diff --git a/Changelog b/Changelog
index 773ad92..8a78a19 100644
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,4 @@
+- Enable open permission checks policy capability.
 - Remove hierarchy from portage module as it is not a good example of
   hieararchy.
 - Remove enableaudit target from modular build as semodule -DB supplants it.
diff --git a/policy/modules/admin/acct.te b/policy/modules/admin/acct.te
index 6d084c9..1e6ec2d 100644
--- a/policy/modules/admin/acct.te
+++ b/policy/modules/admin/acct.te
@@ -23,7 +23,7 @@ allow acct_t self:capability { sys_pacct chown fsetid };
 # not sure why we need kill, the command "last" is reported as using it
 dontaudit acct_t self:capability { kill sys_tty_config };
 
-allow acct_t self:fifo_file { read write getattr };
+allow acct_t self:fifo_file rw_fifo_file_perms;
 allow acct_t self:process signal_perms;
 
 manage_files_pattern(acct_t, acct_data_t, acct_data_t)
diff --git a/policy/modules/admin/amanda.te b/policy/modules/admin/amanda.te
index b6512fe..4b5209c 100644
--- a/policy/modules/admin/amanda.te
+++ b/policy/modules/admin/amanda.te
@@ -76,10 +76,10 @@ allow amanda_t self:tcp_socket create_stream_socket_perms;
 allow amanda_t self:udp_socket create_socket_perms;
 
 # access to amanda_amandates_t
-allow amanda_t amanda_amandates_t:file { getattr lock read write };
+allow amanda_t amanda_amandates_t:file rw_file_perms;
 
 # configuration files -> read only
-allow amanda_t amanda_config_t:file { getattr read };
+allow amanda_t amanda_config_t:file read_file_perms;
 
 # access to amandas data structure
 manage_dirs_pattern(amanda_t, amanda_data_t, amanda_data_t)
@@ -87,7 +87,7 @@ manage_files_pattern(amanda_t, amanda_data_t, amanda_data_t)
 filetrans_pattern(amanda_t, amanda_config_t, amanda_data_t, { file dir })
 
 # access to amanda_dumpdates_t
-allow amanda_t amanda_dumpdates_t:file { getattr lock read write };
+allow amanda_t amanda_dumpdates_t:file rw_file_perms;
 
 can_exec(amanda_t, amanda_exec_t)
 can_exec(amanda_t, amanda_inetd_exec_t)
@@ -172,7 +172,7 @@ optional_policy(`
 
 allow amanda_recover_t self:capability { fowner fsetid kill setgid setuid chown dac_override };
 allow amanda_recover_t self:process { sigkill sigstop signal };
-allow amanda_recover_t self:fifo_file { getattr ioctl read write };
+allow amanda_recover_t self:fifo_file rw_fifo_file_perms;
 allow amanda_recover_t self:unix_stream_socket { connect create read write };
 allow amanda_recover_t self:tcp_socket create_stream_socket_perms;
 allow amanda_recover_t self:udp_socket create_socket_perms;
diff --git a/policy/modules/admin/dpkg.te b/policy/modules/admin/dpkg.te
index 456fca9..07e58a5 100644
--- a/policy/modules/admin/dpkg.te
+++ b/policy/modules/admin/dpkg.te
@@ -171,7 +171,7 @@ userdom_use_unpriv_users_fds(dpkg_t)
 # transition to dpkg script:
 dpkg_domtrans_script(dpkg_t)
 # since the scripts aren't labeled correctly yet...
-allow dpkg_t dpkg_var_lib_t:file execute;
+allow dpkg_t dpkg_var_lib_t:file mmap_file_perms;
 
 optional_policy(`
 	apt_use_ptys(dpkg_t)
diff --git a/policy/modules/admin/firstboot.te b/policy/modules/admin/firstboot.te
index 2d22199..cadd349 100644
--- a/policy/modules/admin/firstboot.te
+++ b/policy/modules/admin/firstboot.te
@@ -27,13 +27,12 @@ files_config_file(firstboot_etc_t)
 
 allow firstboot_t self:capability { dac_override setgid };
 allow firstboot_t self:process setfscreate;
-allow firstboot_t self:file { read write };
-allow firstboot_t self:fifo_file { getattr read write };
+allow firstboot_t self:fifo_file rw_fifo_file_perms;
 allow firstboot_t self:tcp_socket create_stream_socket_perms;
 allow firstboot_t self:unix_stream_socket { connect create };
 allow firstboot_t self:passwd rootok;
 
-allow firstboot_t firstboot_etc_t:file { getattr read };
+allow firstboot_t firstboot_etc_t:file read_file_perms;
 
 kernel_read_system_state(firstboot_t)
 kernel_read_kernel_sysctls(firstboot_t)
diff --git a/policy/modules/admin/mrtg.te b/policy/modules/admin/mrtg.te
index 962f752..7cc90c2 100644
--- a/policy/modules/admin/mrtg.te
+++ b/policy/modules/admin/mrtg.te
@@ -33,7 +33,7 @@ files_pid_file(mrtg_var_run_t)
 allow mrtg_t self:capability { setgid setuid chown };
 dontaudit mrtg_t self:capability sys_tty_config;
 allow mrtg_t self:process signal_perms;
-allow mrtg_t self:fifo_file { getattr read write ioctl };
+allow mrtg_t self:fifo_file rw_fifo_file_perms;
 allow mrtg_t self:unix_stream_socket create_socket_perms;
 allow mrtg_t self:tcp_socket create_socket_perms;
 allow mrtg_t self:udp_socket create_socket_perms;
diff --git a/policy/modules/admin/portage.te b/policy/modules/admin/portage.te
index d2a092e..4f8ebcd 100644
--- a/policy/modules/admin/portage.te
+++ b/policy/modules/admin/portage.te
@@ -73,7 +73,7 @@ read_files_pattern(gcc_config_t, portage_conf_t, portage_conf_t)
 allow gcc_config_t portage_ebuild_t:dir list_dir_perms;
 read_files_pattern(gcc_config_t, portage_ebuild_t, portage_ebuild_t)
 
-allow gcc_config_t portage_exec_t:file { execute getattr };
+allow gcc_config_t portage_exec_t:file mmap_file_perms;
 
 kernel_read_system_state(gcc_config_t)
 kernel_read_kernel_sysctls(gcc_config_t)
diff --git a/policy/modules/admin/rpm.te b/policy/modules/admin/rpm.te
index ce325ba..fc30eb5 100644
--- a/policy/modules/admin/rpm.te
+++ b/policy/modules/admin/rpm.te
@@ -68,8 +68,6 @@ allow rpm_t self:shm create_shm_perms;
 allow rpm_t self:sem create_sem_perms;
 allow rpm_t self:msgq create_msgq_perms;
 allow rpm_t self:msg { send receive };
-allow rpm_t self:dir search;
-allow rpm_t self:file rw_file_perms;;
 
 allow rpm_t rpm_log_t:file manage_file_perms;
 logging_log_filetrans(rpm_t, rpm_log_t, file)
diff --git a/policy/modules/admin/updfstab.te b/policy/modules/admin/updfstab.te
index ccb521f..d23ce81 100644
--- a/policy/modules/admin/updfstab.te
+++ b/policy/modules/admin/updfstab.te
@@ -18,7 +18,7 @@ init_system_domain(updfstab_t, updfstab_exec_t)
 allow updfstab_t self:capability dac_override;
 dontaudit updfstab_t self:capability { sys_admin sys_tty_config };
 allow updfstab_t self:process signal_perms;
-allow updfstab_t self:fifo_file { getattr read write ioctl };
+allow updfstab_t self:fifo_file rw_fifo_file_perms;
 
 kernel_use_fds(updfstab_t)
 kernel_read_kernel_sysctls(updfstab_t)
diff --git a/policy/modules/apps/awstats.te b/policy/modules/apps/awstats.te
index d59f8be..43af46d 100644
--- a/policy/modules/apps/awstats.te
+++ b/policy/modules/apps/awstats.te
@@ -71,7 +71,7 @@ optional_policy(`
 # awstats cgi script policy
 #
 
-allow httpd_awstats_script_t awstats_var_lib_t:dir read;
+allow httpd_awstats_script_t awstats_var_lib_t:dir list_dir_perms;
 
 read_files_pattern(httpd_awstats_script_t, awstats_var_lib_t, awstats_var_lib_t)
 files_search_var_lib(httpd_awstats_script_t)
diff --git a/policy/modules/apps/calamaris.te b/policy/modules/apps/calamaris.te
index b739074..6096881 100644
--- a/policy/modules/apps/calamaris.te
+++ b/policy/modules/apps/calamaris.te
@@ -24,7 +24,7 @@ logging_log_file(calamaris_log_t)
 # for when squid has a different UID
 allow calamaris_t self:capability dac_override;
 allow calamaris_t self:process { fork signal_perms setsched };
-allow calamaris_t self:fifo_file { getattr read write ioctl };
+allow calamaris_t self:fifo_file rw_fifo_file_perms;
 allow calamaris_t self:unix_stream_socket create_stream_socket_perms;
 allow calamaris_t self:tcp_socket create_stream_socket_perms;
 allow calamaris_t self:udp_socket create_socket_perms;
diff --git a/policy/modules/apps/webalizer.te b/policy/modules/apps/webalizer.te
index 12ec66e..8d02fca 100644
--- a/policy/modules/apps/webalizer.te
+++ b/policy/modules/apps/webalizer.te
@@ -48,7 +48,7 @@ allow webalizer_t self:tcp_socket connected_stream_socket_perms;
 allow webalizer_t self:udp_socket { connect connected_socket_perms };
 allow webalizer_t self:netlink_route_socket r_netlink_socket_perms;
 
-allow webalizer_t webalizer_etc_t:file { getattr read };
+allow webalizer_t webalizer_etc_t:file read_file_perms;
 
 manage_dirs_pattern(webalizer_t, webalizer_tmp_t, webalizer_tmp_t)
 manage_files_pattern(webalizer_t, webalizer_tmp_t, webalizer_tmp_t)
diff --git a/policy/modules/apps/yam.te b/policy/modules/apps/yam.te
index 70a5ab8..bf2bf54 100644
--- a/policy/modules/apps/yam.te
+++ b/policy/modules/apps/yam.te
@@ -42,7 +42,7 @@ manage_dirs_pattern(yam_t, yam_content_t, yam_content_t)
 manage_files_pattern(yam_t, yam_content_t, yam_content_t)
 manage_lnk_files_pattern(yam_t, yam_content_t, yam_content_t)
 
-allow yam_t yam_etc_t:file { getattr read };
+allow yam_t yam_etc_t:file read_file_perms;
 files_search_etc(yam_t)
 
 manage_files_pattern(yam_t, yam_tmp_t, yam_tmp_t)
diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if
index 526df99..8fcf126 100644
--- a/policy/modules/kernel/domain.if
+++ b/policy/modules/kernel/domain.if
@@ -628,7 +628,7 @@ interface(`domain_read_confined_domains_state',`
 	read_lnk_files_pattern($1, { domain -unconfined_domain_type }, { domain -unconfined_domain_type })
 
 	dontaudit $1 unconfined_domain_type:dir search_dir_perms;
-	dontaudit $1 unconfined_domain_type:file { getattr read };
+	dontaudit $1 unconfined_domain_type:file read_file_perms;
 ')
 
