--- nsaserefpolicy/policy/modules/services/nis.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/nis.fc	2008-08-14 13:53:54.000000000 -0400
@@ -4,9 +4,14 @@
 /sbin/ypbind		--	gen_context(system_u:object_r:ypbind_exec_t,s0)
 
 /usr/lib/yp/ypxfr	--	gen_context(system_u:object_r:ypxfr_exec_t,s0)
+/usr/lib64/yp/ypxfr	--	gen_context(system_u:object_r:ypxfr_exec_t,s0)
 
 /usr/sbin/rpc\.yppasswdd --	gen_context(system_u:object_r:yppasswdd_exec_t,s0)
 /usr/sbin/rpc\.ypxfrd	--	gen_context(system_u:object_r:ypxfr_exec_t,s0)
 /usr/sbin/ypserv	--	gen_context(system_u:object_r:ypserv_exec_t,s0)
 
 /var/yp(/.*)?			gen_context(system_u:object_r:var_yp_t,s0)
+
+/etc/rc.d/init.d/yppasswd	--	gen_context(system_u:object_r:nis_script_exec_t,s0)
+/etc/rc.d/init.d/ypserv	--	gen_context(system_u:object_r:nis_script_exec_t,s0)
+/etc/rc.d/init.d/ypxfrd	--	gen_context(system_u:object_r:nis_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/nis.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/nis.if	2008-08-14 13:53:54.000000000 -0400
@@ -28,7 +28,7 @@
 		type var_yp_t;
 	')
 
-	dontaudit $1 self:capability net_bind_service;
+	allow $1 self:capability net_bind_service;
 
 	allow $1 self:tcp_socket create_stream_socket_perms;
 	allow $1 self:udp_socket create_socket_perms;
@@ -49,8 +49,8 @@
 	corenet_udp_bind_all_nodes($1)
 	corenet_tcp_bind_generic_port($1)
 	corenet_udp_bind_generic_port($1)
-	corenet_tcp_bind_reserved_port($1)
-	corenet_udp_bind_reserved_port($1)
+	corenet_dontaudit_tcp_bind_all_reserved_ports($1)
+	corenet_dontaudit_udp_bind_all_reserved_ports($1)
 	corenet_dontaudit_tcp_bind_all_ports($1)
 	corenet_dontaudit_udp_bind_all_ports($1)
 	corenet_tcp_connect_portmap_port($1)
@@ -87,6 +87,25 @@
 
 ########################################
 ## <summary>
+##	Use the nis to authenticate passwords
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`nis_authenticate',`
+	tunable_policy(`allow_ypbind',`
+		nis_use_ypbind_uncond($1)
+		corenet_tcp_bind_all_rpc_ports($1)
+		corenet_udp_bind_all_rpc_ports($1)
+	')
+')
+
+########################################
+## <summary>
 ##	Execute ypbind in the ypbind domain.
 ## </summary>
 ## <param name="domain">
@@ -244,3 +263,89 @@
 	corecmd_search_bin($1)
 	domtrans_pattern($1, ypxfr_exec_t, ypxfr_t)
 ')
+
+########################################
+## <summary>
+##	Execute nis server in the nis domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`nis_script_domtrans',`
+	gen_require(`
+		type nis_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, nis_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an nis environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the nis domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`nis_admin',`
+	gen_require(`
+		type ypbind_t, yppasswdd_t;
+		type ypserv_t, ypxfr_t;
+		type ypbind_tmp_t, ypserv_tmp_t, ypserv_conf_t;
+		type ypbind_var_run_t, yppasswdd_var_run_t, ypserv_var_run_t;
+		type nis_script_exec_t;
+	')
+
+	allow $1 ypbind_t:process { ptrace signal_perms };
+	ps_process_pattern($1, ypbind_t)
+	        
+	allow $1 yppasswdd_t:process { ptrace signal_perms };
+	ps_process_pattern($1, yppasswdd_t)
+	        
+	allow $1 ypserv_t:process { ptrace signal_perms };
+	ps_process_pattern($1, ypserv_t)
+	        
+	allow $1 ypxfr_t:process { ptrace signal_perms };
+	ps_process_pattern($1, ypxfr_t)
+
+	# Allow ypbind_t to restart the apache service
+	nis_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 nis_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_tmp($1)
+        admin_pattern($1, ypbind_tmp_t)
+
+	files_list_pids($1)
+        admin_pattern($1, ypbind_var_run_t)
+
+        admin_pattern($1, yppasswdd_var_run_t)
+
+	files_list_etc($1)
+        admin_pattern($1, ypserv_conf_t)
+
+        admin_pattern($1, ypserv_tmp_t)
+
+        admin_pattern($1, ypserv_var_run_t)
+')
+
+
--- nsaserefpolicy/policy/modules/services/nis.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/nis.te	2008-08-14 13:53:54.000000000 -0400
@@ -44,6 +44,9 @@
 type ypxfr_exec_t;
 init_daemon_domain(ypxfr_t, ypxfr_exec_t)
 
