diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 8a0fdeb..6de52b6 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -794,6 +794,7 @@ optional_policy(`
optional_policy(`
udev_rw_db(initrc_t)
udev_manage_pid_files(initrc_t)
+ udev_manage_rules_files(initrc_t)
')
optional_policy(`
diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc
index 53c2e97..0291685 100644
--- a/policy/modules/system/udev.fc
+++ b/policy/modules/system/udev.fc
@@ -6,7 +6,7 @@
/etc/hotplug\.d/default/udev.* -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
-/etc/udev/rules.d(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0)
+/etc/udev/rules.d(/.*)? gen_context(system_u:object_r:udev_rules_t,s0)
/etc/udev/scripts/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
/lib/udev/udev-acl -- gen_context(system_u:object_r:udev_exec_t,s0)
diff --git a/policy/modules/system/udev.if b/policy/modules/system/udev.if
index 7a47b45..12489cb 100644
--- a/policy/modules/system/udev.if
+++ b/policy/modules/system/udev.if
@@ -213,3 +213,22 @@ interface(`udev_manage_pid_files',`
files_search_var_lib($1)
manage_files_pattern($1, udev_var_run_t, udev_var_run_t)
')
+
+########################################
+##
+## Manage udev rules files
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`udev_manage_rules_files',`
+ gen_require(`
+ type udev_rules_t;
+ ')
+
+ manage_dirs_pattern($1, udev_rules_t, udev_rules_t)
+ manage_files_pattern($1, udev_rules_t, udev_rules_t)
+')
diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index 3f0a14e..af1f4e4 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -21,6 +21,9 @@ files_config_file(udev_etc_t)
type udev_tbl_t alias udev_tdb_t;
files_type(udev_tbl_t)
+type udev_rules_t;
+files_type(udev_rules_t)
+
type udev_var_run_t;
files_pid_file(udev_var_run_t)
@@ -64,6 +67,9 @@ allow udev_t udev_etc_t:file read_file_perms;
allow udev_t udev_tbl_t:file manage_file_perms;
dev_filetrans(udev_t, udev_tbl_t, file)
+list_dirs_pattern(udev_t, udev_rules_t, udev_rules_t)
+read_files_pattern(udev_t, udev_rules_t, udev_rules_t)
+
manage_dirs_pattern(udev_t, udev_var_run_t, udev_var_run_t)
manage_files_pattern(udev_t, udev_var_run_t, udev_var_run_t)
manage_lnk_files_pattern(udev_t, udev_var_run_t, udev_var_run_t)