selinux-policy/userdomain.patch

diff -up serefpolicy-3.10.0/policy/modules/admin/usermanage.if.userdomain serefpolicy-3.10.0/policy/modules/admin/usermanage.if
--- serefpolicy-3.10.0/policy/modules/admin/usermanage.if.userdomain	2011-10-11 10:15:28.062129903 -0400
+++ serefpolicy-3.10.0/policy/modules/admin/usermanage.if	2011-10-11 10:15:28.489129089 -0400
@@ -308,7 +308,7 @@ interface(`usermanage_run_useradd',`
 	role $2 types useradd_t;
 
 	# Add/remove user home directories
-	userdom_manage_home_role($2, useradd_t)
+	userdom_manage_home_role($2)
 
 	seutil_run_semanage(useradd_t, $2)
 
diff -up serefpolicy-3.10.0/policy/modules/admin/usermanage.te.userdomain serefpolicy-3.10.0/policy/modules/admin/usermanage.te
--- serefpolicy-3.10.0/policy/modules/admin/usermanage.te.userdomain	2011-10-11 10:15:28.447129169 -0400
+++ serefpolicy-3.10.0/policy/modules/admin/usermanage.te	2011-10-11 10:15:28.490129087 -0400
@@ -512,7 +512,7 @@ seutil_domtrans_setfiles(useradd_t)
 userdom_use_unpriv_users_fds(useradd_t)
 # Add/remove user home directories
 userdom_home_filetrans_user_home_dir(useradd_t)
-userdom_manage_home_role(system_r, useradd_t)
+userdom_manage_home(useradd_t)
 
 mta_manage_spool(useradd_t)
 
diff -up serefpolicy-3.10.0/policy/modules/apps/execmem.if.userdomain serefpolicy-3.10.0/policy/modules/apps/execmem.if
--- serefpolicy-3.10.0/policy/modules/apps/execmem.if.userdomain	2011-10-11 10:15:28.472129121 -0400
+++ serefpolicy-3.10.0/policy/modules/apps/execmem.if	2011-10-11 10:15:28.491129085 -0400
@@ -57,8 +57,6 @@ template(`execmem_role_template',`
 	role $2 types $1_execmem_t;
 
 	userdom_unpriv_usertype($1, $1_execmem_t)
-	userdom_manage_tmp_role($2, $1_execmem_t)
-	userdom_manage_tmpfs_role($2, $1_execmem_t)
 
 	allow $1_execmem_t self:process { execmem execstack };
 	allow $3 $1_execmem_t:process { getattr ptrace noatsecure signal_perms };
diff -up serefpolicy-3.10.0/policy/modules/apps/java.if.userdomain serefpolicy-3.10.0/policy/modules/apps/java.if
--- serefpolicy-3.10.0/policy/modules/apps/java.if.userdomain	2011-10-11 10:15:28.077129873 -0400
+++ serefpolicy-3.10.0/policy/modules/apps/java.if	2011-10-11 10:15:28.492129083 -0400
@@ -73,7 +73,8 @@ template(`java_role_template',`
 	domain_interactive_fd($1_java_t)
 
 	userdom_unpriv_usertype($1, $1_java_t)
-	userdom_manage_tmpfs_role($2, $1_java_t)
+	userdom_manage_tmpfs_role($2)
+	userdom_manage_tmpfs($1_java_t)
 
 	allow $1_java_t self:process { ptrace signal getsched execmem execstack };
 
diff -up serefpolicy-3.10.0/policy/modules/apps/mono.if.userdomain serefpolicy-3.10.0/policy/modules/apps/mono.if
--- serefpolicy-3.10.0/policy/modules/apps/mono.if.userdomain	2011-10-11 10:15:28.082129864 -0400
+++ serefpolicy-3.10.0/policy/modules/apps/mono.if	2011-10-11 10:15:28.493129081 -0400
@@ -49,7 +49,8 @@ template(`mono_role_template',`
 	corecmd_bin_domtrans($1_mono_t, $1_t)
 
 	userdom_unpriv_usertype($1, $1_mono_t)
-	userdom_manage_tmpfs_role($2, $1_mono_t)
+	userdom_manage_tmpfs_role($2)
+	userdom_manage_tmpfs($1_mono_t)
 
 	optional_policy(`
 		xserver_role($1_r, $1_mono_t)
diff -up serefpolicy-3.10.0/policy/modules/apps/mozilla.if.userdomain serefpolicy-3.10.0/policy/modules/apps/mozilla.if
--- serefpolicy-3.10.0/policy/modules/apps/mozilla.if.userdomain	2011-10-11 10:15:28.083129862 -0400
+++ serefpolicy-3.10.0/policy/modules/apps/mozilla.if	2011-10-11 10:15:28.494129079 -0400
@@ -51,7 +51,7 @@ interface(`mozilla_role',`
 	mozilla_run_plugin(mozilla_t, $1)
 	mozilla_dbus_chat($2)
 
-	userdom_manage_tmp_role($1, mozilla_t)
+	userdom_manage_tmp_role($1)
 
 	optional_policy(`
 		nsplugin_role($1, mozilla_t)
diff -up serefpolicy-3.10.0/policy/modules/apps/nsplugin.if.userdomain serefpolicy-3.10.0/policy/modules/apps/nsplugin.if
--- serefpolicy-3.10.0/policy/modules/apps/nsplugin.if.userdomain	2011-10-11 10:15:28.087129854 -0400
+++ serefpolicy-3.10.0/policy/modules/apps/nsplugin.if	2011-10-11 10:15:28.495129077 -0400
@@ -103,7 +103,7 @@ ifdef(`hide_broken_symptoms', `
 	userdom_use_inherited_user_terminals(nsplugin_t)
 	userdom_use_inherited_user_terminals(nsplugin_config_t)
 	userdom_dontaudit_setattr_user_home_content_files(nsplugin_t)
-	userdom_manage_tmpfs_role($1, nsplugin_t)
+	userdom_manage_tmpfs_role($1)
 
 	optional_policy(`
 		pulseaudio_role($1, nsplugin_t)
diff -up serefpolicy-3.10.0/policy/modules/apps/nsplugin.te.userdomain serefpolicy-3.10.0/policy/modules/apps/nsplugin.te
--- serefpolicy-3.10.0/policy/modules/apps/nsplugin.te.userdomain	2011-10-11 10:15:28.088129853 -0400
+++ serefpolicy-3.10.0/policy/modules/apps/nsplugin.te	2011-10-11 10:15:28.496129075 -0400
@@ -286,6 +286,7 @@ userdom_search_user_home_content(nsplugi
 userdom_read_user_home_content_symlinks(nsplugin_config_t)
 userdom_read_user_home_content_files(nsplugin_config_t)
 userdom_dontaudit_search_admin_dir(nsplugin_config_t)
+userdom_manage_tmpfs(nsplugin_t)
 
 tunable_policy(`use_nfs_home_dirs',`
 	fs_getattr_nfs(nsplugin_t)
diff -up serefpolicy-3.10.0/policy/modules/apps/pulseaudio.if.userdomain serefpolicy-3.10.0/policy/modules/apps/pulseaudio.if
--- serefpolicy-3.10.0/policy/modules/apps/pulseaudio.if.userdomain	2011-10-11 10:15:28.089129851 -0400
+++ serefpolicy-3.10.0/policy/modules/apps/pulseaudio.if	2011-10-11 10:15:28.497129073 -0400
@@ -35,9 +35,9 @@ interface(`pulseaudio_role',`
 	allow pulseaudio_t $2:unix_stream_socket connectto;
 	allow $2 pulseaudio_t:unix_stream_socket connectto;
 
