--- nsaserefpolicy/policy/modules/services/munin.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/munin.fc	2008-08-25 10:50:15.000000000 -0400
@@ -6,6 +6,9 @@
 /usr/share/munin/plugins/.*	--	gen_context(system_u:object_r:munin_exec_t,s0)
 
 /var/lib/munin(/.*)?			gen_context(system_u:object_r:munin_var_lib_t,s0)
-/var/log/munin.*		--	gen_context(system_u:object_r:munin_log_t,s0)
+/var/log/munin.*			gen_context(system_u:object_r:munin_log_t,s0)
 /var/run/munin(/.*)?			gen_context(system_u:object_r:munin_var_run_t,s0)
-/var/www/munin(/.*)?			gen_context(system_u:object_r:munin_var_lib_t,s0)
+/var/www/html/munin(/.*)?		gen_context(system_u:object_r:httpd_munin_content_t,s0)
+/var/www/html/munin/cgi(/.*)?		gen_context(system_u:object_r:httpd_munin_script_exec_t,s0)
+
+/etc/rc.d/init.d/munin-node	--	gen_context(system_u:object_r:munin_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/munin.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/munin.if	2008-08-25 10:50:15.000000000 -0400
@@ -80,3 +80,105 @@
 
 	dontaudit $1 munin_var_lib_t:dir search_dir_perms;
 ')
+
+########################################
+## <summary>
+##	Allow the specified domain to append
+##	to munin log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`munin_append_log',`
+	gen_require(`
+		type munin_log_t;
+	')
+
+	logging_search_logs($1)
+	allow $1 munin_log_t:dir list_dir_perms;
+	append_files_pattern($1, munin_log_t, munin_log_t)
+')
+
+########################################
+## <summary>
+##	Execute munin server in the munin domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`munin_script_domtrans',`
+	gen_require(`
+		type munin_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, munin_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an munin environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the munin domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`munin_admin',`
+	gen_require(`
+		type munin_t;
+		type munin_script_exec_t;
+		type munin_etc_t;
+		type munin_tmp_t;
+		type munin_log_t;
+		type munin_var_lib_t;
+		type munin_var_run_t;
+		type httpd_munin_content_t;
+	')
+
+	allow $1 munin_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, munin_t, munin_t)
+	        
+	# Allow munin_t to restart the apache service
+	munin_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 munin_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_tmp($1)
+        admin_pattern($1, munin_tmp_t)
+
+	logging_list_logs($1)
+        admin_pattern($1, munin_log_t)
+
+	files_list_etc($1)
+	admin_pattern($1, munin_etc_t)
+
+	files_list_var_lib($1)
+        admin_pattern($1, munin_var_lib_t)
+
+	files_list_pids($1)
+        admin_pattern($1, munin_var_run_t)
+
+	admin_pattern($1, httpd_munin_content_t)
+')
+
--- nsaserefpolicy/policy/modules/services/munin.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/munin.te	2008-08-25 10:50:15.000000000 -0400
@@ -25,26 +25,33 @@
 type munin_var_run_t alias lrrd_var_run_t;
 files_pid_file(munin_var_run_t)
 
+type munin_script_exec_t;
+init_script_type(munin_script_exec_t)
+
 ########################################
 #
 # Local policy
 #
 
-allow munin_t self:capability { setgid setuid };
+allow munin_t self:capability { chown dac_override setgid setuid sys_rawio };
 dontaudit munin_t self:capability sys_tty_config;
 allow munin_t self:process { getsched setsched signal_perms };
 allow munin_t self:unix_stream_socket { create_stream_socket_perms connectto };
 allow munin_t self:unix_dgram_socket { create_socket_perms sendto };
 allow munin_t self:tcp_socket create_stream_socket_perms;
 allow munin_t self:udp_socket create_socket_perms;
+allow munin_t self:fifo_file manage_fifo_file_perms;
+
+can_exec(munin_t, munin_exec_t)
 
 allow munin_t munin_etc_t:dir list_dir_perms;
 read_files_pattern(munin_t, munin_etc_t, munin_etc_t)
 read_lnk_files_pattern(munin_t, munin_etc_t, munin_etc_t)
 files_search_etc(munin_t)
 
