage_lnk_files_pattern($2, httpd_$1_script_exec_t, httpd_$1_script_exec_t)
-	relabel_dirs_pattern($2, httpd_$1_script_exec_t, httpd_$1_script_exec_t)
-	relabel_files_pattern($2, httpd_$1_script_exec_t, httpd_$1_script_exec_t)
-	relabel_lnk_files_pattern($2, httpd_$1_script_exec_t, httpd_$1_script_exec_t)
+	role $3 types httpd_user_script_t;
+
+	allow $2 httpd_user_content_t:{ dir file lnk_file } { relabelto relabelfrom };
+
+	allow $2 httpd_user_htaccess_t:file { manage_file_perms relabelto relabelfrom };
+
+	manage_dirs_pattern($2, httpd_user_content_ra_t, httpd_user_content_ra_t)
+	manage_files_pattern($2, httpd_user_content_ra_t, httpd_user_content_ra_t)
+	manage_lnk_files_pattern($2, httpd_user_content_ra_t, httpd_user_content_ra_t)
+	relabel_dirs_pattern($2, httpd_user_content_ra_t, httpd_user_content_ra_t)
+	relabel_files_pattern($2, httpd_user_content_ra_t, httpd_user_content_ra_t)
+	relabel_lnk_files_pattern($2, httpd_user_content_ra_t, httpd_user_content_ra_t)
+
+	manage_dirs_pattern($2, httpd_user_content_t, httpd_user_content_t)
+	manage_files_pattern($2, httpd_user_content_t, httpd_user_content_t)
+	manage_lnk_files_pattern($2, httpd_user_content_t, httpd_user_content_t)
+	relabel_dirs_pattern($2, httpd_user_content_t, httpd_user_content_t)
+	relabel_files_pattern($2, httpd_user_content_t, httpd_user_content_t)
+	relabel_lnk_files_pattern($2, httpd_user_content_t, httpd_user_content_t)
+
+	manage_dirs_pattern($2, httpd_user_content_rw_t, httpd_user_content_rw_t)
+	manage_files_pattern($2, httpd_user_content_rw_t, httpd_user_content_rw_t)
+	manage_lnk_files_pattern($2, httpd_user_content_rw_t, httpd_user_content_rw_t)
+	relabel_dirs_pattern($2, httpd_user_content_rw_t, httpd_user_content_rw_t)
+	relabel_files_pattern($2, httpd_user_content_rw_t, httpd_user_content_rw_t)
+	relabel_lnk_files_pattern($2, httpd_user_content_rw_t, httpd_user_content_rw_t)
+
+	manage_dirs_pattern($2, httpd_user_script_exec_t, httpd_user_script_exec_t)
+	manage_files_pattern($2, httpd_user_script_exec_t, httpd_user_script_exec_t)
+	manage_lnk_files_pattern($2, httpd_user_script_exec_t, httpd_user_script_exec_t)
+	relabel_dirs_pattern($2, httpd_user_script_exec_t, httpd_user_script_exec_t)
+	relabel_files_pattern($2, httpd_user_script_exec_t, httpd_user_script_exec_t)
+	relabel_lnk_files_pattern($2, httpd_user_script_exec_t, httpd_user_script_exec_t)
 
 	tunable_policy(`httpd_enable_cgi',`
 		# If a user starts a script by hand it gets the proper context
-		domtrans_pattern($2, httpd_$1_script_exec_t, httpd_$1_script_t)
+		domtrans_pattern($2, httpd_user_script_exec_t, httpd_user_script_t)
 	')
 
 	tunable_policy(`httpd_enable_cgi && httpd_unified',`
-		allow httpd_$1_script_t httpdcontent:file entrypoint;
-
-		domtrans_pattern($2, httpdcontent, httpd_$1_script_t)
+		can_exec(httpd_user_script_t, httpd_user_content_t)
 	')
 
 	# allow accessing files/dirs below the users home dir
 	tunable_policy(`httpd_enable_homedirs',`
-		userdom_search_user_home_dirs($1,httpd_t)
-		userdom_search_user_home_dirs($1,httpd_suexec_t)
-		userdom_search_user_home_dirs($1,httpd_$1_script_t)
+		userdom_search_user_home_dirs(user, httpd_t)
+		userdom_search_user_home_dirs(user, httpd_suexec_t)
+		userdom_search_user_home_dirs(user, httpd_user_script_t)
+		userdom_search_user_home_dirs(user, httpd_sys_script_t)
 	')
 ')
 
