--- nsaserefpolicy/policy/modules/services/samba.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/samba.fc	2008-08-14 13:53:54.000000000 -0400
@@ -15,6 +15,7 @@
 /usr/bin/ntlm_auth		--	gen_context(system_u:object_r:winbind_helper_exec_t,s0)
 /usr/bin/smbmount		--	gen_context(system_u:object_r:smbmount_exec_t,s0)
 /usr/bin/smbmnt			--	gen_context(system_u:object_r:smbmount_exec_t,s0)
+/usr/bin/smbcontrol		--	gen_context(system_u:object_r:smbcontrol_exec_t,s0)
 /usr/sbin/swat			--	gen_context(system_u:object_r:swat_exec_t,s0)
 
 /usr/sbin/nmbd			--	gen_context(system_u:object_r:nmbd_exec_t,s0)
@@ -47,3 +48,11 @@
 /var/run/winbindd(/.*)?			gen_context(system_u:object_r:winbind_var_run_t,s0)
 
 /var/spool/samba(/.*)?			gen_context(system_u:object_r:samba_var_t,s0)
+
+/etc/rc.d/init.d/winbind	--	gen_context(system_u:object_r:samba_script_exec_t,s0)
+/etc/rc.d/init.d/nmb		--	gen_context(system_u:object_r:samba_script_exec_t,s0)
+/etc/rc.d/init.d/smb		--	gen_context(system_u:object_r:samba_script_exec_t,s0)
+
+ifndef(`enable_mls',`
+/var/lib/samba/scripts(/.*)?		gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0)
+')
--- nsaserefpolicy/policy/modules/services/samba.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/samba.if	2008-08-14 13:53:54.000000000 -0400
@@ -33,12 +33,12 @@
 	')
 
 	tunable_policy(`samba_enable_home_dirs',`
-		userdom_manage_user_home_content_dirs($1, smbd_t)
-		userdom_manage_user_home_content_files($1, smbd_t)
-		userdom_manage_user_home_content_symlinks($1, smbd_t)
-		userdom_manage_user_home_content_sockets($1, smbd_t)
-		userdom_manage_user_home_content_pipes($1, smbd_t)
-		userdom_user_home_dir_filetrans_user_home_content($1, smbd_t, { dir file lnk_file sock_file fifo_file })
+		unprivuser_manage_home_content_dirs(smbd_t)
+		unprivuser_manage_home_content_files(smbd_t)
+		unprivuser_manage_home_content_symlinks(smbd_t)
+		unprivuser_manage_home_content_sockets(smbd_t)
+		unprivuser_manage_home_content_pipes(smbd_t)
+		unprivuser_home_dir_filetrans_home_content(smbd_t, { dir file lnk_file sock_file fifo_file })
 	')
 ')
 
@@ -52,6 +52,25 @@
 ##	</summary>
 ## </param>
 #
+interface(`samba_domtrans_smb',`
+	gen_require(`
+		type smbd_t, smbd_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, smbd_exec_t, smbd_t)
+')
+
+########################################
+## <summary>
+##	Execute samba net in the samba_net domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
 interface(`samba_domtrans_net',`
 	gen_require(`
 		type samba_net_t, samba_net_exec_t;
@@ -63,6 +82,25 @@
 
 ########################################
 ## <summary>
+##	Execute samba net in the samba_unconfined_net domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`samba_domtrans_unconfined_net',`
+	gen_require(`
+		type samba_unconfined_net_t, samba_net_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, samba_net_exec_t, samba_unconfined_net_t)
+')
+
+########################################
+## <summary>
 ##	Execute samba net in the samba_net domain, and
 ##	allow the specified role the samba_net domain.
 ## </summary>
@@ -95,6 +133,38 @@
 
