diff --git a/policy/modules/admin/amanda.te b/policy/modules/admin/amanda.te
index 46d467c..3f6cd5e 100644
--- a/policy/modules/admin/amanda.te
+++ b/policy/modules/admin/amanda.te
@@ -207,5 +207,5 @@ logging_search_logs(amanda_recover_t)
 
 miscfiles_read_localization(amanda_recover_t)
 
-userdom_use_user_terminals(amanda_recover_t)
+userdom_use_inherited_user_terminals(amanda_recover_t)
 userdom_search_user_home_content(amanda_recover_t)
diff --git a/policy/modules/admin/amtu.te b/policy/modules/admin/amtu.te
index 057abb0..c75e9e9 100644
--- a/policy/modules/admin/amtu.te
+++ b/policy/modules/admin/amtu.te
@@ -23,7 +23,7 @@ files_read_etc_files(amtu_t)
 
 logging_send_audit_msgs(amtu_t)
 
-userdom_use_user_terminals(amtu_t)
+userdom_use_inherited_user_terminals(amtu_t)
 
 optional_policy(`
 	nscd_dontaudit_search_pid(amtu_t)
diff --git a/policy/modules/admin/apt.te b/policy/modules/admin/apt.te
index 4044710..3491c7f 100644
--- a/policy/modules/admin/apt.te
+++ b/policy/modules/admin/apt.te
@@ -121,7 +121,7 @@ fs_getattr_all_fs(apt_t)
 
 term_create_pty(apt_t, apt_devpts_t)
 term_list_ptys(apt_t)
-term_use_all_terms(apt_t)
+term_use_all_inherited_terms(apt_t)
 
 libs_exec_ld_so(apt_t)
 libs_exec_lib_files(apt_t)
@@ -134,7 +134,7 @@ seutil_use_newrole_fds(apt_t)
 
 sysnet_read_config(apt_t)
 
-userdom_use_user_terminals(apt_t)
+userdom_use_inherited_user_terminals(apt_t)
 
 # with boolean, for cron-apt and such?
 #optional_policy(`
diff --git a/policy/modules/admin/backup.te b/policy/modules/admin/backup.te
index 0bfc958..af95b7a 100644
--- a/policy/modules/admin/backup.te
+++ b/policy/modules/admin/backup.te
@@ -70,7 +70,7 @@ logging_send_syslog_msg(backup_t)
 
 sysnet_read_config(backup_t)
 
-userdom_use_user_terminals(backup_t)
+userdom_use_inherited_user_terminals(backup_t)
 
 optional_policy(`
 	cron_system_entry(backup_t, backup_exec_t)
diff --git a/policy/modules/admin/bootloader.te b/policy/modules/admin/bootloader.te
index d3da8f2..ff661da 100644
--- a/policy/modules/admin/bootloader.te
+++ b/policy/modules/admin/bootloader.te
@@ -127,7 +127,7 @@ seutil_read_bin_policy(bootloader_t)
 seutil_read_loadpolicy(bootloader_t)
 seutil_dontaudit_search_config(bootloader_t)
 
-userdom_use_user_terminals(bootloader_t)
+userdom_use_inherited_user_terminals(bootloader_t)
 userdom_dontaudit_search_user_home_dirs(bootloader_t)
 
 ifdef(`distro_debian',`
diff --git a/policy/modules/admin/consoletype.te b/policy/modules/admin/consoletype.te
index cd5e005..c42874e 100644
--- a/policy/modules/admin/consoletype.te
+++ b/policy/modules/admin/consoletype.te
@@ -54,7 +54,7 @@ init_use_script_ptys(consoletype_t)
 init_use_script_fds(consoletype_t)
 init_rw_script_pipes(consoletype_t)
 
-userdom_use_user_terminals(consoletype_t)
+userdom_use_inherited_user_terminals(consoletype_t)
 
 ifdef(`distro_redhat',`
 	fs_rw_tmpfs_chr_files(consoletype_t)
diff --git a/policy/modules/admin/dmesg.te b/policy/modules/admin/dmesg.te
index 72bc6d8..71b6629 100644
--- a/policy/modules/admin/dmesg.te
+++ b/policy/modules/admin/dmesg.te
@@ -47,7 +47,7 @@ logging_write_generic_logs(dmesg_t)
 miscfiles_read_localization(dmesg_t)
 
 userdom_dontaudit_use_unpriv_user_fds(dmesg_t)
-userdom_use_user_terminals(dmesg_t)
+userdom_use_inherited_user_terminals(dmesg_t)
 
 optional_policy(`
 	seutil_sigchld_newrole(dmesg_t)
diff --git a/policy/modules/admin/dmidecode.te b/policy/modules/admin/dmidecode.te
index d6356b5..5db989e 100644
--- a/policy/modules/admin/dmidecode.te
+++ b/policy/modules/admin/dmidecode.te
@@ -27,4 +27,4 @@ files_list_usr(dmidecode_t)
 
 locallogin_use_fds(dmidecode_t)
 
-userdom_use_user_terminals(dmidecode_t)
+userdom_use_inherited_user_terminals(dmidecode_t)
diff --git a/policy/modules/admin/dpkg.te b/policy/modules/admin/dpkg.te
index 6776b69..c9012d4 100644
--- a/policy/modules/admin/dpkg.te
+++ b/policy/modules/admin/dpkg.te
@@ -161,7 +161,7 @@ seutil_manage_bin_policy(dpkg_t)
 
 sysnet_read_config(dpkg_t)
 
-userdom_use_user_terminals(dpkg_t)
+userdom_use_inherited_user_terminals(dpkg_t)
 userdom_use_unpriv_users_fds(dpkg_t)
 
 # transition to dpkg script:
@@ -282,7 +282,7 @@ selinux_compute_user_contexts(dpkg_script_t)
 storage_raw_read_fixed_disk(dpkg_script_t)
 storage_raw_write_fixed_disk(dpkg_script_t)
 
-term_use_all_terms(dpkg_script_t)
+term_use_all_inherited_terms(dpkg_script_t)
 
 auth_dontaudit_getattr_shadow(dpkg_script_t)
 # ideally we would not need this
diff --git a/policy/modules/admin/firstboot.te b/policy/modules/admin/firstboot.te
index c4d8998..5be4abe 100644
--- a/policy/modules/admin/firstboot.te
+++ b/policy/modules/admin/firstboot.te
@@ -80,7 +80,7 @@ modutils_domtrans_depmod(firstboot_t)
 modutils_read_module_config(firstboot_t)
 modutils_read_module_deps(firstboot_t)
 
-userdom_use_user_terminals(firstboot_t)
+userdom_use_inherited_user_terminals(firstboot_t)
 # Add/remove user home directories
 userdom_manage_user_home_content_dirs(firstboot_t)
 userdom_manage_user_home_content_files(firstboot_t)
diff --git a/policy/modules/admin/kismet.te b/policy/modules/admin/kismet.te
index 9dd6880..4b7fa27 100644
--- a/policy/modules/admin/kismet.te
+++ b/policy/modules/admin/kismet.te
@@ -91,7 +91,7 @@ files_read_usr_files(kismet_t)
 
 miscfiles_read_localization(kismet_t)
 