@@ -362,12 +305,11 @@
 #
 template(`apache_read_user_scripts',`
 	gen_require(`
-		type httpd_$1_script_exec_t;
+		type httpd_user_script_exec_t;
 	')
-
-	allow $2 httpd_$1_script_exec_t:dir list_dir_perms;
-	read_files_pattern($2, httpd_$1_script_exec_t, httpd_$1_script_exec_t)
-	read_lnk_files_pattern($2, httpd_$1_script_exec_t, httpd_$1_script_exec_t)
+	allow $2 httpd_user_script_exec_t:dir list_dir_perms;
+	read_files_pattern($2, httpd_user_script_exec_t, httpd_user_script_exec_t)
+	read_lnk_files_pattern($2, httpd_user_script_exec_t, httpd_user_script_exec_t)
 ')
 
 ########################################
@@ -388,12 +330,12 @@
 #
 template(`apache_read_user_content',`
 	gen_require(`
-		type httpd_$1_content_t;
+		type httpd_user_content_t;
 	')
 
-	allow $2 httpd_$1_content_t:dir list_dir_perms;
-	read_files_pattern($2, httpd_$1_content_t, httpd_$1_content_t)
-	read_lnk_files_pattern($2, httpd_$1_content_t, httpd_$1_content_t)
+	allow $2 httpd_user_content_t:dir list_dir_perms;
+	read_files_pattern($2, httpd_user_content_t, httpd_user_content_t)
+	read_lnk_files_pattern($2, httpd_user_content_t, httpd_user_content_t)
 ')
 
 ########################################
@@ -771,6 +713,7 @@
 	')
 
 	allow $1 httpd_modules_t:dir list_dir_perms;
+	read_lnk_files_pattern($1, httpd_modules_t, httpd_modules_t)
 ')
 
 ########################################
@@ -838,6 +781,32 @@
 
 ########################################
 ## <summary>
+##	Allow the specified domain to delete
+##	apache system content rw files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+# Note that httpd_sys_content_t is found in /var, /etc, /srv and /usr
+interface(`apache_delete_sys_content_rw',`
+	gen_require(`
+		type httpd_sys_content_rw_t;
+	')
+
+	files_search_tmp($1)
+	delete_dirs_pattern($1, httpd_sys_content_rw_t, httpd_sys_content_rw_t)
+	delete_files_pattern($1, httpd_sys_content_rw_t, httpd_sys_content_rw_t)
+	delete_lnk_files_pattern($1, httpd_sys_content_rw_t, httpd_sys_content_rw_t)
+	delete_fifo_files_pattern($1, httpd_sys_content_rw_t, httpd_sys_content_rw_t)
+	delete_sock_files_pattern($1, httpd_sys_content_rw_t, httpd_sys_content_rw_t)
+')
+
+########################################
+## <summary>
 ##	Execute all web scripts in the system
 ##	script domain.
 ## </summary>
@@ -851,12 +820,16 @@
 # sysadm_t to run scripts
 interface(`apache_domtrans_sys_script',`
 	gen_require(`
-		attribute httpdcontent;
 		type httpd_sys_script_t;
+		type httpd_sys_content_t;
+	')
+
+	tunable_policy(`httpd_enable_cgi',`
+		domtrans_pattern($1, httpd_sys_script_exec_t, httpd_sys_script_t)
 	')
 
 	tunable_policy(`httpd_enable_cgi && httpd_unified',`
-		domtrans_pattern($1, httpdcontent, httpd_sys_script_t)
+		domtrans_pattern($1, httpd_sys_content_t, httpd_sys_script_t)
 	')
 ')
 
@@ -942,7 +915,7 @@
 		type httpd_squirrelmail_t;
 	')
 
-	allow $1 httpd_squirrelmail_t:file { getattr read };
+	read_files_pattern($1, httpd_squirrelmail_t, httpd_squirrelmail_t)
 ')
 
 ########################################
@@ -1033,16 +1006,16 @@
 #
 interface(`apache_manage_all_user_content',`
 	gen_require(`
-		attribute httpd_user_content_type, httpd_user_script_exec_type;
+		type httpd_user_content_t, httpd_user_script_exec_t;
 	')
 
-	manage_dirs_pattern($1, httpd_user_content_type, httpd_user_content_type)
-	manage_files_pattern($1, httpd_user_content_type, httpd_user_content_type)
-	manage_lnk_files_pattern($1, httpd_user_content_type, httpd_user_content_type)
+	manage_dirs_pattern($1, httpd_user_content_t, httpd_user_content_t)
+	manage_files_pattern($1, httpd_user_content_t, httpd_user_content_t)
+	manage_lnk_files_pattern($1, httpd_user_content_t, httpd_user_content_t)
 
