--- nsaserefpolicy/policy/modules/services/clamav.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/clamav.fc	2008-08-14 13:53:54.000000000 -0400
@@ -5,16 +5,18 @@
 /usr/bin/freshclam		--	gen_context(system_u:object_r:freshclam_exec_t,s0)
 
 /usr/sbin/clamd			--	gen_context(system_u:object_r:clamd_exec_t,s0)
+/usr/sbin/clamav-milter		--	gen_context(system_u:object_r:clamd_exec_t,s0)
 
 /var/run/amavis(d)?/clamd\.pid	--	gen_context(system_u:object_r:clamd_var_run_t,s0)
-/var/run/clamav(/.*)?			gen_context(system_u:object_r:clamd_var_run_t,s0)
-/var/run/clamd\..*			gen_context(system_u:object_r:clamd_var_run_t,s0)
-/var/run/clamav\..*			gen_context(system_u:object_r:clamd_var_run_t,s0)
+/var/run/clamav.*			gen_context(system_u:object_r:clamd_var_run_t,s0)
+/var/run/clamd.*			gen_context(system_u:object_r:clamd_var_run_t,s0)
 
 /var/lib/clamav(/.*)?			gen_context(system_u:object_r:clamd_var_lib_t,s0)
 
-/var/log/clamav			-d	gen_context(system_u:object_r:clamd_var_log_t,s0)
-/var/log/clamav/clamav.*	--	gen_context(system_u:object_r:clamd_var_log_t,s0)
+/var/log/clamav.*			gen_context(system_u:object_r:clamd_var_log_t,s0)
 /var/log/clamav/freshclam.*	--	gen_context(system_u:object_r:freshclam_var_log_t,s0)
+/var/log/clamd.*			gen_context(system_u:object_r:clamd_var_log_t,s0)
 
 /var/spool/amavisd/clamd\.sock	-s	gen_context(system_u:object_r:clamd_var_run_t,s0)
+
+/etc/rc.d/init.d/clamd-wrapper	--	gen_context(system_u:object_r:clamd_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/clamav.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/clamav.if	2008-08-14 13:53:54.000000000 -0400
@@ -38,6 +38,27 @@
 
 ########################################
 ## <summary>
+##	Allow the specified domain to append
+##	to clamav log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`clamav_append_log',`
+	gen_require(`
+		type clamav_log_t;
+	')
+
+	logging_search_logs($1)
+	allow $1 clamav_log_t:dir list_dir_perms;
+	append_files_pattern($1, clamav_log_t, clamav_log_t)
+')
+
+########################################
+## <summary>
 ##	Read clamav configuration files.
 ## </summary>
 ## <param name="domain">
@@ -91,3 +112,116 @@
 
 	domtrans_pattern($1, clamscan_exec_t, clamscan_t)
 ')
+
+########################################
+## <summary>
+##	Execute clamscan without a transition.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`clamav_exec_clamscan',`
+	gen_require(`
+		type clamscan_exec_t;
+	')
+
+	can_exec($1, clamscan_exec_t)
+
+')
+
+########################################
+## <summary>
+##	Execute clamav server in the clamav domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`clamav_script_domtrans',`
+	gen_require(`
+		type clamd_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, clamd_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an clamav environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the clamav domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`clamav_admin',`
+	gen_require(`
+		type clamd_t;
+		type clamd_script_exec_t;
+		type clamd_etc_t;
+		type clamd_tmp_t;
+		type clamd_var_log_t;
+		type clamd_var_lib_t;
+		type clamd_var_run_t;
+
+		type clamscan_t;
+		type clamscan_tmp_t;
+
+		type freshclam_t;
+		type freshclam_var_log_t;
+	')
+
+	allow $1 clamd_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, clamd_t, clamd_t)
+	        
+	allow $1 clamscan_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, clamscan_t, clamscan_t)
+
+	allow $1 freshclam_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, freshclam_t, freshclam_t)
+	        
+	# Allow clamd_t to restart the apache service
+	clamav_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 clamd_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_tmp($1)
+        admin_pattern($1, clamd_tmp_t)
+
+	files_list_etc($1)
+        admin_pattern($1, clamd_etc_t)
+
+	logging_list_logs($1)
+        admin_pattern($1, clamd_var_log_t)
+
+	files_list_var_lib($1)
+        admin_pattern($1, clamd_var_lib_t)
+
+	files_list_pids($1)
+        admin_pattern($1, clamd_var_run_t)
+
+        admin_pattern($1, clamscan_tmp_t)
+
+        admin_pattern($1, freshclam_var_log_t)
+')
+
--- nsaserefpolicy/policy/modules/services/clamav.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/clamav.te	2008-08-14 13:53:54.000000000 -0400
@@ -13,7 +13,7 @@
 
