--- nsaserefpolicy/policy/modules/system/userdomain.fc	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/userdomain.fc	2008-08-14 13:53:54.000000000 -0400
@@ -1,4 +1,5 @@
-HOME_DIR	-d	gen_context(system_u:object_r:ROLE_home_dir_t,s0-mls_systemhigh)
-HOME_DIR/.+		gen_context(system_u:object_r:ROLE_home_t,s0)
-
-/tmp/gconfd-USER -d	gen_context(system_u:object_r:ROLE_tmp_t,s0)
+HOME_DIR	-d	gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
+HOME_DIR	-l	gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
+HOME_DIR/.+		gen_context(system_u:object_r:user_home_t,s0)
+/tmp/gconfd-USER -d	gen_context(system_u:object_r:user_tmp_t,s0)
+/root(/.*)?	 	gen_context(system_u:object_r:admin_home_t,s0)
--- nsaserefpolicy/policy/modules/system/userdomain.if	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/userdomain.if	2008-08-14 13:53:54.000000000 -0400
@@ -28,10 +28,14 @@
 		class context contains;
 	')
 
-	attribute $1_file_type;
+	attribute $1_usertype;
 
-	type $1_t, userdomain;
+	type $1_t, userdomain, $1_usertype;
 	domain_type($1_t)
+	ifndef(`enable_mls',`
+		# ignore user componant labeling on homedir entry
+		domain_obj_id_change_exemption($1_t)
+	')
 	corecmd_shell_entry_type($1_t)
 	corecmd_bin_entry_type($1_t)
 	domain_user_exemption_target($1_t)
@@ -45,66 +49,82 @@
 	type $1_tty_device_t; 
 	term_user_tty($1_t,$1_tty_device_t)
 
-	allow $1_t self:process { signal_perms getsched setsched share getpgid setpgid setcap getsession getattr };
-	allow $1_t self:fd use;
-	allow $1_t self:fifo_file rw_fifo_file_perms;
-	allow $1_t self:unix_dgram_socket { create_socket_perms sendto };
-	allow $1_t self:unix_stream_socket { create_stream_socket_perms connectto };
-	allow $1_t self:shm create_shm_perms;
-	allow $1_t self:sem create_sem_perms;
-	allow $1_t self:msgq create_msgq_perms;
-	allow $1_t self:msg { send receive };
-	allow $1_t self:context contains;
-	dontaudit $1_t self:socket create;
+	allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
+	allow $1_usertype $1_usertype:fd use;
+	allow $1_usertype $1_t:key { create view read write search link setattr };
+
+	allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
+	allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
+	allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
+	allow $1_usertype $1_usertype:shm create_shm_perms;
+	allow $1_usertype $1_usertype:sem create_sem_perms;
+	allow $1_usertype $1_usertype:msgq create_msgq_perms;
+	allow $1_usertype $1_usertype:msg { send receive };
+	allow $1_usertype $1_usertype:context contains;
+	dontaudit $1_usertype $1_usertype:socket create;
 
-	allow $1_t $1_devpts_t:chr_file { setattr ioctl read getattr lock write append };
-	term_create_pty($1_t,$1_devpts_t)
+	allow $1_usertype $1_devpts_t:chr_file { setattr ioctl read getattr lock write append };
+	term_create_pty($1_usertype, $1_devpts_t)
 
-	allow $1_t $1_tty_device_t:chr_file { setattr rw_chr_file_perms };
+	allow $1_usertype $1_tty_device_t:chr_file { setattr rw_chr_file_perms };
 
-	kernel_read_kernel_sysctls($1_t)
-	kernel_dontaudit_list_unlabeled($1_t)
-	kernel_dontaudit_getattr_unlabeled_files($1_t)
-	kernel_dontaudit_getattr_unlabeled_symlinks($1_t)
-	kernel_dontaudit_getattr_unlabeled_pipes($1_t)
-	kernel_dontaudit_getattr_unlabeled_sockets($1_t)
-	kernel_dontaudit_getattr_unlabeled_blk_files($1_t)
-	kernel_dontaudit_getattr_unlabeled_chr_files($1_t)
+	application_exec_all($1_usertype)
 
-	dev_dontaudit_getattr_all_blk_files($1_t)
-	dev_dontaudit_getattr_all_chr_files($1_t)
+	files_exec_usr_files($1_t)
+
+	kernel_read_kernel_sysctls($1_usertype)
+	kernel_read_all_sysctls($1_usertype)
+
+	kernel_dontaudit_list_unlabeled($1_usertype)
+	kernel_dontaudit_getattr_unlabeled_files($1_usertype)
+	kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
+	kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
+	kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
+	kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
+	kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
+	kernel_dontaudit_list_proc($1_usertype)
 
 	# When the user domain runs ps, there will be a number of access
 	# denials when ps tries to search /proc.  Do not audit these denials.
-	domain_dontaudit_read_all_domains_state($1_t)
-	domain_dontaudit_getattr_all_domains($1_t)
-	domain_dontaudit_getsession_all_domains($1_t)
-
-	files_read_etc_files($1_t)
-	files_read_etc_runtime_files($1_t)
-	files_read_usr_files($1_t)
+	domain_dontaudit_read_all_domains_state($1_usertype)
+	domain_dontaudit_getattr_all_domains($1_usertype)
+	domain_dontaudit_getsession_all_domains($1_usertype)
+
+	files_read_etc_files($1_usertype)
+	files_read_mnt_files($1_usertype)
+	files_read_etc_runtime_files($1_usertype)
+	files_read_usr_files($1_usertype)
 	# Read directories and files with the readable_t type.
 	# This type is a general type for "world"-readable files.
-	files_list_world_readable($1_t)
-	files_read_world_readable_files($1_t)
-	files_read_world_readable_symlinks($1_t)
-	files_read_world_readable_pipes($1_t)
-	files_read_world_readable_sockets($1_t)
+	files_list_world_readable($1_usertype)
+	files_read_world_readable_files($1_usertype)
+	files_read_world_readable_symlinks($1_usertype)
+	files_read_world_readable_pipes($1_usertype)
+	files_read_world_readable_sockets($1_usertype)
 	# old broswer_domain():
-	files_dontaudit_list_non_security($1_t)
-	files_dontaudit_getattr_non_security_files($1_t)
-	files_dontaudit_getattr_non_security_symlinks($1_t)
-	files_dontaudit_getattr_non_security_pipes($1_t)
-	files_dontaudit_getattr_non_security_sockets($1_t)
-
-	libs_use_ld_so($1_t)
-	libs_use_shared_libs($1_t)
-	libs_exec_ld_so($1_t)
+	files_dontaudit_getattr_all_dirs($1_usertype)
+	files_dontaudit_list_non_security($1_usertype)
+	files_dontaudit_getattr_non_security_files($1_usertype)
+	files_dontaudit_getattr_non_security_symlinks($1_usertype)
+	files_dontaudit_getattr_non_security_pipes($1_usertype)
+	files_dontaudit_getattr_non_security_sockets($1_usertype)
+
+	dev_dontaudit_getattr_all_blk_files($1_usertype)
+	dev_dontaudit_getattr_all_chr_files($1_usertype)
+	dev_getattr_mtrr_dev($1_t)
+
+	storage_rw_fuse($1_usertype)
 
-	miscfiles_read_localization($1_t)
-	miscfiles_read_certs($1_t)
+	auth_use_nsswitch($1_usertype)
 
-	sysnet_read_config($1_t)
+	libs_use_ld_so($1_usertype)
+	libs_use_shared_libs($1_usertype)
+	libs_exec_ld_so($1_usertype)
+
+	miscfiles_read_certs($1_usertype)
+	miscfiles_read_localization($1_usertype)
+	miscfiles_read_man_pages($1_usertype)
+	miscfiles_read_public_files($1_usertype)
 
 	tunable_policy(`allow_execmem',`
 		# Allow loading DSOs that require executable stack.
@@ -115,6 +135,11 @@
 		# Allow making the stack executable via mprotect.
 		allow $1_t self:process execstack;
 	')
+
+	optional_policy(`
+		ssh_rw_stream_sockets($1_usertype)
+		ssh_delete_tmp($1_t)
+	')
 ')
 
 #######################################
@@ -141,33 +166,13 @@
 #
 template(`userdom_ro_home_template',`
 	gen_require(`
-		attribute home_type, home_dir_type, $1_file_type;
+		type user_home_t, user_home_dir_t;
 	')
 
-	# type for contents of home directory
-	type $1_home_t, $1_file_type, home_type;
-	files_type($1_home_t)
-	files_associate_tmp($1_home_t)
-	fs_associate_tmpfs($1_home_t)
-	files_mountpoint($1_home_t)
-
-	# type of home directory
-	type $1_home_dir_t, home_dir_type, home_type;
-	files_type($1_home_dir_t)
-	files_mountpoint($1_home_dir_t)
-	files_associate_tmp($1_home_dir_t)
-	fs_associate_tmpfs($1_home_dir_t)
-	files_poly_member($1_home_dir_t)
-
-	##############################
-	#
-	# User home directory file rules
-	#
-
-	allow $1_file_type $1_home_t:filesystem associate;
-
-	# Rules used to associate a homedir as a mountpoint
-	allow $1_home_t self:filesystem associate;
+	ifelse(`$1',`user',`',`
+		typealias user_home_t alias $1_home_t;
+		typealias user_home_dir_t alias $1_home_dir_t;
+	')
 
