--- prelude.orig/prelude.fc 
+++ prelude/prelude.fc 
@@ -10,5 +10,11 @@
 /var/run/prelude-manager(/.*)?	gen_context(system_u:object_r:prelude_var_run_t,s0)
 /var/spool/prelude-manager(/.*)?	gen_context(system_u:object_r:prelude_spool_t,s0)
 /var/spool/prelude(/.*)?	gen_context(system_u:object_r:prelude_spool_t,s0)
-/usr/share/prewikka/cgi-bin(/.*)?	gen_context(system_u:object_r:httpd_prewikka_script_exec_t,s0)
 
+/etc/prewikka/prewikka.conf                 --      gen_context(system_u:object_r:prewikka_etc_t,s0)
+/usr/share/prewikka/cgi-bin/prewikka.cgi     --      gen_context(system_u:object_r:prewikka_exec_t,s0)
+
+/usr/bin/prelude-lml	--	gen_context(system_u:object_r:prelude_lml_exec_t,s0)
+/var/run/prelude-lml.pid	--	gen_context(system_u:object_r:prelude_lml_var_run_t,s0)
+
+

--- prelude.orig/prelude.te 
+++ prelude/prelude.te 
@@ -145,17 +145,170 @@
 #
 
 optional_policy(`
-	apache_content_template(prewikka)
-	files_read_etc_files(httpd_prewikka_script_t)
-
-	optional_policy(`
-		mysql_search_db(httpd_prewikka_script_t)
-		mysql_stream_connect(httpd_prewikka_script_t)
-	')
-
-	optional_policy(`
-		postgresql_stream_connect(httpd_prewikka_script_t)
+	type prewikka_t;
+	type prewikka_exec_t;
+	apache_cgi_domain(prewikka_t, prewikka_exec_t)
+	role system_r types prewikka_t;
+
+	type prewikka_etc_t;
+	files_config_file(prewikka_etc_t)
+
+	########################################
+	#
+	# prewikka_cgi private policy
+	#
+	allow prewikka_t self:unix_stream_socket { write setopt shutdown read create connect };
+
+	# Fix me
+	allow prewikka_t self:fifo_file rw_fifo_file_perms;
+	allow prewikka_t self:dir search;
+	allow prewikka_t self:file { getattr read };
+
+	allow prewikka_t prewikka_etc_t:file read_file_perms;
+	allow prewikka_t prewikka_exec_t:file { read_file_perms entrypoint };
+
+	corecmd_search_bin(prewikka_t)
+
+	dev_read_urand(prewikka_t)
+
+	files_list_root(prewikka_t)
+	files_read_etc_files(prewikka_t)
+	files_read_usr_files(prewikka_t)
+
+	files_search_etc(prewikka_t)
+	files_search_pids(prewikka_t)
+	files_search_usr(prewikka_t)
+	files_search_var(prewikka_t)
+	files_search_var_lib(prewikka_t)
+
+	kernel_read_system_state(prewikka_t)
+
+	libs_exec_lib_files(prewikka_t)
+	libs_read_lib_files(prewikka_t)
+
+	libs_use_ld_so(prewikka_t)
+	libs_use_shared_libs(prewikka_t)
+
+	miscfiles_read_localization(prewikka_t)
+
+	fs_getattr_xattr_fs(prewikka_t)
+
+	optional_policy(`
+		selinux_dontaudit_getattr_fs(prewikka_t)
+		selinux_dontaudit_read_fs(prewikka_t)
+	')
+
+	optional_policy(`
+		seutil_dontaudit_read_config(prewikka_t)
+	')
+
+	optional_policy(`
+		nscd_read_pid(prewikka_t)
+	')
+
+	optional_policy(`
+		tunable_policy(`httpd_enable_cgi && allow_ypbind',`
+			nis_use_ypbind_uncond(prewikka_t)
+		')
+	')
+
+	optional_policy(`
+		mysql_search_db(prewikka_t)
+		mysql_stream_connect(prewikka_t)
+	')
+
+	optional_policy(`
+		postgresql_stream_connect(prewikka_t)
 	')
 ')
 
