--- nsaserefpolicy/policy/modules/system/mount.fc	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/mount.fc	2008-08-14 13:53:54.000000000 -0400
@@ -1,4 +1,6 @@
 /bin/mount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
 /bin/umount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
-
+/sbin/mount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
+/sbin/umount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
+/bin/fusermount            --      gen_context(system_u:object_r:mount_exec_t,s0)
 /usr/bin/fusermount		--	gen_context(system_u:object_r:mount_exec_t,s0)
--- nsaserefpolicy/policy/modules/system/mount.if	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/mount.if	2008-08-14 13:53:54.000000000 -0400
@@ -49,6 +49,8 @@
 	mount_domtrans($1)
 	role $2 types mount_t;
 	allow mount_t $3:chr_file rw_file_perms;
+	#Leaked File Descriptors
+	dontaudit mount_t $1:unix_stream_socket rw_socket_perms;
 
 	optional_policy(`
 		samba_run_smbmount($1, $2, $3)
--- nsaserefpolicy/policy/modules/system/mount.te	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/mount.te	2008-08-14 13:53:54.000000000 -0400
@@ -18,17 +18,18 @@
 init_system_domain(mount_t,mount_exec_t)
 role system_r types mount_t;
 
+typealias mount_t alias mount_ntfs_t;
+typealias mount_exec_t alias mount_ntfs_exec_t;
+
 type mount_loopback_t; # customizable
 files_type(mount_loopback_t)
 
 type mount_tmp_t;
 files_tmp_file(mount_tmp_t)
 
-# causes problems with interfaces when
-# this is optionally declared in monolithic
-# policy--duplicate type declaration
 type unconfined_mount_t;
 application_domain(unconfined_mount_t,mount_exec_t)
+role system_r types unconfined_mount_t;
 
 ########################################
 #
@@ -36,23 +37,28 @@
 #
 
 # setuid/setgid needed to mount cifs 
-allow mount_t self:capability { ipc_lock sys_rawio sys_admin dac_override chown sys_tty_config setuid setgid };
+allow mount_t self:capability { fsetid ipc_lock sys_rawio sys_resource sys_admin dac_override chown sys_tty_config setuid setgid };
+allow mount_t self:process ptrace;
 
 allow mount_t mount_loopback_t:file read_file_perms;
 
 allow mount_t mount_tmp_t:file manage_file_perms;
 allow mount_t mount_tmp_t:dir manage_dir_perms;
+files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
 
 can_exec(mount_t, mount_exec_t)
 
-files_tmp_filetrans(mount_t,mount_tmp_t,{ file dir })
-
+# In order to mount reiserfs_t
+kernel_list_unlabeled(mount_t)
 kernel_read_system_state(mount_t)
+kernel_read_network_state(mount_t)
 kernel_read_kernel_sysctls(mount_t)
 kernel_dontaudit_getattr_core_if(mount_t)
+kernel_search_debugfs(mount_t)
 
 dev_getattr_all_blk_files(mount_t)
 dev_list_all_dev_nodes(mount_t)
+dev_read_usbfs(mount_t)
 dev_rw_lvm_control(mount_t)
 dev_dontaudit_getattr_all_chr_files(mount_t)
 dev_dontaudit_getattr_memory_dev(mount_t)
@@ -62,16 +68,18 @@
 storage_raw_write_fixed_disk(mount_t)
 storage_raw_read_removable_device(mount_t)
 storage_raw_write_removable_device(mount_t)
+storage_rw_fuse(mount_t)
 
-fs_getattr_xattr_fs(mount_t)
-fs_getattr_cifs(mount_t)
+fs_list_all(mount_t)
+fs_getattr_all_fs(mount_t)
 fs_mount_all_fs(mount_t)
 fs_unmount_all_fs(mount_t)
 fs_remount_all_fs(mount_t)
 fs_relabelfrom_all_fs(mount_t)
-fs_list_auto_mountpoints(mount_t)
 fs_rw_tmpfs_chr_files(mount_t)
+fs_manage_tmpfs_dirs(mount_t)
 fs_read_tmpfs_symlinks(mount_t)
+fs_manage_nfs_dirs(mount_t)
 
 term_use_all_terms(mount_t)
 
@@ -79,6 +87,7 @@
 corecmd_exec_bin(mount_t)
 
 domain_use_interactive_fds(mount_t)
+domain_dontaudit_search_all_domains_state(mount_t)
 
 files_search_all(mount_t)
 files_read_etc_files(mount_t)
@@ -100,6 +109,8 @@
 init_use_fds(mount_t)
 init_use_script_ptys(mount_t)
 init_dontaudit_getattr_initctl(mount_t)
+init_stream_connect_script(mount_t)
+init_rw_script_stream_sockets(mount_t)
 
 auth_use_nsswitch(mount_t)
 
@@ -119,6 +130,8 @@
 seutil_read_config(mount_t)
 
 userdom_use_all_users_fds(mount_t)
+sysadm_read_home_content_files(mount_t)
+unprivuser_manage_home_content_dirs(mount_t)
 
 ifdef(`distro_redhat',`
 	optional_policy(`
@@ -167,6 +180,8 @@
 	fs_search_rpc(mount_t)
 
 	rpc_stub(mount_t)
+
+	rpc_domtrans_rpcd(mount_t)
 ')
 
 optional_policy(`
@@ -181,6 +196,11 @@
 	')
 ')
 
+# Needed for mount crypt https://bugzilla.redhat.com/show_bug.cgi?id=418711
+optional_policy(`
+	lvm_domtrans(mount_t)
+')
+
 # for kernel package installation
 optional_policy(`
 	rpm_rw_pipes(mount_t)
@@ -188,6 +208,7 @@
 
 optional_policy(`
 	samba_domtrans_smbmount(mount_t)
+	samba_read_config(mount_t)
 ')
 
 ########################################
@@ -198,4 +219,26 @@
 optional_policy(`
 	files_etc_filetrans_etc_runtime(unconfined_mount_t,file)
 	unconfined_domain(unconfined_mount_t)
+	optional_policy(`
+		hal_dbus_chat(unconfined_mount_t)
+	')
 ')
+
+########################################
+#
+# ntfs local policy
+#
+allow mount_t self:fifo_file rw_fifo_file_perms;
+allow mount_t self:unix_stream_socket create_stream_socket_perms;
+allow mount_t self:unix_dgram_socket create_socket_perms; 
+
+corecmd_exec_shell(mount_t)
+
+modutils_domtrans_insmod(mount_t)
+
+optional_policy(`
+	hal_write_log(mount_t)
+	hal_use_fds(mount_t)
+	hal_rw_pipes(mount_t)
+')
+