 	##############################
 	#
@@ -175,13 +180,14 @@
 	#
 
 	# read-only home directory
-	allow $1_t $1_home_dir_t:dir list_dir_perms;
-	allow $1_t $1_home_t:dir list_dir_perms;
-	allow $1_t $1_home_t:file entrypoint;
-	read_files_pattern($1_t,{ $1_home_t $1_home_dir_t },$1_home_t)
-	read_lnk_files_pattern($1_t,{ $1_home_t $1_home_dir_t },$1_home_t)
-	read_fifo_files_pattern($1_t,{ $1_home_t $1_home_dir_t },$1_home_t)
-	read_sock_files_pattern($1_t,{ $1_home_t $1_home_dir_t },$1_home_t)
+	allow $1_t user_home_dir_t:dir list_dir_perms;
+	allow $1_t user_home_t:dir list_dir_perms;
+	allow $1_t user_home_t:file entrypoint;
+
+	read_files_pattern($1_t, { user_home_t user_home_dir_t }, user_home_t)
+	read_lnk_files_pattern($1_t, { user_home_t user_home_dir_t }, user_home_t)
+	read_fifo_files_pattern($1_t, { user_home_t user_home_dir_t }, user_home_t)
+	read_sock_files_pattern($1_t, { user_home_t user_home_dir_t }, user_home_t)
 	files_list_home($1_t)
 
 	tunable_policy(`use_nfs_home_dirs',`
@@ -190,9 +196,6 @@
 		fs_read_nfs_symlinks($1_t)
 		fs_read_nfs_named_sockets($1_t)
 		fs_read_nfs_named_pipes($1_t)
-	',`
-		fs_dontaudit_list_nfs($1_t)
-		fs_dontaudit_read_nfs_files($1_t)
 	')
 
 	tunable_policy(`use_samba_home_dirs',`
@@ -201,9 +204,6 @@
 		fs_read_cifs_symlinks($1_t)
 		fs_read_cifs_named_sockets($1_t)
 		fs_read_cifs_named_pipes($1_t)
-	',`
-		fs_dontaudit_list_cifs($1_t)
-		fs_dontaudit_read_cifs_files($1_t)
 	')
 ')
 
@@ -231,30 +231,14 @@
 #
 template(`userdom_manage_home_template',`
 	gen_require(`
-		attribute home_type, home_dir_type, $1_file_type;
+		attribute home_type, home_dir_type;
+		type user_home_t, user_home_dir_t;
 	')
 
-	# type for contents of home directory
-	type $1_home_t, $1_file_type, home_type;
-	files_type($1_home_t)
-	files_associate_tmp($1_home_t)
-	fs_associate_tmpfs($1_home_t)
-
-	# type of home directory
-	type $1_home_dir_t, home_dir_type, home_type;
-	files_type($1_home_dir_t)
-	files_associate_tmp($1_home_dir_t)
-	fs_associate_tmpfs($1_home_dir_t)
-
-	##############################
-	#
-	# User home directory file rules
-	#
-
-	allow $1_file_type $1_home_t:filesystem associate;
-
-	# Rules used to associate a homedir as a mountpoint
-	allow $1_home_t self:filesystem associate;
+	ifelse(`$1',`user',`',`
+		typealias user_home_t alias $1_home_t;
+		typealias user_home_dir_t alias $1_home_dir_t;
+	')
 
 	##############################
 	#
@@ -262,43 +246,44 @@
 	#
 
 	# full control of the home directory
-	allow $1_t $1_home_t:file entrypoint;
-	manage_dirs_pattern($1_t,{ $1_home_dir_t $1_home_t },$1_home_t)
-	manage_files_pattern($1_t,{ $1_home_dir_t $1_home_t },$1_home_t)
-	manage_lnk_files_pattern($1_t,{ $1_home_dir_t $1_home_t },$1_home_t)
-	manage_sock_files_pattern($1_t,{ $1_home_dir_t $1_home_t },$1_home_t)
-	manage_fifo_files_pattern($1_t,{ $1_home_dir_t $1_home_t },$1_home_t)
-	relabel_dirs_pattern($1_t,{ $1_home_dir_t $1_home_t },$1_home_t)
-	relabel_files_pattern($1_t,{ $1_home_dir_t $1_home_t },$1_home_t)
-	relabel_lnk_files_pattern($1_t,{ $1_home_dir_t $1_home_t },$1_home_t)
-	relabel_sock_files_pattern($1_t,{ $1_home_dir_t $1_home_t },$1_home_t)
-	relabel_fifo_files_pattern($1_t,{ $1_home_dir_t $1_home_t },$1_home_t)
-	filetrans_pattern($1_t,$1_home_dir_t,$1_home_t,{ dir file lnk_file sock_file fifo_file })
-	files_list_home($1_t)
+	allow $1_t user_home_t:dir mounton;
+	allow $1_t user_home_t:file entrypoint;
+
+	allow $1_usertype user_home_type:dir_file_class_set { relabelto relabelfrom };
+	manage_dirs_pattern($1_usertype, { user_home_dir_t user_home_t }, user_home_type)
+	manage_files_pattern($1_usertype, { user_home_dir_t user_home_t }, user_home_type)
+	manage_lnk_files_pattern($1_usertype, { user_home_dir_t user_home_t }, user_home_type)
+	manage_sock_files_pattern($1_usertype, { user_home_dir_t user_home_t }, user_home_type)
+	manage_fifo_files_pattern($1_usertype, { user_home_dir_t user_home_t }, user_home_type)
+	relabel_dirs_pattern($1_usertype, { user_home_dir_t user_home_t }, user_home_type)
+	relabel_files_pattern($1_usertype, { user_home_dir_t user_home_t }, user_home_type)
+	relabel_lnk_files_pattern($1_usertype, { user_home_dir_t user_home_t }, user_home_type)
+	relabel_sock_files_pattern($1_usertype, { user_home_dir_t user_home_t }, user_home_type)
+	relabel_fifo_files_pattern($1_usertype, { user_home_dir_t user_home_t }, user_home_type)
+	filetrans_pattern($1_usertype, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
+	files_list_home($1_usertype)
 
 	# cjp: this should probably be removed:
-	allow $1_t $1_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
+	allow $1_usertype user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 
 	tunable_policy(`use_nfs_home_dirs',`
-		fs_manage_nfs_dirs($1_t)
-		fs_manage_nfs_files($1_t)
-		fs_manage_nfs_symlinks($1_t)
-		fs_manage_nfs_named_sockets($1_t)
-		fs_manage_nfs_named_pipes($1_t)
-	',`
-		fs_dontaudit_manage_nfs_dirs($1_t)
-		fs_dontaudit_manage_nfs_files($1_t)
+		fs_mount_nfs($1_t)
+		fs_mounton_nfs($1_t)
+		fs_manage_nfs_dirs($1_usertype)
+		fs_manage_nfs_files($1_usertype)
+		fs_manage_nfs_symlinks($1_usertype)
+		fs_manage_nfs_named_sockets($1_usertype)
+		fs_manage_nfs_named_pipes($1_usertype)
 	')
 
 	tunable_policy(`use_samba_home_dirs',`
-		fs_manage_cifs_dirs($1_t)
-		fs_manage_cifs_files($1_t)
-		fs_manage_cifs_symlinks($1_t)
-		fs_manage_cifs_named_sockets($1_t)
-		fs_manage_cifs_named_pipes($1_t)
-	',`
-		fs_dontaudit_manage_cifs_dirs($1_t)
-		fs_dontaudit_manage_cifs_files($1_t)
+		fs_mount_cifs($1_t)
+		fs_mounton_cifs($1_t)
+		fs_manage_cifs_dirs($1_usertype)
+		fs_manage_cifs_files($1_usertype)
+		fs_manage_cifs_symlinks($1_usertype)
+		fs_manage_cifs_named_sockets($1_usertype)
+		fs_manage_cifs_named_pipes($1_usertype)
 	')
 ')
 
@@ -316,14 +301,20 @@
 ## <rolebase/>
 #
 template(`userdom_exec_home_template',`
-	can_exec($1_t,$1_home_t)
 
-	tunable_policy(`use_nfs_home_dirs',`
-		fs_exec_nfs_files($1_t)
+	tunable_policy(`allow_$1_exec_content',`
+		can_exec($1_usertype, user_home_type)
+	',`
+		dontaudit $1_usertype user_home_type:file execute;
 	')
 
-	tunable_policy(`use_samba_home_dirs',`
-		fs_exec_cifs_files($1_t)
+
+	tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
+		fs_exec_nfs_files($1_usertype)
+	')
+
+	tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
+		fs_exec_cifs_files($1_usertype)
 	')
 ')
 
@@ -341,11 +332,10 @@
 ## <rolebase/>
 #
 template(`userdom_poly_home_template',`
-	type_member $1_t $1_home_dir_t:dir $1_home_dir_t;
-	files_poly($1_home_dir_t)
-	files_poly_parent($1_home_dir_t)
-	files_poly_parent($1_home_t)
-	files_poly_member($1_home_t)
+	gen_require(`
+		type user_home_dir_t;
+	')
+	type_member $1_t user_home_dir_t:dir user_home_dir_t;
 ')
 
 #######################################
@@ -369,18 +359,18 @@
 #
 template(`userdom_manage_tmp_template',`
 	gen_require(`
-		attribute $1_file_type;
+		type user_tmp_t;
 	')
 
-	type $1_tmp_t, $1_file_type;
-	files_tmp_file($1_tmp_t)
-
-	manage_dirs_pattern($1_t,$1_tmp_t,$1_tmp_t)
-	manage_files_pattern($1_t,$1_tmp_t,$1_tmp_t)
-	manage_lnk_files_pattern($1_t,$1_tmp_t,$1_tmp_t)
-	manage_sock_files_pattern($1_t,$1_tmp_t,$1_tmp_t)
-	manage_fifo_files_pattern($1_t,$1_tmp_t,$1_tmp_t)
-	files_tmp_filetrans($1_t, $1_tmp_t, { dir file lnk_file sock_file fifo_file })
+	ifelse(`$1',`user',`',`
+		typealias user_tmp_t alias $1_tmp_t;
+	')
+	manage_dirs_pattern($1_usertype, user_tmp_t, user_tmp_t)
+	manage_files_pattern($1_usertype, user_tmp_t, user_tmp_t)
+	manage_lnk_files_pattern($1_usertype, user_tmp_t, user_tmp_t)
+	manage_sock_files_pattern($1_usertype, user_tmp_t, user_tmp_t)
+	manage_fifo_files_pattern($1_usertype, user_tmp_t, user_tmp_t)
+	files_tmp_filetrans($1_usertype, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 ')
 
 #######################################
@@ -396,7 +386,13 @@
 ## <rolebase/>
 #
 template(`userdom_exec_tmp_template',`
-	exec_files_pattern($1_t,$1_tmp_t,$1_tmp_t)
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	tunable_policy(`allow_$1_exec_content',`
+		exec_files_pattern($1_usertype, user_tmp_t, user_tmp_t)
+	')
 ')
 
