diff --git a/policy/modules/services/abrt.fc b/policy/modules/services/abrt.fc
index 1efe354..1bd5812 100644
--- a/policy/modules/services/abrt.fc
+++ b/policy/modules/services/abrt.fc
@@ -14,5 +14,7 @@
/var/log/abrt-logger -- gen_context(system_u:object_r:abrt_var_log_t,s0)
/var/run/abrt\.pid -- gen_context(system_u:object_r:abrt_var_run_t,s0)
-/var/run/abrt\.lock -- gen_context(system_u:object_r:abrt_var_run_t,s0)
+/var/run/abrtd?\.lock -- gen_context(system_u:object_r:abrt_var_run_t,s0)
/var/run/abrt(/.*)? gen_context(system_u:object_r:abrt_var_run_t,s0)
+
+/var/spool/abrt(/.*)? gen_context(system_u:object_r:abrt_var_cache_t,s0)
diff --git a/policy/modules/services/abrt.if b/policy/modules/services/abrt.if
index 4b8a868..b0b7d0f 100644
--- a/policy/modules/services/abrt.if
+++ b/policy/modules/services/abrt.if
@@ -76,6 +76,25 @@ interface(`abrt_read_state',`
########################################
##
+## Connect to abrt over an unix stream socket.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`abrt_stream_connect',`
+ gen_require(`
+ type abrt_t, abrt_var_run_t;
+ ')
+
+ files_search_pids($1)
+ stream_connect_pattern($1, abrt_var_run_t, abrt_var_run_t, abrt_t)
+')
+
+########################################
+##
## Send and receive messages from
## abrt over dbus.
##
@@ -215,6 +234,25 @@ interface(`abrt_read_pid_files',`
read_files_pattern($1, abrt_var_run_t, abrt_var_run_t)
')
+######################################
+##
+## Create, read, write, and delete abrt PID files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`abrt_manage_pid_files',`
+ gen_require(`
+ type abrt_var_run_t;
+ ')
+
+ files_search_pids($1)
+ manage_files_pattern($1, abrt_var_run_t, abrt_var_run_t)
+')
+
#####################################
##
## All of the rules required to administrate
diff --git a/policy/modules/services/abrt.te b/policy/modules/services/abrt.te
index a0e53b1..9ad724f 100644
--- a/policy/modules/services/abrt.te
+++ b/policy/modules/services/abrt.te
@@ -1,5 +1,5 @@
-policy_module(abrt, 1.1.0)
+policy_module(abrt, 1.1.1)
########################################
#
@@ -76,10 +76,12 @@ manage_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
manage_dirs_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
manage_lnk_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
files_var_filetrans(abrt_t, abrt_var_cache_t, { file dir })
+files_spool_filetrans(abrt_t, abrt_var_cache_t, dir)
# abrt pid files
manage_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
manage_dirs_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
+manage_sock_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
manage_lnk_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
files_pid_filetrans(abrt_t, abrt_var_run_t, { file dir })
@@ -102,7 +104,6 @@ corenet_tcp_connect_ftp_port(abrt_t)
corenet_tcp_connect_all_ports(abrt_t)
corenet_sendrecv_http_client_packets(abrt_t)
-
dev_getattr_all_chr_files(abrt_t)
dev_read_urand(abrt_t)
dev_rw_sysfs(abrt_t)
@@ -156,6 +157,12 @@ optional_policy(`
policykit_read_reload(abrt_t)
')
+optional_policy(`
+ prelink_exec(abrt_t)
+ libs_exec_ld_so(abrt_t)
+ corecmd_exec_all_executables(abrt_t)
+')
+
# to install debuginfo packages
optional_policy(`
rpm_exec(abrt_t)
@@ -180,11 +187,12 @@ optional_policy(`
# abrt--helper local policy
#
-allow abrt_helper_t self:capability { chown setgid };
+allow abrt_helper_t self:capability { chown setgid sys_nice };
allow abrt_helper_t self:process signal;
read_files_pattern(abrt_helper_t, abrt_etc_t, abrt_etc_t)
+files_search_spool(abrt_helper_t)
manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
manage_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
manage_lnk_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)