--- nsaserefpolicy/policy/modules/services/postgrey.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/postgrey.fc	2008-08-14 13:53:54.000000000 -0400
@@ -7,3 +7,7 @@
 
 /var/run/postgrey(/.*)?		gen_context(system_u:object_r:postgrey_var_run_t,s0)
 /var/run/postgrey\.pid	--	gen_context(system_u:object_r:postgrey_var_run_t,s0)
+
+/etc/rc.d/init.d/postgrey	--	gen_context(system_u:object_r:postgrey_script_exec_t,s0)
+
+/var/spool/postfix/postgrey(/.*)?	gen_context(system_u:object_r:postgrey_spool_t,s0)
--- nsaserefpolicy/policy/modules/services/postgrey.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/postgrey.if	2008-08-14 13:53:54.000000000 -0400
@@ -12,10 +12,80 @@
 #
 interface(`postgrey_stream_connect',`
         gen_require(`
-                type postgrey_var_run_t, postgrey_t;
+                type postgrey_var_run_t, postgrey_t, postgrey_spool_t;
         ')
 
 	allow $1 postgrey_t:unix_stream_socket connectto;
         allow $1 postgrey_var_run_t:sock_file write;
+        allow $1 postgrey_spool_t:sock_file write;
 	files_search_pids($1)
 ')
+
+########################################
+## <summary>
+##	Execute postgrey server in the postgrey domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`postgrey_script_domtrans',`
+	gen_require(`
+		type postgrey_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, postgrey_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an postgrey environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the postgrey domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`postgrey_admin',`
+	gen_require(`
+		type postgrey_t, postgrey_etc_t;
+		type postgrey_var_lib_t, postgrey_var_run_t;
+		type postgrey_script_exec_t;
+	')
+
+	allow $1 postgrey_t:process { ptrace signal_perms };
+	ps_process_pattern($1, postgrey_t)
+	        
+	# Allow postgrey_t to restart the apache service
+	postgrey_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 postgrey_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_etc($1)
+        admin_pattern($1, postgrey_etc_t)
+
+	files_list_var_lib($1)
+        admin_pattern($1, postgrey_var_lib_t)
+
+	files_list_pids($1)
+        admin_pattern($1, postgrey_var_run_t)
+')
+
+
--- nsaserefpolicy/policy/modules/services/postgrey.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/postgrey.te	2008-08-14 13:53:54.000000000 -0400
@@ -13,26 +13,38 @@
 type postgrey_etc_t;
 files_config_file(postgrey_etc_t)
 
+type postgrey_spool_t;
+files_type(postgrey_spool_t)
+
 type postgrey_var_lib_t;
 files_type(postgrey_var_lib_t)
 
 type postgrey_var_run_t;
 files_pid_file(postgrey_var_run_t)
 
+type postgrey_script_exec_t;
+init_script_type(postgrey_script_exec_t)
+
 ########################################
 #
 # Local policy
 #
 
-allow postgrey_t self:capability { chown setgid setuid };
+allow postgrey_t self:capability { chown dac_override setgid setuid };
 dontaudit postgrey_t self:capability sys_tty_config;
 allow postgrey_t self:process signal_perms;
 allow postgrey_t self:tcp_socket create_stream_socket_perms;
+allow postgrey_t self:fifo_file create_fifo_file_perms;
 
 allow postgrey_t postgrey_etc_t:dir list_dir_perms;
 read_files_pattern(postgrey_t, postgrey_etc_t, postgrey_etc_t)
 read_lnk_files_pattern(postgrey_t, postgrey_etc_t, postgrey_etc_t)
 
+manage_dirs_pattern(postgrey_t, postgrey_spool_t, postgrey_spool_t)
+manage_files_pattern(postgrey_t, postgrey_spool_t, postgrey_spool_t)
+manage_fifo_files_pattern(postgrey_t, postgrey_spool_t, postgrey_spool_t)
+manage_sock_files_pattern(postgrey_t, postgrey_spool_t, postgrey_spool_t)
+
 manage_files_pattern(postgrey_t, postgrey_var_lib_t, postgrey_var_lib_t)
 files_var_lib_filetrans(postgrey_t, postgrey_var_lib_t, file)
 
@@ -86,6 +98,11 @@
 ')
 
 optional_policy(`
+	postfix_read_config(postgrey_t)
+	postfix_manage_spool_files(postgrey_t)
+')
+
+optional_policy(`
 	seutil_sigchld_newrole(postgrey_t)
 ')
 
