xref: /third_party/selinux/libsepol/tests/policies/test-cond/refpolicy-base.conf

class security
class process
class system
class capability
class filesystem
class file
class dir
class fd
class lnk_file
class chr_file
class blk_file
class sock_file
class fifo_file
class socket
class tcp_socket
class udp_socket
class rawip_socket
class node
class netif
class netlink_socket
class packet_socket
class key_socket
class unix_stream_socket
class unix_dgram_socket
class sem
class msg
class msgq
class shm
class ipc
class passwd			# userspace
class drawable			# userspace
class window			# userspace
class gc			# userspace
class font			# userspace
class colormap			# userspace
class property			# userspace
class cursor			# userspace
class xclient			# userspace
class xinput			# userspace
class xserver			# userspace
class xextension		# userspace
class pax
class netlink_route_socket
class netlink_firewall_socket
class netlink_tcpdiag_socket
class netlink_nflog_socket
class netlink_xfrm_socket
class netlink_selinux_socket
class netlink_audit_socket
class netlink_ip6fw_socket
class netlink_dnrt_socket
class dbus			# userspace
class nscd			# userspace
class association
class netlink_kobject_uevent_socket
sid kernel
sid security
sid unlabeled
sid fs
sid file
sid file_labels
sid init
sid any_socket
sid port
sid netif
sid netmsg
sid node
sid igmp_packet
sid icmp_socket
sid tcp_socket
sid sysctl_modprobe
sid sysctl
sid sysctl_fs
sid sysctl_kernel
sid sysctl_net
sid sysctl_net_unix
sid sysctl_vm
sid sysctl_dev
sid kmod
sid policy
sid scmp_packet
sid devnull
common file
{
	ioctl
	read
	write
	create
	getattr
	setattr
	lock
	relabelfrom
	relabelto
	append
	unlink
	link
	rename
	execute
	swapon
	quotaon
	mounton
}
common socket
{
	ioctl
	read
	write
	create
	getattr
	setattr
	lock
	relabelfrom
	relabelto
	append
	bind
	connect
	listen
	accept
	getopt
	setopt
	shutdown
	recvfrom
	sendto
	recv_msg
	send_msg
	name_bind
}	
common ipc
{
	create
	destroy
	getattr
	setattr
	read
	write
	associate
	unix_read
	unix_write
}
class filesystem
{
	mount
	remount
	unmount
	getattr
	relabelfrom
	relabelto
	transition
	associate
	quotamod
	quotaget
}
class dir
inherits file
{
	add_name
	remove_name
	reparent
	search
	rmdir
}
class file
inherits file
{
	execute_no_trans
	entrypoint
	execmod
}
class lnk_file
inherits file
class chr_file
inherits file
{
	execute_no_trans
	entrypoint
	execmod
}
class blk_file
inherits file
class sock_file
inherits file
class fifo_file
inherits file
class fd
{
	use
}
class socket
inherits socket
class tcp_socket
inherits socket
{
	connectto
	newconn
	acceptfrom
	node_bind
	name_connect
}
class udp_socket
inherits socket
{
	node_bind
}
class rawip_socket
inherits socket
{
	node_bind
}
class node 
{
	tcp_recv
	tcp_send
	udp_recv
	udp_send
	rawip_recv
	rawip_send
	enforce_dest
}
class netif
{
	tcp_recv
	tcp_send
	udp_recv
	udp_send
	rawip_recv
	rawip_send
}
class netlink_socket
inherits socket
class packet_socket
inherits socket
class key_socket
inherits socket
class unix_stream_socket
inherits socket
{
	connectto
	newconn
	acceptfrom
}
class unix_dgram_socket
inherits socket
class process
{
	fork
	transition
	sigchld # commonly granted from child to parent
	sigkill # cannot be caught or ignored
	sigstop # cannot be caught or ignored
	signull # for kill(pid, 0)
	signal  # all other signals
	ptrace
	getsched
	setsched
	getsession
	getpgid
	setpgid
	getcap
	setcap
	share
	getattr
	setexec
	setfscreate
	noatsecure
	siginh
	setrlimit
	rlimitinh
	dyntransition
	setcurrent
	execmem
	execstack
	execheap
}
class ipc
inherits ipc
class sem
inherits ipc
class msgq
inherits ipc
{
	enqueue
}
class msg
{
	send
	receive
}
class shm
inherits ipc
{
	lock
}
class security
{
	compute_av
	compute_create
	compute_member
	check_context
	load_policy
	compute_relabel
	compute_user
	setenforce     # was avc_toggle in system class
	setbool
	setsecparam
	setcheckreqprot
}
class system
{
	ipc_info
	syslog_read  
	syslog_mod
	syslog_console
}
class capability
{
	chown           
	dac_override    
	dac_read_search 
	fowner          
	fsetid          
	kill            
	setgid           
	setuid           
	setpcap          
	linux_immutable  
	net_bind_service 
	net_broadcast    
	net_admin        
	net_raw          
	ipc_lock         
	ipc_owner        
	sys_module       
	sys_rawio        
	sys_chroot       
	sys_ptrace       
	sys_pacct        
	sys_admin        
	sys_boot         
	sys_nice         
	sys_resource     
	sys_time         
	sys_tty_config  
	mknod
	lease
	audit_write
	audit_control
}
class passwd
{
	passwd	# change another user passwd
	chfn	# change another user finger info
	chsh	# change another user shell
	rootok  # pam_rootok check (skip auth)
	crontab # crontab on another user
}
class drawable
{
	create
	destroy
	draw
	copy
	getattr
}
class gc
{
	create
	free
	getattr
	setattr
}
class window 
{
	addchild
	create
	destroy
	map
	unmap
	chstack
	chproplist
	chprop	
	listprop
	getattr
	setattr
	setfocus
	move
	chselection
	chparent
	ctrllife
	enumerate
	transparent
	mousemotion
	clientcomevent
	inputevent
	drawevent
	windowchangeevent
	windowchangerequest
	serverchangeevent
	extensionevent
}
class font
{
	load
	free
	getattr
	use
}
class colormap
{
	create
	free
	install
	uninstall
	list
	read
	store
	getattr
	setattr
}
class property
{
	create
	free
	read
	write
}
class cursor
{
	create
	createglyph
	free
	assign
	setattr
}
class xclient
{
	kill
}
class xinput
{
	lookup
	getattr
	setattr
	setfocus
	warppointer
	activegrab
	passivegrab
	ungrab
	bell
	mousemotion
	relabelinput
}
class xserver
{
	screensaver
	gethostlist
	sethostlist
	getfontpath
	setfontpath
	getattr
	grab
	ungrab
}
class xextension
{
	query
	use
}
class pax
{
	pageexec	# Paging based non-executable pages
	emutramp	# Emulate trampolines
	mprotect	# Restrict mprotect()
	randmmap	# Randomize mmap() base
	randexec	# Randomize ET_EXEC base
	segmexec	# Segmentation based non-executable pages
}
class netlink_route_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}
class netlink_firewall_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}
class netlink_tcpdiag_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}
class netlink_nflog_socket
inherits socket
class netlink_xfrm_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}
class netlink_selinux_socket
inherits socket
class netlink_audit_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
	nlmsg_relay
	nlmsg_readpriv
}
class netlink_ip6fw_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}
class netlink_dnrt_socket
inherits socket
class dbus
{
	acquire_svc
	send_msg
}
class nscd
{
	getpwd
	getgrp
	gethost
	getstat
	admin
	shmempwd
	shmemgrp
	shmemhost
}
class association
{
	sendto
	recvfrom
	setcontext
}
class netlink_kobject_uevent_socket
inherits socket
sensitivity s0;
dominance { s0 }
category c0; category c1; category c2; category c3;
category c4; category c5; category c6; category c7;
category c8; category c9; category c10; category c11;
category c12; category c13; category c14; category c15;
category c16; category c17; category c18; category c19;
category c20; category c21; category c22; category c23;
category c24; category c25; category c26; category c27;
category c28; category c29; category c30; category c31;
category c32; category c33; category c34; category c35;
category c36; category c37; category c38; category c39;
category c40; category c41; category c42; category c43;
category c44; category c45; category c46; category c47;
category c48; category c49; category c50; category c51;
category c52; category c53; category c54; category c55;
category c56; category c57; category c58; category c59;
category c60; category c61; category c62; category c63;
category c64; category c65; category c66; category c67;
category c68; category c69; category c70; category c71;
category c72; category c73; category c74; category c75;
category c76; category c77; category c78; category c79;
category c80; category c81; category c82; category c83;
category c84; category c85; category c86; category c87;
category c88; category c89; category c90; category c91;
category c92; category c93; category c94; category c95;
category c96; category c97; category c98; category c99;
category c100; category c101; category c102; category c103;
category c104; category c105; category c106; category c107;
category c108; category c109; category c110; category c111;