 ########################################
 ## <summary>
+##	Execute samba net in the samba_unconfined_net domain, and
+##	allow the specified role the samba_unconfined_net domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed the samba_unconfined_net domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the terminal allow the samba_unconfined_net domain to use.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`samba_run_unconfined_net',`
+	gen_require(`
+		type samba_unconfined_net_t;
+	')
+
+	samba_domtrans_unconfined_net($1)
+	role $2 types samba_unconfined_net_t;
+	allow samba_unconfined_net_t $3:chr_file rw_term_perms;
+')
+
+########################################
+## <summary>
 ##	Execute smbmount in the smbmount domain.
 ## </summary>
 ## <param name="domain">
@@ -331,6 +401,25 @@
 
 ########################################
 ## <summary>
+##	dontaudit the specified domain to
+##	write samba /var files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`samba_dontaudit_write_var_files',`
+	gen_require(`
+		type samba_var_t;
+	')
+
+	dontaudit $1 samba_var_t:file write;
+')
+
+########################################
+## <summary>
 ##	Allow the specified domain to
 ##	read and write samba /var files.
 ## </summary>
@@ -348,6 +437,7 @@
 	files_search_var($1)
 	files_search_var_lib($1)
 	manage_files_pattern($1, samba_var_t, samba_var_t)
+	manage_lnk_files_pattern($1, samba_var_t, samba_var_t)
 ')
 
 ########################################
@@ -420,6 +510,7 @@
 	')
 
 	domtrans_pattern($1, winbind_helper_exec_t, winbind_helper_t)
+	allow $1 winbind_helper_t:process signal;
 ')
 
 ########################################
@@ -503,3 +594,214 @@
 		stream_connect_pattern($1, winbind_tmp_t, winbind_tmp_t, winbind_t)
 	')
 ')
+
+########################################
+## <summary>
+##	Create a set of derived types for apache
+##	web content.
+## </summary>
+## <param name="prefix">
+##	<summary>
+##	The prefix to be used for deriving type names.
+##	</summary>
+## </param>
+#
+template(`samba_helper_template',`
+	gen_require(`
+		type smbd_t;
+	')
+	#This type is for samba helper scripts
+	type samba_$1_script_t;
+	domain_type(samba_$1_script_t)
+	role system_r types samba_$1_script_t;
+
+	# This type is used for executable scripts files
+	type samba_$1_script_exec_t;
+	corecmd_shell_entry_type(samba_$1_script_t)
+	domain_entry_file(samba_$1_script_t, samba_$1_script_exec_t)
+
+	domtrans_pattern(smbd_t, samba_$1_script_exec_t, samba_$1_script_t)
+	allow smbd_t samba_$1_script_exec_t:file ioctl;
+
+')
+
+########################################
+## <summary>
+##	Allow the specified domain to read samba's shares
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`samba_read_share_files',`
+	gen_require(`
+		type samba_share_t;
+	')
+
+	allow $1 samba_share_t:filesystem getattr;
+	read_files_pattern($1, samba_share_t, samba_share_t)
+')
+
+########################################
+## <summary>
+##	Execute a domain transition to run smbcontrol.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`samba_domtrans_smbcontrol',`
+	gen_require(`
+		type smbcontrol_t;
+                type smbcontrol_exec_t;
+	')
+
+	domtrans_pattern($1, smbcontrol_exec_t, smbcontrol_t)
+')
+
+
+########################################
+## <summary>
+##	Execute smbcontrol in the smbcontrol domain, and
+##	allow the specified role the smbcontrol domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed the smbcontrol domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the role's terminal.
+##	</summary>
+## </param>
+#
+interface(`samba_run_smbcontrol',`
+	gen_require(`
+		type smbcontrol_t;
+	')
+
+	samba_domtrans_smbcontrol($1)
+	role $2 types smbcontrol_t;
+	dontaudit smbcontrol_t $3:chr_file rw_term_perms;
+')
+
+########################################
+## <summary>
+##	Execute samba server in the samba domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`samba_script_domtrans',`
+	gen_require(`
+		type samba_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, samba_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an samba environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the samba domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`samba_admin',`
+	gen_require(`
+		type nmbd_t, nmbd_var_run_t;
+		type smbd_t, smbd_tmp_t;
+		type smbd_script_exec_t;
+		type smbd_spool_t, smbd_var_run_t;
+
+		type samba_log_t, samba_var_t;
+		type samba_etc_t, samba_share_t;
+		type samba_secrets_t;
+
+		type swat_var_run_t, swat_tmp_t;
+
+		type winbind_var_run_t, winbind_tmp_t;
+		type winbind_log_t;
+
+		type samba_unconfined_script_t, samba_unconfined_script_exec_t;
+	')
+
+	allow $1 smbd_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, smbd_t, smbd_t)
+	        
+	allow $1 nmbd_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, nmbd_t, nmbd_t)
+	        
+	allow $1 samba_unconfined_script_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, samba_unconfined_script_t, samba_unconfined_script_t)
+	        
+	samba_run_smbcontrol($1, $2, $3)
+	samba_run_winbind_helper($1, $2, $3)
+	samba_run_smbmount($1, $2, $3)
+	samba_run_net($1, $2, $3)
+
+	# Allow smbd_t to restart the apache service
+	samba_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 smbd_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_tmp($1)
+        admin_pattern($1, smbd_tmp_t)
+        admin_pattern($1, swat_tmp_t)
+        admin_pattern($1, winbind_tmp_t)
+
+        admin_pattern($1, samba_secrets_t)
+
+	files_list_etc($1)
+        admin_pattern($1, samba_etc_t)
+
+        admin_pattern($1, samba_share_t)
+
+	logging_list_logs($1)
+        admin_pattern($1, samba_log_t)
+        admin_pattern($1, winbind_log_t)
+
+	files_list_spool($1)
+	admin_pattern($1, smbd_spool_t)
+
+	files_list_var($1)
+        admin_pattern($1, samba_var_t)
+
+	files_list_pids($1)
+        admin_pattern($1, smbd_var_run_t)
+        admin_pattern($1, nmbd_var_run_t)
+        admin_pattern($1, swat_var_run_t)
+        admin_pattern($1, winbind_var_run_t)
+        admin_pattern($1, samba_unconfined_script_exec_t)
+')
+
--- nsaserefpolicy/policy/modules/services/samba.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/samba.te	2008-08-14 13:53:54.000000000 -0400
@@ -66,6 +66,13 @@
 ## </desc>
 gen_tunable(samba_share_nfs, false)
 
