diff --git a/ossec.fc b/ossec.fc
index 34eb1ea..d4eb450 100644
--- a/ossec.fc
+++ b/ossec.fc
@@ -21,8 +21,10 @@
 /var/ossec/etc/shared(/.*)?               gen_context(system_u:object_r:ossec_etc_share_t,s0)
 /var/ossec/rules(/.*)?                    gen_context(system_u:object_r:ossec_rule_t,s0)
 
-/var/ossec/active-response/bin(/.*)? --   gen_context(system_u:object_r:ossec_script_exec_t,s0)
-/var/ossec/active-response(/.*)?          gen_context(system_u:object_r:ossec_script_t,s0)
+#/var/ossec/active-response/bin(/.*)? --   gen_context(system_u:object_r:ossec_script_exec_t,s0)
+#/var/ossec/active-response(/.*)?          gen_context(system_u:object_r:ossec_script_t,s0)
+/var/ossec/active-response/bin(/.*)? --   gen_context(system_u:object_r:ossec_ar_exec_t,s0)
+/var/ossec/active-response(/.*)?          gen_context(system_u:object_r:ossec_ar_bin_t,s0)
 
 /etc/init.d/ossec-hids           --       gen_context(system_u:object_r:ossec_initrc_exec_t,s0)
 /var/ossec/bin/ossec-control     --       gen_context(system_u:object_r:ossec_initrc_exec_t,s0)
diff --git a/ossec.te b/ossec.te
index 119b90a..e489fbc 100644
--- a/ossec.te
+++ b/ossec.te
@@ -1,55 +1,66 @@
 
-policy_module(ossec,1.0.161)
+policy_module(ossec,1.0.165)
 
 ########################################
 #
 # Declarations
 #
 
-type ossec_t;
+# ossec bin dir
 type ossec_bin_t;
 files_type(ossec_bin_t)
 
+# ossec-maild daemon
 type ossec_maild_t;
 type ossec_maild_exec_t;
 init_daemon_domain(ossec_maild_t, ossec_maild_exec_t)
 
+# ossec-execd daemon
 type ossec_execd_t;
 type ossec_execd_exec_t;
 init_daemon_domain(ossec_execd_t, ossec_execd_exec_t)
 
+# ossec-analysisd daemon
 type ossec_analysisd_t;
 type ossec_analysisd_exec_t;
 init_daemon_domain(ossec_analysisd_t, ossec_analysisd_exec_t)
 
+# ossec-logcollector daemon
 type ossec_logcollector_t;
 type ossec_logcollector_exec_t;
 init_daemon_domain(ossec_logcollector_t, ossec_logcollector_exec_t)
 
+# ossec-remoted daemon
 type ossec_remoted_t;
 type ossec_remoted_exec_t;
 init_daemon_domain(ossec_remoted_t, ossec_remoted_exec_t)
 
+# ossec-syscheckd daemon
 type ossec_syscheckd_t;
 type ossec_syscheckd_exec_t;
 init_daemon_domain(ossec_syscheckd_t, ossec_syscheckd_exec_t)
 
+# ossec-monitord daemon
 type ossec_monitord_t;
 type ossec_monitord_exec_t;
 init_daemon_domain(ossec_monitord_t, ossec_monitord_exec_t)
 
+# ossec-dbd daemon
 type ossec_dbd_t;
 type ossec_dbd_exec_t;
 init_daemon_domain(ossec_dbd_t, ossec_dbd_exec_t)
 
+# ossec-csyslogd daemon
 type ossec_csyslogd_t;
 type ossec_csyslogd_exec_t;
 init_daemon_domain(ossec_csyslogd_t, ossec_csyslogd_exec_t)
 
+# ossec-agentlessd daemon
 type ossec_agentlessd_t;
 type ossec_agentlessd_exec_t;
 init_daemon_domain(ossec_agentlessd_t, ossec_agentlessd_exec_t)
 
+# initrc
 type ossec_initrc_exec_t;
 init_script_file(ossec_initrc_exec_t)
 