category c112; category c113; category c114; category c115;
category c116; category c117; category c118; category c119;
category c120; category c121; category c122; category c123;
category c124; category c125; category c126; category c127;
category c128; category c129; category c130; category c131;
category c132; category c133; category c134; category c135;
category c136; category c137; category c138; category c139;
category c140; category c141; category c142; category c143;
category c144; category c145; category c146; category c147;
category c148; category c149; category c150; category c151;
category c152; category c153; category c154; category c155;
category c156; category c157; category c158; category c159;
category c160; category c161; category c162; category c163;
category c164; category c165; category c166; category c167;
category c168; category c169; category c170; category c171;
category c172; category c173; category c174; category c175;
category c176; category c177; category c178; category c179;
category c180; category c181; category c182; category c183;
category c184; category c185; category c186; category c187;
category c188; category c189; category c190; category c191;
category c192; category c193; category c194; category c195;
category c196; category c197; category c198; category c199;
category c200; category c201; category c202; category c203;
category c204; category c205; category c206; category c207;
category c208; category c209; category c210; category c211;
category c212; category c213; category c214; category c215;
category c216; category c217; category c218; category c219;
category c220; category c221; category c222; category c223;
category c224; category c225; category c226; category c227;
category c228; category c229; category c230; category c231;
category c232; category c233; category c234; category c235;
category c236; category c237; category c238; category c239;
category c240; category c241; category c242; category c243;
category c244; category c245; category c246; category c247;
category c248; category c249; category c250; category c251;
category c252; category c253; category c254; category c255;
level s0:c0.c255;
mlsconstrain file { write setattr append unlink link rename
		    ioctl lock execute relabelfrom } (h1 dom h2);
mlsconstrain file { create relabelto } ((h1 dom h2) and (l2 eq h2));
mlsconstrain file { read } ((h1 dom h2) or ( t2 == domain ) or ( t1 == mlsfileread ));
mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
	( h1 dom h2 );
mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file } { create relabelto }
	(( h1 dom h2 ) and ( l2 eq h2 ));
mlsconstrain process { ptrace } ( h1 dom h2 );
mlsconstrain process { sigkill sigstop } ( h1 dom h2 ) or
		( t1 == mcskillall );
mlsconstrain xextension query ( t1 == mlsfileread );
attribute netif_type;
attribute node_type;
attribute port_type;
attribute reserved_port_type;
attribute device_node;
attribute memory_raw_read;
attribute memory_raw_write;
attribute domain;
attribute unconfined_domain_type;
attribute set_curr_context;
attribute entry_type;
attribute privfd;
attribute can_change_process_identity;
attribute can_change_process_role;
attribute can_change_object_identity;
attribute can_system_change;
attribute process_user_target;
attribute cron_source_domain;
attribute cron_job_domain;
attribute process_uncond_exempt;	# add userhelperdomain to this one
attribute file_type;
attribute lockfile;
attribute mountpoint;
attribute pidfile;
attribute polydir;
attribute usercanread;
attribute polyparent;
attribute polymember;
attribute security_file_type;
attribute tmpfile;
attribute tmpfsfile;
attribute filesystem_type;
attribute noxattrfs;
attribute can_load_kernmodule;
attribute can_receive_kernel_messages;
attribute kern_unconfined;
attribute proc_type;
attribute sysctl_type;
attribute mcskillall;
attribute mlsfileread;
attribute mlsfilereadtoclr;
attribute mlsfilewrite;
attribute mlsfilewritetoclr;
attribute mlsfileupgrade;
attribute mlsfiledowngrade;
attribute mlsnetread;
attribute mlsnetreadtoclr;
attribute mlsnetwrite;
attribute mlsnetwritetoclr;
attribute mlsnetupgrade;
attribute mlsnetdowngrade;
attribute mlsnetrecvall;
attribute mlsipcread;
attribute mlsipcreadtoclr;
attribute mlsipcwrite;
attribute mlsipcwritetoclr;
attribute mlsprocread;
attribute mlsprocreadtoclr;
attribute mlsprocwrite;
attribute mlsprocwritetoclr;
attribute mlsprocsetsl;
attribute mlsxwinread;
attribute mlsxwinreadtoclr;
attribute mlsxwinwrite;
attribute mlsxwinwritetoclr;
attribute mlsxwinreadproperty;
attribute mlsxwinwriteproperty;
attribute mlsxwinreadcolormap;
attribute mlsxwinwritecolormap;
attribute mlsxwinwritexinput;
attribute mlstrustedobject;
attribute privrangetrans;
attribute mlsrangetrans;
attribute can_load_policy;
attribute can_setenforce;
attribute can_setsecparam;
attribute ttynode;
attribute ptynode;
attribute server_ptynode;
attribute serial_device;
type bin_t;
type sbin_t;
type ls_exec_t;
type shell_exec_t;
type chroot_exec_t;
type ppp_device_t;
type tun_tap_device_t;
type port_t, port_type;
type reserved_port_t, port_type, reserved_port_type;
type afs_bos_port_t, port_type;
type afs_fs_port_t, port_type;
type afs_ka_port_t, port_type;
type afs_pt_port_t, port_type;
type afs_vl_port_t, port_type;
type amanda_port_t, port_type;
type amavisd_recv_port_t, port_type;
type amavisd_send_port_t, port_type;
type asterisk_port_t, port_type;
type auth_port_t, port_type;
type bgp_port_t, port_type;
type biff_port_t, port_type, reserved_port_type; 
type clamd_port_t, port_type;
type clockspeed_port_t, port_type;
type comsat_port_t, port_type;
type cvs_port_t, port_type;
type dcc_port_t, port_type;
type dbskkd_port_t, port_type;
type dhcpc_port_t, port_type;
type dhcpd_port_t, port_type;
type dict_port_t, port_type;
type distccd_port_t, port_type;
type dns_port_t, port_type;
type fingerd_port_t, port_type;
type ftp_data_port_t, port_type;
type ftp_port_t, port_type;
type gatekeeper_port_t, port_type;
type giftd_port_t, port_type;
type gopher_port_t, port_type;
type http_cache_port_t, port_type;
type http_port_t, port_type;
type howl_port_t, port_type;
type hplip_port_t, port_type;
type i18n_input_port_t, port_type;
type imaze_port_t, port_type;
type inetd_child_port_t, port_type;
type innd_port_t, port_type;
type ipp_port_t, port_type;
type ircd_port_t, port_type;
type isakmp_port_t, port_type;
type jabber_client_port_t, port_type;
type jabber_interserver_port_t, port_type;
type kerberos_admin_port_t, port_type;
type kerberos_master_port_t, port_type;
type kerberos_port_t, port_type;
type ktalkd_port_t, port_type;
type ldap_port_t, port_type;
type lrrd_port_t, port_type; 
type mail_port_t, port_type;
type monopd_port_t, port_type;
type mysqld_port_t, port_type;
type nessus_port_t, port_type;
type nmbd_port_t, port_type;
type ntp_port_t, port_type;
type openvpn_port_t, port_type;
type pegasus_http_port_t, port_type;
type pegasus_https_port_t, port_type;
type pop_port_t, port_type;
type portmap_port_t, port_type;
type postgresql_port_t, port_type;
type postgrey_port_t, port_type;
type printer_port_t, port_type;
type ptal_port_t, port_type;
type pxe_port_t, port_type;
type pyzor_port_t, port_type;
type radacct_port_t, port_type;
type radius_port_t, port_type;
type razor_port_t, port_type;
type rlogind_port_t, port_type;
type rndc_port_t, port_type;
type router_port_t, port_type;
type rsh_port_t, port_type;
type rsync_port_t, port_type;
type smbd_port_t, port_type;
type smtp_port_t, port_type;
type snmp_port_t, port_type;
type spamd_port_t, port_type;
type ssh_port_t, port_type;
type soundd_port_t, port_type;
type socks_port_t, port_type; type stunnel_port_t, port_type; 
type swat_port_t, port_type;
type syslogd_port_t, port_type;
type telnetd_port_t, port_type;
type tftp_port_t, port_type;
type transproxy_port_t, port_type;
type utcpserver_port_t, port_type; 
type uucpd_port_t, port_type;
type vnc_port_t, port_type;
type xserver_port_t, port_type;
type xen_port_t, port_type;
type zebra_port_t, port_type;
type zope_port_t, port_type;
type node_t, node_type;
type compat_ipv4_node_t alias node_compat_ipv4_t, node_type;
type inaddr_any_node_t alias node_inaddr_any_t, node_type;
type node_internal_t, node_type; 
type link_local_node_t alias node_link_local_t, node_type;
type lo_node_t alias node_lo_t, node_type;
type mapped_ipv4_node_t alias node_mapped_ipv4_t, node_type;
type multicast_node_t alias node_multicast_t, node_type;
