--- nsaserefpolicy/policy/modules/services/virt.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/virt.fc	2008-08-14 13:53:54.000000000 -0400
@@ -9,3 +9,6 @@
 /var/lib/libvirt/images(/.*)? 	gen_context(system_u:object_r:virt_image_t,s0)
 /var/log/libvirt(/.*)?		gen_context(system_u:object_r:virt_log_t,s0)
 /var/run/libvirt(/.*)?		gen_context(system_u:object_r:virt_var_run_t,s0)
+
+/etc/rc.d/init.d/libvirtd	--	gen_context(system_u:object_r:virtd_script_exec_t,s0)
+
--- nsaserefpolicy/policy/modules/services/virt.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/virt.if	2008-08-14 13:53:54.000000000 -0400
@@ -68,7 +68,7 @@
 ##	</summary>
 ## </param>
 #
-interface(`virt_manage_pids_files',`
+interface(`virt_manage_pid_files',`
 	gen_require(`
 		type virt_var_run_t;
 	')
@@ -78,6 +78,24 @@
 
 ########################################
 ## <summary>
+##	Execute virt server in the virt domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`virtd_script_domtrans',`
+	gen_require(`
+		type virtd_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, virtd_script_exec_t)
+')
+
+########################################
+## <summary>
 ##	Search virt lib directories.
 ## </summary>
 ## <param name="domain">
@@ -196,6 +214,35 @@
 
 ########################################
 ## <summary>
+##	Make the specified type usable as a virt image
+## </summary>
+## <desc>
+##	<p>
+##	Make the specified type usable as a virt image
+##	</p>
+## </desc>
+## <param name="type">
+##	<summary>
+##	Type to be used as a virtual image
+##	</summary>
+## </param>
+#
+#
+interface(`virt_image',`
+	gen_require(`
+		attribute virt_image_type;
+	')
+
+	typeattribute $1 virt_image_type;
+
+	files_type($1)
+
+	# virt images can be assigned to blk devices
+	dev_node($1)
+')
+
+########################################
+## <summary>
 ##	Allow domain to manage virt image files
 ## </summary>
 ## <param name="domain">
@@ -214,6 +261,7 @@
 	manage_dirs_pattern($1, virt_image_t, virt_image_t)
 	manage_files_pattern($1, virt_image_t, virt_image_t)
 	read_lnk_files_pattern($1, virt_image_t, virt_image_t)
+	rw_blk_files_pattern($1, virt_image_t, virt_image_t)
 
 	tunable_policy(`virt_use_nfs',`
 		fs_manage_nfs_dirs($1)
@@ -243,11 +291,18 @@
 interface(`virt_admin',`
 	gen_require(`
 		type virtd_t;
+		type virtd_script_exec_t;
 	')
 
 	allow $1 virtd_t:process { ptrace signal_perms };
 	ps_process_pattern($1, virtd_t)
 
+	# Allow virtd_t to restart the apache service
+	virtd_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 virtd_script_exec_t system_r;
+	allow $2 system_r;
+
 	virt_manage_pid_files($1)
 
 	virt_manage_lib_files($1)
--- nsaserefpolicy/policy/modules/services/virt.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/virt.te	2008-08-14 13:53:54.000000000 -0400
@@ -1,6 +1,8 @@
 
 policy_module(virt, 1.0.0)
 
+attribute virt_image_type;
+
 ########################################
 #
 # Declarations
@@ -28,9 +30,7 @@
 
 # virt Image files
 type virt_image_t; # customizable
-files_type(virt_image_t)
-# virt_image_t can be assigned to blk devices
-dev_node(virt_image_t)
+virt_image(virt_image_t)
 
 type virt_log_t;
 logging_log_file(virt_log_t)
@@ -45,6 +45,9 @@
 type virtd_exec_t;
 init_daemon_domain(virtd_t, virtd_exec_t)
 
