diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.6.12/policy/modules/kernel/corecommands.fc
--- nsaserefpolicy/policy/modules/kernel/corecommands.fc	2009-04-30 11:12:20.000000000 +0200
+++ serefpolicy-3.6.12/policy/modules/kernel/corecommands.fc	2009-04-30 14:46:55.000000000 +0200
@@ -214,6 +214,8 @@
 /usr/share/Modules/init(/.*)?		gen_context(system_u:object_r:bin_t,s0)
 /usr/share/printconf/util/print\.py --	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/selinux/devel/policygentool -- gen_context(system_u:object_r:bin_t,s0)
+/usr/share/shorewall-shell(/.*)?     	gen_context(system_u:object_r:bin_t,s0)
+/usr/share/shorewall-perl/compiler.pl   --      gen_context(system_u:object_r:bin_t,s0)
 /usr/share/turboprint/lib(/.*)?	--	gen_context(system_u:object_r:bin_t,s0)
 
 /usr/X11R6/lib(64)?/X11/xkb/xkbcomp --	gen_context(system_u:object_r:bin_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/shorewall.fc serefpolicy-3.6.12/policy/modules/services/shorewall.fc
--- nsaserefpolicy/policy/modules/services/shorewall.fc	1970-01-01 01:00:00.000000000 +0100
+++ serefpolicy-3.6.12/policy/modules/services/shorewall.fc	2009-04-30 11:21:12.000000000 +0200
@@ -0,0 +1,13 @@
+
+/etc/rc\.d/init\.d/shorewall        	--      gen_context(system_u:object_r:shorewall_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/shorewall-lite       --      gen_context(system_u:object_r:shorewall_initrc_exec_t,s0)
+
+/etc/shorewall(/.*)?            		gen_context(system_u:object_r:shorewall_etc_t,s0)
+/etc/shorewall-lite(/.*)?               	gen_context(system_u:object_r:shorewall_etc_t,s0)
+
+/sbin/shorewall				--	gen_context(system_u:object_r:shorewall_exec_t,s0)
+/sbin/shorewall-lite			--      gen_context(system_u:object_r:shorewall_exec_t,s0)
+
+/var/lib/shorewall(/.*)?			gen_context(system_u:object_r:shorewall_var_lib_t,s0)
+/var/lib/shorewall-lite(/.*)?           	gen_context(system_u:object_r:shorewall_var_lib_t,s0)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/shorewall.if serefpolicy-3.6.12/policy/modules/services/shorewall.if
--- nsaserefpolicy/policy/modules/services/shorewall.if	1970-01-01 01:00:00.000000000 +0100
+++ serefpolicy-3.6.12/policy/modules/services/shorewall.if	2009-04-30 11:15:10.000000000 +0200
@@ -0,0 +1,166 @@
+## <summary>policy for shorewall</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run shorewall.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`shorewall_domtrans',`
+	gen_require(`
+		type shorewall_t; 
+		type shorewall_exec_t;
+	')
+
+	domtrans_pattern($1, shorewall_exec_t, shorewall_t)
+')
+
+#######################################
+## <summary>
+##      Read shorewall etc configuration files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`shorewall_read_etc',`
+        gen_require(`
+                type shorewall_etc_t;
+        ')
+
+        files_search_etc($1)
+        read_files_pattern($1, shorewall_etc_t, shorewall_etc_t)
+')
+
+#######################################
+## <summary>
+##      Read shorewall PID files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`shorewall_read_pid_files',`
+        gen_require(`
+                type shorewall_var_run_t;
+        ')
+
+        files_search_pids($1)
+        read_files_pattern($1, shorewall_var_run_t, shorewall_var_run_t)
+')
+
+#######################################
+## <summary>
+##      Read and write shorewall PID files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`shorewall_rw_pid_files',`
+        gen_require(`
+                type shorewall_var_run_t;
+        ')
+
+        files_search_pids($1)
+        rw_files_pattern($1, shorewall_var_run_t, shorewall_var_run_t)
+')
+
+######################################
+## <summary>
+##      Read shorewall /var/lib files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`shorewall_read_var_lib',`
+        gen_require(`
+                type shorewall_t;
+       ')
+
+        files_search_var_lib($1)
+        search_dirs_pattern($1, shorewall_var_lib_t, shorewall_var_lib_t)
+        read_files_pattern($1, shorewall_var_lib_t, shorewall_var_lib_t)
+')
+
+#######################################
+## <summary>
+##      Read and write shorewall /var/lib files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`shorewall_rw_var_lib',`
+        gen_require(`
+                type shorewall_t;
+       ')
+
+        files_search_var_lib($1)
+        search_dirs_pattern($1, shorewall_var_lib_t, shorewall_var_lib_t)
+        rw_files_pattern($1, shorewall_var_lib_t, shorewall_var_lib_t)
+')
+
+#######################################
+## <summary>
+##      All of the rules required to administrate 
+##      an shorewall environment
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <param name="role">
+##      <summary>
+##      The role to be allowed to manage the syslog domain.