-	manage_dirs_pattern($1, httpd_user_script_exec_type, httpd_user_script_exec_type)
-	manage_files_pattern($1, httpd_user_script_exec_type, httpd_user_script_exec_type)
-	manage_lnk_files_pattern($1, httpd_user_script_exec_type, httpd_user_script_exec_type)
+	manage_dirs_pattern($1, httpd_user_script_exec_t, httpd_user_script_exec_t)
+	manage_files_pattern($1, httpd_user_script_exec_t, httpd_user_script_exec_t)
+	manage_lnk_files_pattern($1, httpd_user_script_exec_t, httpd_user_script_exec_t)
 ')
 
 ########################################
@@ -1098,3 +1071,144 @@
 
 	allow httpd_t $1:process signal;
 ')
+
+########################################
+## <summary>
+##	Allow the specified domain to search 
+##	apache bugzilla directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`apache_search_bugzilla_dirs',`
+	gen_require(`
+		type httpd_bugzilla_content_t;
+	')
+
+	allow $1 httpd_bugzilla_content_t:dir search_dir_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read and write Apache
+##	bugzill script unix domain stream sockets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`apache_dontaudit_rw_bugzilla_script_stream_sockets',`
+	gen_require(`
+		type httpd_bugzilla_script_t;
+	')
+
+	dontaudit $1 httpd_bugzilla_script_t:unix_stream_socket { read write };
+')
+
+########################################
+## <summary>
+##	Execute apache server in the ntpd domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`apache_script_domtrans',`
+	gen_require(`
+		type httpd_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, httpd_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate an apache environment
+## </summary>
+## <param name="prefix">
+##	<summary>
+##	Prefix of the domain. Example, user would be
+##	the prefix for the uder_t domain.
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the apache domain.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`apache_admin',`
+
+	gen_require(`
+		type httpd_t, httpd_script_exec_t, httpd_config_t;
+		type httpd_log_t, httpd_modules_t, httpd_lock_t;
+		type httpd_var_run_t;
+		attribute httpdcontent;
+		attribute httpd_script_exec_type;
+		type httpd_bool_t;
+		type httpd_php_tmp_t;
+		type httpd_suexec_tmp_t;
+		type httpd_tmp_t;
+
+	')
+
+	allow $1 httpd_t:process { getattr ptrace signal_perms };
+
+	# Allow $1 to restart the apache service
+	apache_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 httpd_script_exec_t system_r;
+	allow $2 system_r;
+
+	apache_manage_all_content($1)
+	miscfiles_manage_public_files($1)
+
+	files_search_etc($1)
+	admin_pattern($1, httpd_config_t)
+
+	logging_search_logs($1)
+	admin_pattern($1, httpd_log_t)
+
+	admin_pattern($1, httpd_modules_t)
+
+	admin_pattern($1, httpd_lock_t)
+	files_lock_filetrans($1, httpd_lock_t, file)
+
+	admin_pattern($1, httpd_var_run_t)
+	files_pid_filetrans($1, httpd_var_run_t, file)
+
+	kernel_search_proc($1)
+	allow $1 httpd_t:dir list_dir_perms;
+	ps_process_pattern($1, httpd_t)
+	read_lnk_files_pattern($1, httpd_t, httpd_t)
+
+	admin_pattern($1, httpdcontent)
+	admin_pattern($1, httpd_script_exec_type)
+
+	seutil_domtrans_setfiles($1)
+
+	admin_pattern($1, httpd_tmp_t)
+	admin_pattern($1, httpd_php_tmp_t)
+	admin_pattern($1, httpd_suexec_tmp_t)
+	files_tmp_filetrans($1, httpd_tmp_t, { file dir })
+
+ifdef(`TODO',`
+	apache_set_booleans($1, $2, $3, httpd_bool_t )
+	seutil_setsebool_per_role_template($1, httpd, $3)
+	allow httpd_setsebool_t httpd_bool_t:dir list_dir_perms;
+	allow httpd_setsebool_t httpd_bool_t:file rw_file_perms;
+')
+')
--- nsaserefpolicy/policy/modules/services/apache.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/apache.te	2008-08-14 13:53:54.000000000 -0400
@@ -20,6 +20,8 @@
 # Declarations
 #
 
+selinux_genbool(httpd_bool_t)
+
 ## <desc>
 ## <p>
 ## Allow Apache to modify public files
@@ -31,10 +33,17 @@
 
