diff --git a/refpolicy/policy/modules/admin/logrotate.te b/refpolicy/policy/modules/admin/logrotate.te
index 0b9aeec4..060908be 100644
--- a/refpolicy/policy/modules/admin/logrotate.te
+++ b/refpolicy/policy/modules/admin/logrotate.te
@@ -52,7 +52,10 @@ allow logrotate_t logrotate_tmp_t:dir create_dir_perms;
 allow logrotate_t logrotate_tmp_t:file create_file_perms;
 files_create_tmp_files(logrotate_t, logrotate_tmp_t, { file dir })
 
+# for /var/lib/logrotate.status and /var/lib/logcheck
 allow logrotate_t logrotate_var_lib_t:dir { create rw_dir_perms };
+allow logrotate_t logrotate_var_lib_t:file create_file_perms;
+files_create_var_lib(logrotate_t, logrotate_var_lib_t)
 
 kernel_read_system_state(logrotate_t)
 kernel_read_kernel_sysctl(logrotate_t)
@@ -74,6 +77,7 @@ corecmd_exec_ls(logrotate_t)
 
 domain_signal_all_domains(logrotate_t)
 domain_use_wide_inherit_fd(logrotate_t)
+domain_getattr_all_entry_files(logrotate_t)
 
 files_read_usr_files(logrotate_t)
 files_read_etc_files(logrotate_t)
@@ -88,6 +92,7 @@ files_manage_generic_spool_dirs(logrotate_t)
 init_domtrans_script(logrotate_t)
 
 logging_manage_all_logs(logrotate_t)
+logging_send_syslog_msg(logrotate_t)
 # cjp: why is this needed?
 logging_exec_all_logs(logrotate_t)
 
@@ -96,6 +101,8 @@ libs_use_shared_libs(logrotate_t)
 
 miscfiles_read_localization(logrotate_t)
 
+seutil_dontaudit_search_config(logrotate_t)
+
 sysnet_read_config(logrotate_t)
 
 userdom_use_unpriv_users_fd(logrotate_t)
@@ -164,18 +171,11 @@ allow logrotate_t {staff_home_dir_t sysadm_home_dir_t}:dir { getattr read search
 # Read /proc/PID directories for all domains.
 allow logrotate_t domain:notdevfile_class_set r_file_perms;
 allow logrotate_t domain:dir r_dir_perms;
-allow logrotate_t exec_type:file getattr;
-
-# for /var/lib/logrotate.status and /var/lib/logcheck
-file_type_auto_trans(logrotate_t, var_lib_t, logrotate_var_lib_t, file)
 
 # for /var/backups on Debian
 ifdef(`backup.te', `
 rw_dir_create_file(logrotate_t, backup_store_t)
 ')
 
-allow logrotate_t syslogd_t:unix_dgram_socket sendto;
 allow logrotate_t syslogd_exec_t:file r_file_perms;
-
-dontaudit logrotate_t selinux_config_t:dir search;
 ') dnl end TODO