path: root/0014-Label-some-unit-files-in-contrib-modules.patch

From 5ef5a543b2e342b0ac849493ccdffbe26d6fe997 Mon Sep 17 00:00:00 2001
From: Nicolas Iooss <nicolas.iooss@m4x.org>
Date: Tue, 5 Jan 2016 18:00:31 +0100
Subject: [PATCH] Label some unit files in contrib modules

---
 policy/modules/contrib/apache.fc         | 2 ++
 policy/modules/contrib/apache.te         | 3 +++
 policy/modules/contrib/apcupsd.fc        | 2 ++
 policy/modules/contrib/apcupsd.te        | 3 +++
 policy/modules/contrib/apm.fc            | 2 ++
 policy/modules/contrib/apm.te            | 3 +++
 policy/modules/contrib/arpwatch.fc       | 2 ++
 policy/modules/contrib/arpwatch.te       | 3 +++
 policy/modules/contrib/automount.fc      | 2 ++
 policy/modules/contrib/automount.te      | 3 +++
 policy/modules/contrib/avahi.fc          | 3 +++
 policy/modules/contrib/avahi.te          | 3 +++
 policy/modules/contrib/bind.fc           | 4 ++++
 policy/modules/contrib/bind.te           | 3 +++
 policy/modules/contrib/clamav.fc         | 4 ++++
 policy/modules/contrib/clamav.te         | 3 +++
 policy/modules/contrib/colord.fc         | 2 ++
 policy/modules/contrib/colord.te         | 3 +++
 policy/modules/contrib/consolekit.fc     | 2 ++
 policy/modules/contrib/consolekit.te     | 3 +++
 policy/modules/contrib/cron.fc           | 3 +++
 policy/modules/contrib/cron.te           | 3 +++
 policy/modules/contrib/cups.fc           | 3 +++
 policy/modules/contrib/cups.te           | 3 +++
 policy/modules/contrib/dhcp.fc           | 1 +
 policy/modules/contrib/dhcp.te           | 3 +++
 policy/modules/contrib/ftp.fc            | 3 +++
 policy/modules/contrib/ftp.te            | 3 +++
 policy/modules/contrib/kdump.fc          | 2 ++
 policy/modules/contrib/ldap.fc           | 2 ++
 policy/modules/contrib/ldap.te           | 3 +++
 policy/modules/contrib/mysql.fc          | 2 ++
 policy/modules/contrib/mysql.te          | 3 +++
 policy/modules/contrib/networkmanager.te | 6 +++---
 policy/modules/contrib/nis.fc            | 5 +++++
 policy/modules/contrib/nis.te            | 6 ++++++
 policy/modules/contrib/nscd.fc           | 3 +++
 policy/modules/contrib/nscd.te           | 3 +++
 policy/modules/contrib/ntp.fc            | 1 +
 policy/modules/contrib/ntp.te            | 6 +++---
 policy/modules/contrib/openvpn.fc        | 2 ++
 policy/modules/contrib/openvpn.te        | 3 +++
 policy/modules/contrib/ppp.fc            | 2 ++
 policy/modules/contrib/ppp.te            | 3 +++
 policy/modules/contrib/rpc.fc            | 3 +++
 policy/modules/contrib/rpc.te            | 6 ++++++
 policy/modules/contrib/samba.fc          | 2 ++
 policy/modules/contrib/samba.te          | 3 +++
 policy/modules/contrib/tor.fc            | 1 +
 policy/modules/contrib/tor.te            | 3 +++
 50 files changed, 141 insertions(+), 6 deletions(-)

diff --git a/policy/modules/contrib/apache.fc b/policy/modules/contrib/apache.fc
index caa2b1e7e682..5fc2d2c53f59 100644
--- a/policy/modules/contrib/apache.fc
+++ b/policy/modules/contrib/apache.fc
@@ -51,6 +51,8 @@ HOME_DIR/((www)|(web)|(public_html))(/.*)?/logs(/.*)?	gen_context(system_u:objec
 /usr/lib/httpd(/.*)?	gen_context(system_u:object_r:httpd_modules_t,s0)
 /usr/lib/lighttpd(/.*)?	gen_context(system_u:object_r:httpd_modules_t,s0)
 
+/usr/lib/systemd/system/httpd.service	--	gen_context(system_u:object_r:httpd_unit_t,s0)
+
 /usr/libexec/httpd-ssl-pass-dialog	--	gen_context(system_u:object_r:httpd_passwd_exec_t,s0)
 
 /usr/s?bin/apache(2)?	--	gen_context(system_u:object_r:httpd_exec_t,s0)
diff --git a/policy/modules/contrib/apache.te b/policy/modules/contrib/apache.te
index b139e54dbe46..d7b98aabdc2d 100644
--- a/policy/modules/contrib/apache.te
+++ b/policy/modules/contrib/apache.te
@@ -289,6 +289,9 @@ init_script_file(httpd_initrc_exec_t)
 type httpd_keytab_t;
 files_type(httpd_keytab_t)
 
+type httpd_unit_t;
+init_unit_file(httpd_unit_t)
+
 type httpd_lock_t;
 files_lock_file(httpd_lock_t)
 
diff --git a/policy/modules/contrib/apcupsd.fc b/policy/modules/contrib/apcupsd.fc
index 21e641e6b960..5434b0e20b74 100644
--- a/policy/modules/contrib/apcupsd.fc
+++ b/policy/modules/contrib/apcupsd.fc
@@ -4,6 +4,8 @@
 
