diff --git a/refpolicy/policy/modules/admin/consoletype.if b/refpolicy/policy/modules/admin/consoletype.if
index 6faf8e1..8070200 100644
--- a/refpolicy/policy/modules/admin/consoletype.if
+++ b/refpolicy/policy/modules/admin/consoletype.if
@@ -10,12 +10,18 @@ allow $1 consoletype_exec_t:file { getattr read execute };
 allow $1 consoletype_t:process transition;
 type_transition $1 consoletype_exec_t:process consoletype_t;
 dontaudit $1 consoletype_t:process { noatsecure siginh rlimitinh };
+allow $1 consoletype_t:fd use;
+allow consoletype_t $1:fd use;
+allow consoletype_t $1:fifo_file rw_file_perms;
+allow consoletype_t $1:process sigchld;
 ')
 
 define(`consoletype_transition_depend',`
 type consoletype_t, consoletype_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 #######################################
diff --git a/refpolicy/policy/modules/admin/dmesg.if b/refpolicy/policy/modules/admin/dmesg.if
index dc01a1c..bc718b2 100644
--- a/refpolicy/policy/modules/admin/dmesg.if
+++ b/refpolicy/policy/modules/admin/dmesg.if
@@ -20,12 +20,18 @@ allow $1 dmesg_exec_t:file { getattr read execute };
 allow $1 dmesg_t:process transition;
 type_transition $1 dmesg_exec_t:process dmesg_t;
 dontaudit $1 dmesg_t:process { noatsecure siginh rlimitinh };
+allow $1 dmesg_t:fd use;
+allow dmesg_t $1:fd use;
+allow dmesg_t $1:fifo_file rw_file_perms;
+allow dmesg_t $1:process sigchld;
 ')
 
 define(`dmesg_transition_depend',`
 type dmesg_t, dmesg_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/admin/netutils.if b/refpolicy/policy/modules/admin/netutils.if
index e063dd5..c1150fe 100644
--- a/refpolicy/policy/modules/admin/netutils.if
+++ b/refpolicy/policy/modules/admin/netutils.if
@@ -10,12 +10,18 @@ allow $1 netutils_exec_t:file { getattr read execute };
 allow $1 netutils_t:process transition;
 type_transition $1 netutils_exec_t:process netutils_t;
 dontaudit $1 netutils_t:process { noatsecure siginh rlimitinh };
+allow $1 netutils_t:fd use;
+allow netutils_t $1:fd use;
+allow netutils_t $1:fifo_file rw_file_perms;
+allow netutils_t $1:process sigchld;
 ')
 
 define(`netutils_transition_depend',`
 type netutils_t, netutils_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 #######################################
diff --git a/refpolicy/policy/modules/admin/rpm.if b/refpolicy/policy/modules/admin/rpm.if
index 1e77b40..cabe283 100644
--- a/refpolicy/policy/modules/admin/rpm.if
+++ b/refpolicy/policy/modules/admin/rpm.if
@@ -19,12 +19,18 @@ allow $1 rpm_exec_t:file { getattr read execute };
 allow $1 rpm_t:process transition;
 type_transition $1 rpm_exec_t:process rpm_t;
 dontaudit $1 rpm_t:process { noatsecure siginh rlimitinh };
+allow $1 rpm_t:fd use;
+allow rpm_t $1:fd use;
+allow rpm_t $1:fifo_file rw_file_perms;
+allow rpm_t $1:process sigchld;
 ')
 
 define(`rpm_transition_depend',`
 type rpm_t, rpm_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/apps/gpg.if b/refpolicy/policy/modules/apps/gpg.if
index 7e0737c..d635dcc 100644
--- a/refpolicy/policy/modules/apps/gpg.if
+++ b/refpolicy/policy/modules/apps/gpg.if
@@ -47,6 +47,9 @@ role $1_r types $1_gpg_pinentry_t;
 allow $1_t $1_gpg_t:process transition;
 allow $1_t gpg_exec_t:file { getattr read execute };
 type_transition $1_t gpg_exec_t:process $1_gpg_t;
+allow $1_t $1_gpg_t:fd use;
+allow $1_gpg_t $1_t:fd use;
+allow $1_gpg_t $1_t:fifo_file rw_file_perms;
 
 allow $1_gpg_t self:capability { ipc_lock setuid };
 allow { $1_t $1_gpg_t } $1_gpg_t:process signal;
@@ -156,6 +159,9 @@ dontaudit $1_gpg_t var_t:dir search;
 allow $1_gpg_t $1_gpg_helper_t:process transition;
 allow $1_gpg_t gpg_helper_exec_t:file { getattr read execute };
 type_transition $1_gpg_t gpg_helper_exec_t:process $1_gpg_helper_t;
+allow $1_gpg_t $1_gpg_helper_t:fd use;
+allow $1_gpg_helper_t $1_t:fd use;
+allow $1_gpg_helper_t $1_t:fifo_file rw_file_perms;
 
 allow $1_gpg_helper_t self:unix_stream_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept };
 
@@ -273,6 +279,9 @@ can_unix_connect($1_gpg_t, $1_gpg_agent_t)
 allow $1_gpg_agent_t $1_gpg_pinentry_t:process transition;
 allow $1_gpg_agent_t pinentry_exec_t:file { getattr read execute };
 type_transition $1_gpg_agent_t pinentry_exec_t:process $1_gpg_pinentry_t;
+allow $1_gpg_pinentry_t $1_gpg_agent_t:fd use;
+allow $1_gpg_agent_t $1_gpg_pinentry_t:fd use;
+allow $1_gpg_agent_t $1_gpg_pinentry_t:fifo_file rw_file_perms;
 
 allow $1_gpg_pinentry_t self:unix_stream_socket { connect create getattr read shutdown write };
 allow $1_gpg_pinentry_t self:fifo_file { getattr read write };
diff --git a/refpolicy/policy/modules/kernel/bootloader.if b/refpolicy/policy/modules/kernel/bootloader.if
index 8681739..5e312b2 100644
--- a/refpolicy/policy/modules/kernel/bootloader.if
+++ b/refpolicy/policy/modules/kernel/bootloader.if
@@ -19,12 +19,18 @@ allow $1 bootloader_exec_t:file { getattr read execute };
 allow $1 bootloader_t:process transition;
 type_transition $1 bootloader_exec_t:process bootloader_t;
 dontaudit $1 bootloader_t:process { noatsecure siginh rlimitinh };
+allow $1 bootloader_t:fd use;
+allow bootloader_t $1:fd use;
+allow bootloader_t $1:fifo_file rw_file_perms;
+allow bootloader_t $1:process sigchld;
 ')
 
 define(`bootloader_transition_depend',`
 type bootloader_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/kernel/devices.if b/refpolicy/policy/modules/kernel/devices.if
index 92a52f6..227e8b2 100644
--- a/refpolicy/policy/modules/kernel/devices.if
+++ b/refpolicy/policy/modules/kernel/devices.if
@@ -50,13 +50,13 @@ class chr_file { getattr relabelfrom relabelto };
 #
 define(`devices_list_device_nodes',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 device_t:lnk_file { getattr read };
 ')
 
 define(`devices_list_device_nodes_depend',`
 type device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class lnk_file { getattr read };
 ')
 
@@ -66,12 +66,12 @@ class lnk_file { getattr read };
 #
 define(`devices_ignore_list_device_nodes',`
 requires_block_template(`$0'_depend)
-dontaudit $1 device_t:dir { getattr read search };
+dontaudit $1 device_t:dir r_dir_perms;
 ')
 
 define(`devices_ignore_list_device_nodes_depend',`
 type device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 ')
 
 ########################################
@@ -94,13 +94,13 @@ class fifo_file getattr;
 #
 define(`devices_get_generic_block_device_attributes',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr search read };
+allow $1 device_t:dir r_dir_perms;
 allow $1 device_t:blk_file getattr;
 ')
 
 define(`devices_get_generic_block_device_attributes_depend',`
 type device_t;
-class dir { getattr search read };
+class dir r_dir_perms;
 class blk_file getattr;
 ')
 
@@ -142,13 +142,13 @@ class capability mknod;
 #
 define(`devices_get_generic_character_device_attributes',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr search read };
+allow $1 device_t:dir r_dir_perms;
 allow $1 device_t:chr_file getattr;
 ')
 
 define(`devices_get_generic_character_device_attributes_depend',`
 type device_t;
-class dir { getattr search read };
+class dir r_dir_perms;
 class chr_file getattr;
 ')
 
@@ -264,7 +264,7 @@ allow $1 device_t:blk_file { create ioctl read getattr lock write setattr append
 
 define(`devices_manage_generic_block_devices_depend',`
 type device_t;
-class dir { getattr search read };
+class dir r_dir_perms;
 class blk_file { create ioctl read getattr lock write setattr append link unlink rename };
 ')
 
@@ -280,7 +280,7 @@ allow $1 device_t:chr_file { create ioctl read getattr lock write setattr append
 
 define(`devices_manage_generic_character_devices_depend',`
 type device_t;
-class dir { getattr search read };
+class dir r_dir_perms;
 class chr_file { create ioctl read getattr lock write setattr append link unlink rename };
 ')
 
@@ -308,14 +308,14 @@ class dir { getattr search read write add_name remove_name };
 #
 define(`devices_get_all_block_device_attributes',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 device_node:blk_file getattr;
 ')
 
 define(`devices_get_all_block_device_attributes_depend',`
 attribute device_node;
 class blk_file getattr;
-class dir { getattr read search };
+class dir r_dir_perms;
 ')
 
 ########################################
@@ -338,14 +338,14 @@ class blk_file getattr;
 #
 define(`devices_get_all_character_device_attributes',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 device_node:chr_file getattr;
 ')
 
 define(`devices_get_all_character_device_attributes_depend',`
 attribute device_node;
 class chr_file getattr;
-class dir { getattr read search };
+class dir r_dir_perms;
 ')
 
 ########################################
@@ -407,7 +407,7 @@ storage_write_scsi_generic($1)
 
 define(`devices_manage_generic_block_devices_depend',`
 attribute device_node;
-class dir { getattr search read };
+class dir r_dir_perms;
 class blk_file { create ioctl read getattr lock write setattr append link unlink rename };
 ')
 
@@ -424,7 +424,7 @@ typeattribute $1 memory_raw_read, memory_raw_write;
 
 define(`devices_manage_all_character_devices_depend',`
 attribute device_node, memory_raw_read, memory_raw_write;
-class dir { getattr search read };
+class dir r_dir_perms;
 class chr_file { create ioctl read getattr lock write setattr append link unlink rename };
 ')
 