+## <desc>
+## <p>
+## Allow samba to export ntfs/fusefs volumes.
+## </p>
+## </desc>
+gen_tunable(samba_share_fusefs, false)
+
 type nmbd_t;
 type nmbd_exec_t;
 init_daemon_domain(nmbd_t, nmbd_exec_t)
@@ -80,11 +87,9 @@
 logging_log_file(samba_log_t)
 
 type samba_net_t;
-domain_type(samba_net_t)
-role system_r types samba_net_t;
-
 type samba_net_exec_t;
-domain_entry_file(samba_net_t, samba_net_exec_t)
+role system_r types samba_net_t;
+application_domain(samba_net_t, samba_net_exec_t)
 
 type samba_net_tmp_t;
 files_tmp_file(samba_net_tmp_t)
@@ -146,6 +151,14 @@
 type winbind_var_run_t;
 files_pid_file(winbind_var_run_t)
 
+type smbcontrol_t;
+type smbcontrol_exec_t;
+application_domain(smbcontrol_t, smbcontrol_exec_t)
+role system_r types smbcontrol_t;
+
+type samba_script_exec_t;
+init_script_type(samba_script_exec_t)
+
 ########################################
 #
 # Samba net local policy
@@ -200,7 +213,10 @@
 
 miscfiles_read_localization(samba_net_t) 
 