-	userdom_manage_home_role($1, pulseaudio_t)
-	userdom_manage_tmp_role($1, pulseaudio_t)
-	userdom_manage_tmpfs_role($1, pulseaudio_t)
+	userdom_manage_home_role($1)
+	userdom_manage_tmp_role($1)
+	userdom_manage_tmpfs_role($1)
 
 	allow $2 pulseaudio_t:dbus send_msg;
 	allow pulseaudio_t $2:dbus { acquire_svc send_msg };
diff -up serefpolicy-3.10.0/policy/modules/apps/pulseaudio.te.userdomain serefpolicy-3.10.0/policy/modules/apps/pulseaudio.te
--- serefpolicy-3.10.0/policy/modules/apps/pulseaudio.te.userdomain	2011-10-11 10:15:28.091129847 -0400
+++ serefpolicy-3.10.0/policy/modules/apps/pulseaudio.te	2011-10-11 10:15:28.498129071 -0400
@@ -95,6 +95,10 @@ logging_send_syslog_msg(pulseaudio_t)
 
 miscfiles_read_localization(pulseaudio_t)
 
+userdom_manage_home(pulseaudio_t)
+userdom_manage_tmp(pulseaudio_t)
+userdom_manage_tmpfs(pulseaudio_t)
+
 optional_policy(`
 	alsa_read_rw_config(pulseaudio_t)
 ')
diff -up serefpolicy-3.10.0/policy/modules/apps/userhelper.if.userdomain serefpolicy-3.10.0/policy/modules/apps/userhelper.if
--- serefpolicy-3.10.0/policy/modules/apps/userhelper.if.userdomain	2011-10-11 10:15:28.102129826 -0400
+++ serefpolicy-3.10.0/policy/modules/apps/userhelper.if	2011-10-11 10:15:28.498129071 -0400
@@ -294,7 +294,7 @@ template(`userhelper_console_role_templa
 
 	auth_use_pam($1_consolehelper_t)
 
-	userdom_manage_tmpfs_role($2, $1_consolehelper_t)
+	userdom_manage_tmpfs_role($2)
 
 	optional_policy(`
 		dbus_connect_session_bus($1_consolehelper_t)
diff -up serefpolicy-3.10.0/policy/modules/apps/userhelper.te.userdomain serefpolicy-3.10.0/policy/modules/apps/userhelper.te
--- serefpolicy-3.10.0/policy/modules/apps/userhelper.te.userdomain	2011-10-11 10:15:28.102129826 -0400
+++ serefpolicy-3.10.0/policy/modules/apps/userhelper.te	2011-10-11 10:15:28.499129069 -0400
@@ -65,6 +65,7 @@ userhelper_exec(consolehelper_domain)
 userdom_use_user_ptys(consolehelper_domain)
 userdom_use_user_ttys(consolehelper_domain)
 userdom_read_user_home_content_files(consolehelper_domain)
+userdom_manage_tmpfs(consolehelper_domain)
 
 optional_policy(`
 	gnome_read_gconf_home_files(consolehelper_domain)
diff -up serefpolicy-3.10.0/policy/modules/apps/wine.if.userdomain serefpolicy-3.10.0/policy/modules/apps/wine.if
--- serefpolicy-3.10.0/policy/modules/apps/wine.if.userdomain	2011-10-11 10:15:28.105129820 -0400
+++ serefpolicy-3.10.0/policy/modules/apps/wine.if	2011-10-11 10:15:28.499129069 -0400
@@ -105,7 +105,8 @@ template(`wine_role_template',`
 	corecmd_bin_domtrans($1_wine_t, $1_t)
 
 	userdom_unpriv_usertype($1, $1_wine_t)
-	userdom_manage_tmpfs_role($2, $1_wine_t)
+	userdom_manage_tmpfs_role($2)
+	userdom_manage_tmpfs($1_wine_t)
 
 	domain_mmap_low($1_wine_t)
 
diff -up serefpolicy-3.10.0/policy/modules/apps/wm.if.userdomain serefpolicy-3.10.0/policy/modules/apps/wm.if
--- serefpolicy-3.10.0/policy/modules/apps/wm.if.userdomain	2011-10-11 10:15:28.107129816 -0400
+++ serefpolicy-3.10.0/policy/modules/apps/wm.if	2011-10-11 10:15:28.500129068 -0400
@@ -77,9 +77,13 @@ template(`wm_role_template',`
 	miscfiles_read_fonts($1_wm_t)
 	miscfiles_read_localization($1_wm_t)
 
-	userdom_manage_home_role($2, $1_wm_t)
-	userdom_manage_tmpfs_role($2, $1_wm_t)
-	userdom_manage_tmp_role($2, $1_wm_t)
+	userdom_manage_home_role($2)
+	userdom_manage_home($1_wm_t)
+	userdom_manage_tmpfs_role($2)
+	userdom_manage_tmpfs($1_wm_t)
+	userdom_manage_tmp_role($2)
+	userdom_manage_tmp($1_wm_t)
+
 	userdom_exec_user_tmp_files($1_wm_t)
 
 	optional_policy(`
diff -up serefpolicy-3.10.0/policy/modules/roles/sysadm.te.userdomain serefpolicy-3.10.0/policy/modules/roles/sysadm.te
--- serefpolicy-3.10.0/policy/modules/roles/sysadm.te.userdomain	2011-10-11 10:15:28.000000000 -0400
+++ serefpolicy-3.10.0/policy/modules/roles/sysadm.te	2011-10-11 10:16:15.471039586 -0400
@@ -60,7 +60,8 @@ sysnet_filetrans_named_content(sysadm_t)
 # Add/remove user home directories
 userdom_manage_user_home_dirs(sysadm_t)
 userdom_home_filetrans_user_home_dir(sysadm_t)
-userdom_manage_tmp_role(sysadm_r, sysadm_t)
+userdom_manage_tmp_role(sysadm_r)
+userdom_manage_tmp(sysadm_t)
 