type site_local_node_t alias node_site_local_t, node_type;
type unspec_node_t alias node_unspec_t, node_type;
type netif_t, netif_type;
type device_t;
type agp_device_t;
type apm_bios_t;
type cardmgr_dev_t;
type clock_device_t;
type cpu_device_t;
type crypt_device_t;
type dri_device_t;
type event_device_t;
type framebuf_device_t;
type lvm_control_t;
type memory_device_t;
type misc_device_t;
type mouse_device_t;
type mtrr_device_t;
type null_device_t;
type power_device_t;
type printer_device_t;
type random_device_t;
type scanner_device_t;
type sound_device_t;
type sysfs_t;
type urandom_device_t;
type usbfs_t alias usbdevfs_t;
type usb_device_t;
type v4l_device_t;
type xserver_misc_device_t;
type zero_device_t;
type xconsole_device_t;
type devfs_control_t;
type boot_t;
type default_t, file_type, mountpoint;
type etc_t, file_type;
type etc_runtime_t, file_type;
type file_t, file_type, mountpoint;
type home_root_t, file_type, mountpoint;
type lost_found_t, file_type;
type mnt_t, file_type, mountpoint;
type modules_object_t;
type no_access_t, file_type;
type poly_t, file_type;
type readable_t, file_type;
type root_t, file_type, mountpoint;
type src_t, file_type, mountpoint;
type system_map_t;
type tmp_t, mountpoint; #, polydir
type usr_t, file_type, mountpoint;
type var_t, file_type, mountpoint;
type var_lib_t, file_type, mountpoint;
type var_lock_t, file_type, lockfile;
type var_run_t, file_type, pidfile;
type var_spool_t;
type fs_t;
type bdev_t;
type binfmt_misc_fs_t;
type capifs_t;
type configfs_t;
type eventpollfs_t;
type futexfs_t;
type hugetlbfs_t;
type inotifyfs_t;
type nfsd_fs_t;
type ramfs_t;
type romfs_t;
type rpc_pipefs_t;
type tmpfs_t;
type autofs_t, noxattrfs;
type cifs_t alias sambafs_t, noxattrfs;
type dosfs_t, noxattrfs;
type iso9660_t, filesystem_type, noxattrfs;
type removable_t, noxattrfs;
type nfs_t, filesystem_type, noxattrfs;
type kernel_t, can_load_kernmodule;
type debugfs_t;
type proc_t, proc_type;
type proc_kmsg_t, proc_type;
type proc_kcore_t, proc_type;
type proc_mdstat_t, proc_type;
type proc_net_t, proc_type;
type proc_xen_t, proc_type;
type sysctl_t, sysctl_type;
type sysctl_irq_t, sysctl_type;
type sysctl_rpc_t, sysctl_type;
type sysctl_fs_t, sysctl_type;
type sysctl_kernel_t, sysctl_type;
type sysctl_modprobe_t, sysctl_type;
type sysctl_hotplug_t, sysctl_type;
type sysctl_net_t, sysctl_type;
type sysctl_net_unix_t, sysctl_type;
type sysctl_vm_t, sysctl_type;
type sysctl_dev_t, sysctl_type;
type unlabeled_t;
type auditd_exec_t;
type crond_exec_t;
type cupsd_exec_t;
type getty_t;
type init_t;
type init_exec_t;
type initrc_t;
type initrc_exec_t;
type login_exec_t;
type sshd_exec_t;
type su_exec_t;
type udev_exec_t;
type unconfined_t;
type xdm_exec_t;
type lvm_exec_t;
type security_t;
type bsdpty_device_t;
type console_device_t;
type devpts_t;
type devtty_t;
type ptmx_t;
type tty_device_t, serial_device;
type usbtty_device_t, serial_device;
	bool secure_mode false;
	bool secure_mode_insmod false;
	bool secure_mode_policyload false;
		bool allow_cvs_read_shadow false;
		bool allow_execheap false;
		bool allow_execmem true;
		bool allow_execmod false;
		bool allow_execstack true;
		bool allow_ftpd_anon_write false;
		bool allow_gssd_read_tmp true;
		bool allow_httpd_anon_write false;
		bool allow_java_execstack false;
		bool allow_kerberos true;
		bool allow_rsync_anon_write false;
		bool allow_saslauthd_read_shadow false;
		bool allow_smbd_anon_write false;
		bool allow_ptrace false;
		bool allow_ypbind false;
		bool fcron_crond false;
		bool ftp_home_dir false;
		bool ftpd_is_daemon true;
		bool httpd_builtin_scripting true;
		bool httpd_can_network_connect false;
		bool httpd_can_network_connect_db false;
		bool httpd_can_network_relay false;
		bool httpd_enable_cgi true;
		bool httpd_enable_ftp_server false;
		bool httpd_enable_homedirs true;
		bool httpd_ssi_exec true;
		bool httpd_tty_comm false;
		bool httpd_unified true;
		bool named_write_master_zones false;
		bool nfs_export_all_rw true;
		bool nfs_export_all_ro true;
		bool pppd_can_insmod false;
		bool read_default_t true;
		bool run_ssh_inetd false;
		bool samba_enable_home_dirs false;
		bool spamassasin_can_network false;
		bool squid_connect_any false;
		bool ssh_sysadm_login false;
		bool stunnel_is_daemon false;
		bool use_nfs_home_dirs false;
		bool use_samba_home_dirs false;
		bool user_ping true;
		bool spamd_enable_home_dirs true;
	allow bin_t fs_t:filesystem associate;
	allow bin_t noxattrfs:filesystem associate;
	typeattribute bin_t file_type;
	allow sbin_t fs_t:filesystem associate;
	allow sbin_t noxattrfs:filesystem associate;
	typeattribute sbin_t file_type;
	allow ls_exec_t fs_t:filesystem associate;
	allow ls_exec_t noxattrfs:filesystem associate;
	typeattribute ls_exec_t file_type;
typeattribute ls_exec_t entry_type;
	allow shell_exec_t fs_t:filesystem associate;
	allow shell_exec_t noxattrfs:filesystem associate;
	typeattribute shell_exec_t file_type;
	allow chroot_exec_t fs_t:filesystem associate;
	allow chroot_exec_t noxattrfs:filesystem associate;
	typeattribute chroot_exec_t file_type;
	typeattribute ppp_device_t device_node;
	allow ppp_device_t fs_t:filesystem associate;
	allow ppp_device_t tmpfs_t:filesystem associate;
	allow ppp_device_t tmp_t:filesystem associate;
	typeattribute tun_tap_device_t device_node;
	allow tun_tap_device_t fs_t:filesystem associate;
	allow tun_tap_device_t tmpfs_t:filesystem associate;
	allow tun_tap_device_t tmp_t:filesystem associate;
typeattribute auth_port_t reserved_port_type;
typeattribute bgp_port_t reserved_port_type;
typeattribute bgp_port_t reserved_port_type;
typeattribute comsat_port_t reserved_port_type;
typeattribute dhcpc_port_t reserved_port_type;
typeattribute dhcpd_port_t reserved_port_type;
typeattribute dhcpd_port_t reserved_port_type;
typeattribute dhcpd_port_t reserved_port_type;
typeattribute dhcpd_port_t reserved_port_type;
typeattribute dhcpd_port_t reserved_port_type;
typeattribute dns_port_t reserved_port_type;
typeattribute dns_port_t reserved_port_type;
typeattribute fingerd_port_t reserved_port_type;
typeattribute ftp_data_port_t reserved_port_type;
typeattribute ftp_port_t reserved_port_type;
typeattribute gopher_port_t reserved_port_type;
typeattribute gopher_port_t reserved_port_type;
typeattribute http_port_t reserved_port_type;
typeattribute http_port_t reserved_port_type;
typeattribute http_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute inetd_child_port_t reserved_port_type;
typeattribute innd_port_t reserved_port_type;
typeattribute ipp_port_t reserved_port_type;
typeattribute ipp_port_t reserved_port_type;
typeattribute isakmp_port_t reserved_port_type;
typeattribute kerberos_admin_port_t reserved_port_type;
typeattribute kerberos_admin_port_t reserved_port_type;
typeattribute kerberos_admin_port_t reserved_port_type;
typeattribute kerberos_port_t reserved_port_type;
typeattribute kerberos_port_t reserved_port_type;
typeattribute kerberos_port_t reserved_port_type;
typeattribute kerberos_port_t reserved_port_type;
typeattribute ktalkd_port_t reserved_port_type;
typeattribute ktalkd_port_t reserved_port_type;
typeattribute ldap_port_t reserved_port_type;
typeattribute ldap_port_t reserved_port_type;
typeattribute ldap_port_t reserved_port_type;
typeattribute ldap_port_t reserved_port_type;
typeattribute nmbd_port_t reserved_port_type;
typeattribute nmbd_port_t reserved_port_type;
typeattribute nmbd_port_t reserved_port_type;
typeattribute ntp_port_t reserved_port_type;
typeattribute pop_port_t reserved_port_type;
typeattribute pop_port_t reserved_port_type;
typeattribute pop_port_t reserved_port_type;
typeattribute pop_port_t reserved_port_type;
typeattribute pop_port_t reserved_port_type;
typeattribute pop_port_t reserved_port_type;
typeattribute pop_port_t reserved_port_type;
typeattribute portmap_port_t reserved_port_type;
typeattribute portmap_port_t reserved_port_type;
typeattribute printer_port_t reserved_port_type;
typeattribute rlogind_port_t reserved_port_type;
typeattribute rndc_port_t reserved_port_type;
typeattribute router_port_t reserved_port_type;
typeattribute rsh_port_t reserved_port_type;
typeattribute rsync_port_t reserved_port_type;
typeattribute rsync_port_t reserved_port_type;
typeattribute smbd_port_t reserved_port_type;
typeattribute smbd_port_t reserved_port_type;
typeattribute smtp_port_t reserved_port_type;
typeattribute smtp_port_t reserved_port_type;