 #######################################
@@ -439,18 +435,18 @@
 #
 template(`userdom_manage_tmpfs_template',`
 	gen_require(`
-		attribute $1_file_type;
+		attribute user_file_type;
 	')
 
-	type $1_tmpfs_t, $1_file_type;
+	type $1_tmpfs_t, user_file_type;
 	files_tmpfs_file($1_tmpfs_t)
 
-	manage_dirs_pattern($1_t,$1_tmpfs_t,$1_tmpfs_t)
-	manage_files_pattern($1_t,$1_tmpfs_t,$1_tmpfs_t)
-	manage_lnk_files_pattern($1_t,$1_tmpfs_t,$1_tmpfs_t)
-	manage_sock_files_pattern($1_t,$1_tmpfs_t,$1_tmpfs_t)
-	manage_fifo_files_pattern($1_t,$1_tmpfs_t,$1_tmpfs_t)
-	fs_tmpfs_filetrans($1_t,$1_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+	manage_dirs_pattern($1_usertype, $1_tmpfs_t, $1_tmpfs_t)
+	manage_files_pattern($1_usertype, $1_tmpfs_t, $1_tmpfs_t)
+	manage_lnk_files_pattern($1_usertype, $1_tmpfs_t, $1_tmpfs_t)
+	manage_sock_files_pattern($1_usertype, $1_tmpfs_t, $1_tmpfs_t)
+	manage_fifo_files_pattern($1_usertype, $1_tmpfs_t, $1_tmpfs_t)
+	fs_tmpfs_filetrans($1_usertype, $1_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 ')
 
 #######################################
@@ -468,17 +464,17 @@
 #
 template(`userdom_untrusted_content_template',`
 	gen_require(`
-		attribute $1_file_type;
+		attribute user_file_type;
 		attribute untrusted_content_type, untrusted_content_tmp_type;
 		type $1_t;
 	')
 
 	# types for network-obtained content
-	type $1_untrusted_content_t, $1_file_type, untrusted_content_type; #, customizable
+	type $1_untrusted_content_t, user_file_type, untrusted_content_type; #, customizable
 	files_type($1_untrusted_content_t)
 	files_poly_member($1_untrusted_content_t)
 
-	type $1_untrusted_content_tmp_t, $1_file_type, untrusted_content_tmp_type; # customizable
+	type $1_untrusted_content_tmp_t, user_file_type, untrusted_content_tmp_type; # customizable
 	files_tmp_file($1_untrusted_content_tmp_t)
 
 	# Allow user to relabel untrusted content
@@ -510,10 +506,6 @@
 ## <rolebase/>
 #
 template(`userdom_exec_generic_pgms_template',`
-	gen_require(`
-		type $1_t;
-	')
-
 	corecmd_exec_bin($1_t)
 ')
 
@@ -531,34 +523,20 @@
 ## <rolebase/>
 #
 template(`userdom_basic_networking_template',`
-	gen_require(`
-		type $1_t;
-	')
-
-	allow $1_t self:tcp_socket create_stream_socket_perms;
-	allow $1_t self:udp_socket create_socket_perms;
-
-	corenet_all_recvfrom_unlabeled($1_t)
-	corenet_all_recvfrom_netlabel($1_t)
-	corenet_tcp_sendrecv_all_if($1_t)
-	corenet_udp_sendrecv_all_if($1_t)
-	corenet_tcp_sendrecv_all_nodes($1_t)
-	corenet_udp_sendrecv_all_nodes($1_t)
-	corenet_tcp_sendrecv_all_ports($1_t)
-	corenet_udp_sendrecv_all_ports($1_t)
-	corenet_tcp_connect_all_ports($1_t)
-	corenet_sendrecv_all_client_packets($1_t)
 
-	corenet_all_recvfrom_labeled($1_t, $1_t)
+	allow $1_usertype self:tcp_socket create_stream_socket_perms;
+	allow $1_usertype self:udp_socket create_socket_perms;
 
-	optional_policy(`
-		init_tcp_recvfrom_all_daemons($1_t)
-		init_udp_recvfrom_all_daemons($1_t)
-	')
-
-	optional_policy(`
-		ipsec_match_default_spd($1_t)
-	')
+	corenet_all_recvfrom_unlabeled($1_usertype)
+	corenet_all_recvfrom_netlabel($1_usertype)
+	corenet_tcp_sendrecv_all_if($1_usertype)
+	corenet_udp_sendrecv_all_if($1_usertype)
+	corenet_tcp_sendrecv_all_nodes($1_usertype)
+	corenet_udp_sendrecv_all_nodes($1_usertype)
+	corenet_tcp_sendrecv_all_ports($1_usertype)
+	corenet_udp_sendrecv_all_ports($1_usertype)
+	corenet_tcp_connect_all_ports($1_usertype)
+	corenet_sendrecv_all_client_packets($1_usertype)
 ')
 
 #######################################
@@ -575,30 +553,33 @@
 #
 template(`userdom_xwindows_client_template',`
 	gen_require(`
-		type $1_t, $1_tmpfs_t;
+		type $1_tmpfs_t;
 	')
 
-	dev_rw_xserver_misc($1_t)
-	dev_rw_power_management($1_t)
-	dev_read_input($1_t)
-	dev_read_misc($1_t)
-	dev_write_misc($1_t)
+	dev_rwx_zero($1_usertype)
+	dev_rw_xserver_misc($1_usertype)
+	dev_rw_power_management($1_usertype)
+	dev_read_input($1_usertype)
+	dev_read_misc($1_usertype)
+	dev_write_misc($1_usertype)
 	# open office is looking for the following
-	dev_getattr_agp_dev($1_t)
-	dev_dontaudit_rw_dri($1_t)
+	dev_getattr_agp_dev($1_usertype)
+	dev_dontaudit_rw_dri($1_usertype)
 	# GNOME checks for usb and other devices:
-	dev_rw_usbfs($1_t)
+	dev_rw_usbfs($1_usertype)
+	dev_read_generic_usb_dev($1_usertype)
 
-	xserver_user_client_template($1,$1_t,$1_tmpfs_t)
-	xserver_xsession_entry_type($1_t)
-	xserver_dontaudit_write_log($1_t)
-	xserver_stream_connect_xdm($1_t)
+	xserver_per_role_template($1, $1_usertype, $1_r)
+	xserver_xsession_entry_type($1_usertype)
+	xserver_dontaudit_write_log($1_usertype)
+	xserver_stream_connect_xdm($1_usertype)
 	# certain apps want to read xdm.pid file
-	xserver_read_xdm_pid($1_t)
+	xserver_read_xdm_pid($1_usertype)
 	# gnome-session creates socket under /tmp/.ICE-unix/
-	xserver_create_xdm_tmp_sockets($1_t)
+	xserver_create_xdm_tmp_sockets($1_usertype)
 	# Needed for escd, remove if we get escd policy
-	xserver_manage_xdm_tmp_files($1_t)
+	xserver_manage_xdm_tmp_files($1_usertype)
+	xserver_stream_connect_xdm_xserver($1_usertype)
 ')
 
 #######################################
@@ -629,13 +610,7 @@
 ## <summary>
 ##	The template for allowing the user to change roles.
 ## </summary>
-## <param name="src_role_prefix">
-##	<summary>
-##	The prefix of the user domain (e.g., user
-##	is the prefix for user_t).
-##	</summary>
-## </param>
-## <param name="tgt_role_prefix">
+## <param name="userdomain_prefix">
 ##	<summary>
 ##	The prefix of the user domain (e.g., user
 ##	is the prefix for user_t).
@@ -699,188 +674,202 @@
 	dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 	dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 
-	allow $1_t unpriv_userdomain:fd use;
+	allow $1_usertype unpriv_userdomain:fd use;
 
-	kernel_read_system_state($1_t)
-	kernel_read_network_state($1_t)
-	kernel_read_net_sysctls($1_t)
+	kernel_read_system_state($1_usertype)
+	kernel_read_network_state($1_usertype)
+	kernel_read_net_sysctls($1_usertype)
 	# Very permissive allowing every domain to see every type:
-	kernel_get_sysvipc_info($1_t)
+	kernel_get_sysvipc_info($1_usertype)
 	# Find CDROM devices:
-	kernel_read_device_sysctls($1_t)
+	kernel_read_device_sysctls($1_usertype)
 
-	corenet_udp_bind_all_nodes($1_t)
-	corenet_udp_bind_generic_port($1_t)
+	corenet_udp_bind_all_nodes($1_usertype)
+	corenet_udp_bind_generic_port($1_usertype)
 
-	dev_read_rand($1_t)
-	dev_write_sound($1_t)
-	dev_read_sound($1_t)
-	dev_read_sound_mixer($1_t)
-	dev_write_sound_mixer($1_t)
+	dev_read_rand($1_usertype)
+	dev_write_sound($1_usertype)
+	dev_read_sound($1_usertype)
+	dev_read_sound_mixer($1_usertype)
+	dev_write_sound_mixer($1_usertype)
 
-	files_exec_etc_files($1_t)
-	files_search_locks($1_t)
+	files_exec_etc_files($1_usertype)
+	files_search_locks($1_usertype)
 	# Check to see if cdrom is mounted
-	files_search_mnt($1_t)
+	files_search_mnt($1_usertype)
 	# cjp: perhaps should cut back on file reads:
-	files_read_var_files($1_t)
-	files_read_var_symlinks($1_t)
-	files_read_generic_spool($1_t)
-	files_read_var_lib_files($1_t)
+	files_read_var_files($1_usertype)
+	files_read_var_symlinks($1_usertype)
+	files_read_generic_spool($1_usertype)
+	files_read_var_lib_files($1_usertype)
 	# Stat lost+found.
-	files_getattr_lost_found_dirs($1_t)
+	files_getattr_lost_found_dirs($1_usertype)
+	files_read_config_files($1_usertype)
+
+	tunable_policy(`user_rw_noexattrfile',`
+		fs_manage_noxattr_fs_files($1_usertype)
+		fs_manage_noxattr_fs_dirs($1_usertype)
+	',`
+		fs_read_noxattr_fs_files($1_usertype)
+	')
+
+	logging_send_syslog_msg($1_usertype)
+	logging_send_audit_msgs($1_usertype)
+	selinux_get_enforce_mode($1_usertype)
 