 optional_policy(`
 	ssh_filetrans_admin_home_content(sysadm_t)
diff -up serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te.userdomain serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te
--- serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te.userdomain	2011-10-11 10:15:28.476129113 -0400
+++ serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te	2011-10-11 10:15:28.501129066 -0400
@@ -45,9 +45,12 @@ gen_tunable(unconfined_login, true)
 # calls is not correct, however we dont currently
 # have another method to add access to these types
 userdom_base_user_template(unconfined)
-userdom_manage_home_role(unconfined_r, unconfined_t)
-userdom_manage_tmp_role(unconfined_r, unconfined_t)
-userdom_manage_tmpfs_role(unconfined_r, unconfined_t)
+userdom_manage_home_role(unconfined_r)
+userdom_user_home_dir_filetrans_user_home_content(unconfined_t, { dir file lnk_file sock_file fifo_file })
+userdom_manage_tmp_role(unconfined_r)
+userdom_manage_tmp(unconfined_t)
+userdom_manage_tmpfs_role(unconfined_r)
+userdom_manage_tmpfs(unconfined_t)
 userdom_unpriv_usertype(unconfined, unconfined_t)
 
 type unconfined_exec_t;
diff -up serefpolicy-3.10.0/policy/modules/services/rshd.te.userdomain serefpolicy-3.10.0/policy/modules/services/rshd.te
--- serefpolicy-3.10.0/policy/modules/services/rshd.te.userdomain	2011-10-11 10:15:28.333129386 -0400
+++ serefpolicy-3.10.0/policy/modules/services/rshd.te	2011-10-11 10:15:28.502129064 -0400
@@ -66,7 +66,7 @@ seutil_read_config(rshd_t)
 seutil_read_default_contexts(rshd_t)
 
 userdom_search_user_home_content(rshd_t)
-userdom_manage_tmp_role(system_r, rshd_t)
+userdom_manage_tmp(rshd_t)
 
 tunable_policy(`use_nfs_home_dirs',`
 	fs_read_nfs_files(rshd_t)
diff -up serefpolicy-3.10.0/policy/modules/services/ssh.if.userdomain serefpolicy-3.10.0/policy/modules/services/ssh.if
--- serefpolicy-3.10.0/policy/modules/services/ssh.if.userdomain	2011-10-11 10:15:28.354129346 -0400
+++ serefpolicy-3.10.0/policy/modules/services/ssh.if	2011-10-11 10:15:28.503129062 -0400
@@ -380,7 +380,7 @@ template(`ssh_role_template',`
 	manage_lnk_files_pattern($3, ssh_home_t, ssh_home_t)
 	manage_sock_files_pattern($3, ssh_home_t, ssh_home_t)
 	userdom_search_user_home_dirs($1_t)
-	userdom_manage_tmp_role($2, ssh_t)
+	userdom_manage_tmp(ssh_t)
 
 	##############################
 	#
diff -up serefpolicy-3.10.0/policy/modules/services/ssh.te.userdomain serefpolicy-3.10.0/policy/modules/services/ssh.te
--- serefpolicy-3.10.0/policy/modules/services/ssh.te.userdomain	2011-10-11 10:15:28.355129344 -0400
+++ serefpolicy-3.10.0/policy/modules/services/ssh.te	2011-10-11 10:15:28.503129062 -0400
@@ -200,6 +200,7 @@ userdom_read_user_tmp_files(ssh_t)
 userdom_write_user_tmp_files(ssh_t)
 userdom_read_user_home_content_symlinks(ssh_t)
 userdom_read_home_certs(ssh_t)
+userdom_manage_tmp(ssh_t)
 
 tunable_policy(`allow_ssh_keysign',`
 	domtrans_pattern(ssh_t, ssh_keysign_exec_t, ssh_keysign_t)
@@ -280,7 +281,7 @@ corenet_sendrecv_xserver_server_packets(
 
 userdom_read_user_home_content_files(sshd_t)
 userdom_read_user_home_content_symlinks(sshd_t)
-userdom_manage_tmp_role(system_r, sshd_t)
+userdom_manage_tmp(sshd_t)
 userdom_spec_domtrans_unpriv_users(sshd_t)
 userdom_signal_unpriv_users(sshd_t)
 userdom_dyntransition_unpriv_users(sshd_t)
diff -up serefpolicy-3.10.0/policy/modules/services/sssd.te.userdomain serefpolicy-3.10.0/policy/modules/services/sssd.te
--- serefpolicy-3.10.0/policy/modules/services/sssd.te.userdomain	2011-10-11 10:15:28.356129342 -0400
+++ serefpolicy-3.10.0/policy/modules/services/sssd.te	2011-10-11 10:15:28.504129060 -0400
@@ -92,7 +92,7 @@ miscfiles_read_generic_certs(sssd_t)
 sysnet_dns_name_resolve(sssd_t)
 sysnet_use_ldap(sssd_t)
 
-userdom_manage_tmp_role(system_r, sssd_t)
+userdom_manage_tmp(sssd_t)
 
 optional_policy(`
 	dbus_system_bus_client(sssd_t)
diff -up serefpolicy-3.10.0/policy/modules/services/xserver.te.userdomain serefpolicy-3.10.0/policy/modules/services/xserver.te
--- serefpolicy-3.10.0/policy/modules/services/xserver.te.userdomain	2011-10-11 10:15:28.480129106 -0400
+++ serefpolicy-3.10.0/policy/modules/services/xserver.te	2011-10-11 10:15:28.505129058 -0400
@@ -671,7 +671,7 @@ userdom_stream_connect(xdm_t)
 userdom_manage_user_tmp_dirs(xdm_t)
 userdom_manage_user_tmp_files(xdm_t)
 userdom_manage_user_tmp_sockets(xdm_t)
-userdom_manage_tmpfs_role(system_r, xdm_t)
+userdom_manage_tmpfs(xdm_t)
 
 application_signal(xdm_t)
 
diff -up serefpolicy-3.10.0/policy/modules/system/userdomain.if.userdomain serefpolicy-3.10.0/policy/modules/system/userdomain.if
--- serefpolicy-3.10.0/policy/modules/system/userdomain.if.userdomain	2011-10-11 10:15:28.482129102 -0400
+++ serefpolicy-3.10.0/policy/modules/system/userdomain.if	2011-10-11 10:15:28.506129056 -0400
@@ -35,21 +35,14 @@ template(`userdom_base_user_template',`
 	type $1_t, userdomain, $1_usertype;
 	domain_type($1_t)
 	role $1_r;
-	corecmd_shell_entry_type($1_t)
-	corecmd_bin_entry_type($1_t)
 	domain_user_exemption_target($1_t)
 	ubac_constrained($1_t)
 	role $1_r types $1_t;
 	allow system_r $1_r;
 
-	term_user_pty($1_t, user_devpts_t)
-
-	term_user_tty($1_t, user_tty_device_t)
-	term_dontaudit_getattr_generic_ptys($1_t)
-
 	allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
 	allow $1_usertype $1_usertype:fd use;
-	allow $1_usertype $1_t:key { create view read write search link setattr };
+	allow $1_usertype $1_usertype:key { create view read write search link setattr };
 
 	allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
 	allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
@@ -61,114 +54,7 @@ template(`userdom_base_user_template',`
 	allow $1_usertype $1_usertype:context contains;
 	dontaudit $1_usertype $1_usertype:socket create;
 