+##      </summary>
+## </param>
+## <rolecap/>
+#
+interface(`shorewall_admin',`
+        gen_require(`
+                type shorewall_t, shorewall_var_run_t, shorewall_lock_t;
+                type shorewall_initrc_exec_t, shorewall_var_lib_t;
+                type shorewall_tmp_t;
+        ')
+
+        allow $1 shorewall_t:process { ptrace signal_perms };
+        ps_process_pattern($1, shorewall_t)
+
+        init_labeled_script_domtrans($1, shorewall_initrc_exec_t)
+        domain_system_change_exemption($1)
+        role_transition $2 shorewall_initrc_exec_t system_r;
+        allow $2 system_r;
+
+        files_search_etc($1)
+        admin_pattern($1, shorewall_etc_t)
+
+	files_search_locks($1)
+	admin_pattern($1, shorewall_lock_t)
+
+        files_search_pids($1)
+        admin_pattern($1, shorewall_var_run_t)
+
+        files_search_var_lib($1)
+        admin_pattern($1, shorewall_var_lib_t)
+
+        files_search_tmp($1)
+        admin_pattern($1, shorewall_tmp_t)
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/shorewall.te serefpolicy-3.6.12/policy/modules/services/shorewall.te
--- nsaserefpolicy/policy/modules/services/shorewall.te	1970-01-01 01:00:00.000000000 +0100
+++ serefpolicy-3.6.12/policy/modules/services/shorewall.te	2009-04-30 11:13:01.000000000 +0200
@@ -0,0 +1,102 @@
+policy_module(shorewall,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type shorewall_t;
+type shorewall_exec_t;
+init_daemon_domain(shorewall_t, shorewall_exec_t)
+
+type shorewall_initrc_exec_t;
+init_script_file(shorewall_initrc_exec_t)
+
+# etc files
+type shorewall_etc_t;
+files_config_file(shorewall_etc_t)
+
+# lock files
+type shorewall_lock_t;
+files_lock_file(shorewall_lock_t)
+
+# tmp files
+type shorewall_tmp_t;
+files_tmp_file(shorewall_tmp_t)
+
+# var/lib files
+type shorewall_var_lib_t;
+files_type(shorewall_var_lib_t)
+
+########################################
+#
+# shorewall local policy
+#
+
+allow shorewall_t self:capability { dac_override net_admin net_raw setuid setgid sys_nice sys_ptrace};
+dontaudit shorewall_t self:capability sys_tty_config;
+
+allow shorewall_t self:fifo_file rw_fifo_file_perms;
+
+# etc file
+read_files_pattern(shorewall_t, shorewall_etc_t, shorewall_etc_t)
+list_dirs_pattern(shorewall_t, shorewall_etc_t, shorewall_etc_t)
+
+# lock files
+manage_files_pattern(shorewall_t,shorewall_lock_t,shorewall_lock_t)
+files_lock_filetrans(shorewall_t, shorewall_lock_t, file)
+
+# var/lib files for shorewall
+exec_files_pattern(shorewall_t,shorewall_var_lib_t,shorewall_var_lib_t)
+manage_dirs_pattern(shorewall_t,shorewall_var_lib_t,shorewall_var_lib_t)
+manage_files_pattern(shorewall_t,shorewall_var_lib_t,shorewall_var_lib_t)