 ## <desc>
 ## <p>
-## Allow Apache to use mod_auth_pam
+## Allow httpd scripts and modules execmem/execstack
 ## </p>
 ## </desc>
-gen_tunable(allow_httpd_mod_auth_pam, false)
+gen_tunable(httpd_execmem, false)
+
+## <desc>
+## <p>
+## Allow Apache to communicate with avahi service via dbus
+## </p>
+## </desc>
+gen_tunable(allow_httpd_dbus_avahi, false)
 
 ## <desc>
 ## <p>
@@ -45,7 +54,14 @@
 
 ## <desc>
 ## <p>
-## Allow HTTPD scripts and modules to connect to the network using TCP.
+## Allow http daemon to send mail
+## </p>
+## </desc>
+gen_tunable(httpd_can_sendmail, false)
+
+## <desc>
+## <p>
+## Allow HTTPD scripts and modules to connect to the network
 ## </p>
 ## </desc>
 gen_tunable(httpd_can_network_connect, false)
@@ -109,14 +125,33 @@
 ## </desc>
 gen_tunable(httpd_unified, false)
 
+## <desc>
+## <p>
+## Allow httpd to access nfs file systems
+## </p>
+## </desc>
+gen_tunable(httpd_use_nfs, false)
+
+## <desc>
+## <p>
+## Allow httpd to access cifs file systems
+## </p>
+## </desc>
+gen_tunable(httpd_use_cifs, false)
+
+## <desc>
+## <p>
+## Allow apache scripts to write to public content.  Directories/Files must be labeled public_content_rw_t.
+## </p>
+## </desc>
+gen_tunable(allow_httpd_sys_script_anon_write, false)
+
 attribute httpdcontent;
-attribute httpd_user_content_type;
 
 # domains that can exec all users scripts
 attribute httpd_exec_scripts;
 
 attribute httpd_script_exec_type;
-attribute httpd_user_script_exec_type;
 
 # user script domains
 attribute httpd_script_domains;
@@ -147,6 +182,9 @@
 type httpd_log_t;
 logging_log_file(httpd_log_t)
 
+type httpd_script_exec_t;
+init_script_type(httpd_script_exec_t)
+
 # httpd_modules_t is the type given to module files (libraries) 
 # that come with Apache /etc/httpd/modules and /usr/lib/apache
 type httpd_modules_t;
@@ -180,6 +218,9 @@
 
 # setup the system domain for system CGI scripts
 apache_content_template(sys)
+typeattribute httpd_sys_content_t httpdcontent; # customizable
+typeattribute httpd_sys_content_rw_t httpdcontent; # customizable
+typeattribute httpd_sys_content_ra_t httpdcontent; # customizable
 
 type httpd_tmp_t;
 files_tmp_file(httpd_tmp_t)
@@ -202,12 +243,16 @@
 	prelink_object_file(httpd_modules_t)
 ')
 
+apache_content_template(user)
+userdom_user_home_content(user, httpd_user_content_t)
+typealias httpd_user_content_t alias httpd_unconfined_content_t;
+
 ########################################
 #
 # Apache server local policy
 #
 
-allow httpd_t self:capability { chown dac_override kill setgid setuid sys_tty_config };
+allow httpd_t self:capability { chown dac_override kill setgid setuid sys_nice sys_tty_config };
 dontaudit httpd_t self:capability { net_admin sys_tty_config };
 allow httpd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 allow httpd_t self:fd use;
@@ -249,6 +294,7 @@
 allow httpd_t httpd_modules_t:dir list_dir_perms;
 mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
 read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
+read_lnk_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
 
 apache_domtrans_rotatelogs(httpd_t)
 # Apache-httpd needs to be able to send signals to the log rotate procs.
@@ -289,6 +335,7 @@
 kernel_read_kernel_sysctls(httpd_t)
 # for modules that want to access /proc/meminfo
 kernel_read_system_state(httpd_t)
+kernel_search_network_sysctl(httpd_t)
 
 corenet_all_recvfrom_unlabeled(httpd_t)
 corenet_all_recvfrom_netlabel(httpd_t)
@@ -312,12 +359,11 @@
 
 fs_getattr_all_fs(httpd_t)
 fs_search_auto_mountpoints(httpd_t)
+fs_list_inotifyfs(httpd_t)
 
 auth_use_nsswitch(httpd_t)
 
-# execute perl
-corecmd_exec_bin(httpd_t)
-corecmd_exec_shell(httpd_t)
+application_exec_all(httpd_t)
 
 domain_use_interactive_fds(httpd_t)
 