typeattribute smtp_port_t reserved_port_type;
typeattribute snmp_port_t reserved_port_type;
typeattribute snmp_port_t reserved_port_type;
typeattribute snmp_port_t reserved_port_type;
typeattribute spamd_port_t reserved_port_type;
typeattribute ssh_port_t reserved_port_type;
typeattribute swat_port_t reserved_port_type;
typeattribute syslogd_port_t reserved_port_type;
typeattribute telnetd_port_t reserved_port_type;
typeattribute tftp_port_t reserved_port_type;
typeattribute uucpd_port_t reserved_port_type;
	allow device_t tmpfs_t:filesystem associate;
	allow device_t fs_t:filesystem associate;
	allow device_t noxattrfs:filesystem associate;
	typeattribute device_t file_type;
	allow device_t fs_t:filesystem associate;
	allow device_t noxattrfs:filesystem associate;
	typeattribute device_t file_type;
	typeattribute device_t mountpoint;
	allow device_t tmp_t:filesystem associate;
	typeattribute agp_device_t device_node;
	allow agp_device_t fs_t:filesystem associate;
	allow agp_device_t tmpfs_t:filesystem associate;
	allow agp_device_t tmp_t:filesystem associate;
	typeattribute apm_bios_t device_node;
	allow apm_bios_t fs_t:filesystem associate;
	allow apm_bios_t tmpfs_t:filesystem associate;
	allow apm_bios_t tmp_t:filesystem associate;
	typeattribute cardmgr_dev_t device_node;
	allow cardmgr_dev_t fs_t:filesystem associate;
	allow cardmgr_dev_t tmpfs_t:filesystem associate;
	allow cardmgr_dev_t tmp_t:filesystem associate;
	allow cardmgr_dev_t fs_t:filesystem associate;
	allow cardmgr_dev_t noxattrfs:filesystem associate;
	typeattribute cardmgr_dev_t file_type;
	allow cardmgr_dev_t fs_t:filesystem associate;
	allow cardmgr_dev_t noxattrfs:filesystem associate;
	typeattribute cardmgr_dev_t file_type;
	typeattribute cardmgr_dev_t polymember;
	allow cardmgr_dev_t tmpfs_t:filesystem associate;
	typeattribute cardmgr_dev_t tmpfile;
	allow cardmgr_dev_t tmp_t:filesystem associate;
	typeattribute clock_device_t device_node;
	allow clock_device_t fs_t:filesystem associate;
	allow clock_device_t tmpfs_t:filesystem associate;
	allow clock_device_t tmp_t:filesystem associate;
	typeattribute cpu_device_t device_node;
	allow cpu_device_t fs_t:filesystem associate;
	allow cpu_device_t tmpfs_t:filesystem associate;
	allow cpu_device_t tmp_t:filesystem associate;
	typeattribute crypt_device_t device_node;
	allow crypt_device_t fs_t:filesystem associate;
	allow crypt_device_t tmpfs_t:filesystem associate;
	allow crypt_device_t tmp_t:filesystem associate;
	typeattribute dri_device_t device_node;
	allow dri_device_t fs_t:filesystem associate;
	allow dri_device_t tmpfs_t:filesystem associate;
	allow dri_device_t tmp_t:filesystem associate;
	typeattribute event_device_t device_node;
	allow event_device_t fs_t:filesystem associate;
	allow event_device_t tmpfs_t:filesystem associate;
	allow event_device_t tmp_t:filesystem associate;
	typeattribute framebuf_device_t device_node;
	allow framebuf_device_t fs_t:filesystem associate;
	allow framebuf_device_t tmpfs_t:filesystem associate;
	allow framebuf_device_t tmp_t:filesystem associate;
	typeattribute lvm_control_t device_node;
	allow lvm_control_t fs_t:filesystem associate;
	allow lvm_control_t tmpfs_t:filesystem associate;
	allow lvm_control_t tmp_t:filesystem associate;
	typeattribute memory_device_t device_node;
	allow memory_device_t fs_t:filesystem associate;
	allow memory_device_t tmpfs_t:filesystem associate;
	allow memory_device_t tmp_t:filesystem associate;
neverallow ~memory_raw_read memory_device_t:{ chr_file blk_file } read;
neverallow ~memory_raw_write memory_device_t:{ chr_file blk_file } { append write };
	typeattribute misc_device_t device_node;
	allow misc_device_t fs_t:filesystem associate;
	allow misc_device_t tmpfs_t:filesystem associate;
	allow misc_device_t tmp_t:filesystem associate;
	typeattribute mouse_device_t device_node;
	allow mouse_device_t fs_t:filesystem associate;
	allow mouse_device_t tmpfs_t:filesystem associate;
	allow mouse_device_t tmp_t:filesystem associate;
	typeattribute mtrr_device_t device_node;
	allow mtrr_device_t fs_t:filesystem associate;
	allow mtrr_device_t tmpfs_t:filesystem associate;
	allow mtrr_device_t tmp_t:filesystem associate;
	typeattribute null_device_t device_node;
	allow null_device_t fs_t:filesystem associate;
	allow null_device_t tmpfs_t:filesystem associate;
	allow null_device_t tmp_t:filesystem associate;
	typeattribute null_device_t mlstrustedobject;
	typeattribute power_device_t device_node;
	allow power_device_t fs_t:filesystem associate;
	allow power_device_t tmpfs_t:filesystem associate;
	allow power_device_t tmp_t:filesystem associate;
	typeattribute printer_device_t device_node;
	allow printer_device_t fs_t:filesystem associate;
	allow printer_device_t tmpfs_t:filesystem associate;
	allow printer_device_t tmp_t:filesystem associate;
	typeattribute random_device_t device_node;
	allow random_device_t fs_t:filesystem associate;
	allow random_device_t tmpfs_t:filesystem associate;
	allow random_device_t tmp_t:filesystem associate;
	typeattribute scanner_device_t device_node;
	allow scanner_device_t fs_t:filesystem associate;
	allow scanner_device_t tmpfs_t:filesystem associate;
	allow scanner_device_t tmp_t:filesystem associate;
	typeattribute sound_device_t device_node;
	allow sound_device_t fs_t:filesystem associate;
	allow sound_device_t tmpfs_t:filesystem associate;
	allow sound_device_t tmp_t:filesystem associate;
	allow sysfs_t fs_t:filesystem associate;
	allow sysfs_t noxattrfs:filesystem associate;
	typeattribute sysfs_t file_type;
	typeattribute sysfs_t mountpoint;
	typeattribute sysfs_t filesystem_type;
	allow sysfs_t self:filesystem associate;
	typeattribute urandom_device_t device_node;
	allow urandom_device_t fs_t:filesystem associate;
	allow urandom_device_t tmpfs_t:filesystem associate;
	allow urandom_device_t tmp_t:filesystem associate;
	allow usbfs_t fs_t:filesystem associate;
	allow usbfs_t noxattrfs:filesystem associate;
	typeattribute usbfs_t file_type;
	typeattribute usbfs_t mountpoint;
	typeattribute usbfs_t filesystem_type;
	allow usbfs_t self:filesystem associate;
	typeattribute usbfs_t noxattrfs;
	typeattribute usb_device_t device_node;
	allow usb_device_t fs_t:filesystem associate;
	allow usb_device_t tmpfs_t:filesystem associate;
	allow usb_device_t tmp_t:filesystem associate;
	typeattribute v4l_device_t device_node;
	allow v4l_device_t fs_t:filesystem associate;
	allow v4l_device_t tmpfs_t:filesystem associate;
	allow v4l_device_t tmp_t:filesystem associate;
	typeattribute xserver_misc_device_t device_node;
	allow xserver_misc_device_t fs_t:filesystem associate;
	allow xserver_misc_device_t tmpfs_t:filesystem associate;
	allow xserver_misc_device_t tmp_t:filesystem associate;
	typeattribute zero_device_t device_node;
	allow zero_device_t fs_t:filesystem associate;
	allow zero_device_t tmpfs_t:filesystem associate;
	allow zero_device_t tmp_t:filesystem associate;
	typeattribute zero_device_t mlstrustedobject;
	allow xconsole_device_t fs_t:filesystem associate;
	allow xconsole_device_t noxattrfs:filesystem associate;
	typeattribute xconsole_device_t file_type;
	allow xconsole_device_t tmpfs_t:filesystem associate;
	allow xconsole_device_t tmp_t:filesystem associate;
	typeattribute devfs_control_t device_node;
	allow devfs_control_t fs_t:filesystem associate;
	allow devfs_control_t tmpfs_t:filesystem associate;
	allow devfs_control_t tmp_t:filesystem associate;
neverallow domain ~domain:process { transition dyntransition };
neverallow { domain -set_curr_context } self:process setcurrent;
neverallow { domain unlabeled_t } ~{ domain unlabeled_t }:process *;
neverallow ~{ domain unlabeled_t } *:process *;
allow file_type self:filesystem associate;
	allow boot_t fs_t:filesystem associate;
	allow boot_t noxattrfs:filesystem associate;
	typeattribute boot_t file_type;
	allow boot_t fs_t:filesystem associate;
	allow boot_t noxattrfs:filesystem associate;
	typeattribute boot_t file_type;
	typeattribute boot_t mountpoint;
	allow default_t fs_t:filesystem associate;
	allow default_t noxattrfs:filesystem associate;
	allow etc_t fs_t:filesystem associate;
	allow etc_t noxattrfs:filesystem associate;
	allow etc_runtime_t fs_t:filesystem associate;
	allow etc_runtime_t noxattrfs:filesystem associate;
	allow file_t fs_t:filesystem associate;
	allow file_t noxattrfs:filesystem associate;
	allow kernel_t file_t:dir mounton;