 	# cjp: some of this probably can be removed
-	selinux_get_fs_mount($1_t)
-	selinux_validate_context($1_t)
-	selinux_compute_access_vector($1_t)
-	selinux_compute_create_context($1_t)
-	selinux_compute_relabel_context($1_t)
-	selinux_compute_user_contexts($1_t)
+	selinux_get_fs_mount($1_usertype)
+	selinux_validate_context($1_usertype)
+	selinux_compute_access_vector($1_usertype)
+	selinux_compute_create_context($1_usertype)
+	selinux_compute_relabel_context($1_usertype)
+	selinux_compute_user_contexts($1_usertype)
 
 	# for eject
-	storage_getattr_fixed_disk_dev($1_t)
+	storage_getattr_fixed_disk_dev($1_usertype)
 
-	auth_use_nsswitch($1_t)
-	auth_read_login_records($1_t)
-	auth_search_pam_console_data($1_t)
+	auth_read_login_records($1_usertype)
+	auth_search_pam_console_data($1_usertype)
 	auth_run_pam($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
 	auth_run_utempter($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
+	authlogin_per_role_template($1, $1_t, $1_r)
 
-	init_read_utmp($1_t)
+	init_read_utmp($1_usertype)
 
-	seutil_read_file_contexts($1_t)
-	seutil_read_default_contexts($1_t)
+	seutil_read_file_contexts($1_usertype)
+	seutil_read_default_contexts($1_usertype)
 	seutil_run_newrole($1_t,$1_r,{ $1_devpts_t $1_tty_device_t })
 	seutil_exec_checkpolicy($1_t)
-	seutil_exec_setfiles($1_t)
+	seutil_exec_setfiles($1_usertype)
 	# for when the network connection is killed
 	# this is needed when a login role can change
 	# to this one.
 	seutil_dontaudit_signal_newrole($1_t)
 
 	tunable_policy(`read_default_t',`
-		files_list_default($1_t)
-		files_read_default_files($1_t)
-		files_read_default_symlinks($1_t)
-		files_read_default_sockets($1_t)
-		files_read_default_pipes($1_t)
+		files_list_default($1_usertype)
+		files_read_default_files($1_usertype)
+		files_read_default_symlinks($1_usertype)
+		files_read_default_sockets($1_usertype)
+		files_read_default_pipes($1_usertype)
 	')
 
 	tunable_policy(`user_direct_mouse',`
-		dev_read_mouse($1_t)
-	')
-
-	tunable_policy(`user_ttyfile_stat',`
-		term_getattr_all_user_ttys($1_t)
+		dev_read_mouse($1_usertype)
 	')
 
 	optional_policy(`
-		alsa_read_rw_config($1_t)
+		alsa_read_rw_config($1_usertype)
 	')
 
 	optional_policy(`
 		# Allow graphical boot to check battery lifespan
-		apm_stream_connect($1_t)
+		apm_stream_connect($1_usertype)
 	')
 
 	optional_policy(`
-		canna_stream_connect($1_t)
+		canna_stream_connect($1_usertype)
 	')
 
 	optional_policy(`
-		dbus_system_bus_client_template($1,$1_t)
+		dbus_system_bus_client_template($1, $1_usertype)
 
 		optional_policy(`
-			bluetooth_dbus_chat($1_t)
+			avahi_dbus_chat($1_usertype)
 		')
 
 		optional_policy(`
-			evolution_dbus_chat($1,$1_t)
-			evolution_alarm_dbus_chat($1,$1_t)
+			bluetooth_dbus_chat($1_usertype)
 		')
 
 		optional_policy(`
-			cups_dbus_chat_config($1_t)
+			consolekit_dbus_chat($1_usertype)
+			consolekit_read_log($1_usertype)
 		')
 
 		optional_policy(`
-			hal_dbus_chat($1_t)
+			evolution_dbus_chat($1, $1_usertype)
+			evolution_alarm_dbus_chat($1, $1_usertype)
 		')
 
 		optional_policy(`
-			networkmanager_dbus_chat($1_t)
-		')
+			networkmanager_dbus_chat($1_usertype)
 	')
 
 	optional_policy(`
-		inetd_use_fds($1_t)
-		inetd_rw_tcp_sockets($1_t)
+			vpnc_dbus_chat($1_usertype)
 	')
 
 	optional_policy(`
-		inn_read_config($1_t)
-		inn_read_news_lib($1_t)
-		inn_read_news_spool($1_t)
+			hal_dbus_chat($1_usertype)
+		')
 	')
 
 	optional_policy(`
-		locate_read_lib_files($1_t)
+		inetd_use_fds($1_usertype)
+		inetd_rw_tcp_sockets($1_usertype)
 	')
 
-	# for running depmod as part of the kernel packaging process
 	optional_policy(`
-		modutils_read_module_config($1_t)
+		inn_read_config($1_usertype)
+		inn_read_news_lib($1_usertype)
+		inn_read_news_spool($1_usertype)
 	')
 
 	optional_policy(`
-		mta_rw_spool($1_t)
+		locate_read_lib_files($1_usertype)
 	')
 
-
+	# for running depmod as part of the kernel packaging process
 	optional_policy(`
-		tunable_policy(`allow_user_mysql_connect',`
-			mysql_stream_connect($1_t)
-		')
+		modutils_read_module_config($1_usertype)
 	')
 
 	optional_policy(`
-		# to allow monitoring of pcmcia status
-		pcmcia_read_pid($1_t)
+		mta_rw_spool($1_usertype)
 	')
 
 	optional_policy(`
-		pcscd_read_pub_files($1_t)
-		pcscd_stream_connect($1_t)
+		alsa_read_rw_config($1_usertype)
 	')
 
 	optional_policy(`
 		tunable_policy(`allow_user_postgresql_connect',`
-			postgresql_stream_connect($1_t)
-			postgresql_tcp_connect($1_t)
+			postgresql_stream_connect($1_usertype)
+		')
+	')
+
+	tunable_policy(`user_ttyfile_stat',`
+		term_getattr_all_user_ttys($1_usertype)
 		')
+
+	optional_policy(`
+		# to allow monitoring of pcmcia status
+		pcmcia_read_pid($1_usertype)
 	')
 
 	optional_policy(`
-		resmgr_stream_connect($1_t)
+		pcscd_read_pub_files($1_usertype)
+		pcscd_stream_connect($1_usertype)
 	')
 
 	optional_policy(`
-		rpc_dontaudit_getattr_exports($1_t)
-		rpc_manage_nfs_rw_content($1_t)
+		resmgr_stream_connect($1_usertype)
 	')
 
 	optional_policy(`
-		samba_stream_connect_winbind($1_t)
+		rpc_dontaudit_getattr_exports($1_usertype)
+		rpc_manage_nfs_rw_content($1_usertype)
 	')
 
 	optional_policy(`
-		slrnpull_search_spool($1_t)
+		samba_stream_connect_winbind($1_usertype)
 	')
 
 	optional_policy(`
-		usernetctl_run($1_t,$1_r,{ $1_devpts_t $1_tty_device_t })
+		slrnpull_search_spool($1_usertype)
 	')
+
 ')
 
 #######################################
@@ -902,9 +891,7 @@
 ## </param>
 #
 template(`userdom_login_user_template', `
-	gen_require(`
-		class context contains;
-	')
+	gen_tunable(allow_$1_exec_content, true)
 
 	userdom_base_user_template($1)
 
@@ -934,70 +921,72 @@
 
 	allow $1_t self:context contains;
 
-	kernel_dontaudit_read_system_state($1_t)
+	kernel_dontaudit_read_system_state($1_usertype)
 
-	dev_read_sysfs($1_t)
-	dev_read_urand($1_t)
+	dev_read_sysfs($1_usertype)
+	dev_read_urand($1_usertype)
 
-	domain_use_interactive_fds($1_t)
+	domain_use_interactive_fds($1_usertype)
 	# Command completion can fire hundreds of denials
-	domain_dontaudit_exec_all_entry_files($1_t)
+	domain_dontaudit_exec_all_entry_files($1_usertype)
 
-	files_dontaudit_list_default($1_t)
-	files_dontaudit_read_default_files($1_t)
 	# Stat lost+found.
-	files_getattr_lost_found_dirs($1_t)
+	files_getattr_lost_found_dirs($1_usertype)
 
-	fs_get_all_fs_quotas($1_t)
-	fs_getattr_all_fs($1_t)
-	fs_getattr_all_dirs($1_t)
-	fs_search_auto_mountpoints($1_t)
-	fs_list_inotifyfs($1_t)
-	fs_rw_anon_inodefs_files($1_t)
+	files_dontaudit_list_default($1_usertype)
+	files_dontaudit_read_default_files($1_usertype)
 
-	auth_dontaudit_write_login_records($1_t)
+	fs_get_all_fs_quotas($1_usertype)
+	fs_getattr_all_fs($1_usertype)
+	fs_search_all($1_usertype)
+	fs_list_inotifyfs($1_usertype)
+	fs_rw_anon_inodefs_files($1_usertype)
 
-	application_exec_all($1_t)
+	auth_dontaudit_write_login_records($1_t)
+	auth_rw_cache($1_t)
 
 	# The library functions always try to open read-write first,
 	# then fall back to read-only if it fails. 
-	init_dontaudit_rw_utmp($1_t)
+	init_dontaudit_rw_utmp($1_usertype)
 	# Stop warnings about access to /dev/console
-	init_dontaudit_use_fds($1_t)
-	init_dontaudit_use_script_fds($1_t)
+	init_dontaudit_use_fds($1_usertype)
+	init_dontaudit_use_script_fds($1_usertype)
 
-	libs_exec_lib_files($1_t)
+	libs_exec_lib_files($1_usertype)
 
-	logging_dontaudit_getattr_all_logs($1_t)
+	logging_dontaudit_getattr_all_logs($1_usertype)
 
-	miscfiles_read_man_pages($1_t)
 	# for running TeX programs
-	miscfiles_read_tetex_data($1_t)
-	miscfiles_exec_tetex_data($1_t)
+	miscfiles_read_tetex_data($1_usertype)
+	miscfiles_exec_tetex_data($1_usertype)
 