@@ -335,6 +381,10 @@
 files_read_var_lib_symlinks(httpd_t)
 
 fs_search_auto_mountpoints(httpd_sys_script_t)
+# php uploads a file to /tmp and then execs programs to acton them
+manage_dirs_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t)
+manage_files_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t)
+files_tmp_filetrans(httpd_sys_script_t, httpd_sys_content_rw_t, { dir file lnk_file sock_file fifo_file })
 
 libs_use_ld_so(httpd_t)
 libs_use_shared_libs(httpd_t)
@@ -351,18 +401,33 @@
 
 userdom_use_unpriv_users_fds(httpd_t)
 
-mta_send_mail(httpd_t)
-
 tunable_policy(`allow_httpd_anon_write',`
 	miscfiles_manage_public_files(httpd_t)
 ') 
 
-ifdef(`TODO', `
 #
 # We need optionals to be able to be within booleans to make this work
 #
+## <desc>
+## <p>
+## Allow Apache to use mod_auth_pam
+## </p>
+## </desc>
+gen_tunable(allow_httpd_mod_auth_pam, false)
+
+tunable_policy(`allow_httpd_mod_auth_pam',`
+	auth_domtrans_chkpwd(httpd_t)
+')
+
+## <desc>
+## <p>
+## Allow Apache to use mod_auth_pam
+## </p>
+## </desc>
+gen_tunable(allow_httpd_mod_auth_ntlm_winbind, false)
+optional_policy(`
 tunable_policy(`allow_httpd_mod_auth_pam',`
-	auth_domtrans_chk_passwd(httpd_t)
+		samba_domtrans_winbind_helper(httpd_t)
 ')
 ')
 
@@ -370,6 +435,16 @@
 	corenet_tcp_connect_all_ports(httpd_t)
 ')
 
+tunable_policy(`httpd_can_sendmail',`
+	# allow httpd to connect to mail servers
+	corenet_tcp_connect_smtp_port(httpd_t)
+	corenet_sendrecv_smtp_client_packets(httpd_t)
+	corenet_tcp_connect_pop_port(httpd_t)
+	corenet_sendrecv_pop_client_packets(httpd_t)
+	mta_send_mail(httpd_t)
+	mta_send_mail(httpd_sys_script_t)
+')
+
 tunable_policy(`httpd_can_network_relay',`
 	# allow httpd to work as a relay
 	corenet_tcp_connect_gopher_port(httpd_t)
@@ -382,23 +457,34 @@
 	corenet_sendrecv_http_cache_client_packets(httpd_t)
 ')
 
-tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
-	domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t)
+tunable_policy(`httpd_enable_cgi && httpd_unified',`
+	allow httpd_sys_script_t httpd_sys_content_t:file entrypoint;
+	filetrans_pattern(httpd_sys_script_t, httpd_sys_content_t, httpd_sys_content_rw_t, { file dir lnk_file })
+	can_exec(httpd_sys_script_t, httpd_sys_content_t)
+')
+
+tunable_policy(`allow_httpd_sys_script_anon_write',`
+	miscfiles_manage_public_files(httpd_sys_script_t)
+') 
 
-	manage_dirs_pattern(httpd_t, httpdcontent, httpdcontent)
-	manage_files_pattern(httpd_t, httpdcontent, httpdcontent)
-	manage_lnk_files_pattern(httpd_t, httpdcontent, httpdcontent)
+tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
+	domtrans_pattern(httpd_t, httpd_sys_content_t, httpd_sys_script_t)
+	filetrans_pattern(httpd_t, httpd_sys_content_t, httpd_sys_content_rw_t, { file dir lnk_file })
+	manage_dirs_pattern(httpd_t, httpdcontent, httpd_sys_content_rw_t)
+	manage_files_pattern(httpd_t, httpdcontent, httpd_sys_content_rw_t)
+	manage_lnk_files_pattern(httpd_t, httpdcontent, httpd_sys_content_rw_t)
 ')
 
 tunable_policy(`httpd_enable_ftp_server',`
 	corenet_tcp_bind_ftp_port(httpd_t)
 ')
 
-tunable_policy(`httpd_enable_homedirs',`
-	userdom_read_unpriv_users_home_content_files(httpd_t)
+tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
+	fs_read_nfs_files(httpd_t)
+	fs_read_nfs_symlinks(httpd_t)
 ')
 
-tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
+tunable_policy(`httpd_use_nfs',`
 	fs_read_nfs_files(httpd_t)
 	fs_read_nfs_symlinks(httpd_t)
 ')
@@ -408,6 +494,11 @@
 	fs_read_cifs_symlinks(httpd_t)
 ')
 