-userdom_use_user_terminals(kismet_t)
+userdom_use_inherited_user_terminals(kismet_t)
 userdom_read_user_tmpfs_files(kismet_t)
 
 optional_policy(`
diff --git a/policy/modules/admin/kudzu.te b/policy/modules/admin/kudzu.te
index 4f7bd3c..8debd58 100644
--- a/policy/modules/admin/kudzu.te
+++ b/policy/modules/admin/kudzu.te
@@ -119,7 +119,7 @@ modutils_domtrans_insmod(kudzu_t)
 
 sysnet_read_config(kudzu_t)
 
-userdom_use_user_terminals(kudzu_t)
+userdom_use_inherited_user_terminals(kudzu_t)
 userdom_dontaudit_use_unpriv_user_fds(kudzu_t)
 userdom_search_user_home_dirs(kudzu_t)
 
diff --git a/policy/modules/admin/logrotate.te b/policy/modules/admin/logrotate.te
index 7090dae..2de56db 100644
--- a/policy/modules/admin/logrotate.te
+++ b/policy/modules/admin/logrotate.te
@@ -116,7 +116,7 @@ miscfiles_read_localization(logrotate_t)
 
 seutil_dontaudit_read_config(logrotate_t)
 
-userdom_use_user_terminals(logrotate_t)
+userdom_use_inherited_user_terminals(logrotate_t)
 userdom_list_user_home_dirs(logrotate_t)
 userdom_use_unpriv_users_fds(logrotate_t)
 
diff --git a/policy/modules/admin/mrtg.te b/policy/modules/admin/mrtg.te
index 0e19d80..9630f71 100644
--- a/policy/modules/admin/mrtg.te
+++ b/policy/modules/admin/mrtg.te
@@ -112,7 +112,7 @@ miscfiles_read_localization(mrtg_t)
 
 selinux_dontaudit_getattr_dir(mrtg_t)
 
-userdom_use_user_terminals(mrtg_t)
+userdom_use_inherited_user_terminals(mrtg_t)
 userdom_dontaudit_read_user_home_content_files(mrtg_t)
 userdom_dontaudit_use_unpriv_user_fds(mrtg_t)
 
diff --git a/policy/modules/admin/netutils.te b/policy/modules/admin/netutils.te
index e0791b9..27fcbe0 100644
--- a/policy/modules/admin/netutils.te
+++ b/policy/modules/admin/netutils.te
@@ -83,7 +83,7 @@ logging_send_syslog_msg(netutils_t)
 miscfiles_read_localization(netutils_t)
 
 term_dontaudit_use_console(netutils_t)
-userdom_use_user_terminals(netutils_t)
+userdom_use_inherited_user_terminals(netutils_t)
 userdom_use_all_users_fds(netutils_t)
 
 optional_policy(`
diff --git a/policy/modules/admin/portage.if b/policy/modules/admin/portage.if
index 8aaa46d..8714d7f 100644
--- a/policy/modules/admin/portage.if
+++ b/policy/modules/admin/portage.if
@@ -183,7 +183,7 @@ interface(`portage_compile_domain',`
 
 	logging_send_syslog_msg($1)
 
-	userdom_use_user_terminals($1)
+	userdom_use_inherited_user_terminals($1)
 
 	# SELinux-enabled programs running in the sandbox
 	seutil_libselinux_linked($1)
diff --git a/policy/modules/admin/portage.te b/policy/modules/admin/portage.te
index c633aea..313dd50 100644
--- a/policy/modules/admin/portage.te
+++ b/policy/modules/admin/portage.te
@@ -105,7 +105,7 @@ logging_send_syslog_msg(gcc_config_t)
 
 miscfiles_read_localization(gcc_config_t)
 
-userdom_use_user_terminals(gcc_config_t)
+userdom_use_inherited_user_terminals(gcc_config_t)
 
 consoletype_exec(gcc_config_t)
 
@@ -254,7 +254,7 @@ miscfiles_read_localization(portage_fetch_t)
 sysnet_read_config(portage_fetch_t)
 sysnet_dns_name_resolve(portage_fetch_t)
 
-userdom_use_user_terminals(portage_fetch_t)
+userdom_use_inherited_user_terminals(portage_fetch_t)
 userdom_dontaudit_read_user_home_content_files(portage_fetch_t)
 
 ifdef(`hide_broken_symptoms',`
diff --git a/policy/modules/admin/quota.te b/policy/modules/admin/quota.te
index 5dd42f5..f13ac41 100644
--- a/policy/modules/admin/quota.te
+++ b/policy/modules/admin/quota.te
@@ -72,7 +72,7 @@ init_use_script_ptys(quota_t)
 
 logging_send_syslog_msg(quota_t)
 
-userdom_use_user_terminals(quota_t)
+userdom_use_inherited_user_terminals(quota_t)
 userdom_dontaudit_use_unpriv_user_fds(quota_t)
 
 optional_policy(`
diff --git a/policy/modules/admin/rpm.te b/policy/modules/admin/rpm.te
index 47a8f7d..881d7bf 100644
--- a/policy/modules/admin/rpm.te
+++ b/policy/modules/admin/rpm.te
@@ -189,7 +189,7 @@ logging_send_syslog_msg(rpm_t)
 seutil_manage_src_policy(rpm_t)
 seutil_manage_bin_policy(rpm_t)
 
-userdom_use_user_terminals(rpm_t)
+userdom_use_inherited_user_terminals(rpm_t)
 userdom_use_unpriv_users_fds(rpm_t)
 
 optional_policy(`
@@ -299,7 +299,7 @@ storage_raw_write_fixed_disk(rpm_script_t)
 
 term_getattr_unallocated_ttys(rpm_script_t)
 term_list_ptys(rpm_script_t)
-term_use_all_terms(rpm_script_t)
+term_use_all_inherited_terms(rpm_script_t)
 
 auth_dontaudit_getattr_shadow(rpm_script_t)
 auth_use_nsswitch(rpm_script_t)
diff --git a/policy/modules/admin/shutdown.te b/policy/modules/admin/shutdown.te
index 8966ec9..e5ab187 100644
--- a/policy/modules/admin/shutdown.te
+++ b/policy/modules/admin/shutdown.te
@@ -38,7 +38,7 @@ domain_use_interactive_fds(shutdown_t)
 files_read_etc_files(shutdown_t)
 files_read_generic_pids(shutdown_t)
 
-term_use_all_terms(shutdown_t)
+term_use_all_inherited_terms(shutdown_t)
 
 auth_use_nsswitch(shutdown_t)
 auth_write_login_records(shutdown_t)
diff --git a/policy/modules/admin/tripwire.te b/policy/modules/admin/tripwire.te
index 2ae8b62..a8e786b 100644
--- a/policy/modules/admin/tripwire.te
+++ b/policy/modules/admin/tripwire.te
@@ -80,7 +80,7 @@ files_getattr_all_sockets(tripwire_t)
 
 logging_send_syslog_msg(tripwire_t)
 