-allow munin_t munin_log_t:file manage_file_perms;
-logging_log_filetrans(munin_t, munin_log_t, file)
+manage_dirs_pattern(munin_t, munin_log_t,  munin_log_t)
+manage_files_pattern(munin_t, munin_log_t,  munin_log_t)
+logging_log_filetrans(munin_t, munin_log_t, { file dir })
 
 manage_dirs_pattern(munin_t, munin_tmp_t, munin_tmp_t)
 manage_files_pattern(munin_t, munin_tmp_t, munin_tmp_t)
@@ -61,9 +68,11 @@
 files_pid_filetrans(munin_t, munin_var_run_t, file)
 
 kernel_read_system_state(munin_t)
-kernel_read_kernel_sysctls(munin_t)
+kernel_read_network_state(munin_t)
+kernel_read_all_sysctls(munin_t)
 
 corecmd_exec_bin(munin_t)
+corecmd_exec_shell(munin_t)
 
 corenet_all_recvfrom_unlabeled(munin_t)
 corenet_all_recvfrom_netlabel(munin_t)
@@ -73,30 +82,39 @@
 corenet_udp_sendrecv_all_nodes(munin_t)
 corenet_tcp_sendrecv_all_ports(munin_t)
 corenet_udp_sendrecv_all_ports(munin_t)
+corenet_tcp_bind_munin_port(munin_t)
+corenet_tcp_connect_munin_port(munin_t)
+corenet_tcp_connect_http_port(munin_t)
+corenet_tcp_bind_all_nodes(munin_t)
 
 dev_read_sysfs(munin_t)
 dev_read_urand(munin_t)
 
 domain_use_interactive_fds(munin_t)
+domain_dontaudit_read_all_domains_state(munin_t)
 
 files_read_etc_files(munin_t)
 files_read_etc_runtime_files(munin_t)
 files_read_usr_files(munin_t)
+files_list_spool(munin_t)
 
 fs_getattr_all_fs(munin_t)
 fs_search_auto_mountpoints(munin_t)
 
+auth_use_nsswitch(munin_t)
+
 libs_use_ld_so(munin_t)
 libs_use_shared_libs(munin_t)
 
 logging_send_syslog_msg(munin_t)
 
+miscfiles_read_fonts(munin_t)
 miscfiles_read_localization(munin_t)
 
-sysnet_read_config(munin_t)
+sysnet_exec_ifconfig(munin_t)
+netutils_domtrans_ping(munin_t)
 
 userdom_dontaudit_use_unpriv_user_fds(munin_t)
-
 sysadm_dontaudit_search_home_dirs(munin_t)
 
 optional_policy(`
@@ -109,7 +127,21 @@
 ')
 
 optional_policy(`
-	nis_use_ypbind(munin_t)
+	fstools_domtrans(munin_t)
+')
+
+optional_policy(`
+	mta_read_config(munin_t)
+	mta_send_mail(munin_t)
+')
+
+optional_policy(`
+	mysql_read_config(munin_t)
+	mysql_stream_connect(munin_t)
+')
+
+optional_policy(`
+	sendmail_read_log(munin_t)
 ')
 
 optional_policy(`
@@ -119,3 +151,9 @@
 optional_policy(`
 	udev_read_db(munin_t)
 ')
+
+#============= http munin policy ==============
+apache_content_template(munin)
+
+manage_dirs_pattern(munin_t, httpd_munin_content_t, httpd_munin_content_t)
+manage_files_pattern(munin_t, httpd_munin_content_t, httpd_munin_content_t)
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in	2008-08-11 11:23:34.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/kernel/corenetwork.te.in	2008-08-25 13:35:01.000000000 -0400
@@ -123,6 +127,7 @@
 network_port(mmcc, tcp,5050,s0, udp,5050,s0)
 network_port(monopd, tcp,1234,s0)
 network_port(msnp, tcp,1863,s0, udp,1863,s0)
+network_port(munin, tcp,4949,s0, udp,4949,s0)
 network_port(mysqld, tcp,1186,s0, tcp,3306,s0)
 portcon tcp 63132-63163 gen_context(system_u:object_r:mysqld_port_t, s0)
 network_port(nessus, tcp,1241,s0)