-	seutil_read_config($1_t)
+	seutil_read_config($1_usertype)
+	optional_policy(`
+		cups_read_config($1_usertype)
+		cups_stream_connect($1_usertype)
+		cups_stream_connect_ptal($1_usertype)
+	')
 
 	optional_policy(`
-		cups_read_config($1_t)
-		cups_stream_connect($1_t)
-		cups_stream_connect_ptal($1_t)
+		kerberos_use($1_usertype)
+		kerberos_524_connect($1_usertype)
 	')
 
 	optional_policy(`
-		kerberos_use($1_t)
+		mta_dontaudit_read_spool_symlinks($1_usertype)
 	')
 
 	optional_policy(`
-		mta_dontaudit_read_spool_symlinks($1_t)
+		quota_dontaudit_getattr_db($1_usertype)
 	')
 
 	optional_policy(`
-		quota_dontaudit_getattr_db($1_t)
+		rpm_read_db($1_usertype)
+		rpm_dontaudit_manage_db($1_usertype)
 	')
 
 	optional_policy(`
-		rpm_read_db($1_t)
-		rpm_dontaudit_manage_db($1_t)
+		oddjob_run_mkhomedir($1_t, $1_r, { $1_devpts_t $1_tty_device_t })
 	')
 ')
 
@@ -1031,9 +1020,6 @@
 	domain_interactive_fd($1_t)
 
 	typeattribute $1_devpts_t user_ptynode;
-	typeattribute $1_home_dir_t user_home_dir_type;
-	typeattribute $1_home_t user_home_type;
-	typeattribute $1_tmp_t user_tmpfile;
 	typeattribute $1_tty_device_t user_ttynode;
 
 	##############################
@@ -1042,12 +1028,24 @@
 	#
 
 	# privileged home directory writers
-	manage_dirs_pattern(privhome,{ $1_home_dir_t $1_home_t },$1_home_t)
-	manage_files_pattern(privhome,{ $1_home_dir_t $1_home_t },$1_home_t)
-	manage_lnk_files_pattern(privhome,{ $1_home_dir_t $1_home_t },$1_home_t)
-	manage_sock_files_pattern(privhome,{ $1_home_dir_t $1_home_t },$1_home_t)
-	manage_fifo_files_pattern(privhome,{ $1_home_dir_t $1_home_t },$1_home_t)
-	filetrans_pattern(privhome,$1_home_dir_t,$1_home_t,{ dir file lnk_file sock_file fifo_file })
+	manage_dirs_pattern(privhome, { user_home_dir_t user_home_t }, user_home_t)
+	manage_files_pattern(privhome, { user_home_dir_t user_home_t }, user_home_t)
+	manage_lnk_files_pattern(privhome, { user_home_dir_t user_home_t }, user_home_t)
+	manage_sock_files_pattern(privhome, { user_home_dir_t user_home_t }, user_home_t)
+	manage_fifo_files_pattern(privhome, { user_home_dir_t user_home_t }, user_home_t)
+	filetrans_pattern(privhome, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
+
+	optional_policy(`
+		dbus_per_role_template($1, $1_usertype, $1_r)
+		dbus_system_bus_client_template($1, $1_usertype)
+
+		optional_policy(`
+			consolekit_dbus_chat($1_usertype)
+		')
+		optional_policy(`
+			cups_dbus_chat($1_usertype)
+		')
+	')
 
 	optional_policy(`
 		loadkeys_run($1_t,$1_r,$1_tty_device_t)
@@ -1087,14 +1085,16 @@
 	#
 
 	authlogin_per_role_template($1, $1_t, $1_r)
-	auth_search_pam_console_data($1_t)
+	auth_search_pam_console_data($1_usertype)
 
-	dev_read_sound($1_t)
-	dev_write_sound($1_t)
+	dev_read_sound($1_usertype)
+	dev_write_sound($1_usertype)
 	# gnome keyring wants to read this.
-	dev_dontaudit_read_rand($1_t)
+	dev_dontaudit_read_rand($1_usertype)
+	# temporarily allow since openoffice requires this
+	dev_read_rand($1_usertype)
 
-	logging_send_syslog_msg($1_t)
+	logging_send_syslog_msg($1_usertype)
 	logging_dontaudit_send_audit_msgs($1_t)
 
 	# Need to to this just so screensaver will work. Should be moved to screensaver domain
@@ -1102,28 +1102,23 @@
 	selinux_get_enforce_mode($1_t)
 
 	optional_policy(`
-		alsa_read_rw_config($1_t)
+		alsa_read_rw_config($1_usertype)
 	')
 
 	optional_policy(`
-		dbus_per_role_template($1, $1_t, $1_r)
-		dbus_system_bus_client_template($1, $1_t)
-
-		optional_policy(`
-			consolekit_dbus_chat($1_t)
+		apache_per_role_template($1, $1_usertype, $1_r)
 		')
 
 		optional_policy(`
-			cups_dbus_chat($1_t)
-		')
+		nsplugin_per_role_template($1, $1_usertype, $1_r)
 	')
 
 	optional_policy(`
-		java_per_role_template($1, $1_t, $1_r)
+		openoffice_per_role_template($1, $1_usertype, $1_r)
 	')
 
 	optional_policy(`
-		setroubleshoot_dontaudit_stream_connect($1_t)
+		polkit_per_role_template($1, $1_usertype, $1_r)
 	')
 ')
 
@@ -1134,8 +1129,7 @@
 ## </summary>
 ## <desc>
 ##	<p>
-##	The template for creating a unprivileged user roughly
-##	equivalent to a regular linux user.
+##	The template containing the most basic rules common to all users.
 ##	</p>
 ##	<p>
 ##	This template creates a user domain, types, and
@@ -1167,11 +1161,10 @@
 	#
 
 	# port access is audited even if dac would not have allowed it, so dontaudit it here
-	corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
+#	corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
 	# Need the following rule to allow users to run vpnc
 	corenet_tcp_bind_xserver_port($1_t)
 
-	files_exec_usr_files($1_t)
 	# cjp: why?
 	files_read_kernel_symbol_table($1_t)
 
@@ -1189,36 +1182,45 @@
 		')
 	')
 
-	tunable_policy(`user_dmesg',`
-		kernel_read_ring_buffer($1_t)
-	',`
-		kernel_dontaudit_read_ring_buffer($1_t)
-	')
-
 	# Allow users to run TCP servers (bind to ports and accept connection from
 	# the same domain and outside users)  disabling this forces FTP passive mode
 	# and may change other protocols
 	tunable_policy(`user_tcp_server',`
 		corenet_tcp_bind_all_nodes($1_t)
-		corenet_tcp_bind_generic_port($1_t)
+		corenet_tcp_bind_all_unreserved_ports($1_t)
 	')
 
+	# Run pppd in pppd_t by default for user
 	optional_policy(`
-		netutils_run_ping_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
-		netutils_run_traceroute_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
+		ppp_run_cond($1_t, $1_r, { $1_tty_device_t $1_devpts_t })
 	')
 
 	optional_policy(`
-		postgresql_userdom_template($1,$1_t,$1_r)
+		games_rw_data($1_usertype)
 	')
 
-	# Run pppd in pppd_t by default for user
 	optional_policy(`
-		ppp_run_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
+		mount_run($1_t, $1_r, { $1_tty_device_t $1_devpts_t })
 	')
 
 	optional_policy(`
-		setroubleshoot_stream_connect($1_t)
+		nsplugin_per_role_template($1, $1_usertype, $1_r)
+	')
+
+	optional_policy(`
+		polkit_per_role_template($1, $1_usertype, $1_r)
+	')
+
+	optional_policy(`
+		java_per_role_template($1, $1_t, $1_r)
+	')
+
+	optional_policy(`
+		mono_per_role_template($1, $1_t, $1_r)
+	')
+
+	optional_policy(`
+		gpg_per_role_template($1, $1_usertype, $1_r)
 	')
 ')
 
@@ -1295,8 +1297,6 @@
 	# Manipulate other users crontab.
 	allow $1_t self:passwd crontab;
 
-	allow $1_t self:netlink_audit_socket nlmsg_readpriv;
-
 	kernel_read_software_raid_state($1_t)
 	kernel_getattr_core_if($1_t)
 	kernel_getattr_message_if($1_t)
@@ -1318,8 +1318,6 @@
 
 	dev_getattr_generic_blk_files($1_t)
 	dev_getattr_generic_chr_files($1_t)
-	# for lsof
-	dev_getattr_mtrr_dev($1_t)
 	# Allow MAKEDEV to work
 	dev_create_all_blk_files($1_t)
 	dev_create_all_chr_files($1_t)
@@ -1374,13 +1372,6 @@
 	# But presently necessary for installing the file_contexts file.
 	seutil_manage_bin_policy($1_t)
 
-	tunable_policy(`user_rw_noexattrfile',`
-		fs_manage_noxattr_fs_files($1_t)
-		fs_manage_noxattr_fs_dirs($1_t)
-	',`
-		fs_read_noxattr_fs_files($1_t)
-	')
-
 	optional_policy(`
 		postgresql_unconfined($1_t)
 	')
@@ -1432,6 +1423,7 @@
 	dev_relabel_all_dev_nodes($1)
 
 	files_create_boot_flag($1)
+	files_create_default_dir($1)
 
 	# Necessary for managing /boot/efi
 	fs_manage_dos_files($1)
@@ -1461,10 +1453,6 @@
 	seutil_run_semanage($1,$2,$3)
 	seutil_run_setfiles($1, $2, $3)
 
-	staff_dontaudit_append_home_content_files($1)
-
-	sysadm_dontaudit_read_home_content_files($1)
-
 	optional_policy(`
 		aide_run($1,$2, $3)
 	')
@@ -1484,6 +1472,14 @@
 	optional_policy(`
 		netlabel_run_mgmt($1,$2, $3)
 	')
+
+	optional_policy(`
+		staff_dontaudit_append_home_content_files($1)
+	')
+
+	optional_policy(`
+		sysadm_dontaudit_read_home_content_files($1)
+	')
 ')
 
 ########################################
@@ -1741,11 +1737,15 @@
 #
 template(`userdom_user_home_content',`
 	gen_require(`
-		attribute $1_file_type;
+		attribute user_file_type;
+		attribute user_home_type;
+		attribute home_type;
 	')
 
-	typeattribute $2 $1_file_type;
-	files_type($2)
+	typeattribute $2 user_file_type;
+	typeattribute $2 user_home_type;
+	typeattribute $2 home_type;
+	files_poly_member($2)
 ')
 