+samba_read_var_files(samba_net_t) 
+
 sysadm_dontaudit_search_home_dirs(samba_net_t)
+userdom_list_all_users_home_dirs(samba_net_t)
 
 optional_policy(`
 	kerberos_use(samba_net_t)
@@ -210,7 +226,7 @@
 #
 # smbd Local policy
 #
-allow smbd_t self:capability { fowner setgid setuid sys_resource lease dac_override dac_read_search };
+allow smbd_t self:capability { chown fowner setgid setuid sys_resource lease dac_override dac_read_search };
 dontaudit smbd_t self:capability sys_tty_config;
 allow smbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 allow smbd_t self:process setrlimit;
@@ -220,7 +236,7 @@
 allow smbd_t self:msgq create_msgq_perms;
 allow smbd_t self:sem create_sem_perms;
 allow smbd_t self:shm create_shm_perms;
-allow smbd_t self:sock_file read_file_perms;
+allow smbd_t self:sock_file read_sock_file_perms;
 allow smbd_t self:tcp_socket create_stream_socket_perms;
 allow smbd_t self:udp_socket create_socket_perms;
 allow smbd_t self:unix_dgram_socket { create_socket_perms sendto };
@@ -228,10 +244,8 @@
 
 allow smbd_t samba_etc_t:file { rw_file_perms setattr };
 
-create_dirs_pattern(smbd_t, samba_log_t, samba_log_t)
+manage_dirs_pattern(smbd_t, samba_log_t, samba_log_t)
 manage_files_pattern(smbd_t, samba_log_t, samba_log_t)
-allow smbd_t samba_log_t:dir setattr;
-dontaudit smbd_t samba_log_t:dir remove_name;
 
 allow smbd_t samba_net_tmp_t:file getattr;
 
@@ -241,6 +255,7 @@
 manage_dirs_pattern(smbd_t, samba_share_t, samba_share_t)
 manage_files_pattern(smbd_t, samba_share_t, samba_share_t)
 manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t)
+allow smbd_t samba_share_t:filesystem getattr;
 
 manage_dirs_pattern(smbd_t, samba_var_t, samba_var_t)
 manage_files_pattern(smbd_t, samba_var_t, samba_var_t)
@@ -258,7 +273,7 @@
 manage_sock_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t)
 files_pid_filetrans(smbd_t, smbd_var_run_t, file)
 
-allow smbd_t winbind_var_run_t:sock_file { read write getattr };
+allow smbd_t winbind_var_run_t:sock_file rw_sock_file_perms;
 
 kernel_getattr_core_if(smbd_t)
 kernel_getattr_message_if(smbd_t)
@@ -328,6 +343,8 @@
 
 sysadm_dontaudit_search_home_dirs(smbd_t)
 
+term_use_ptmx(smbd_t)
+
 ifdef(`hide_broken_symptoms', `
 	files_dontaudit_getattr_default_dirs(smbd_t)
 	files_dontaudit_getattr_boot_dirs(smbd_t)
@@ -348,6 +365,25 @@
 tunable_policy(`samba_share_nfs',`
 	fs_manage_nfs_dirs(smbd_t)
 	fs_manage_nfs_files(smbd_t)
+	fs_manage_nfs_symlinks(smbd_t)
+	fs_manage_nfs_named_pipes(smbd_t)
+	fs_manage_nfs_named_sockets(smbd_t)
+')
+
+# Support Samba sharing of ntfs/fusefs mount points
+tunable_policy(`samba_share_fusefs',`
+	fs_manage_fusefs_dirs(smbd_t)
+	fs_manage_fusefs_files(smbd_t)
+',`
+	fs_search_fusefs_dirs(smbd_t)
+')
+
+optional_policy(`
+	kerberos_keytab_template(smbd, smbd_t)
+')
+
+optional_policy(`
+	lpd_exec_lpr(smbd_t)
 ')
 
 optional_policy(`
@@ -405,7 +441,7 @@
 allow nmbd_t self:msgq create_msgq_perms;
 allow nmbd_t self:sem create_sem_perms;
 allow nmbd_t self:shm create_shm_perms;
-allow nmbd_t self:sock_file read_file_perms;
+allow nmbd_t self:sock_file read_sock_file_perms;
 allow nmbd_t self:tcp_socket create_stream_socket_perms;
 allow nmbd_t self:udp_socket create_socket_perms;
 allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto };
@@ -452,6 +488,7 @@
 dev_getattr_mtrr_dev(nmbd_t)
 