-
+########################################
+#
+# prelude_lml private declarations
+#
+optional_policy(`
+	type prelude_lml_t;
+	type prelude_lml_exec_t;
+	domain_type(prelude_lml_t)
+	init_daemon_domain(prelude_lml_t, prelude_lml_exec_t)
+
+	type prelude_lml_var_run_t;
+	files_pid_file(prelude_lml_var_run_t)
+
+	type prelude_lml_tmp_t;
+	files_tmp_file(prelude_lml_tmp_t)
+
+	########################################
+	#
+	# prelude_lml private policy	
+	#
+
+	allow prelude_lml_t self:netlink_route_socket { write getattr read bind create nlmsg_read };
+	allow prelude_lml_t self:tcp_socket { write getattr setopt read create connect };
+	allow prelude_lml_t self:unix_dgram_socket { write create connect };
+	allow prelude_lml_t self:fifo_file rw_fifo_file_perms;
+	allow prelude_lml_t self:unix_stream_socket connectto;
+
+	manage_dirs_pattern(prelude_lml_t,prelude_lml_tmp_t,prelude_lml_tmp_t)
+	manage_files_pattern(prelude_lml_t,prelude_lml_tmp_t,prelude_lml_tmp_t)
+	files_tmp_filetrans(prelude_lml_t, prelude_lml_tmp_t, { file dir })
+	files_list_tmp(prelude_lml_t)
+
+	files_search_spool(prelude_lml_t)
+	manage_dirs_pattern(prelude_lml_t,prelude_spool_t,prelude_spool_t)
+	manage_files_pattern(prelude_lml_t,prelude_spool_t,prelude_spool_t)
+
+	files_search_var_lib(prelude_lml_t)
+	manage_dirs_pattern(prelude_lml_t,prelude_var_lib_t,prelude_var_lib_t)
+	manage_files_pattern(prelude_lml_t,prelude_var_lib_t,prelude_var_lib_t)
+
+	manage_files_pattern(prelude_lml_t, prelude_lml_var_run_t, prelude_lml_var_run_t)
+	files_pid_filetrans(prelude_lml_t, prelude_lml_var_run_t, file)
+
+	libs_use_ld_so(prelude_lml_t)
+	libs_use_shared_libs(prelude_lml_t)
+
+	logging_send_syslog_msg(prelude_lml_t)
+
+	miscfiles_read_localization(prelude_lml_t)
+
+	corecmd_search_bin(prelude_lml_t)
+
+	corenet_tcp_sendrecv_generic_if(prelude_lml_t)
+	corenet_tcp_sendrecv_all_nodes(prelude_lml_t)
+
+	corenet_tcp_recvfrom_netlabel(prelude_lml_t)
+	corenet_tcp_recvfrom_unlabeled(prelude_lml_t)
+	corenet_sendrecv_unlabeled_packets(prelude_lml_t)
+
+	corenet_tcp_connect_prelude_port(prelude_lml_t)
+
+	dev_read_rand(prelude_lml_t)
+	dev_read_urand(prelude_lml_t)
+
+	files_list_etc(prelude_lml_t)
+	files_read_etc_files(prelude_lml_t)
+	files_read_etc_runtime_files(prelude_lml_t)
+
+	files_search_spool(prelude_lml_t)
+	files_search_usr(prelude_lml_t)
+	files_search_var_lib(prelude_lml_t)
+
+	fs_list_inotifyfs(prelude_lml_t)
+
+	libs_exec_lib_files(prelude_lml_t)
+	libs_read_lib_files(prelude_lml_t)
+
+	logging_read_generic_logs(prelude_lml_t)
+	logging_search_logs(prelude_lml_t)
+
+	optional_policy(`
+		apache_read_log(prelude_lml_t)
+	')
+
+	optional_policy(`
+		gamin_stream_connect(prelude_lml_t)
+    	gamin_domtrans(prelude_lml_t)
+	')
+')
+