@@ -57,67 +68,82 @@ optional_policy(`
         ossec_domtrans(httpd_t)
 ')
 
+# ossec var dir
 type ossec_var_t;
 files_type(ossec_var_t)
 
+# ossec var run dir
 type ossec_var_run_t;
 files_pid_file(ossec_var_run_t)
 
+# ossec tmp dir
 type ossec_tmp_t;
 files_tmp_file(ossec_tmp_t)
 
+# ossec logs dir
 type ossec_log_t;
 logging_log_file(ossec_log_t)
 
+# ossec etc dir
 type ossec_etc_t;
 files_config_file(ossec_etc_t)
 
+# ossec etc share dir
 type ossec_etc_share_t;
 files_config_file(ossec_etc_share_t)
 
+# ossec rules dir
 type ossec_rule_t;
 files_config_file(ossec_rule_t)
 
+# ossec stats dir
 type ossec_stats_t;
 files_type(ossec_stats_t)
 
+# ossec queue dir
 type ossec_queue_t;
 files_type(ossec_queue_t)
 
-#type ossec_ar_t;
-#files_type(ossec_ar_t);
+###
+# Active-Response Domain and File Types
+type ossec_ar_t;
 
-#type ossec_ar_bin_t;
-#files_type(ossec_ar_bin_t);
+type ossec_ar_bin_t;
+files_type(ossec_ar_bin_t);
 
-#type ossec_ar_exec_t;
-#files_type(ossec_ar_exec_t);
+type ossec_ar_exec_t;
+files_type(ossec_ar_exec_t);
 
+domain_type(ossec_ar_t)
+domain_entry_file(ossec_ar_t, ossec_ar_exec_t)
+domtrans_pattern(ossec_execd_t, ossec_ar_exec_t, ossec_ar_t)
+role system_r types ossec_ar_t;
+unconfined_domain(ossec_ar_t)
+###
 
-type ossec_script_t;
-type ossec_script_exec_t;
-files_type(ossec_script_t)
-domain_type(ossec_script_t)
-domain_entry_file(ossec_script_t, ossec_script_exec_t)
-domtrans_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_t)
-role system_r types ossec_script_t;
-unconfined_domain(ossec_script_t)
-#unconfined_run(ossec_script_exec_t, ossec_script_t)
+#type ossec_script_t;
+#type ossec_script_exec_t;
+#files_type(ossec_script_t)
+#domain_type(ossec_script_t)
+#domain_entry_file(ossec_script_t, ossec_script_exec_t)
+#domtrans_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_t)
+#role system_r types ossec_script_t;
+#unconfined_domain(ossec_script_t)
+##unconfined_run(ossec_script_exec_t, ossec_script_t)
 
-#type_transition ossec_execd_t ossec_script_exec_t:process unconfined_t;
+##type_transition ossec_execd_t ossec_script_exec_t:process unconfined_t;
 
-#files_type(ossec_script_exec_t)
-#domain_type(ossec_script_exec_t)
-#domain_entry_file(ossec_script_exec_t, ossec_execd_t)
-##domtrans_pattern(unconfined_t, ossec_script_exec_t, ossec_execd_t)
-#unconfined_domain(ossec_script_exec_t)
-#unconfined_shell_domtrans(ossec_script_exec_t)
-#unconfined_run(ossec_execd_t, system_r)
-#unconfined_run(ossec_script_exec_t, ossec_script_t)
+##files_type(ossec_script_exec_t)
+##domain_type(ossec_script_exec_t)
+##domain_entry_file(ossec_script_exec_t, ossec_execd_t)
+###domtrans_pattern(unconfined_t, ossec_script_exec_t, ossec_execd_t)
+##unconfined_domain(ossec_script_exec_t)
+##unconfined_shell_domtrans(ossec_script_exec_t)
+##unconfined_run(ossec_execd_t, system_r)
+##unconfined_run(ossec_script_exec_t, ossec_script_t)
 
 
 require {
-	type ossec_t;
 	type ossec_bin_t;
 