 /usr/s?bin/apcupsd	--	gen_context(system_u:object_r:apcupsd_exec_t,s0)
 
+/usr/lib/systemd/system/apcupsd\.service -- gen_context(system_u:object_r:apcupsd_unit_t,s0)
+
 /var/lock/subsys/apcupsd	--	gen_context(system_u:object_r:apcupsd_lock_t,s0)
 
 /var/log/apcupsd\.events.*	--	gen_context(system_u:object_r:apcupsd_log_t,s0)
diff --git a/policy/modules/contrib/apcupsd.te b/policy/modules/contrib/apcupsd.te
index d5bf5bd13824..eb8443f1ef44 100644
--- a/policy/modules/contrib/apcupsd.te
+++ b/policy/modules/contrib/apcupsd.te
@@ -24,6 +24,9 @@ files_tmp_file(apcupsd_tmp_t)
 type apcupsd_var_run_t;
 files_pid_file(apcupsd_var_run_t)
 
+type apcupsd_unit_t;
+init_unit_file(apcupsd_unit_t)
+
 ########################################
 #
 # Local policy
diff --git a/policy/modules/contrib/apm.fc b/policy/modules/contrib/apm.fc
index c35143aa46f6..6598e5c49631 100644
--- a/policy/modules/contrib/apm.fc
+++ b/policy/modules/contrib/apm.fc
@@ -6,6 +6,8 @@
 /usr/s?bin/apmd	--	gen_context(system_u:object_r:apmd_exec_t,s0)
 /usr/s?bin/powersaved	--	gen_context(system_u:object_r:apmd_exec_t,s0)
 
+/usr/lib/systemd/system/apmd\.service -- gen_context(system_u:object_r:apmd_unit_t,s0)
+
 /var/lock/subsys/acpid	--	gen_context(system_u:object_r:apmd_lock_t,s0)
 
 /var/log/acpid.*	--	gen_context(system_u:object_r:apmd_log_t,s0)
diff --git a/policy/modules/contrib/apm.te b/policy/modules/contrib/apm.te
index d6344dc94229..82b74a90b8fd 100644
--- a/policy/modules/contrib/apm.te
+++ b/policy/modules/contrib/apm.te
@@ -35,6 +35,9 @@ files_type(apmd_var_lib_t)
 type apmd_var_run_t;
 files_pid_file(apmd_var_run_t)
 
+type apmd_unit_t;
+init_unit_file(apmd_unit_t)
+
 ########################################
 #
 # Client local policy
diff --git a/policy/modules/contrib/arpwatch.fc b/policy/modules/contrib/arpwatch.fc
index af12072997b3..d74af0ad10e2 100644
--- a/policy/modules/contrib/arpwatch.fc
+++ b/policy/modules/contrib/arpwatch.fc
@@ -1,5 +1,7 @@
 /etc/rc\.d/init\.d/arpwatch	--	gen_context(system_u:object_r:arpwatch_initrc_exec_t,s0)
 
+/usr/lib/systemd/system/arpwatch.service -- gen_context(system_u:object_r:arpwatch_unit_t,s0)
+
 /usr/s?bin/arpwatch	--	gen_context(system_u:object_r:arpwatch_exec_t,s0)
 
 /var/arpwatch(/.*)?	gen_context(system_u:object_r:arpwatch_data_t,s0)
diff --git a/policy/modules/contrib/arpwatch.te b/policy/modules/contrib/arpwatch.te
index 97ecc558b86c..606c467d5e09 100644
--- a/policy/modules/contrib/arpwatch.te
+++ b/policy/modules/contrib/arpwatch.te
@@ -21,6 +21,9 @@ files_tmp_file(arpwatch_tmp_t)
 type arpwatch_var_run_t;
 files_pid_file(arpwatch_var_run_t)
 
+type arpwatch_unit_t;
+init_unit_file(arpwatch_unit_t)
+
 ########################################
 #
 # Local policy
diff --git a/policy/modules/contrib/automount.fc b/policy/modules/contrib/automount.fc
index 4a731d2b69b5..d7233f5c1e9f 100644
--- a/policy/modules/contrib/automount.fc
+++ b/policy/modules/contrib/automount.fc
@@ -1,6 +1,8 @@
 /etc/apm/event\.d/autofs	--	gen_context(system_u:object_r:automount_exec_t,s0)
 /etc/rc\.d/init\.d/autofs	--	gen_context(system_u:object_r:automount_initrc_exec_t,s0)
 
+/usr/lib/systemd/system/autofs\.service -- gen_context(system_u:object_r:automount_unit_t,s0)
+
 /usr/s?bin/automount	--	gen_context(system_u:object_r:automount_exec_t,s0)
 
 /var/lock/subsys/autofs	--	gen_context(system_u:object_r:automount_lock_t,s0)
diff --git a/policy/modules/contrib/automount.te b/policy/modules/contrib/automount.te
index be5adee32971..cfe6dff22d56 100644
--- a/policy/modules/contrib/automount.te
+++ b/policy/modules/contrib/automount.te
@@ -22,6 +22,9 @@ type automount_tmp_t;
 files_tmp_file(automount_tmp_t)
 files_mountpoint(automount_tmp_t)
 