@@ -435,7 +435,7 @@ class chr_file { create ioctl read getattr lock write setattr append link unlink
 define(`devices_raw_read_memory',`
 requires_block_template(`$0'_depend)
 typeattribute $1 memory_raw_read;
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 memory_device_t:chr_file { getattr read ioctl };
 allow $1 self:capability sys_rawio;
 ')
@@ -443,7 +443,7 @@ allow $1 self:capability sys_rawio;
 define(`devices_raw_read_memory_depend',`
 type device_t, memory_device_t;
 attribute memory_raw_read;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read ioctl };
 class capability sys_rawio;
 ')
@@ -455,7 +455,7 @@ class capability sys_rawio;
 define(`devices_raw_write_memory',`
 requires_block_template(`$0'_depend)
 typeattribute $1 memory_raw_write;
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 memory_device_t:chr_file write;
 allow $1 self:capability sys_rawio;
 ')
@@ -463,7 +463,7 @@ allow $1 self:capability sys_rawio;
 define(`devices_raw_write_memory_depend',`
 type device_t, memory_device_t;
 attribute memory_raw_write;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file write;
 class capability sys_rawio;
 ')
@@ -504,13 +504,13 @@ class chr_file execute;
 #
 define(`devices_get_random_data',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 random_device_t:chr_file { getattr read ioctl };
 ')
 
 define(`devices_get_random_data_depend',`
 type device_t, random_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read ioctl };
 ')
 
@@ -520,13 +520,13 @@ class chr_file { getattr read ioctl };
 #
 define(`devices_get_pseudorandom_data',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 urandom_device_t:chr_file { getattr read ioctl };
 ')
 
 define(`devices_get_pseudorandom_data_depend',`
 type device_t, urandom_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read ioctl };
 ')
 
@@ -536,13 +536,13 @@ class chr_file { getattr read ioctl };
 #
 define(`devices_add_entropy',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 random_device_t:chr_file { getattr write ioctl };
 ')
 
 define(`devices_add_entropy_depend',`
 type device_t, random_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr write ioctl };
 ')
 
@@ -552,13 +552,13 @@ class chr_file { getattr write ioctl };
 #
 define(`devices_set_pseudorandom_seed',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 urandom_device_t:chr_file { getattr write ioctl };
 ')
 
 define(`devices_set_pseudorandom_seed_depend',`
 type device_t, urandom_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr write ioctl };
 ')
 
@@ -568,14 +568,14 @@ class chr_file { getattr write ioctl };
 #
 define(`devices_use_dev_null',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
-allow $1 null_device_t:chr_file { getattr read write append ioctl };
+allow $1 device_t:dir r_dir_perms;
+allow $1 null_device_t:chr_file rw_file_perms;
 ')
 
 define(`devices_use_dev_null_depend',`
 type device_t, null_device_t;
-class device_t:dir { getattr read search };
-class chr_file { getattr read write append ioctl };
+class device_t:dir r_dir_perms;
+class chr_file rw_file_perms;
 ')
 
 ########################################
@@ -584,14 +584,14 @@ class chr_file { getattr read write append ioctl };
 #
 define(`devices_use_dev_zero',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
-allow $1 zero_device_t:chr_file { getattr read write append ioctl };
+allow $1 device_t:dir r_dir_perms;
+allow $1 zero_device_t:chr_file rw_file_perms;
 ')
 
 define(`devices_use_dev_zero_depend',`
 type device_t, zero_device_t;
-class device_t:dir { getattr read search };
-class chr_file { getattr read write append ioctl };
+class device_t:dir r_dir_perms;
+class chr_file r_file_perms;
 ')
 
 ########################################
@@ -615,13 +615,13 @@ class chr_file execute;
 #
 define(`devices_read_realtime_clock',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 clock_device_t:chr_file { getattr read ioctl };
 ')
 
 define(`devices_read_realtime_clock_depend',`
 type device_t, clock_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read ioctl };
 ')
 
@@ -631,13 +631,13 @@ class chr_file { getattr read ioctl };
 #
 define(`devices_write_realtime_clock',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 clock_device_t:chr_file { setattr lock write append ioctl };
 ')
 
 define(`devices_write_realtime_clock_depend',`
 type device_t, clock_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { setattr lock write append ioctl };
 ')
 
@@ -656,13 +656,13 @@ devices_write_realtime_clock($1)
 #
 define(`devices_record_sound_input',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 sound_device_t:chr_file { getattr read ioctl };
 ')
 
 define(`devices_record_sound_input_depend',`
 type device_t, sound_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read ioctl };
 ')
 
@@ -672,13 +672,13 @@ class chr_file { getattr read ioctl };
 #
 define(`devices_play_sound',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 sound_device_t:chr_file { getattr write ioctl };
 ')
 
 define(`devices_play_sound_depend',`
 type device_t, sound_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr write ioctl };
 ')
 
@@ -688,13 +688,13 @@ class chr_file { getattr write ioctl };
 #
 define(`devices_read_sound_mixer_levels',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 sound_device_t:chr_file { getattr read ioctl };
 ')
 
 define(`devices_read_sound_mixer_levels_depend',`
 type device_t, sound_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read ioctl };
 ')
 
@@ -704,13 +704,13 @@ class chr_file { getattr read ioctl };
 #
 define(`devices_write_sound_mixer_levels',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 sound_device_t:chr_file { getattr write ioctl };
 ')
 
 define(`devices_write_sound_mixer_levels_depend',`
 type device_t, sound_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr write ioctl };
 ')
 
@@ -720,13 +720,13 @@ class chr_file { getattr write ioctl };
 #
 define(`devices_direct_agp_access',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 agp_device_t:chr_file { getattr read write ioctl };
 ')
 
 define(`devices_direct_agp_access_depend',`
 type device_t, agp_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read write ioctl };
 ')
 
@@ -736,13 +736,13 @@ class chr_file { getattr read write ioctl };
 #
 define(`devices_get_direct_rendering_interface_attributes',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 dri_device_t:chr_file getattr;
 ')
 
 define(`devices_get_direct_rendering_interface_attributes_depend',`
 type device_t, dri_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file getattr;
 ')
 
@@ -752,13 +752,13 @@ class chr_file getattr;
 #
 define(`devices_use_direct_rendering_interface',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 dri_device_t:chr_file { getattr read write ioctl };
 ')
 
 define(`devices_use_direct_rendering_interface_depend',`
 type device_t, dri_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read write ioctl };
 ')
 
@@ -782,13 +782,13 @@ class chr_file { getattr read write ioctl };
 #
 define(`devices_read_mtrr',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 mtrr_device_t:chr_file { getattr read ioctl };
 ')
 
 define(`devices_read_mtrr_depend',`
 type device_t, mtrr_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read ioctl };
 ')
 
@@ -798,12 +798,13 @@ class chr_file { getattr read ioctl };
 #
 define(`devices_write_mtrr',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 mtrr_device_t:chr_file { getattr write ioctl };
 ')
 
 define(`devices_write_mtrr_depend',`
 type device_t, mtrr_device_t;
+class dir r_dir_perms;
 class chr_file { getattr write ioctl };
 ')
 
@@ -813,13 +814,13 @@ class chr_file { getattr write ioctl };
 #
 define(`devices_read_framebuffer',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 framebuf_device_t:chr_file { getattr read ioctl };
 ')
 
 define(`devices_read_framebuffer_depend',`
 type framebuf_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read ioctl };
 ')
 
@@ -829,13 +830,13 @@ class chr_file { getattr read ioctl };
 #
 define(`devices_write_framebuffer',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 framebuf_device_t:chr_file { getattr write ioctl };
 ')
 
 define(`devices_write_framebuffer_depend',`
 type device_t, framebuf_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr write ioctl };
 ')
 
@@ -845,13 +846,13 @@ class chr_file { getattr write ioctl };
 #
 define(`devices_read_lvm_control_channel',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 lvm_control_t:chr_file { getattr read };
 ')
 
 define(`devices_read_lvm_control_channel_depend',`
 type lvm_control_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { ioctl read getattr lock write append };
 ')
 
@@ -861,13 +862,13 @@ class chr_file { ioctl read getattr lock write append };
 #
 define(`devices_use_lvm_control_channel',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr search read };
+allow $1 device_t:dir r_dir_perms;
 allow $1 lvm_control_t:chr_file { ioctl read getattr lock write append };
 ')
 
 define(`devices_use_lvm_control_channel_depend',`
 type lvm_control_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { ioctl read getattr lock write append };
 ')
 
@@ -893,13 +894,13 @@ class chr_file unlink;
 #
 define(`devices_read_misc',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 misc_device_t:chr_file { getattr read ioctl };
 ')
 
 define(`devices_read_misc_depend',`
 type device_t, misc_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read ioctl };
 ')
 
@@ -909,13 +910,13 @@ class chr_file { getattr read ioctl };
 #
 define(`devices_write_misc',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 misc_device_t:chr_file { getattr write ioctl };
 ')
 
 define(`devices_write_misc_depend',`
 type device_t, misc_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr write ioctl };
 ')
 
@@ -925,13 +926,13 @@ class chr_file { getattr write ioctl };
 #
 define(`devices_get_mouse_input',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 mouse_device_t:chr_file { getattr read ioctl };
 ')
 
 define(`devices_get_mouse_input_depend',`
 type device_t, mouse_device_t;
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 class chr_file { getattr read ioctl };
 ')
 
@@ -941,13 +942,13 @@ class chr_file { getattr read ioctl };
 #
 define(`devices_get_input_event',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 event_device_t:chr_file { getattr read ioctl };
 ')
 
 define(`devices_get_input_event_depend',`
 type device_t, event_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read ioctl };
 ')
 
@@ -957,13 +958,13 @@ class chr_file { getattr read ioctl };
 #
 define(`devices_get_cpuid',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 cpu_device_t:chr_file { getattr read ioctl };
 ')
 
 define(`devices_get_cpuid_depend',`
 type device_t, cpu_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read ioctl };
 ')
 
@@ -973,13 +974,13 @@ class chr_file { getattr read ioctl };
 #
 define(`devices_load_cpu_microcode',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 cpu_device_t:chr_file { getattr read write ioctl };
 ')
 
 define(`devices_load_cpu_microcode_depend',`
 type device_t, cpu_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read write ioctl };
 ')
 
@@ -989,13 +990,13 @@ class chr_file { getattr read write ioctl };
 #
 define(`devices_use_scanner',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 scanner_device_t:chr_file { getattr read write ioctl };
 ')
 
 define(`devices_use_scanner_depend',`
 type device_t, scanner_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read write ioctl };
 ')
 
@@ -1005,12 +1006,12 @@ class chr_file { getattr read write ioctl };
 #
 define(`devices_control_system_powermanagement',`
 requires_block_template(`$0'_depend)
-allow $1 device_t:dir { getattr read search };
+allow $1 device_t:dir r_dir_perms;
 allow $1 power_device_t:chr_file { getattr read write ioctl };
 ')
 
 define(`devices_control_system_powermanagement_depend',`
 type device_t, power_device_t;
-class dir { getattr read search };
+class dir r_dir_perms;
 class chr_file { getattr read write ioctl };
 ')
diff --git a/refpolicy/policy/modules/kernel/kernel.if b/refpolicy/policy/modules/kernel/kernel.if
index 55d391c..4cbb309 100644
--- a/refpolicy/policy/modules/kernel/kernel.if
+++ b/refpolicy/policy/modules/kernel/kernel.if
@@ -11,12 +11,18 @@ allow kernel_t $1:process transition;
 allow $1 kernel_t:fd use;
 type_transition kernel_t $2:process $1;
 dontaudit kernel_t $1:process { noatsecure siginh rlimitinh };
+allow $1 kernel_t:fd use;
+allow kernel_t $1:fd use;
+allow kernel_t $1:fifo_file rw_file_perms;
+allow kernel_t $1:process sigchld;
 ')
 
 define(`kernel_make_userland_entrypoint_depend',`
 type kernel_t;
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
 class file { getattr read execute };
+class fifo_file rw_file_perms;
+class fd use;
 ')
 