+type virtd_script_exec_t;
+init_script_type(virtd_script_exec_t)
+
 ########################################
 #
 # virtd local policy
@@ -49,9 +52,8 @@
 #
 # virtd local policy
 #
-
 allow virtd_t self:capability { dac_override kill net_admin setgid sys_nice sys_ptrace };
-allow virtd_t self:process { sigkill signal execmem };
+allow virtd_t self:process { getsched sigkill signal execmem };
 allow virtd_t self:fifo_file rw_file_perms;
 allow virtd_t self:unix_stream_socket create_stream_socket_perms;
 allow virtd_t self:tcp_socket create_stream_socket_perms;
@@ -64,7 +66,7 @@
 manage_lnk_files_pattern(virtd_t, virt_etc_rw_t, virt_etc_rw_t)
 filetrans_pattern(virtd_t, virt_etc_t, virt_etc_rw_t, dir)
 
-manage_files_pattern(virtd_t, virt_image_t, virt_image_t)
+manage_files_pattern(virtd_t, virt_image_type, virt_image_type)
 
 manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t)
 manage_files_pattern(virtd_t, virt_log_t, virt_log_t)
@@ -82,6 +84,8 @@
 kernel_read_system_state(virtd_t)
 kernel_read_network_state(virtd_t)
 kernel_rw_net_sysctls(virtd_t)
+kernel_read_xen_state(virtd_t)
+kernel_write_xen_state(virtd_t)
 kernel_load_module(virtd_t)
 
 corecmd_exec_bin(virtd_t)
@@ -93,7 +97,7 @@
 corenet_tcp_sendrecv_all_nodes(virtd_t)
 corenet_tcp_sendrecv_all_ports(virtd_t)
 corenet_tcp_bind_all_nodes(virtd_t)
-#corenet_tcp_bind_virt_port(virtd_t)
+corenet_tcp_bind_virt_port(virtd_t)
 corenet_tcp_bind_vnc_port(virtd_t)
 corenet_tcp_connect_vnc_port(virtd_t)
 corenet_tcp_connect_soundd_port(virtd_t)
@@ -107,8 +111,10 @@
 
 files_read_usr_files(virtd_t)
 files_read_etc_files(virtd_t)
+files_read_usr_files(virtd_t)
 files_read_etc_runtime_files(virtd_t)
 files_search_all(virtd_t)
+files_list_kernel_modules(virtd_t)
 
 fs_list_auto_mountpoints(virtd_t)
 
@@ -162,26 +168,27 @@
 	')
 ')
 
-#optional_policy(`
-#	dnsmasq_domtrans(virtd_t)
-#	dnsmasq_signal(virtd_t)
-#	dnsmasq_sigkill(virtd_t)
-#')
+optional_policy(`
+	dnsmasq_domtrans(virtd_t)
+	dnsmasq_signal(virtd_t)
+	dnsmasq_sigkill(virtd_t)
+')
 
 optional_policy(`
 	iptables_domtrans(virtd_t)
 ')
 
-#optional_policy(`
-#	polkit_domtrans_auth(virtd_t)
-#	polkit_domtrans_resolve(virtd_t)
-#')
+optional_policy(`
+	polkit_domtrans_auth(virtd_t)
+	polkit_domtrans_resolve(virtd_t)
+')
 
 optional_policy(`
 	qemu_domtrans(virtd_t)
 	qemu_read_state(virtd_t)
 	qemu_signal(virtd_t)
 	qemu_kill(virtd_t)
+	qemu_setsched(virtd_t)
 ')
 
 optional_policy(`
@@ -189,9 +196,10 @@
 ')
 
 optional_policy(`
-	kernel_read_xen_state(virtd_t)
-	kernel_write_xen_state(virtd_t)
-
 	xen_stream_connect(virtd_t)
 	xen_stream_connect_xenstore(virtd_t)
 ')
+
+optional_policy(`
+	unconfined_domain(virtd_t)
+')