 ########################################
@@ -743,12 +743,12 @@ interface(`domain_dontaudit_read_all_domains_state',`
 	')
 
 	dontaudit $1 domain:dir list_dir_perms;
-	dontaudit $1 domain:lnk_file read_file_perms;
+	dontaudit $1 domain:lnk_file read_lnk_file_perms;
 	dontaudit $1 domain:file read_file_perms;
 
 	# cjp: these should be removed:
-	dontaudit $1 domain:sock_file read_file_perms;
-	dontaudit $1 domain:fifo_file read_file_perms;
+	dontaudit $1 domain:sock_file read_sock_file_perms;
+	dontaudit $1 domain:fifo_file read_fifo_file_perms;
 ')
 
 ########################################
diff --git a/policy/modules/kernel/selinux.te b/policy/modules/kernel/selinux.te
index a4c47e7..32d4c26 100644
--- a/policy/modules/kernel/selinux.te
+++ b/policy/modules/kernel/selinux.te
@@ -33,8 +33,8 @@ neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security sets
 #
 
 # use SELinuxfs
-allow selinux_unconfined_type security_t:dir { getattr search read };
-allow selinux_unconfined_type security_t:file { getattr read write };
+allow selinux_unconfined_type security_t:dir list_dir_perms;
+allow selinux_unconfined_type security_t:file rw_file_perms;
 
 # Access the security API.
 allow selinux_unconfined_type security_t:security ~{ load_policy setenforce setbool };
diff --git a/policy/modules/services/afs.te b/policy/modules/services/afs.te
index d8b0334..b6c15b1 100644
--- a/policy/modules/services/afs.te
+++ b/policy/modules/services/afs.te
@@ -70,7 +70,7 @@ can_exec(afs_bosserver_t,afs_bosserver_exec_t)
 manage_dirs_pattern(afs_bosserver_t, afs_config_t, afs_config_t)
 manage_files_pattern(afs_bosserver_t, afs_config_t, afs_config_t)
 
-allow afs_bosserver_t afs_dbdir_t:dir { search read getattr };
+allow afs_bosserver_t afs_dbdir_t:dir list_dir_perms;
 
 allow afs_bosserver_t afs_fsserver_t:process signal_perms;
 domtrans_pattern(afs_bosserver_t, afs_fsserver_exec_t, afs_fsserver_t)
diff --git a/policy/modules/services/apache.if b/policy/modules/services/apache.if
index 630b5e3..6bb849d 100644
--- a/policy/modules/services/apache.if
+++ b/policy/modules/services/apache.if
@@ -790,7 +790,7 @@ interface(`apache_exec_modules',`
 	')
 
 	allow $1 httpd_modules_t:dir list_dir_perms;
-	allow $1 httpd_modules_t:lnk_file read_file_perms;
+	allow $1 httpd_modules_t:lnk_file read_lnk_file_perms;
 	can_exec($1,httpd_modules_t)
 ')
 
diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
index bb7d2c9..490683f 100644
--- a/policy/modules/services/apache.te
+++ b/policy/modules/services/apache.te
@@ -258,7 +258,7 @@ manage_dirs_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
 manage_files_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
 manage_lnk_files_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
 
-allow httpd_t httpd_suexec_exec_t:file { getattr read };
+allow httpd_t httpd_suexec_exec_t:file read_file_perms;
 
 allow httpd_t httpd_sys_content_t:dir list_dir_perms;
 read_files_pattern(httpd_t, httpd_sys_content_t, httpd_sys_content_t)
@@ -509,9 +509,9 @@ optional_policy(`
 
 domtrans_pattern(httpd_t, httpd_helper_exec_t, httpd_helper_t)
 
-allow httpd_helper_t httpd_config_t:file { getattr read };
+allow httpd_helper_t httpd_config_t:file read_file_perms;
 
-allow httpd_helper_t httpd_log_t:file append;
+allow httpd_helper_t httpd_log_t:file append_file_perms;
 
 libs_use_ld_so(httpd_helper_t)
 libs_use_shared_libs(httpd_helper_t)
@@ -677,7 +677,7 @@ allow httpd_sys_script_t httpd_t:tcp_socket { read write };
 
 dontaudit httpd_sys_script_t httpd_config_t:dir search;
 
-allow httpd_sys_script_t httpd_squirrelmail_t:file { append read };
+allow httpd_sys_script_t httpd_squirrelmail_t:file { append_file_perms read_file_perms };
 
 allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
 read_files_pattern(httpd_sys_script_t, squirrelmail_spool_t, squirrelmail_spool_t)
@@ -692,7 +692,7 @@ files_search_spool(httpd_sys_script_t)
 apache_domtrans_rotatelogs(httpd_sys_script_t)
 
 ifdef(`distro_redhat',`
-	allow httpd_sys_script_t httpd_log_t:file { getattr append };
+	allow httpd_sys_script_t httpd_log_t:file append_file_perms;
 ')
 
 tunable_policy(`httpd_enable_homedirs',`
diff --git a/policy/modules/services/avahi.te b/policy/modules/services/avahi.te
index 3869e4f..6703a6b 100644
--- a/policy/modules/services/avahi.te
+++ b/policy/modules/services/avahi.te
@@ -21,7 +21,7 @@ files_pid_file(avahi_var_run_t)
 allow avahi_t self:capability { dac_override setgid chown fowner kill setuid sys_chroot };
 dontaudit avahi_t self:capability sys_tty_config;
 allow avahi_t self:process { setrlimit signal_perms setcap };
-allow avahi_t self:fifo_file { read write };
+allow avahi_t self:fifo_file rw_fifo_file_perms;
 allow avahi_t self:unix_stream_socket { connectto create_stream_socket_perms };
 allow avahi_t self:unix_dgram_socket create_socket_perms;
 allow avahi_t self:tcp_socket create_stream_socket_perms;
diff --git a/policy/modules/services/bind.te b/policy/modules/services/bind.te
index ee0ae50..57ab115 100644
--- a/policy/modules/services/bind.te
+++ b/policy/modules/services/bind.te
@@ -70,7 +70,7 @@ allow named_t self:unix_dgram_socket create_socket_perms;
 allow named_t self:tcp_socket create_stream_socket_perms;
 allow named_t self:udp_socket create_socket_perms;
 
-allow named_t dnssec_t:file { getattr read };
+allow named_t dnssec_t:file read_file_perms;
 
 # read configuration
 allow named_t named_conf_t:dir list_dir_perms;
@@ -201,22 +201,20 @@ optional_policy(`
 # cjp: why net_admin?!
 allow ndc_t self:capability { dac_override net_admin };
 allow ndc_t self:process { fork signal_perms };
-allow ndc_t self:fifo_file { read write getattr ioctl };
+allow ndc_t self:fifo_file rw_fifo_file_perms;
 allow ndc_t self:unix_stream_socket { connect create_stream_socket_perms };
 allow ndc_t self:tcp_socket create_socket_perms;
 allow ndc_t self:netlink_route_socket r_netlink_socket_perms;
 
-allow ndc_t dnssec_t:file { getattr read };
+allow ndc_t dnssec_t:file read_file_perms;
 allow ndc_t dnssec_t:lnk_file { getattr read };
 
-allow ndc_t named_t:unix_stream_socket connectto;
+stream_connect_pattern(ndc_t, named_var_run_t, named_var_run_t, named_t)
 
-allow ndc_t named_conf_t:file { getattr read };
+allow ndc_t named_conf_t:file read_file_perms;
 allow ndc_t named_conf_t:lnk_file { getattr read };
 
-allow ndc_t named_var_run_t:sock_file rw_file_perms;
-
-allow ndc_t named_zone_t:dir search;
+allow ndc_t named_zone_t:dir search_dir_perms;
 
 kernel_read_kernel_sysctls(ndc_t)
 
diff --git a/policy/modules/services/ccs.te b/policy/modules/services/ccs.te
index 0dbde41..670a60d 100644
--- a/policy/modules/services/ccs.te
+++ b/policy/modules/services/ccs.te
@@ -38,7 +38,7 @@ files_pid_file(ccs_var_run_t)
 allow ccs_t self:capability { ipc_lock sys_nice sys_resource sys_admin };
 allow ccs_t self:process { signal setrlimit setsched };
 dontaudit ccs_t self:process ptrace;
-allow ccs_t self:fifo_file { read write };
+allow ccs_t self:fifo_file rw_fifo_file_perms;
 allow ccs_t self:unix_stream_socket { connectto create_stream_socket_perms };
 allow ccs_t self:unix_dgram_socket create_socket_perms;
 allow ccs_t self:netlink_route_socket r_netlink_socket_perms;
diff --git a/policy/modules/services/cups.te b/policy/modules/services/cups.te
index 357ba46..22d152d 100644
--- a/policy/modules/services/cups.te
+++ b/policy/modules/services/cups.te
@@ -123,7 +123,7 @@ files_pid_filetrans(cupsd_t, cupsd_var_run_t, file)
 
 read_files_pattern(cupsd_t, hplip_etc_t, hplip_etc_t)
 
-allow cupsd_t hplip_var_run_t:file { read getattr };
+allow cupsd_t hplip_var_run_t:file read_file_perms;
 
 stream_connect_pattern(cupsd_t, ptal_var_run_t, ptal_var_run_t, ptal_t)
 allow cupsd_t ptal_var_run_t : sock_file setattr;
@@ -307,7 +307,7 @@ allow cupsd_config_t cupsd_log_t:file rw_file_perms;
 allow cupsd_config_t cupsd_tmp_t:file manage_file_perms;
 files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { file dir })
 