+type automount_unit_t;
+init_unit_file(automount_unit_t)
+
 type automount_var_run_t;
 files_pid_file(automount_var_run_t)
 
diff --git a/policy/modules/contrib/avahi.fc b/policy/modules/contrib/avahi.fc
index fc7c5eaf5ea9..37b83bbd67e4 100644
--- a/policy/modules/contrib/avahi.fc
+++ b/policy/modules/contrib/avahi.fc
@@ -1,5 +1,8 @@
 /etc/rc\.d/init\.d/avahi.*	--	gen_context(system_u:object_r:avahi_initrc_exec_t,s0)
 
+/usr/lib/systemd/system/avahi-daemon.* -- gen_context(system_u:object_r:avahi_unit_t,s0)
+/usr/lib/systemd/system/avahi-dnsconfd.* -- gen_context(system_u:object_r:avahi_unit_t,s0)
+
 /usr/s?bin/avahi-daemon	--	gen_context(system_u:object_r:avahi_exec_t,s0)
 /usr/s?bin/avahi-dnsconfd	--	gen_context(system_u:object_r:avahi_exec_t,s0)
 /usr/s?bin/avahi-autoipd	--	gen_context(system_u:object_r:avahi_exec_t,s0)
diff --git a/policy/modules/contrib/avahi.te b/policy/modules/contrib/avahi.te
index 461cef0d403a..2dbcc8d525da 100644
--- a/policy/modules/contrib/avahi.te
+++ b/policy/modules/contrib/avahi.te
@@ -19,6 +19,9 @@ files_pid_file(avahi_var_lib_t)
 type avahi_var_run_t;
 files_pid_file(avahi_var_run_t)
 
+type avahi_unit_t;
+init_unit_file(avahi_unit_t)
+
 ########################################
 #
 # Local policy
diff --git a/policy/modules/contrib/bind.fc b/policy/modules/contrib/bind.fc
index ca6c477d4695..18fb5b135d12 100644
--- a/policy/modules/contrib/bind.fc
+++ b/policy/modules/contrib/bind.fc
@@ -14,6 +14,10 @@
 /etc/unbound(/.*)?	gen_context(system_u:object_r:named_conf_t,s0)
 /etc/unbound/.*\.key	--	gen_context(system_u:object_r:dnssec_t,s0)
 
+/usr/lib/systemd/system/unbound.service -- gen_context(system_u:object_r:named_unit_t,s0)
+/usr/lib/systemd/system/unbound-keygen.service -- gen_context(system_u:object_r:named_unit_t,s0)
+/usr/lib/systemd/system/named.service -- gen_context(system_u:object_r:named_unit_t,s0)
+
 /usr/s?bin/lwresd	--	gen_context(system_u:object_r:named_exec_t,s0)
 /usr/s?bin/named	--	gen_context(system_u:object_r:named_exec_t,s0)
 /usr/s?bin/named-checkconf	--	gen_context(system_u:object_r:named_checkconf_exec_t,s0)
diff --git a/policy/modules/contrib/bind.te b/policy/modules/contrib/bind.te
index 6991aeba10ed..6b11fb595a01 100644
--- a/policy/modules/contrib/bind.te
+++ b/policy/modules/contrib/bind.te
@@ -53,6 +53,9 @@ logging_log_file(named_log_t)
 type named_tmp_t;
 files_tmp_file(named_tmp_t)
 
+type named_unit_t;
+init_unit_file(named_unit_t)
+
 type named_var_run_t;
 files_pid_file(named_var_run_t)
 init_daemon_pid_file(named_var_run_t, dir, "named")
diff --git a/policy/modules/contrib/clamav.fc b/policy/modules/contrib/clamav.fc
index e1791f2604e2..6bb710bbd450 100644
--- a/policy/modules/contrib/clamav.fc
+++ b/policy/modules/contrib/clamav.fc
@@ -2,6 +2,10 @@
 
 /etc/rc\.d/init\.d/clamd.*	--	gen_context(system_u:object_r:clamd_initrc_exec_t,s0)
 
+/usr/lib/systemd/system/clamd@scan\.service -- gen_context(system_u:object_r:clamd_unit_t,s0)
+/usr/lib/systemd/system/clamd@\.service -- gen_context(system_u:object_r:clamd_unit_t,s0)
+/usr/lib/systemd/system/clamd\.clamav\.service -- gen_context(system_u:object_r:clamd_unit_t,s0)
+
 /usr/bin/clamscan	--	gen_context(system_u:object_r:clamscan_exec_t,s0)
 /usr/bin/clamdscan	--	gen_context(system_u:object_r:clamscan_exec_t,s0)
 /usr/bin/freshclam	--	gen_context(system_u:object_r:freshclam_exec_t,s0)
diff --git a/policy/modules/contrib/clamav.te b/policy/modules/contrib/clamav.te
index 2587877d6043..71949fa5bebc 100644
--- a/policy/modules/contrib/clamav.te
+++ b/policy/modules/contrib/clamav.te
@@ -38,6 +38,9 @@ files_config_file(clamd_etc_t)
 type clamd_initrc_exec_t;
 init_script_file(clamd_initrc_exec_t)
 