-userdom_use_user_terminals(tripwire_t)
+userdom_use_inherited_user_terminals(tripwire_t)
 
 optional_policy(`
 	cron_system_entry(tripwire_t, tripwire_exec_t)
@@ -101,7 +101,7 @@ logging_send_syslog_msg(twadmin_t)
 
 miscfiles_read_localization(twadmin_t)
 
-userdom_use_user_terminals(twadmin_t)
+userdom_use_inherited_user_terminals(twadmin_t)
 
 ########################################
 #
@@ -127,7 +127,7 @@ logging_send_syslog_msg(twprint_t)
 
 miscfiles_read_localization(twprint_t)
 
-userdom_use_user_terminals(twprint_t)
+userdom_use_inherited_user_terminals(twprint_t)
 
 ########################################
 #
@@ -143,4 +143,4 @@ logging_send_syslog_msg(siggen_t)
 
 miscfiles_read_localization(siggen_t)
 
-userdom_use_user_terminals(siggen_t)
+userdom_use_inherited_user_terminals(siggen_t)
diff --git a/policy/modules/admin/tzdata.te b/policy/modules/admin/tzdata.te
index d0f2a64..3816a0f 100644
--- a/policy/modules/admin/tzdata.te
+++ b/policy/modules/admin/tzdata.te
@@ -28,7 +28,7 @@ miscfiles_read_localization(tzdata_t)
 miscfiles_manage_localization(tzdata_t)
 miscfiles_etc_filetrans_localization(tzdata_t)
 
-userdom_use_user_terminals(tzdata_t)
+userdom_use_inherited_user_terminals(tzdata_t)
 
 # tzdata looks for /var/spool/postfix/etc/localtime.
 optional_policy(`
diff --git a/policy/modules/admin/usbmodules.te b/policy/modules/admin/usbmodules.te
index 74354da..4467577 100644
--- a/policy/modules/admin/usbmodules.te
+++ b/policy/modules/admin/usbmodules.te
@@ -36,7 +36,7 @@ miscfiles_read_hwdata(usbmodules_t)
 
 modutils_read_module_deps(usbmodules_t)
 
-userdom_use_user_terminals(usbmodules_t)
+userdom_use_inherited_user_terminals(usbmodules_t)
 
 optional_policy(`
 	hotplug_read_config(usbmodules_t)
diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
index 441cf22..3391a86 100644
--- a/policy/modules/admin/usermanage.te
+++ b/policy/modules/admin/usermanage.te
@@ -79,8 +79,8 @@ selinux_compute_create_context(chfn_t)
 selinux_compute_relabel_context(chfn_t)
 selinux_compute_user_contexts(chfn_t)
 
-term_use_all_ttys(chfn_t)
-term_use_all_ptys(chfn_t)
+term_use_all_inherited_ttys(chfn_t)
+term_use_all_inherited_ptys(chfn_t)
 
 fs_getattr_xattr_fs(chfn_t)
 fs_search_auto_mountpoints(chfn_t)
@@ -323,7 +323,7 @@ miscfiles_read_localization(passwd_t)
 
 seutil_dontaudit_search_config(passwd_t)
 
-userdom_use_user_terminals(passwd_t)
+userdom_use_inherited_user_terminals(passwd_t)
 userdom_use_unpriv_users_fds(passwd_t)
 # make sure that getcon succeeds
 userdom_getattr_all_users(passwd_t)
diff --git a/policy/modules/admin/vpn.te b/policy/modules/admin/vpn.te
index ebf4b26..b0c4f72 100644
--- a/policy/modules/admin/vpn.te
+++ b/policy/modules/admin/vpn.te
@@ -77,8 +77,8 @@ domain_use_interactive_fds(vpnc_t)
 fs_getattr_xattr_fs(vpnc_t)
 fs_getattr_tmpfs(vpnc_t)
 
-term_use_all_ptys(vpnc_t)
-term_use_all_ttys(vpnc_t)
+term_use_all_inherited_ptys(vpnc_t)
+term_use_all_inherited_ttys(vpnc_t)
 
 corecmd_exec_all_executables(vpnc_t)
 
diff --git a/policy/modules/apps/ada.te b/policy/modules/apps/ada.te
index 39c75fb..057d8b1 100644
--- a/policy/modules/apps/ada.te
+++ b/policy/modules/apps/ada.te
@@ -17,7 +17,7 @@ role system_r types ada_t;
 
 allow ada_t self:process { execstack execmem };
 
-userdom_use_user_terminals(ada_t)
+userdom_use_inherited_user_terminals(ada_t)
 
 optional_policy(`
 	unconfined_domain(ada_t)
diff --git a/policy/modules/apps/cdrecord.te b/policy/modules/apps/cdrecord.te
index 1403835..9fadc94 100644
--- a/policy/modules/apps/cdrecord.te
+++ b/policy/modules/apps/cdrecord.te
@@ -56,7 +56,7 @@ logging_send_syslog_msg(cdrecord_t)
 miscfiles_read_localization(cdrecord_t)
 
 # write to the user domain tty.
-userdom_use_user_terminals(cdrecord_t)
+userdom_use_inherited_user_terminals(cdrecord_t)
 userdom_read_user_home_content_files(cdrecord_t)
 
 # Handle nfs home dirs
diff --git a/policy/modules/apps/evolution.te b/policy/modules/apps/evolution.te
index cd70958..126d7ea 100644
--- a/policy/modules/apps/evolution.te
+++ b/policy/modules/apps/evolution.te
@@ -215,7 +215,7 @@ userdom_rw_user_tmp_files(evolution_t)
 userdom_manage_user_tmp_dirs(evolution_t)
 userdom_manage_user_tmp_sockets(evolution_t)
 userdom_manage_user_tmp_files(evolution_t)
-userdom_use_user_terminals(evolution_t)
+userdom_use_inherited_user_terminals(evolution_t)
 # FIXME: suppress access to .local/.icons/.themes until properly implemented
 # FIXME: suppress access to .gaim/blist.xml (buddy list synchronization)
 # until properly implemented
diff --git a/policy/modules/apps/gift.te b/policy/modules/apps/gift.te
index 6e4add5..10a2ce4 100644
--- a/policy/modules/apps/gift.te
+++ b/policy/modules/apps/gift.te
@@ -132,7 +132,7 @@ miscfiles_read_localization(giftd_t)
 
 sysnet_read_config(giftd_t)
 
-userdom_use_user_terminals(giftd_t)
+userdom_use_inherited_user_terminals(giftd_t)
 
 tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_dirs(giftd_t)
diff --git a/policy/modules/apps/gpg.te b/policy/modules/apps/gpg.te
index 9050e8c..54e62e5 100644
--- a/policy/modules/apps/gpg.te
+++ b/policy/modules/apps/gpg.te
@@ -191,7 +191,7 @@ files_read_etc_files(gpg_helper_t)
 
 auth_use_nsswitch(gpg_helper_t)
 