-allow cupsd_config_t cupsd_var_run_t:file { getattr read };
+allow cupsd_config_t cupsd_var_run_t:file read_file_perms;
 
 manage_files_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t)
 files_pid_filetrans(cupsd_config_t, cupsd_config_var_run_t, file)
diff --git a/policy/modules/services/dante.te b/policy/modules/services/dante.te
index e59c8ac..d2a6899 100644
--- a/policy/modules/services/dante.te
+++ b/policy/modules/services/dante.te
@@ -24,7 +24,7 @@ files_pid_file(dante_var_run_t)
 allow dante_t self:capability { setuid setgid };
 dontaudit dante_t self:capability sys_tty_config;
 allow dante_t self:process signal_perms;
-allow dante_t self:fifo_file { read write };
+allow dante_t self:fifo_file rw_fifo_file_perms;
 allow dante_t self:tcp_socket create_stream_socket_perms;
 allow dante_t self:udp_socket create_socket_perms;
 
diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te
index 2e8dc2e..3054bce 100644
--- a/policy/modules/services/dbus.te
+++ b/policy/modules/services/dbus.te
@@ -36,7 +36,7 @@ files_pid_file(system_dbusd_var_run_t)
 allow system_dbusd_t self:capability { dac_override setgid setpcap setuid };
 dontaudit system_dbusd_t self:capability sys_tty_config;
 allow system_dbusd_t self:process { getattr signal_perms setcap };
-allow system_dbusd_t self:fifo_file { read write };
+allow system_dbusd_t self:fifo_file rw_fifo_file_perms;
 allow system_dbusd_t self:dbus { send_msg acquire_svc };
 allow system_dbusd_t self:unix_stream_socket { connectto create_stream_socket_perms connectto };
 allow system_dbusd_t self:unix_dgram_socket create_socket_perms;
diff --git a/policy/modules/services/dhcp.te b/policy/modules/services/dhcp.te
index d8b0e5a..7f7729e 100644
--- a/policy/modules/services/dhcp.te
+++ b/policy/modules/services/dhcp.te
@@ -27,7 +27,7 @@ files_pid_file(dhcpd_var_run_t)
 allow dhcpd_t self:capability net_raw;
 dontaudit dhcpd_t self:capability { net_admin sys_tty_config };
 allow dhcpd_t self:process signal_perms;
-allow dhcpd_t self:fifo_file { read write getattr };
+allow dhcpd_t self:fifo_file rw_fifo_file_perms;
 allow dhcpd_t self:unix_dgram_socket create_socket_perms;
 allow dhcpd_t self:unix_stream_socket create_socket_perms;
 allow dhcpd_t self:netlink_route_socket r_netlink_socket_perms;
diff --git a/policy/modules/services/distcc.te b/policy/modules/services/distcc.te
index 610d083..10b412c 100644
--- a/policy/modules/services/distcc.te
+++ b/policy/modules/services/distcc.te
@@ -27,7 +27,7 @@ files_pid_file(distccd_var_run_t)
 allow distccd_t self:capability { setgid setuid };
 dontaudit distccd_t self:capability sys_tty_config;
 allow distccd_t self:process { signal_perms setsched };
-allow distccd_t self:fifo_file { read write getattr };
+allow distccd_t self:fifo_file rw_fifo_file_perms;
 allow distccd_t self:netlink_route_socket r_netlink_socket_perms;
 allow distccd_t self:tcp_socket create_stream_socket_perms;
 allow distccd_t self:udp_socket create_socket_perms;
diff --git a/policy/modules/services/dnsmasq.te b/policy/modules/services/dnsmasq.te
index ed88fff..86085fb 100644
--- a/policy/modules/services/dnsmasq.te
+++ b/policy/modules/services/dnsmasq.te
@@ -24,7 +24,7 @@ files_pid_file(dnsmasq_var_run_t)
 allow dnsmasq_t self:capability { net_admin setgid setuid net_bind_service net_raw };
 dontaudit dnsmasq_t self:capability sys_tty_config;
 allow dnsmasq_t self:process { setcap signal_perms };
-allow dnsmasq_t self:fifo_file { read write };
+allow dnsmasq_t self:fifo_file rw_fifo_file_perms;
 allow dnsmasq_t self:netlink_route_socket { bind create nlmsg_read read write };
 allow dnsmasq_t self:tcp_socket create_stream_socket_perms;
 allow dnsmasq_t self:udp_socket create_socket_perms;
diff --git a/policy/modules/services/dovecot.te b/policy/modules/services/dovecot.te
index 3d4b1ff..9785ac9 100644
--- a/policy/modules/services/dovecot.te
+++ b/policy/modules/services/dovecot.te
@@ -148,7 +148,7 @@ allow dovecot_auth_t self:unix_stream_socket create_stream_socket_perms;
 
 allow dovecot_auth_t dovecot_t:unix_stream_socket { getattr accept read write ioctl };
 
-allow dovecot_auth_t dovecot_passwd_t:file { getattr read };
+allow dovecot_auth_t dovecot_passwd_t:file read_file_perms;
 
 # Allow dovecot to create and read SSL parameters file
 manage_files_pattern(dovecot_t, dovecot_var_lib_t, dovecot_var_lib_t)
diff --git a/policy/modules/services/finger.te b/policy/modules/services/finger.te
index 56cc74b..add0d44 100644
--- a/policy/modules/services/finger.te
+++ b/policy/modules/services/finger.te
@@ -28,7 +28,7 @@ files_pid_file(fingerd_var_run_t)
 allow fingerd_t self:capability { setgid setuid };
 dontaudit fingerd_t self:capability { sys_tty_config fsetid };
 allow fingerd_t self:process signal_perms;
-allow fingerd_t self:fifo_file { read write getattr };
+allow fingerd_t self:fifo_file rw_fifo_file_perms;
 allow fingerd_t self:tcp_socket connected_stream_socket_perms;
 allow fingerd_t self:udp_socket create_socket_perms;
 allow fingerd_t self:unix_dgram_socket create_socket_perms;
diff --git a/policy/modules/services/gatekeeper.te b/policy/modules/services/gatekeeper.te
index 9de0edc..70acca3 100644
--- a/policy/modules/services/gatekeeper.te
+++ b/policy/modules/services/gatekeeper.te
@@ -35,7 +35,7 @@ allow gatekeeper_t self:tcp_socket create_stream_socket_perms;
 allow gatekeeper_t self:udp_socket create_socket_perms;
 
 allow gatekeeper_t gatekeeper_etc_t:lnk_file { getattr read };
-allow gatekeeper_t gatekeeper_etc_t:file { getattr read };
+allow gatekeeper_t gatekeeper_etc_t:file read_file_perms;
 files_search_etc(gatekeeper_t)
 
 manage_files_pattern(gatekeeper_t, gatekeeper_log_t, gatekeeper_log_t)
diff --git a/policy/modules/services/jabber.te b/policy/modules/services/jabber.te
index e3e529a..04674d9 100644
--- a/policy/modules/services/jabber.te
+++ b/policy/modules/services/jabber.te
@@ -30,7 +30,7 @@ files_pid_file(jabberd_var_run_t)
 allow jabberd_t self:capability dac_override;
 dontaudit jabberd_t self:capability sys_tty_config;
 allow jabberd_t self:process signal_perms;
-allow jabberd_t self:fifo_file { read write getattr };
+allow jabberd_t self:fifo_file read_fifo_file_perms;
 allow jabberd_t self:tcp_socket create_stream_socket_perms;
 allow jabberd_t self:udp_socket create_socket_perms;
 
diff --git a/policy/modules/services/ldap.te b/policy/modules/services/ldap.te
index 1a5ef74..0038d75 100644
--- a/policy/modules/services/ldap.te
+++ b/policy/modules/services/ldap.te
@@ -44,7 +44,7 @@ files_pid_file(slapd_var_run_t)
 allow slapd_t self:capability { kill setgid setuid net_raw dac_override dac_read_search };
 dontaudit slapd_t self:capability sys_tty_config;
 allow slapd_t self:process setsched;
-allow slapd_t self:fifo_file { read write };
+allow slapd_t self:fifo_file rw_fifo_file_perms;
 allow slapd_t self:udp_socket create_socket_perms;
 #slapd needs to listen and accept needed by ldapsearch (slapd needs to accept from ldapseach)
 allow slapd_t self:tcp_socket create_stream_socket_perms;
@@ -58,7 +58,7 @@ manage_dirs_pattern(slapd_t, slapd_db_t, slapd_db_t)
 manage_files_pattern(slapd_t, slapd_db_t, slapd_db_t)
 manage_lnk_files_pattern(slapd_t, slapd_db_t, slapd_db_t)
 
-allow slapd_t slapd_etc_t:file { getattr read };
+allow slapd_t slapd_etc_t:file read_file_perms;
 
 allow slapd_t slapd_lock_t:file manage_file_perms;
 files_lock_filetrans(slapd_t,slapd_lock_t,file)
diff --git a/policy/modules/services/lpd.te b/policy/modules/services/lpd.te
index d44f211..ca30c34 100644
--- a/policy/modules/services/lpd.te
+++ b/policy/modules/services/lpd.te
@@ -68,7 +68,7 @@ delete_files_pattern(checkpc_t, print_spool_t, print_spool_t)
 files_search_spool(checkpc_t)
 
 allow checkpc_t printconf_t:file getattr;
-allow checkpc_t printconf_t:dir { getattr search read };
+allow checkpc_t printconf_t:dir list_dir_perms;
 
 kernel_read_system_state(checkpc_t)
 
@@ -142,7 +142,7 @@ manage_files_pattern(lpd_t, print_spool_t, print_spool_t)
 files_search_spool(lpd_t)
 
 # lpd must be able to execute the filter utilities in /usr/share/printconf.
-allow lpd_t printconf_t:dir { getattr search read };
+allow lpd_t printconf_t:dir list_dir_perms;
 can_exec(lpd_t, printconf_t)
 
 # Create and bind to /dev/printer.
diff --git a/policy/modules/services/monop.te b/policy/modules/services/monop.te
index eb4880a..04b480f 100644
--- a/policy/modules/services/monop.te
+++ b/policy/modules/services/monop.te
@@ -29,7 +29,7 @@ allow monopd_t self:process signal_perms;
 allow monopd_t self:tcp_socket create_stream_socket_perms;
 allow monopd_t self:udp_socket create_socket_perms;
 
-allow monopd_t monopd_etc_t:file { getattr read };
+allow monopd_t monopd_etc_t:file read_file_perms;
 files_search_etc(monopd_t)
 
 allow monopd_t monopd_share_t:dir list_dir_perms;
diff --git a/policy/modules/services/mysql.if b/policy/modules/services/mysql.if
index ba21f5f..0115dbf 100644
--- a/policy/modules/services/mysql.if
+++ b/policy/modules/services/mysql.if
@@ -157,7 +157,7 @@ interface(`mysql_rw_db_sockets',`
 
 	files_search_var_lib($1)
 	allow $1 mysqld_db_t:dir search;
-	allow $1 mysqld_db_t:sock_file rw_file_perms;
+	allow $1 mysqld_db_t:sock_file rw_sock_file_perms;
 ')
 
 ########################################
diff --git a/policy/modules/services/mysql.te b/policy/modules/services/mysql.te
index 708735c..760dad2 100644
--- a/policy/modules/services/mysql.te
+++ b/policy/modules/services/mysql.te
@@ -33,7 +33,7 @@ files_tmp_file(mysqld_tmp_t)
 allow mysqld_t self:capability { dac_override setgid setuid sys_resource net_bind_service };
 dontaudit mysqld_t self:capability sys_tty_config;
 allow mysqld_t self:process { setsched getsched setrlimit signal_perms rlimitinh };
-allow mysqld_t self:fifo_file { read write };
+allow mysqld_t self:fifo_file rw_fifo_file_perms;
 allow mysqld_t self:unix_stream_socket create_stream_socket_perms;
 allow mysqld_t self:tcp_socket create_stream_socket_perms;
 allow mysqld_t self:udp_socket create_socket_perms;
@@ -43,7 +43,7 @@ manage_files_pattern(mysqld_t, mysqld_db_t, mysqld_db_t)
 manage_lnk_files_pattern(mysqld_t, mysqld_db_t, mysqld_db_t)
 files_var_lib_filetrans(mysqld_t, mysqld_db_t, { dir file })
 
