Index: selinux/build/nagios-nrpe.fc
===================================================================
--- selinux/build/nagios-nrpe.fc	(revision 88)
+++ selinux/build/nagios-nrpe.fc	(revision 88)
@@ -0,0 +1,5 @@
+# Joe Presbrey
+# presbrey@mit.edu
+# 2006/1/15
+
+/usr/sbin/nrpe gen_context(system_u:object_r:nrpe_exec_t,s0)
Index: selinux/build/nagios-nrpe.if
===================================================================
--- selinux/build/nagios-nrpe.if	(revision 88)
+++ selinux/build/nagios-nrpe.if	(revision 88)
@@ -0,0 +1,25 @@
+# Joe Presbrey
+# presbrey@mit.edu
+# 2006/1/15
+
+interface(`nrpe_domtrans',`
+        gen_requires(`
+                type nrpe_t, nrpe_exec_t;
+        ')
+
+        domain_auto_trans($1,nrpe_exec_t,nrpe_t)
+
+        allow $1 nrpe_t:fd use;
+        allow nrpe_t $1:fd use;
+        allow nrpe_t:$1:fifo_file rw_file_perms;
+        allow nrpe_t $1:process sigchld;
+')
+
+template(`nrpe_access',`
+        require {
+                type nrpe_etc_t;
+        }
+
+	allow $1 nrpe_etc_t:file r_file_perms;
+	allow $1 nrpe_etc_t:dir r_dir_perms;
+')
Index: selinux/build/nagios-nrpe.te
===================================================================
--- selinux/build/nagios-nrpe.te	(revision 88)
+++ selinux/build/nagios-nrpe.te	(revision 88)
@@ -0,0 +1,56 @@
+# Joe Presbrey
+# presbrey@mit.edu
+# 2006/1/15
+
+policy_module(nrpe,1.0.0)
+
+require {
+	type nrpe_t, nrpe_exec_t;
+        type inaddr_any_node_t;
+        type inetd_child_port_t;
+        type initrc_var_run_t;
+        type nrpe_t;
+        type port_t;
+        type var_run_t;
+};
+
+########################################
+#
+# nrpe local policy
+
+files_read_etc_files(nrpe_t)
+files_rw_etc_runtime_files(nrpe_t)
+libs_use_ld_so(nrpe_t)
+libs_use_shared_libs(nrpe_t)
+miscfiles_read_localization(nrpe_t)
+
+sysnet_dns_name_resolve(nrpe_t)
+corenet_tcp_sendrecv_all_nodes(nrpe_t)
+corenet_udp_sendrecv_all_nodes(nrpe_t)
+
+nagios_read_config(nrpe_t)
+files_rw_generic_pids(nrpe_t)
+allow nrpe_t self:capability { setgid setuid };
+allow nrpe_t self:tcp_socket { accept bind create listen setopt };
+
+require {
+	attribute domain;
+	attribute file_type;
+	attribute filesystem_type;
+};
+
+domain_read_all_domains_state(nrpe_t)
+dontaudit nrpe_t domain:dir getattr;
+dontaudit nrpe_t file_type:dir all_dir_perms;
+dontaudit nrpe_t file_type:file all_file_perms;
+files_getattr_all_dirs(nrpe_t)
+files_getattr_all_files(nrpe_t)
+fs_getattr_all_fs(nrpe_t)
+fs_get_xattr_fs_quotas(nrpe_t)
+
+allow nrpe_t inaddr_any_node_t:tcp_socket node_bind;
+allow nrpe_t inetd_child_port_t:tcp_socket name_bind;
+allow nrpe_t initrc_var_run_t:file { lock read };
+allow nrpe_t port_t:tcp_socket { recv_msg send_msg };
+allow nrpe_t var_run_t:dir { add_name write };
+allow nrpe_t var_run_t:file create;