-userdom_use_user_terminals(gpg_helper_t)
+userdom_use_inherited_user_terminals(gpg_helper_t)
 
 tunable_policy(`use_nfs_home_dirs',`
 	fs_dontaudit_rw_nfs_files(gpg_helper_t)
@@ -239,7 +239,7 @@ fs_dontaudit_list_inotifyfs(gpg_agent_t)
 miscfiles_read_localization(gpg_agent_t)
 
 # Write to the user domain tty.
-userdom_use_user_terminals(gpg_agent_t)
+userdom_use_inherited_user_terminals(gpg_agent_t)
 # read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d )
 userdom_search_user_home_dirs(gpg_agent_t)
 
diff --git a/policy/modules/apps/irc.te b/policy/modules/apps/irc.te
index 66beb80..e4a5ce6 100644
--- a/policy/modules/apps/irc.te
+++ b/policy/modules/apps/irc.te
@@ -84,7 +84,7 @@ seutil_use_newrole_fds(irc_t)
 sysnet_read_config(irc_t)
 
 # Write to the user domain tty.
-userdom_use_user_terminals(irc_t)
+userdom_use_inherited_user_terminals(irc_t)
 
 tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_dirs(irc_t)
diff --git a/policy/modules/apps/loadkeys.te b/policy/modules/apps/loadkeys.te
index 2523758..bdd438b 100644
--- a/policy/modules/apps/loadkeys.te
+++ b/policy/modules/apps/loadkeys.te
@@ -38,7 +38,7 @@ locallogin_use_fds(loadkeys_t)
 
 miscfiles_read_localization(loadkeys_t)
 
-userdom_use_user_ttys(loadkeys_t)
+userdom_use_inherited_user_ttys(loadkeys_t)
 userdom_list_user_home_content(loadkeys_t)
 
 ifdef(`hide_broken_symptoms',`
diff --git a/policy/modules/apps/lockdev.te b/policy/modules/apps/lockdev.te
index 0bac996..ca2388d 100644
--- a/policy/modules/apps/lockdev.te
+++ b/policy/modules/apps/lockdev.te
@@ -35,5 +35,5 @@ fs_getattr_xattr_fs(lockdev_t)
 
 logging_send_syslog_msg(lockdev_t)
 
-userdom_use_user_terminals(lockdev_t)
+userdom_use_inherited_user_terminals(lockdev_t)
 
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
index 2a91fa8..5de919c 100644
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -141,7 +141,7 @@ miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t)
 # Browse the web, connect to printer
 sysnet_dns_name_resolve(mozilla_t)
 
-userdom_use_user_ptys(mozilla_t)
+userdom_use_inherited_user_ptys(mozilla_t)
 
 xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
 xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
diff --git a/policy/modules/apps/mplayer.te b/policy/modules/apps/mplayer.te
index 931304b..b669561 100644
--- a/policy/modules/apps/mplayer.te
+++ b/policy/modules/apps/mplayer.te
@@ -76,7 +76,7 @@ storage_raw_read_removable_device(mencoder_t)
 
 miscfiles_read_localization(mencoder_t)
 
-userdom_use_user_terminals(mencoder_t)
+userdom_use_inherited_user_terminals(mencoder_t)
 # Handle removable media, /tmp, and /home
 userdom_list_user_tmp(mencoder_t)
 userdom_read_user_tmp_files(mencoder_t)
@@ -225,7 +225,7 @@ fs_list_inotifyfs(mplayer_t)
 miscfiles_read_localization(mplayer_t)
 miscfiles_read_fonts(mplayer_t)
 
-userdom_use_user_terminals(mplayer_t)
+userdom_use_inherited_user_terminals(mplayer_t)
 # Read media files
 userdom_list_user_tmp(mplayer_t)
 userdom_read_user_tmp_files(mplayer_t)
diff --git a/policy/modules/apps/pulseaudio.te b/policy/modules/apps/pulseaudio.te
index c2d20a2..b6cb3a6 100644
--- a/policy/modules/apps/pulseaudio.te
+++ b/policy/modules/apps/pulseaudio.te
@@ -85,8 +85,8 @@ fs_rw_anon_inodefs_files(pulseaudio_t)
 fs_getattr_tmpfs(pulseaudio_t)
 fs_list_inotifyfs(pulseaudio_t)
 
-term_use_all_ttys(pulseaudio_t)
-term_use_all_ptys(pulseaudio_t)
+term_use_all_inherited_ttys(pulseaudio_t)
+term_use_all_inherited_ptys(pulseaudio_t)
 
 auth_use_nsswitch(pulseaudio_t)
 
diff --git a/policy/modules/apps/qemu.if b/policy/modules/apps/qemu.if
index c1d5f50..4e0bb0e 100644
--- a/policy/modules/apps/qemu.if
+++ b/policy/modules/apps/qemu.if
@@ -76,7 +76,7 @@ template(`qemu_domain_template',`
 
 	sysnet_read_config($1_t)
 
-	userdom_use_user_terminals($1_t)
+	userdom_use_inherited_user_terminals($1_t)
 	userdom_attach_admin_tun_iface($1_t)
 
 	optional_policy(`
diff --git a/policy/modules/apps/screen.if b/policy/modules/apps/screen.if
index 320df26..4a8db26 100644
--- a/policy/modules/apps/screen.if
+++ b/policy/modules/apps/screen.if
@@ -137,7 +137,7 @@ template(`screen_role_template',`
 
 	seutil_read_config($1_screen_t)
 
-	userdom_use_user_terminals($1_screen_t)
+	userdom_use_inherited_user_terminals($1_screen_t)
 	userdom_create_user_pty($1_screen_t)
 	userdom_user_home_domtrans($1_screen_t, $3)
 	userdom_setattr_user_ptys($1_screen_t)
diff --git a/policy/modules/apps/tvtime.te b/policy/modules/apps/tvtime.te
index 11fe4f2..98bfbf3 100644
--- a/policy/modules/apps/tvtime.te
+++ b/policy/modules/apps/tvtime.te
@@ -73,7 +73,7 @@ fs_search_auto_mountpoints(tvtime_t)
 miscfiles_read_localization(tvtime_t)
 miscfiles_read_fonts(tvtime_t)
 
-userdom_use_user_terminals(tvtime_t)
+userdom_use_inherited_user_terminals(tvtime_t)
 userdom_read_user_home_content_files(tvtime_t)
 
 # X access, Home files
diff --git a/policy/modules/apps/uml.te b/policy/modules/apps/uml.te
index 2df1343..7a11f39 100644
--- a/policy/modules/apps/uml.te
+++ b/policy/modules/apps/uml.te
@@ -134,7 +134,7 @@ seutil_use_newrole_fds(uml_t)
 # Use the network.
 sysnet_read_config(uml_t)
 