-allow mysqld_t mysqld_etc_t:file { getattr read };
+allow mysqld_t mysqld_etc_t:file read_file_perms;
 allow mysqld_t mysqld_etc_t:lnk_file { getattr read };
 allow mysqld_t mysqld_etc_t:dir list_dir_perms;
 
diff --git a/policy/modules/services/nagios.te b/policy/modules/services/nagios.te
index 741b157..5a92af1 100644
--- a/policy/modules/services/nagios.te
+++ b/policy/modules/services/nagios.te
@@ -177,7 +177,7 @@ dontaudit nrpe_t self:capability sys_tty_config;
 allow nrpe_t self:process { setpgid signal_perms };
 allow nrpe_t self:fifo_file rw_fifo_file_perms;
 
-allow nrpe_t nrpe_etc_t:file { getattr read };
+allow nrpe_t nrpe_etc_t:file read_file_perms;
 files_search_etc(nrpe_t)
 
 kernel_read_system_state(nrpe_t)
diff --git a/policy/modules/services/nessus.te b/policy/modules/services/nessus.te
index eda0e12..af734bc 100644
--- a/policy/modules/services/nessus.te
+++ b/policy/modules/services/nessus.te
@@ -30,7 +30,7 @@ files_pid_file(nessusd_var_run_t)
 allow nessusd_t self:capability net_raw;
 dontaudit nessusd_t self:capability sys_tty_config;
 allow nessusd_t self:process { setsched signal_perms };
-allow nessusd_t self:fifo_file { getattr read write };
+allow nessusd_t self:fifo_file rw_fifo_file_perms;
 allow nessusd_t self:tcp_socket create_stream_socket_perms;
 allow nessusd_t self:udp_socket create_socket_perms;
 allow nessusd_t self:rawip_socket create_socket_perms;
@@ -42,7 +42,7 @@ manage_files_pattern(nessusd_t, nessusd_db_t, nessusd_db_t)
 manage_lnk_files_pattern(nessusd_t, nessusd_db_t, nessusd_db_t)
 files_list_var_lib(nessusd_t)
 
-allow nessusd_t nessusd_etc_t:file { getattr read };
+allow nessusd_t nessusd_etc_t:file read_file_perms;
 files_search_etc(nessusd_t)
 
 manage_files_pattern(nessusd_t, nessusd_log_t, nessusd_log_t)
diff --git a/policy/modules/services/nis.te b/policy/modules/services/nis.te
index 9cec5d3..bd0e701 100644
--- a/policy/modules/services/nis.te
+++ b/policy/modules/services/nis.te
@@ -224,7 +224,7 @@ allow ypserv_t self:udp_socket create_socket_perms;
 
 manage_files_pattern(ypserv_t,var_yp_t,var_yp_t)
 
-allow ypserv_t ypserv_conf_t:file { getattr read };
+allow ypserv_t ypserv_conf_t:file read_file_perms;
 
 manage_dirs_pattern(ypserv_t, ypserv_tmp_t, ypserv_tmp_t)
 manage_files_pattern(ypserv_t, ypserv_tmp_t, ypserv_tmp_t)
@@ -304,7 +304,7 @@ manage_files_pattern(ypxfr_t, var_yp_t, var_yp_t)
 allow ypxfr_t ypserv_t:tcp_socket { read write };
 allow ypxfr_t ypserv_t:udp_socket { read write };
 
-allow ypxfr_t ypserv_conf_t:file { getattr read };
+allow ypxfr_t ypserv_conf_t:file read_file_perms;
 
 corenet_all_recvfrom_unlabeled(ypxfr_t)
 corenet_all_recvfrom_netlabel(ypxfr_t)
diff --git a/policy/modules/services/nscd.te b/policy/modules/services/nscd.te
index 5e4eb69..e871857 100644
--- a/policy/modules/services/nscd.te
+++ b/policy/modules/services/nscd.te
@@ -31,7 +31,7 @@ logging_log_file(nscd_log_t)
 allow nscd_t self:capability { kill setgid setuid audit_write };
 dontaudit nscd_t self:capability sys_tty_config;
 allow nscd_t self:process { getattr setsched signal_perms };
-allow nscd_t self:fifo_file { read write };
+allow nscd_t self:fifo_file read_fifo_file_perms;
 allow nscd_t self:unix_stream_socket create_stream_socket_perms;
 allow nscd_t self:unix_dgram_socket create_socket_perms;
 allow nscd_t self:netlink_selinux_socket create_socket_perms;
diff --git a/policy/modules/services/nsd.te b/policy/modules/services/nsd.te
index 22611c0..7cd87e5 100644
--- a/policy/modules/services/nsd.te
+++ b/policy/modules/services/nsd.te
@@ -124,7 +124,7 @@ allow nsd_crond_t self:fifo_file rw_fifo_file_perms;
 allow nsd_crond_t self:tcp_socket create_socket_perms;
 allow nsd_crond_t self:udp_socket create_socket_perms;
 
-allow nsd_crond_t nsd_conf_t:file { getattr read ioctl };
+allow nsd_crond_t nsd_conf_t:file read_file_perms;
 
 allow nsd_crond_t nsd_db_t:file manage_file_perms;
 filetrans_pattern(nsd_crond_t, nsd_zone_t, nsd_db_t, file)
diff --git a/policy/modules/services/ntop.te b/policy/modules/services/ntop.te
index 54a2c5f..fd48217 100644
--- a/policy/modules/services/ntop.te
+++ b/policy/modules/services/ntop.te
@@ -34,7 +34,7 @@ files_pid_file(ntop_var_run_t)
 allow ntop_t self:capability { net_raw setgid setuid sys_admin net_admin };
 dontaudit ntop_t self:capability sys_tty_config;
 allow ntop_t self:process signal_perms;
-allow ntop_t self:fifo_file { read write };
+allow ntop_t self:fifo_file rw_fifo_file_perms;
 allow ntop_t self:tcp_socket create_stream_socket_perms;
 allow ntop_t self:udp_socket create_socket_perms;
 allow ntop_t self:packet_socket create_socket_perms;
diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
index 53a8150..19005e3 100644
--- a/policy/modules/services/ntp.te
+++ b/policy/modules/services/ntp.te
@@ -41,7 +41,7 @@ init_system_domain(ntpd_t, ntpdate_exec_t)
 allow ntpd_t self:capability { chown dac_override kill setgid setuid sys_time ipc_lock sys_chroot sys_nice sys_resource };
 dontaudit ntpd_t self:capability { net_admin sys_tty_config fsetid sys_nice };
 allow ntpd_t self:process { signal_perms getcap setcap setsched setrlimit };
-allow ntpd_t self:fifo_file { read write getattr };
+allow ntpd_t self:fifo_file rw_fifo_file_perms;
 allow ntpd_t self:unix_dgram_socket create_socket_perms;
 allow ntpd_t self:unix_stream_socket create_socket_perms;
 allow ntpd_t self:tcp_socket create_stream_socket_perms;
diff --git a/policy/modules/services/nx.te b/policy/modules/services/nx.te
index eef573e..16d321d 100644
--- a/policy/modules/services/nx.te
+++ b/policy/modules/services/nx.te
@@ -30,7 +30,7 @@ files_pid_file(nx_server_var_run_t)
 # NX server local policy
 #
 
-allow nx_server_t self:fifo_file { getattr ioctl read write };
+allow nx_server_t self:fifo_file rw_fifo_file_perms;
 allow nx_server_t self:tcp_socket create_socket_perms;
 allow nx_server_t self:udp_socket create_socket_perms;
 
diff --git a/policy/modules/services/oav.te b/policy/modules/services/oav.te
index 9800dde..fc63af2 100644
--- a/policy/modules/services/oav.te
+++ b/policy/modules/services/oav.te
@@ -82,7 +82,7 @@ optional_policy(`
 
 dontaudit scannerdaemon_t self:capability sys_tty_config;
 allow scannerdaemon_t self:process signal_perms;
-allow scannerdaemon_t self:fifo_file { read write };
+allow scannerdaemon_t self:fifo_file rw_fifo_file_perms;
 allow scannerdaemon_t self:tcp_socket create_stream_socket_perms;
 allow scannerdaemon_t self:udp_socket create_socket_perms;
 
diff --git a/policy/modules/services/oddjob.te b/policy/modules/services/oddjob.te
index 0a38d3a..051098c 100644
--- a/policy/modules/services/oddjob.te
+++ b/policy/modules/services/oddjob.te
@@ -29,7 +29,7 @@ files_pid_file(oddjob_var_run_t)
 
 allow oddjob_t self:capability setgid;
 allow oddjob_t self:process { setexec signal };
-allow oddjob_t self:fifo_file { read write };
+allow oddjob_t self:fifo_file rw_fifo_file_perms;
 allow oddjob_t self:unix_stream_socket create_stream_socket_perms;
 
 manage_files_pattern(oddjob_t, oddjob_var_run_t, oddjob_var_run_t)
@@ -68,7 +68,7 @@ optional_policy(`
 # oddjob_mkhomedir local policy
 #
 
-allow oddjob_mkhomedir_t self:fifo_file { read write };
+allow oddjob_mkhomedir_t self:fifo_file rw_fifo_file_perms;
 allow oddjob_mkhomedir_t self:unix_stream_socket create_stream_socket_perms;
 
 files_read_etc_files(oddjob_mkhomedir_t)
diff --git a/policy/modules/services/pcscd.te b/policy/modules/services/pcscd.te
index a90f603..b3e9931 100644
--- a/policy/modules/services/pcscd.te
+++ b/policy/modules/services/pcscd.te
@@ -22,7 +22,7 @@ files_pid_file(pcscd_var_run_t)
 
 allow pcscd_t self:capability { dac_override dac_read_search };
 allow pcscd_t self:process signal;
-allow pcscd_t self:fifo_file { read write };
+allow pcscd_t self:fifo_file rw_fifo_file_perms;
 allow pcscd_t self:unix_stream_socket create_stream_socket_perms;
 allow pcscd_t self:unix_dgram_socket create_socket_perms;
 allow pcscd_t self:tcp_socket create_stream_socket_perms;
diff --git a/policy/modules/services/perdition.te b/policy/modules/services/perdition.te
index b221e6b..e7c6650 100644
--- a/policy/modules/services/perdition.te
+++ b/policy/modules/services/perdition.te
@@ -27,7 +27,7 @@ allow perdition_t self:process signal_perms;
 allow perdition_t self:tcp_socket create_stream_socket_perms;
 allow perdition_t self:udp_socket create_socket_perms;
 
