diff --git a/policy/modules/services/virt.fc b/policy/modules/services/virt.fc
index 1116f4f..2124b6a 100644
--- a/policy/modules/services/virt.fc
+++ b/policy/modules/services/virt.fc
@@ -7,6 +7,10 @@ HOME_DIR/VirtualMachines/isos(/.*)? gen_context(system_u:object_r:virt_content_t
 /etc/libvirt/[^/]*	-d	gen_context(system_u:object_r:virt_etc_rw_t,s0)
 /etc/libvirt/.*/.*		gen_context(system_u:object_r:virt_etc_rw_t,s0)
 /etc/rc\.d/init\.d/libvirtd --	gen_context(system_u:object_r:virtd_initrc_exec_t,s0)
+/etc/xen		-d	gen_context(system_u:object_r:virt_etc_t,s0)
+/etc/xen/[^/]*		--	gen_context(system_u:object_r:virt_etc_t,s0)
+/etc/xen/[^/]*		-d	gen_context(system_u:object_r:virt_etc_rw_t,s0)
+/etc/xen/.*/.*			gen_context(system_u:object_r:virt_etc_rw_t,s0)
 
 /usr/sbin/libvirtd	--	gen_context(system_u:object_r:virtd_exec_t,s0)
 
diff --git a/policy/modules/services/virt.if b/policy/modules/services/virt.if
index 92b6ca4..7bb17f6 100644
--- a/policy/modules/services/virt.if
+++ b/policy/modules/services/virt.if
@@ -20,8 +20,12 @@ template(`virt_domain_template',`
 
 	type $1_t, virt_domain;
 	domain_type($1_t)
+	domain_user_exemption_target($1_t)
 	role system_r types $1_t;
 
+	type $1_devpts_t;
+	term_pty($1_devpts_t)
+
 	type $1_tmp_t;
 	files_tmp_file($1_tmp_t)
 
@@ -35,6 +39,9 @@ template(`virt_domain_template',`
 	type $1_var_run_t;
 	files_pid_file($1_var_run_t)
 
+	allow $1_t $1_devpts_t:chr_file { rw_chr_file_perms setattr };
+	term_create_pty($1_t, $1_devpts_t)
+
 	manage_dirs_pattern($1_t, $1_image_t, $1_image_t)
 	manage_files_pattern($1_t, $1_image_t, $1_image_t)
 	read_lnk_files_pattern($1_t, $1_image_t, $1_image_t)
@@ -62,6 +69,9 @@ template(`virt_domain_template',`
 	files_pid_filetrans($1_t, $1_var_run_t, { dir file })
 	stream_connect_pattern($1_t, $1_var_run_t, $1_var_run_t, virtd_t)
 
+	optional_policy(`
+		xserver_rw_shm($1_t)
+	')
 ')
 
 ########################################
@@ -293,6 +303,7 @@ interface(`virt_read_lib_files',`
 
 	files_search_var_lib($1)
 	read_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
+	read_lnk_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
 ')
 
 ########################################
@@ -471,7 +482,7 @@ interface(`virt_manage_images',`
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate 
+##	All of the rules required to administrate
 ##	an virt environment
 ## </summary>
 ## <param name="domain">
diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
index b02d62c..a2989cd 100644
--- a/policy/modules/services/virt.te
+++ b/policy/modules/services/virt.te
@@ -1,5 +1,5 @@
 
-policy_module(virt, 1.3.1)
+policy_module(virt, 1.3.2)
 
 ########################################
 #
@@ -15,6 +15,13 @@ gen_tunable(virt_use_comm, false)
 
 ## <desc>
 ## <p>
+## Allow virt to read fuse files
+## </p>
+## </desc>
+gen_tunable(virt_use_fusefs, false)
+
+## <desc>
+## <p>
 ## Allow virt to manage nfs files
 ## </p>
 ## </desc>
@@ -84,11 +91,11 @@ type virtd_initrc_exec_t;
 init_script_file(virtd_initrc_exec_t)
 
 ifdef(`enable_mcs',`
-	init_ranged_daemon_domain(virtd_t, virtd_exec_t,s0 - mcs_systemhigh)
+	init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mcs_systemhigh)
 ')
 
 ifdef(`enable_mls',`
-	init_ranged_daemon_domain(virtd_t, virtd_exec_t,s0 - mls_systemhigh)
+	init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mls_systemhigh)
 ')
 
 ########################################
@@ -107,6 +114,7 @@ read_lnk_files_pattern(svirt_t, virt_image_t, virt_image_t)
 allow svirt_t svirt_image_t:dir search_dir_perms;
 manage_dirs_pattern(svirt_t, svirt_image_t, svirt_image_t)
 manage_files_pattern(svirt_t, svirt_image_t, svirt_image_t)
+fs_hugetlbfs_filetrans(svirt_t, svirt_image_t, file)
 
 list_dirs_pattern(svirt_t, virt_content_t, virt_content_t)
 read_files_pattern(svirt_t, virt_content_t, virt_content_t)
@@ -118,10 +126,13 @@ corenet_udp_sendrecv_generic_node(svirt_t)
 corenet_udp_sendrecv_all_ports(svirt_t)
 corenet_udp_bind_generic_node(svirt_t)
 corenet_udp_bind_all_ports(svirt_t)
+corenet_tcp_bind_all_ports(svirt_t)
+corenet_tcp_connect_all_ports(svirt_t)
 
 dev_list_sysfs(svirt_t)
 
 userdom_search_user_home_content(svirt_t)
+userdom_read_user_home_content_symlinks(svirt_t)
 userdom_read_all_users_state(svirt_t)
 
 tunable_policy(`virt_use_comm',`
@@ -129,6 +140,11 @@ tunable_policy(`virt_use_comm',`
 	dev_rw_printer(svirt_t)
 ')
 