 ########################################
@@ -418,15 +424,16 @@ class file { getattr read };
 #
 define(`kernel_read_system_state',`
 requires_block_template(`$0'_depend)
-allow $1 proc_t:dir { getattr search read };
-allow $1 proc_t:{ lnk_file file } { getattr read ioctl };
+allow $1 proc_t:dir r_dir_perms;
+allow $1 proc_t:lnk_file { getattr read };
+allow $1 proc_t:file r_file_perms;
 ')
 
 define(`kernel_read_system_state_depend',`
 type proc_t;
-class dir { search getattr read };
+class dir r_dir_perms;
 class lnk_file { getattr read };
-class file { getattr read ioctl };
+class file r_file_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/kernel/terminal.if b/refpolicy/policy/modules/kernel/terminal.if
index 96c0d89..c5cc8e2 100644
--- a/refpolicy/policy/modules/kernel/terminal.if
+++ b/refpolicy/policy/modules/kernel/terminal.if
@@ -1,4 +1,6 @@
 # Copyright (C) 2005 Tresys Technology, LLC
+## <module name="terminal" layer="kernel">
+## <summary>Policy for terminals.</summary>
 
 ########################################
 #
@@ -278,13 +280,13 @@ define(`terminal_use_all_private_pseudoterminals',`
 requires_block_template(`$0'_depend)
 devices_list_device_nodes($1)
 allow $1 devpts_t:dir { getattr read search };
-allow $1 ptynode:chr_file { read write };
+allow $1 ptynode:chr_file { getattr read write ioctl };
 ')
 
 define(`terminal_use_all_private_pseudoterminals_depend',`
 attribute ptynode;
 class dir { getattr search read };
-class chr_file { read write };
+class chr_file { getattr read write ioctl };
 ')
 
 ########################################
@@ -333,6 +335,21 @@ class chr_file setattr;
 
 ########################################
 #
+# terminal_relabel_general_physical_terminal(domain)
+#
+define(`terminal_relabel_general_physical_terminal',`
+requires_block_template(`$0'_depend)
+devices_list_device_nodes($1)
+allow $1 tty_device_t:chr_file { relabelfrom relabelto };
+')
+
+define(`terminal_relabel_general_physical_terminal_depend',`
+type tty_device_t;
+class chr_file { relabelfrom relabelto };
+')
+
+########################################
+#
 # terminal_reset_physical_terminal_labels(domain)
 #
 define(`terminal_reset_physical_terminal_labels',`
@@ -346,7 +363,6 @@ define(`terminal_reset_physical_terminal_labels_depend',`
 attribute ttynode;
 type tty_device_t;
 class chr_file { relabelfrom relabelto };
-devices_list_device_nodes_depend
 ')
 
 ########################################
@@ -379,12 +395,12 @@ class chr_file { read write };
 define(`terminal_use_general_physical_terminal',`
 requires_block_template(`$0'_depend)
 devices_list_device_nodes($1)
-allow $1 tty_device_t:chr_file { read write };
+allow $1 tty_device_t:chr_file { getattr read write ioctl };
 ')
 
 define(`terminal_use_general_physical_terminal_depend',`
 type tty_device_t;
-class chr_file { read write };
+class chr_file { getattr read write ioctl };
 ')
 
 ########################################
@@ -418,6 +434,21 @@ class chr_file getattr;
 
 ########################################
 #
+# terminal_set_all_private_physical_terminal_attributes(domain)
+#
+define(`terminal_set_all_private_physical_terminal_attributes',`
+requires_block_template(`$0'_depend)
+devices_list_device_nodes($1)
+allow $1 ttynode:chr_file setattr;
+')
+
+define(`terminal_set_all_private_physical_terminal_attributes_depend',`
+attribute ttynode;
+class chr_file setattr;
+')
+
+########################################
+#
 # terminal_ignore_get_all_private_physical_terminal_attributes(domain)
 #
 define(`terminal_ignore_get_all_private_physical_terminal_attributes',`
@@ -431,6 +462,21 @@ class chr_file getattr;
 ')
 
 ########################################
+#
+# terminal_relabel_all_private_physical_terminals(domain)
+#
+define(`terminal_relabel_all_private_physical_terminals',`
+requires_block_template(`$0'_depend)
+devices_list_device_nodes($1)
+allow $1 ttynode:chr_file { relabelfrom relabelto };
+')
+
+define(`terminal_relabel_all_private_physical_terminals_depend',`
+attribute ttynode;
+class chr_file { relabelfrom relabelto };
+')
+
+########################################
 ## <interface name="terminal_write_all_private_physical_terminals">
 ##	<description>
 ##		Write to all private ttys.  Has a backchannel of
@@ -460,12 +506,12 @@ class chr_file { getattr write };
 define(`terminal_use_all_private_physical_terminals',`
 requires_block_template(`$0'_depend)
 devices_list_device_nodes($1)
-allow $1 ttynode:chr_file { read write };
+allow $1 ttynode:chr_file { getattr read write ioctl };
 ')
 
 define(`terminal_use_all_private_physical_terminals_depend',`
 attribute ttynode;
-class chr_file { read write };
+class chr_file { getattr read write ioctl };
 ')
 
 ########################################
@@ -481,3 +527,5 @@ define(`terminal_ignore_use_all_private_physical_terminals_depend',`
 attribute ttynode;
 class chr_file { read write };
 ')
+
+## </module>
diff --git a/refpolicy/policy/modules/services/mta.if b/refpolicy/policy/modules/services/mta.if
index 3ee99d9..973bbf4 100644
--- a/refpolicy/policy/modules/services/mta.if
+++ b/refpolicy/policy/modules/services/mta.if
@@ -1,4 +1,6 @@
 # Copyright (C) 2005 Tresys Technology, LLC
+## <module name="mta" layer="keyservices">
+## <summary>Policy common to all email tranfer agents.</summary>
 
 #######################################
 #
@@ -36,6 +38,10 @@ allow $1_t sendmail_exec_t:file { getattr read execute execute_no_trans };
 allow $1_t sendmail_exec_t:lnk_file { getattr read };
 allow $1_t $1_mail_t:process transition;
 type_transition $1_t sendmail_exec_t:process $1_mail_t;
+allow $1_t $1_mail_t:fd use;
+allow $1_mail_t $1_t:fd use;
+allow $1_mail_t $1_t:fifo_file rw_file_perms;
+allow $1_mail_t $1_t:process sigchld;
 
 kernel_read_kernel_sysctl($1_mail_t)
 
@@ -174,11 +180,10 @@ allow $1 sendmail_exec_t:file { getattr read execute };
 allow $1 system_mail_t:process transition;
 type_transition $1 sendmail_exec_t:process system_mail_t;
 dontaudit $1 system_mail_t:process { noatsecure siginh rlimitinh };
-
 allow $1 system_mail_t:fd use;
-allow system_mail_t $1:process sigchld;
 allow system_mail_t $1:fd use;
-allow system_mail_t $1:fifo_file { ioctl read getattr lock write append };
+allow system_mail_t $1:fifo_file rw_file_perms;
+allow system_mail_t $1:process sigchld;
 ')
 
 define(`mta_send_mail_depend',`
@@ -241,10 +246,30 @@ class file { getattr read write append setattr };
 
 #######################################
 #
+# mta_get_mail_spool_attributes(domain)
+#
+define(`mta_get_mail_spool_attributes',`
+requires_block_template(`$0'_depend)
+files_search_system_spool_directory($1)
+allow $1 mail_spool_t:dir r_dir_perms;
+allow $1 mail_spool_t:lnk_file read;
+allow $1 mail_spool_t:file getattr;
+')
+
+define(`mta_get_mail_spool_attributes_depend',`
+type mail_spool_t;
+class dir r_dir_perms;
+class file getattr;
+class lnk_file read;
+')
+
+#######################################
+#
 # mta_modify_mail_spool(domain)
 #
 define(`mta_modify_mail_spool',`
 requires_block_template(`$0'_depend)
+files_search_system_spool_directory($1)
 allow $1 mail_spool_t:dir { read getattr lock search ioctl add_name remove_name write };
 allow $1 mail_spool_t:file { getattr read write append setattr };
 ')
@@ -261,6 +286,7 @@ class file { create ioctl read getattr lock write setattr append link unlink ren
 #
 define(`mta_manage_mail_spool',`
 requires_block_template(`$0'_depend)
+files_search_system_spool_directory($1)
 allow $1 mail_spool_t:dir { read getattr lock search ioctl add_name remove_name write };
 allow $1 mail_spool_t:file { create ioctl read getattr lock write setattr append link unlink rename };
 ')
@@ -286,3 +312,5 @@ type mqueue_spool_t;
 class dir { read getattr lock search ioctl add_name remove_name write };
 class file { create ioctl read getattr lock write setattr append link unlink rename }
 ')
+
+## </module>
diff --git a/refpolicy/policy/modules/system/authlogin.if b/refpolicy/policy/modules/system/authlogin.if
index b1ca874..cf84657 100644
--- a/refpolicy/policy/modules/system/authlogin.if
+++ b/refpolicy/policy/modules/system/authlogin.if
@@ -51,6 +51,10 @@ selinux_read_config($1_chkpwd_t)
 allow $1_t chkpwd_exec_t:file { getattr read execute };
 allow $1_t $1_chkpwd_t:process transition;
 type_transition $1_t chkpwd_exec_t:process $1_chkpwd_t;
+allow $1_chkpwd_t $1_t:fd use;
+allow $1_t $1_chkpwd_t:fd use;
+allow $1_chkpwd_t $1_t:fifo_file rw_file_perms;
+allow $1_chkpwd_t $1_t:process sigchld;
 