-allow perdition_t perdition_etc_t:file { getattr read };
+allow perdition_t perdition_etc_t:file read_file_perms;
 files_search_etc(perdition_t)
 
 manage_files_pattern(perdition_t, perdition_var_run_t, perdition_var_run_t)
diff --git a/policy/modules/services/postfix.te b/policy/modules/services/postfix.te
index 3f2cb82..ad008aa 100644
--- a/policy/modules/services/postfix.te
+++ b/policy/modules/services/postfix.te
@@ -474,8 +474,8 @@ manage_dirs_pattern(postfix_qmgr_t, postfix_spool_t, postfix_spool_t)
 manage_files_pattern(postfix_qmgr_t, postfix_spool_t, postfix_spool_t)
 manage_lnk_files_pattern(postfix_qmgr_t, postfix_spool_t, postfix_spool_t)
 
-allow postfix_qmgr_t postfix_spool_bounce_t:dir { getattr read search };
-allow postfix_qmgr_t postfix_spool_bounce_t:file { read getattr };
+allow postfix_qmgr_t postfix_spool_bounce_t:dir list_dir_perms;
+allow postfix_qmgr_t postfix_spool_bounce_t:file read_file_perms;
 allow postfix_qmgr_t postfix_spool_bounce_t:lnk_file { getattr read };
 
 corecmd_exec_bin(postfix_qmgr_t)
@@ -494,8 +494,8 @@ allow postfix_showq_t postfix_spool_t:file read_file_perms;
 
 postfix_list_spool(postfix_showq_t)
 
-allow postfix_showq_t postfix_spool_maildrop_t:dir { getattr read search };
-allow postfix_showq_t postfix_spool_maildrop_t:file { read getattr };
+allow postfix_showq_t postfix_spool_maildrop_t:dir list_dir_perms;
+allow postfix_showq_t postfix_spool_maildrop_t:file read_file_perms;
 allow postfix_showq_t postfix_spool_maildrop_t:lnk_file { getattr read };
 
 # to write the mailq output, it really should not need read access!
diff --git a/policy/modules/services/postgresql.te b/policy/modules/services/postgresql.te
index 36ac371..060a601 100644
--- a/policy/modules/services/postgresql.te
+++ b/policy/modules/services/postgresql.te
@@ -103,8 +103,7 @@ role system_r types sepgsql_trusted_proc_t;
 allow postgresql_t self:capability { kill dac_override dac_read_search chown fowner fsetid setuid setgid sys_nice sys_tty_config sys_admin };
 dontaudit postgresql_t self:capability { sys_tty_config sys_admin };
 allow postgresql_t self:process signal_perms;
-allow postgresql_t self:fifo_file { getattr read write ioctl };
-allow postgresql_t self:file { getattr read };
+allow postgresql_t self:fifo_file rw_fifo_file_perms;
 allow postgresql_t self:sem create_sem_perms;
 allow postgresql_t self:shm create_shm_perms;
 allow postgresql_t self:tcp_socket create_stream_socket_perms;
diff --git a/policy/modules/services/ppp.te b/policy/modules/services/ppp.te
index 269950e..229a6fe 100644
--- a/policy/modules/services/ppp.te
+++ b/policy/modules/services/ppp.te
@@ -223,23 +223,23 @@ optional_policy(`
 allow pptp_t self:capability net_raw;
 dontaudit pptp_t self:capability sys_tty_config;
 allow pptp_t self:process signal;
-allow pptp_t self:fifo_file { read write };
+allow pptp_t self:fifo_file rw_fifo_file_perms;
 allow pptp_t self:unix_dgram_socket create_socket_perms;
 allow pptp_t self:unix_stream_socket { connectto create_stream_socket_perms };
 allow pptp_t self:rawip_socket create_socket_perms;
 allow pptp_t self:tcp_socket create_socket_perms;
 
-allow pptp_t pppd_etc_t:dir { getattr read search };
-allow pptp_t pppd_etc_t:file { read getattr };
+allow pptp_t pppd_etc_t:dir list_dir_perms;
+allow pptp_t pppd_etc_t:file read_file_perms;
 allow pptp_t pppd_etc_t:lnk_file { getattr read };
 
-allow pptp_t pppd_etc_rw_t:dir { getattr read search };
-allow pptp_t pppd_etc_rw_t:file { read getattr };
+allow pptp_t pppd_etc_rw_t:dir list_dir_perms;
+allow pptp_t pppd_etc_rw_t:file read_file_perms;
 allow pptp_t pppd_etc_rw_t:lnk_file { getattr read };
 can_exec(pptp_t, pppd_etc_rw_t)
 
 # Allow pptp to append to pppd log files
-allow pptp_t pppd_log_t:file append;
+allow pptp_t pppd_log_t:file append_file_perms;
 
 allow pptp_t pptp_log_t:file manage_file_perms;
 logging_log_filetrans(pptp_t, pptp_log_t, file)
diff --git a/policy/modules/services/qmail.te b/policy/modules/services/qmail.te
index 8ad47da..8ff937b 100644
--- a/policy/modules/services/qmail.te
+++ b/policy/modules/services/qmail.te
@@ -73,10 +73,10 @@ delete_files_pattern(qmail_clean_t, qmail_spool_t, qmail_spool_t)
 #   this component preprocesses mail from stdin and invokes qmail-queue
 #
 
-allow qmail_inject_t self:fifo_file write;
+allow qmail_inject_t self:fifo_file write_fifo_file_perms;
 allow qmail_inject_t self:process signal_perms;
 
-allow qmail_inject_t qmail_queue_exec_t:file read;
+allow qmail_inject_t qmail_queue_exec_t:file read_file_perms;
 
 corecmd_search_bin(qmail_inject_t)
 
@@ -95,7 +95,7 @@ qmail_read_config(qmail_inject_t)
 #   this component delivers a mail message
 #
 
-allow qmail_local_t self:fifo_file write;
+allow qmail_local_t self:fifo_file write_file_perms;
 allow qmail_local_t self:process signal_perms;
 allow qmail_local_t self:unix_stream_socket create_stream_socket_perms;
 
@@ -104,7 +104,7 @@ manage_files_pattern(qmail_local_t, qmail_alias_home_t, qmail_alias_home_t)
 
 can_exec(qmail_local_t, qmail_local_exec_t)
 
-allow qmail_local_t qmail_queue_exec_t:file read;
+allow qmail_local_t qmail_queue_exec_t:file read_file_perms;
 
 allow qmail_local_t qmail_spool_t:file read_file_perms;
 
@@ -132,12 +132,12 @@ qmail_domtrans_queue(qmail_local_t)
 
 allow qmail_lspawn_t self:capability { setuid setgid };
 allow qmail_lspawn_t self:process signal_perms;
-allow qmail_lspawn_t self:fifo_file { read write };
+allow qmail_lspawn_t self:fifo_file rw_fifo_file_perms;
 allow qmail_lspawn_t self:unix_stream_socket create_socket_perms;
 
 can_exec(qmail_lspawn_t, qmail_exec_t)
 
-allow qmail_lspawn_t qmail_local_exec_t:file read;
+allow qmail_lspawn_t qmail_local_exec_t:file read_file_perms;
 
 read_files_pattern(qmail_lspawn_t, qmail_spool_t, qmail_spool_t)
 
@@ -154,10 +154,10 @@ files_search_tmp(qmail_lspawn_t)
 #
 
 allow qmail_queue_t qmail_lspawn_t:fd use;
-allow qmail_queue_t qmail_lspawn_t:fifo_file write;
+allow qmail_queue_t qmail_lspawn_t:fifo_file write_fifo_file_perms;
 
 allow qmail_queue_t qmail_smtpd_t:fd use;
-allow qmail_queue_t qmail_smtpd_t:fifo_file read;
+allow qmail_queue_t qmail_smtpd_t:fifo_file read_fifo_file_perms;
 allow qmail_queue_t qmail_smtpd_t:process sigchld;
 
 manage_dirs_pattern(qmail_queue_t, qmail_spool_t, qmail_spool_t)
@@ -206,9 +206,9 @@ sysnet_read_config(qmail_remote_t)
 #
 
 allow qmail_rspawn_t self:process signal_perms;
-allow qmail_rspawn_t self:fifo_file read;
+allow qmail_rspawn_t self:fifo_file read_fifo_file_perms;
 
-allow qmail_rspawn_t qmail_remote_exec_t:file read;
+allow qmail_rspawn_t qmail_remote_exec_t:file read_file_perms;
 
 rw_files_pattern(qmail_rspawn_t, qmail_spool_t, qmail_spool_t)
 
@@ -221,7 +221,7 @@ corecmd_search_bin(qmail_rspawn_t)
 #
 
 allow qmail_send_t self:process signal_perms;
-allow qmail_send_t self:fifo_file write;
+allow qmail_send_t self:fifo_file write_fifo_file_perms;
 
 manage_dirs_pattern(qmail_send_t, qmail_spool_t, qmail_spool_t)
 manage_files_pattern(qmail_send_t, qmail_spool_t, qmail_spool_t)
@@ -240,10 +240,10 @@ optional_policy(`
 #
 
 allow qmail_smtpd_t self:process signal_perms;
-allow qmail_smtpd_t self:fifo_file write;
+allow qmail_smtpd_t self:fifo_file write_fifo_file_perms;
 allow qmail_smtpd_t self:tcp_socket create_socket_perms;
 
-allow qmail_smtpd_t qmail_queue_exec_t:file read;
+allow qmail_smtpd_t qmail_queue_exec_t:file read_file_perms;
 
 dev_read_rand(qmail_smtpd_t)
 dev_read_urand(qmail_smtpd_t)
@@ -280,7 +280,7 @@ miscfiles_read_localization(qmail_splogger_t)
 
 allow qmail_start_t self:capability { setgid setuid };
 dontaudit qmail_start_t self:capability sys_tty_config;
-allow qmail_start_t self:fifo_file { getattr read write };
+allow qmail_start_t self:fifo_file rw_fifo_file_perms;
 allow qmail_start_t self:process signal_perms;
 
 can_exec(qmail_start_t, qmail_start_exec_t)
@@ -305,7 +305,7 @@ optional_policy(`
 #   this component sets up TCP-related environment variables
 #
 
-allow qmail_tcp_env_t qmail_smtpd_exec_t:file read;
+allow qmail_tcp_env_t qmail_smtpd_exec_t:file read_file_perms;
 
 corecmd_search_bin(qmail_tcp_env_t)
 
diff --git a/policy/modules/services/resmgr.te b/policy/modules/services/resmgr.te
index 70c426f..167918d 100644
--- a/policy/modules/services/resmgr.te
+++ b/policy/modules/services/resmgr.te
@@ -25,7 +25,7 @@ allow resmgrd_t self:capability { dac_override sys_admin sys_rawio };
 dontaudit resmgrd_t self:capability sys_tty_config;
 allow resmgrd_t self:process signal_perms;
 
