--- nsaserefpolicy/policy/modules/services/squid.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/squid.fc	2008-08-25 10:50:15.000000000 -0400
@@ -12,3 +12,8 @@
 /var/run/squid\.pid	--	gen_context(system_u:object_r:squid_var_run_t,s0)
 
 /var/spool/squid(/.*)?		gen_context(system_u:object_r:squid_cache_t,s0)
+/usr/lib/squid/cachemgr\.cgi	--	gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
+/usr/lib64/squid/cachemgr\.cgi	--	gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
+
+/etc/rc.d/init.d/squid	--	gen_context(system_u:object_r:squid_script_exec_t,s0)
+
--- nsaserefpolicy/policy/modules/services/squid.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/squid.if	2008-08-25 10:50:15.000000000 -0400
@@ -131,3 +131,114 @@
 interface(`squid_use',`
 	refpolicywarn(`$0($*) has been deprecated.')
 ')
+
+########################################
+## <summary>
+##	Allow read and write squid
+##	unix domain stream sockets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`squid_rw_stream_sockets',`
+	gen_require(`
+		type squid_t;
+	')
+
+	allow $1 squid_t:unix_stream_socket { getattr read write };
+')
+
+########################################
+## <summary>
+##	Execute squid server in the squid domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`squid_script_domtrans',`
+	gen_require(`
+		type squid_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, squid_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an squid environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the squid domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`squid_admin',`
+	gen_require(`
+		type squid_t;
+		type squid_script_exec_t;
+		type squid_cache_t;
+		type squid_conf_t;
+		type squid_log_t;
+		type squid_var_run_t;
+	')
+
+	allow $1 squid_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, squid_t, squid_t)
+	        
+	# Allow squid_t to restart the apache service
+	squid_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 squid_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_etc($1)
+        admin_pattern($1, squid_conf_t)
+
+	logging_list_logs($1)
+        admin_pattern($1, squid_log_t)
+
+	files_list_var($1)
+	admin_pattern($1, squid_cache_t)
+
+	files_list_pids($1)
+        admin_pattern($1, squid_var_run_t)
+')
+
+########################################
+## <summary>
+##	Send a signal to squid.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`squid_signal',`
+	gen_require(`
+		type squid_t;
+	')
+
+	allow $1 squid_t:process signal;
+')
+
--- nsaserefpolicy/policy/modules/services/squid.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/squid.te	2008-08-25 10:50:15.000000000 -0400
@@ -31,12 +31,15 @@
 type squid_var_run_t;
 files_pid_file(squid_var_run_t)
 
+type squid_script_exec_t;
+init_script_type(squid_script_exec_t)
+
 ########################################
 #
 # Local policy
 #
 
-allow squid_t self:capability { setgid setuid dac_override sys_resource };
+allow squid_t self:capability { setgid kill setuid dac_override sys_resource };
 dontaudit squid_t self:capability sys_tty_config;
 allow squid_t self:process ~{ ptrace setcurrent setexec setfscreate execmem execstack execheap };
 allow squid_t self:fifo_file rw_fifo_file_perms;
@@ -85,6 +88,7 @@
 corenet_udp_sendrecv_all_ports(squid_t)
 corenet_tcp_bind_all_nodes(squid_t)
 corenet_udp_bind_all_nodes(squid_t)
+corenet_tcp_bind_http_port(squid_t)
 corenet_tcp_bind_http_cache_port(squid_t)
 corenet_udp_bind_http_cache_port(squid_t)
 corenet_tcp_bind_ftp_port(squid_t)
@@ -92,10 +96,12 @@
 corenet_udp_bind_gopher_port(squid_t)
 corenet_tcp_bind_squid_port(squid_t)
 corenet_udp_bind_squid_port(squid_t)
+corenet_udp_bind_wccp_port(squid_t)
 corenet_tcp_connect_ftp_port(squid_t)
 corenet_tcp_connect_gopher_port(squid_t)
 corenet_tcp_connect_http_port(squid_t)
 corenet_tcp_connect_http_cache_port(squid_t)
+corenet_tcp_connect_pgpkeyserver_port(squid_t)
 corenet_sendrecv_http_client_packets(squid_t)
 corenet_sendrecv_ftp_client_packets(squid_t)
 corenet_sendrecv_gopher_client_packets(squid_t)
@@ -109,6 +115,8 @@
 
 fs_getattr_all_fs(squid_t)
 fs_search_auto_mountpoints(squid_t)
+#squid requires the following when run in diskd mode, the recommended setting
+fs_rw_tmpfs_files(squid_t)
 
 selinux_dontaudit_getattr_dir(squid_t)
 
@@ -128,6 +136,7 @@
 files_getattr_home_dir(squid_t)
 
 auth_use_nsswitch(squid_t)
+auth_domtrans_chkpwd(squid_t)
 
 libs_use_ld_so(squid_t)
 libs_use_shared_libs(squid_t)
@@ -149,11 +158,7 @@
 ')
 
 optional_policy(`
-	allow squid_t self:capability kill;
-	cron_use_fds(squid_t)
-	cron_use_system_job_fds(squid_t)
-	cron_rw_pipes(squid_t)
-	cron_write_system_job_pipes(squid_t)
+	cron_system_entry(squid_t, squid_exec_t)
 ')
 
 optional_policy(`
@@ -168,7 +173,12 @@
 	udev_read_db(squid_t)
 ')
 
-ifdef(`TODO',`
-#squid requires the following when run in diskd mode, the recommended setting
-allow squid_t tmpfs_t:file { read write };
-') dnl end TODO
+optional_policy(`
+	apache_content_template(squid)
+	corenet_tcp_connect_http_cache_port(httpd_squid_script_t)
+	squid_read_config(httpd_squid_script_t)
+	allow httpd_squid_script_t self:tcp_socket create_socket_perms;
+	sysnet_dns_name_resolve(httpd_squid_script_t)
+	corenet_all_recvfrom_unlabeled(httpd_squid_script_t)
+	corenet_all_recvfrom_netlabel(httpd_squid_script_t)
+')
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in	2008-08-11 11:23:34.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/kernel/corenetwork.te.in	2008-08-25 13:35:01.000000000 -0400
@@ -134,10 +139,13 @@
 network_port(pegasus_http, tcp,5988,s0)
 network_port(pegasus_https, tcp,5989,s0)
 network_port(postfix_policyd, tcp,10031,s0)
+network_port(pulseaudio, tcp,4713,s0)
+network_port(pgpkeyserver, udp, 11371,s0, tcp,11371,s0)
 network_port(pop, tcp,106,s0, tcp,109,s0, tcp,110,s0, tcp,143,s0, tcp,220,s0, tcp,993,s0, tcp,995,s0, tcp,1109,s0)
 network_port(portmap, udp,111,s0, tcp,111,s0)
 network_port(postgresql, tcp,5432,s0)
 network_port(postgrey, tcp,60000,s0)
+network_port(prelude, tcp,4690,s0, udp,4690,s0)
 network_port(printer, tcp,515,s0)
 network_port(ptal, tcp,5703,s0)
 network_port(pxe, udp,4011,s0)
