--- nsaserefpolicy/policy/modules/system/unconfined.if	2007-02-19 11:32:53.000000000 -0500
+++ serefpolicy-2.5.10/policy/modules/system/unconfined.if	2007-03-23 14:33:51.000000000 -0400
@@ -18,7 +18,7 @@
 	')
 
 	# Use any Linux capability.
-	allow $1 self:capability *;
+	allow $1 self:capability all_capabilities;
 	allow $1 self:fifo_file manage_fifo_file_perms;
 
 	# Transition to myself, to make get_ordered_context_list happy.
@@ -28,10 +28,10 @@
 	allow $1 self:file rw_file_perms;
 
 	# Userland object managers
-	allow $1 self:nscd *;
-	allow $1 self:dbus *;
-	allow $1 self:passwd *;
-	allow $1 self:association *;
+	allow $1 self:nscd all_nscd;
+	allow $1 self:dbus all_dbus;
+	allow $1 self:passwd all_passwd;
+	allow $1 self:association all_association;
 
 	kernel_unconfined($1)
 	corenet_unconfined($1)
--- nsaserefpolicy/policy/support/obj_perm_sets.spt	2007-01-02 12:57:51.000000000 -0500
+++ serefpolicy-2.5.10/policy/support/obj_perm_sets.spt	2007-03-23 14:34:29.000000000 -0400
@@ -215,7 +215,7 @@
 define(`getattr_file_perms',`{ getattr }')
 define(`setattr_file_perms',`{ setattr }')
 define(`read_file_perms',`{ getattr read lock ioctl }')
-define(`mmap_file_perms',`{ getattr read execute }')
+define(`mmap_file_perms',`{ getattr read execute ioctl }')
 define(`exec_file_perms',`{ getattr read execute execute_no_trans }')
 define(`append_file_perms',`{ getattr append lock ioctl }')
 define(`write_file_perms',`{ getattr write append lock ioctl }')
@@ -324,3 +324,13 @@
 #
 define(`client_stream_socket_perms', `{ create ioctl read getattr write setattr append bind getopt setopt shutdown }')
 define(`server_stream_socket_perms', `{ client_stream_socket_perms listen accept }')
+
+define(`all_capabilities', `{ chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control }
+')
+
+define(`all_nscd', `{ getpwd getgrp gethost getstat admin shmempwd shmemgrp shmemhost } ')
+define(`all_dbus', `{ acquire_svc send_msg } ')
+define(`all_passwd', `{ passwd chfn chsh rootok crontab } ')
+define(`all_association', `{ sendto recvfrom setcontext polmatch } ')
+
+