 # Write to the user domain tty.
 #userdomain_use_$1_terminal($1_chkpwd_t)
@@ -80,10 +84,12 @@ define(`authlogin_per_userdomain_template_depend',`
 attribute can_read_shadow_passwords;
 type chkpwd_exec_t, system_chkpwd_t, shadow_t;
 class file { getattr read execute };
-class process { getattr transition };
+class process { getattr transition sigchld };
 class capability setuid;
 class unix_stream_socket { create read getattr write setattr append bind connect getopt setopt shutdown };
 class unix_dgram_socket { create read getattr write setattr append bind connect getopt setopt shutdown };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 #######################################
@@ -121,12 +127,18 @@ allow $1 login_exec_t:file { getattr read execute };
 allow $1 $2:process transition;
 type_transition $1 login_exec_t:process $2;
 dontaudit $1 $2:process { noatsecure siginh rlimitinh };
+allow $1 $2:fd use;
+allow $2 $1:fd use;
+allow $2 $1:fifo_file rw_file_perms;
+allow $2 $1:process sigchld;
 ')
 
 define(`authlogin_login_program_transition_depend',`
 type login_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 #######################################
@@ -138,6 +150,10 @@ requires_block_template(`$0'_depend)
 allow $1 chkpwd_exec_t:file { getattr read execute };
 allow $1 system_chkpwd_t:process transition;
 type_transition $1 chkpwd_exec_t:process system_chkpwd_t;
+allow $1 system_chkpwd_t:fd use;
+allow system_chkpwd_t $1:fd use;
+allow system_chkpwd_t $1:fifo_file rw_file_perms;
+allow system_chkpwd_t $1:process sigchld;
 
 dontaudit $1 shadow_t:file { getattr read };
 #allow $1_t sbin_t:dir search;
@@ -161,8 +177,10 @@ sysnetwork_read_network_config($1)
 define(`authlogin_check_password_transition_depend',`
 type system_chkpwd_t, chkpwd_exec_t, shadow_t;
 class file { getattr read execute };
-class process transition;
+class process { transition sigchld };
 class udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 #######################################
@@ -267,6 +285,21 @@ class file relabelto;
 
 #######################################
 #
+# authlogin_modify_login_failure_records(domain)
+#
+define(`authlogin_modify_login_failure_records',`
+requires_block_template(`$0'_depend)
+logging_search_system_log_directory($1)
+allow $1 faillog_t:file { read write append };
+')
+
+define(`authlogin_modify_login_failure_records_depend',`
+type faillog_t;
+class file { read write append };
+')
+
+#######################################
+#
 # authlogin_modify_last_login_log(domain)
 #
 define(`authlogin_modify_last_login_log',`
@@ -297,12 +330,18 @@ allow $1 pam_exec_t:file { getattr read execute };
 allow $1 pam_t:process transition;
 type_transition $1 pam_exec_t:process pam_t;
 dontaudit $1 pam_t:process { noatsecure siginh rlimitinh };
+allow $1 pam_t:fd use;
+allow pam_t $1:fd use;
+allow pam_t $1:fifo_file rw_file_perms;
+allow pam_t $1:process sigchld;
 ')
 
 define(`authlogin_pam_transition_depend',`
 type pam_t, pam_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -394,12 +433,18 @@ allow $1 pam_console_exec_t:file { getattr read execute };
 allow $1 pam_console_t:process transition;
 type_transition $1 pam_console_exec_t:process pam_console_t;
 dontaudit $1 pam_console_t:process { noatsecure siginh rlimitinh };
+allow $1 pam_console_t:fd use;
+allow pam_console_t $1:fd use;
+allow pam_console_t $1:fifo_file rw_file_perms;
+allow pam_console_t $1:process sigchld;
 ')
 
 define(`authlogin_pam_console_transition_depend',`
 type pam_console_t, pam_console_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 #######################################
@@ -525,12 +570,18 @@ allow $1 utempter_exec_t:file { getattr read execute };
 allow $1 utempter_t:process transition;
 type_transition $1 utempter_exec_t:process utempter_t;
 dontaudit $1 utempter_t:process { noatsecure siginh rlimitinh };
+allow $1 utempter_t:fd use;
+allow utempter_t $1:fd use;
+allow utempter_t $1:fifo_file rw_file_perms;
+allow utempter_t $1:process sigchld;
 ')
 
 define(`authlogin_utempter_transition_depend',`
 type utempter_t, utempter_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/system/clock.if b/refpolicy/policy/modules/system/clock.if
index 0ba002e..73e32dd 100644
--- a/refpolicy/policy/modules/system/clock.if
+++ b/refpolicy/policy/modules/system/clock.if
@@ -17,12 +17,18 @@ allow $1 hwclock_exec_t:file { getattr read execute };
 allow $1 hwclock_t:process transition;
 type_transition $1 hwclock_exec_t:process hwclock_t;
 dontaudit $1 hwclock_t:process { noatsecure siginh rlimitinh };
+allow $1 hwclock_t:fd use;
+allow hwclock_t $1:fd use;
+allow hwclock_t $1:fifo_file rw_file_perms;
+allow hwclock_t $1:process sigchld;
 ')
 
 define(`clock_transition_depend',`
 type hwclock_t, hwclock_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/system/corecommands.if b/refpolicy/policy/modules/system/corecommands.if
index 82065f4..2fc23a0 100644
--- a/refpolicy/policy/modules/system/corecommands.if
+++ b/refpolicy/policy/modules/system/corecommands.if
@@ -54,14 +54,14 @@ define(`corecommands_execute_general_programs',`
 requires_block_template(`$0'_depend)
 allow $1 bin_t:dir { getattr search read };
 allow $1 bin_t:lnk_file { getattr read };
-allow $1 bin_t:file { getattr read ioctl execute execute_no_trans };
+allow $1 bin_t:file { getattr read ioctl lock execute execute_no_trans };
 ')
 
 define(`corecommands_execute_general_programs_depend',`
 type bin_t;
 class dir { getattr search read };
 class lnk_file { getattr read };
-class file { getattr read ioctl execute execute_no_trans };
+class file { getattr read ioctl lock execute execute_no_trans };
 ')
 
 ########################################
@@ -84,12 +84,12 @@ class dir search;
 #
 define(`corecommands_read_system_programs_directory',`
 requires_block_template(`$0'_depend)
-allow $1 sbin_t:dir { getattr search read };
+allow $1 sbin_t:dir r_dir_perms;
 ')
 
 define(`corecommands_read_system_programs_directory_depend',`
 type sbin_t;
-class dir { getattr search read };
+class dir r_dir_perms;
 ')
 
 ########################################
@@ -114,14 +114,14 @@ define(`corecommands_execute_system_programs',`
 requires_block_template(`$0'_depend)
 allow $1 sbin_t:dir { getattr search read };
 allow $1 sbin_t:lnk_file { getattr read };
-allow $1 sbin_t:file { getattr read ioctl execute execute_no_trans };
+allow $1 sbin_t:file { getattr read ioctl lock execute execute_no_trans };
 ')
 
 define(`corecommands_execute_system_programs_depend',`
 type sbin_t;
 class dir { getattr search read };
 class lnk_file { getattr read };
-class file { getattr read ioctl execute execute_no_trans };
+class file { getattr read ioctl lock execute execute_no_trans };
 ')
 
 ########################################
@@ -130,16 +130,16 @@ class file { getattr read ioctl execute execute_no_trans };
 #
 define(`corecommands_execute_shell',`
 requires_block_template(`$0'_depend)
-allow $1 bin_t:dir { getattr search read };
+allow $1 bin_t:dir r_dir_perms;
 allow $1 bin_t:lnk_file { getattr read };
-allow $1 shell_exec_t:file { getattr read execute execute_no_trans };
+allow $1 shell_exec_t:file { getattr read lock ioctl execute execute_no_trans };
 ')
 
 define(`corecommands_execute_shell_depend',`
 type bin_t, shell_exec_t;
-class dir { getattr search read };
+class dir r_dir_perms;
 class lnk_file { getattr read };
-class file { getattr read execute execute_no_trans };
+class file { getattr read lock ioctl execute execute_no_trans };
 ')
 
 ########################################
@@ -148,22 +148,24 @@ class file { getattr read execute execute_no_trans };
 #
 define(`corecommands_execute_ls',`
 requires_block_template(`$0'_depend)
-allow $1 bin_t:dir { getattr search read };
+allow $1 bin_t:dir r_dir_perms;
 allow $1 bin_t:lnk_file { getattr read };
-allow $1 ls_exec_t:file { getattr read execute execute_no_trans };
+allow $1 ls_exec_t:file { getattr read lock ioctl execute execute_no_trans };
 ')
 
 define(`corecommands_execute_shell_depend',`
 type bin_t, ls_exec_t;
-class dir { getattr search read };
+class dir r_dir_perms;
 class lnk_file { getattr read };
-class file { getattr read execute execute_no_trans };
+class file { getattr read lock ioctl execute execute_no_trans };
 ')
 
 ########################################
-## <interface name="corecommands_shell_transition">
+## <interface name="corecommands_shell_explicit_transition">
 ##	<description>
-##		Execute a shell in the target domain.
+##		Execute a shell in the target domain.  This
+##		is an explicit transition, requiring the
+##		caller to use setexeccon().
 ##	</description>
 ##	<parameter name="domain">
 ##		The type of the process performing this action.
@@ -174,22 +176,51 @@ class file { getattr read execute execute_no_trans };
 ##	<infoflow type="write" weight="10"/>
 ## </interface>
 #
-define(`corecommands_shell_transition',`
+define(`corecommands_shell_explicit_transition',`
 requires_block_template(`$0'_depend)
 allow $1 bin_t:dir { getattr search read };
 allow $1 bin_t:lnk_file { getattr read };
 allow $1 shell_exec_t:file { getattr read execute };
 allow $1 $2:process transition;
-type_transition $1 shell_exec_t:process $2;
 dontaudit $1 $2:process { noatsecure siginh rlimitinh };
+allow $1 $2:fd use;
+allow $2 $1:fd use;
+allow $2 $1:fifo_file rw_file_perms;
+allow $2 $1:process sigchld;
 ')
 
-define(`corecommands_shell_transition_depend',`
+define(`corecommands_shell_explicit_transition_depend',`
 type bin_t, shell_exec_t;
 class dir { getattr search read };
 class lnk_file { getattr read };
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
+')
+
+########################################
+## <interface name="corecommands_shell_transition">
+##	<description>
+##		Execute a shell in the target domain.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<parameter name="target_domain">
+##		The type of the shell process.
+##	</parameter>
+##	<infoflow type="write" weight="10"/>
+## </interface>
+#
+define(`corecommands_shell_transition',`
+requires_block_template(`$0'_depend)
+corecommands_shell_explicit_transition($1,$2)
+type_transition $1 shell_exec_t:process $2;
+')
+
+define(`corecommands_shell_transition_depend',`
+type shell_exec_t;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/system/domain.if b/refpolicy/policy/modules/system/domain.if
index 4ff71ac..234207d 100644
--- a/refpolicy/policy/modules/system/domain.if
+++ b/refpolicy/policy/modules/system/domain.if
@@ -278,12 +278,12 @@ class process { getattr ptrace };
 #
 define(`domain_ignore_read_all_domains_process_dirs',`
 requires_block_template(`$0'_depend)
-dontaudit $1 domain:dir { getattr search read };
+dontaudit $1 domain:dir r_dir_perms;
 ')
 
 define(`domain_ignore_read_all_domains_process_dirs_depend',`
 attribute domain;
-class dir { getattr search read };
+class dir r_dir_perms;
 ')
 