-userdom_use_user_terminals(uml_t)
+userdom_use_inherited_user_terminals(uml_t)
 userdom_attach_admin_tun_iface(uml_t)
 
 optional_policy(`
diff --git a/policy/modules/apps/usernetctl.te b/policy/modules/apps/usernetctl.te
index 9586818..f938024 100644
--- a/policy/modules/apps/usernetctl.te
+++ b/policy/modules/apps/usernetctl.te
@@ -58,7 +58,7 @@ seutil_read_config(usernetctl_t)
 
 sysnet_read_config(usernetctl_t)
 
-userdom_use_user_terminals(usernetctl_t)
+userdom_use_inherited_user_terminals(usernetctl_t)
 
 optional_policy(`
 	hostname_exec(usernetctl_t)
diff --git a/policy/modules/apps/vlock.te b/policy/modules/apps/vlock.te
index 03fc701..f58654e 100644
--- a/policy/modules/apps/vlock.te
+++ b/policy/modules/apps/vlock.te
@@ -50,4 +50,4 @@ logging_send_syslog_msg(vlock_t)
 miscfiles_read_localization(vlock_t)
 
 userdom_dontaudit_search_user_home_dirs(vlock_t)
-userdom_use_user_terminals(vlock_t)
+userdom_use_inherited_user_terminals(vlock_t)
diff --git a/policy/modules/apps/vmware.te b/policy/modules/apps/vmware.te
index c76ceb2..21bc56c 100644
--- a/policy/modules/apps/vmware.te
+++ b/policy/modules/apps/vmware.te
@@ -270,7 +270,7 @@ libs_read_lib_files(vmware_t)
 
 miscfiles_read_localization(vmware_t)
 
-userdom_use_user_terminals(vmware_t)
+userdom_use_inherited_user_terminals(vmware_t)
 userdom_list_user_home_dirs(vmware_t)
 # cjp: why?
 userdom_read_user_home_content_files(vmware_t)
diff --git a/policy/modules/apps/webalizer.te b/policy/modules/apps/webalizer.te
index f79314b..64304e8 100644
--- a/policy/modules/apps/webalizer.te
+++ b/policy/modules/apps/webalizer.te
@@ -81,7 +81,7 @@ miscfiles_read_public_files(webalizer_t)
 sysnet_dns_name_resolve(webalizer_t)
 sysnet_read_config(webalizer_t)
 
-userdom_use_user_terminals(webalizer_t)
+userdom_use_inherited_user_terminals(webalizer_t)
 userdom_use_unpriv_users_fds(webalizer_t)
 userdom_dontaudit_search_user_home_content(webalizer_t)
 
diff --git a/policy/modules/apps/wine.te b/policy/modules/apps/wine.te
index 953cb28..ff3af83 100644
--- a/policy/modules/apps/wine.te
+++ b/policy/modules/apps/wine.te
@@ -40,7 +40,7 @@ domain_mmap_low(wine_t)
 
 files_execmod_all_files(wine_t)
 
-userdom_use_user_terminals(wine_t)
+userdom_use_inherited_user_terminals(wine_t)
 
 tunable_policy(`wine_mmap_zero_ignore',`
 	dontaudit wine_t self:memprotect mmap_zero;
diff --git a/policy/modules/apps/xscreensaver.te b/policy/modules/apps/xscreensaver.te
index 1bdeb16..775f788 100644
--- a/policy/modules/apps/xscreensaver.te
+++ b/policy/modules/apps/xscreensaver.te
@@ -37,7 +37,7 @@ logging_send_syslog_msg(xscreensaver_t)
 
 miscfiles_read_localization(xscreensaver_t)
 
-userdom_use_user_ptys(xscreensaver_t)
+userdom_use_inherited_user_ptys(xscreensaver_t)
 #access to .icons and ~/.xscreensaver
 userdom_read_user_home_content_files(xscreensaver_t)
 
diff --git a/policy/modules/apps/yam.te b/policy/modules/apps/yam.te
index 223ad43..d400ef6 100644
--- a/policy/modules/apps/yam.te
+++ b/policy/modules/apps/yam.te
@@ -92,7 +92,7 @@ seutil_read_config(yam_t)
 sysnet_dns_name_resolve(yam_t)
 sysnet_read_config(yam_t)
 
-userdom_use_user_terminals(yam_t)
+userdom_use_inherited_user_terminals(yam_t)
 userdom_use_unpriv_users_fds(yam_t)
 # Reading dotfiles...
 # cjp: ?
diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
index f3acfee..71d5500 100644
--- a/policy/modules/kernel/terminal.if
+++ b/policy/modules/kernel/terminal.if
@@ -208,6 +208,27 @@ interface(`term_use_all_terms',`
 
 ########################################
 ## <summary>
+##	Read and write the inherited console, all inherited 
+##	ttys and ptys.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`term_use_all_inherited_terms',`
+	gen_require(`
+		attribute ttynode, ptynode;
+		type console_device_t, devpts_t, tty_device_t;
+	')
+
+	allow $1 { devpts_t console_device_t tty_device_t ttynode ptynode }:chr_file rw_inherited_term_perms;
+')
+
+########################################
+## <summary>
 ##	Write to the console.
 ## </summary>
 ## <param name="domain">
@@ -842,6 +863,26 @@ interface(`term_use_all_ptys',`
 
 ########################################
 ## <summary>
+##	Read and write all inherited ptys.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`term_use_all_inherited_ptys',`
+	gen_require(`
+		attribute ptynode;
+		type devpts_t;
+	')
+
+	allow $1 ptynode:chr_file { rw_inherited_term_perms lock };
+')
+
+########################################
+## <summary>
 ##	Do not audit attempts to read or write any ptys.
 ## </summary>
 ## <param name="domain">
@@ -1340,7 +1381,27 @@ interface(`term_use_all_ttys',`
 	')
 
 	dev_list_all_dev_nodes($1)
-	allow $1 ttynode:chr_file rw_chr_file_perms;
+	allow $1 ttynode:chr_file rw_term_perms;
+')
+
+########################################
+## <summary>
+##	Read and write all inherited ttys.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`term_use_all_inherited_ttys',`
+	gen_require(`
+		attribute ttynode;
+	')
+
+	dev_list_all_dev_nodes($1)
+	allow $1 ttynode:chr_file rw_inherited_term_perms;
 ')
 
 ########################################
diff --git a/policy/modules/services/aide.te b/policy/modules/services/aide.te
index 2509dd2..615e957 100644
--- a/policy/modules/services/aide.te
+++ b/policy/modules/services/aide.te
@@ -39,4 +39,4 @@ logging_send_syslog_msg(aide_t)
 
 seutil_use_newrole_fds(aide_t)
 
-userdom_use_user_terminals(aide_t)
+userdom_use_inherited_user_terminals(aide_t)
diff --git a/policy/modules/services/apcupsd.te b/policy/modules/services/apcupsd.te
index d052bf0..08fd3de 100644
--- a/policy/modules/services/apcupsd.te
+++ b/policy/modules/services/apcupsd.te
@@ -87,7 +87,7 @@ miscfiles_read_localization(apcupsd_t)
 
 sysnet_dns_name_resolve(apcupsd_t)
 