+type clamd_unit_t;
+init_unit_file(clamd_unit_t)
+
 type clamd_tmp_t;
 files_tmp_file(clamd_tmp_t)
 
diff --git a/policy/modules/contrib/colord.fc b/policy/modules/contrib/colord.fc
index 71639eb54374..5fac35735362 100644
--- a/policy/modules/contrib/colord.fc
+++ b/policy/modules/contrib/colord.fc
@@ -4,6 +4,8 @@
 /usr/lib/[^/]*/colord/colord	--	gen_context(system_u:object_r:colord_exec_t,s0)
 /usr/lib/[^/]*/colord/colord-sane	--	gen_context(system_u:object_r:colord_exec_t,s0)
 
+/usr/lib/systemd/system/colord\.service -- gen_context(system_u:object_r:colord_unit_t,s0)
+
 /usr/libexec/colord	--	gen_context(system_u:object_r:colord_exec_t,s0)
 /usr/libexec/colord-sane	--	gen_context(system_u:object_r:colord_exec_t,s0)
 
diff --git a/policy/modules/contrib/colord.te b/policy/modules/contrib/colord.te
index f3eca54a98cb..6d09ec6aa0f0 100644
--- a/policy/modules/contrib/colord.te
+++ b/policy/modules/contrib/colord.te
@@ -18,6 +18,9 @@ files_tmpfs_file(colord_tmpfs_t)
 type colord_var_lib_t;
 files_type(colord_var_lib_t)
 
+type colord_unit_t;
+init_unit_file(colord_unit_t)
+
 ########################################
 #
 # Local policy
diff --git a/policy/modules/contrib/consolekit.fc b/policy/modules/contrib/consolekit.fc
index 0dbb0ab52ed4..c082a33c450e 100644
--- a/policy/modules/contrib/consolekit.fc
+++ b/policy/modules/contrib/consolekit.fc
@@ -1,3 +1,5 @@
+/usr/lib/systemd/system/console-kit.*\.service -- gen_context(system_u:object_r:consolekit_unit_t,s0)
+
 /usr/s?bin/console-kit-daemon	--	gen_context(system_u:object_r:consolekit_exec_t,s0)
 
 /var/log/ConsoleKit(/.*)?	gen_context(system_u:object_r:consolekit_log_t,s0)
diff --git a/policy/modules/contrib/consolekit.te b/policy/modules/contrib/consolekit.te
index 050c5c59f408..d7cbc290124d 100644
--- a/policy/modules/contrib/consolekit.te
+++ b/policy/modules/contrib/consolekit.te
@@ -19,6 +19,9 @@ type consolekit_var_run_t;
 files_pid_file(consolekit_var_run_t)
 init_daemon_pid_file(consolekit_var_run_t, dir, "ConsoleKit")
 
+type consolekit_unit_t;
+init_unit_file(consolekit_unit_t)
+
 ########################################
 #
 # Local policy
diff --git a/policy/modules/contrib/cron.fc b/policy/modules/contrib/cron.fc
index 76b3b8f9136f..1fc7f93d053b 100644
--- a/policy/modules/contrib/cron.fc
+++ b/policy/modules/contrib/cron.fc
@@ -6,6 +6,9 @@
 /usr/bin/at	--	gen_context(system_u:object_r:crontab_exec_t,s0)
 /usr/bin/(f)?crontab	--	gen_context(system_u:object_r:crontab_exec_t,s0)
 
+/usr/lib/systemd/system/atd\.service -- gen_context(system_u:object_r:crond_unit_t,s0)
+/usr/lib/systemd/system/crond\.service -- gen_context(system_u:object_r:crond_unit_t,s0)
+
 /usr/libexec/fcron	--	gen_context(system_u:object_r:crond_exec_t,s0)
 /usr/libexec/fcronsighup	--	gen_context(system_u:object_r:crontab_exec_t,s0)
 
diff --git a/policy/modules/contrib/cron.te b/policy/modules/contrib/cron.te
index b481d5d6f259..f0a94bb43f76 100644
--- a/policy/modules/contrib/cron.te
+++ b/policy/modules/contrib/cron.te
@@ -71,6 +71,9 @@ domain_cron_exemption_source(crond_t)
 type crond_initrc_exec_t;
 init_script_file(crond_initrc_exec_t)
 
+type crond_unit_t;
+init_unit_file(crond_unit_t)
+
 type crond_tmp_t;
 files_tmp_file(crond_tmp_t)
 files_poly_parent(crond_tmp_t)
diff --git a/policy/modules/contrib/cups.fc b/policy/modules/contrib/cups.fc
index 206dea4128eb..44358c3529a6 100644
--- a/policy/modules/contrib/cups.fc
+++ b/policy/modules/contrib/cups.fc
@@ -20,6 +20,9 @@
 
 /lib/udev/udev-configure-printer	--	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
 
+/usr/lib/systemd/system/cups\.service -- gen_context(system_u:object_r:cupsd_unit_t,s0)
+/usr/lib/systemd/system/org\.cups\.cupsd\.service -- gen_context(system_u:object_r:cupsd_unit_t,s0)
+
 /opt/brother/Printers(.*/)?inf(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 /opt/gutenprint/ppds(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 
diff --git a/policy/modules/contrib/cups.te b/policy/modules/contrib/cups.te
index 1edccbe97044..80199f014346 100644
--- a/policy/modules/contrib/cups.te
+++ b/policy/modules/contrib/cups.te
@@ -63,6 +63,9 @@ files_pid_file(cupsd_var_run_t)
 init_daemon_pid_file(cupsd_var_run_t, dir, "cups")
 mls_trusted_object(cupsd_var_run_t)
 