+files_var_lib_filetrans(shorewall_t,shorewall_var_lib_t, { dir file })
+
+# tmp files for shorewall
+manage_dirs_pattern(shorewall_t,shorewall_tmp_t,shorewall_tmp_t)
+manage_files_pattern(shorewall_t,shorewall_tmp_t,shorewall_tmp_t)
+files_tmp_filetrans(shorewall_t, shorewall_tmp_t, { file dir })
+
+kernel_read_kernel_sysctls(shorewall_t)
+kernel_read_system_state(shorewall_t)
+kernel_read_network_state(shorewall_t)
+kernel_rw_net_sysctls(shorewall_t)
+
+corecmd_exec_bin(shorewall_t)
+corecmd_exec_shell(shorewall_t)
+
+dev_read_urand(shorewall_t)
+
+fs_getattr_all_fs(shorewall_t)
+
+domain_read_all_domains_state(shorewall_t)
+
+files_getattr_kernel_modules(shorewall_t)
+files_read_etc_files(shorewall_t)
+files_read_usr_files(shorewall_t)
+files_search_kernel_modules(shorewall_t)
+
+init_rw_utmp(shorewall_t)
+
+libs_use_ld_so(shorewall_t)
+libs_use_shared_libs(shorewall_t)
+
+logging_send_syslog_msg(shorewall_t)
+
+miscfiles_read_localization(shorewall_t)
+
+userdom_dontaudit_list_admin_dir(shorewall_t)
+
+sysnet_domtrans_ifconfig(shorewall_t)
+iptables_domtrans(shorewall_t)
+
+optional_policy(`
+        modutils_domtrans_insmod(shorewall_t)
+')
+
+optional_policy(`
+	ulogd_search_log(shorewall_t)
+')
+
+permissive shorewall_t;
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ulogd.if serefpolicy-3.6.12/policy/modules/services/ulogd.if
--- nsaserefpolicy/policy/modules/services/ulogd.if	2009-04-30 11:12:20.000000000 +0200
+++ serefpolicy-3.6.12/policy/modules/services/ulogd.if	2009-04-30 11:14:52.000000000 +0200
@@ -62,6 +62,25 @@
         read_files_pattern($1, ulogd_var_log_t, ulogd_var_log_t)
 ')
 
+#######################################
+## <summary>
+##      Allow the specified domain to search ulogd's log files.
+## </summary>
+## <param name="domain">
+## <summary>
+##      Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ulogd_search_log',`
+        gen_require(`
+                type ulogd_var_log_t;
+        ')
+
+        logging_search_logs($1)
+        allow $1 ulogd_var_log_t:dir search_dir_perms;
+')
+
 ########################################
 ## <summary>
 ##      Allow the specified domain to append to ulogd's log files.
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.fc serefpolicy-3.6.12/policy/modules/system/iptables.fc
--- nsaserefpolicy/policy/modules/system/iptables.fc	2009-04-30 11:12:20.000000000 +0200
+++ serefpolicy-3.6.12/policy/modules/system/iptables.fc	2009-04-30 11:19:17.000000000 +0200
@@ -9,4 +9,3 @@
 /usr/sbin/iptables-restore 	--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/iptables-multi 	--	gen_context(system_u:object_r:iptables_exec_t,s0)
 
-/var/lib/shorewall(/.*)? --	gen_context(system_u:object_r:iptables_var_run_t,s0)