+type nis_script_exec_t;
+init_script_type(nis_script_exec_t)
+
 ########################################
 #
 # ypbind local policy
@@ -111,9 +114,19 @@
 sysnet_read_config(ypbind_t)
 
 userdom_dontaudit_use_unpriv_user_fds(ypbind_t)
-
 sysadm_dontaudit_search_home_dirs(ypbind_t)
 
+
+optional_policy(`
+	dbus_system_bus_client_template(ypbind, ypbind_t)
+	dbus_connect_system_bus(ypbind_t)
+	init_dbus_chat_script(ypbind_t)
+
+	optional_policy(`
+		networkmanager_dbus_chat(ypbind_t)
+	')
+')
+
 optional_policy(`
 	seutil_sigchld_newrole(ypbind_t)
 ')
@@ -127,6 +140,7 @@
 # yppasswdd local policy
 #
 
+allow yppasswdd_t self:capability dac_override;
 dontaudit yppasswdd_t self:capability sys_tty_config;
 allow yppasswdd_t self:fifo_file rw_fifo_file_perms;
 allow yppasswdd_t self:process { setfscreate signal_perms };
@@ -157,8 +171,8 @@
 corenet_udp_sendrecv_all_ports(yppasswdd_t)
 corenet_tcp_bind_all_nodes(yppasswdd_t)
 corenet_udp_bind_all_nodes(yppasswdd_t)
-corenet_tcp_bind_reserved_port(yppasswdd_t)
-corenet_udp_bind_reserved_port(yppasswdd_t)
+corenet_tcp_bind_all_rpc_ports(yppasswdd_t)
+corenet_udp_bind_all_rpc_ports(yppasswdd_t)
 corenet_dontaudit_tcp_bind_all_reserved_ports(yppasswdd_t)
 corenet_dontaudit_udp_bind_all_reserved_ports(yppasswdd_t)
 corenet_sendrecv_generic_server_packets(yppasswdd_t)
@@ -249,6 +263,8 @@
 corenet_udp_bind_all_nodes(ypserv_t)
 corenet_tcp_bind_reserved_port(ypserv_t)
 corenet_udp_bind_reserved_port(ypserv_t)
+corenet_tcp_bind_all_rpc_ports(ypserv_t)
+corenet_udp_bind_all_rpc_ports(ypserv_t)
 corenet_dontaudit_tcp_bind_all_reserved_ports(ypserv_t)
 corenet_dontaudit_udp_bind_all_reserved_ports(ypserv_t)
 corenet_sendrecv_generic_server_packets(ypserv_t)
@@ -318,6 +334,8 @@
 corenet_udp_bind_all_nodes(ypxfr_t)
 corenet_tcp_bind_reserved_port(ypxfr_t)
 corenet_udp_bind_reserved_port(ypxfr_t)
+corenet_tcp_bind_all_rpc_ports(ypxfr_t)
+corenet_udp_bind_all_rpc_ports(ypxfr_t)
 corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)
 corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t)
 corenet_tcp_connect_all_ports(ypxfr_t)