-	allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
-	term_create_pty($1_usertype, user_devpts_t)
-	# avoid annoying messages on terminal hangup on role change
-	dontaudit $1_usertype user_devpts_t:chr_file ioctl;
-
-	allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
-	# avoid annoying messages on terminal hangup on role change
-	dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
-
-	application_exec_all($1_usertype)
-
-	kernel_read_kernel_sysctls($1_usertype)
-	kernel_read_all_sysctls($1_usertype)
-	kernel_dontaudit_list_unlabeled($1_usertype)
-	kernel_dontaudit_getattr_unlabeled_files($1_usertype)
-	kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
-	kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
-	kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
-	kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
-	kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
-	kernel_dontaudit_list_proc($1_usertype)
-
-	dev_dontaudit_getattr_all_blk_files($1_usertype)
-	dev_dontaudit_getattr_all_chr_files($1_usertype)
-	dev_getattr_mtrr_dev($1_t)
-
-	# When the user domain runs ps, there will be a number of access
-	# denials when ps tries to search /proc. Do not audit these denials.
-	domain_dontaudit_read_all_domains_state($1_usertype)
-	domain_dontaudit_getattr_all_domains($1_usertype)
-	domain_dontaudit_getsession_all_domains($1_usertype)
-	dev_dontaudit_all_access_check($1_usertype)
-
-	files_read_etc_files($1_usertype)
-	files_list_mnt($1_usertype)
-	files_list_var($1_usertype)
-	files_read_mnt_files($1_usertype)
-	files_dontaudit_access_check_mnt($1_usertype)
-	files_read_etc_runtime_files($1_usertype)
-	files_read_usr_files($1_usertype)
-	files_read_usr_src_files($1_usertype)
-	# Read directories and files with the readable_t type.
-	# This type is a general type for "world"-readable files.
-	files_list_world_readable($1_usertype)
-	files_read_world_readable_files($1_usertype)
-	files_read_world_readable_symlinks($1_usertype)
-	files_read_world_readable_pipes($1_usertype)
-	files_read_world_readable_sockets($1_usertype)
-	# old broswer_domain():
-	files_dontaudit_getattr_all_dirs($1_usertype)
-	files_dontaudit_list_non_security($1_usertype)
-	files_dontaudit_getattr_all_files($1_usertype)
-	files_dontaudit_getattr_non_security_symlinks($1_usertype)
-	files_dontaudit_getattr_non_security_pipes($1_usertype)
-	files_dontaudit_getattr_non_security_sockets($1_usertype)
-	files_dontaudit_setattr_etc_runtime_files($1_usertype)
-
-	files_exec_usr_files($1_t)
-
-	fs_list_cgroup_dirs($1_usertype)
-	fs_dontaudit_rw_cgroup_files($1_usertype)
-
-	storage_rw_fuse($1_usertype)
-
 	auth_use_nsswitch($1_t)
-
-	init_stream_connect($1_usertype)
-	# The library functions always try to open read-write first,
-	# then fall back to read-only if it fails. 
-	init_dontaudit_rw_utmp($1_usertype)
-
-	libs_exec_ld_so($1_usertype)
-
-	logging_send_audit_msgs($1_t)
-
-	miscfiles_read_localization($1_t)
-	miscfiles_read_generic_certs($1_t)
-
-	miscfiles_read_all_certs($1_usertype)
-	miscfiles_read_localization($1_usertype)
-	miscfiles_read_man_pages($1_usertype)
-	miscfiles_read_public_files($1_usertype)
-
-	systemd_dbus_chat_logind($1_usertype)
-
-	tunable_policy(`allow_execmem',`
-		# Allow loading DSOs that require executable stack.
-		allow $1_t self:process execmem;
-	')
-
-	tunable_policy(`allow_execmem && allow_execstack',`
-		# Allow making the stack executable via mprotect.
-		allow $1_t self:process execstack;
-	')
-
-	optional_policy(`
-		abrt_stream_connect($1_usertype)
-	')
-
-	optional_policy(`
-		fs_list_cgroup_dirs($1_usertype)
-	')
-	
-	optional_policy(`
-		ssh_rw_stream_sockets($1_usertype)
-		ssh_delete_tmp($1_t)
-		ssh_signal($1_t)
-	')
 ')
 
 #######################################
@@ -242,6 +128,22 @@ interface(`userdom_ro_home_role',`
 ##	The user role
 ##	</summary>
 ## </param>
+## <rolebase/>
+#
+interface(`userdom_manage_home_role',`
+	gen_require(`
+		type user_home_dir_t;
+		attribute user_home_type;
+	')
+
+	role $1 types { user_home_type user_home_dir_t };
+')
+
+#######################################
+## <summary>
+##	Allow a home directory for which the
+##	role has full access.
+## </summary>
 ## <param name="userdomain">
 ##	<summary>
 ##	The user domain
@@ -249,61 +151,58 @@ interface(`userdom_ro_home_role',`
 ## </param>
 ## <rolebase/>
 #
-interface(`userdom_manage_home_role',`
+interface(`userdom_manage_home',`
 	gen_require(`
 		type user_home_t, user_home_dir_t;
 		attribute user_home_type;
 	')
 
-	role $1 types { user_home_type user_home_dir_t };
-
 	##############################
 	#
 	# Domain access to home dir
 	#
-
-	type_member $2 user_home_dir_t:dir user_home_dir_t;
+	type_member $1 user_home_dir_t:dir user_home_dir_t;
 
 	# full control of the home directory
-	allow $2 user_home_t:dir mounton;
-	allow $2 user_home_t:file entrypoint;
+	allow $1 user_home_t:dir mounton;
+	allow $1 user_home_t:file entrypoint;
 
-	allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
-	allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
-	manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
-	manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
-	manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
-	manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
-	manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
-	relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
-	relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
-	relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
-	relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
-	relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
-	filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
-	files_list_home($2)
+	allow $1 user_home_type:dir_file_class_set { relabelto relabelfrom };
+	allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
+	manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
+	manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
+	manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
+	manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
+	manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
+	relabel_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
+	relabel_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
+	relabel_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
+	relabel_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
+	relabel_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
+	filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
+	files_list_home($1)
 
 	# cjp: this should probably be removed:
-	allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
+	allow $1 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 
 	tunable_policy(`use_nfs_home_dirs',`
-		fs_mount_nfs($2)
-		fs_mounton_nfs($2)
-		fs_manage_nfs_dirs($2)
-		fs_manage_nfs_files($2)
-		fs_manage_nfs_symlinks($2)
-		fs_manage_nfs_named_sockets($2)
-		fs_manage_nfs_named_pipes($2)
+		fs_mount_nfs($1)
+		fs_mounton_nfs($1)
+		fs_manage_nfs_dirs($1)
+		fs_manage_nfs_files($1)
+		fs_manage_nfs_symlinks($1)
+		fs_manage_nfs_named_sockets($1)
+		fs_manage_nfs_named_pipes($1)
 	')
 
 	tunable_policy(`use_samba_home_dirs',`
-		fs_mount_cifs($2)
-		fs_mounton_cifs($2)
-		fs_manage_cifs_dirs($2)
-		fs_manage_cifs_files($2)
-		fs_manage_cifs_symlinks($2)
-		fs_manage_cifs_named_sockets($2)
-		fs_manage_cifs_named_pipes($2)
+		fs_mount_cifs($1)
+		fs_mounton_cifs($1)
+		fs_manage_cifs_dirs($1)
+		fs_manage_cifs_files($1)
+		fs_manage_cifs_symlinks($1)
+		fs_manage_cifs_named_sockets($1)
+		fs_manage_cifs_named_pipes($1)
 	')
 ')
 
