diff --git a/policy/modules/services/accountsd.if b/policy/modules/services/accountsd.if
index 292dadd1..c0f858de 100644
--- a/policy/modules/services/accountsd.if
+++ b/policy/modules/services/accountsd.if
@@ -18,6 +18,46 @@ interface(`accountsd_domtrans',`
domtrans_pattern($1, accountsd_exec_t, accountsd_t)
')
+########################################
+##
+## Do not audit attempts to read and write Accounts Daemon
+## fifo file.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`accountsd_dontaudit_rw_fifo_file',`
+ gen_require(`
+ type accountsd_t;
+ ')
+
+ dontaudit $1 accountsd_t:fifo_file rw_fifo_file_perms;
+')
+
+########################################
+##
+## Send and receive messages from
+## accountsd over dbus.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`accountsd_dbus_chat',`
+ gen_require(`
+ type accountsd_t;
+ class dbus send_msg;
+ ')
+
+ allow $1 accountsd_t:dbus send_msg;
+ allow accountsd_t $1:dbus send_msg;
+')
+
########################################
##
## Search accountsd lib directories.
@@ -76,46 +116,6 @@ interface(`accountsd_manage_lib_files',`
manage_files_pattern($1, accountsd_var_lib_t, accountsd_var_lib_t)
')
-########################################
-##
-## Send and receive messages from
-## accountsd over dbus.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`accountsd_dbus_chat',`
- gen_require(`
- type accountsd_t;
- class dbus send_msg;
- ')
-
- allow $1 accountsd_t:dbus send_msg;
- allow accountsd_t $1:dbus send_msg;
-')
-
-########################################
-##
-## Do not audit attempts to read and write Accounts Daemon
-## fifo file.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`accountsd_dontaudit_rw_fifo_file',`
- gen_require(`
- type accountsd_t;
- ')
-
- dontaudit $1 accountsd_t:fifo_file rw_inherited_fifo_file_perms;
-')
-
########################################
##
## All of the rules required to administrate
@@ -137,8 +137,9 @@ interface(`accountsd_admin',`
gen_require(`
type accountsd_t;
')
+
allow $1 accountsd_t:process { ptrace signal_perms getattr };
- read_files_pattern($1, accountsd_t, accountsd_t)
+ ps_process_pattern($1, accountsd_t)
accountsd_manage_lib_files($1)
')
diff --git a/policy/modules/services/accountsd.te b/policy/modules/services/accountsd.te
index eced3f6d..1632f105 100644
--- a/policy/modules/services/accountsd.te
+++ b/policy/modules/services/accountsd.te
@@ -16,13 +16,13 @@ files_type(accountsd_var_lib_t)
#
# accountsd local policy
#
-allow accountsd_t self:capability { dac_override setuid setgid sys_ptrace };
+allow accountsd_t self:capability { dac_override setuid setgid sys_ptrace };
allow accountsd_t self:fifo_file rw_fifo_file_perms;
manage_dirs_pattern(accountsd_t, accountsd_var_lib_t, accountsd_var_lib_t)
manage_files_pattern(accountsd_t, accountsd_var_lib_t, accountsd_var_lib_t)
-files_var_lib_filetrans(accountsd_t, accountsd_var_lib_t, { file dir } )
+files_var_lib_filetrans(accountsd_t, accountsd_var_lib_t, { file dir })
kernel_read_kernel_sysctls(accountsd_t)