 ########################################
@@ -1841,11 +1841,11 @@
 #
 template(`userdom_search_user_home_dirs',`
 	gen_require(`
-		type $1_home_dir_t;
+		type user_home_dir_t;
 	')
 
 	files_search_home($2)
-	allow $2 $1_home_dir_t:dir search_dir_perms;
+	allow $2 user_home_dir_t:dir search_dir_perms;
 ')
 
 ########################################
@@ -1875,11 +1875,11 @@
 #
 template(`userdom_list_user_home_dirs',`
 	gen_require(`
-		type $1_home_dir_t;
+		type user_home_dir_t;
 	')
 
 	files_search_home($2)
-	allow $2 $1_home_dir_t:dir list_dir_perms;
+	allow $2 user_home_dir_t:dir list_dir_perms;
 ')
 
 ########################################
@@ -1923,12 +1923,12 @@
 #
 template(`userdom_user_home_domtrans',`
 	gen_require(`
-		type $1_home_dir_t, $1_home_t;
+		type user_home_dir_t, user_home_t;
 	')
 
 	files_search_home($2)
-	allow $2 $1_home_dir_t:dir search_dir_perms;
-	domain_auto_trans($2,$1_home_t,$3)
+	allow $2 user_home_dir_t:dir search_dir_perms;
+	domain_auto_trans($2, user_home_t, $3)
 ')
 
 ########################################
@@ -1958,10 +1958,11 @@
 #
 template(`userdom_dontaudit_list_user_home_dirs',`
 	gen_require(`
-		type $1_home_dir_t;
+		type user_home_dir_t;
 	')
 
-	dontaudit $2 $1_home_dir_t:dir list_dir_perms;
+	dontaudit $2 user_home_dir_t:dir list_dir_perms;
+	dontaudit $2 user_home_t:dir list_dir_perms;
 ')
 
 ########################################
@@ -1993,11 +1994,47 @@
 #
 template(`userdom_manage_user_home_content_dirs',`
 	gen_require(`
-		type $1_home_dir_t, $1_home_t;
+		type user_home_dir_t, user_home_t;
+		attribute user_home_type;
 	')
 
 	files_search_home($2)
-	manage_dirs_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t)
+	manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_t)
+')
+
+########################################
+## <summary>
+##	dontaudit attemps to Create files
+##	in a user home subdirectory.
+## </summary>
+## <desc>
+##	<p>
+##	Create, read, write, and delete directories
+##	in a user home subdirectory.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`userdom_dontaudit_create_user_home_content_files',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	dontaudit $2 user_home_dir_t:file create;
 ')
 
 ########################################
@@ -2029,10 +2066,10 @@
 #
 template(`userdom_dontaudit_setattr_user_home_content_files',`
 	gen_require(`
-		type $1_home_dir_t, $1_home_t;
+		type user_home_dir_t, user_home_t;
 	')
 
-	dontaudit $2 $1_home_t:file setattr;
+	dontaudit $2 user_home_t:file setattr;
 ')
 
 ########################################
@@ -2062,11 +2099,11 @@
 #
 template(`userdom_read_user_home_content_files',`
 	gen_require(`
-		type $1_home_dir_t, $1_home_t;
+		type user_home_dir_t, user_home_t;
 	')
 
 	files_search_home($2)
-	read_files_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t)
+	read_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
 ')
 
 ########################################
@@ -2096,11 +2133,11 @@
 #
 template(`userdom_dontaudit_read_user_home_content_files',`
 	gen_require(`
-		type $1_home_t;
+		type user_home_t;
 	')
 
-	dontaudit $2 $1_home_t:dir list_dir_perms;
-	dontaudit $2 $1_home_t:file read_file_perms;
+	dontaudit $2 user_home_t:dir list_dir_perms;
+	dontaudit $2 user_home_t:file read_file_perms;
 ')
 
 ########################################
@@ -2130,10 +2167,14 @@
 #
 template(`userdom_dontaudit_write_user_home_content_files',`
 	gen_require(`
-		type $1_home_t;
+		type user_home_t;
 	')
 
-	dontaudit $2 $1_home_t:file write;
+	dontaudit $2 user_home_t:file write;
+	fs_dontaudit_list_nfs($2)
+	fs_dontaudit_rw_nfs_files($2)
+	fs_dontaudit_list_cifs($2)
+	fs_dontaudit_rw_cifs_files($2)
 ')
 
 ########################################
@@ -2163,11 +2204,11 @@
 #
 template(`userdom_read_user_home_content_symlinks',`
 	gen_require(`
-		type $1_home_dir_t, $1_home_t;
+		type user_home_dir_t, user_home_t;
 	')
 
 	files_search_home($2)
-	read_lnk_files_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t)
+	read_lnk_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
 ')
 
 ########################################
@@ -2197,11 +2238,11 @@
 #
 template(`userdom_exec_user_home_content_files',`
 	gen_require(`
-		type $1_home_dir_t, $1_home_t;
+		type user_home_dir_t, user_home_t;
 	')
 
 	files_search_home($2)
-	exec_files_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t)
+	exec_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
 ')
 
 ########################################
@@ -2231,10 +2272,10 @@
 #
 template(`userdom_dontaudit_exec_user_home_content_files',`
 	gen_require(`
-		type $1_home_t;
+		type user_home_t;
 	')
 
-	dontaudit $2 $1_home_t:file execute;
+	dontaudit $2 user_home_t:file execute;
 ')
 
 ########################################
@@ -2266,12 +2307,12 @@
 #
 template(`userdom_manage_user_home_content_files',`
 	gen_require(`
-		type $1_home_dir_t, $1_home_t;
+		type user_home_dir_t, user_home_t;
 	')
 
 	files_search_home($2)
-	allow $2 $1_home_dir_t:dir search_dir_perms;
-	manage_files_pattern($2,$1_home_t,$1_home_t)
+	allow $2 user_home_dir_t:dir search_dir_perms;
+	manage_files_pattern($2, user_home_t, user_home_t)
 ')
 
 ########################################
@@ -2303,10 +2344,10 @@
 #
 template(`userdom_dontaudit_manage_user_home_content_dirs',`
 	gen_require(`
-		type $1_home_dir_t, $1_home_t;
+		type user_home_dir_t, user_home_t;
 	')
 
-	dontaudit $2 $1_home_t:dir manage_dir_perms;
+	dontaudit $2 user_home_t:dir manage_dir_perms;
 ')
 
 ########################################
@@ -2338,12 +2379,12 @@
 #
 template(`userdom_manage_user_home_content_symlinks',`
 	gen_require(`
-		type $1_home_dir_t, $1_home_t;
+		type user_home_dir_t, user_home_t;
 	')
 
 	files_search_home($2)
-	allow $2 $1_home_dir_t:dir search_dir_perms;
-	manage_lnk_files_pattern($2,$1_home_t,$1_home_t)
+	allow $2 user_home_dir_t:dir search_dir_perms;
+	manage_lnk_files_pattern($2, user_home_t, user_home_t)
 ')
 
 ########################################
@@ -2375,12 +2416,12 @@
 #
 template(`userdom_manage_user_home_content_pipes',`
 	gen_require(`
-		type $1_home_dir_t, $1_home_t;
+		type user_home_dir_t, user_home_t;
 	')
 
 	files_search_home($2)
-	allow $2 $1_home_dir_t:dir search_dir_perms;
-	manage_fifo_files_pattern($2,$1_home_t,$1_home_t)
+	allow $2 user_home_dir_t:dir search_dir_perms;
+	manage_fifo_files_pattern($2, user_home_t, user_home_t)
 ')
 
 ########################################
@@ -2412,12 +2453,12 @@
 #
 template(`userdom_manage_user_home_content_sockets',`
 	gen_require(`
-		type $1_home_dir_t, $1_home_t;
+		type user_home_dir_t, user_home_t;
 	')
 
 	files_search_home($2)
-	allow $2 $1_home_dir_t:dir search_dir_perms;
-	manage_sock_files_pattern($2,$1_home_t,$1_home_t)
+	allow $2 user_home_dir_t:dir search_dir_perms;
+	manage_sock_files_pattern($2, user_home_t, user_home_t)
 ')
 
 ########################################
@@ -2462,11 +2503,11 @@
 #
 template(`userdom_user_home_dir_filetrans',`
 	gen_require(`
-		type $1_home_dir_t;
+		type user_home_dir_t;
 	')
 
 	files_search_home($2)
-	filetrans_pattern($2,$1_home_dir_t,$3,$4)
+	filetrans_pattern($2, user_home_dir_t, $3, $4)
 ')
 
 ########################################
@@ -2511,11 +2552,11 @@
 #
 template(`userdom_user_home_content_filetrans',`
 	gen_require(`
-		type $1_home_t;
+		type user_home_t;
 	')
 
 	files_search_home($2)
-	filetrans_pattern($2,$1_home_t,$3,$4)
+	filetrans_pattern($2, user_home_t, $3, $4)
 ')
 
 ########################################
@@ -2555,11 +2596,11 @@
 #
 template(`userdom_user_home_dir_filetrans_user_home_content',`
 	gen_require(`
-		type $1_home_dir_t, $1_home_t;
+		type user_home_dir_t, user_home_t;
 	')
 
 	files_search_home($2)
-	filetrans_pattern($2,$1_home_dir_t,$1_home_t,$3)
+	filetrans_pattern($2, user_home_dir_t, user_home_t, $3)
 ')
 
 ########################################
@@ -2589,11 +2630,11 @@
 #
 template(`userdom_write_user_tmp_sockets',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
 	files_search_tmp($2)
-	allow $2 $1_tmp_t:sock_file write;
+	write_sock_files_pattern($2, user_tmp_t, user_tmp_t)
 ')
 
 ########################################
@@ -2623,11 +2664,11 @@
 #
 template(`userdom_list_user_tmp',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
 	files_search_tmp($2)
-	allow $2 $1_tmp_t:dir list_dir_perms;
+	allow $2 user_tmp_t:dir list_dir_perms;
 ')
 
 ########################################
@@ -2659,10 +2700,10 @@
 #
 template(`userdom_dontaudit_list_user_tmp',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
-	dontaudit $2 $1_tmp_t:dir list_dir_perms;
+	dontaudit $2 user_tmp_t:dir list_dir_perms;
 ')
 