+tunable_policy(`httpd_use_cifs',`
+	fs_read_cifs_files(httpd_t)
+	fs_read_cifs_symlinks(httpd_t)
+')
+
 tunable_policy(`httpd_ssi_exec',`
 	corecmd_shell_domtrans(httpd_t,httpd_sys_script_t)
 	allow httpd_sys_script_t httpd_t:fd use;
@@ -441,8 +532,13 @@
 ')
 
 optional_policy(`
-	kerberos_use(httpd_t)
-	kerberos_read_kdc_config(httpd_t)
+	dbus_system_bus_client_template(httpd, httpd_t)
+	tunable_policy(`allow_httpd_dbus_avahi',`
+		avahi_dbus_chat(httpd_t)
+	')
+')
+optional_policy(`
+	kerberos_keytab_template(httpd, httpd_t)
 ')
 
 optional_policy(`
@@ -454,18 +550,13 @@
 ')
 
 optional_policy(`
-	# Allow httpd to work with mysql
 	mysql_stream_connect(httpd_t)
 	mysql_rw_db_sockets(httpd_t)
-
-	tunable_policy(`httpd_can_network_connect_db',`
-		mysql_tcp_connect(httpd_t)
-	')
+	mysql_read_config(httpd_t)
 ')
 
 optional_policy(`
 	nagios_read_config(httpd_t)
-	nagios_domtrans_cgi(httpd_t)
 ')
 
 optional_policy(`
@@ -475,6 +566,12 @@
 	openca_kill(httpd_t)
 ')
 
+tunable_policy(`httpd_execmem',`
+	allow httpd_t self:process { execmem execstack };
+	allow httpd_sys_script_t self:process { execmem execstack };
+	allow httpd_suexec_t self:process { execmem execstack };
+') 
+
 optional_policy(`
 	# Allow httpd to work with postgresql
 	postgresql_stream_connect(httpd_t)
@@ -482,6 +579,7 @@
 
 	tunable_policy(`httpd_can_network_connect_db',`
 		postgresql_tcp_connect(httpd_t)
+		postgresql_tcp_connect(httpd_sys_script_t)
 	')
 ')
 
@@ -490,6 +588,7 @@
 ')
 
 optional_policy(`
+	files_dontaudit_rw_usr_dirs(httpd_t)
 	snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
 	snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
 ')
@@ -519,9 +618,28 @@
 logging_send_syslog_msg(httpd_helper_t)
 
 tunable_policy(`httpd_tty_comm',`
+	# cjp: this is redundant:
+	term_use_controlling_term(httpd_helper_t)
+
 	sysadm_use_terms(httpd_helper_t)
 ')
 
+optional_policy(`
+	type httpd_unconfined_script_t;
+	type httpd_unconfined_script_exec_t;
+	domain_type(httpd_unconfined_script_t)
+	domain_entry_file(httpd_unconfined_script_t, httpd_unconfined_script_exec_t)
+	domtrans_pattern(httpd_t, httpd_unconfined_script_exec_t, httpd_unconfined_script_t)
+	unconfined_domain(httpd_unconfined_script_t)
+
+	role system_r types httpd_unconfined_script_t;
+
+	tunable_policy(`httpd_tty_comm',`
+		unconfined_use_terminals(httpd_helper_t)
+	')
+')
+
+
 ########################################
 #
 # Apache PHP script local policy
@@ -551,22 +669,27 @@
 
 fs_search_auto_mountpoints(httpd_php_t)
 
+auth_use_nsswitch(httpd_php_t)
+
 libs_exec_lib_files(httpd_php_t)
 libs_use_ld_so(httpd_php_t)
 libs_use_shared_libs(httpd_php_t)
 
 userdom_use_unpriv_users_fds(httpd_php_t)
 
-optional_policy(`
-	mysql_stream_connect(httpd_php_t)
+tunable_policy(`httpd_can_network_connect_db',`
+	corenet_tcp_connect_mysqld_port(httpd_t)
+	corenet_sendrecv_mysqld_client_packets(httpd_t)
+	corenet_tcp_connect_mysqld_port(httpd_sys_script_t)
+	corenet_sendrecv_mysqld_client_packets(httpd_sys_script_t)
+	corenet_tcp_connect_mysqld_port(httpd_suexec_t)
+	corenet_sendrecv_mysqld_client_packets(httpd_suexec_t)
 ')
 
-optional_policy(`
-	nis_use_ypbind(httpd_php_t)
-')
 
 optional_policy(`
-	postgresql_stream_connect(httpd_php_t)
+	mysql_stream_connect(httpd_php_t)
+	mysql_read_config(httpd_php_t)
 ')
 
