--- nsaserefpolicy/policy/modules/system/lvm.fc	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/lvm.fc	2008-08-14 13:53:54.000000000 -0400
@@ -55,6 +55,7 @@
 /sbin/lvs		--	gen_context(system_u:object_r:lvm_exec_t,s0)
 /sbin/lvscan		--	gen_context(system_u:object_r:lvm_exec_t,s0)
 /sbin/multipathd	--	gen_context(system_u:object_r:lvm_exec_t,s0)
+/sbin/multipath\.static	--	gen_context(system_u:object_r:lvm_exec_t,s0)
 /sbin/pvchange		--	gen_context(system_u:object_r:lvm_exec_t,s0)
 /sbin/pvcreate		--	gen_context(system_u:object_r:lvm_exec_t,s0)
 /sbin/pvdata		--	gen_context(system_u:object_r:lvm_exec_t,s0)
@@ -97,3 +98,4 @@
 /var/lock/lvm(/.*)?		gen_context(system_u:object_r:lvm_lock_t,s0)
 /var/run/multipathd\.sock -s	gen_context(system_u:object_r:lvm_var_run_t,s0)
 /var/lib/multipath(/.*)?	gen_context(system_u:object_r:lvm_var_lib_t,s0)
+/var/run/dmevent.*		gen_context(system_u:object_r:lvm_var_run_t,s0)
--- nsaserefpolicy/policy/modules/system/lvm.te	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/lvm.te	2008-08-14 13:53:54.000000000 -0400
@@ -13,6 +13,9 @@
 type clvmd_var_run_t;
 files_pid_file(clvmd_var_run_t)
 
+type clvmd_script_exec_t;
+init_script_type(clvmd_script_exec_t)
+
 type lvm_t;
 type lvm_exec_t;
 init_system_domain(lvm_t,lvm_exec_t)
@@ -22,7 +25,7 @@
 role system_r types lvm_t;
 
 type lvm_etc_t;
-files_type(lvm_etc_t)
+files_config_file(lvm_etc_t)
 
 type lvm_lock_t;
 files_lock_file(lvm_lock_t)
@@ -44,9 +47,9 @@
 # Cluster LVM daemon local policy
 #
 
-allow clvmd_t self:capability { sys_admin mknod };
+allow clvmd_t self:capability { sys_nice chown ipc_lock sys_admin mknod };
 dontaudit clvmd_t self:capability sys_tty_config;
-allow clvmd_t self:process signal_perms;
+allow clvmd_t self:process { signal_perms  setsched };
 dontaudit clvmd_t self:process ptrace;
 allow clvmd_t self:socket create_socket_perms;
 allow clvmd_t self:fifo_file rw_fifo_file_perms;
@@ -54,6 +57,8 @@
 allow clvmd_t self:tcp_socket create_stream_socket_perms;
 allow clvmd_t self:udp_socket create_socket_perms;
 
+init_dontaudit_getattr_initctl(clvmd_t)
+
 manage_files_pattern(clvmd_t,clvmd_var_run_t,clvmd_var_run_t)
 files_pid_filetrans(clvmd_t,clvmd_var_run_t,file)
 
@@ -85,10 +90,15 @@
 corenet_sendrecv_generic_server_packets(clvmd_t)
 
 dev_read_sysfs(clvmd_t)
+dev_manage_generic_symlinks(clvmd_t)
+dev_relabel_generic_dev_dirs(clvmd_t)
+dev_manage_generic_blk_files(clvmd_t)
 dev_manage_generic_chr_files(clvmd_t)
 dev_rw_lvm_control(clvmd_t)
 dev_dontaudit_getattr_all_blk_files(clvmd_t)
 dev_dontaudit_getattr_all_chr_files(clvmd_t)
+dev_create_generic_dirs(clvmd_t)
+dev_delete_generic_dirs(clvmd_t)
 
 files_read_etc_files(clvmd_t)
 files_list_usr(clvmd_t)
@@ -99,9 +109,12 @@
 fs_dontaudit_read_removable_files(clvmd_t)
 
 storage_dontaudit_getattr_removable_dev(clvmd_t)
+storage_dev_filetrans_fixed_disk(clvmd_t)
+storage_manage_fixed_disk(clvmd_t)
 
 domain_use_interactive_fds(clvmd_t)
 