-allow resmgrd_t resmgrd_etc_t:file { getattr read };
+allow resmgrd_t resmgrd_etc_t:file read_file_perms;
 files_search_etc(resmgrd_t)
 
 allow resmgrd_t resmgrd_var_run_t:file manage_file_perms;
diff --git a/policy/modules/services/ricci.te b/policy/modules/services/ricci.te
index 5cd7567..78fe27b 100644
--- a/policy/modules/services/ricci.te
+++ b/policy/modules/services/ricci.te
@@ -84,7 +84,7 @@ files_lock_file(ricci_modstorage_lock_t)
 
 allow ricci_t self:capability { setuid sys_nice sys_boot };
 allow ricci_t self:process setsched;
-allow ricci_t self:fifo_file { read write };
+allow ricci_t self:fifo_file rw_fifo_file_perms;
 allow ricci_t self:unix_stream_socket { create_stream_socket_perms connectto };
 allow ricci_t self:tcp_socket create_stream_socket_perms;
 
@@ -362,7 +362,7 @@ optional_policy(`
 # ricci_modrpm local policy
 #
 
-allow ricci_modrpm_t self:fifo_file { getattr read };
+allow ricci_modrpm_t self:fifo_file read_fifo_file_perms;
 
 kernel_read_kernel_sysctls(ricci_modrpm_t)
 
@@ -390,7 +390,7 @@ optional_policy(`
 #
 
 allow ricci_modservice_t self:capability { dac_override sys_nice };
-allow ricci_modservice_t self:fifo_file { getattr read write };
+allow ricci_modservice_t self:fifo_file rw_fifo_file_perms;
 allow ricci_modservice_t self:process setsched;
 
 kernel_read_kernel_sysctls(ricci_modservice_t)
diff --git a/policy/modules/services/rpc.te b/policy/modules/services/rpc.te
index f0403ed..55995a5 100644
--- a/policy/modules/services/rpc.te
+++ b/policy/modules/services/rpc.te
@@ -95,7 +95,7 @@ optional_policy(`
 
 allow nfsd_t self:capability { dac_override dac_read_search sys_admin sys_resource };
 
-allow nfsd_t exports_t:file { getattr read };
+allow nfsd_t exports_t:file read_file_perms;
 allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir list_dir_perms;
 
 # for /proc/fs/nfs/exports - should we have a new type?
diff --git a/policy/modules/services/samba.te b/policy/modules/services/samba.te
index 14e1c8c..c7d47a5 100644
--- a/policy/modules/services/samba.te
+++ b/policy/modules/services/samba.te
@@ -220,7 +220,7 @@ allow smbd_t self:msg { send receive };
 allow smbd_t self:msgq create_msgq_perms;
 allow smbd_t self:sem create_sem_perms;
 allow smbd_t self:shm create_shm_perms;
-allow smbd_t self:sock_file read_file_perms;
+allow smbd_t self:sock_file read_sock_file_perms;
 allow smbd_t self:tcp_socket create_stream_socket_perms;
 allow smbd_t self:udp_socket create_socket_perms;
 allow smbd_t self:unix_dgram_socket { create_socket_perms sendto };
@@ -405,7 +405,7 @@ allow nmbd_t self:msg { send receive };
 allow nmbd_t self:msgq create_msgq_perms;
 allow nmbd_t self:sem create_sem_perms;
 allow nmbd_t self:shm create_shm_perms;
-allow nmbd_t self:sock_file read_file_perms;
+allow nmbd_t self:sock_file read_sock_file_perms;
 allow nmbd_t self:tcp_socket create_stream_socket_perms;
 allow nmbd_t self:udp_socket create_socket_perms;
 allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto };
@@ -572,17 +572,17 @@ allow swat_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
 allow swat_t self:tcp_socket create_stream_socket_perms;
 allow swat_t self:udp_socket create_socket_perms;
 
-allow swat_t nmbd_exec_t:file { execute read };
+allow swat_t nmbd_exec_t:file mmap_file_perms;
 
 rw_files_pattern(swat_t, samba_etc_t, samba_etc_t)
 
 append_files_pattern(swat_t, samba_log_t, samba_log_t)
 
-allow swat_t smbd_exec_t:file execute ;
+allow swat_t smbd_exec_t:file mmap_file_perms ;
 
 allow swat_t smbd_t:process signull;
 
-allow swat_t smbd_var_run_t:file read;
+allow swat_t smbd_var_run_t:file read_file_perms;
 
 manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t)
 manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t)
@@ -591,7 +591,7 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir })
 manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t)
 files_pid_filetrans(swat_t, swat_var_run_t, file)
 
-allow swat_t winbind_exec_t:file execute;
+allow swat_t winbind_exec_t:file mmap_file_perms;
 
 kernel_read_kernel_sysctls(swat_t)
 kernel_read_system_state(swat_t)
@@ -654,7 +654,7 @@ optional_policy(`
 allow winbind_t self:capability { dac_override ipc_lock setuid };
 dontaudit winbind_t self:capability sys_tty_config;
 allow winbind_t self:process signal_perms;
-allow winbind_t self:fifo_file { read write };
+allow winbind_t self:fifo_file rw_fifo_file_perms;
 allow winbind_t self:unix_dgram_socket create_socket_perms;
 allow winbind_t self:unix_stream_socket create_stream_socket_perms;
 allow winbind_t self:tcp_socket create_stream_socket_perms;
@@ -761,7 +761,7 @@ allow winbind_helper_t samba_etc_t:dir list_dir_perms;
 read_files_pattern(winbind_helper_t, samba_etc_t, samba_etc_t)
 read_lnk_files_pattern(winbind_helper_t, samba_etc_t, samba_etc_t)
 
-allow winbind_helper_t samba_var_t:dir search;
+allow winbind_helper_t samba_var_t:dir search_dir_perms;
 files_list_var_lib(winbind_helper_t)
 
 stream_connect_pattern(winbind_helper_t, winbind_var_run_t, winbind_var_run_t, winbind_t)
diff --git a/policy/modules/services/sasl.te b/policy/modules/services/sasl.te
index df51a47..bc0c13a 100644
--- a/policy/modules/services/sasl.te
+++ b/policy/modules/services/sasl.te
@@ -34,7 +34,7 @@ files_pid_file(saslauthd_var_run_t)
 allow saslauthd_t self:capability setuid;
 dontaudit saslauthd_t self:capability sys_tty_config;
 allow saslauthd_t self:process signal_perms;
-allow saslauthd_t self:fifo_file { read write };
+allow saslauthd_t self:fifo_file rw_fifo_file_perms;
 allow saslauthd_t self:unix_dgram_socket create_socket_perms;
 allow saslauthd_t self:unix_stream_socket create_stream_socket_perms;
 allow saslauthd_t self:tcp_socket create_socket_perms;
diff --git a/policy/modules/services/spamassassin.if b/policy/modules/services/spamassassin.if
index 715eba1..f583eb2 100644
--- a/policy/modules/services/spamassassin.if
+++ b/policy/modules/services/spamassassin.if
@@ -88,8 +88,7 @@ template(`spamassassin_per_role_template',`
 	files_tmp_filetrans($1_spamc_t, $1_spamc_tmp_t, { file dir })
 
 	# Allow connecting to a local spamd
-	allow $1_spamc_t spamd_t:unix_stream_socket connectto;
-	allow $1_spamc_t spamd_tmp_t:sock_file rw_file_perms;
+	stream_connect_pattern($1_spamc_t, spamd_tmp_t, spamd_tmp_t, spamd_t)
 
 	domtrans_pattern($2, spamc_exec_t, $1_spamc_t)
 
diff --git a/policy/modules/services/stunnel.te b/policy/modules/services/stunnel.te
index bf4e7a2..e433bbb 100644
--- a/policy/modules/services/stunnel.te
+++ b/policy/modules/services/stunnel.te
@@ -39,8 +39,8 @@ allow stunnel_t self:fifo_file rw_fifo_file_perms;
 allow stunnel_t self:tcp_socket create_stream_socket_perms;
 allow stunnel_t self:udp_socket create_socket_perms;
 
-allow stunnel_t stunnel_etc_t:dir { getattr read search };
-allow stunnel_t stunnel_etc_t:file { read getattr };
+allow stunnel_t stunnel_etc_t:dir list_dir_perms;
+allow stunnel_t stunnel_etc_t:file read_file_perms;
 allow stunnel_t stunnel_etc_t:lnk_file { getattr read };
 
 manage_dirs_pattern(stunnel_t, stunnel_tmp_t, stunnel_tmp_t)
diff --git a/policy/modules/services/tftp.te b/policy/modules/services/tftp.te
index 68ef3f9..0635932 100644
--- a/policy/modules/services/tftp.te
+++ b/policy/modules/services/tftp.te
@@ -39,8 +39,8 @@ allow tftpd_t self:unix_dgram_socket create_socket_perms;
 allow tftpd_t self:unix_stream_socket create_stream_socket_perms;
 dontaudit tftpd_t self:capability sys_tty_config;
 
-allow tftpd_t tftpdir_t:dir { getattr read search };
-allow tftpd_t tftpdir_t:file { read getattr };
+allow tftpd_t tftpdir_t:dir list_dir_perms;
+allow tftpd_t tftpdir_t:file read_file_perms;
 allow tftpd_t tftpdir_t:lnk_file { getattr read };
 
 manage_dirs_pattern(tftpd_t, tftpdir_rw_t, tftpdir_rw_t)
diff --git a/policy/modules/services/tor.te b/policy/modules/services/tor.te
index d937480..51e0500 100644
--- a/policy/modules/services/tor.te
+++ b/policy/modules/services/tor.te
@@ -35,7 +35,7 @@ files_pid_file(tor_var_run_t)
 #
 
 allow tor_t self:capability { setgid setuid };
-allow tor_t self:fifo_file { read write };
+allow tor_t self:fifo_file rw_fifo_file_perms;
 allow tor_t self:unix_stream_socket create_stream_socket_perms;
 allow tor_t self:netlink_route_socket r_netlink_socket_perms;
 allow tor_t self:tcp_socket create_stream_socket_perms;
diff --git a/policy/modules/services/ucspitcp.te b/policy/modules/services/ucspitcp.te
index 0077c4c..8afcd4c 100644
--- a/policy/modules/services/ucspitcp.te
+++ b/policy/modules/services/ucspitcp.te
@@ -52,7 +52,7 @@ optional_policy(`
 #
 
 allow ucspitcp_t self:capability { setgid setuid };
-allow ucspitcp_t self:fifo_file { read write };
+allow ucspitcp_t self:fifo_file rw_fifo_file_perms;
 allow ucspitcp_t self:tcp_socket create_stream_socket_perms;
 allow ucspitcp_t self:udp_socket create_socket_perms;
 
diff --git a/policy/modules/services/uptime.te b/policy/modules/services/uptime.te
index 4840ab3..8932b66 100644
--- a/policy/modules/services/uptime.te
+++ b/policy/modules/services/uptime.te
@@ -26,9 +26,9 @@ files_pid_file(uptimed_var_run_t)
 
 dontaudit uptimed_t self:capability sys_tty_config;
 allow uptimed_t self:process signal_perms;
-allow uptimed_t self:fifo_file { getattr write };
+allow uptimed_t self:fifo_file write_file_perms;
 