@@ -316,6 +215,21 @@ interface(`userdom_manage_home_role',`
 ##	Role allowed access.
 ##	</summary>
 ## </param>
+## <rolebase/>
+#
+interface(`userdom_manage_tmp_role',`
+	gen_require(`
+		attribute user_tmp_type;
+		type user_tmp_t;
+	')
+
+	role $1 types user_tmp_t;
+')
+
+#######################################
+## <summary>
+##	Manage user temporary files
+## </summary>
 ## <param name="domain">
 ##	<summary>
 ##	Domain allowed access.
@@ -323,27 +237,25 @@ interface(`userdom_manage_home_role',`
 ## </param>
 ## <rolebase/>
 #
-interface(`userdom_manage_tmp_role',`
+interface(`userdom_manage_tmp',`
 	gen_require(`
 		attribute user_tmp_type;
 		type user_tmp_t;
 	')
 
-	role $1 types user_tmp_t;
-
-	files_poly_member_tmp($2, user_tmp_t)
+	files_poly_member_tmp($1, user_tmp_t)
 
-	manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
-	manage_files_pattern($2, user_tmp_type, user_tmp_type)
-	manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
-	manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
-	manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
-	files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
-	relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
-	relabel_files_pattern($2, user_tmp_type, user_tmp_type)
-	relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
-	relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
-	relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
+	manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
+	manage_files_pattern($1, user_tmp_type, user_tmp_type)
+	manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
+	manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
+	manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
+	files_tmp_filetrans($1, user_tmp_t, { dir file lnk_file sock_file fifo_file })
+	relabel_dirs_pattern($1, user_tmp_type, user_tmp_type)
+	relabel_files_pattern($1, user_tmp_type, user_tmp_type)
+	relabel_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
+	relabel_sock_files_pattern($1, user_tmp_type, user_tmp_type)
+	relabel_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
 ')
 
 #######################################
@@ -424,6 +336,21 @@ interface(`userdom_exec_user_tmp_files',
 ##	Role allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
+#
+interface(`userdom_manage_tmpfs_role',`
+	gen_require(`
+		attribute user_tmpfs_type;
+		type user_tmpfs_t;
+	')
+
+	role $1 types user_tmpfs_t;
+')
+
+#######################################
+## <summary>
+##	Allow access for the user tmpfs type
+## </summary>
 ## <param name="domain">
 ##	<summary>
 ##	Domain allowed access.
@@ -431,25 +358,23 @@ interface(`userdom_exec_user_tmp_files',
 ## </param>
 ## <rolecap/>
 #
-interface(`userdom_manage_tmpfs_role',`
+interface(`userdom_manage_tmpfs',`
 	gen_require(`
 		attribute user_tmpfs_type;
 		type user_tmpfs_t;
 	')
 
-	role $1 types user_tmpfs_t;
-
-	manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
-	manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
-	manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
-	manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
-	manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
-	fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
-	relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
-	relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
-	relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
-	relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
-	relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
+	manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
+	manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
+	manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
+	manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
+	manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
+	fs_tmpfs_filetrans($1, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+	relabel_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
+	relabel_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
+	relabel_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
+	relabel_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
+	relabel_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
 ')
 
 #######################################
@@ -578,260 +503,31 @@ template(`userdom_change_password_templa
 template(`userdom_common_user_template',`
 	gen_require(`
 		attribute unpriv_userdomain;
+		attribute common_userdomain;
 	')
 
-	userdom_basic_networking($1_usertype)
-
-	##############################
-	#
-	# User domain Local policy
-	#
-
-	# evolution and gnome-session try to create a netlink socket
-	dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
-	dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
-	allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
-	allow $1_t self:socket create_socket_perms;
-
-	allow $1_usertype unpriv_userdomain:fd use;
-
-	kernel_read_system_state($1_usertype)
-	kernel_read_network_state($1_usertype)
-	kernel_read_software_raid_state($1_usertype)
-	kernel_read_net_sysctls($1_usertype)
-	# Very permissive allowing every domain to see every type:
-	kernel_get_sysvipc_info($1_usertype)
-	# Find CDROM devices:
-	kernel_read_device_sysctls($1_usertype)
-	kernel_request_load_module($1_usertype)
-
-	corenet_udp_bind_generic_node($1_usertype)
-	corenet_udp_bind_generic_port($1_usertype)
-
-	dev_read_rand($1_usertype)
-	dev_write_sound($1_usertype)
-	dev_read_sound($1_usertype)
-	dev_read_sound_mixer($1_usertype)
-	dev_write_sound_mixer($1_usertype)
-
-	files_exec_etc_files($1_usertype)
-	files_search_locks($1_usertype)
-	# Check to see if cdrom is mounted
-	files_search_mnt($1_usertype)
-	# cjp: perhaps should cut back on file reads:
-	files_read_var_files($1_usertype)
-	files_read_var_symlinks($1_usertype)
-	files_read_generic_spool($1_usertype)
-	files_read_var_lib_files($1_usertype)
-	# Stat lost+found.
-	files_getattr_lost_found_dirs($1_usertype)
-	files_read_config_files($1_usertype)
-	fs_read_noxattr_fs_files($1_usertype)
-	fs_read_noxattr_fs_symlinks($1_usertype)
-	fs_rw_cgroup_files($1_usertype)
-
-	application_getattr_socket($1_usertype)
-
-	logging_send_syslog_msg($1_usertype)
-	logging_send_audit_msgs($1_usertype)
-	selinux_get_enforce_mode($1_usertype)
-
-	# cjp: some of this probably can be removed
-	selinux_get_fs_mount($1_usertype)
-	selinux_validate_context($1_usertype)
-	selinux_compute_access_vector($1_usertype)
-	selinux_compute_create_context($1_usertype)
-	selinux_compute_relabel_context($1_usertype)
-	selinux_compute_user_contexts($1_usertype)
-
-	# for eject
-	storage_getattr_fixed_disk_dev($1_usertype)
+	typeattribute $1_t common_userdomain;
 
-	auth_read_login_records($1_usertype)
-	auth_run_pam($1_t,$1_r)
-	auth_run_utempter($1_t,$1_r)
+	userdom_basic_networking(common_userdomain)
 