	allow home_root_t fs_t:filesystem associate;
	allow home_root_t noxattrfs:filesystem associate;
	allow home_root_t fs_t:filesystem associate;
	allow home_root_t noxattrfs:filesystem associate;
	typeattribute home_root_t file_type;
	typeattribute home_root_t polyparent;
	allow lost_found_t fs_t:filesystem associate;
	allow lost_found_t noxattrfs:filesystem associate;
	allow mnt_t fs_t:filesystem associate;
	allow mnt_t noxattrfs:filesystem associate;
	allow modules_object_t fs_t:filesystem associate;
	allow modules_object_t noxattrfs:filesystem associate;
	typeattribute modules_object_t file_type;
	allow no_access_t fs_t:filesystem associate;
	allow no_access_t noxattrfs:filesystem associate;
	allow poly_t fs_t:filesystem associate;
	allow poly_t noxattrfs:filesystem associate;
	allow readable_t fs_t:filesystem associate;
	allow readable_t noxattrfs:filesystem associate;
	allow root_t fs_t:filesystem associate;
	allow root_t noxattrfs:filesystem associate;
	allow root_t fs_t:filesystem associate;
	allow root_t noxattrfs:filesystem associate;
	typeattribute root_t file_type;
	typeattribute root_t polyparent;
	allow kernel_t root_t:dir mounton;
	allow src_t fs_t:filesystem associate;
	allow src_t noxattrfs:filesystem associate;
	allow system_map_t fs_t:filesystem associate;
	allow system_map_t noxattrfs:filesystem associate;
	typeattribute system_map_t file_type;
	allow tmp_t fs_t:filesystem associate;
	allow tmp_t noxattrfs:filesystem associate;
	typeattribute tmp_t file_type;
	allow tmp_t fs_t:filesystem associate;
	allow tmp_t noxattrfs:filesystem associate;
	typeattribute tmp_t file_type;
	typeattribute tmp_t polymember;
	allow tmp_t tmpfs_t:filesystem associate;
	typeattribute tmp_t tmpfile;
	allow tmp_t tmp_t:filesystem associate;
	allow tmp_t fs_t:filesystem associate;
	allow tmp_t noxattrfs:filesystem associate;
	typeattribute tmp_t file_type;
	typeattribute tmp_t polyparent;
	allow usr_t fs_t:filesystem associate;
	allow usr_t noxattrfs:filesystem associate;
	allow var_t fs_t:filesystem associate;
	allow var_t noxattrfs:filesystem associate;
	allow var_lib_t fs_t:filesystem associate;
	allow var_lib_t noxattrfs:filesystem associate;
	allow var_lock_t fs_t:filesystem associate;
	allow var_lock_t noxattrfs:filesystem associate;
	allow var_run_t fs_t:filesystem associate;
	allow var_run_t noxattrfs:filesystem associate;
	allow var_spool_t fs_t:filesystem associate;
	allow var_spool_t noxattrfs:filesystem associate;
	typeattribute var_spool_t file_type;
	allow var_spool_t fs_t:filesystem associate;
	allow var_spool_t noxattrfs:filesystem associate;
	typeattribute var_spool_t file_type;
	typeattribute var_spool_t polymember;
	allow var_spool_t tmpfs_t:filesystem associate;
	typeattribute var_spool_t tmpfile;
	allow var_spool_t tmp_t:filesystem associate;
	typeattribute fs_t filesystem_type;
	allow fs_t self:filesystem associate;
	typeattribute bdev_t filesystem_type;
	allow bdev_t self:filesystem associate;
	typeattribute binfmt_misc_fs_t filesystem_type;
	allow binfmt_misc_fs_t self:filesystem associate;
	allow binfmt_misc_fs_t fs_t:filesystem associate;
	allow binfmt_misc_fs_t noxattrfs:filesystem associate;
	typeattribute binfmt_misc_fs_t file_type;
	typeattribute binfmt_misc_fs_t mountpoint;
	typeattribute capifs_t filesystem_type;
	allow capifs_t self:filesystem associate;
	typeattribute configfs_t filesystem_type;
	allow configfs_t self:filesystem associate;
	typeattribute eventpollfs_t filesystem_type;
	allow eventpollfs_t self:filesystem associate;
	typeattribute futexfs_t filesystem_type;
	allow futexfs_t self:filesystem associate;
	typeattribute hugetlbfs_t filesystem_type;
	allow hugetlbfs_t self:filesystem associate;
	allow hugetlbfs_t fs_t:filesystem associate;
	allow hugetlbfs_t noxattrfs:filesystem associate;
	typeattribute hugetlbfs_t file_type;
	typeattribute hugetlbfs_t mountpoint;
	typeattribute inotifyfs_t filesystem_type;
	allow inotifyfs_t self:filesystem associate;
	typeattribute nfsd_fs_t filesystem_type;
	allow nfsd_fs_t self:filesystem associate;
	typeattribute ramfs_t filesystem_type;
	allow ramfs_t self:filesystem associate;
	typeattribute romfs_t filesystem_type;
	allow romfs_t self:filesystem associate;
	typeattribute rpc_pipefs_t filesystem_type;
	allow rpc_pipefs_t self:filesystem associate;
	typeattribute tmpfs_t filesystem_type;
	allow tmpfs_t self:filesystem associate;
	allow tmpfs_t fs_t:filesystem associate;
	allow tmpfs_t noxattrfs:filesystem associate;
	typeattribute tmpfs_t file_type;
	allow tmpfs_t fs_t:filesystem associate;
	allow tmpfs_t noxattrfs:filesystem associate;
	typeattribute tmpfs_t file_type;
	typeattribute tmpfs_t mountpoint;
allow tmpfs_t noxattrfs:filesystem associate;
	typeattribute autofs_t filesystem_type;
	allow autofs_t self:filesystem associate;
	allow autofs_t fs_t:filesystem associate;
	allow autofs_t noxattrfs:filesystem associate;
	typeattribute autofs_t file_type;
	typeattribute autofs_t mountpoint;
	typeattribute cifs_t filesystem_type;
	allow cifs_t self:filesystem associate;
	typeattribute dosfs_t filesystem_type;
	allow dosfs_t self:filesystem associate;
allow dosfs_t fs_t:filesystem associate;
	typeattribute iso9660_t filesystem_type;
	allow iso9660_t self:filesystem associate;
allow removable_t noxattrfs:filesystem associate;
	typeattribute removable_t filesystem_type;
	allow removable_t self:filesystem associate;
	allow removable_t fs_t:filesystem associate;
	allow removable_t noxattrfs:filesystem associate;
	typeattribute removable_t file_type;
	typeattribute removable_t usercanread;
	typeattribute nfs_t filesystem_type;
	allow nfs_t self:filesystem associate;
	allow nfs_t fs_t:filesystem associate;
	allow nfs_t noxattrfs:filesystem associate;
	typeattribute nfs_t file_type;
	typeattribute nfs_t mountpoint;
neverallow ~can_load_kernmodule self:capability sys_module;
role system_r;
role sysadm_r;
role staff_r;
role user_r;
role secadm_r;
	typeattribute kernel_t domain;
	allow kernel_t self:dir { read getattr lock search ioctl };
	allow kernel_t self:lnk_file { read getattr lock ioctl };
	allow kernel_t self:file { getattr read write append ioctl lock };
	allow kernel_t self:process { fork sigchld };
		role secadm_r types kernel_t;
		role sysadm_r types kernel_t;
		role user_r types kernel_t;
		role staff_r types kernel_t;
	typeattribute kernel_t privrangetrans;
role system_r types kernel_t;
	typeattribute debugfs_t filesystem_type;
	allow debugfs_t self:filesystem associate;
allow debugfs_t self:filesystem associate;
	allow proc_t fs_t:filesystem associate;
	allow proc_t noxattrfs:filesystem associate;
	typeattribute proc_t file_type;
	typeattribute proc_t mountpoint;
	typeattribute proc_t filesystem_type;
	allow proc_t self:filesystem associate;
neverallow ~can_receive_kernel_messages proc_kmsg_t:file ~getattr;
neverallow { domain -kern_unconfined } proc_kcore_t:file ~getattr;
	allow sysctl_t fs_t:filesystem associate;
	allow sysctl_t noxattrfs:filesystem associate;
	typeattribute sysctl_t file_type;
	typeattribute sysctl_t mountpoint;
	allow sysctl_fs_t fs_t:filesystem associate;
	allow sysctl_fs_t noxattrfs:filesystem associate;
	typeattribute sysctl_fs_t file_type;
	typeattribute sysctl_fs_t mountpoint;
allow kernel_t self:capability *;
allow kernel_t unlabeled_t:dir mounton;
allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow kernel_t self:shm { associate getattr setattr create destroy read write lock unix_read unix_write };
allow kernel_t self:sem { associate getattr setattr create destroy read write unix_read unix_write };
allow kernel_t self:msg { send receive };
allow kernel_t self:msgq { associate getattr setattr create destroy read write enqueue unix_read unix_write };
allow kernel_t self:unix_dgram_socket { create { ioctl read getattr write setattr append bind connect getopt setopt shutdown } };
allow kernel_t self:unix_stream_socket { { create { ioctl read getattr write setattr append bind connect getopt setopt shutdown } } listen accept };
allow kernel_t self:unix_dgram_socket sendto;
allow kernel_t self:unix_stream_socket connectto;
allow kernel_t self:fifo_file { getattr read write append ioctl lock };
allow kernel_t self:sock_file { read getattr lock ioctl };
allow kernel_t self:fd use;
allow kernel_t proc_t:dir { read getattr lock search ioctl };
allow kernel_t proc_t:{ lnk_file file } { read getattr lock ioctl };
allow kernel_t proc_net_t:dir { read getattr lock search ioctl };