-allow uptimed_t uptimed_etc_t:file { getattr read };
+allow uptimed_t uptimed_etc_t:file read_file_perms;
 files_search_etc(uptimed_t)
 
 allow uptimed_t uptimed_spool_t:file manage_file_perms;
diff --git a/policy/modules/services/uucp.te b/policy/modules/services/uucp.te
index 0c0353a..b7f8f7a 100644
--- a/policy/modules/services/uucp.te
+++ b/policy/modules/services/uucp.te
@@ -107,7 +107,7 @@ optional_policy(`
 #
 
 allow uux_t self:capability { setuid setgid };
-allow uux_t self:fifo_file { getattr write };
+allow uux_t self:fifo_file write_file_perms;
 
 uucp_append_log(uux_t)
 uucp_manage_spool(uux_t)
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index a46e866..ce109e9 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -427,7 +427,7 @@ allow xdm_xserver_t xdm_t:shm rw_shm_perms;
 allow xdm_xserver_t xdm_var_lib_t:file { getattr read };
 dontaudit xdm_xserver_t xdm_var_lib_t:dir search;
 
-allow xdm_xserver_t xdm_var_run_t:file { getattr read };
+allow xdm_xserver_t xdm_var_run_t:file read_file_perms;
 
 # Label pid and temporary files with derived types.
 manage_files_pattern(xdm_xserver_t, xdm_tmp_t, xdm_tmp_t)
diff --git a/policy/modules/services/zebra.te b/policy/modules/services/zebra.te
index 3fcae71..1000a57 100644
--- a/policy/modules/services/zebra.te
+++ b/policy/modules/services/zebra.te
@@ -41,7 +41,7 @@ files_pid_file(zebra_var_run_t)
 allow zebra_t self:capability { setgid setuid net_admin net_raw };
 dontaudit zebra_t self:capability sys_tty_config;
 allow zebra_t self:process { signal_perms getcap setcap };
-allow zebra_t self:file { ioctl read write getattr lock append };
+allow zebra_t self:file rw_file_perms;
 allow zebra_t self:unix_dgram_socket create_socket_perms;
 allow zebra_t self:unix_stream_socket { connectto create_stream_socket_perms };
 allow zebra_t self:netlink_route_socket rw_netlink_socket_perms;
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
index 4b47e52..7b170e5 100644
--- a/policy/modules/system/authlogin.if
+++ b/policy/modules/system/authlogin.if
@@ -871,7 +871,7 @@ interface(`auth_manage_var_auth',`
 	files_search_var($1)
 	allow $1 var_auth_t:dir manage_dir_perms;
 	allow $1 var_auth_t:file rw_file_perms;
-	allow $1 var_auth_t:lnk_file rw_file_perms;
+	allow $1 var_auth_t:lnk_file rw_lnk_file_perms;
 ')
 
 ########################################
diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
index b62d578..7246fd8 100644
--- a/policy/modules/system/authlogin.te
+++ b/policy/modules/system/authlogin.te
@@ -263,7 +263,7 @@ optional_policy(`
 # System check password local policy
 #
 
-allow system_chkpwd_t shadow_t:file { getattr read };
+allow system_chkpwd_t shadow_t:file read_file_perms;
 
 corecmd_search_bin(system_chkpwd_t)
 
@@ -289,7 +289,7 @@ ifdef(`distro_ubuntu',`
 #
 
 allow updpwd_t self:process setfscreate;
-allow updpwd_t self:fifo_file { read write };
+allow updpwd_t self:fifo_file rw_fifo_file_perms;
 allow updpwd_t self:unix_stream_socket create_stream_socket_perms;
 allow updpwd_t self:unix_dgram_socket create_socket_perms;
 
diff --git a/policy/modules/system/clock.te b/policy/modules/system/clock.te
index f6d05df..469f749 100644
--- a/policy/modules/system/clock.te
+++ b/policy/modules/system/clock.te
@@ -24,7 +24,7 @@ role system_r types hwclock_t;
 allow hwclock_t self:capability { dac_override sys_rawio sys_time sys_tty_config };
 dontaudit hwclock_t self:capability sys_tty_config;
 allow hwclock_t self:process signal_perms;
-allow hwclock_t self:fifo_file { getattr read write };
+allow hwclock_t self:fifo_file rw_fifo_file_perms;
 
 # Allow hwclock to store & retrieve correction factors.
 allow hwclock_t adjtime_t:file { rw_file_perms setattr };
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index a7db5fe..302cc9c 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -774,7 +774,7 @@ interface(`init_read_state',`
 
 	allow $1 init_t:dir search_dir_perms;
 	allow $1 init_t:file read_file_perms;
-	allow $1 init_t:lnk_file read_file_perms;
+	allow $1 init_t:lnk_file read_lnk_file_perms;
 ')
 
 ########################################
diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te
index 1381dd5..b1c3e74 100644
--- a/policy/modules/system/ipsec.te
+++ b/policy/modules/system/ipsec.te
@@ -59,7 +59,7 @@ allow ipsec_t self:process signal;
 allow ipsec_t self:netlink_route_socket r_netlink_socket_perms;
 allow ipsec_t self:tcp_socket create_stream_socket_perms;
 allow ipsec_t self:key_socket { create write read setopt };
-allow ipsec_t self:fifo_file { read getattr };
+allow ipsec_t self:fifo_file read_file_perms;
 
 allow ipsec_t ipsec_conf_file_t:dir list_dir_perms;
 read_files_pattern(ipsec_t,ipsec_conf_file_t,ipsec_conf_file_t)
@@ -186,7 +186,7 @@ read_lnk_files_pattern(ipsec_mgmt_t,ipsec_t,ipsec_t)
 allow ipsec_mgmt_t self:unix_dgram_socket { create connect write };
 allow ipsec_mgmt_t ipsec_t:unix_dgram_socket { create connect write };
 
-allow ipsec_mgmt_t ipsec_conf_file_t:file { getattr read ioctl };
+allow ipsec_mgmt_t ipsec_conf_file_t:file read_file_perms;
 
 manage_files_pattern(ipsec_mgmt_t,ipsec_key_file_t,ipsec_key_file_t)
 manage_lnk_files_pattern(ipsec_mgmt_t,ipsec_key_file_t,ipsec_key_file_t)
diff --git a/policy/modules/system/iscsi.te b/policy/modules/system/iscsi.te
index deccf56..c8492b7 100644
--- a/policy/modules/system/iscsi.te
+++ b/policy/modules/system/iscsi.te
@@ -30,7 +30,7 @@ files_pid_file(iscsi_var_run_t)
 
 allow iscsid_t self:capability { dac_override ipc_lock net_admin sys_nice sys_resource };
 allow iscsid_t self:process { setrlimit setsched signal };
-allow iscsid_t self:fifo_file { read write };
+allow iscsid_t self:fifo_file rw_fifo_file_perms;
 allow iscsid_t self:unix_stream_socket { create_stream_socket_perms connectto };
 allow iscsid_t self:unix_dgram_socket create_socket_perms;
 allow iscsid_t self:sem create_sem_perms;
diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index 86b1851..4855a56 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -451,7 +451,7 @@ interface(`logging_send_syslog_msg',`
 	')
 
 	allow $1 devlog_t:lnk_file read;
-	allow $1 devlog_t:sock_file rw_file_perms;
+	allow $1 devlog_t:sock_file rw_sock_file_perms;
 
 	# the type of socket depends on the syslog daemon
 	allow $1 syslogd_t:unix_dgram_socket sendto;
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index d7c7dcf..072759f 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -127,7 +127,7 @@ logging_send_syslog_msg(auditctl_t)
 allow auditd_t self:capability { chown fsetid sys_nice sys_resource };
 dontaudit auditd_t self:capability sys_tty_config;
 allow auditd_t self:process { signal_perms setpgid setsched };
-allow auditd_t self:file { getattr read write };
+allow auditd_t self:file rw_file_perms;
 allow auditd_t self:unix_dgram_socket create_socket_perms;
 allow auditd_t self:fifo_file rw_file_perms;
 allow auditd_t self:tcp_socket create_stream_socket_perms;
@@ -227,7 +227,7 @@ allow audisp_t self:fifo_file rw_file_perms;
 allow audisp_t self:unix_stream_socket create_stream_socket_perms;
 allow audisp_t self:unix_dgram_socket create_socket_perms;
 
-allow audisp_t auditd_t:unix_stream_socket rw_file_perms;
+allow audisp_t auditd_t:unix_stream_socket rw_socket_perms;
 
 manage_sock_files_pattern(audisp_t, audisp_var_run_t, audisp_var_run_t)
 files_pid_filetrans(audisp_t, audisp_var_run_t, sock_file)
diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
index 16bf947..aeb194b 100644
--- a/policy/modules/system/selinuxutil.te
+++ b/policy/modules/system/selinuxutil.te
@@ -440,7 +440,7 @@ allow semanage_t self:unix_stream_socket create_stream_socket_perms;
 allow semanage_t self:unix_dgram_socket create_socket_perms;
 allow semanage_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
 
-allow semanage_t policy_config_t:file { read write };
+allow semanage_t policy_config_t:file rw_file_perms;
 
 allow semanage_t semanage_tmp_t:dir manage_dir_perms;
 allow semanage_t semanage_tmp_t:file manage_file_perms;
diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
index 34d03d9..15ad57c 100644
--- a/policy/modules/system/sysnetwork.te
+++ b/policy/modules/system/sysnetwork.te
@@ -56,7 +56,6 @@ allow dhcpc_t dhcp_etc_t:dir list_dir_perms;
 read_lnk_files_pattern(dhcpc_t,dhcp_etc_t,dhcp_etc_t)
 exec_files_pattern(dhcpc_t,dhcp_etc_t,dhcp_etc_t)
 
-allow dhcpc_t dhcp_state_t:file { getattr read };
 manage_files_pattern(dhcpc_t,dhcpc_state_t,dhcpc_state_t)
 filetrans_pattern(dhcpc_t,dhcp_state_t,dhcpc_state_t,file)
 
diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index f88cf17..9c832b6 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -45,7 +45,7 @@ allow udev_t self:process ~{ setcurrent setexec setfscreate setrlimit execmem ex
 allow udev_t self:process { execmem setfscreate };
 allow udev_t self:fd use;
 allow udev_t self:fifo_file rw_fifo_file_perms;
-allow udev_t self:sock_file read_file_perms;
+allow udev_t self:sock_file read_sock_file_perms;
 allow udev_t self:shm create_shm_perms;
 allow udev_t self:sem create_sem_perms;
 allow udev_t self:msgq create_msgq_perms;
diff --git a/policy/modules/system/xen.te b/policy/modules/system/xen.te
index 6b6823d..3b04a40 100644
--- a/policy/modules/system/xen.te
+++ b/policy/modules/system/xen.te
@@ -123,10 +123,7 @@ manage_fifo_files_pattern(xend_t,xend_var_lib_t,xend_var_lib_t)
 files_var_lib_filetrans(xend_t,xend_var_lib_t,{ file dir })
 
