--- nsaserefpolicy/policy/modules/system/authlogin.fc	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/authlogin.fc	2008-08-14 13:53:54.000000000 -0400
@@ -7,12 +7,10 @@
 /etc/passwd\.lock	--	gen_context(system_u:object_r:shadow_t,s0)
 /etc/shadow.*		--	gen_context(system_u:object_r:shadow_t,s0)
 
-/lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:pam_exec_t,s0)
-/lib64/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:pam_exec_t,s0)
-
 /sbin/pam_console_apply	 --	gen_context(system_u:object_r:pam_console_exec_t,s0)
 /sbin/pam_timestamp_check --	gen_context(system_u:object_r:pam_exec_t,s0)
 /sbin/unix_chkpwd	--	gen_context(system_u:object_r:chkpwd_exec_t,s0)
+/usr/sbin/validate	--	gen_context(system_u:object_r:chkpwd_exec_t,s0)
 /sbin/unix_update	--	gen_context(system_u:object_r:updpwd_exec_t,s0)
 /sbin/unix_verify	--	gen_context(system_u:object_r:chkpwd_exec_t,s0)
 ifdef(`distro_suse', `
@@ -40,6 +38,10 @@
 /var/log/wtmp.*		--	gen_context(system_u:object_r:wtmp_t,s0)
 
 /var/run/console(/.*)?	 	gen_context(system_u:object_r:pam_var_console_t,s0)
-
 /var/run/pam_mount(/.*)?	gen_context(system_u:object_r:pam_var_run_t,s0)
+/var/run/sepermit(/.*)? 	gen_context(system_u:object_r:pam_var_run_t,s0)
+
 /var/run/sudo(/.*)?		gen_context(system_u:object_r:pam_var_run_t,s0)
+/var/run/pam_ssh(/.*)?		gen_context(system_u:object_r:var_auth_t,s0)
+
+/var/cache/coolkey(/.*)?	gen_context(system_u:object_r:auth_cache_t,s0)
--- nsaserefpolicy/policy/modules/system/authlogin.if	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/authlogin.if	2008-08-14 13:53:54.000000000 -0400
@@ -56,10 +56,6 @@
 	miscfiles_read_localization($1_chkpwd_t)
 
 	seutil_read_config($1_chkpwd_t)
-
-	optional_policy(`
-		kerberos_use($1_chkpwd_t)
-	')
 ')
 
 #######################################
@@ -99,7 +95,7 @@
 template(`authlogin_per_role_template',`
 
 	gen_require(`
-		type system_chkpwd_t, shadow_t;
+		type system_chkpwd_t, shadow_t, updpwd_t;
 	')
 
 	authlogin_common_auth_domain_template($1)
@@ -169,6 +165,7 @@
 interface(`auth_login_pgm_domain',`
 	gen_require(`
 		type var_auth_t;
+		type auth_cache_t;
 	')
 
 	domain_type($1)
@@ -177,12 +174,27 @@
 	domain_obj_id_change_exemption($1)
 	role system_r types $1;
 
+	# Needed for pam_selinux_permit to cleanup properly
+	domain_read_all_domains_state($1)
+	domain_kill_all_domains($1)
+
+	# pam_keyring
+	allow $1 self:capability ipc_lock;
+	allow $1 self:process setkeycreate;
+	allow $1 self:key manage_key_perms;
+	userdom_manage_all_users_keys($1)
+
 	files_list_var_lib($1)
 	manage_files_pattern($1, var_auth_t, var_auth_t)
 
 	# needed for afs - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=253321
 	kernel_rw_afs_state($1)
 
+	manage_dirs_pattern($1, auth_cache_t, auth_cache_t)
+	manage_files_pattern($1, auth_cache_t, auth_cache_t)
+	manage_sock_files_pattern($1, auth_cache_t, auth_cache_t)
+	files_var_filetrans($1, auth_cache_t, dir)
+
 	# for SSP/ProPolice
 	dev_read_urand($1)
 	# for fingerprint readers
@@ -216,6 +228,7 @@
 	auth_rw_faillog($1)
 	auth_exec_pam($1)
 	auth_use_nsswitch($1)
+	auth_manage_pam_pid($1)
 
 	init_rw_utmp($1)
 