 
@@ -402,12 +402,12 @@ class fifo_file getattr;
 #
 define(`domain_execute_all_entrypoint_programs',`
 requires_block_template(`$0'_depend)
-allow $1 entry_type:file { getattr read ioctl execute execute_no_trans };
+allow $1 entry_type:file { getattr read ioctl lock execute execute_no_trans };
 ')
 
 define(`domain_execute_all_entrypoint_programs_depend',`
 attribute entry_type;
-class file { getattr read ioctl execute execute_no_trans };
+class file { getattr read ioctl lock execute execute_no_trans };
 ')
 
 ########################################
@@ -416,12 +416,14 @@ class file { getattr read ioctl execute execute_no_trans };
 #
 define(`domain_read_all_entrypoint_programs',`
 requires_block_template(`$0'_depend)
-allow $1 entry_type:{ file lnk_file } { getattr read };
+allow $1 entry_type:lnk_file { getattr read };
+allow $1 entry_type:file r_file_perms;
 ')
 
 define(`domain_read_all_entrypoint_programs_depend',`
 attribute entry_type;
-class file { getattr read };
+class file r_file_perms;
+class lnk_file { getattr read };
 ')
 
 ## </module>
diff --git a/refpolicy/policy/modules/system/files.if b/refpolicy/policy/modules/system/files.if
index 6d7c4a5..bdebc30 100644
--- a/refpolicy/policy/modules/system/files.if
+++ b/refpolicy/policy/modules/system/files.if
@@ -136,7 +136,7 @@ class sock_file getattr;
 #
 define(`files_relabel_all_files',`
 requires_block_template(`$0'_depend)
-allow $1 { file_type $2 }:dir { getattr search read relabelfrom relabelto };
+allow $1 { file_type $2 }:dir { r_dir_perms relabelfrom relabelto };
 allow $1 { file_type $2 }:file { getattr relabelfrom relabelto };
 allow $1 { file_type $2 }:lnk_file { getattr relabelfrom relabelto };
 allow $1 { file_type $2 }:fifo_file { getattr relabelfrom relabelto };
@@ -149,7 +149,7 @@ selinux_relabelto_binary_policy($1)
 
 define(`files_relabel_all_files_depend',`
 attribute file_type;
-class dir { getattr search read relabelfrom relabelto };
+class dir { r_dir_perms relabelfrom relabelto };
 class file { relabelfrom relabelto };
 class lnk_file { relabelfrom relabelto };
 class fifo_file { relabelfrom relabelto };
@@ -215,12 +215,12 @@ class dir search;
 #
 define(`files_read_all_directories',`
 requires_block_template(`$0'_depend)
-allow $1 file_type:dir { getattr search read };
+allow $1 file_type:dir r_dir_perms;
 ')
 
 define(`files_read_all_directories_depend',`
 attribute file_type;
-class dir { getattr search read };
+class dir r_dir_perms;
 ')
 
 ########################################
@@ -237,20 +237,6 @@ attribute file_type;
 class dir search;
 ')
 
-########################################
-#
-# files_read_all_directories(domain)
-#
-define(`files_read_all_directories',`
-requires_block_template(`$0'_depend)
-allow $1 file_type:dir { getattr search read };
-')
-
-define(`files_read_all_directories_depend',`
-attribute file_type;
-class dir { getattr search read };
-')
-
 #######################################
 #
 # files_relabelto_all_file_type_filesystems(domain)
@@ -313,13 +299,13 @@ class dir { getattr search mounton };
 #
 define(`files_read_root_dir',`
 requires_block_template(`$0'_depend)
-allow $1 root_t:dir { getattr search read };
+allow $1 root_t:dir r_dir_perms;
 allow $1 root_t:lnk_file { getattr read };
 ')
 
 define(`files_read_root_dir_depend',`
 type root_t;
-class dir { getattr search read };
+class dir r_dir_perms;
 class lnk_file { getattr read };
 ')
 
@@ -329,12 +315,12 @@ class lnk_file { getattr read };
 #
 define(`files_create_root_dir_entry',`
 requires_block_template(`$0'_depend)
-allow $1 root_t:dir { getattr search read write add_name };
+allow $1 root_t:dir ra_dir_perms;
 ')
 
 define(`files_create_root_dir_entry_depend',`
 type root_t;
-class dir { getattr search read write add_name };
+class dir ra_dir_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/system/getty.if b/refpolicy/policy/modules/system/getty.if
index 41a67b2..4c55da3 100644
--- a/refpolicy/policy/modules/system/getty.if
+++ b/refpolicy/policy/modules/system/getty.if
@@ -10,12 +10,18 @@ allow $1 getty_exec_t:file { getattr read execute };
 allow $1 getty_t:process transition;
 type_transition $1 getty_exec_t:process getty_t;
 dontaudit $1 getty_t:process { noatsecure siginh rlimitinh };
+allow $1 getty_t:fd use;
+allow getty_t $1:fd use;
+allow getty_t $1:fifo_file rw_file_perms;
+allow getty_t $1:process sigchld;
 ')
 
 define(`getty_transition_depend',`
 type getty_t, getty_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 #######################################
diff --git a/refpolicy/policy/modules/system/getty.te b/refpolicy/policy/modules/system/getty.te
index 9536e3e..ce2f2a6 100644
--- a/refpolicy/policy/modules/system/getty.te
+++ b/refpolicy/policy/modules/system/getty.te
@@ -2,6 +2,11 @@
 
 policy_module(getty,1.0)
 
+########################################
+#
+# Declarations
+#
+
 type getty_t;
 type getty_exec_t;
 init_make_init_domain(getty_t,getty_exec_t)
@@ -30,9 +35,12 @@ allow getty_t self:process { getpgid getsession };
 
 allow getty_t getty_etc_t:dir { getattr search read };
 allow getty_t getty_etc_t:file { getattr read };
+files_create_private_config(getty_t,getty_etc_t,{ file dir })
 
 allow getty_t getty_tmp_t:file { getattr create read setattr write setattr unlink };
 allow getty_t getty_tmp_t:dir { getattr search create read setattr write setattr unlink rmdir };
+files_create_private_tmp_data(getty_t,getty_tmp_t,{ file dir })
+
 allow getty_t getty_log_t:file { getattr append setattr };
 
 kernel_read_hardware_state(getty_t)
@@ -48,8 +56,6 @@ init_script_modify_runtime_data(getty_t)
 init_script_use_pseudoterminal(getty_t)
 
 files_modify_system_runtime_data(getty_t)
-files_create_private_config(getty_t,getty_etc_t,{ file dir })
-files_create_private_tmp_data(getty_t,getty_tmp_t,{ file dir })
 files_manage_system_lock_files(getty_t)
 files_read_runtime_system_config(getty_t)
 files_read_general_system_config(getty_t)
diff --git a/refpolicy/policy/modules/system/hostname.if b/refpolicy/policy/modules/system/hostname.if
index e7ec93d..5a47de8 100644
--- a/refpolicy/policy/modules/system/hostname.if
+++ b/refpolicy/policy/modules/system/hostname.if
@@ -9,6 +9,7 @@
 ##	</description>
 ##	<parameter name="domain">
 ##		The type of the process performing this action.
+##		Has a sigchld signal backchannel.
 ##	</parameter>
 ##	<infoflow type="write" weight="10"/>
 ## </interface>
@@ -19,12 +20,18 @@ allow $1 hostname_exec_t:file { getattr read execute };
 allow $1 hostname_t:process transition;
 type_transition $1 hostname_exec_t:process hostname_t;
 dontaudit $1 hostname_t:process { noatsecure siginh rlimitinh };
+allow $1 hostname_t:fd use;
+allow hostname_t $1:fd use;
+allow hostname_t $1:fifo_file rw_file_perms;
+allow hostname_t $1:process sigchld;
 ')
 
 define(`hostname_transition_depend',`
 type hostname_t, hostname_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -32,6 +39,7 @@ class process { transition noatsecure siginh rlimitinh };
 ##	<description>
 ##		Execute hostname in the hostname domain, and
 ##		allow the specified role the hostname domain.
+##		Has a sigchld signal backchannel.
 ##	</description>
 ##	<parameter name="domain">
 ##		The type of the process performing this action.
diff --git a/refpolicy/policy/modules/system/hotplug.if b/refpolicy/policy/modules/system/hotplug.if
index e4002c9..e9a49c6 100644
--- a/refpolicy/policy/modules/system/hotplug.if
+++ b/refpolicy/policy/modules/system/hotplug.if
@@ -1,4 +1,9 @@
 # Copyright (C) 2005 Tresys Technology, LLC
+## <module name="hotplug" layer="system">
+## <summary>
+##	Policy for hotplug system, for supporting the
+##	connection and disconnection of devices at runtime.
+## </summary>
 
 #######################################
 #
@@ -10,12 +15,18 @@ allow $1 hotplug_exec_t:file { getattr read execute };
 allow $1 hotplug_t:process transition;
 type_transition $1 hotplug_exec_t:process hotplug_t;
 dontaudit $1 hotplug_t:process { noatsecure siginh rlimitinh };
+allow $1 hotplug_t:fd use;
+allow hotplug_t $1:fd use;
+allow hotplug_t $1:fifo_file rw_file_perms;
+allow hotplug_t $1:process sigchld;
 ')
 
 define(`hotplug_transition_depend',`
 type hotplug_t, hotplug_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 #######################################
@@ -99,3 +110,5 @@ class file { read getattr lock ioctl };
 class dir { read getattr lock search ioctl };
 class lnk_file { getattr read };
 ')
+
+## </module>
diff --git a/refpolicy/policy/modules/system/init.if b/refpolicy/policy/modules/system/init.if
index 1d1f5e9..db255bb 100644
--- a/refpolicy/policy/modules/system/init.if
+++ b/refpolicy/policy/modules/system/init.if
@@ -13,13 +13,18 @@ allow init_t $1:process transition;
 allow init_t $2:file { getattr read execute };
 dontaudit init_t $1:process { noatsecure siginh rlimitinh };
 type_transition init_t $2:process $1;
+allow $1 init_t:fd use;
+allow init_t $1:fd use;
+allow $1 init_t:fifo_file rw_file_perms;
+allow $1 init_t:process sigchld;
 ')
 
 define(`init_make_init_domain_depend',`
 type init_t;
 class file { getattr read execute };
 class fd use;
-class process { transition noatsecure siginh rlimitinh };
+class fifo_file rw_file_perms;
+class process { transition noatsecure siginh rlimitinh sigchld };
 role system_r;
 ')
 