allow kernel_t proc_net_t:file { read getattr lock ioctl };
allow kernel_t proc_mdstat_t:file { read getattr lock ioctl };
allow kernel_t proc_kcore_t:file getattr;
allow kernel_t proc_kmsg_t:file getattr;
allow kernel_t sysctl_t:dir { read getattr lock search ioctl };
allow kernel_t sysctl_kernel_t:dir { read getattr lock search ioctl };
allow kernel_t sysctl_kernel_t:file { read getattr lock ioctl };
allow kernel_t unlabeled_t:fifo_file { getattr read write append ioctl lock };
	allow kernel_t unlabeled_t:association { sendto recvfrom };
	allow kernel_t netif_type:netif rawip_send;
	allow kernel_t netif_type:netif rawip_recv;
	allow kernel_t node_type:node rawip_send;
	allow kernel_t node_type:node rawip_recv;
	allow kernel_t netif_t:netif rawip_send;
	allow kernel_t netif_type:netif { tcp_send tcp_recv };
	allow kernel_t node_type:node { tcp_send tcp_recv };
	allow kernel_t node_t:node rawip_send;
	allow kernel_t multicast_node_t:node rawip_send;
	allow kernel_t sysfs_t:dir { read getattr lock search ioctl };
	allow kernel_t sysfs_t:{ file lnk_file } { read getattr lock ioctl };
	allow kernel_t usbfs_t:dir search;
	allow kernel_t filesystem_type:filesystem mount;
	allow kernel_t security_t:dir { read search getattr };
	allow kernel_t security_t:file { getattr read write };
	typeattribute kernel_t can_load_policy;
	if(!secure_mode_policyload) {
		allow kernel_t security_t:security load_policy;
		auditallow kernel_t security_t:security load_policy;
	}
	allow kernel_t device_t:dir { read getattr lock search ioctl };
	allow kernel_t device_t:lnk_file { getattr read };
	allow kernel_t console_device_t:chr_file { getattr read write append ioctl lock };
	allow kernel_t bin_t:dir { read getattr lock search ioctl };
	allow kernel_t bin_t:lnk_file { read getattr lock ioctl };
	allow kernel_t shell_exec_t:file { { read getattr lock execute ioctl } execute_no_trans };
	allow kernel_t sbin_t:dir { read getattr lock search ioctl };
	allow kernel_t bin_t:dir { read getattr lock search ioctl };
	allow kernel_t bin_t:lnk_file { read getattr lock ioctl };
	allow kernel_t bin_t:file { { read getattr lock execute ioctl } execute_no_trans };
	allow kernel_t domain:process signal;
	allow kernel_t proc_t:dir search;
	allow kernel_t domain:dir search;
	allow kernel_t root_t:dir { read getattr lock search ioctl };
	allow kernel_t root_t:lnk_file { read getattr lock ioctl };
	allow kernel_t etc_t:dir { read getattr lock search ioctl };
	allow kernel_t home_root_t:dir { read getattr lock search ioctl };
	allow kernel_t usr_t:dir { read getattr lock search ioctl };
	allow kernel_t usr_t:{ file lnk_file } { read getattr lock ioctl };
	typeattribute kernel_t mlsprocread;
	typeattribute kernel_t mlsprocwrite;
	allow kernel_t self:capability *;
	allow kernel_t self:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
	allow kernel_t self:process transition;
	allow kernel_t self:file { getattr read write append ioctl lock };
	allow kernel_t self:nscd *;
	allow kernel_t self:dbus *;
	allow kernel_t self:passwd *;
	allow kernel_t proc_type:{ dir file } *;
	allow kernel_t sysctl_t:{ dir file } *;
	allow kernel_t kernel_t:system *;
	allow kernel_t unlabeled_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } *;
	allow kernel_t unlabeled_t:filesystem *;
	allow kernel_t unlabeled_t:association *;
	typeattribute kernel_t can_load_kernmodule, can_receive_kernel_messages;
	typeattribute kernel_t kern_unconfined;
	allow kernel_t { proc_t proc_net_t }:dir search;
	allow kernel_t sysctl_type:dir { read getattr lock search ioctl };
	allow kernel_t sysctl_type:file { { getattr read write append ioctl lock } setattr };
	allow kernel_t node_type:node *;
	allow kernel_t netif_type:netif *;
	allow kernel_t port_type:tcp_socket { send_msg recv_msg name_connect };
	allow kernel_t port_type:udp_socket { send_msg recv_msg };
	allow kernel_t port_type:{ tcp_socket udp_socket rawip_socket } name_bind;
	allow kernel_t node_type:{ tcp_socket udp_socket rawip_socket } node_bind;
	allow kernel_t unlabeled_t:association { sendto recvfrom };
	allow kernel_t device_node:{ chr_file blk_file } *;
	allow kernel_t mtrr_device_t:{ dir file } *;
	allow kernel_t self:capability sys_rawio;
	typeattribute kernel_t memory_raw_write, memory_raw_read;
	typeattribute kernel_t unconfined_domain_type;
	typeattribute kernel_t can_change_process_identity;
	typeattribute kernel_t can_change_process_role;
	typeattribute kernel_t can_change_object_identity;
	typeattribute kernel_t set_curr_context;
	allow kernel_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket } socket key_socket } *;
	allow kernel_t domain:fd use;
	allow kernel_t domain:fifo_file { getattr read write append ioctl lock };
	allow kernel_t domain:process ~{ transition dyntransition execmem execstack execheap };
	allow kernel_t domain:{ sem msgq shm } *;
	allow kernel_t domain:msg { send receive };
	allow kernel_t domain:dir { read getattr lock search ioctl };
	allow kernel_t domain:file { read getattr lock ioctl };
	allow kernel_t domain:lnk_file { read getattr lock ioctl };
	dontaudit kernel_t domain:dir { read getattr lock search ioctl };
	dontaudit kernel_t domain:lnk_file { read getattr lock ioctl };
	dontaudit kernel_t domain:file { read getattr lock ioctl };
	dontaudit kernel_t domain:sock_file { read getattr lock ioctl };
	dontaudit kernel_t domain:fifo_file { read getattr lock ioctl };
	allow kernel_t file_type:{ file chr_file } ~execmod;
	allow kernel_t file_type:{ dir lnk_file sock_file fifo_file blk_file } *;
	allow kernel_t file_type:filesystem *;
	allow kernel_t file_type:{ unix_stream_socket unix_dgram_socket } name_bind;
		if (allow_execmod) {
			allow kernel_t file_type:file execmod;
		}
	allow kernel_t filesystem_type:filesystem *;
	allow kernel_t filesystem_type:{ dir file lnk_file sock_file fifo_file chr_file blk_file } *;
	allow kernel_t security_t:dir { getattr search read };
	allow kernel_t security_t:file { getattr read write };
	typeattribute kernel_t can_load_policy, can_setenforce, can_setsecparam;
	if(!secure_mode_policyload) {
		allow kernel_t security_t:security *;
		auditallow kernel_t security_t:security { load_policy setenforce setbool };
	}
		if (allow_execheap) {
		allow kernel_t self:process execheap;
		}
		if (allow_execmem) {
		allow kernel_t self:process execmem;
		}
		if (allow_execmem && allow_execstack) {
		allow kernel_t self:process execstack;
		auditallow kernel_t self:process execstack;
		} else {
		}
		if (allow_execheap) {
		auditallow kernel_t self:process execheap;
		}
		if (allow_execmem) {
		auditallow kernel_t self:process execmem;
		}
		if (read_default_t) {
	allow kernel_t default_t:dir { read getattr lock search ioctl };
	allow kernel_t default_t:file { read getattr lock ioctl };
	allow kernel_t default_t:lnk_file { read getattr lock ioctl };
	allow kernel_t default_t:sock_file { read getattr lock ioctl };
	allow kernel_t default_t:fifo_file { read getattr lock ioctl };
		}
	allow unlabeled_t self:filesystem associate;
range_transition getty_t login_exec_t s0 - s0:c0.c255;
range_transition init_t xdm_exec_t s0 - s0:c0.c255;
range_transition initrc_t crond_exec_t s0 - s0:c0.c255;
range_transition initrc_t cupsd_exec_t s0 - s0:c0.c255;
range_transition initrc_t sshd_exec_t s0 - s0:c0.c255;
range_transition initrc_t udev_exec_t s0 - s0:c0.c255;
range_transition initrc_t xdm_exec_t s0 - s0:c0.c255;
range_transition kernel_t udev_exec_t s0 - s0:c0.c255;
range_transition unconfined_t su_exec_t s0 - s0:c0.c255;
range_transition unconfined_t initrc_exec_t s0;
	typeattribute security_t filesystem_type;
	allow security_t self:filesystem associate;
	typeattribute security_t mlstrustedobject;
neverallow ~can_load_policy security_t:security load_policy;
neverallow ~can_setenforce security_t:security setenforce;
neverallow ~can_setsecparam security_t:security setsecparam;
	typeattribute bsdpty_device_t device_node;
	allow bsdpty_device_t fs_t:filesystem associate;
	allow bsdpty_device_t tmpfs_t:filesystem associate;
	allow bsdpty_device_t tmp_t:filesystem associate;
	typeattribute console_device_t device_node;
	allow console_device_t fs_t:filesystem associate;
	allow console_device_t tmpfs_t:filesystem associate;
	allow console_device_t tmp_t:filesystem associate;
	allow devpts_t fs_t:filesystem associate;
	allow devpts_t noxattrfs:filesystem associate;
	typeattribute devpts_t file_type;