+type cupsd_unit_t;
+init_unit_file(cupsd_unit_t)
+
 type hplip_t;
 type hplip_exec_t;
 init_daemon_domain(hplip_t, hplip_exec_t)
diff --git a/policy/modules/contrib/dhcp.fc b/policy/modules/contrib/dhcp.fc
index d00dc796493d..b82a438e88f5 100644
--- a/policy/modules/contrib/dhcp.fc
+++ b/policy/modules/contrib/dhcp.fc
@@ -1,6 +1,7 @@
 /etc/rc\.d/init\.d/dhcpd(6)?	--	gen_context(system_u:object_r:dhcpd_initrc_exec_t,s0)
 
 /usr/s?bin/dhcpd.*	--	gen_context(system_u:object_r:dhcpd_exec_t,s0)
+/usr/lib/systemd/system/dhcpcd.*	--	gen_context(system_u:object_r:dhcpd_unit_t,s0)
 
 /var/lib/dhcpd(/.*)?	gen_context(system_u:object_r:dhcpd_state_t,s0)
 /var/lib/dhcp(3)?/dhcpd\.leases.*	--	gen_context(system_u:object_r:dhcpd_state_t,s0)
diff --git a/policy/modules/contrib/dhcp.te b/policy/modules/contrib/dhcp.te
index 2d64a81daa95..3f1c7a0a59e6 100644
--- a/policy/modules/contrib/dhcp.te
+++ b/policy/modules/contrib/dhcp.te
@@ -20,6 +20,9 @@ init_daemon_domain(dhcpd_t, dhcpd_exec_t)
 type dhcpd_initrc_exec_t;
 init_script_file(dhcpd_initrc_exec_t)
 
+type dhcpd_unit_t;
+init_unit_file(dhcpd_unit_t)
+
 type dhcpd_state_t;
 files_type(dhcpd_state_t)
 
diff --git a/policy/modules/contrib/ftp.fc b/policy/modules/contrib/ftp.fc
index 974f6282a4cb..08a52d60e375 100644
--- a/policy/modules/contrib/ftp.fc
+++ b/policy/modules/contrib/ftp.fc
@@ -5,6 +5,9 @@
 /etc/rc\.d/init\.d/vsftpd	--	gen_context(system_u:object_r:ftpd_initrc_exec_t,s0)
 /etc/rc\.d/init\.d/proftpd	--	gen_context(system_u:object_r:ftpd_initrc_exec_t,s0)
 
+/usr/lib/systemd/system/vsftpd.* -- gen_context(system_u:object_r:ftpd_unit_t,s0)
+/usr/lib/systemd/system/proftpd.* -- gen_context(system_u:object_r:ftpd_unit_t,s0)
+
 /usr/bin/ftpdctl	--	gen_context(system_u:object_r:ftpdctl_exec_t,s0)
 
 /usr/kerberos/sbin/ftpd	--	gen_context(system_u:object_r:ftpd_exec_t,s0)
diff --git a/policy/modules/contrib/ftp.te b/policy/modules/contrib/ftp.te
index 774bc9ef31cf..0213d86d1773 100644
--- a/policy/modules/contrib/ftp.te
+++ b/policy/modules/contrib/ftp.te
@@ -136,6 +136,9 @@ files_tmp_file(ftpd_tmp_t)
 type ftpd_tmpfs_t;
 files_tmpfs_file(ftpd_tmpfs_t)
 
+type ftpd_unit_t;
+init_unit_file(ftpd_unit_t)
+
 type ftpd_var_run_t;
 files_pid_file(ftpd_var_run_t)
 
diff --git a/policy/modules/contrib/kdump.fc b/policy/modules/contrib/kdump.fc
index b1fe716855f9..b151b8e8ef74 100644
--- a/policy/modules/contrib/kdump.fc
+++ b/policy/modules/contrib/kdump.fc
@@ -4,6 +4,8 @@
 
 /bin/kdumpctl	--	gen_context(system_u:object_r:kdumpctl_exec_t,s0)
 
+/usr/lib/systemd/system/kdump.service -- gen_context(system_u:object_r:kdump_unit_t,s0)
+
 /usr/bin/kdumpctl	--	gen_context(system_u:object_r:kdumpctl_exec_t,s0)
 
 /sbin/kdump	--	gen_context(system_u:object_r:kdump_exec_t,s0)
diff --git a/policy/modules/contrib/ldap.fc b/policy/modules/contrib/ldap.fc
index 23b0e9a58902..295f1e0a6dfc 100644
--- a/policy/modules/contrib/ldap.fc
+++ b/policy/modules/contrib/ldap.fc
@@ -4,6 +4,8 @@
 
 /etc/rc\.d/init\.d/ldap	--	gen_context(system_u:object_r:slapd_initrc_exec_t,s0)
 
+/usr/lib/systemd/system/slapd.* --	gen_context(system_u:object_r:iptables_unit_t,s0)
+
 /usr/s?bin/slapd	--	gen_context(system_u:object_r:slapd_exec_t,s0)
 
 /usr/lib/openldap/slapd	--	gen_context(system_u:object_r:slapd_exec_t,s0)
diff --git a/policy/modules/contrib/ldap.te b/policy/modules/contrib/ldap.te
index 28c36b58dd0d..70937452e22a 100644
--- a/policy/modules/contrib/ldap.te
+++ b/policy/modules/contrib/ldap.te
@@ -39,6 +39,9 @@ files_tmp_file(slapd_tmp_t)
 type slapd_tmpfs_t;
 files_tmpfs_file(slapd_tmpfs_t)
 