@@ -36,17 +41,16 @@ allow initrc_t $1:process transition;
 allow initrc_t $2:file { getattr read execute };
 dontaudit initrc_t $1:process { noatsecure siginh rlimitinh };
 type_transition initrc_t $2:process $1;
+allow initrc_t $1:fd use;
 allow $1 initrc_t:fd use;
-# backchannels:
+allow $1 initrc_t:fifo_file rw_file_perms;
 allow $1 initrc_t:process sigchld;
-# cjp: probably for logging
-allow $1 initrc_t:fifo_file { getattr write };
 ')
 
 define(`init_make_daemon_domain_depend',`
 type initrc_t;
 class file { getattr read execute };
-class fifo_file { getattr write };
+class fifo_file rw_file_perms;
 class fd use;
 class process { transition noatsecure siginh rlimitinh sigchld };
 role system_r;
@@ -65,18 +69,17 @@ allow initrc_t $1:process transition;
 allow initrc_t $2:file { getattr read execute };
 dontaudit initrc_t $1:process { noatsecure siginh rlimitinh };
 type_transition initrc_t $2:process $1;
+allow initrc_t $1:fd use;
 allow $1 initrc_t:fd use;
-# backchannels:
+allow $1 initrc_t:fifo_file rw_file_perms;
 allow $1 initrc_t:process sigchld;
-# cjp: probably for logging
-allow $1 initrc_t:fifo_file { getattr write };
 ')
 
 define(`init_make_system_domain_depend',`
 type initrc_t;
 class file { getattr read execute };
 class fd use;
-class fifo_file { getattr write };
+class fifo_file rw_file_perms;
 class process { transition noatsecure siginh rlimitinh sigchld };
 role system_r;
 ')
@@ -91,12 +94,18 @@ allow $1 init_exec_t:file { getattr read execute };
 allow $1 init_t:process transition;
 type_transition $1 init_exec_t:process init_t;
 dontaudit $1 init_t:process { noatsecure siginh rlimitinh };
+allow $1 init_t:fd use;
+allow init_t $1:fd use;
+allow init_t $1:fifo_file rw_file_perms;
+allow init_t $1:process sigchld;
 ')
 
 define(`init_transition_depend',`
 type init_t, init_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -222,12 +231,18 @@ allow $1 initrc_exec_t:file { getattr read execute };
 allow $1 initrc_t:process transition;
 type_transition $1 initrc_exec_t:process init_t;
 dontaudit $1 init_t:process { noatsecure siginh rlimitinh };
+allow $1 initrc_t:fd use;
+allow initrc_t $1:fd use;
+allow initrc_t $1:fifo_file rw_file_perms;
+allow initrc_t $1:process sigchld;
 ')
 
 define(`init_script_transition_depend',`
 type initrc_t, initrc_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -277,26 +292,6 @@ class process { getattr ptrace };
 
 ########################################
 #
-# init_script_direct_admin_transition(role,domain)
-#
-define(`init_script_direct_admin_transition',`
-requires_block_template(`$0'_depend)
-allow $2 initrc_exec_t:file { getattr read execute };
-allow $2 initrc_t:process transition;
-type_transition $2 initrc_exec_t:file init_t;
-role_transition $1 initrc_exec_t system_r;
-dontaudit $2 init_t:process { noatsecure siginh rlimitinh };
-')
-
-define(`init_script_direct_admin_transition_depend',`
-type initrc_t, initrc_exec_t;
-class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
-kernel_system_role_transition_depend
-')
-
-########################################
-#
 # init_script_use_file_descriptors(domain)
 #
 define(`init_script_use_file_descriptors',`
diff --git a/refpolicy/policy/modules/system/iptables.if b/refpolicy/policy/modules/system/iptables.if
index b8e9aa0..c0d6335 100644
--- a/refpolicy/policy/modules/system/iptables.if
+++ b/refpolicy/policy/modules/system/iptables.if
@@ -17,12 +17,18 @@ allow $1 iptables_exec_t:file { getattr read execute };
 allow $1 iptables_t:process transition;
 type_transition $1 iptables_exec_t:process iptables_t;
 dontaudit $1 iptables_t:process { noatsecure siginh rlimitinh };
+allow $1 iptables_t:fd use;
+allow iptables_t $1:fd use;
+allow iptables_t $1:fifo_file rw_file_perms;
+allow iptables_t $1:process sigchld;
 ')
 
 define(`iptables_transition_depend',`
 type iptables_t, iptables_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/system/libraries.if b/refpolicy/policy/modules/system/libraries.if
index 9600fa0..12379bc 100644
--- a/refpolicy/policy/modules/system/libraries.if
+++ b/refpolicy/policy/modules/system/libraries.if
@@ -19,12 +19,18 @@ allow $1 ldconfig_exec_t:file { getattr read execute };
 allow $1 ldconfig_t:process transition;
 type_transition $1 ldconfig_exec_t:process ldconfig_t;
 dontaudit $1 ldconfig_t:process { noatsecure siginh rlimitinh };
+allow $1 ldconfig_t:fd use;
+allow ldconfig_t $1:fd use;
+allow ldconfig_t $1:fifo_file rw_file_perms;
+allow ldconfig_t $1:process sigchld;
 ')
 
 define(`libraries_ldconfig_transition_depend',`
 type ldconfig_t, ldconfig_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -71,18 +77,18 @@ class chr_file { getattr read write ioctl };
 define(`libraries_use_dynamic_loader',`
 requires_block_template(`$0'_depend)
 files_read_general_system_config_directory($1)
-allow $1 lib_t:dir { getattr search read };
-allow $1 lib_t:lnk_file { getattr read };
-allow $1 ld_so_t:lnk_file { getattr read };
-allow $1 ld_so_t:file { getattr read execute };
-allow $1 ld_so_cache_t:file { getattr read };
+allow $1 lib_t:dir r_dir_perms;
+allow $1 lib_t:lnk_file r_file_perms;
+allow $1 ld_so_t:lnk_file r_file_perms;
+allow $1 ld_so_t:file rx_file_perms;
+allow $1 ld_so_cache_t:file r_file_perms;
 ')
 
 define(`libraries_use_dynamic_loader_depend',`
 type lib_t, ld_so_t, ld_so_cache_t;
-class dir { getattr search read };
-class lnk_file { getattr read };
-class file { getattr read execute };
+class dir r_dir_perms;
+class lnk_file r_file_perms;
+class file rx_file_perms;
 ')
 
 ########################################
@@ -127,17 +133,17 @@ class file { execute execmod };
 #
 define(`libraries_execute_dynamic_loader',`
 requires_block_template(`$0'_depend)
-allow $1 lib_t:dir { getattr search read };
-allow $1 lib_t:lnk_file { getattr read };
-allow $1 ld_so_t:lnk_file { getattr read };
-allow $1 ld_so_t:file { getattr read execute execute_no_trans };
+allow $1 lib_t:dir r_dir_perms;
+allow $1 lib_t:lnk_file r_file_perms;
+allow $1 ld_so_t:lnk_file r_file_perms;
+allow $1 ld_so_t:file { r_file_perms execute execute_no_trans };
 ')
 
 define(`libraries_execute_dynamic_loader_depend',`
 type lib_t, ld_so_t;
-class dir { getattr search read };
-class lnk_file { getattr read };
-class file { getattr read execute execute_no_trans };
+class dir r_dir_perms;
+class lnk_file r_file_perms;
+class file { r_file_perms execute execute_no_trans };
 ')
 
 ########################################
@@ -227,17 +233,17 @@ class file { getattr read execute execute_no_trans };
 define(`libraries_use_shared_libraries',`
 requires_block_template(`$0'_depend)
 files_search_general_application_resources_dir($1)
-allow $1 lib_t:dir { getattr search read };
-allow $1 lib_t:lnk_file { getattr read };
-allow $1 { shlib_t texrel_shlib_t }:lnk_file { getattr read };
-allow $1 { shlib_t texrel_shlib_t }:file { getattr read execute };
+allow $1 lib_t:dir r_dir_perms;
+allow $1 lib_t:lnk_file r_file_perms;
+allow $1 { shlib_t texrel_shlib_t }:lnk_file r_file_perms;
+allow $1 { shlib_t texrel_shlib_t }:file rx_file_perms;
 ')
 
 define(`libraries_use_shared_libraries_depend',`
 type lib_t, shlib_t, texrel_shlib_t;
-class dir { getattr searc read };
-class lnk_file { getattr read };
-class file { getattr read execute };
+class dir r_dir_perms;
+class lnk_file r_file_perms;
+class file rx_dir_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/system/locallogin.te b/refpolicy/policy/modules/system/locallogin.te
index 9a611c6..2426a07 100644
--- a/refpolicy/policy/modules/system/locallogin.te
+++ b/refpolicy/policy/modules/system/locallogin.te
@@ -66,11 +66,16 @@ devices_get_pseudorandom_data(local_login_t)
 
 terminal_use_all_private_physical_terminals(local_login_t)
 terminal_use_general_physical_terminal(local_login_t)
+terminal_relabel_general_physical_terminal(local_login_t)
+terminal_relabel_all_private_physical_terminals(local_login_t)
+terminal_set_all_private_physical_terminal_attributes(local_login_t)
+terminal_set_general_physical_terminal_attributes(local_login_t)
 
 authlogin_check_password_transition(local_login_t)
 authlogin_ignore_read_shadow_passwords(local_login_t)
 authlogin_modify_login_records(local_login_t)
 authlogin_modify_last_login_log(local_login_t)
+authlogin_modify_login_failure_records(local_login_t)
 authlogin_pam_execute(local_login_t)
 authlogin_pam_console_manage_runtime_data(local_login_t)
 
@@ -78,8 +83,8 @@ domain_read_all_entrypoint_programs(local_login_t)
 
 files_read_general_system_config(local_login_t)
 files_read_runtime_system_config(local_login_t)
-files_list_home_directories(local_login_t)
 files_read_general_application_resources(local_login_t)
+files_manage_system_lock_files(var_lock_t)
 
 init_script_modify_runtime_data(local_login_t)
 init_ignore_use_file_descriptors(local_login_t)
@@ -94,8 +99,14 @@ miscfiles_read_localization(local_login_t)
 selinux_read_config(local_login_t)
 selinux_read_default_contexts(local_login_t)
 
+userdomain_all_users_explicit_transition(local_login_t)
+userdomain_signal_all_userdomains(local_login_t)
+userdomain_search_all_users_home_dirs(local_login_t)
 userdomain_use_all_unprivileged_users_file_descriptors(local_login_t)
 
+# Search for mail spool file.
+mta_get_mail_spool_attributes(local_login_t)
+
 ifdef(`TODO',`
 
 can_ypbind(local_login_t)
@@ -117,15 +128,9 @@ allow local_login_t default_t:notdevfile_class_set r_file_perms;
 allow local_login_t readable_t:dir r_dir_perms;
 allow local_login_t readable_t:notdevfile_class_set r_file_perms;
 
-# Read /var, /var/spool
-allow local_login_t { var_t var_spool_t }:dir search;
-
 # for when /var/mail is a sym-link
 allow local_login_t var_t:lnk_file read;
 
-# Read /dev directories and any symbolic links.
-allow local_login_t device_t:lnk_file r_file_perms;
-
 dontaudit local_login_t sysfs_t:dir search;
 
 allow local_login_t autofs_t:dir { search read getattr };
@@ -140,18 +145,6 @@ ifdef(`crack.te', `
 allow local_login_t crack_db_t:file r_file_perms;
 ')
 