-userdom_use_user_ttys(apcupsd_t)
+userdom_use_inherited_user_ttys(apcupsd_t)
 
 optional_policy(`
 	hostname_exec(apcupsd_t)
diff --git a/policy/modules/services/apm.te b/policy/modules/services/apm.te
index 1c8c27e..544ab59 100644
--- a/policy/modules/services/apm.te
+++ b/policy/modules/services/apm.te
@@ -45,7 +45,7 @@ dev_rw_apm_bios(apm_t)
 
 fs_getattr_xattr_fs(apm_t)
 
-term_use_all_terms(apm_t)
+term_use_all_inherited_terms(apm_t)
 
 domain_use_interactive_fds(apm_t)
 
diff --git a/policy/modules/services/bind.te b/policy/modules/services/bind.te
index 4deca04..945a36e 100644
--- a/policy/modules/services/bind.te
+++ b/policy/modules/services/bind.te
@@ -238,7 +238,7 @@ miscfiles_read_localization(ndc_t)
 sysnet_read_config(ndc_t)
 sysnet_dns_name_resolve(ndc_t)
 
-userdom_use_user_terminals(ndc_t)
+userdom_use_inherited_user_terminals(ndc_t)
 
 term_dontaudit_use_console(ndc_t)
 
diff --git a/policy/modules/services/clockspeed.te b/policy/modules/services/clockspeed.te
index b40f3f7..3676ecc 100644
--- a/policy/modules/services/clockspeed.te
+++ b/policy/modules/services/clockspeed.te
@@ -38,7 +38,7 @@ files_read_etc_files(clockspeed_cli_t)
 
 miscfiles_read_localization(clockspeed_cli_t)
 
-userdom_use_user_terminals(clockspeed_cli_t)
+userdom_use_inherited_user_terminals(clockspeed_cli_t)
 
 ########################################
 #
diff --git a/policy/modules/services/consolekit.te b/policy/modules/services/consolekit.te
index e67a003..7e38d42 100644
--- a/policy/modules/services/consolekit.te
+++ b/policy/modules/services/consolekit.te
@@ -55,7 +55,7 @@ fs_list_inotifyfs(consolekit_t)
 
 mcs_ptrace_all(consolekit_t)
 
-term_use_all_terms(consolekit_t)
+term_use_all_inherited_terms(consolekit_t)
 
 auth_use_nsswitch(consolekit_t)
 auth_manage_pam_console_data(consolekit_t)
diff --git a/policy/modules/services/cron.if b/policy/modules/services/cron.if
index 35241ed..f12612e 100644
--- a/policy/modules/services/cron.if
+++ b/policy/modules/services/cron.if
@@ -73,7 +73,7 @@ template(`cron_common_crontab_template',`
 	userdom_manage_user_tmp_dirs($1_t)
 	userdom_manage_user_tmp_files($1_t)
 	# Access terminals.
-	userdom_use_user_terminals($1_t)
+	userdom_use_inherited_user_terminals($1_t)
 	# Read user crontabs
 	userdom_read_user_home_content_files($1_t)
 
diff --git a/policy/modules/services/dbus.if b/policy/modules/services/dbus.if
index 1a1becd..bab2385 100644
--- a/policy/modules/services/dbus.if
+++ b/policy/modules/services/dbus.if
@@ -147,7 +147,7 @@ template(`dbus_role_template',`
 	seutil_read_config($1_dbusd_t)
 	seutil_read_default_contexts($1_dbusd_t)
 
-	term_use_all_terms($1_dbusd_t)
+	term_use_all_inherited_terms($1_dbusd_t)
 
 	userdom_read_user_home_content_files($1_dbusd_t)
 
diff --git a/policy/modules/services/dcc.te b/policy/modules/services/dcc.te
index ec19ff4..9000177 100644
--- a/policy/modules/services/dcc.te
+++ b/policy/modules/services/dcc.te
@@ -110,7 +110,7 @@ logging_send_syslog_msg(cdcc_t)
 
 miscfiles_read_localization(cdcc_t)
 
-userdom_use_user_terminals(cdcc_t)
+userdom_use_inherited_user_terminals(cdcc_t)
 
 ########################################
 #
@@ -152,7 +152,7 @@ logging_send_syslog_msg(dcc_client_t)
 
 miscfiles_read_localization(dcc_client_t)
 
-userdom_use_user_terminals(dcc_client_t)
+userdom_use_inherited_user_terminals(dcc_client_t)
 
 optional_policy(`
 	amavis_read_spool_files(dcc_client_t)
@@ -197,7 +197,7 @@ logging_send_syslog_msg(dcc_dbclean_t)
 
 miscfiles_read_localization(dcc_dbclean_t)
 
-userdom_use_user_terminals(dcc_dbclean_t)
+userdom_use_inherited_user_terminals(dcc_dbclean_t)
 
 ########################################
 #
diff --git a/policy/modules/services/devicekit.te b/policy/modules/services/devicekit.te
index f231f17..2a048fa 100644
--- a/policy/modules/services/devicekit.te
+++ b/policy/modules/services/devicekit.te
@@ -127,7 +127,7 @@ storage_raw_write_fixed_disk(devicekit_disk_t)
 storage_raw_read_removable_device(devicekit_disk_t)
 storage_raw_write_removable_device(devicekit_disk_t)
 
-term_use_all_terms(devicekit_disk_t)
+term_use_all_inherited_terms(devicekit_disk_t)
 
 auth_use_nsswitch(devicekit_disk_t)
 
@@ -219,7 +219,7 @@ files_read_usr_files(devicekit_power_t)
 
 fs_list_inotifyfs(devicekit_power_t)
 
-term_use_all_terms(devicekit_power_t)
+term_use_all_inherited_terms(devicekit_power_t)
 
 auth_use_nsswitch(devicekit_power_t)
 
diff --git a/policy/modules/services/ftp.te b/policy/modules/services/ftp.te
index 8a74a83..172e3d9 100644
--- a/policy/modules/services/ftp.te
+++ b/policy/modules/services/ftp.te
@@ -356,7 +356,7 @@ files_tmp_filetrans(ftpdctl_t, ftpdctl_tmp_t, sock_file)
 # Allow ftpdctl to read config files
 files_read_etc_files(ftpdctl_t)
 
-userdom_use_user_terminals(ftpdctl_t)
+userdom_use_inherited_user_terminals(ftpdctl_t)
 
 ########################################
 #
diff --git a/policy/modules/services/hadoop.te b/policy/modules/services/hadoop.te
index 9821a88..1367b08 100644
--- a/policy/modules/services/hadoop.te
+++ b/policy/modules/services/hadoop.te
@@ -165,7 +165,7 @@ miscfiles_read_localization(hadoop_t)
 
 sysnet_read_config(hadoop_t)
 
-userdom_use_user_terminals(hadoop_t)
+userdom_use_inherited_user_terminals(hadoop_t)
 
 java_exec(hadoop_t)
 
