--- nsaserefpolicy/policy/modules/services/openvpn.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/openvpn.fc	2008-08-14 13:53:54.000000000 -0400
@@ -11,5 +11,7 @@
 #
 # /var
 #
-/var/log/openvpn(/.*)?		gen_context(system_u:object_r:openvpn_var_log_t,s0)
+/var/log/openvpn.*		gen_context(system_u:object_r:openvpn_var_log_t,s0)
 /var/run/openvpn(/.*)?		gen_context(system_u:object_r:openvpn_var_run_t,s0)
+
+/etc/rc.d/init.d/openvpn	--	gen_context(system_u:object_r:openvpn_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/openvpn.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/openvpn.if	2008-08-14 13:53:54.000000000 -0400
@@ -90,3 +90,74 @@
 	read_files_pattern($1, openvpn_etc_t, openvpn_etc_t)
 	read_lnk_files_pattern($1, openvpn_etc_t, openvpn_etc_t)
 ')
+
+########################################
+## <summary>
+##	Execute openvpn server in the openvpn domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`openvpn_script_domtrans',`
+	gen_require(`
+		type openvpn_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, openvpn_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an openvpn environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the openvpn domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`openvpn_admin',`
+	gen_require(`
+		type openvpn_t;
+		type openvpn_script_exec_t;
+		type openvpn_etc_t;
+		type openvpn_var_log_t;
+		type openvpn_var_run_t;
+	')
+
+	allow $1 openvpn_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, openvpn_t, openvpn_t)
+	        
+	# Allow openvpn_t to restart the apache service
+	openvpn_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 openvpn_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_etc($1)
+        admin_pattern($1, openvpn_etc_t)
+
+	logging_list_logs($1)
+        admin_pattern($1, openvpn_var_log_t)
+
+	files_list_pids($1)
+        admin_pattern($1, openvpn_var_run_t)
+')
+
+
--- nsaserefpolicy/policy/modules/services/openvpn.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/openvpn.te	2008-08-14 13:53:54.000000000 -0400
@@ -8,7 +8,7 @@
 
 ## <desc>
 ## <p>
-## Allow openvpn to read home directories
+## Allow openvpn service access to users home directories
 ## </p>
 ## </desc>
 gen_tunable(openvpn_enable_homedirs, false)
@@ -20,7 +20,7 @@
 
 # configuration files
 type openvpn_etc_t;
-files_type(openvpn_etc_t)
+files_config_file(openvpn_etc_t)
 
 # log files
 type openvpn_var_log_t;
@@ -30,12 +30,15 @@
 type openvpn_var_run_t;
 files_pid_file(openvpn_var_run_t)
 
+type openvpn_script_exec_t;
+init_script_type(openvpn_script_exec_t)
+
 ########################################
 #
 # openvpn local policy
 #
 
-allow openvpn_t self:capability { dac_read_search dac_override net_bind_service net_admin setgid setuid sys_tty_config };
+allow openvpn_t self:capability { dac_read_search dac_override net_bind_service net_admin setgid setuid sys_chroot sys_tty_config };
 allow openvpn_t self:process { signal getsched };
 
 allow openvpn_t self:unix_dgram_socket { create_socket_perms sendto };
@@ -47,6 +50,7 @@
 allow openvpn_t openvpn_etc_t:dir list_dir_perms;
 read_files_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_t)
 read_lnk_files_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_t)
+can_exec(openvpn_t, openvpn_etc_t)
 
 allow openvpn_t openvpn_var_log_t:file manage_file_perms;
 logging_log_filetrans(openvpn_t, openvpn_var_log_t, file)
@@ -77,6 +81,7 @@
 corenet_sendrecv_openvpn_server_packets(openvpn_t)
 corenet_rw_tun_tap_dev(openvpn_t)
 corenet_tcp_connect_openvpn_port(openvpn_t)
+corenet_tcp_connect_http_port(openvpn_t)
 
 dev_search_sysfs(openvpn_t)
 dev_read_rand(openvpn_t)
@@ -110,3 +115,12 @@
 
 	networkmanager_dbus_chat(openvpn_t)
 ')
+
+
+# Need to interact with terminals if config option "auth-user-pass" is used
+sysadm_use_terms(openvpn_t)
+
+optional_policy(`
+	unconfined_use_terminals(openvpn_t)
+')
+