-	init_read_utmp($1_usertype)
-
-	seutil_read_file_contexts($1_usertype)
-	seutil_read_default_contexts($1_usertype)
-	seutil_run_newrole($1_t,$1_r)
-	seutil_exec_checkpolicy($1_t)
-	seutil_exec_setfiles($1_usertype)
-	# for when the network connection is killed
-	# this is needed when a login role can change
-	# to this one.
-	seutil_dontaudit_signal_newrole($1_t)
-
-	tunable_policy(`user_direct_mouse',`
-		dev_read_mouse($1_usertype)
-	')
-
-	tunable_policy(`user_ttyfile_stat',`
-		term_getattr_all_ttys($1_t)
-	')
-
-	optional_policy(`
-		# Allow graphical boot to check battery lifespan
-		apm_stream_connect($1_usertype)
-	')
-
-	optional_policy(`
-		canna_stream_connect($1_usertype)
-	')
-
-	optional_policy(`
-		chrome_role($1_r, $1_usertype)
-	')
-
-	optional_policy(`
-		colord_read_lib_files($1_usertype)
-	')
-
-	optional_policy(`
-		dbus_system_bus_client($1_usertype)
-
-		allow $1_usertype $1_usertype:dbus  send_msg;
-
-		optional_policy(`
-			avahi_dbus_chat($1_usertype)
-		')
-
-		optional_policy(`
-			policykit_dbus_chat($1_usertype)
-		')
-
-		optional_policy(`
-			bluetooth_dbus_chat($1_usertype)
-		')
-
-		optional_policy(`
-			consolekit_dbus_chat($1_usertype)
-			consolekit_read_log($1_usertype)
-		')
-
-		optional_policy(`
-			devicekit_dbus_chat($1_usertype)
-			devicekit_dbus_chat_power($1_usertype)
-			devicekit_dbus_chat_disk($1_usertype)
-		')
-
-		optional_policy(`
-			evolution_dbus_chat($1_usertype)
-			evolution_alarm_dbus_chat($1_usertype)
-		')
-
-		optional_policy(`
-			gnome_dbus_chat_gconfdefault($1_usertype)
-		')
-
-		optional_policy(`
-			hal_dbus_chat($1_usertype)
-		')
-
-		optional_policy(`
-			kde_dbus_chat_backlighthelper($1_usertype)
-		')
-
-		optional_policy(`
-			modemmanager_dbus_chat($1_usertype)
-		')
-
-		optional_policy(`
-			networkmanager_dbus_chat($1_usertype)
-			networkmanager_read_lib_files($1_usertype)
-		')
-
-		optional_policy(`
-			vpn_dbus_chat($1_usertype)
-		')
-	')
-
-	optional_policy(`
-		git_session_role($1_r, $1_usertype)
-	')
-
-	optional_policy(`
-		inetd_use_fds($1_usertype)
-		inetd_rw_tcp_sockets($1_usertype)
-	')
-
-	optional_policy(`
-		inn_read_config($1_usertype)
-		inn_read_news_lib($1_usertype)
-		inn_read_news_spool($1_usertype)
-	')
-
-	optional_policy(`
-		lircd_stream_connect($1_usertype)
-	')
-
-	optional_policy(`
-		locate_read_lib_files($1_usertype)
-	')
-
-	# for running depmod as part of the kernel packaging process
-	optional_policy(`
-		modutils_read_module_config($1_usertype)
-	')
-
-	optional_policy(`
-		mta_rw_spool($1_usertype)
-		mta_manage_queue($1_usertype)
-		mta_filetrans_home_content($1_usertype)
-	')
-
-	optional_policy(`
-		nsplugin_role($1_r, $1_usertype)
-	')
-
-	optional_policy(`
-		tunable_policy(`allow_user_mysql_connect',`
-			mysql_stream_connect($1_t)
-		')
-	')
-
-	optional_policy(`
-		oident_manage_user_content($1_t)
-		oident_relabel_user_content($1_t)
-	')
-
-	optional_policy(`
-		# to allow monitoring of pcmcia status
-		pcmcia_read_pid($1_usertype)
-	')
-
-	optional_policy(`
-		pcscd_read_pub_files($1_usertype)
-		pcscd_stream_connect($1_usertype)
-	')
-
-	optional_policy(`
-		tunable_policy(`allow_user_postgresql_connect',`
-			postgresql_stream_connect($1_usertype)
-			postgresql_tcp_connect($1_usertype)
-		')
-	')
-
-	optional_policy(`
-		resmgr_stream_connect($1_usertype)
-	')
+	auth_run_pam(common_userdomain,$1_r)
+	auth_run_utempter(common_userdomain,$1_r)
+	seutil_run_newrole(common_userdomain,$1_r)
 
 	optional_policy(`
-		rpc_dontaudit_getattr_exports($1_usertype)
-		rpc_manage_nfs_rw_content($1_usertype)
+		chrome_role($1_r, common_userdomain)
 	')
 
 	optional_policy(`
-		rpcbind_stream_connect($1_usertype)
+		git_session_role($1_r, common_userdomain)
 	')
 
 	optional_policy(`
-		samba_stream_connect_winbind($1_usertype)
+		nsplugin_role($1_r, common_userdomain)
 	')
 
 	optional_policy(`
-		sandbox_transition($1_usertype, $1_r)
+		sandbox_transition(common_userdomain, $1_r)
 	')
 
 	optional_policy(`
@@ -839,11 +535,7 @@ template(`userdom_common_user_template',
 	')
 
 	optional_policy(`
-		slrnpull_search_spool($1_usertype)
-	')
-
-	optional_policy(`
-		thumb_role($1_r, $1_usertype)
+		thumb_role($1_r, common_userdomain)
 	')
 ')
 
@@ -872,10 +564,9 @@ template(`userdom_login_user_template',
 
 	userdom_base_user_template($1)
 
-	userdom_manage_home_role($1_r, $1_usertype)
-
-	userdom_manage_tmp_role($1_r, $1_usertype)
-	userdom_manage_tmpfs_role($1_r, $1_usertype)
+	userdom_manage_home_role($1_r)
+	userdom_manage_tmp_role($1_r)
+	userdom_manage_tmpfs_role($1_r)
 
 	ifelse(`$1',`unconfined',`',`
 		gen_tunable(allow_$1_exec_content, true)
@@ -1010,9 +701,6 @@ template(`userdom_restricted_user_templa
 	typeattribute $1_t unpriv_userdomain;
 	domain_interactive_fd($1_t)
 
-	allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
-	dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
-
 	##############################
 	#
 	# Local policy
@@ -3929,6 +3617,10 @@ template(`userdom_unpriv_usertype',`
 	
 	auth_use_nsswitch($2)
 	ubac_constrained($2)
+
+	userdom_manage_home_role($1_r)
+	userdom_manage_tmp_role($1_r)
+	userdom_manage_tmpfs_role($1_r)
 ')
 