 ########################################
@@ -590,6 +713,8 @@
 manage_files_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t)
 files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir })
 
+can_exec(httpd_suexec_t, httpd_sys_script_exec_t)
+
 kernel_read_kernel_sysctls(httpd_suexec_t)
 kernel_list_proc(httpd_suexec_t)
 kernel_read_proc_symlinks(httpd_suexec_t)
@@ -598,9 +723,7 @@
 
 fs_search_auto_mountpoints(httpd_suexec_t)
 
-# for shell scripts
-corecmd_exec_bin(httpd_suexec_t)
-corecmd_exec_shell(httpd_suexec_t)
+application_exec_all(httpd_suexec_t)
 
 files_read_etc_files(httpd_suexec_t)
 files_read_usr_files(httpd_suexec_t)
@@ -633,12 +756,21 @@
 	corenet_sendrecv_all_client_packets(httpd_suexec_t)
 ')
 
+read_files_pattern(httpd_suexec_t, httpd_user_content_t, httpd_user_content_t)
+read_files_pattern(httpd_suexec_t, httpd_user_script_rw_t, httpd_user_script_rw_t)
+read_files_pattern(httpd_suexec_t, httpd_user_script_ro_t, httpd_user_script_ro_t)
+read_files_pattern(httpd_suexec_t, httpd_user_script_ra_t, httpd_user_script_ra_t)
+
+domain_entry_file(httpd_sys_script_t, httpd_sys_content_t)
 tunable_policy(`httpd_enable_cgi && httpd_unified',`
 	domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t)
+	domtrans_pattern(httpd_suexec_t, httpd_user_content_t, httpd_user_script_t)
+	domtrans_pattern(httpd_suexec_t, httpd_user_script_ro_t, httpd_user_script_t)
+	domtrans_pattern(httpd_suexec_t, httpd_user_script_ra_t, httpd_user_script_t)
+	domtrans_pattern(httpd_suexec_t, httpd_user_script_rw_t, httpd_user_script_t)
 ')
-
-tunable_policy(`httpd_enable_homedirs',`
-	userdom_read_unpriv_users_home_content_files(httpd_suexec_t)
+tunable_policy(`httpd_enable_cgi',`
+	domtrans_pattern(httpd_suexec_t, httpd_user_script_t, httpd_user_script_t)
 ')
 
 tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
@@ -647,6 +779,12 @@
 	fs_exec_nfs_files(httpd_suexec_t)
 ')
 
+tunable_policy(`httpd_use_cifs',`
+	fs_read_cifs_files(httpd_suexec_t)
+	fs_read_cifs_symlinks(httpd_suexec_t)
+	fs_exec_cifs_files(httpd_suexec_t)
+')
+
 tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
 	fs_read_cifs_files(httpd_suexec_t)
 	fs_read_cifs_symlinks(httpd_suexec_t)
@@ -664,10 +802,6 @@
 	dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
 ')
 
-optional_policy(`
-	nagios_domtrans_cgi(httpd_suexec_t)
-')
-
 ########################################
 #
 # Apache system script local policy
@@ -677,7 +811,8 @@
 
 dontaudit httpd_sys_script_t httpd_config_t:dir search;
 
-allow httpd_sys_script_t httpd_squirrelmail_t:file { append read };
+apache_read_squirrelmail_data(httpd_sys_script_t)
+apache_append_squirrelmail_data(httpd_sys_script_t)
 
 allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
 read_files_pattern(httpd_sys_script_t, squirrelmail_spool_t, squirrelmail_spool_t)
@@ -691,12 +826,15 @@
 # Should we add a boolean?
 apache_domtrans_rotatelogs(httpd_sys_script_t)
 
+sysnet_read_config(httpd_sys_script_t)
+
 ifdef(`distro_redhat',`
 	allow httpd_sys_script_t httpd_log_t:file { getattr append };
 ')
 
-tunable_policy(`httpd_enable_homedirs',`
-	userdom_read_unpriv_users_home_content_files(httpd_sys_script_t)
+tunable_policy(`httpd_use_nfs',`
+	fs_read_nfs_files(httpd_sys_script_t)
+	fs_read_nfs_symlinks(httpd_sys_script_t)
 ')
 
 tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
@@ -704,6 +842,28 @@
 	fs_read_nfs_symlinks(httpd_sys_script_t)
 ')
 
+tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
+	allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms;
+	allow httpd_sys_script_t self:udp_socket create_socket_perms;
+
+	corenet_all_recvfrom_unlabeled(httpd_sys_script_t)
+	corenet_all_recvfrom_netlabel(httpd_sys_script_t)
+	corenet_tcp_sendrecv_all_if(httpd_sys_script_t)
+	corenet_udp_sendrecv_all_if(httpd_sys_script_t)
+	corenet_tcp_sendrecv_all_nodes(httpd_sys_script_t)
+	corenet_udp_sendrecv_all_nodes(httpd_sys_script_t)
+	corenet_tcp_sendrecv_all_ports(httpd_sys_script_t)
+	corenet_udp_sendrecv_all_ports(httpd_sys_script_t)
+	corenet_tcp_connect_all_ports(httpd_sys_script_t)
+	corenet_sendrecv_all_client_packets(httpd_sys_script_t)
+')
+
+
+tunable_policy(`httpd_use_cifs',`
+	fs_read_cifs_files(httpd_sys_script_t)
+	fs_read_cifs_symlinks(httpd_sys_script_t)
+')
+
 tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
 	fs_read_cifs_files(httpd_sys_script_t)
 	fs_read_cifs_symlinks(httpd_sys_script_t)
@@ -716,10 +876,10 @@
 optional_policy(`
 	mysql_stream_connect(httpd_sys_script_t)
 	mysql_rw_db_sockets(httpd_sys_script_t)
-')
-
-optional_policy(`
-	postgresql_stream_connect(httpd_sys_script_t)
+	mysql_read_config(httpd_sys_script_t)
+	mysql_stream_connect(httpd_suexec_t)
+	mysql_rw_db_sockets(httpd_suexec_t)
+	mysql_read_config(httpd_suexec_t)
 ')
 
 ########################################
@@ -727,6 +887,8 @@
 # httpd_rotatelogs local policy
 #
 
+allow httpd_rotatelogs_t self:capability dac_override;
+
 manage_files_pattern(httpd_rotatelogs_t, httpd_log_t, httpd_log_t)
 
 kernel_read_kernel_sysctls(httpd_rotatelogs_t)
@@ -741,3 +903,48 @@
 logging_search_logs(httpd_rotatelogs_t)
 
 miscfiles_read_localization(httpd_rotatelogs_t)
+
+#============= bugzilla policy ==============
+apache_content_template(bugzilla)
+
+type httpd_bugzilla_tmp_t;
+files_tmp_file(httpd_bugzilla_tmp_t)
+
+allow httpd_bugzilla_script_t self:netlink_route_socket r_netlink_socket_perms;
+allow httpd_bugzilla_script_t self:tcp_socket create_stream_socket_perms;
+allow httpd_bugzilla_script_t self:udp_socket create_socket_perms;
+
+corenet_all_recvfrom_unlabeled(httpd_bugzilla_script_t)
+corenet_all_recvfrom_netlabel(httpd_bugzilla_script_t)
+corenet_tcp_sendrecv_all_if(httpd_bugzilla_script_t)
+corenet_udp_sendrecv_all_if(httpd_bugzilla_script_t)
+corenet_tcp_sendrecv_all_nodes(httpd_bugzilla_script_t)
+corenet_udp_sendrecv_all_nodes(httpd_bugzilla_script_t)
+corenet_tcp_sendrecv_all_ports(httpd_bugzilla_script_t)
+corenet_udp_sendrecv_all_ports(httpd_bugzilla_script_t)
+corenet_tcp_connect_postgresql_port(httpd_bugzilla_script_t)
+corenet_tcp_connect_mysqld_port(httpd_bugzilla_script_t)
+corenet_tcp_connect_http_port(httpd_bugzilla_script_t)
+corenet_tcp_connect_smtp_port(httpd_bugzilla_script_t)
+corenet_sendrecv_postgresql_client_packets(httpd_bugzilla_script_t)
+corenet_sendrecv_mysqld_client_packets(httpd_bugzilla_script_t)
+
+manage_dirs_pattern(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, httpd_bugzilla_tmp_t)
+manage_files_pattern(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, httpd_bugzilla_tmp_t)
+files_tmp_filetrans(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, { file dir })
+
+files_search_var_lib(httpd_bugzilla_script_t)
+
+mta_send_mail(httpd_bugzilla_script_t)
+
+sysnet_read_config(httpd_bugzilla_script_t)
+sysnet_use_ldap(httpd_bugzilla_script_t)
+
+optional_policy(`
+	mysql_search_db(httpd_bugzilla_script_t)
+	mysql_stream_connect(httpd_bugzilla_script_t)
+')
+
+optional_policy(`
+	postgresql_stream_connect(httpd_bugzilla_script_t)
+')