 fs_getattr_all_fs(nmbd_t)
+fs_list_inotifyfs(nmbd_t)
 fs_search_auto_mountpoints(nmbd_t)
 
 domain_use_interactive_fds(nmbd_t)
@@ -536,6 +573,7 @@
 storage_raw_write_fixed_disk(smbmount_t)
 
 term_list_ptys(smbmount_t)
+term_use_controlling_term(smbmount_t)
 
 corecmd_list_bin(smbmount_t)
 
@@ -560,28 +598,37 @@
 
 userdom_use_all_users_fds(smbmount_t)
 
+optional_policy(`
+	cups_read_rw_config(smbmount_t)
+')
+
 ########################################
 #
 # SWAT Local policy
 #
 
-allow swat_t self:capability { setuid setgid };
-allow swat_t self:process signal_perms;
+allow swat_t self:capability { setuid setgid sys_resource };
+allow swat_t self:process { setrlimit signal_perms };
 allow swat_t self:fifo_file rw_file_perms;
 allow swat_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
 allow swat_t self:tcp_socket create_stream_socket_perms;
 allow swat_t self:udp_socket create_socket_perms;
 
-allow swat_t nmbd_exec_t:file { execute read };
+allow swat_t self:unix_stream_socket connectto;
+can_exec(swat_t, smbd_exec_t)
+allow swat_t smbd_port_t:tcp_socket name_bind;
+allow swat_t smbd_t:process { signal signull };
+allow swat_t smbd_var_run_t:file { lock unlink };
+
+can_exec(swat_t, nmbd_exec_t)
+allow swat_t nmbd_port_t:udp_socket name_bind;
+allow swat_t nmbd_t:process { signal signull };
+allow swat_t nmbd_var_run_t:file { lock read unlink };
 
 rw_files_pattern(swat_t, samba_etc_t, samba_etc_t)
 
 append_files_pattern(swat_t, samba_log_t, samba_log_t)
 
-allow swat_t smbd_exec_t:file execute ;
-
-allow swat_t smbd_t:process signull;
-
 allow swat_t smbd_var_run_t:file read;
 
 manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t)
@@ -591,7 +638,9 @@
 manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t)
 files_pid_filetrans(swat_t, swat_var_run_t, file)
 
-allow swat_t winbind_exec_t:file execute;
+can_exec(swat_t, winbind_exec_t)
+allow swat_t winbind_var_run_t:dir { write add_name remove_name };
+allow swat_t winbind_var_run_t:sock_file { create unlink };
 
 kernel_read_kernel_sysctls(swat_t)
 kernel_read_system_state(swat_t)
@@ -616,10 +665,12 @@
 
 dev_read_urand(swat_t)
 
+files_list_var_lib(swat_t)
 files_read_etc_files(swat_t)
 files_search_home(swat_t)
 files_read_usr_files(swat_t)
 fs_getattr_xattr_fs(swat_t)
+fs_list_inotifyfs(swat_t)
 
 auth_domtrans_chk_passwd(swat_t)
 auth_use_nsswitch(swat_t)
@@ -628,6 +679,7 @@
 libs_use_shared_libs(swat_t)
 
 logging_send_syslog_msg(swat_t)
+logging_send_audit_msgs(swat_t)
 logging_search_logs(swat_t)
 
 miscfiles_read_localization(swat_t)
@@ -645,6 +697,17 @@
 	kerberos_use(swat_t)
 ')
 