 # configuration files
 type clamd_etc_t;
-files_type(clamd_etc_t)
+files_config_file(clamd_etc_t)
 
 # tmp files
 type clamd_tmp_t;
@@ -48,6 +48,9 @@
 type freshclam_var_log_t;
 logging_log_file(freshclam_var_log_t)
 
+type clamd_script_exec_t;
+init_script_type(clamd_script_exec_t)
+
 ########################################
 #
 # clamd local policy
@@ -87,6 +90,9 @@
 kernel_dontaudit_list_proc(clamd_t)
 kernel_read_sysctl(clamd_t)
 kernel_read_kernel_sysctls(clamd_t)
+kernel_read_system_state(clamd_t)
+
+corecmd_exec_shell(clamd_t)
 
 corenet_all_recvfrom_unlabeled(clamd_t)
 corenet_all_recvfrom_netlabel(clamd_t)
@@ -97,6 +103,8 @@
 corenet_tcp_bind_all_nodes(clamd_t)
 corenet_tcp_bind_clamd_port(clamd_t)
 corenet_sendrecv_clamd_server_packets(clamd_t)
+corenet_tcp_bind_generic_port(clamd_t)
+corenet_tcp_connect_generic_port(clamd_t)
 
 dev_read_rand(clamd_t)
 dev_read_urand(clamd_t)
@@ -120,6 +128,9 @@
 cron_use_system_job_fds(clamd_t)
 cron_rw_pipes(clamd_t)
 
+mta_read_config(clamd_t)
+mta_send_mail(clamd_t)
+
 optional_policy(`
 	amavis_read_lib_files(clamd_t)
 	amavis_read_spool_files(clamd_t)
@@ -127,6 +138,10 @@
 	amavis_create_pid_files(clamd_t)
 ')
 
+optional_policy(`
+	exim_read_spool_files(clamd_t)
+')
+
 ########################################
 #
 # Freshclam local policy
@@ -197,7 +212,7 @@
 allow clamscan_t self:fifo_file rw_file_perms;
 allow clamscan_t self:unix_stream_socket create_stream_socket_perms;
 allow clamscan_t self:unix_dgram_socket create_socket_perms;
-allow clamscan_t self:tcp_socket { listen accept };
+allow clamscan_t self:tcp_socket create_stream_socket_perms;
 
 # configuration files
 allow clamscan_t clamd_etc_t:dir list_dir_perms;
@@ -213,6 +228,14 @@
 manage_files_pattern(clamscan_t, clamd_var_lib_t, clamd_var_lib_t)
 allow clamscan_t clamd_var_lib_t:dir list_dir_perms;
 
+corenet_all_recvfrom_unlabeled(clamscan_t)
+corenet_all_recvfrom_netlabel(clamscan_t)
+corenet_tcp_sendrecv_all_if(clamscan_t)
+corenet_tcp_sendrecv_all_nodes(clamscan_t)
+corenet_tcp_sendrecv_all_ports(clamscan_t)
+corenet_tcp_sendrecv_clamd_port(clamscan_t)
+corenet_tcp_connect_clamd_port(clamscan_t)
+
 kernel_read_kernel_sysctls(clamscan_t)
 
 files_read_etc_files(clamscan_t)
@@ -230,6 +253,12 @@
 
 clamav_stream_connect(clamscan_t)
 
+mta_send_mail(clamscan_t)
+
 optional_policy(`
 	apache_read_sys_content(clamscan_t)
 ')
+
+optional_policy(`
+	mailscanner_manage_spool(clamscan_t)
+')