	typeattribute devpts_t mountpoint;
	allow devpts_t tmpfs_t:filesystem associate;
	allow devpts_t tmp_t:filesystem associate;
	typeattribute devpts_t filesystem_type;
	allow devpts_t self:filesystem associate;
	typeattribute devpts_t ttynode, ptynode;
	typeattribute devtty_t device_node;
	allow devtty_t fs_t:filesystem associate;
	allow devtty_t tmpfs_t:filesystem associate;
	allow devtty_t tmp_t:filesystem associate;
	typeattribute devtty_t mlstrustedobject;
	typeattribute ptmx_t device_node;
	allow ptmx_t fs_t:filesystem associate;
	allow ptmx_t tmpfs_t:filesystem associate;
	allow ptmx_t tmp_t:filesystem associate;
	typeattribute ptmx_t mlstrustedobject;
	typeattribute tty_device_t device_node;
	allow tty_device_t fs_t:filesystem associate;
	allow tty_device_t tmpfs_t:filesystem associate;
	allow tty_device_t tmp_t:filesystem associate;
	typeattribute tty_device_t ttynode;
	typeattribute usbtty_device_t device_node;
	allow usbtty_device_t fs_t:filesystem associate;
	allow usbtty_device_t tmpfs_t:filesystem associate;
	allow usbtty_device_t tmp_t:filesystem associate;
user system_u roles { system_r } level s0 range s0 - s0:c0.c255;
user user_u roles { user_r sysadm_r system_r } level s0 range s0 - s0:c0.c255;
	user root roles { user_r sysadm_r system_r } level s0 range s0 - s0:c0.c255;
constrain process transition
	( u1 == u2
	or t1 == can_change_process_identity
);
constrain process transition 
	( r1 == r2
	or t1 == can_change_process_role
);
constrain process dyntransition
	( u1 == u2 and r1 == r2 );
constrain { dir file lnk_file sock_file fifo_file chr_file blk_file } { create relabelto relabelfrom } 
	( u1 == u2 or t1 == can_change_object_identity );
constrain { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket } { create relabelto relabelfrom } 
	( u1 == u2 or t1 == can_change_object_identity );
sid port system_u:object_r:port_t:s0
sid node system_u:object_r:node_t:s0
sid netif system_u:object_r:netif_t:s0
sid devnull system_u:object_r:null_device_t:s0
sid file system_u:object_r:file_t:s0
sid fs system_u:object_r:fs_t:s0
sid kernel system_u:system_r:kernel_t:s0
sid sysctl system_u:object_r:sysctl_t:s0
sid unlabeled system_u:object_r:unlabeled_t:s0
sid any_socket		system_u:object_r:unlabeled_t:s0
sid file_labels		system_u:object_r:unlabeled_t:s0
sid icmp_socket		system_u:object_r:unlabeled_t:s0
sid igmp_packet		system_u:object_r:unlabeled_t:s0
sid init			system_u:object_r:unlabeled_t:s0
sid kmod			system_u:object_r:unlabeled_t:s0
sid netmsg		system_u:object_r:unlabeled_t:s0
sid policy		system_u:object_r:unlabeled_t:s0
sid scmp_packet		system_u:object_r:unlabeled_t:s0
sid sysctl_modprobe 	system_u:object_r:unlabeled_t:s0
sid sysctl_fs		system_u:object_r:unlabeled_t:s0
sid sysctl_kernel	system_u:object_r:unlabeled_t:s0
sid sysctl_net		system_u:object_r:unlabeled_t:s0
sid sysctl_net_unix	system_u:object_r:unlabeled_t:s0
sid sysctl_vm		system_u:object_r:unlabeled_t:s0
sid sysctl_dev		system_u:object_r:unlabeled_t:s0
sid tcp_socket		system_u:object_r:unlabeled_t:s0
sid security system_u:object_r:security_t:s0
fs_use_xattr ext2 system_u:object_r:fs_t:s0;
fs_use_xattr ext3 system_u:object_r:fs_t:s0;
fs_use_xattr gfs system_u:object_r:fs_t:s0;
fs_use_xattr jfs system_u:object_r:fs_t:s0;
fs_use_xattr reiserfs system_u:object_r:fs_t:s0;
fs_use_xattr xfs system_u:object_r:fs_t:s0;
fs_use_task pipefs system_u:object_r:fs_t:s0;
fs_use_task sockfs system_u:object_r:fs_t:s0;
fs_use_trans mqueue system_u:object_r:tmpfs_t:s0;
fs_use_trans shm system_u:object_r:tmpfs_t:s0;
fs_use_trans tmpfs system_u:object_r:tmpfs_t:s0;
fs_use_trans devpts system_u:object_r:devpts_t:s0;
genfscon proc /mtrr system_u:object_r:mtrr_device_t:s0
genfscon sysfs / system_u:object_r:sysfs_t:s0
genfscon usbfs / system_u:object_r:usbfs_t:s0
genfscon usbdevfs / system_u:object_r:usbfs_t:s0
genfscon rootfs / system_u:object_r:root_t:s0
genfscon bdev / system_u:object_r:bdev_t:s0
genfscon binfmt_misc / system_u:object_r:binfmt_misc_fs_t:s0
genfscon capifs / system_u:object_r:capifs_t:s0
genfscon configfs / system_u:object_r:configfs_t:s0
genfscon eventpollfs / system_u:object_r:eventpollfs_t:s0
genfscon futexfs / system_u:object_r:futexfs_t:s0
genfscon hugetlbfs / system_u:object_r:hugetlbfs_t:s0
genfscon inotifyfs / system_u:object_r:inotifyfs_t:s0
genfscon nfsd / system_u:object_r:nfsd_fs_t:s0
genfscon ramfs / system_u:object_r:ramfs_t:s0
genfscon romfs / system_u:object_r:romfs_t:s0
genfscon cramfs / system_u:object_r:romfs_t:s0
genfscon rpc_pipefs / system_u:object_r:rpc_pipefs_t:s0
genfscon autofs / system_u:object_r:autofs_t:s0
genfscon automount / system_u:object_r:autofs_t:s0
genfscon cifs / system_u:object_r:cifs_t:s0
genfscon smbfs / system_u:object_r:cifs_t:s0
genfscon fat / system_u:object_r:dosfs_t:s0
genfscon msdos / system_u:object_r:dosfs_t:s0
genfscon ntfs / system_u:object_r:dosfs_t:s0
genfscon vfat / system_u:object_r:dosfs_t:s0
genfscon iso9660 / system_u:object_r:iso9660_t:s0
genfscon udf / system_u:object_r:iso9660_t:s0
genfscon nfs / system_u:object_r:nfs_t:s0
genfscon nfs4 / system_u:object_r:nfs_t:s0
genfscon afs / system_u:object_r:nfs_t:s0
genfscon hfsplus / system_u:object_r:nfs_t:s0
genfscon debugfs / system_u:object_r:debugfs_t:s0
genfscon proc / system_u:object_r:proc_t:s0
genfscon proc /sysvipc system_u:object_r:proc_t:s0
genfscon proc /kmsg system_u:object_r:proc_kmsg_t:s0
genfscon proc /kcore system_u:object_r:proc_kcore_t:s0
genfscon proc /mdstat system_u:object_r:proc_mdstat_t:s0
genfscon proc /net system_u:object_r:proc_net_t:s0
genfscon proc /xen system_u:object_r:proc_xen_t:s0
genfscon proc /sys system_u:object_r:sysctl_t:s0
genfscon proc /irq system_u:object_r:sysctl_irq_t:s0
genfscon proc /net/rpc system_u:object_r:sysctl_rpc_t:s0
genfscon proc /sys/fs system_u:object_r:sysctl_fs_t:s0
genfscon proc /sys/kernel system_u:object_r:sysctl_kernel_t:s0
genfscon proc /sys/kernel/modprobe system_u:object_r:sysctl_modprobe_t:s0
genfscon proc /sys/kernel/hotplug system_u:object_r:sysctl_hotplug_t:s0
genfscon proc /sys/net system_u:object_r:sysctl_net_t:s0
genfscon proc /sys/net/unix system_u:object_r:sysctl_net_unix_t:s0
genfscon proc /sys/vm system_u:object_r:sysctl_vm_t:s0
genfscon proc /sys/dev system_u:object_r:sysctl_dev_t:s0
genfscon selinuxfs / system_u:object_r:security_t:s0
portcon udp 7007 system_u:object_r:afs_bos_port_t:s0
portcon tcp 2040 system_u:object_r:afs_fs_port_t:s0
portcon udp 7000 system_u:object_r:afs_fs_port_t:s0
portcon udp 7005 system_u:object_r:afs_fs_port_t:s0
portcon udp 7004 system_u:object_r:afs_ka_port_t:s0
portcon udp 7002 system_u:object_r:afs_pt_port_t:s0
portcon udp 7003 system_u:object_r:afs_vl_port_t:s0
portcon udp 10080 system_u:object_r:amanda_port_t:s0
portcon tcp 10080 system_u:object_r:amanda_port_t:s0
portcon udp 10081 system_u:object_r:amanda_port_t:s0
portcon tcp 10081 system_u:object_r:amanda_port_t:s0
portcon tcp 10082 system_u:object_r:amanda_port_t:s0
portcon tcp 10083 system_u:object_r:amanda_port_t:s0
portcon tcp 10024 system_u:object_r:amavisd_recv_port_t:s0
portcon tcp 10025 system_u:object_r:amavisd_send_port_t:s0
portcon tcp 1720 system_u:object_r:asterisk_port_t:s0
portcon udp 2427 system_u:object_r:asterisk_port_t:s0
portcon udp 2727 system_u:object_r:asterisk_port_t:s0
portcon udp 4569 system_u:object_r:asterisk_port_t:s0
portcon udp 5060 system_u:object_r:asterisk_port_t:s0
portcon tcp 113 system_u:object_r:auth_port_t:s0
portcon tcp 179 system_u:object_r:bgp_port_t:s0
portcon udp 179 system_u:object_r:bgp_port_t:s0
portcon tcp 3310 system_u:object_r:clamd_port_t:s0
portcon udp 4041 system_u:object_r:clockspeed_port_t:s0
portcon udp 512 system_u:object_r:comsat_port_t:s0
portcon tcp 2401 system_u:object_r:cvs_port_t:s0
portcon udp 2401 system_u:object_r:cvs_port_t:s0
portcon udp 6276 system_u:object_r:dcc_port_t:s0
portcon udp 6277 system_u:object_r:dcc_port_t:s0
portcon tcp 1178 system_u:object_r:dbskkd_port_t:s0
portcon udp 68 system_u:object_r:dhcpc_port_t:s0
portcon udp 67 system_u:object_r:dhcpd_port_t:s0
portcon tcp 647 system_u:object_r:dhcpd_port_t:s0
portcon udp 647 system_u:object_r:dhcpd_port_t:s0
portcon tcp 847 system_u:object_r:dhcpd_port_t:s0
portcon udp 847 system_u:object_r:dhcpd_port_t:s0
portcon tcp 2628 system_u:object_r:dict_port_t:s0
portcon tcp 3632 system_u:object_r:distccd_port_t:s0
portcon udp 53 system_u:object_r:dns_port_t:s0
portcon tcp 53 system_u:object_r:dns_port_t:s0
