--- nsaserefpolicy/policy/modules/services/ftp.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/ftp.fc	2008-08-14 13:53:54.000000000 -0400
@@ -27,3 +27,6 @@
 /var/log/vsftpd.*	--	gen_context(system_u:object_r:xferlog_t,s0)
 /var/log/xferlog.*	--	gen_context(system_u:object_r:xferlog_t,s0)
 /var/log/xferreport.*	--	gen_context(system_u:object_r:xferlog_t,s0)
+
+/etc/rc.d/init.d/vsftpd	--	gen_context(system_u:object_r:ftp_script_exec_t,s0)
+/etc/rc.d/init.d/proftpd	--	gen_context(system_u:object_r:ftp_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/ftp.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/ftp.if	2008-08-14 13:53:54.000000000 -0400
@@ -28,11 +28,13 @@
 		type ftpd_t;
 	')
 
-	userdom_manage_user_home_content_files($1, ftpd_t)
-	userdom_manage_user_home_content_symlinks($1, ftpd_t)
-	userdom_manage_user_home_content_sockets($1, ftpd_t)
-	userdom_manage_user_home_content_pipes($1, ftpd_t)
-	userdom_user_home_dir_filetrans_user_home_content($1, ftpd_t, { dir file lnk_file sock_file fifo_file })
+	tunable_policy(`ftp_home_dir',`
+		unprivuser_manage_home_content_files(ftpd_t)
+		unprivuser_manage_home_content_symlinks(ftpd_t)
+		unprivuser_manage_home_content_sockets(ftpd_t)
+		unprivuser_manage_home_content_pipes(ftpd_t)
+		unprivuser_home_dir_filetrans_home_content(ftpd_t, { dir file lnk_file sock_file fifo_file })
+	')
 ')
 
 ########################################
@@ -155,3 +157,94 @@
 	role $2 types ftpdctl_t;
 	allow ftpdctl_t $3:chr_file rw_term_perms;
 ')
+
+########################################
+## <summary>
+##	Execute ftp server in the ftp domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`ftp_script_domtrans',`
+	gen_require(`
+		type ftp_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, ftp_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an ftp environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the ftp domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`ftp_admin',`
+	gen_require(`
+		type ftp_t;
+		type ftpdctl_t;
+		type ftp_script_exec_t;
+		type ftp_tmp_t;
+		type ftp_log_t;
+		type ftp_etc_t;
+		type ftp_lock_t;
+		type ftp_var_lib_t;
+		type ftp_var_run_t;
+		type xferlog_t;
+	')
+
+	ps_process_pattern($1, ftp_t)
+	allow $1 ftp_t:process { ptrace signal_perms };
+
+	# Allow ftp_t to restart the apache service
+	ftp_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 ftp_script_exec_t system_r;
+	allow $2 system_r;
+
+	ps_process_pattern($1, ftpdctl_t)
+	        
+	ftp_run_ftpdctl($1, $2, $3)
+
+	miscfiles_manage_public_files($1)
+
+	files_list_tmp($1)
+        admin_pattern($1, ftp_tmp_t)
+
+	logging_list_logs($1)
+        admin_pattern($1, ftp_log_t)
+
+        admin_pattern($1, xferlog_t)
+
+	files_list_etc($1)
+	admin_pattern($1, ftp_etc_t)
+
+	files_list_var($1)
+	admin_pattern($1, ftp_lock_t)
+
+	files_list_var_lib($1)
+        admin_pattern($1, ftp_var_lib_t)
+
+	files_list_pids($1)
+        admin_pattern($1, ftp_var_run_t)
+')
--- nsaserefpolicy/policy/modules/services/ftp.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/ftp.te	2008-08-14 13:53:54.000000000 -0400
@@ -75,6 +75,9 @@
 type xferlog_t;
 logging_log_file(xferlog_t)
 
+type ftp_script_exec_t;
+init_script_type(ftp_script_exec_t)
+
 ########################################
 #
 # ftpd local policy
@@ -106,9 +109,10 @@
 manage_sock_files_pattern(ftpd_t, ftpd_tmpfs_t, ftpd_tmpfs_t)
 fs_tmpfs_filetrans(ftpd_t, ftpd_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 
+manage_dirs_pattern(ftpd_t, ftpd_var_run_t, ftpd_var_run_t)
 manage_files_pattern(ftpd_t, ftpd_var_run_t, ftpd_var_run_t)
 manage_sock_files_pattern(ftpd_t, ftpd_var_run_t, ftpd_var_run_t)
-files_pid_filetrans(ftpd_t, ftpd_var_run_t, file)
+files_pid_filetrans(ftpd_t, ftpd_var_run_t, { file dir} )
 
 # proftpd requires the client side to bind a socket so that
 # it can stat the socket to perform access control decisions,
@@ -123,6 +127,7 @@
 
 kernel_read_kernel_sysctls(ftpd_t)
 kernel_read_system_state(ftpd_t)
+kernel_search_network_state(ftpd_t)
 
 dev_read_sysfs(ftpd_t)
 dev_read_urand(ftpd_t)
@@ -169,7 +174,9 @@
 libs_use_ld_so(ftpd_t)
 libs_use_shared_libs(ftpd_t)
 
+logging_send_audit_msgs(ftpd_t)
 logging_send_syslog_msg(ftpd_t)
+logging_set_loginuid(ftpd_t)
 
 miscfiles_read_localization(ftpd_t)
 miscfiles_read_public_files(ftpd_t)
@@ -219,6 +226,11 @@
 	userdom_manage_all_users_home_content_dirs(ftpd_t)
 	userdom_manage_all_users_home_content_files(ftpd_t)
 	userdom_manage_all_users_home_content_symlinks(ftpd_t)
+	auth_manage_all_files_except_shadow(ftpd_t)
+
+	auth_read_all_dirs_except_shadow(ftpd_t)
+	auth_read_all_files_except_shadow(ftpd_t)
+	auth_read_all_symlinks_except_shadow(ftpd_t)
 ')
 
 tunable_policy(`ftp_home_dir && use_nfs_home_dirs',`
@@ -254,7 +266,9 @@
 ')
 
 optional_policy(`
-	kerberos_read_keytab(ftpd_t)
+	kerberos_keytab_template(ftpd, ftpd_t)
+	kerberos_manage_host_rcache(ftpd_t)
+	selinux_validate_context(ftpd_t)
 ')
 
 optional_policy(`
@@ -266,6 +280,14 @@
 ')
 
 optional_policy(`
+	dbus_system_bus_client_template(notused, ftpd_t)
+	optional_policy(`
+		oddjob_dbus_chat(ftpd_t)
+		oddjob_domtrans_mkhomedir(ftpd_t)
+	')
+')
+
+optional_policy(`
 	seutil_sigchld_newrole(ftpd_t)
 ')
 
