From 99064c9fbdfab2cf8f980af3518007e71d1c666d Mon Sep 17 00:00:00 2001
From: Chris PeBenito <cpebenito@tresys.com>
Date: Apr 11 2007 14:04:35 +0000
Subject: more consolekit updates from dan


---

diff --git a/policy/modules/services/consolekit.fc b/policy/modules/services/consolekit.fc
index e8268f8..838082c 100644
--- a/policy/modules/services/consolekit.fc
+++ b/policy/modules/services/consolekit.fc
@@ -1 +1,3 @@
 /usr/sbin/console-kit-daemon	--	gen_context(system_u:object_r:consolekit_exec_t,s0)
+
+/var/run/consolekit.pid		--	gen_context(system_u:object_r:consolekit_var_run_t,s0)
diff --git a/policy/modules/services/consolekit.te b/policy/modules/services/consolekit.te
index 055c9a7..749c347 100644
--- a/policy/modules/services/consolekit.te
+++ b/policy/modules/services/consolekit.te
@@ -1,5 +1,5 @@
 
-policy_module(consolekit,1.0.1)
+policy_module(consolekit,1.0.2)
 
 ########################################
 #
@@ -10,16 +10,24 @@ type consolekit_t;
 type consolekit_exec_t;
 init_daemon_domain(consolekit_t, consolekit_exec_t)
 
+# pid files
+type consolekit_var_run_t;
+files_pid_file(consolekit_var_run_t)
+
 ########################################
 #
 # consolekit local policy
 #
 
 allow consolekit_t self:capability { sys_tty_config dac_override sys_nice sys_ptrace };
-allow consolekit_t self:process getsched;
+allow consolekit_t self:process { getsched signal };
 allow consolekit_t self:fifo_file rw_fifo_file_perms;
 allow consolekit_t self:unix_stream_socket create_stream_socket_perms;
 
+# pid file
+manage_files_pattern(consolekit_t,consolekit_var_run_t,consolekit_var_run_t)
+files_pid_filetrans(consolekit_t,consolekit_var_run_t, file)
+
 dev_read_urand(consolekit_t)
 dev_read_sysfs(consolekit_t)
 
@@ -28,6 +36,8 @@ domain_use_interactive_fds(consolekit_t)
 
 files_read_etc_files(consolekit_t)
 
+term_use_console(consolekit_t)
+
 libs_use_ld_so(consolekit_t)
 libs_use_shared_libs(consolekit_t)
 
@@ -44,4 +54,8 @@ optional_policy(`
 	dbus_connect_system_bus(consolekit_t)
 
 	hal_dbus_chat(consolekit_t)
+
+	optional_policy(`
+		unconfined_dbus_chat(consolekit_t)
+	')
 ')