This patch an attribute of application_exec_type to any executable that can be executed by a user. I have only patched the executables that currently transition to a domain if run under inetd or init, but do not transition if run by a user. Also changed corecommand_exec_any to only execute executables that a user is supposed to run. So if sysadm_t tries to execute a dameon directly it will get a permission denied.