+type slapd_unit_t;
+init_unit_file(slapd_unit_t)
+
 type slapd_var_run_t;
 files_pid_file(slapd_var_run_t)
 
diff --git a/policy/modules/contrib/mysql.fc b/policy/modules/contrib/mysql.fc
index 3898bc8243fc..947aa89d0e4a 100644
--- a/policy/modules/contrib/mysql.fc
+++ b/policy/modules/contrib/mysql.fc
@@ -7,6 +7,8 @@ HOME_DIR/\.my\.cnf	--	gen_context(system_u:object_r:mysqld_home_t,s0)
 /etc/rc\.d/init\.d/mysqld?	--	gen_context(system_u:object_r:mysqld_initrc_exec_t,s0)
 /etc/rc\.d/init\.d/mysqlmanager	--	gen_context(system_u:object_r:mysqlmanagerd_initrc_exec_t,s0)
 
+/usr/lib/systemd/system/mysqld\.service -- gen_context(system_u:object_r:mysqld_unit_t,s0)
+
 /usr/bin/mysqld_safe	--	gen_context(system_u:object_r:mysqld_safe_exec_t,s0)
 /usr/bin/mysql_upgrade	--	gen_context(system_u:object_r:mysqld_exec_t,s0)
 
diff --git a/policy/modules/contrib/mysql.te b/policy/modules/contrib/mysql.te
index 0db8319b2386..989e709265f7 100644
--- a/policy/modules/contrib/mysql.te
+++ b/policy/modules/contrib/mysql.te
@@ -38,6 +38,9 @@ files_config_file(mysqld_etc_t)
 type mysqld_home_t;
 userdom_user_home_content(mysqld_home_t)
 
+type mysqld_unit_t;
+init_unit_file(mysqld_unit_t)
+
 type mysqld_initrc_exec_t;
 init_script_file(mysqld_initrc_exec_t)
 
diff --git a/policy/modules/contrib/networkmanager.te b/policy/modules/contrib/networkmanager.te
index da9d5d19715e..f8a2457c3094 100644
--- a/policy/modules/contrib/networkmanager.te
+++ b/policy/modules/contrib/networkmanager.te
@@ -18,15 +18,15 @@ files_config_file(NetworkManager_etc_rw_t)
 type NetworkManager_initrc_exec_t;
 init_script_file(NetworkManager_initrc_exec_t)
 
+type NetworkManager_unit_t;
+init_unit_file(NetworkManager_unit_t)
+
 type NetworkManager_log_t;
 logging_log_file(NetworkManager_log_t)
 
 type NetworkManager_tmp_t;
 files_tmp_file(NetworkManager_tmp_t)
 
-type NetworkManager_unit_t;
-init_unit_file(NetworkManager_unit_t)
-
 type NetworkManager_var_lib_t;
 files_type(NetworkManager_var_lib_t)
 
diff --git a/policy/modules/contrib/nis.fc b/policy/modules/contrib/nis.fc
index 09c298396cd2..1b8e48057f35 100644
--- a/policy/modules/contrib/nis.fc
+++ b/policy/modules/contrib/nis.fc
@@ -20,3 +20,8 @@
 /var/run/ypbind.*	--	gen_context(system_u:object_r:ypbind_var_run_t,s0)
 /var/run/ypserv.*	--	gen_context(system_u:object_r:ypserv_var_run_t,s0)
 /var/run/yppass.*	--	gen_context(system_u:object_r:yppasswdd_var_run_t,s0)
+
+/usr/lib/systemd/system/ypbind\.service    --      gen_context(system_u:object_r:ypbind_unit_t,s0)
+/usr/lib/systemd/system/ypserv\.service    --      gen_context(system_u:object_r:nis_unit_t,s0)
+/usr/lib/systemd/system/yppasswdd\.service --      gen_context(system_u:object_r:nis_unit_t,s0)
+/usr/lib/systemd/system/ypxfrd\.service    --      gen_context(system_u:object_r:nis_unit_t,s0)
diff --git a/policy/modules/contrib/nis.te b/policy/modules/contrib/nis.te
index 71a2e6f1da93..807b729b83e8 100644
--- a/policy/modules/contrib/nis.te
+++ b/policy/modules/contrib/nis.te
@@ -27,6 +27,9 @@ files_tmp_file(ypbind_tmp_t)
 type ypbind_var_run_t;
 files_pid_file(ypbind_var_run_t)
 
+type ypbind_unit_t;
+init_unit_file(ypbind_unit_t)
+
 type yppasswdd_t;
 type yppasswdd_exec_t;
 init_daemon_domain(yppasswdd_t, yppasswdd_exec_t)
@@ -55,6 +58,9 @@ init_daemon_domain(ypxfr_t, ypxfr_exec_t)
 type ypxfr_var_run_t;
 files_pid_file(ypxfr_var_run_t)
 
+type nis_unit_t;
+init_unit_file(nis_unit_t)
+
 ########################################
 #
 # ypbind local policy
diff --git a/policy/modules/contrib/nscd.fc b/policy/modules/contrib/nscd.fc
index a39d96c4e825..624bd8a15d38 100644
--- a/policy/modules/contrib/nscd.fc
+++ b/policy/modules/contrib/nscd.fc
@@ -1,5 +1,8 @@
 /etc/rc\.d/init\.d/nscd	--	gen_context(system_u:object_r:nscd_initrc_exec_t,s0)
 