 	type ossec_maild_t;
@@ -148,8 +174,11 @@ require {
 	type ossec_rule_t;
 	type ossec_stats_t;
 	type ossec_queue_t;
-	type ossec_script_t;
-	type ossec_script_exec_t;
+
+	type ossec_ar_t;
+	type ossec_ar_bin_t;
+	type ossec_ar_exec_t;
+
 	type httpd_t;
 	type httpd_log_t;
 	type unreserved_port_t;
@@ -163,7 +192,6 @@ require {
 	class capability { dac_override dac_read_search setuid setgid fsetid sys_chroot sys_nice };
 	class tcp_socket { create name_bind name_connect };
 	class udp_socket { create bind name_bind node_bind };
-
 }
 
 
@@ -177,14 +205,14 @@ require {
 auth_read_passwd(ossec_maild_t)
 
 # init
-allow ossec_maild_t self:capability { dac_override dac_read_search setuid setgid sys_chroot }; #fsetid sys_nice };
-#allow ossec_t self:process { setsched };
+allow ossec_maild_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
 
 # etc dir
-search_dirs_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t)
-read_lnk_files_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t)
-read_files_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t)
-sysnet_read_config(ossec_maild_t)
+ossec_read_config(ossec_maild_t)
+#search_dirs_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t)
+#read_lnk_files_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t)
+#read_files_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t)
+#sysnet_read_config(ossec_maild_t)
 
 # var dir
 search_dirs_pattern(ossec_maild_t, ossec_var_t, ossec_var_t)
@@ -200,7 +228,6 @@ allow ossec_maild_t ossec_log_t:file { create_file_perms append_file_perms };
 logging_log_filetrans(ossec_maild_t, ossec_log_t, file)
 
 # Sockets
-#allow ossec_t self:udp_socket { create };
 allow ossec_maild_t self:tcp_socket { create connect read write };
 allow ossec_maild_t smtp_port_t:tcp_socket { name_connect };
 
@@ -211,6 +238,18 @@ allow ossec_maild_t smtp_port_t:tcp_socket { name_connect };
 auth_read_passwd(ossec_execd_t)
 allow ossec_execd_t self:capability { dac_override dac_read_search setgid };
 
+# etc dir
+ossec_read_config(ossec_execd_t)
+#search_dirs_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
+#read_lnk_files_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
+#read_files_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
+##sysnet_read_config(ossec_execd_t)
+
+# etc share dir
+search_dirs_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
+read_files_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
+#manage_files_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
+
 # var dir
 #search_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)
 rw_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)
@@ -232,21 +271,11 @@ read_files_pattern(ossec_execd_t, ossec_log_t, ossec_log_t)
 allow ossec_execd_t ossec_log_t:file { create_file_perms append_file_perms };
 logging_log_filetrans(ossec_execd_t, ossec_log_t, file)
 
-# etc dir
-search_dirs_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
-read_lnk_files_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
-read_files_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
-#sysnet_read_config(ossec_execd_t)
-
-# etc share dir
-search_dirs_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
-read_files_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
-#manage_files_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
-
 # script dir
-search_dirs_pattern(ossec_execd_t, ossec_script_t, ossec_script_t)
-read_files_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_exec_t)
-exec_files_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_exec_t)
+search_dirs_pattern(ossec_execd_t, ossec_ar_bin_t, ossec_ar_bin_t)
+#search_dirs_pattern(ossec_execd_t, ossec_script_t, ossec_script_t)
+#read_files_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_exec_t)
+#exec_files_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_exec_t)
 exec_files_pattern(ossec_execd_t, shell_exec_t, shell_exec_t)
 
 
@@ -257,12 +286,13 @@ allow ossec_execd_t self:unix_dgram_socket { create bind getopt read write };
 dev_read_urand(ossec_execd_t)
 