 ########################################
@@ -2694,10 +2735,10 @@
 #
 template(`userdom_dontaudit_manage_user_tmp_dirs',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
-	dontaudit $2 $1_tmp_t:dir manage_dir_perms;
+	dontaudit $2 user_tmp_t:dir manage_dir_perms;
 ')
 
 ########################################
@@ -2727,12 +2768,12 @@
 #
 template(`userdom_read_user_tmp_files',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
 	files_search_tmp($2)
-	allow $2 $1_tmp_t:dir list_dir_perms;
-	read_files_pattern($2,$1_tmp_t,$1_tmp_t)
+	allow $2 user_tmp_t:dir list_dir_perms;
+	read_files_pattern($2, user_tmp_t, user_tmp_t)
 ')
 
 ########################################
@@ -2764,10 +2805,10 @@
 #
 template(`userdom_dontaudit_read_user_tmp_files',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
-	dontaudit $2 $1_tmp_t:file read_file_perms;
+	dontaudit $2 user_tmp_t:file read_file_perms;
 ')
 
 ########################################
@@ -2799,10 +2840,10 @@
 #
 template(`userdom_dontaudit_append_user_tmp_files',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
-	dontaudit $2 $1_tmp_t:file append;
+	dontaudit $2 user_tmp_t:file append;
 ')
 
 ########################################
@@ -2832,12 +2873,12 @@
 #
 template(`userdom_rw_user_tmp_files',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
 	files_search_tmp($2)
-	allow $2 $1_tmp_t:dir list_dir_perms;
-	rw_files_pattern($2,$1_tmp_t,$1_tmp_t)
+	allow $2 user_tmp_t:dir list_dir_perms;
+	rw_files_pattern($2, user_tmp_t, user_tmp_t)
 ')
 
 ########################################
@@ -2869,10 +2910,10 @@
 #
 template(`userdom_dontaudit_manage_user_tmp_files',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
-	dontaudit $2 $1_tmp_t:file manage_file_perms;
+	dontaudit $2 user_tmp_t:file manage_file_perms;
 ')
 
 ########################################
@@ -2904,12 +2945,12 @@
 #
 template(`userdom_read_user_tmp_symlinks',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
 	files_search_tmp($2)
-	allow $2 $1_tmp_t:dir list_dir_perms;
-	read_lnk_files_pattern($2,$1_tmp_t,$1_tmp_t)
+	allow $2 user_tmp_t:dir list_dir_perms;
+	read_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
 ')
 
 ########################################
@@ -2941,11 +2982,11 @@
 #
 template(`userdom_manage_user_tmp_dirs',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
 	files_search_tmp($2)
-	manage_dirs_pattern($2,$1_tmp_t,$1_tmp_t)
+	manage_dirs_pattern($2, user_tmp_t, user_tmp_t)
 ')
 
 ########################################
@@ -2977,11 +3018,11 @@
 #
 template(`userdom_manage_user_tmp_files',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
 	files_search_tmp($2)
-	manage_files_pattern($2,$1_tmp_t,$1_tmp_t)
+	manage_files_pattern($2, user_tmp_t, user_tmp_t)
 ')
 
 ########################################
@@ -3013,11 +3054,11 @@
 #
 template(`userdom_manage_user_tmp_symlinks',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
 	files_search_tmp($2)
-	manage_lnk_files_pattern($2,$1_tmp_t,$1_tmp_t)
+	manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
 ')
 
 ########################################
@@ -3049,11 +3090,11 @@
 #
 template(`userdom_manage_user_tmp_pipes',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
 	files_search_tmp($2)
-	manage_fifo_files_pattern($2,$1_tmp_t,$1_tmp_t)
+	manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
 ')
 
 ########################################
@@ -3085,11 +3126,11 @@
 #
 template(`userdom_manage_user_tmp_sockets',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
 	files_search_tmp($2)
-	manage_sock_files_pattern($2,$1_tmp_t,$1_tmp_t)
+	manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
 ')
 
 ########################################
@@ -3134,10 +3175,10 @@
 #
 template(`userdom_user_tmp_filetrans',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
-	filetrans_pattern($2,$1_tmp_t,$3,$4)
+	filetrans_pattern($2, user_tmp_t, $3, $4)
 	files_search_tmp($2)
 ')
 
@@ -3178,19 +3219,19 @@
 #
 template(`userdom_tmp_filetrans_user_tmp',`
 	gen_require(`
-		type $1_tmp_t;
+		type user_tmp_t;
 	')
 
-	files_tmp_filetrans($2,$1_tmp_t,$3)
+	files_tmp_filetrans($2, user_tmp_t, $3)
 ')
 
 ########################################
 ## <summary>
-##	Read user tmpfs files.
+##	Read/write user tmpfs files.
 ## </summary>
 ## <desc>
 ##	<p>
-##	Read user tmpfs files.
+##	Read/write user tmpfs files.
 ##	</p>
 ##	<p>
 ##	This is a templated interface, and should only
@@ -4616,11 +4657,11 @@
 #
 interface(`userdom_search_all_users_home_dirs',`
 	gen_require(`
-		attribute home_dir_type;
+		attribute user_home_dir_type;
 	')
 
 	files_list_home($1)
-	allow $1 home_dir_type:dir search_dir_perms;
+	allow $1 user_home_dir_type:dir search_dir_perms;
 ')
 
 ########################################
@@ -4640,6 +4681,14 @@
 
 	files_list_home($1)
 	allow $1 home_dir_type:dir list_dir_perms;
+
+	tunable_policy(`use_nfs_home_dirs',`
+		fs_list_nfs($1)
+	')
+
+	tunable_policy(`use_samba_home_dirs',`
+		fs_list_cifs($1)
+	')
 ')
 
 ########################################
@@ -4677,6 +4726,8 @@
 	')
 
 	dontaudit $1 { home_dir_type home_type }:dir search_dir_perms;
+	fs_dontaudit_list_nfs($1)
+	fs_dontaudit_list_cifs($1)
 ')
 
 ########################################
@@ -4721,6 +4772,25 @@
 
 ########################################
 ## <summary>
+##	Delete all files
+##	in all users home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_all_users_home_content_files',`
+	gen_require(`
+		attribute home_type;
+	')
+
+	delete_files_pattern($1, home_type, home_type)
+')
+
+########################################
+## <summary>
 ##	Create, read, write, and delete all files
 ##	in all users home directories.
 ## </summary>
@@ -4946,7 +5016,7 @@
 
 ########################################
 ## <summary>
-##	Relabel to generic user home directories.
+##	Relabel to staff home directories.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -5318,6 +5388,42 @@
 
 ########################################
 ## <summary>
+##	Write all unprivileged users files in /tmp
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_unpriv_users_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	manage_files_pattern($1, user_tmp_t,  user_tmp_t)
+')
+
+########################################
+## <summary>
+##	Write all unprivileged users lnk_files in /tmp
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_unpriv_users_tmp_symlinks',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	manage_lnk_files_pattern($1, user_tmp_t,  user_tmp_t)
+')
+
+########################################
+## <summary>
 ##	Read and write unprivileged user ttys.
 ## </summary>
 ## <param name="domain">
@@ -5368,7 +5474,7 @@
 		attribute userdomain;
 	')
 
-	read_files_pattern($1,userdomain,userdomain)
+	ps_process_pattern($1, userdomain)
 	kernel_search_proc($1)
 ')
 
@@ -5483,7 +5589,7 @@
 
 ########################################
 ## <summary>
-##	Send a dbus message to all user domains.
+##	Manage keys for all user domains.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -5491,10 +5597,46 @@
 ##	</summary>
 ## </param>
 #
-interface(`userdom_dbus_send_all_users',`
+interface(`userdom_manage_all_users_keys',`
 	gen_require(`
 		attribute userdomain;
-		class dbus send_msg;
+	')
+
+	allow $1 userdomain:key manage_key_perms;
+')
+
+########################################
+## <summary>
+##	dontaudit search keys for all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_search_all_users_keys',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	dontaudit $1 userdomain:key search;
+')
+
+########################################
+## <summary>
+##	Send a dbus message to all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_dbus_send_all_users',`
+	gen_require(`
+		attribute userdomain;
+		class dbus send_msg;
 	')
 