+# Systemd unit files
+/usr/lib/systemd/system/nscd.*	--	gen_context(system_u:object_r:nscd_unit_t,s0)
+
 /usr/s?bin/nscd	--	gen_context(system_u:object_r:nscd_exec_t,s0)
 
 /var/cache/nscd(/.*)?	gen_context(system_u:object_r:nscd_var_run_t,s0)
diff --git a/policy/modules/contrib/nscd.te b/policy/modules/contrib/nscd.te
index 998dcdd1aab6..cddce83b21c5 100644
--- a/policy/modules/contrib/nscd.te
+++ b/policy/modules/contrib/nscd.te
@@ -34,6 +34,9 @@ init_script_file(nscd_initrc_exec_t)
 type nscd_log_t;
 logging_log_file(nscd_log_t)
 
+type nscd_unit_t;
+init_unit_file(nscd_unit_t);
+
 ########################################
 #
 # Local policy
diff --git a/policy/modules/contrib/ntp.fc b/policy/modules/contrib/ntp.fc
index 4aee20d75082..58b2d5bccbdf 100644
--- a/policy/modules/contrib/ntp.fc
+++ b/policy/modules/contrib/ntp.fc
@@ -13,6 +13,7 @@
 
 # Systemd unit file
 /usr/lib/systemd/ntp-units\.d/.*  --   gen_context(system_u:object_r:ntpd_unit_t,s0)
+/usr/lib/systemd/system/ntpd\.service               --      gen_context(system_u:object_r:ntpd_unit_t,s0)
 
 /usr/s?bin/ntpd		--	gen_context(system_u:object_r:ntpd_exec_t,s0)
 /usr/s?bin/ntpdate	--	gen_context(system_u:object_r:ntpdate_exec_t,s0)
diff --git a/policy/modules/contrib/ntp.te b/policy/modules/contrib/ntp.te
index 12a61620b7ff..b7430fdd779c 100644
--- a/policy/modules/contrib/ntp.te
+++ b/policy/modules/contrib/ntp.te
@@ -21,6 +21,9 @@ init_script_file(ntpd_initrc_exec_t)
 type ntp_conf_t;
 files_config_file(ntp_conf_t)
 
+type ntpd_unit_t;
+init_unit_file(ntpd_unit_t)
+
 type ntpd_key_t;
 files_type(ntpd_key_t)
 
@@ -33,9 +36,6 @@ files_tmp_file(ntpd_tmp_t)
 type ntpd_tmpfs_t;
 files_tmpfs_file(ntpd_tmpfs_t)
 
-type ntpd_unit_t;
-init_unit_file(ntpd_unit_t)
-
 type ntpd_var_run_t;
 files_pid_file(ntpd_var_run_t)
 
diff --git a/policy/modules/contrib/openvpn.fc b/policy/modules/contrib/openvpn.fc
index 928a8af9df07..6b6ac3512ccb 100644
--- a/policy/modules/contrib/openvpn.fc
+++ b/policy/modules/contrib/openvpn.fc
@@ -3,6 +3,8 @@
 
 /etc/rc\.d/init\.d/openvpn	--	gen_context(system_u:object_r:openvpn_initrc_exec_t,s0)
 
+/usr/lib/systemd/system/openvpn\.service -- gen_context(system_u:object_r:openvpn_unit_t,s0)
+
 /usr/s?bin/openvpn	--	gen_context(system_u:object_r:openvpn_exec_t,s0)
 
 /var/log/openvpn-status\.log.*	--	gen_context(system_u:object_r:openvpn_status_t,s0)
diff --git a/policy/modules/contrib/openvpn.te b/policy/modules/contrib/openvpn.te
index fb30050dab3a..fb386274447a 100644
--- a/policy/modules/contrib/openvpn.te
+++ b/policy/modules/contrib/openvpn.te
@@ -43,6 +43,9 @@ logging_log_file(openvpn_status_t)
 type openvpn_tmp_t;
 files_tmp_file(openvpn_tmp_t)
 
+type openvpn_unit_t;
+init_unit_file(openvpn_unit_t)
+
 type openvpn_var_log_t;
 logging_log_file(openvpn_var_log_t)
 
diff --git a/policy/modules/contrib/ppp.fc b/policy/modules/contrib/ppp.fc
index fae90d342d1e..952d0e2b274f 100644
--- a/policy/modules/contrib/ppp.fc
+++ b/policy/modules/contrib/ppp.fc
@@ -12,6 +12,8 @@ HOME_DIR/\.ppprc	--	gen_context(system_u:object_r:ppp_home_t,s0)
 /sbin/ppp-watch	--	gen_context(system_u:object_r:pppd_exec_t,s0)
 /sbin/pppoe-server	--	gen_context(system_u:object_r:pppd_exec_t,s0)
 
+/usr/lib/systemd/system/ppp.*	--	gen_context(system_u:object_r:iptables_unit_t,s0)
+
 /usr/s?bin/ipppd	--	gen_context(system_u:object_r:pppd_exec_t,s0)
 /usr/s?bin/ppp-watch	--	gen_context(system_u:object_r:pppd_exec_t,s0)
 /usr/s?bin/pppd	--	gen_context(system_u:object_r:pppd_exec_t,s0)
diff --git a/policy/modules/contrib/ppp.te b/policy/modules/contrib/ppp.te
index 1d3079ff0923..e974c0f742a1 100644
--- a/policy/modules/contrib/ppp.te
+++ b/policy/modules/contrib/ppp.te
@@ -53,6 +53,9 @@ files_lock_file(pppd_lock_t)
 type pppd_tmp_t;
 files_tmp_file(pppd_tmp_t)
 