+storage_relabel_fixed_disk(clvmd_t)
 storage_raw_read_fixed_disk(clvmd_t)
 
 auth_use_nsswitch(clvmd_t)
@@ -115,9 +128,11 @@
 
 seutil_dontaudit_search_config(clvmd_t)
 seutil_sigchld_newrole(clvmd_t)
+seutil_read_config(clvmd_t)
+seutil_read_file_contexts(clvmd_t)
+seutil_search_default_contexts(clvmd_t)
 
 userdom_dontaudit_use_unpriv_user_fds(clvmd_t)
-
 sysadm_dontaudit_search_home_dirs(clvmd_t)
 
 lvm_domtrans(clvmd_t)
@@ -137,6 +152,14 @@
 ')
 
 optional_policy(`
+	unconfined_domain(clvmd_t)
+')
+
+optional_policy(`
+	unconfined_domain(lvm_t)
+')
+
+optional_policy(`
 	udev_read_db(clvmd_t)
 ')
 
@@ -147,17 +170,19 @@
 
 # DAC overrides and mknod for modifying /dev entries (vgmknodes)
 # rawio needed for dmraid
-allow lvm_t self:capability { dac_override fowner ipc_lock sys_admin sys_nice mknod chown sys_resource sys_rawio };
+allow lvm_t self:capability { dac_override fowner ipc_lock sys_admin sys_nice mknod chown sys_resource sys_rawio net_admin };
+# lvm needs net_admin for multipath
 dontaudit lvm_t self:capability sys_tty_config;
 allow lvm_t self:process { sigchld sigkill sigstop signull signal };
 # LVM will complain a lot if it cannot set its priority.
 allow lvm_t self:process setsched;
 allow lvm_t self:file rw_file_perms;
-allow lvm_t self:fifo_file rw_file_perms;
+allow lvm_t self:fifo_file manage_fifo_file_perms;
 allow lvm_t self:unix_dgram_socket create_socket_perms;
 allow lvm_t self:netlink_kobject_uevent_socket create_socket_perms;
 
-allow lvm_t clvmd_t:unix_stream_socket connectto;
+allow lvm_t self:unix_stream_socket { connectto create_stream_socket_perms };
+allow lvm_t clvmd_t:unix_stream_socket { connectto rw_socket_perms };
 
 manage_dirs_pattern(lvm_t,lvm_tmp_t,lvm_tmp_t)
 manage_files_pattern(lvm_t,lvm_tmp_t,lvm_tmp_t)
@@ -189,6 +214,7 @@
 manage_files_pattern(lvm_t,lvm_metadata_t,lvm_metadata_t)
 filetrans_pattern(lvm_t,lvm_etc_t,lvm_metadata_t,file)
 files_etc_filetrans(lvm_t,lvm_metadata_t,file)
+files_search_mnt(lvm_t)
 
 kernel_read_system_state(lvm_t)
 kernel_read_kernel_sysctls(lvm_t)
@@ -225,6 +251,7 @@
 dev_dontaudit_getattr_generic_blk_files(lvm_t)
 dev_dontaudit_getattr_generic_pipes(lvm_t)
 dev_create_generic_dirs(lvm_t)
+dev_rw_generic_files(lvm_t)
 
 fs_getattr_xattr_fs(lvm_t)
 fs_search_auto_mountpoints(lvm_t)
@@ -243,6 +270,7 @@
 storage_dev_filetrans_fixed_disk(lvm_t)
 # Access raw devices and old /dev/lvm (c 109,0).  Is this needed?
 storage_manage_fixed_disk(lvm_t)
+mls_file_read_all_levels(lvm_t)
 
 term_getattr_all_user_ttys(lvm_t)
 term_list_ptys(lvm_t)
@@ -252,6 +280,7 @@
 
 domain_use_interactive_fds(lvm_t)
 
+files_read_usr_files(lvm_t)
 files_read_etc_files(lvm_t)
 files_read_etc_runtime_files(lvm_t)
 # for when /usr is not mounted:
@@ -273,6 +302,8 @@
 seutil_search_default_contexts(lvm_t)
 seutil_sigchld_newrole(lvm_t)
 
+sysadm_dontaudit_search_home_dirs(lvm_t)
+
 ifdef(`distro_redhat',`
 	# this is from the initrd:
 	files_rw_isid_type_dirs(lvm_t)
@@ -291,5 +322,18 @@
 ')
 
 optional_policy(`
+	modutils_domtrans_insmod(lvm_t)
+')
+
+optional_policy(`
 	udev_read_db(lvm_t)
 ')
+
+optional_policy(`
+	unconfined_domain(lvm_t)
+')
+
+optional_policy(`
+	xen_append_log(lvm_t)
+	xen_dontaudit_rw_unix_stream_sockets(lvm_t)
+')
