diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
index 0df5803..9b79f4a 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -1134,6 +1134,32 @@ interface(`fs_read_noxattr_fs_symlinks',`
########################################
##
+## Relabel all objets from filesystems that
+## do not support extended attributes.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`fs_relabelfrom_noxattr_fs',`
+ gen_require(`
+ attribute noxattrfs;
+ ')
+
+ allow $1 noxattrfs:dir list_dir_perms;
+ relabelfrom_dirs_pattern($1, noxattrfs, noxattrfs)
+ relabelfrom_files_pattern($1, noxattrfs, noxattrfs)
+ relabelfrom_lnk_files_pattern($1, noxattrfs, noxattrfs)
+ relabelfrom_fifo_files_pattern($1, noxattrfs, noxattrfs)
+ relabelfrom_sock_files_pattern($1, noxattrfs, noxattrfs)
+ relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs)
+ relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs)
+')
+
+########################################
+##
## Do not audit attempts to read
## files on a CIFS or SMB filesystem.
##
@@ -4441,26 +4467,26 @@ interface(`fs_getattr_all_files',`
########################################
##
-## Get the attributes of all symbolic links with
-## a filesystem type.
+## Do not audit attempts to get the attributes
+## of all files with a filesystem type.
##
##
##
-## Domain allowed access.
+## Domain to not audit.
##
##
#
-interface(`fs_getattr_all_symlinks',`
+interface(`fs_dontaudit_getattr_all_files',`
gen_require(`
attribute filesystem_type;
')
- getattr_lnk_files_pattern($1, filesystem_type, filesystem_type)
+ dontaudit $1 filesystem_type:file getattr;
')
########################################
##
-## Get the attributes of all named pipes with
+## Get the attributes of all symbolic links with
## a filesystem type.
##
##
@@ -4469,37 +4495,37 @@ interface(`fs_getattr_all_symlinks',`
##
##
#
-interface(`fs_getattr_all_pipes',`
+interface(`fs_getattr_all_symlinks',`
gen_require(`
attribute filesystem_type;
')
- getattr_fifo_files_pattern($1, filesystem_type, filesystem_type)
+ getattr_lnk_files_pattern($1, filesystem_type, filesystem_type)
')
########################################
##
-## Get the attributes of all named sockets with
-## a filesystem type.
+## Do not audit attempts to get the attributes
+## of all symbolic links with a filesystem type.
##
##
##
-## Domain allowed access.
+## Domain to not audit.
##
##
#
-interface(`fs_getattr_all_sockets',`
+interface(`fs_dontaudit_getattr_all_symlinks',`
gen_require(`
attribute filesystem_type;
')
- getattr_sock_files_pattern($1, filesystem_type, filesystem_type)
+ dontaudit $1 filesystem_type:lnk_file getattr;
')
########################################
##
-## Do not audit attempts to get the attributes
-## of all files with a filesystem type.
+## Get the attributes of all named pipes with
+## a filesystem type.
##
##
##
@@ -4507,37 +4533,37 @@ interface(`fs_getattr_all_sockets',`
##
##
#
-interface(`fs_dontaudit_getattr_all_files',`
+interface(`fs_getattr_all_pipes',`
gen_require(`
attribute filesystem_type;
')
- dontaudit $1 filesystem_type:file getattr;
+ getattr_fifo_files_pattern($1, filesystem_type, filesystem_type)
')
########################################
##
## Do not audit attempts to get the attributes
-## of all symbolic links with a filesystem type.
+## of all named pipes with a filesystem type.
##
##
##
-## Domain allowed access.
+## Domain to not audit.
##
##
#
-interface(`fs_dontaudit_getattr_all_symlinks',`
+interface(`fs_dontaudit_getattr_all_pipes',`
gen_require(`
attribute filesystem_type;
')
- dontaudit $1 filesystem_type:lnk_file getattr;
+ dontaudit $1 filesystem_type:fifo_file getattr;
')
########################################
##
-## Do not audit attempts to get the attributes
-## of all named pipes with a filesystem type.
+## Get the attributes of all named sockets with
+## a filesystem type.
##
##
##
@@ -4545,14 +4571,15 @@ interface(`fs_dontaudit_getattr_all_symlinks',`
##
##
#
-interface(`fs_dontaudit_getattr_all_pipes',`
+interface(`fs_getattr_all_sockets',`
gen_require(`
attribute filesystem_type;
')
- dontaudit $1 filesystem_type:fifo_file getattr;
+ getattr_sock_files_pattern($1, filesystem_type, filesystem_type)
')
+
########################################
##
## Do not audit attempts to get the attributes
@@ -4560,7 +4587,7 @@ interface(`fs_dontaudit_getattr_all_pipes',`
##
##
##
-## Domain allowed access.
+## Domain to not audit.
##
##
#
@@ -4627,29 +4654,3 @@ interface(`fs_unconfined',`
typeattribute $1 filesystem_unconfined_type;
')
-
-########################################
-##
-## Relabel all objets from filesystems that
-## do not support extended attributes.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`fs_relabelfrom_noxattr_fs',`
- gen_require(`
- attribute noxattrfs;
- ')
-
- allow $1 noxattrfs:dir list_dir_perms;
- relabelfrom_dirs_pattern($1, noxattrfs, noxattrfs)
- relabelfrom_files_pattern($1, noxattrfs, noxattrfs)
- relabelfrom_lnk_files_pattern($1, noxattrfs, noxattrfs)
- relabelfrom_fifo_files_pattern($1, noxattrfs, noxattrfs)
- relabelfrom_sock_files_pattern($1, noxattrfs, noxattrfs)
- relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs)
- relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs)
-')