@@ -226,8 +239,40 @@
 	seutil_read_config($1)
 	seutil_read_default_contexts($1)
 
+	userdom_set_rlimitnh($1)
+	userdom_read_all_users_home_content_symlinks($1)
+	unprivuser_unlink_tmp_files($1)
+	unprivuser_stream_connect($1)
+
+	optional_policy(`
+		dbus_system_bus_client_template(notused, $1)
+		optional_policy(`
+			oddjob_dbus_chat($1)
+			oddjob_domtrans_mkhomedir($1)
+		')
+	')
+
+	optional_policy(`
+		corecmd_exec_bin($1)
+		storage_getattr_fixed_disk_dev($1)
+		mount_domtrans($1)
+	')
+
+	optional_policy(`
+		nis_authenticate($1)
+	')
+
+	optional_policy(`
+		ssh_agent_exec($1)
+		userdom_read_all_users_home_content_files($1)
+	')
+
 	tunable_policy(`allow_polyinstantiation',`
 		files_polyinstantiate_all($1)
+		unprivuser_manage_home_content_dirs($1)
+		unprivuser_manage_home_content_files($1)
+		userdom_relabel_all_home_dirs($1)
+		userdom_relabel_all_home_files($1)
 	')
 ')
 
@@ -333,19 +378,15 @@
 	dev_read_rand($1)
 	dev_read_urand($1)
 
+	auth_use_nsswitch($1)
+
 	logging_send_audit_msgs($1)
 
 	miscfiles_read_certs($1)
 
-	sysnet_dns_name_resolve($1)
-	sysnet_use_ldap($1)
-
 	optional_policy(`
-		kerberos_use($1)
-	')
-
-	optional_policy(`
-		nis_use_ypbind($1)
+		kerberos_read_keytab($1)
+		kerberos_524_connect($1)
 	')
 
 	optional_policy(`
@@ -356,6 +397,28 @@
 	optional_policy(`
 		samba_stream_connect_winbind($1)
 	')
+	auth_domtrans_upd_passwd($1)
+')
+
+########################################
+## <summary>
+##	Run unix_chkpwd to check a password.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`auth_domtrans_chkpwd',`
+	gen_require(`
+		type system_chkpwd_t, chkpwd_exec_t, shadow_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, chkpwd_exec_t, system_chkpwd_t)
+	dontaudit $1 shadow_t:file { getattr read };
+	auth_domtrans_upd_passwd($1)
 ')
 
 ########################################
@@ -369,12 +432,12 @@
 ## </param>
 ## <param name="role">
 ##	<summary>
-##	The role to allow the chkpwd domain.
+##	The role to allow the updpwd domain.
 ##	</summary>
 ## </param>
 ## <param name="terminal">
 ##	<summary>
-##	The type of the terminal allow the chkpwd domain to use.
+##	The type of the terminal allow the updpwd domain to use.
 ##	</summary>
 ## </param>
 #
@@ -386,6 +449,7 @@
 	auth_domtrans_chk_passwd($1)
 	role $2 types system_chkpwd_t;
 	allow system_chkpwd_t $3:chr_file rw_file_perms;
+	auth_run_upd_passwd($1, $2, $3)
 ')
 
 ########################################
@@ -1447,6 +1511,10 @@
 	')
 
 	optional_policy(`
+		kerberos_use($1)
+	')
+
+	optional_policy(`
 		nis_use_ypbind($1)
 	')
 
@@ -1457,6 +1525,7 @@
 	optional_policy(`
 		samba_stream_connect_winbind($1)
 		samba_read_var_files($1)
+		samba_dontaudit_write_var_files($1)
 	')
 ')
 
