--- nsaserefpolicy/policy/modules/services/bind.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/bind.fc	2008-08-14 13:53:54.000000000 -0400
@@ -49,3 +49,5 @@
 /var/named/chroot/var/log/named.*	--	gen_context(system_u:object_r:named_log_t,s0)
 /var/named/dynamic(/.*)?		gen_context(system_u:object_r:named_cache_t,s0)
 ')
+
+/etc/rc.d/init.d/named	--	gen_context(system_u:object_r:named_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/bind.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/bind.if	2008-08-14 13:53:54.000000000 -0400
@@ -254,3 +254,94 @@
 interface(`bind_udp_chat_named',`
 	refpolicywarn(`$0($*) has been deprecated.')
 ')
+
+########################################
+## <summary>
+##	Execute bind server in the bind domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`bind_script_domtrans',`
+	gen_require(`
+		type bind_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, bind_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an bind environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the bind domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`bind_admin',`
+	gen_require(`
+		type named_t;
+		type named_script_exec_t;
+		type named_tmp_t;
+		type named_log_t;
+		type named_conf_t;
+		type named_var_lib_t;
+		type named_var_run_t;
+
+		type named_cache_t;
+		type named_zone_t;
+		type dnssec_t;
+		type ndc_t;
+	')
+
+	allow $1 named_t:process { ptrace signal_perms };
+	ps_process_pattern($1, named_t)
+	        
+	allow $1 ndc_t:process { ptrace signal_perms };
+	ps_process_pattern($1, ndc_t)
+	        
+	bind_run_ndc($1, $2, $3)
+
+	# Allow named_t to restart the apache service
+	bind_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 named_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_tmp($1)
+        admin_pattern($1, named_tmp_t)
+
+	logging_list_logs($1)
+        admin_pattern($1, named_log_t)
+
+	files_list_etc($1)
+	admin_pattern($1, named_conf_t)
+
+	admin_pattern($1, named_cache_t)
+	admin_pattern($1, named_zone_t)
+	admin_pattern($1, dnssec_t)
+
+	files_list_var_lib($1)
+        admin_pattern($1, named_var_lib_t)
+
+	files_list_pids($1)
+        admin_pattern($1, named_var_run_t)
+')
--- nsaserefpolicy/policy/modules/services/bind.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/bind.te	2008-08-14 13:53:54.000000000 -0400
@@ -53,6 +53,9 @@
 init_system_domain(ndc_t, ndc_exec_t)
 role system_r types ndc_t;
 
+type named_script_exec_t;
+init_script_type(named_script_exec_t)
+
 ########################################
 #
 # Named local policy
@@ -60,7 +63,7 @@
 
 allow named_t self:capability { chown dac_override fowner setgid setuid sys_chroot sys_nice sys_resource };
 dontaudit named_t self:capability sys_tty_config;
-allow named_t self:process { setsched setcap setrlimit signal_perms };
+allow named_t self:process { setsched getcap setcap setrlimit signal_perms };
 allow named_t self:fifo_file rw_fifo_file_perms;
 allow named_t self:unix_stream_socket create_stream_socket_perms;
 allow named_t self:unix_dgram_socket create_socket_perms;
@@ -113,14 +116,13 @@
 corenet_tcp_bind_all_nodes(named_t)
 corenet_udp_bind_all_nodes(named_t)
 corenet_tcp_bind_dns_port(named_t)
-corenet_udp_bind_dns_port(named_t)
+corenet_udp_bind_all_ports(named_t)
 corenet_tcp_bind_rndc_port(named_t)
 corenet_tcp_connect_all_ports(named_t)
 corenet_sendrecv_dns_server_packets(named_t)
 corenet_sendrecv_dns_client_packets(named_t)
 corenet_sendrecv_rndc_server_packets(named_t)
 corenet_sendrecv_rndc_client_packets(named_t)
-corenet_udp_bind_all_unreserved_ports(named_t)
 
 dev_read_sysfs(named_t)
 dev_read_rand(named_t)
@@ -223,6 +225,7 @@
 corenet_tcp_sendrecv_all_nodes(ndc_t)
 corenet_tcp_sendrecv_all_ports(ndc_t)
 corenet_tcp_connect_rndc_port(ndc_t)
+corenet_tcp_bind_all_nodes(ndc_t)
 corenet_sendrecv_rndc_client_packets(ndc_t)
 
 domain_use_interactive_fds(ndc_t)