 ########################################
diff -up serefpolicy-3.10.0/policy/modules/system/userdomain.te.userdomain serefpolicy-3.10.0/policy/modules/system/userdomain.te
--- serefpolicy-3.10.0/policy/modules/system/userdomain.te.userdomain	2011-10-11 10:15:28.427129208 -0400
+++ serefpolicy-3.10.0/policy/modules/system/userdomain.te	2011-10-11 10:15:28.507129054 -0400
@@ -69,6 +69,8 @@ attribute userdomain;
 
 # unprivileged user domains
 attribute unpriv_userdomain;
+# common user domains
+attribute common_userdomain;
 
 attribute untrusted_content_type;
 attribute untrusted_content_tmp_type;
@@ -141,16 +143,17 @@ miscfiles_cert_type(home_cert_t)
 userdom_user_home_content(home_cert_t)
 ubac_constrained(home_cert_t)
 
-tunable_policy(`allow_console_login',`
-	term_use_console(userdomain)
-')
-
-allow userdomain userdomain:process signull;
+allow unpriv_userdomain self:netlink_kobject_uevent_socket create_socket_perms;
+dontaudit unpriv_userdomain self:netlink_audit_socket create_socket_perms;
 
 # Nautilus causes this avc
 dontaudit unpriv_userdomain self:dir setattr;
 allow unpriv_userdomain self:key manage_key_perms;
 
+userdom_manage_home(unpriv_userdomain)
+userdom_manage_tmp(unpriv_userdomain)
+userdom_manage_tmpfs(unpriv_userdomain)
+
 optional_policy(`
 	alsa_read_rw_config(unpriv_userdomain)
 	alsa_manage_home_files(unpriv_userdomain)
@@ -158,6 +161,125 @@ optional_policy(`
 	alsa_filetrans_named_content(unpriv_userdomain)
 ')
 