@@ -1491,3 +1560,59 @@
 	typeattribute $1 can_write_shadow_passwords;
 	typeattribute $1 can_relabelto_shadow_passwords;
 ')
+
+########################################
+## <summary>
+##	Read authentication cache
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`auth_read_cache',`
+	gen_require(`
+		type auth_cache_t;
+	')
+
+	read_files_pattern($1, auth_cache_t,  auth_cache_t)
+')
+
+########################################
+## <summary>
+##	Read/Write authentication cache
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`auth_rw_cache',`
+	gen_require(`
+		type auth_cache_t;
+	')
+
+	rw_files_pattern($1, auth_cache_t,  auth_cache_t)
+')
+########################################
+## <summary>
+##	Manage authentication cache
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`auth_manage_cache',`
+	gen_require(`
+		type auth_cache_t;
+	')
+
+	manage_files_pattern($1, auth_cache_t,  auth_cache_t)
+')
--- nsaserefpolicy/policy/modules/system/authlogin.te	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/authlogin.te	2008-08-14 13:53:54.000000000 -0400
@@ -59,6 +59,9 @@
 type utempter_exec_t;
 application_domain(utempter_t,utempter_exec_t)
 
+type auth_cache_t;
+logging_log_file(auth_cache_t)
+
 #
 # var_auth_t is the type of /var/lib/auth, usually
 # used for auth data in pam_able
@@ -73,6 +76,9 @@
 authlogin_common_auth_domain_template(system)
 role system_r types system_chkpwd_t;
 
+# Read only version of updpwd
+domain_entry_file(system_chkpwd_t, updpwd_exec_t)
+
 ########################################
 #
 # PAM local policy
@@ -111,7 +117,8 @@
 term_use_all_user_ttys(pam_t)
 term_use_all_user_ptys(pam_t)
 
-init_dontaudit_rw_utmp(pam_t)
+init_read_utmp(pam_t)
+init_dontaudit_write_utmp(pam_t)
 
 files_read_etc_files(pam_t)
 
@@ -122,6 +129,12 @@
 
 userdom_use_unpriv_users_fds(pam_t)
 
+userdom_write_unpriv_users_tmp_files(pam_t)
+unprivuser_unlink_tmp_files(pam_t)
+unprivuser_dontaudit_read_home_content_files(pam_t)
+unprivuser_dontaudit_write_home_content_files(pam_t)
+unprivuser_append_home_content_files(pam_t)
+
 ifdef(`distro_ubuntu',`
 	optional_policy(`
 		unconfined_domain(pam_t)
@@ -155,6 +168,8 @@
 dev_read_sysfs(pam_console_t)
 dev_getattr_apm_bios_dev(pam_console_t)
 dev_setattr_apm_bios_dev(pam_console_t)
+dev_getattr_cpu_dev(pam_console_t)
+dev_setattr_cpu_dev(pam_console_t)
 dev_getattr_dri_dev(pam_console_t)
 dev_setattr_dri_dev(pam_console_t)
 dev_getattr_input_dev(pam_console_t)
@@ -179,6 +194,10 @@
 dev_setattr_video_dev(pam_console_t)
 dev_getattr_xserver_misc_dev(pam_console_t)
 dev_setattr_xserver_misc_dev(pam_console_t)
+
+dev_getattr_all_chr_files(pam_console_t)
+dev_setattr_all_chr_files(pam_console_t)
+
 dev_read_urand(pam_console_t)
 
 mls_file_read_all_levels(pam_console_t)
@@ -283,6 +302,11 @@
 	')
 ')
 
+optional_policy(`
+	# apache leaks file descriptors
+	apache_dontaudit_rw_tcp_sockets(system_chkpwd_t)
+')
+
 ########################################
 #
 # updpwd local policy
@@ -298,8 +322,10 @@
 files_manage_etc_files(updpwd_t)
 
 term_dontaudit_use_console(updpwd_t)
-term_dontaudit_use_console(updpwd_t)
+term_dontaudit_use_all_user_ptys(updpwd_t)
+term_dontaudit_use_all_user_ttys(updpwd_t)
 term_dontaudit_use_unallocated_ttys(updpwd_t)
+term_dontaudit_use_generic_ptys(updpwd_t)
 
 auth_manage_shadow(updpwd_t)
 auth_use_nsswitch(updpwd_t)
@@ -360,11 +386,6 @@
 ')
 
 optional_policy(`
-	# Allow utemper to write to /tmp/.xses-*
-	unconfined_write_tmp_files(utempter_t)
-')
-
-optional_policy(`
 	xserver_use_xdm_fds(utempter_t)
 	xserver_rw_xdm_pipes(utempter_t)
 ')