@@ -345,7 +345,7 @@ miscfiles_read_localization(zookeeper_t)
 
 sysnet_read_config(zookeeper_t)
 
-userdom_use_user_terminals(zookeeper_t)
+userdom_use_inherited_user_terminals(zookeeper_t)
 userdom_dontaudit_search_user_home_dirs(zookeeper_t)
 
 java_exec(zookeeper_t)
diff --git a/policy/modules/services/lpd.te b/policy/modules/services/lpd.te
index 93c14ca..7a2064a 100644
--- a/policy/modules/services/lpd.te
+++ b/policy/modules/services/lpd.te
@@ -113,7 +113,7 @@ init_use_fds(checkpc_t)
 
 sysnet_read_config(checkpc_t)
 
-userdom_use_user_terminals(checkpc_t)
+userdom_use_inherited_user_terminals(checkpc_t)
 
 optional_policy(`
 	cron_system_entry(checkpc_t, checkpc_exec_t)
@@ -277,7 +277,7 @@ miscfiles_read_localization(lpr_t)
 
 userdom_read_user_tmp_symlinks(lpr_t)
 # Write to the user domain tty.
-userdom_use_user_terminals(lpr_t)
+userdom_use_inherited_user_terminals(lpr_t)
 userdom_read_user_home_content_files(lpr_t)
 userdom_read_user_tmp_files(lpr_t)
 
diff --git a/policy/modules/services/mta.te b/policy/modules/services/mta.te
index 64268e4..56f0d56 100644
--- a/policy/modules/services/mta.te
+++ b/policy/modules/services/mta.te
@@ -80,7 +80,7 @@ term_dontaudit_use_unallocated_ttys(system_mail_t)
 
 init_use_script_ptys(system_mail_t)
 
-userdom_use_user_terminals(system_mail_t)
+userdom_use_inherited_user_terminals(system_mail_t)
 userdom_dontaudit_search_user_home_dirs(system_mail_t)
 
 optional_policy(`
@@ -256,9 +256,9 @@ optional_policy(`
 
 domain_use_interactive_fds(user_mail_t)
 
-userdom_use_user_terminals(user_mail_t)
+userdom_use_inherited_user_terminals(user_mail_t)
 # Write to the user domain tty. cjp: why?
-userdom_use_user_terminals(mta_user_agent)
+userdom_use_inherited_user_terminals(mta_user_agent)
 # Create dead.letter in user home directories.
 userdom_manage_user_home_content_files(user_mail_t)
 userdom_user_home_dir_filetrans_user_home_content(user_mail_t, file)
diff --git a/policy/modules/services/oav.te b/policy/modules/services/oav.te
index b4c5f86..0f1549d 100644
--- a/policy/modules/services/oav.te
+++ b/policy/modules/services/oav.te
@@ -66,7 +66,7 @@ logging_send_syslog_msg(oav_update_t)
 
 sysnet_read_config(oav_update_t)
 
-userdom_use_user_terminals(oav_update_t)
+userdom_use_inherited_user_terminals(oav_update_t)
 
 optional_policy(`
 	cron_system_entry(oav_update_t, oav_update_exec_t)
diff --git a/policy/modules/services/portmap.te b/policy/modules/services/portmap.te
index 333a1fe..45430a7 100644
--- a/policy/modules/services/portmap.te
+++ b/policy/modules/services/portmap.te
@@ -142,7 +142,7 @@ logging_send_syslog_msg(portmap_helper_t)
 
 sysnet_read_config(portmap_helper_t)
 
-userdom_use_user_terminals(portmap_helper_t)
+userdom_use_inherited_user_terminals(portmap_helper_t)
 userdom_dontaudit_use_all_users_fds(portmap_helper_t)
 
 optional_policy(`
diff --git a/policy/modules/services/portslave.te b/policy/modules/services/portslave.te
index 69c331e..0555635 100644
--- a/policy/modules/services/portslave.te
+++ b/policy/modules/services/portslave.te
@@ -79,7 +79,7 @@ fs_getattr_xattr_fs(portslave_t)
 
 term_use_unallocated_ttys(portslave_t)
 term_setattr_unallocated_ttys(portslave_t)
-term_use_all_ttys(portslave_t)
+term_use_all_inherited_ttys(portslave_t)
 term_search_ptys(portslave_t)
 
 auth_rw_login_records(portslave_t)
diff --git a/policy/modules/services/postfix.te b/policy/modules/services/postfix.te
index 06e37d4..3f0f6b0 100644
--- a/policy/modules/services/postfix.te
+++ b/policy/modules/services/postfix.te
@@ -487,8 +487,8 @@ write_fifo_files_pattern(postfix_postqueue_t, postfix_public_t, postfix_public_t
 domtrans_pattern(postfix_postqueue_t, postfix_showq_exec_t, postfix_showq_t)
 
 # to write the mailq output, it really should not need read access!
-term_use_all_ptys(postfix_postqueue_t)
-term_use_all_ttys(postfix_postqueue_t)
+term_use_all_inherited_ptys(postfix_postqueue_t)
+term_use_all_inherited_ttys(postfix_postqueue_t)
 
 init_sigchld_script(postfix_postqueue_t)
 init_use_script_fds(postfix_postqueue_t)
@@ -542,8 +542,8 @@ allow postfix_showq_t postfix_spool_maildrop_t:file read_file_perms;
 allow postfix_showq_t postfix_spool_maildrop_t:lnk_file { getattr read };
 
 # to write the mailq output, it really should not need read access!
-term_use_all_ptys(postfix_showq_t)
-term_use_all_ttys(postfix_showq_t)
+term_use_all_inherited_ptys(postfix_showq_t)
+term_use_all_inherited_ttys(postfix_showq_t)
 
 ########################################
 #
diff --git a/policy/modules/services/ppp.te b/policy/modules/services/ppp.te
index 2af42e7..a3bbe4d 100644
--- a/policy/modules/services/ppp.te
+++ b/policy/modules/services/ppp.te
@@ -176,7 +176,7 @@ sysnet_exec_ifconfig(pppd_t)
 sysnet_manage_config(pppd_t)
 sysnet_etc_filetrans_config(pppd_t)
 
-userdom_use_user_terminals(pppd_t)
+userdom_use_inherited_user_terminals(pppd_t)
 userdom_dontaudit_use_unpriv_user_fds(pppd_t)
 userdom_search_user_home_dirs(pppd_t)
 
diff --git a/policy/modules/services/privoxy.te b/policy/modules/services/privoxy.te
index 2dbf4d4..c978b83 100644
--- a/policy/modules/services/privoxy.te
+++ b/policy/modules/services/privoxy.te
@@ -87,7 +87,7 @@ miscfiles_read_localization(privoxy_t)
 userdom_dontaudit_use_unpriv_user_fds(privoxy_t)
 userdom_dontaudit_search_user_home_dirs(privoxy_t)
 # cjp: this should really not be needed
-userdom_use_user_terminals(privoxy_t)
+userdom_use_inherited_user_terminals(privoxy_t)
 
 tunable_policy(`privoxy_connect_any',`
 	corenet_tcp_connect_all_ports(privoxy_t)
diff --git a/policy/modules/services/samba.te b/policy/modules/services/samba.te
index e30bb63..8bbfcc1 100644
--- a/policy/modules/services/samba.te
+++ b/policy/modules/services/samba.te
@@ -215,7 +215,7 @@ miscfiles_read_localization(samba_net_t)
 
 samba_read_var_files(samba_net_t)
 