 	allow $1 userdomain:dbus send_msg;
@@ -5513,3 +5655,506 @@
 interface(`userdom_unconfined',`
 	refpolicywarn(`$0($*) has been deprecated.')
 ')
+
+########################################
+## <summary>
+##	allow getattr all user file type
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`userdom_list_user_files',`
+	gen_require(`
+		attribute user_home_type;
+	')
+
+	allow $2 user_home_type:dir search_dir_perms;
+	allow $2 user_home_type:file getattr;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to write to homedirs of sysadm users 
+##	home directory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_write_sysadm_home_dirs',`
+	gen_require(`
+		type admin_home_t;
+	')
+
+	dontaudit $1 admin_home_t:dir write;
+')
+
+########################################
+## <summary>
+##	Ptrace all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`userdom_ptrace_all_users',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	allow $1 userdomain:process ptrace;
+')
+
+########################################
+## <summary>
+##	unlink all unprivileged users home directory
+##	files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_unlink_unpriv_users_home_content_files',`
+	gen_require(`
+		attribute user_home_dir_type, user_home_type;
+	')
+
+	files_search_home($1)
+	allow $1 user_home_dir_type:dir list_dir_perms;
+	allow $1 user_home_type:file unlink;
+')
+
+########################################
+## <summary>
+##	dontaudit search all users home directory
+##	files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_search_users_home_dirs',`
+
+	gen_require(`
+		attribute user_home_dir_type;
+	')
+
+	files_search_home($1)
+	dontaudit $1 user_home_dir_type:dir search_dir_perms;
+')
+
+
+########################################
+## <summary>
+##	Identify specified type as being in a users home directory
+## </summary>
+## <desc>
+##	<p>
+##	Make the specified type a home type.
+##	</p>
+## </desc>
+## <param name="type">
+##	<summary>
+##	Type to be used as a home directory type.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_home_type',`
+	gen_require(`
+		attribute user_home_type;
+		attribute home_type;
+	')
+	typeattribute $1 user_home_type;
+	typeattribute $1 home_type;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to relabel unpriv user
+##	home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_relabel_unpriv_user_home_content_files',`
+	gen_require(`
+		attribute user_home_type;
+	')
+
+	dontaudit $1 user_home_type:file { relabelto relabelfrom };
+')
+
+
+########################################
+## <summary>
+##	Mmap of unpriv user
+##	home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_mmap_unpriv_user_home_content_files',`
+	gen_require(`
+		attribute user_home_type;
+	')
+
+	files_search_home($1)
+	allow $1 user_home_type:file execute;
+')
+
+########################################
+## <summary>
+##	dontaudit attempts to write to user home dir files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_write_unpriv_user_home_content_files',`
+	gen_require(`
+		attribute user_home_type;
+	')
+
+	allow $1 user_home_type:file write_file_perms;
+')
+
+########################################
+## <summary>
+##	Allow apps to set rlimits on userdomain
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_set_rlimitnh',`
+	gen_require(`
+		attribute userdomain;
+	')
+	allow $1 userdomain:process rlimitinh;
+')
+
+########################################
+## <summary>
+##	Define this type as a Allow apps to set rlimits on userdomain
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`userdom_unpriv_usertype',`
+	gen_require(`
+		attribute unpriv_userdomain, userdomain;
+		attribute $1_usertype;
+	')
+	typeattribute $2  $1_usertype;
+	typeattribute $2  unpriv_userdomain;
+	typeattribute $2  userdomain;
+
+#	optional_policy(`
+#		xserver_usertype($1, $2)
+#	')
+')
+
+
+########################################
+## <summary>
+##	Manage and create all files in /tmp on behalf of the user
+## </summary>
+## <desc>
+##	<p>
+##	The interface for full access to the temporary directories.
+##	This creates a derived type for the user
+##	temporary type.  Execute access is not given.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="class">
+##	<summary>
+##	The class of the object to be created.
+##	If not specified, file is used.
+##	</summary>
+## </param>
+#
+template(`userdom_transition_user_tmp',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	files_tmp_filetrans($2, user_tmp_t, $3)
+')
+
+################################################
+## <summary>
+## Allow unpriv users read domains system state
+## </summary>
+## <desc>
+## Allow the ps command visibility to processes in
+## the specified domain when used by an 
+## unprivileged user
+## </desc>
+## <param name="domain_allowed_access">
+##	<summary>
+## 	Domain for which the ps command will have access
+##	</summary>
+## </param>
+## <rolebase/>
+## 
+#
+interface(`userdom_readable_process',`
+  gen_require(`
+      attribute unpriv_process;
+  ')
+
+  typeattribute $1 unpriv_process;
+')
+
+########################################
+## <summary>
+##	Read user tmpfs files.
+## </summary>
+## <desc>
+##	<p>
+##	Read user tmpfs files.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`userdom_read_user_tmpfs_files',`
+	gen_require(`
+		type $1_tmpfs_t;
+	')
+
+	fs_search_tmpfs($2)
+	allow $2 $1_tmpfs_t:dir list_dir_perms;
+	read_files_pattern($2, $1_tmpfs_t, $1_tmpfs_t)
+	read_lnk_files_pattern($2, $1_tmpfs_t, $1_tmpfs_t)
+')
+
+#######################################
+## <summary>
+##	The template for creating a unprivileged user roughly
+##	equivalent to a regular linux user.
+## </summary>
+## <desc>
+##	<p>
+##     The template for creating a unprivileged user roughly
+##     equivalent to a regular linux user.
+##     </p>
+##     <p>
+##	This template creates a user domain, types, and
+##	rules for the user's tty, pty, home directories,
+##	tmp, and tmpfs files.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+#
+template(`userdom_admin_login_user_template',`
+					      
+  userdom_unpriv_user_template($1)
+
+  allow $1_t self:capability sys_nice;
+
+  domain_read_all_domains_state($1_t)
+  domain_getattr_all_domains($1_t)
+
+  files_read_kernel_modules($1_t)
+
+  kernel_read_fs_sysctls($1_t)
+
+  modutils_read_module_config($1_t)
+  modutils_read_module_deps($1_t)
+
+  miscfiles_read_hwdata($1_t)
+
+  sudo_per_role_template($1, $1_t, $1_r)
+  seutil_run_newrole($1_t, $1_r, { $1_tty_device_t $1_devpts_t })
+
+  optional_policy(`
+	gnomeclock_dbus_chat($1_t)
+  ')
+
+  optional_policy(`
+	kerneloops_dbus_chat($1_t)
+  ')
+
+  optional_policy(`
+	rpm_dbus_chat($1_t)
+  ')
+
+  optional_policy(`
+	setroubleshoot_stream_connect($1_t)
+  ')
+
+  optional_policy(`
+	netutils_run_ping_cond($1_t, $1_r, { $1_tty_device_t $1_devpts_t })
+	netutils_run_traceroute_cond($1_t, $1_r, { $1_tty_device_t $1_devpts_t })
+  ')
+')
+
+
+########################################
+## <summary>
+##	Relabel to all user home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_relabel_all_home_dirs',`
+	gen_require(`
+		attribute user_home_type;
+	')
+
+	files_search_home($1)
+	relabel_dirs_pattern($1, user_home_type,  user_home_type)
+')
+
+########################################
+## <summary>
+##	Relabel to all user home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_relabel_all_home_files',`
+	gen_require(`
+		attribute user_home_type;
+	')
+
+	files_search_home($1)
+	relabel_files_pattern($1, user_home_type,  user_home_type)
+')
+
+########################################
+## <summary>
+##	Read all users home directories symlinks.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_read_all_users_home_content_symlinks',`
+	gen_require(`
+		attribute home_type;
+	')
+
+	files_list_home($1)
+	read_lnk_files_pattern($1, home_type, home_type)
+')
+
+########################################
+## <summary>
+##	delete all directories
+##	in all users home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_all_users_home_content_dirs',`
+	gen_require(`
+		attribute home_type;
+	')
+
+	files_list_home($1)
+	delete_dirs_pattern($1, home_type, home_type)
+')
+
+########################################
+## <summary>
+##	Delete all symlinks
+##	in all users home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_all_users_home_content_symlinks',`
+	gen_require(`
+		attribute home_type;
+	')
+
+	files_list_home($1)
+	delete_lnk_files_pattern($1, home_type, home_type)
+')
+
--- nsaserefpolicy/policy/modules/system/userdomain.te	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/system/userdomain.te	2008-08-14 13:53:54.000000000 -0400
@@ -8,13 +8,6 @@
 
 ## <desc>
 ## <p>
-## Allow users to connect to mysql
-## </p>
-## </desc>
-gen_tunable(allow_user_mysql_connect,false)
-
-## <desc>
-## <p>
 ## Allow users to connect to PostgreSQL
 ## </p>
 ## </desc>
@@ -29,13 +22,6 @@
 
 ## <desc>
 ## <p>
-## Allow users to read system messages.
-## </p>
-## </desc>
-gen_tunable(user_dmesg,false)
-
-## <desc>
-## <p>
 ## Allow user to r/w files on filesystems
 ## that do not have extended attributes (FAT, CDROM, FLOPPY)
 ## </p>
@@ -58,6 +44,12 @@
 # users home directory contents
 attribute home_type;
 
+# Executables to be run by user
+attribute user_exec_type;
+
+# File types owned by users
+attribute user_file_type;
+
 # The privhome attribute identifies every domain that can create files under
 # regular user home directories in the regular context (IE act on behalf of
 # a user in writing regular files)
@@ -81,6 +73,72 @@
 
 # unprivileged user domains
 attribute unpriv_userdomain;
+attribute unpriv_process;
 
 attribute untrusted_content_type;
 attribute untrusted_content_tmp_type;
+
+type admin_home_t, home_type;
+files_type(admin_home_t)
+files_associate_tmp(admin_home_t)
+fs_associate_tmpfs(admin_home_t)
+files_mountpoint(admin_home_t)
+
+type user_home_t, user_file_type, user_home_type, home_type;
+files_type(user_home_t)
+files_associate_tmp(user_home_t)
+fs_associate_tmpfs(user_home_t)
+files_mountpoint(user_home_t)
+files_poly_parent(user_home_t)
+files_poly_member(user_home_t)
+
+# type of home directory
+type user_home_dir_t, home_dir_type, user_home_dir_type, home_type;
+files_type(user_home_dir_t)
+files_mountpoint(user_home_dir_t)
+files_associate_tmp(user_home_dir_t)
+fs_associate_tmpfs(user_home_dir_t)
+files_poly(user_home_dir_t)
+files_poly_member(user_home_dir_t)
+files_poly_parent(user_home_dir_t)
+
+type user_tmp_t, user_file_type, user_tmpfile;
+files_tmp_file(user_tmp_t)
+
+##############################
+#
+# User home directory file rules
+#
+
+allow user_file_type user_home_t:filesystem associate;
+
+# Rules used to associate a homedir as a mountpoint
+allow user_home_t self:filesystem associate;
+
+tunable_policy(`allow_console_login',`
+	term_use_console(userdomain)
+')
+
+# Allow unpriv users to read system state of unpriv processes
+read_files_pattern(unpriv_userdomain, unpriv_process, unpriv_process)
+read_lnk_files_pattern(unpriv_userdomain, unpriv_process, unpriv_process)
+allow unpriv_userdomain unpriv_process:process getattr;
+dontaudit unpriv_userdomain unpriv_process:process ptrace;
+
+
+tunable_policy(`use_nfs_home_dirs',`
+	manage_dirs_pattern(privhome, nfs_t, nfs_t)
+	manage_files_pattern(privhome, nfs_t, nfs_t)
+	manage_lnk_files_pattern(privhome, nfs_t, nfs_t)
+	manage_sock_files_pattern(privhome, nfs_t, nfs_t)
+	manage_fifo_files_pattern(privhome, nfs_t, nfs_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+	manage_dirs_pattern(privhome, cifs_t, cifs_t)
+	manage_files_pattern(privhome, cifs_t, cifs_t)
+	manage_lnk_files_pattern(privhome, cifs_t, cifs_t)
+	manage_sock_files_pattern(privhome, cifs_t, cifs_t)
+	manage_fifo_files_pattern(privhome, cifs_t, cifs_t)
+')
+