+init_read_utmp(swat_t)
+init_dontaudit_write_utmp(swat_t)
+
+manage_dirs_pattern(swat_t, samba_log_t, samba_log_t)
+create_files_pattern(swat_t, samba_log_t, samba_log_t)
+
+manage_files_pattern(swat_t, samba_etc_t, samba_secrets_t)
+
+manage_files_pattern(swat_t, samba_var_t, samba_var_t)
+files_list_var_lib(swat_t)
+
 ########################################
 #
 # Winbind local policy
@@ -687,13 +750,15 @@
 
 manage_dirs_pattern(winbind_t, winbind_tmp_t, winbind_tmp_t)
 manage_files_pattern(winbind_t, winbind_tmp_t, winbind_tmp_t)
-manage_sock_files_pattern(winbind_t, winbind_tmp_t, winbind_tmp_t)
+manage_sock_files_pattern(winbind_t, winbind_var_run_t, winbind_var_run_t)
 files_tmp_filetrans(winbind_t, winbind_tmp_t, { file dir })
 
 manage_files_pattern(winbind_t, winbind_var_run_t, winbind_var_run_t)
 manage_sock_files_pattern(winbind_t, winbind_var_run_t, winbind_var_run_t)
 files_pid_filetrans(winbind_t, winbind_var_run_t, file)
 
+corecmd_exec_bin(winbind_t)
+
 kernel_read_kernel_sysctls(winbind_t)
 kernel_list_proc(winbind_t)
 kernel_read_proc_symlinks(winbind_t)
@@ -780,8 +845,13 @@
 miscfiles_read_localization(winbind_helper_t) 
 
 optional_policy(`
+	apache_append_log(winbind_helper_t)
+')
+
+optional_policy(`
 	squid_read_log(winbind_helper_t)
 	squid_append_log(winbind_helper_t)
+	squid_rw_stream_sockets(winbind_helper_t)
 ')
 
 ########################################
@@ -790,6 +860,16 @@
 #
 
 optional_policy(`
+	type samba_unconfined_net_t;
+	domain_type(samba_unconfined_net_t)
+	role system_r types samba_unconfined_net_t;
+
+	unconfined_domain(samba_unconfined_net_t)
+
+	manage_files_pattern(samba_unconfined_net_t, samba_etc_t, samba_secrets_t)
+	filetrans_pattern(samba_unconfined_net_t, samba_etc_t, samba_secrets_t, file)
+')
+
 	type samba_unconfined_script_t;
 	type samba_unconfined_script_exec_t;
 	domain_type(samba_unconfined_script_t)
@@ -800,9 +880,46 @@
 	allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms;
 	allow smbd_t samba_unconfined_script_exec_t:file ioctl;
 
+optional_policy(`
 	unconfined_domain(samba_unconfined_script_t)
+')
 
 	tunable_policy(`samba_run_unconfined',`
 		domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t)
+', `
+	can_exec(smbd_t, samba_unconfined_script_exec_t)
 	')
-')
+
+########################################
+#
+# smbcontrol local policy
+#
+
+# internal communication is often done using fifo and unix sockets.
+allow smbcontrol_t self:fifo_file rw_file_perms;
+allow smbcontrol_t self:unix_stream_socket create_stream_socket_perms;
+
+files_read_etc_files(smbcontrol_t)
+
+libs_use_ld_so(smbcontrol_t)
+libs_use_shared_libs(smbcontrol_t)
+
+miscfiles_read_localization(smbcontrol_t)
+
+files_search_var_lib(smbcontrol_t)
+samba_read_config(smbcontrol_t)
+samba_rw_var_files(smbcontrol_t)
+samba_search_var(smbcontrol_t)
+samba_read_winbind_pid(smbcontrol_t)
+
+allow smbcontrol_t smbd_t:process signal;
+domain_use_interactive_fds(smbcontrol_t)
+allow smbd_t smbcontrol_t:process { signal signull };
+
+allow nmbd_t smbcontrol_t:process signal;
+allow smbcontrol_t nmbd_t:process { signal signull };
+
+allow smbcontrol_t winbind_t:process { signal signull };
+allow winbind_t smbcontrol_t:process signal;
+
+allow smbcontrol_t nmbd_var_run_t:file { read lock };