+tunable_policy(`allow_console_login',`
+	term_use_console(userdomain)
+')
+
+allow userdomain userdomain:process signull;
+
+allow userdomain user_devpts_t:chr_file { setattr rw_chr_file_perms };
+term_create_pty(userdomain, user_devpts_t)
+# avoid annoying messages on terminal hangup on role change
+dontaudit userdomain user_devpts_t:chr_file ioctl;
+
+allow userdomain user_tty_device_t:chr_file { setattr rw_chr_file_perms };
+# avoid annoying messages on terminal hangup on role change
+dontaudit userdomain user_tty_device_t:chr_file ioctl;
+
+corecmd_shell_entry_type(userdomain)
+corecmd_bin_entry_type(userdomain)
+
+term_user_pty(userdomain, user_devpts_t)
+
+term_user_tty(userdomain, user_tty_device_t)
+term_dontaudit_getattr_generic_ptys(userdomain)
+
+application_exec_all(userdomain)
+
+kernel_read_kernel_sysctls(userdomain)
+kernel_read_all_sysctls(userdomain)
+kernel_dontaudit_list_unlabeled(userdomain)
+kernel_dontaudit_getattr_unlabeled_files(userdomain)
+kernel_dontaudit_getattr_unlabeled_symlinks(userdomain)
+kernel_dontaudit_getattr_unlabeled_pipes(userdomain)
+kernel_dontaudit_getattr_unlabeled_sockets(userdomain)
+kernel_dontaudit_getattr_unlabeled_blk_files(userdomain)
+kernel_dontaudit_getattr_unlabeled_chr_files(userdomain)
+kernel_dontaudit_list_proc(userdomain)
+
+dev_dontaudit_getattr_all_blk_files(userdomain)
+dev_dontaudit_getattr_all_chr_files(userdomain)
+dev_getattr_mtrr_dev(userdomain)
+
+# When the user domain runs ps, there will be a number of access
+# denials when ps tries to search /proc. Do not audit these denials.
+domain_dontaudit_read_all_domains_state(userdomain)
+domain_dontaudit_getattr_all_domains(userdomain)
+domain_dontaudit_getsession_all_domains(userdomain)
+dev_dontaudit_all_access_check(userdomain)
+
+files_read_etc_files(userdomain)
+files_list_mnt(userdomain)
+files_list_var(userdomain)
+files_read_mnt_files(userdomain)
+files_dontaudit_access_check_mnt(userdomain)
+files_read_etc_runtime_files(userdomain)
+files_read_usr_files(userdomain)
+files_read_usr_src_files(userdomain)
+# Read directories and files with the readable_t type.
+# This type is a general type for "world"-readable files.
+files_list_world_readable(userdomain)
+files_read_world_readable_files(userdomain)
+files_read_world_readable_symlinks(userdomain)
+files_read_world_readable_pipes(userdomain)
+files_read_world_readable_sockets(userdomain)
+# old broswer_domain():
+files_dontaudit_getattr_all_dirs(userdomain)
+files_dontaudit_list_non_security(userdomain)
+files_dontaudit_getattr_all_files(userdomain)
+files_dontaudit_getattr_non_security_symlinks(userdomain)
+files_dontaudit_getattr_non_security_pipes(userdomain)
+files_dontaudit_getattr_non_security_sockets(userdomain)
+files_dontaudit_setattr_etc_runtime_files(userdomain)
+
+files_exec_usr_files(userdomain)
+
+fs_list_cgroup_dirs(userdomain)
+fs_dontaudit_rw_cgroup_files(userdomain)
+
+storage_rw_fuse(userdomain)
+
+init_stream_connect(userdomain)
+# The library functions always try to open read-write first,
+# then fall back to read-only if it fails. 
+init_dontaudit_rw_utmp(userdomain)
+libs_exec_ld_so(userdomain)
+logging_send_audit_msgs(userdomain)
+
+miscfiles_read_localization(userdomain)
+miscfiles_read_generic_certs(userdomain)
+
+miscfiles_read_all_certs(userdomain)
+miscfiles_read_localization(userdomain)
+miscfiles_read_man_pages(userdomain)
+miscfiles_read_public_files(userdomain)
+
+systemd_dbus_chat_logind(userdomain)
+
+tunable_policy(`allow_execmem',`
+	# Allow loading DSOs that require executable stack.
+	allow userdomain self:process execmem;
+')
+
+tunable_policy(`allow_execmem && allow_execstack',`
+	# Allow making the stack executable via mprotect.
+	allow userdomain self:process execstack;
+')
+
+optional_policy(`
+	abrt_stream_connect(userdomain)
+')
+
+optional_policy(`
+	fs_list_cgroup_dirs(userdomain)
+')
+	
+optional_policy(`
+	ssh_rw_stream_sockets(userdomain)
+	ssh_delete_tmp(userdomain)
+	ssh_signal(userdomain)
+')
+
 optional_policy(`
 	gnome_filetrans_home_content(userdomain)
 ')
@@ -173,3 +295,240 @@ optional_policy(`
 optional_policy(`
 	xserver_filetrans_home_content(userdomain)
 ')
+
+##############################
+#
+# Common User domain Local policy
+#
+
+# evolution and gnome-session try to create a netlink socket
+dontaudit common_userdomain self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
+dontaudit common_userdomain self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
+allow common_userdomain self:netlink_kobject_uevent_socket create_socket_perms;
+allow common_userdomain self:socket create_socket_perms;
+
+allow common_userdomain unpriv_userdomain:fd use;
+
+kernel_read_system_state(common_userdomain)
+kernel_read_network_state(common_userdomain)
+kernel_read_software_raid_state(common_userdomain)
+kernel_read_net_sysctls(common_userdomain)
+# Very permissive allowing every domain to see every type:
+kernel_get_sysvipc_info(common_userdomain)
+# Find CDROM devices:
+kernel_read_device_sysctls(common_userdomain)
+kernel_request_load_module(common_userdomain)
+
+corenet_udp_bind_generic_node(common_userdomain)
+corenet_udp_bind_generic_port(common_userdomain)
+
+dev_read_rand(common_userdomain)
+dev_write_sound(common_userdomain)
+dev_read_sound(common_userdomain)
+dev_read_sound_mixer(common_userdomain)
+dev_write_sound_mixer(common_userdomain)
+
+files_exec_etc_files(common_userdomain)
+files_search_locks(common_userdomain)
+# Check to see if cdrom is mounted
+files_search_mnt(common_userdomain)
+# cjp: perhaps should cut back on file reads:
+files_read_var_files(common_userdomain)
+files_read_var_symlinks(common_userdomain)
+files_read_generic_spool(common_userdomain)
+files_read_var_lib_files(common_userdomain)
+# Stat lost+found.
+files_getattr_lost_found_dirs(common_userdomain)
+files_read_config_files(common_userdomain)
+fs_read_noxattr_fs_files(common_userdomain)
+fs_read_noxattr_fs_symlinks(common_userdomain)
+fs_rw_cgroup_files(common_userdomain)
+
+application_getattr_socket(common_userdomain)
+
+logging_send_syslog_msg(common_userdomain)
+logging_send_audit_msgs(common_userdomain)
+selinux_get_enforce_mode(common_userdomain)
+
+# cjp: some of this probably can be removed
+selinux_get_fs_mount(common_userdomain)
+selinux_validate_context(common_userdomain)
+selinux_compute_access_vector(common_userdomain)
+selinux_compute_create_context(common_userdomain)
+selinux_compute_relabel_context(common_userdomain)
+selinux_compute_user_contexts(common_userdomain)
+
+# for eject
+storage_getattr_fixed_disk_dev(common_userdomain)
+
+auth_read_login_records(common_userdomain)
+
+init_read_utmp(common_userdomain)
+
+seutil_read_file_contexts(common_userdomain)
+seutil_read_default_contexts(common_userdomain)
+seutil_exec_checkpolicy(common_userdomain)
+seutil_exec_setfiles(common_userdomain)
+# for when the network connection is killed
+# this is needed when a login role can change
+# to this one.
+seutil_dontaudit_signal_newrole(common_userdomain)
+
+tunable_policy(`user_direct_mouse',`
+	dev_read_mouse(common_userdomain)
+')
+
+tunable_policy(`user_ttyfile_stat',`
+	term_getattr_all_ttys(common_userdomain)
+')
+
+optional_policy(`
+	# Allow graphical boot to check battery lifespan
+	apm_stream_connect(common_userdomain)
+')
+
+optional_policy(`
+	canna_stream_connect(common_userdomain)
+')
+
+optional_policy(`
+	colord_read_lib_files(common_userdomain)
+')
+
+optional_policy(`
+	dbus_system_bus_client(common_userdomain)
+
+	allow common_userdomain common_userdomain:dbus  send_msg;
+
+	optional_policy(`
+		avahi_dbus_chat(common_userdomain)
+	')
+
+	optional_policy(`
+		policykit_dbus_chat(common_userdomain)
+	')
+
+	optional_policy(`
+		bluetooth_dbus_chat(common_userdomain)
+	')
+
+	optional_policy(`
+		consolekit_dbus_chat(common_userdomain)
+		consolekit_read_log(common_userdomain)
+	')
+
+	optional_policy(`
+		devicekit_dbus_chat(common_userdomain)
+		devicekit_dbus_chat_power(common_userdomain)
+		devicekit_dbus_chat_disk(common_userdomain)
+	')
+
+	optional_policy(`
+		evolution_dbus_chat(common_userdomain)
+		evolution_alarm_dbus_chat(common_userdomain)
+	')
+
+	optional_policy(`
+		gnome_dbus_chat_gconfdefault(common_userdomain)
+	')
+
+	optional_policy(`
+		hal_dbus_chat(common_userdomain)
+	')
+
+	optional_policy(`
+		kde_dbus_chat_backlighthelper(common_userdomain)
+	')
+
+	optional_policy(`
+		modemmanager_dbus_chat(common_userdomain)
+	')
+
+	optional_policy(`
+		networkmanager_dbus_chat(common_userdomain)
+		networkmanager_read_lib_files(common_userdomain)
+	')
+
+	optional_policy(`
+		vpn_dbus_chat(common_userdomain)
+	')
+')
+
+optional_policy(`
+	inetd_use_fds(common_userdomain)
+	inetd_rw_tcp_sockets(common_userdomain)
+')
+
+optional_policy(`
+	inn_read_config(common_userdomain)
+	inn_read_news_lib(common_userdomain)
+	inn_read_news_spool(common_userdomain)
+')
+
+optional_policy(`
+	lircd_stream_connect(common_userdomain)
+')
+
+optional_policy(`
+	locate_read_lib_files(common_userdomain)
+')
+
+# for running depmod as part of the kernel packaging process
+optional_policy(`
+	modutils_read_module_config(common_userdomain)
+')
+
+optional_policy(`
+	mta_rw_spool(common_userdomain)
+	mta_manage_queue(common_userdomain)
+	mta_filetrans_home_content(common_userdomain)
+')
+
+optional_policy(`
+	tunable_policy(`allow_user_mysql_connect',`
+		mysql_stream_connect(common_userdomain)
+	')
+')
+
+optional_policy(`
+	oident_manage_user_content(common_userdomain)
+	oident_relabel_user_content(common_userdomain)
+')
+
+optional_policy(`
+	# to allow monitoring of pcmcia status
+	pcmcia_read_pid(common_userdomain)
+')
+
+optional_policy(`
+	pcscd_read_pub_files(common_userdomain)
+	pcscd_stream_connect(common_userdomain)
+')
+
+optional_policy(`
+	tunable_policy(`allow_user_postgresql_connect',`
+		postgresql_stream_connect(common_userdomain)
+		postgresql_tcp_connect(common_userdomain)
+	')
+')
+
+optional_policy(`
+	resmgr_stream_connect(common_userdomain)
+')
+
+optional_policy(`
+	rpc_dontaudit_getattr_exports(common_userdomain)
+	rpc_manage_nfs_rw_content(common_userdomain)
+')
+
+optional_policy(`
+	rpcbind_stream_connect(common_userdomain)
+')
+
+optional_policy(`
+	samba_stream_connect_winbind(common_userdomain)
+')
+
+optional_policy(`
+	slrnpull_search_spool(common_userdomain)
+')