--- /home/kaigai/repo/refpolicy/policy/modules/services/postgresql.te	2011-11-12 09:02:00.436879262 +0100
+++ /home/kaigai/tmp/a/serefpolicy-3.10.0/policy/modules/services/postgresql.te	2011-11-12 08:33:50.937268325 +0100
@@ -1,4 +1,4 @@
-policy_module(postgresql, 1.13.1)
+policy_module(postgresql, 1.12.2)
 
 gen_require(`
 	class db_database all_db_database_perms;
@@ -19,16 +19,16 @@ gen_require(`
 #
 
 ## <desc>
-## <p>
-## Allow unprived users to execute DDL statement
-## </p>
+##	<p>
+##	Allow unprivileged users to execute DDL statement
+##	</p>
 ## </desc>
 gen_tunable(sepgsql_enable_users_ddl, true)
 
 ## <desc>
-## <p>
-## Allow database admins to execute DML statement
-## </p>
+##	<p>
+##	Allow database admins to execute DML statement
+##	</p>
 ## </desc>
 gen_tunable(sepgsql_unconfined_dbadm, true)
 
@@ -209,28 +209,23 @@ allow postgresql_t self:unix_stream_sock
 allow postgresql_t self:netlink_selinux_socket create_socket_perms;
 
 allow postgresql_t sepgsql_database_type:db_database *;
-type_transition postgresql_t postgresql_t:db_database sepgsql_db_t;		# deprecated
+type_transition postgresql_t postgresql_t:db_database sepgsql_db_t;
 
 allow postgresql_t sepgsql_module_type:db_database install_module;
 # Database/Loadable module
 allow sepgsql_database_type sepgsql_module_type:db_database load_module;
 
 allow postgresql_t sepgsql_schema_type:db_schema *;
-type_transition postgresql_t sepgsql_database_type:db_schema sepgsql_schema_t;
 
 allow postgresql_t sepgsql_table_type:{ db_table db_column db_tuple } *;
-type_transition postgresql_t sepgsql_database_type:db_table sepgsql_sysobj_t;	# deprecated
-type_transition postgresql_t sepgsql_schema_type:db_table sepgsql_sysobj_t;
+type_transition postgresql_t sepgsql_database_type:db_table sepgsql_sysobj_t;
 
 allow postgresql_t sepgsql_sequence_type:db_sequence *;
-type_transition postgresql_t sepgsql_schema_type:db_sequence sepgsql_seq_t;
 
 allow postgresql_t sepgsql_view_type:db_view *;
-type_transition postgresql_t sepgsql_schema_type:db_view sepgsql_view_t;
 
 allow postgresql_t sepgsql_procedure_type:db_procedure *;
-type_transition postgresql_t sepgsql_database_type:db_procedure sepgsql_proc_exec_t;	# deprecated
-type_transition postgresql_t sepgsql_schema_type:db_procedure sepgsql_proc_exec_t;
+type_transition postgresql_t sepgsql_database_type:db_procedure sepgsql_proc_exec_t;
 
 allow postgresql_t sepgsql_blob_type:db_blob *;
 type_transition postgresql_t sepgsql_database_type:db_blob sepgsql_blob_t;
@@ -246,7 +241,7 @@ allow postgresql_t postgresql_etc_t:dir 
 read_files_pattern(postgresql_t, postgresql_etc_t, postgresql_etc_t)
 read_lnk_files_pattern(postgresql_t, postgresql_etc_t, postgresql_etc_t)
 
-allow postgresql_t postgresql_exec_t:lnk_file { getattr read };
+allow postgresql_t postgresql_exec_t:lnk_file read_lnk_file_perms;
 can_exec(postgresql_t, postgresql_exec_t )
 
 allow postgresql_t postgresql_lock_t:file manage_file_perms;
@@ -312,8 +307,7 @@ domain_dontaudit_list_all_domains_state(
 domain_use_interactive_fds(postgresql_t)
 
 files_dontaudit_search_home(postgresql_t)
-files_manage_etc_files(postgresql_t)
-files_search_etc(postgresql_t)
+files_read_etc_files(postgresql_t)
 files_read_etc_runtime_files(postgresql_t)
 files_read_usr_files(postgresql_t)
 
@@ -333,9 +327,7 @@ userdom_dontaudit_use_unpriv_user_fds(po
 userdom_dontaudit_search_user_home_dirs(postgresql_t)
 userdom_dontaudit_use_user_terminals(postgresql_t)
 
-optional_policy(`
-	mta_getattr_spool(postgresql_t)
-')
+mta_getattr_spool(postgresql_t)
 
 tunable_policy(`allow_execmem',`
 	allow postgresql_t self:process execmem;
@@ -445,7 +437,7 @@ tunable_policy(`sepgsql_enable_users_ddl
 #
 
 allow sepgsql_admin_type sepgsql_database_type:db_database { create drop getattr setattr relabelfrom relabelto access };
-type_transition sepgsql_admin_type sepgsql_admin_type:db_database sepgsql_db_t;		# deprecated
+type_transition sepgsql_admin_type sepgsql_admin_type:db_database sepgsql_db_t;
 
 allow sepgsql_admin_type sepgsql_schema_type:db_schema { create drop getattr setattr relabelfrom relabelto search add_name remove_name };
 type_transition sepgsql_admin_type sepgsql_database_type:db_schema sepgsql_schema_t;
@@ -459,11 +451,11 @@ type_transition sepgsql_admin_type sepgs
 
 allow sepgsql_admin_type sepgsql_sequence_type:db_sequence { create drop getattr setattr relabelfrom relabelto get_value next_value set_value };
 
-type_transition sepgsql_admin_type sepgsql_schema_type:db_sequence sepgsql_seq_t;
+type_transition sepgsql_admin_type sepgsql_schema_type:db_schema sepgsql_seq_t;
 
 allow sepgsql_admin_type sepgsql_view_type:db_view { create drop getattr setattr relabelfrom relabelto expand };
 
-type_transition sepgsql_admin_type sepgsql_schema_type:db_view sepgsql_view_t;
+type_transition sepgsql_admin_type sepgsql_view_type:db_view sepgsql_view_t;
 
 allow sepgsql_admin_type sepgsql_procedure_type:db_procedure { create drop getattr relabelfrom relabelto };
 allow sepgsql_admin_type sepgsql_proc_exec_t:db_procedure execute;
@@ -507,7 +499,7 @@ tunable_policy(`sepgsql_unconfined_dbadm
 #
 
 allow sepgsql_unconfined_type sepgsql_database_type:db_database *;
-type_transition sepgsql_unconfined_type sepgsql_unconfined_type:db_database sepgsql_db_t;	# deprecated
+type_transition sepgsql_unconfined_type sepgsql_unconfined_type:db_database sepgsql_db_t;
 
 allow sepgsql_unconfined_type sepgsql_schema_type:db_schema *;
 type_transition sepgsql_unconfined_type sepgsql_database_type:db_schema sepgsql_schema_t;