 # transition to store
-domain_auto_trans(xend_t, xenstored_exec_t, xenstored_t)
-allow xenstored_t xend_t:fd use;
-allow xenstored_t xend_t:process sigchld;
-allow xenstored_t xend_t:fifo_file write;
+domtrans_pattern(xend_t, xenstored_exec_t, xenstored_t)
 
 # transition to console
 domain_auto_trans(xend_t, xenconsoled_exec_t, xenconsoled_t)
@@ -224,7 +221,7 @@ optional_policy(`
 
 allow xenconsoled_t self:capability { dac_override fsetid ipc_lock };
 allow xenconsoled_t self:unix_stream_socket create_stream_socket_perms;
-allow xenconsoled_t self:fifo_file { read write };
+allow xenconsoled_t self:fifo_file rw_fifo_file_perms;
 
 allow xenconsoled_t xen_devpts_t:chr_file rw_term_perms;
 
@@ -318,7 +315,7 @@ xen_append_log(xenstored_t)
 allow xm_t self:capability { dac_override ipc_lock sys_tty_config };
 
 # internal communication is often done using fifo and unix sockets.
-allow xm_t self:fifo_file { read write };
+allow xm_t self:fifo_file rw_fifo_file_perms;
 allow xm_t self:unix_stream_socket { create_stream_socket_perms connectto };
 allow xm_t self:tcp_socket create_stream_socket_perms;
 
diff --git a/policy/policy_capabilities b/policy/policy_capabilities
index ad2d5d6..054cfbc 100644
--- a/policy/policy_capabilities
+++ b/policy/policy_capabilities
@@ -2,7 +2,7 @@
 # This file contains the policy capabilites
 # that are enabled in this policy, not a
 # declaration of DAC capabilites such as
-# CAP_DAC_OVERRIDE.
+# dac_override.
 #
 # The affected object classes and their
 # permissions should also be listed in
@@ -25,9 +25,8 @@
 # Checks enabled:
 # dir: open
 # file: open
-# lnk_file: open
 # fifo_file: open
 # chr_file: open
 # blk_file: open
 #
-#policycap open_perms;
+policycap open_perms;
diff --git a/policy/support/obj_perm_sets.spt b/policy/support/obj_perm_sets.spt
index d308697..0960f33 100644
--- a/policy/support/obj_perm_sets.spt
+++ b/policy/support/obj_perm_sets.spt
@@ -59,22 +59,22 @@ define(`stat_file_perms', `{ getattr } refpolicywarn(`$0 is deprecated please us
 # 
 # Permissions for executing files.
 #
-define(`x_file_perms', `{ getattr execute } refpolicywarn(`$0 is deprecated please use { getattr execute } instead.')')
+define(`x_file_perms', `{ getattr open execute } refpolicywarn(`$0 is deprecated please use { getattr execute } instead.')')
 
 # 
 # Permissions for reading files and their attributes.
 #
-define(`r_file_perms', `{ read getattr lock ioctl } refpolicywarn(`$0 is deprecated please use read_file_perms instead.')')
+define(`r_file_perms', `{ open read getattr lock ioctl } refpolicywarn(`$0 is deprecated please use read_file_perms instead.')')
 
 # 
 # Permissions for reading and executing files.
 #
-define(`rx_file_perms', `{ read getattr lock execute ioctl } refpolicywarn(`$0 is deprecated please use { mmap_file_perms ioctl lock } instead.')')
+define(`rx_file_perms', `{ open read getattr lock execute ioctl } refpolicywarn(`$0 is deprecated please use { mmap_file_perms ioctl lock } instead.')')
 
 # 
 # Permissions for reading and appending to files.
 #
-define(`ra_file_perms', `{ ioctl read getattr lock append } refpolicywarn(`$0 is deprecated please use { read_file_perms append_file_perms } instead.')')
+define(`ra_file_perms', `{ open ioctl read getattr lock append } refpolicywarn(`$0 is deprecated please use { read_file_perms append_file_perms } instead.')')
 
 #
 # Permissions for linking, unlinking and renaming files.
@@ -89,17 +89,12 @@ define(`create_lnk_perms', `{ create read getattr setattr link unlink rename } r
 # 
 # Permissions for reading directories and their attributes.
 #
-define(`r_dir_perms', `{ read getattr lock search ioctl } refpolicywarn(`$0 is deprecated please use list_dir_perms instead.')')
-
-# 
-# Permissions for reading and writing directories and their attributes.
-#
-define(`rw_dir_perms', `{ read getattr lock search ioctl add_name remove_name write }')
+define(`r_dir_perms', `{ open read getattr lock search ioctl } refpolicywarn(`$0 is deprecated please use list_dir_perms instead.')')
 
 # 
 # Permissions for reading and adding names to directories.
 #
-define(`ra_dir_perms', `{ read getattr lock search ioctl add_name write } refpolicywarn(`$0 is deprecated please use { list_dir_perms add_entry_dir_perms } instead.')')
+define(`ra_dir_perms', `{ open read getattr lock search ioctl add_name write } refpolicywarn(`$0 is deprecated please use { list_dir_perms add_entry_dir_perms } instead.')')
 
 
 #
@@ -187,9 +182,10 @@ define(`create_shm_perms', `{ associate getattr setattr create destroy read writ
 define(`getattr_dir_perms',`{ getattr }')
 define(`setattr_dir_perms',`{ setattr }')
 define(`search_dir_perms',`{ getattr search }')
-define(`list_dir_perms',`{ getattr search read lock ioctl }')
-define(`add_entry_dir_perms',`{ getattr search lock ioctl write add_name }')
-define(`del_entry_dir_perms',`{ getattr search lock ioctl write remove_name }')
+define(`list_dir_perms',`{ getattr search open read lock ioctl }')
+define(`add_entry_dir_perms',`{ getattr search open lock ioctl write add_name }')
+define(`del_entry_dir_perms',`{ getattr search open lock ioctl write remove_name }')
+define(`rw_dir_perms', `{ open read getattr lock search ioctl add_name remove_name write }')
 define(`create_dir_perms',`{ getattr create }')
 define(`rename_dir_perms',`{ getattr rename }')
 define(`delete_dir_perms',`{ getattr rmdir }')
@@ -203,12 +199,12 @@ define(`relabel_dir_perms',`{ getattr relabelfrom relabelto }')
 #
 define(`getattr_file_perms',`{ getattr }')
 define(`setattr_file_perms',`{ setattr }')
-define(`read_file_perms',`{ getattr read lock ioctl }')
-define(`mmap_file_perms',`{ getattr read execute ioctl }')
-define(`exec_file_perms',`{ getattr read execute execute_no_trans }')
-define(`append_file_perms',`{ getattr append lock ioctl }')
-define(`write_file_perms',`{ getattr write append lock ioctl }')
-define(`rw_file_perms',`{ getattr read write append ioctl lock }')
+define(`read_file_perms',`{ getattr open read lock ioctl }')
+define(`mmap_file_perms',`{ getattr open read execute ioctl }')
+define(`exec_file_perms',`{ getattr open read execute execute_no_trans }')
+define(`append_file_perms',`{ getattr open append lock ioctl }')
+define(`write_file_perms',`{ getattr open write append lock ioctl }')
+define(`rw_file_perms',`{ getattr open read write append ioctl lock }')
 define(`create_file_perms',`{ getattr create open }')
 define(`rename_file_perms',`{ getattr rename }')
 define(`delete_file_perms',`{ getattr unlink }')
@@ -239,10 +235,10 @@ define(`relabel_lnk_file_perms',`{ getattr relabelfrom relabelto }')
 #
 define(`getattr_fifo_file_perms',`{ getattr }')
 define(`setattr_fifo_file_perms',`{ setattr }')
-define(`read_fifo_file_perms',`{ getattr read lock ioctl }')
-define(`append_fifo_file_perms',`{ getattr append lock ioctl }')
-define(`write_fifo_file_perms',`{ getattr write append lock ioctl }')
-define(`rw_fifo_file_perms',`{ getattr read write append ioctl lock }')
+define(`read_fifo_file_perms',`{ getattr open read lock ioctl }')
+define(`append_fifo_file_perms',`{ getattr open append lock ioctl }')
+define(`write_fifo_file_perms',`{ getattr open write append lock ioctl }')
+define(`rw_fifo_file_perms',`{ getattr open read write append ioctl lock }')
 define(`create_fifo_file_perms',`{ getattr create open }')
 define(`rename_fifo_file_perms',`{ getattr rename }')
 define(`delete_fifo_file_perms',`{ getattr unlink }')
@@ -272,10 +268,10 @@ define(`relabel_sock_file_perms',`{ getattr relabelfrom relabelto }')
 #
 define(`getattr_blk_file_perms',`{ getattr }')
 define(`setattr_blk_file_perms',`{ setattr }')
-define(`read_blk_file_perms',`{ getattr read lock ioctl }')
-define(`append_blk_file_perms',`{ getattr append lock ioctl }')
-define(`write_blk_file_perms',`{ getattr write append lock ioctl }')
-define(`rw_blk_file_perms',`{ getattr read write append ioctl lock }')
+define(`read_blk_file_perms',`{ getattr open read lock ioctl }')
+define(`append_blk_file_perms',`{ getattr open append lock ioctl }')
+define(`write_blk_file_perms',`{ getattr open write append lock ioctl }')
+define(`rw_blk_file_perms',`{ getattr open read write append ioctl lock }')
 define(`create_blk_file_perms',`{ getattr create }')
 define(`rename_blk_file_perms',`{ getattr rename }')
 define(`delete_blk_file_perms',`{ getattr unlink }')
@@ -289,10 +285,10 @@ define(`relabel_blk_file_perms',`{ getattr relabelfrom relabelto }')
 #
 define(`getattr_chr_file_perms',`{ getattr }')
 define(`setattr_chr_file_perms',`{ setattr }')
-define(`read_chr_file_perms',`{ getattr read lock ioctl }')
-define(`append_chr_file_perms',`{ getattr append lock ioctl }')
-define(`write_chr_file_perms',`{ getattr write append lock ioctl }')
-define(`rw_chr_file_perms',`{ getattr read write append ioctl lock }')
+define(`read_chr_file_perms',`{ getattr open read lock ioctl }')
+define(`append_chr_file_perms',`{ getattr open append lock ioctl }')
+define(`write_chr_file_perms',`{ getattr open write append lock ioctl }')
+define(`rw_chr_file_perms',`{ getattr open read write append ioctl lock }')
 define(`create_chr_file_perms',`{ getattr create }')
 define(`rename_chr_file_perms',`{ getattr rename }')
 define(`delete_chr_file_perms',`{ getattr unlink }')
@@ -309,7 +305,7 @@ define(`relabel_chr_file_perms',`{ getattr relabelfrom relabelto }')
 #
 # Use (read and write) terminals
 #
-define(`rw_term_perms', `{ getattr read write ioctl }')
+define(`rw_term_perms', `{ getattr open read write ioctl }')
 
 #
 # Sockets