--- nsaserefpolicy/policy/modules/services/setroubleshoot.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/setroubleshoot.fc	2008-08-25 10:50:15.000000000 -0400
@@ -5,3 +5,5 @@
 /var/log/setroubleshoot(/.*)?		gen_context(system_u:object_r:setroubleshoot_var_log_t,s0)
 
 /var/lib/setroubleshoot(/.*)?		gen_context(system_u:object_r:setroubleshoot_var_lib_t,s0)
+
+/etc/rc.d/init.d/setroubleshoot	--	gen_context(system_u:object_r:setroubleshoot_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/setroubleshoot.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/setroubleshoot.if	2008-08-25 10:58:02.000000000 -0400
@@ -16,8 +16,8 @@
 	')
 
 	files_search_pids($1)
-	allow $1 setroubleshoot_var_run_t:sock_file write;
-	allow $1 setroubleshootd_t:unix_stream_socket connectto;
+	stream_connect_pattern($1, setroubleshoot_var_run_t, setroubleshoot_var_run_t, setroubleshootd_t)
+	allow $1 setroubleshoot_var_run_t:sock_file read;
 ')
 
 ########################################
@@ -36,6 +36,75 @@
 		type setroubleshootd_t, setroubleshoot_var_run_t;
 	')
 
-	dontaudit $1 setroubleshoot_var_run_t:sock_file write;
+	dontaudit $1 setroubleshoot_var_run_t:sock_file rw_sock_file_perms;
 	dontaudit $1 setroubleshootd_t:unix_stream_socket connectto;
 ')
+
+########################################
+## <summary>
+##	Execute setroubleshoot server in the setroubleshoot domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`setroubleshoot_script_domtrans',`
+	gen_require(`
+		type setroubleshoot_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, setroubleshoot_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an setroubleshoot environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the setroubleshoot domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`setroubleshoot_admin',`
+	gen_require(`
+		type setroubleshootd_t;
+		type setroubleshoot_script_exec_t;
+		type setroubleshoot_log_t;
+		type setroubleshoot_var_lib_t;
+		type setroubleshoot_var_run_t;
+	')
+
+	allow $1 setroubleshootd_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, setroubleshootd_t, setroubleshootd_t)
+	        
+	# Allow setroubleshootd_t to restart the apache service
+	setroubleshoot_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 setroubleshoot_script_exec_t system_r;
+	allow $2 system_r;
+
+	logging_list_logs($1)
+        admin_pattern($1, setroubleshoot_log_t)
+
+	files_list_var_lib($1)
+        admin_pattern($1, setroubleshoot_var_lib_t)
+
+	files_list_pids($1)
+        admin_pattern($1, setroubleshoot_var_run_t)
+')
--- nsaserefpolicy/policy/modules/services/setroubleshoot.te	2008-08-25 09:12:31.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/setroubleshoot.te	2008-08-25 10:53:14.000000000 -0400
@@ -22,13 +22,16 @@
 type setroubleshoot_var_run_t;
 files_pid_file(setroubleshoot_var_run_t)
 
+type setroubleshoot_script_exec_t;
+init_script_type(setroubleshoot_script_exec_t)
+
 ########################################
 #
 # setroubleshootd local policy
 #
 
-allow setroubleshootd_t self:capability { dac_override sys_tty_config };
-allow setroubleshootd_t self:process { signull signal getattr getsched };
+allow setroubleshootd_t self:capability { dac_override sys_nice sys_tty_config };
+allow setroubleshootd_t self:process { getattr getsched setsched sigkill signull signal };
 allow setroubleshootd_t self:fifo_file rw_fifo_file_perms;
 allow setroubleshootd_t self:tcp_socket create_stream_socket_perms;
 allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto };
@@ -52,7 +55,9 @@
 
 kernel_read_kernel_sysctls(setroubleshootd_t)
 kernel_read_system_state(setroubleshootd_t)
+kernel_read_net_sysctls(setroubleshootd_t)
 kernel_read_network_state(setroubleshootd_t)
+kernel_dontaudit_list_all_proc(setroubleshootd_t)
 
 corecmd_exec_bin(setroubleshootd_t)
 corecmd_exec_shell(setroubleshootd_t)
@@ -68,16 +73,23 @@
 
 dev_read_urand(setroubleshootd_t)
 dev_read_sysfs(setroubleshootd_t)
+dev_getattr_all_blk_files(setroubleshootd_t)
+dev_getattr_all_chr_files(setroubleshootd_t)
 
 domain_dontaudit_search_all_domains_state(setroubleshootd_t)
 
 files_read_usr_files(setroubleshootd_t)
 files_read_etc_files(setroubleshootd_t)
-files_getattr_all_dirs(setroubleshootd_t)
+files_list_all(setroubleshootd_t)
 files_getattr_all_files(setroubleshootd_t)
+files_getattr_all_pipes(setroubleshootd_t)
+files_getattr_all_sockets(setroubleshootd_t)
 
 fs_getattr_all_dirs(setroubleshootd_t)
 fs_getattr_all_files(setroubleshootd_t)
+fs_read_fusefs_symlinks(setroubleshootd_t)
+fs_dontaudit_read_nfs_files(setroubleshootd_t)
+fs_dontaudit_read_cifs_files(setroubleshootd_t)
 
 selinux_get_enforce_mode(setroubleshootd_t)
 selinux_validate_context(setroubleshootd_t)
@@ -97,19 +109,21 @@
 
 locallogin_dontaudit_use_fds(setroubleshootd_t)
 
+logging_send_audit_msgs(setroubleshootd_t)
 logging_send_syslog_msg(setroubleshootd_t)
 logging_stream_connect_dispatcher(setroubleshootd_t)
 
 seutil_read_config(setroubleshootd_t)
 seutil_read_file_contexts(setroubleshootd_t)
-
-sysnet_read_config(setroubleshootd_t)
+seutil_read_bin_policy(setroubleshootd_t)
 
 sysadm_dontaudit_read_home_content_files(setroubleshootd_t)
+unprivuser_dontaudit_read_home_content_files(setroubleshootd_t)
 
 optional_policy(`
 	dbus_system_bus_client_template(setroubleshootd, setroubleshootd_t)
 	dbus_connect_system_bus(setroubleshootd_t)
+	dbus_system_domain(setroubleshootd_t, setroubleshootd_exec_t)
 ')
 
 optional_policy(`