+tunable_policy(`virt_use_fusefs',`
+	fs_read_fusefs_files(svirt_t)
+	fs_read_fusefs_symlinks(svirt_t)
+')
+
 tunable_policy(`virt_use_nfs',`
 	fs_manage_nfs_dirs(svirt_t)
 	fs_manage_nfs_files(svirt_t)
@@ -153,6 +169,10 @@ optional_policy(`
 	xen_rw_image_files(svirt_t)
 ')
 
+optional_policy(`
+	xen_rw_image_files(svirt_t)
+')
+
 ########################################
 #
 # virtd local policy
@@ -165,6 +185,7 @@ allow virtd_t self:fifo_file rw_fifo_file_perms;
 allow virtd_t self:unix_stream_socket create_stream_socket_perms;
 allow virtd_t self:tcp_socket create_stream_socket_perms;
 allow virtd_t self:tun_socket create_socket_perms;
+allow virtd_t self:netlink_kobject_uevent_socket create_socket_perms;
 
 manage_dirs_pattern(virtd_t, svirt_cache_t, svirt_cache_t)
 manage_files_pattern(virtd_t, svirt_cache_t, svirt_cache_t)
@@ -226,6 +247,7 @@ dev_rw_sysfs(virtd_t)
 dev_read_rand(virtd_t)
 dev_rw_kvm(virtd_t)
 dev_getattr_all_chr_files(virtd_t)
+dev_rw_mtrr(virtd_t)
 
 # Init script handling
 domain_use_interactive_fds(virtd_t)
@@ -243,6 +265,8 @@ fs_list_auto_mountpoints(virtd_t)
 fs_getattr_xattr_fs(virtd_t)
 fs_rw_anon_inodefs_files(virtd_t)
 fs_list_inotifyfs(virtd_t)
+fs_manage_cgroup_dirs(virtd_t)
+fs_rw_cgroup_files(virtd_t)
 
 mcs_process_set_categories(virtd_t)
 
@@ -259,8 +283,10 @@ auth_use_nsswitch(virtd_t)
 
 miscfiles_read_localization(virtd_t)
 miscfiles_read_certs(virtd_t)
+miscfiles_read_hwdata(virtd_t)
 
 modutils_read_module_deps(virtd_t)
+modutils_read_module_config(virtd_t)
 modutils_manage_module_config(virtd_t)
 
 logging_send_syslog_msg(virtd_t)
@@ -332,7 +358,7 @@ optional_policy(`
 ')
 
 optional_policy(`
-        policykit_dbus_chat(virtd_t)
+	policykit_dbus_chat(virtd_t)
 	policykit_domtrans_auth(virtd_t)
 	policykit_domtrans_resolve(virtd_t)
 	policykit_read_lib(virtd_t)
@@ -343,6 +369,7 @@ optional_policy(`
 	qemu_read_state(virtd_t)
 	qemu_signal(virtd_t)
 	qemu_kill(virtd_t)
+	qemu_setsched(virtd_t)
 ')
 
 optional_policy(`
@@ -360,6 +387,7 @@ optional_policy(`
 
 optional_policy(`
 	udev_domtrans(virtd_t)
+	udev_read_db(virtd_t)
 ')
 
 optional_policy(`
@@ -371,8 +399,8 @@ optional_policy(`
 # virtual domains common policy
 #
 
-allow virt_domain self:capability { dac_read_search dac_override };
-allow virt_domain self:process { execmem signal getsched signull };
+allow virt_domain self:capability { dac_read_search dac_override kill };
+allow virt_domain self:process { execmem execstack signal getsched signull };
 allow virt_domain self:fifo_file rw_file_perms;
 allow virt_domain self:shm create_shm_perms;
 allow virt_domain self:unix_stream_socket create_stream_socket_perms;
@@ -399,7 +427,9 @@ corenet_rw_tun_tap_dev(virt_domain)
 corenet_tcp_bind_virt_migration_port(virt_domain)
 corenet_tcp_connect_virt_migration_port(virt_domain)
 
+dev_read_rand(virt_domain)
 dev_read_sound(virt_domain)
+dev_read_urand(virt_domain)
 dev_write_sound(virt_domain)
 dev_rw_ksm(virt_domain)
 dev_rw_kvm(virt_domain)
@@ -410,11 +440,17 @@ domain_use_interactive_fds(virt_domain)
 files_read_etc_files(virt_domain)
 files_read_usr_files(virt_domain)
 files_read_var_files(virt_domain)
+files_search_all(virt_domain)
 
 fs_getattr_tmpfs(virt_domain)
 fs_rw_anon_inodefs_files(virt_domain)
 fs_rw_tmpfs_files(virt_domain)
 
+term_use_all_terms(virt_domain)
+term_getattr_pty_fs(virt_domain)
+term_use_generic_ptys(virt_domain)
+term_use_ptmx(virt_domain)
+
 auth_use_nsswitch(virt_domain)
 
 logging_send_syslog_msg(virt_domain)