 # Run autoresponce unconstrained
-allow ossec_execd_t ossec_script_t:process { rlimitinh siginh noatsecure };
-#allow ossec_execd_t unconfined_t:process { transition rlimitinh siginh noatsecure };
-#allow unconfined_t ossec_script_exec_t:file { entrypoint };
+allow ossec_execd_t ossec_ar_t:process { rlimitinh siginh noatsecure };
+#allow ossec_execd_t ossec_script_t:process { rlimitinh siginh noatsecure };
+##allow ossec_execd_t unconfined_t:process { transition rlimitinh siginh noatsecure };
+##allow unconfined_t ossec_script_exec_t:file { entrypoint };
 
-##unconfined_domtrans(ossec_script_t)
-##unconfined_run(ossec_execd_t, ossec_script_t)
+###unconfined_domtrans(ossec_script_t)
+###unconfined_run(ossec_execd_t, ossec_script_t)
 
 
 #============= ossec_analysisd_t ==============
@@ -271,6 +301,17 @@ allow ossec_execd_t ossec_script_t:process { rlimitinh siginh noatsecure };
 auth_read_passwd(ossec_analysisd_t)
 allow ossec_analysisd_t self:capability { dac_override dac_read_search fsetid setuid setgid sys_chroot };
 
+# etc dir
+ossec_read_config(ossec_analysisd_t)
+#search_dirs_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
+#read_lnk_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
+#read_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
+##sysnet_read_config(ossec_maild_t)
+
+# etc share dir
+search_dirs_pattern(ossec_analysisd_t, ossec_etc_share_t, ossec_etc_share_t)
+manage_files_pattern(ossec_analysisd_t, ossec_etc_share_t, ossec_etc_share_t)
+
 # var dir
 search_dirs_pattern(ossec_analysisd_t, ossec_var_t, ossec_var_t)
 #rw_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)
@@ -293,16 +334,6 @@ rw_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
 create_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
 append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
 
-# etc dir
-search_dirs_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
-read_lnk_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
-read_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
-#sysnet_read_config(ossec_maild_t)
-
-# etc share dir
-search_dirs_pattern(ossec_analysisd_t, ossec_etc_share_t, ossec_etc_share_t)
-manage_files_pattern(ossec_analysisd_t, ossec_etc_share_t, ossec_etc_share_t)
-
 # logs
 #search_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
 add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
@@ -329,9 +360,10 @@ allow ossec_analysisd_t ossec_remoted_t:unix_dgram_socket { sendto };
 allow ossec_logcollector_t self:capability { dac_override dac_read_search };
 
 # etc dir
-search_dirs_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
-read_lnk_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
-read_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
+ossec_read_config(ossec_logcollector_t)
+#search_dirs_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
+#read_lnk_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
+#read_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
 
 # var dir
 search_dirs_pattern(ossec_logcollector_t, ossec_var_t, ossec_var_t)
@@ -371,9 +403,10 @@ auth_read_passwd(ossec_remoted_t)
 allow ossec_remoted_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
 
 # etc dir
-search_dirs_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
-read_lnk_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
-read_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
+ossec_read_config(ossec_remoted_t)
+#search_dirs_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
+#read_lnk_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
+#read_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
 
 # etc share dir
 search_dirs_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t)
@@ -424,9 +457,10 @@ allow ossec_syscheckd_t self:capability { dac_override dac_read_search setuid se
 allow ossec_syscheckd_t self:process { setsched };
 
 # etc dir
-search_dirs_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
-read_lnk_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
-read_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
+ossec_read_config(ossec_syscheckd_t)
+#search_dirs_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
+#read_lnk_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
+#read_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
 
 # var dir
 search_dirs_pattern(ossec_syscheckd_t, ossec_var_t, ossec_var_t)
@@ -472,9 +506,10 @@ auth_read_passwd(ossec_monitord_t)
 allow ossec_monitord_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
 
 # etc dir
-search_dirs_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
-read_lnk_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
-read_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
+ossec_read_config(ossec_monitord_t)
+#search_dirs_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
+#read_lnk_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
+#read_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
 
 # var dir
 search_dirs_pattern(ossec_monitord_t, ossec_var_t, ossec_var_t)