portcon tcp 79 system_u:object_r:fingerd_port_t:s0
portcon tcp 20 system_u:object_r:ftp_data_port_t:s0
portcon tcp 21 system_u:object_r:ftp_port_t:s0
portcon udp 1718 system_u:object_r:gatekeeper_port_t:s0
portcon udp 1719 system_u:object_r:gatekeeper_port_t:s0
portcon tcp 1721 system_u:object_r:gatekeeper_port_t:s0
portcon tcp 7000 system_u:object_r:gatekeeper_port_t:s0
portcon tcp 1213 system_u:object_r:giftd_port_t:s0
portcon tcp 70 system_u:object_r:gopher_port_t:s0
portcon udp 70 system_u:object_r:gopher_port_t:s0
portcon tcp 3128 system_u:object_r:http_cache_port_t:s0
portcon udp 3130 system_u:object_r:http_cache_port_t:s0
portcon tcp 8080 system_u:object_r:http_cache_port_t:s0
portcon tcp 8118 system_u:object_r:http_cache_port_t:s0
portcon tcp 80 system_u:object_r:http_port_t:s0
portcon tcp 443 system_u:object_r:http_port_t:s0
portcon tcp 488 system_u:object_r:http_port_t:s0
portcon tcp 8008 system_u:object_r:http_port_t:s0
portcon tcp 9050 system_u:object_r:http_port_t:s0
portcon tcp 5335 system_u:object_r:howl_port_t:s0
portcon udp 5353 system_u:object_r:howl_port_t:s0
portcon tcp 50000 system_u:object_r:hplip_port_t:s0
portcon tcp 50002 system_u:object_r:hplip_port_t:s0
portcon tcp 9010 system_u:object_r:i18n_input_port_t:s0
portcon tcp 5323 system_u:object_r:imaze_port_t:s0
portcon udp 5323 system_u:object_r:imaze_port_t:s0
portcon tcp 7 system_u:object_r:inetd_child_port_t:s0
portcon udp 7 system_u:object_r:inetd_child_port_t:s0
portcon tcp 9 system_u:object_r:inetd_child_port_t:s0
portcon udp 9 system_u:object_r:inetd_child_port_t:s0
portcon tcp 13 system_u:object_r:inetd_child_port_t:s0
portcon udp 13 system_u:object_r:inetd_child_port_t:s0
portcon tcp 19 system_u:object_r:inetd_child_port_t:s0
portcon udp 19 system_u:object_r:inetd_child_port_t:s0
portcon tcp 37 system_u:object_r:inetd_child_port_t:s0
portcon udp 37 system_u:object_r:inetd_child_port_t:s0
portcon tcp 512 system_u:object_r:inetd_child_port_t:s0
portcon tcp 543 system_u:object_r:inetd_child_port_t:s0
portcon tcp 544 system_u:object_r:inetd_child_port_t:s0
portcon tcp 891 system_u:object_r:inetd_child_port_t:s0
portcon udp 891 system_u:object_r:inetd_child_port_t:s0
portcon tcp 892 system_u:object_r:inetd_child_port_t:s0
portcon udp 892 system_u:object_r:inetd_child_port_t:s0
portcon tcp 2105 system_u:object_r:inetd_child_port_t:s0
portcon tcp 5666 system_u:object_r:inetd_child_port_t:s0
portcon tcp 119 system_u:object_r:innd_port_t:s0
portcon tcp 631 system_u:object_r:ipp_port_t:s0
portcon udp 631 system_u:object_r:ipp_port_t:s0
portcon tcp 6667 system_u:object_r:ircd_port_t:s0
portcon udp 500 system_u:object_r:isakmp_port_t:s0
portcon tcp 5222 system_u:object_r:jabber_client_port_t:s0
portcon tcp 5223 system_u:object_r:jabber_client_port_t:s0
portcon tcp 5269 system_u:object_r:jabber_interserver_port_t:s0
portcon tcp 464 system_u:object_r:kerberos_admin_port_t:s0
portcon udp 464 system_u:object_r:kerberos_admin_port_t:s0
portcon tcp 749 system_u:object_r:kerberos_admin_port_t:s0
portcon tcp 4444 system_u:object_r:kerberos_master_port_t:s0
portcon udp 4444 system_u:object_r:kerberos_master_port_t:s0
portcon tcp 88 system_u:object_r:kerberos_port_t:s0
portcon udp 88 system_u:object_r:kerberos_port_t:s0
portcon tcp 750 system_u:object_r:kerberos_port_t:s0
portcon udp 750 system_u:object_r:kerberos_port_t:s0
portcon udp 517 system_u:object_r:ktalkd_port_t:s0
portcon udp 518 system_u:object_r:ktalkd_port_t:s0
portcon tcp 389 system_u:object_r:ldap_port_t:s0
portcon udp 389 system_u:object_r:ldap_port_t:s0
portcon tcp 636 system_u:object_r:ldap_port_t:s0
portcon udp 636 system_u:object_r:ldap_port_t:s0
portcon tcp 2000 system_u:object_r:mail_port_t:s0
portcon tcp 1234 system_u:object_r:monopd_port_t:s0
portcon tcp 3306 system_u:object_r:mysqld_port_t:s0
portcon tcp 1241 system_u:object_r:nessus_port_t:s0
portcon udp 137 system_u:object_r:nmbd_port_t:s0
portcon udp 138 system_u:object_r:nmbd_port_t:s0
portcon udp 139 system_u:object_r:nmbd_port_t:s0
portcon udp 123 system_u:object_r:ntp_port_t:s0
portcon udp 5000 system_u:object_r:openvpn_port_t:s0
portcon tcp 5988 system_u:object_r:pegasus_http_port_t:s0
portcon tcp 5989 system_u:object_r:pegasus_https_port_t:s0
portcon tcp 106 system_u:object_r:pop_port_t:s0
portcon tcp 109 system_u:object_r:pop_port_t:s0
portcon tcp 110 system_u:object_r:pop_port_t:s0
portcon tcp 143 system_u:object_r:pop_port_t:s0
portcon tcp 220 system_u:object_r:pop_port_t:s0
portcon tcp 993 system_u:object_r:pop_port_t:s0
portcon tcp 995 system_u:object_r:pop_port_t:s0
portcon tcp 1109 system_u:object_r:pop_port_t:s0
portcon udp 111 system_u:object_r:portmap_port_t:s0
portcon tcp 111 system_u:object_r:portmap_port_t:s0
portcon tcp 5432 system_u:object_r:postgresql_port_t:s0
portcon tcp 60000 system_u:object_r:postgrey_port_t:s0
portcon tcp 515 system_u:object_r:printer_port_t:s0
portcon tcp 5703 system_u:object_r:ptal_port_t:s0
portcon udp 4011 system_u:object_r:pxe_port_t:s0
portcon udp 24441 system_u:object_r:pyzor_port_t:s0
portcon udp 1646 system_u:object_r:radacct_port_t:s0
portcon udp 1813 system_u:object_r:radacct_port_t:s0
portcon udp 1645 system_u:object_r:radius_port_t:s0
portcon udp 1812 system_u:object_r:radius_port_t:s0
portcon tcp 2703 system_u:object_r:razor_port_t:s0
portcon tcp 513 system_u:object_r:rlogind_port_t:s0
portcon tcp 953 system_u:object_r:rndc_port_t:s0
portcon udp 520 system_u:object_r:router_port_t:s0
portcon tcp 514 system_u:object_r:rsh_port_t:s0
portcon tcp 873 system_u:object_r:rsync_port_t:s0
portcon udp 873 system_u:object_r:rsync_port_t:s0
portcon tcp 137-139 system_u:object_r:smbd_port_t:s0
portcon tcp 445 system_u:object_r:smbd_port_t:s0
portcon tcp 25 system_u:object_r:smtp_port_t:s0
portcon tcp 465 system_u:object_r:smtp_port_t:s0
portcon tcp 587 system_u:object_r:smtp_port_t:s0
portcon udp 161 system_u:object_r:snmp_port_t:s0
portcon udp 162 system_u:object_r:snmp_port_t:s0
portcon tcp 199 system_u:object_r:snmp_port_t:s0
portcon tcp 783 system_u:object_r:spamd_port_t:s0
portcon tcp 22 system_u:object_r:ssh_port_t:s0
portcon tcp 8000 system_u:object_r:soundd_port_t:s0
portcon tcp 9433 system_u:object_r:soundd_port_t:s0
portcon tcp 901 system_u:object_r:swat_port_t:s0
portcon udp 514 system_u:object_r:syslogd_port_t:s0
portcon tcp 23 system_u:object_r:telnetd_port_t:s0
portcon udp 69 system_u:object_r:tftp_port_t:s0
portcon tcp 8081 system_u:object_r:transproxy_port_t:s0
portcon tcp 540 system_u:object_r:uucpd_port_t:s0
portcon tcp 5900 system_u:object_r:vnc_port_t:s0
portcon tcp 6001 system_u:object_r:xserver_port_t:s0
portcon tcp 6002 system_u:object_r:xserver_port_t:s0
portcon tcp 6003 system_u:object_r:xserver_port_t:s0
portcon tcp 6004 system_u:object_r:xserver_port_t:s0
portcon tcp 6005 system_u:object_r:xserver_port_t:s0
portcon tcp 6006 system_u:object_r:xserver_port_t:s0
portcon tcp 6007 system_u:object_r:xserver_port_t:s0
portcon tcp 6008 system_u:object_r:xserver_port_t:s0
portcon tcp 6009 system_u:object_r:xserver_port_t:s0
portcon tcp 6010 system_u:object_r:xserver_port_t:s0
portcon tcp 6011 system_u:object_r:xserver_port_t:s0
portcon tcp 6012 system_u:object_r:xserver_port_t:s0
portcon tcp 6013 system_u:object_r:xserver_port_t:s0
portcon tcp 6014 system_u:object_r:xserver_port_t:s0
portcon tcp 6015 system_u:object_r:xserver_port_t:s0
portcon tcp 6016 system_u:object_r:xserver_port_t:s0
portcon tcp 6017 system_u:object_r:xserver_port_t:s0
portcon tcp 6018 system_u:object_r:xserver_port_t:s0
portcon tcp 6019 system_u:object_r:xserver_port_t:s0
portcon tcp 8002 system_u:object_r:xen_port_t:s0
portcon tcp 2601 system_u:object_r:zebra_port_t:s0
portcon tcp 8021 system_u:object_r:zope_port_t:s0
portcon tcp 1-1023 system_u:object_r:reserved_port_t:s0
portcon udp 1-1023 system_u:object_r:reserved_port_t:s0
nodecon :: ffff:ffff:ffff:ffff:ffff:ffff:: system_u:object_r:compat_ipv4_node_t:s0
nodecon 0.0.0.0 255.255.255.255 system_u:object_r:inaddr_any_node_t:s0
nodecon fe80:: ffff:ffff:ffff:ffff:: system_u:object_r:link_local_node_t:s0
nodecon 127.0.0.1 255.255.255.255 system_u:object_r:lo_node_t:s0
nodecon ::ffff:0000:0000 ffff:ffff:ffff:ffff:ffff:ffff:: system_u:object_r:mapped_ipv4_node_t:s0
nodecon ff00:: ff00:: system_u:object_r:multicast_node_t:s0
nodecon fec0:: ffc0:: system_u:object_r:site_local_node_t:s0
nodecon :: ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff system_u:object_r:unspec_node_t:s0