+type pppd_unit_t;
+init_unit_file(pppd_unit_t)
+
 type pppd_var_run_t;
 files_pid_file(pppd_var_run_t)
 
diff --git a/policy/modules/contrib/rpc.fc b/policy/modules/contrib/rpc.fc
index 0344d07f86b9..32881246bb25 100644
--- a/policy/modules/contrib/rpc.fc
+++ b/policy/modules/contrib/rpc.fc
@@ -7,6 +7,9 @@
 /sbin/rpc\..*	--	gen_context(system_u:object_r:rpcd_exec_t,s0)
 /sbin/sm-notify	--	gen_context(system_u:object_r:rpcd_exec_t,s0)
 
+/usr/lib/systemd/system/nfs.* --	gen_context(system_u:object_r:nfsd_unit_t,s0)
+/usr/lib/systemd/system/rpc.* --	gen_context(system_u:object_r:rpcd_unit_t,s0)
+
 /usr/s?bin/rpc\..*	--	gen_context(system_u:object_r:rpcd_exec_t,s0)
 /usr/s?bin/rpc\.idmapd	--	gen_context(system_u:object_r:rpcd_exec_t,s0)
 /usr/s?bin/rpc\.gssd	--	gen_context(system_u:object_r:gssd_exec_t,s0)
diff --git a/policy/modules/contrib/rpc.te b/policy/modules/contrib/rpc.te
index 93ce41a5770d..4a8d842b02c4 100644
--- a/policy/modules/contrib/rpc.te
+++ b/policy/modules/contrib/rpc.te
@@ -52,11 +52,17 @@ rpc_domain_template(rpcd)
 type rpcd_initrc_exec_t;
 init_script_file(rpcd_initrc_exec_t)
 
+type rpcd_unit_t;
+init_unit_file(rpcd_unit_t)
+
 rpc_domain_template(nfsd)
 
 type nfsd_initrc_exec_t;
 init_script_file(nfsd_initrc_exec_t)
 
+type nfsd_unit_t;
+init_unit_file(nfsd_unit_t)
+
 type nfsd_rw_t;
 files_type(nfsd_rw_t)
 
diff --git a/policy/modules/contrib/samba.fc b/policy/modules/contrib/samba.fc
index 9155792b84f9..f24f980fb1be 100644
--- a/policy/modules/contrib/samba.fc
+++ b/policy/modules/contrib/samba.fc
@@ -8,6 +8,8 @@
 /etc/samba/smbpasswd	--	gen_context(system_u:object_r:samba_secrets_t,s0)
 /etc/samba(/.*)?	gen_context(system_u:object_r:samba_etc_t,s0)
 
+/usr/lib/systemd/system/smb.service --	gen_context(system_u:object_r:samba_unit_t,s0)
+
 /usr/bin/net	--	gen_context(system_u:object_r:samba_net_exec_t,s0)
 /usr/bin/ntlm_auth	--	gen_context(system_u:object_r:winbind_helper_exec_t,s0)
 /usr/bin/smbcontrol	--	gen_context(system_u:object_r:smbcontrol_exec_t,s0)
diff --git a/policy/modules/contrib/samba.te b/policy/modules/contrib/samba.te
index f6e9be311db5..6607c964af45 100644
--- a/policy/modules/contrib/samba.te
+++ b/policy/modules/contrib/samba.te
@@ -113,6 +113,9 @@ files_config_file(samba_etc_t)
 type samba_initrc_exec_t;
 init_script_file(samba_initrc_exec_t)
 
+type samba_unit_t;
+init_unit_file(samba_unit_t)
+
 type samba_log_t;
 logging_log_file(samba_log_t)
 
diff --git a/policy/modules/contrib/tor.fc b/policy/modules/contrib/tor.fc
index c92677765d33..9e0077dec750 100644
--- a/policy/modules/contrib/tor.fc
+++ b/policy/modules/contrib/tor.fc
@@ -4,6 +4,7 @@
 
 /usr/bin/tor	--	gen_context(system_u:object_r:tor_exec_t,s0)
 /usr/s?bin/tor	--	gen_context(system_u:object_r:tor_exec_t,s0)
+/usr/lib/systemd/system/tor\.service -- gen_context(system_u:object_r:tor_unit_t,s0)
 
 /var/lib/tor(/.*)?	gen_context(system_u:object_r:tor_var_lib_t,s0)
 /var/lib/tor-data(/.*)?	gen_context(system_u:object_r:tor_var_lib_t,s0)
diff --git a/policy/modules/contrib/tor.te b/policy/modules/contrib/tor.te
index 418eb2953306..8a675febb69c 100644
--- a/policy/modules/contrib/tor.te
+++ b/policy/modules/contrib/tor.te
@@ -33,6 +33,9 @@ type tor_var_run_t;
 files_pid_file(tor_var_run_t)
 init_daemon_pid_file(tor_var_run_t, dir, "tor")
 
+type tor_unit_t;
+init_unit_file(tor_unit_t)
+
 ########################################
 #
 # Local policy
-- 
2.6.4