-# Permit login to search the user home directories.
-allow local_login_t home_root_t:dir search;
-allow local_login_t home_dir_type:dir search;
-
-# Write to /var/log/btmp
-allow local_login_t faillog_t:file { append read write };
-
-# Search for mail spool file.
-allow local_login_t mail_spool_t:dir r_dir_perms;
-allow local_login_t mail_spool_t:file getattr;
-allow local_login_t mail_spool_t:lnk_file read;
-
 allow local_login_t mouse_device_t:chr_file { getattr setattr };
 
 tunable_policy(`targeted_policy',`
@@ -159,10 +152,6 @@ unconfined_domain(local_login_t)
 domain_auto_trans(local_login_t, shell_exec_t, unconfined_t)
 ')
 
-# But also permit other user domains to be entered by login.
-domain_trans(local_login_t, shell_exec_t, userdomain)
-allow local_login_t userdomain:process signal;
-
 # Do not audit denied attempts to access devices.
 dontaudit local_login_t fixed_disk_device_t:blk_file { getattr setattr };
 dontaudit local_login_t removable_device_t:blk_file { getattr setattr };
@@ -177,18 +166,6 @@ dontaudit local_login_t scanner_device_t:chr_file { getattr setattr };
 # Do not audit denied attempts to access /mnt.
 dontaudit local_login_t mnt_t:dir r_dir_perms;
 
-# Create lock file.
-allow local_login_t var_lock_t:dir rw_dir_perms;
-allow local_login_t var_lock_t:file create_file_perms;
-
-# Read and write ttys.
-allow local_login_t tty_device_t:chr_file setattr;
-allow local_login_t ttyfile:chr_file setattr;
-
-# Relabel ttys.
-allow local_login_t tty_device_t:chr_file { relabelfrom relabelto };
-allow local_login_t ttyfile:chr_file { relabelfrom relabelto };
-
 optional_policy(`gpm.te',`
 allow local_login_t gpmctl_t:sock_file { getattr setattr };
 ')
@@ -241,6 +218,7 @@ selinux_read_default_contexts(sulogin_t)
 
 authlogin_read_shadow_passwords(sulogin_t)
 
+userdomain_sysadm_shell_transition(sulogin_t)
 userdomain_use_all_unprivileged_users_file_descriptors(sulogin_t)
 
 # suse and debian do not use pam with sulogin...
@@ -264,7 +242,6 @@ kernel_compute_selinux_reachable_user_contexts(sulogin_t)
 
 ifdef(`TODO',`
 
-domain_auto_trans(sulogin_t, shell_exec_t, sysadm_t)
 allow sulogin_t sysadm_devpts_t:chr_file { getattr ioctl read write };
 
 can_ypbind(sulogin_t)
diff --git a/refpolicy/policy/modules/system/lvm.if b/refpolicy/policy/modules/system/lvm.if
index d84f8d2..4c9437c 100644
--- a/refpolicy/policy/modules/system/lvm.if
+++ b/refpolicy/policy/modules/system/lvm.if
@@ -1,4 +1,6 @@
 # Copyright (C) 2005 Tresys Technology, LLC
+## <module name="lvm" layer="system">
+## <summary>Policy for logical volume management programs.</summary>
 
 ########################################
 ## <interface name="lvm_transition">
@@ -17,12 +19,18 @@ allow $1 lvm_exec_t:file { getattr read execute };
 allow $1 lvm_t:process transition;
 type_transition $1 lvm_exec_t:process lvm_t;
 dontaudit $1 lvm_t:process { noatsecure siginh rlimitinh };
+allow $1 lvm_t:fd use;
+allow lvm_t $1:fd use;
+allow lvm_t $1:fifo_file rw_file_perms;
+allow lvm_t $1:process sigchld;
 ')
 
 define(`lvm_transition_depend',`
 type lvm_t, lvm_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -76,3 +84,4 @@ type lvm_t, lvm_exec_t;
 class file { getattr read };
 ')
 
+## </module>
diff --git a/refpolicy/policy/modules/system/modutils.if b/refpolicy/policy/modules/system/modutils.if
index b124ce3..5066301 100644
--- a/refpolicy/policy/modules/system/modutils.if
+++ b/refpolicy/policy/modules/system/modutils.if
@@ -65,7 +65,9 @@ allow $1 insmod_exec_t:file { getattr read execute };
 allow $1 insmod_t:process transition;
 type_transition $1 insmod_exec_t:process insmod_t;
 dontaudit $1 insmod_t:process { noatsecure siginh rlimitinh };
-# backchannel:
+allow $1 insmod_t:fd use;
+allow insmod_t $1:fd use;
+allow insmod_t $1:fifo_file rw_file_perms;
 allow insmod_t $1:process sigchld;
 ')
 
@@ -73,6 +75,8 @@ define(`modutils_insmod_transition_depend',`
 type insmod_t;
 class file { getattr read execute };
 class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -138,12 +142,18 @@ allow $1 depmod_exec_t:file { getattr read execute };
 allow $1 depmod_t:process transition;
 type_transition $1 depmod_exec_t:process depmod_t;
 dontaudit $1 depmod_t:process { noatsecure siginh rlimitinh };
+allow $1 depmod_t:fd use;
+allow depmod_t $1:fd use;
+allow depmod_t $1:fifo_file rw_file_perms;
+allow depmod_t $1:process sigchld;
 ')
 
 define(`modutils_depmod_transition_depend',`
 type depmod_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -206,12 +216,18 @@ allow $1 update_modules_exec_t:file { getattr read execute };
 allow $1 update_modules_t:process transition;
 type_transition $1 update_modules_exec_t:process update_modules_t;
 dontaudit $1 update_modules_t:process { noatsecure siginh rlimitinh };
+allow $1 update_modules_t:fd use;
+allow update_modules_t $1:fd use;
+allow update_modules_t $1:fifo_file rw_file_perms;
+allow update_modules_t $1:process sigchld;
 ')
 
 define(`modutils_update_modules_transition_depend',`
 type update_modules_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh signal };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/system/mount.if b/refpolicy/policy/modules/system/mount.if
index 51bfc3b..574bf39 100644
--- a/refpolicy/policy/modules/system/mount.if
+++ b/refpolicy/policy/modules/system/mount.if
@@ -17,12 +17,18 @@ allow $1 mount_exec_t:file { getattr read execute };
 allow $1 mount_t:process transition;
 type_transition $1 mount_exec_t:process mount_t;
 dontaudit $1 mount_t:process { noatsecure siginh rlimitinh };
+allow $1 mount_t:fd use;
+allow mount_t $1:fd use;
+allow mount_t $1:fifo_file rw_file_perms;
+allow mount_t $1:process sigchld;
 ')
 
 define(`mount_transition_depend',`
 type mount_t, mount_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/system/selinux.if b/refpolicy/policy/modules/system/selinux.if
index fd97ed4..8700646 100644
--- a/refpolicy/policy/modules/system/selinux.if
+++ b/refpolicy/policy/modules/system/selinux.if
@@ -19,12 +19,18 @@ allow $1 checkpolicy_exec_t:file { getattr read execute };
 allow $1 checkpolicy_t:process transition;
 type_transition $1 checkpolicy_exec_t:process checkpolicy_t;
 dontaudit $1 checkpolicy_t:process { noatsecure siginh rlimitinh };
+allow $1 checkpolicy_t:fd use;
+allow checkpolicy_t $1:fd use;
+allow checkpolicy_t $1:fifo_file rw_file_perms;
+allow checkpolicy_t $1:process sigchld;
 ')
 
 define(`selinux_checkpolicy_transition_depend',`
 type checkpolicy_t, checkpolicy_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -33,6 +39,7 @@ class process { transition noatsecure siginh rlimitinh };
 ##		Execute checkpolicy in the checkpolicy domain, and
 ##		allow the specified role the checkpolicy domain,
 ##		and use the caller's terminal.
+##		Has a SIGCHLD signal backchannel.
 ##	</description>
 ##	<parameter name="domain">
 ##		The type of the process performing this action.
@@ -89,12 +96,18 @@ allow $1 load_policy_exec_t:file { getattr read execute };
 allow $1 load_policy_t:process transition;
 type_transition $1 load_policy_exec_t:process load_policy_t;
 dontaudit $1 load_policy_t:process { noatsecure siginh rlimitinh };
+allow $1 load_policy_t:fd use;
+allow load_policy_t $1:fd use;
+allow load_policy_t $1:fifo_file rw_file_perms;
+allow load_policy_t $1:process sigchld;
 ')
 
 define(`selinux_load_policy_transition_depend',`
 type load_policy_t, load_policy_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -103,6 +116,7 @@ class process { transition noatsecure siginh rlimitinh };
 ##		Execute load_policy in the load_policy domain, and
 ##		allow the specified role the load_policy domain,
 ##		and use the caller's terminal.
+##		Has a SIGCHLD signal backchannel.
 ##	</description>
 ##	<parameter name="domain">
 ##		The type of the process performing this action.
@@ -173,12 +187,18 @@ allow $1 newrole_exec_t:file { getattr read execute };
 allow $1 newrole_t:process transition;
 type_transition $1 newrole_exec_t:process newrole_t;
 dontaudit $1 newrole_t:process { noatsecure siginh rlimitinh };
+allow $1 newrole_t:fd use;
+allow newrole_t $1:fd use;
+allow newrole_t $1:fifo_file rw_file_perms;
+allow newrole_t $1:process sigchld;
 ')
 
 define(`selinux_newrole_transition_depend',`
 type newrole_t, newrole_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -293,12 +313,18 @@ allow $1 restorecon_exec_t:file { getattr read execute };
 allow $1 restorecon_t:process transition;
 type_transition $1 restorecon_exec_t:process restorecon_t;
 dontaudit $1 restorecon_t:process { noatsecure siginh rlimitinh };
+allow $1 restorecon_t:fd use;
+allow restorecon_t $1:fd use;
+allow restorecon_t $1:fifo_file rw_file_perms;
+allow restorecon_t $1:process sigchld;
 ')
 
 define(`selinux_restorecon_transition_depend',`
 type restorecon_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -363,12 +389,18 @@ allow $1 run_init_exec_t:file { getattr read execute };
 allow $1 run_init_t:process transition;
 type_transition $1 run_init_exec_t:process run_init_t;
 dontaudit $1 run_init_t:process { noatsecure siginh rlimitinh };
+allow $1 run_init_t:fd use;
+allow run_init_t $1:fd use;
+allow run_init_t $1:fifo_file rw_file_perms;
+allow run_init_t $1:process sigchld;
 ')
 
 define(`selinux_run_init_transition_depend',`
 type run_init_t, run_init_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -433,12 +465,18 @@ allow $1 setfiles_exec_t:file { getattr read execute };
 allow $1 setfiles_t:process transition;
 type_transition $1 setfiles_exec_t:process setfiles_t;
 dontaudit $1 setfiles_t:process { noatsecure siginh rlimitinh };
+allow $1 setfiles_t:fd use;
+allow setfiles_t $1:fd use;
+allow setfiles_t $1:fifo_file rw_file_perms;
+allow setfiles_t $1:process sigchld;
 ')
 
 define(`selinux_setfiles_transition_depend',`
 type setfiles_t, setfiles_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/system/selinuxutil.if b/refpolicy/policy/modules/system/selinuxutil.if
index fd97ed4..8700646 100644
--- a/refpolicy/policy/modules/system/selinuxutil.if
+++ b/refpolicy/policy/modules/system/selinuxutil.if
@@ -19,12 +19,18 @@ allow $1 checkpolicy_exec_t:file { getattr read execute };
 allow $1 checkpolicy_t:process transition;
 type_transition $1 checkpolicy_exec_t:process checkpolicy_t;
 dontaudit $1 checkpolicy_t:process { noatsecure siginh rlimitinh };
+allow $1 checkpolicy_t:fd use;
+allow checkpolicy_t $1:fd use;
+allow checkpolicy_t $1:fifo_file rw_file_perms;
+allow checkpolicy_t $1:process sigchld;
 ')
 
 define(`selinux_checkpolicy_transition_depend',`
 type checkpolicy_t, checkpolicy_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -33,6 +39,7 @@ class process { transition noatsecure siginh rlimitinh };
 ##		Execute checkpolicy in the checkpolicy domain, and
 ##		allow the specified role the checkpolicy domain,
 ##		and use the caller's terminal.
+##		Has a SIGCHLD signal backchannel.
 ##	</description>
 ##	<parameter name="domain">
 ##		The type of the process performing this action.
@@ -89,12 +96,18 @@ allow $1 load_policy_exec_t:file { getattr read execute };
 allow $1 load_policy_t:process transition;
 type_transition $1 load_policy_exec_t:process load_policy_t;
 dontaudit $1 load_policy_t:process { noatsecure siginh rlimitinh };
+allow $1 load_policy_t:fd use;
+allow load_policy_t $1:fd use;
+allow load_policy_t $1:fifo_file rw_file_perms;
+allow load_policy_t $1:process sigchld;
 ')
 
 define(`selinux_load_policy_transition_depend',`
 type load_policy_t, load_policy_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -103,6 +116,7 @@ class process { transition noatsecure siginh rlimitinh };
 ##		Execute load_policy in the load_policy domain, and
 ##		allow the specified role the load_policy domain,
 ##		and use the caller's terminal.
+##		Has a SIGCHLD signal backchannel.
 ##	</description>
 ##	<parameter name="domain">
 ##		The type of the process performing this action.
@@ -173,12 +187,18 @@ allow $1 newrole_exec_t:file { getattr read execute };
 allow $1 newrole_t:process transition;
 type_transition $1 newrole_exec_t:process newrole_t;
 dontaudit $1 newrole_t:process { noatsecure siginh rlimitinh };
+allow $1 newrole_t:fd use;
+allow newrole_t $1:fd use;
+allow newrole_t $1:fifo_file rw_file_perms;
+allow newrole_t $1:process sigchld;
 ')
 
 define(`selinux_newrole_transition_depend',`
 type newrole_t, newrole_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -293,12 +313,18 @@ allow $1 restorecon_exec_t:file { getattr read execute };
 allow $1 restorecon_t:process transition;
 type_transition $1 restorecon_exec_t:process restorecon_t;
 dontaudit $1 restorecon_t:process { noatsecure siginh rlimitinh };
+allow $1 restorecon_t:fd use;
+allow restorecon_t $1:fd use;
+allow restorecon_t $1:fifo_file rw_file_perms;
+allow restorecon_t $1:process sigchld;
 ')
 
 define(`selinux_restorecon_transition_depend',`
 type restorecon_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -363,12 +389,18 @@ allow $1 run_init_exec_t:file { getattr read execute };
 allow $1 run_init_t:process transition;
 type_transition $1 run_init_exec_t:process run_init_t;
 dontaudit $1 run_init_t:process { noatsecure siginh rlimitinh };
+allow $1 run_init_t:fd use;
+allow run_init_t $1:fd use;
+allow run_init_t $1:fifo_file rw_file_perms;
+allow run_init_t $1:process sigchld;
 ')
 
 define(`selinux_run_init_transition_depend',`
 type run_init_t, run_init_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
@@ -433,12 +465,18 @@ allow $1 setfiles_exec_t:file { getattr read execute };
 allow $1 setfiles_t:process transition;
 type_transition $1 setfiles_exec_t:process setfiles_t;
 dontaudit $1 setfiles_t:process { noatsecure siginh rlimitinh };
+allow $1 setfiles_t:fd use;
+allow setfiles_t $1:fd use;
+allow setfiles_t $1:fifo_file rw_file_perms;
+allow setfiles_t $1:process sigchld;
 ')
 
 define(`selinux_setfiles_transition_depend',`
 type setfiles_t, setfiles_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/system/sysnetwork.if b/refpolicy/policy/modules/system/sysnetwork.if
index 9a88945..0de49c3 100644
--- a/refpolicy/policy/modules/system/sysnetwork.if
+++ b/refpolicy/policy/modules/system/sysnetwork.if
@@ -10,12 +10,18 @@ allow $1 dhcpc_exec_t:file { getattr read execute };
 allow $1 dhcpc_t:process transition;
 type_transition $1 dhcpc_exec_t:process dhcpc_t;
 dontaudit $1 dhcpc_t:process { noatsecure siginh rlimitinh };
+allow $1 dhcpc_t:fd use;
+allow dhcpc_t $1:fd use;
+allow dhcpc_t $1:fifo_file rw_file_perms;
+allow dhcpc_t $1:process sigchld;
 ')
 
 define(`sysnetwork_dhcpc_transition_depend',`
 type dhcpc_t, dhcpc_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 #######################################
@@ -35,12 +41,18 @@ allow $1 ifconfig_exec_t:file { getattr read execute };
 allow $1 ifconfig_t:process transition;
 type_transition $1 ifconfig_exec_t:process ifconfig_t;
 dontaudit $1 ifconfig_t:process { noatsecure siginh rlimitinh };
+allow $1 ifconfig_t:fd use;
+allow ifconfig_t $1:fd use;
+allow ifconfig_t $1:fifo_file rw_file_perms;
+allow ifconfig_t $1:process sigchld;
 ')
 
 define(`sysnetwork_ifconfig_transition_depend',`
 type ifconfig_t, ifconfig_exec_t;
 class file { getattr read execute };
-class process { transition noatsecure siginh rlimitinh };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/system/udev.if b/refpolicy/policy/modules/system/udev.if
index cab73b6..bcf83b8 100644
--- a/refpolicy/policy/modules/system/udev.if
+++ b/refpolicy/policy/modules/system/udev.if
@@ -10,8 +10,9 @@ allow $1 udev_exec_t:file { getattr read execute };
 allow $1 udev_t:process transition;
 type_transition $1 udev_exec_t:process udev_t;
 dontaudit $1 udev_t:process { noatsecure siginh rlimitinh };
-# backchannels:
+allow $1 udev_t:fd use;
 allow udev_t $1:fd use;
+allow udev_t $1:fifo_file rw_file_perms;
 allow udev_t $1:process sigchld;
 ')
 
@@ -19,6 +20,8 @@ define(`udev_transition_depend',`
 type udev_t, udev_exec_t;
 class file { getattr read execute };
 class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/system/userdomain.if b/refpolicy/policy/modules/system/userdomain.if
index 882fa9f..0971b72 100644
--- a/refpolicy/policy/modules/system/userdomain.if
+++ b/refpolicy/policy/modules/system/userdomain.if
@@ -150,6 +150,7 @@ authlogin_utempter_transition_add_role_use_terminal($1_t,$1_r,{ $1_tty_device_t 
 
 corecommands_execute_general_programs($1_t)
 corecommands_execute_system_programs($1_t)
+corecommands_execute_ls($1_t)
 
 domain_execute_all_entrypoint_programs($1_t)
 domain_use_widely_inheritable_file_descriptors($1_t)
@@ -809,6 +810,28 @@ allow $1_t eventpollfs_t:file getattr;
 ')
 
 ########################################
+## <interface name="userdomain_all_users_explicit_transition">
+##	<description>
+##		Execute a shell in all user domains.  This
+##		is an explicit transition, requiring the
+##		caller to use setexeccon().
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<infoflow type="write" weight="10"/>
+## </interface>
+#
+define(`userdomain_all_users_explicit_transition',`
+requires_block_template(`$0'_depend)
+corecommands_shell_explicit_transition($1,userdomain)
+')
+
+define(`userdomain_all_users_explicit_transition_depend',`
+type sysadm_t;
+')
+
+########################################
 ## <interface name="userdomain_sysadm_shell_transition">
 ##	<description>
 ##		Execute a shell in the sysadm domain.
@@ -853,14 +876,36 @@ class chr_file { getattr read write ioctl };
 ')
 
 ########################################
+## <interface name="userdomain_search_all_users_home_dirs">
+##	<description>
+##		Search all users home directories.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<infoflow type="read" weight="7"/>
+## </interface>
+#
+define(`userdomain_search_all_users_home_dirs',`
+requires_block_template(`$0'_depend)
+files_list_home_directories($1)
+allow $1 { home_dir_type home_type }:dir search;
+')
+
+define(`userdomain_search_all_users_home_dirs_depend',`
+attribute home_dir_type, home_type;
+class dir search;
+')
+
+########################################
 ## <interface name="userdomain_read_all_users_data">
 ##	<description>
-##		Inherit the file descriptors from all user domains
+##		Read all files in all users home directories.
 ##	</description>
 ##	<parameter name="domain">
 ##		The type of the process performing this action.
 ##	</parameter>
-##	<infoflow type="read" weight="1"/>
+##	<infoflow type="read" weight="10"/>
 ## </interface>
 #
 define(`userdomain_read_all_users_data',`
@@ -898,6 +943,27 @@ class fd use;
 ')
 
 ########################################
+## <interface name="userdomain_signal_all_userdomains">
+##	<description>
+##		Send general signals to all user domains.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<infoflow type="write" weight="1"/>
+## </interface>
+#
+define(`userdomain_signal_all_userdomains',`
+requires_block_template(`$0'_depend)
+allow $1 userdomain:process signal;
+')
+
+define(`userdomain_signal_all_userdomains_depend',`
+attribute userdomain;
+class process signal;
+')
+
+########################################
 ## <interface name="userdomain_use_all_unprivileged_users_file_descriptors">
 ##	<description>
 ##		Inherit the file descriptors from all user domains.
@@ -927,7 +993,7 @@ class fd use;
 ##	<parameter name="domain">
 ##		The type of the process performing this action.
 ##	</parameter>
-##	<infoflow type="read" weight="1"/>
+##	<infoflow type="none"/>
 ## </interface>
 #
 define(`userdomain_ignore_use_all_unprivileged_users_file_descriptors',`