-userdom_use_user_terminals(samba_net_t)
+userdom_use_inherited_user_terminals(samba_net_t)
 userdom_list_user_home_dirs(samba_net_t)
 
 optional_policy(`
@@ -578,7 +578,7 @@ files_read_etc_files(smbcontrol_t)
 
 miscfiles_read_localization(smbcontrol_t)
 
-userdom_use_user_terminals(smbcontrol_t)
+userdom_use_inherited_user_terminals(smbcontrol_t)
 
 ########################################
 #
@@ -650,7 +650,7 @@ locallogin_use_fds(smbmount_t)
 
 logging_search_logs(smbmount_t)
 
-userdom_use_user_terminals(smbmount_t)
+userdom_use_inherited_user_terminals(smbmount_t)
 userdom_use_all_users_fds(smbmount_t)
 
 optional_policy(`
@@ -904,7 +904,7 @@ logging_send_syslog_msg(winbind_helper_t)
 
 miscfiles_read_localization(winbind_helper_t) 
 
-userdom_use_user_terminals(winbind_helper_t)
+userdom_use_inherited_user_terminals(winbind_helper_t)
 
 optional_policy(`
 	apache_append_log(winbind_helper_t)
diff --git a/policy/modules/services/samhain.te b/policy/modules/services/samhain.te
index 150c85d..71e9315 100644
--- a/policy/modules/services/samhain.te
+++ b/policy/modules/services/samhain.te
@@ -55,7 +55,7 @@ domain_use_interactive_fds(samhain_t)
 
 seutil_sigchld_newrole(samhain_t)
 
-userdom_use_user_terminals(samhain_t)
+userdom_use_inherited_user_terminals(samhain_t)
 
 ########################################
 #
diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index 22adaca..dee74f9 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -393,7 +393,7 @@ template(`ssh_role_template',`
 	seutil_dontaudit_read_config($1_ssh_agent_t)
 
 	# Write to the user domain tty.
-	userdom_use_user_terminals($1_ssh_agent_t)
+	userdom_use_inherited_user_terminals($1_ssh_agent_t)
 
 	# for the transition back to normal privs upon exec
 	userdom_search_user_home_content($1_ssh_agent_t)
diff --git a/policy/modules/services/sysstat.te b/policy/modules/services/sysstat.te
index 52f0d6c..a5b7481 100644
--- a/policy/modules/services/sysstat.te
+++ b/policy/modules/services/sysstat.te
@@ -51,7 +51,7 @@ fs_getattr_xattr_fs(sysstat_t)
 fs_list_inotifyfs(sysstat_t)
 
 term_use_console(sysstat_t)
-term_use_all_terms(sysstat_t)
+term_use_all_inherited_terms(sysstat_t)
 
 init_use_fds(sysstat_t)
 
diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
index 3eca020..8a99ba4 100644
--- a/policy/modules/services/virt.te
+++ b/policy/modules/services/virt.te
@@ -441,7 +441,7 @@ fs_getattr_tmpfs(virt_domain)
 fs_rw_anon_inodefs_files(virt_domain)
 fs_rw_tmpfs_files(virt_domain)
 
-term_use_all_terms(virt_domain)
+term_use_all_inherited_terms(virt_domain)
 term_getattr_pty_fs(virt_domain)
 term_use_generic_ptys(virt_domain)
 term_use_ptmx(virt_domain)
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index 143c893..c3ccc5e 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -236,7 +236,7 @@ allow xdm_t iceauth_home_t:file read_file_perms;
 
 fs_search_auto_mountpoints(iceauth_t)
 
-userdom_use_user_terminals(iceauth_t)
+userdom_use_inherited_user_terminals(iceauth_t)
 userdom_read_user_tmp_files(iceauth_t)
 
 tunable_policy(`use_nfs_home_dirs',`
@@ -280,7 +280,7 @@ term_use_ptmx(xauth_t)
 
 auth_use_nsswitch(xauth_t)
 
-userdom_use_user_terminals(xauth_t)
+userdom_use_inherited_user_terminals(xauth_t)
 userdom_read_user_tmp_files(xauth_t)
 
 xserver_rw_xdm_tmp_files(xauth_t)
diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
index 66d13c4..0174712 100644
--- a/policy/modules/system/authlogin.te
+++ b/policy/modules/system/authlogin.te
@@ -118,7 +118,7 @@ miscfiles_read_localization(chkpwd_t)
 seutil_read_config(chkpwd_t)
 seutil_dontaudit_use_newrole_fds(chkpwd_t)
 
-userdom_use_user_terminals(chkpwd_t)
+userdom_use_inherited_user_terminals(chkpwd_t)
 
 ifdef(`distro_ubuntu',`
 	optional_policy(`
@@ -343,7 +343,7 @@ logging_send_syslog_msg(updpwd_t)
 
 miscfiles_read_localization(updpwd_t)
 
-userdom_use_user_terminals(updpwd_t)
+userdom_use_inherited_user_terminals(updpwd_t)
 
 ifdef(`distro_ubuntu',`
 	optional_policy(`
@@ -377,7 +377,7 @@ domain_use_interactive_fds(utempter_t)
 
 logging_search_logs(utempter_t)
 
-userdom_use_user_terminals(utempter_t)
+userdom_use_inherited_user_terminals(utempter_t)
 # Allow utemper to write to /tmp/.xses-*
 userdom_write_user_tmp_files(utempter_t)
 
diff --git a/policy/modules/system/clock.te b/policy/modules/system/clock.te
index b9ed25b..de3738c 100644
--- a/policy/modules/system/clock.te
+++ b/policy/modules/system/clock.te
@@ -46,8 +46,8 @@ fs_search_auto_mountpoints(hwclock_t)
 
 term_dontaudit_use_console(hwclock_t)
 term_use_unallocated_ttys(hwclock_t)
-term_use_all_ttys(hwclock_t)
-term_use_all_ptys(hwclock_t)
+term_use_all_inherited_ttys(hwclock_t)
+term_use_all_inherited_ptys(hwclock_t)
 
 domain_use_interactive_fds(hwclock_t)
 
diff --git a/policy/modules/system/hostname.te b/policy/modules/system/hostname.te
index c310775..09970e1 100644
--- a/policy/modules/system/hostname.te
+++ b/policy/modules/system/hostname.te
@@ -40,8 +40,8 @@ fs_search_auto_mountpoints(hostname_t)
 fs_dontaudit_use_tmpfs_chr_dev(hostname_t)
 
 term_dontaudit_use_console(hostname_t)
-term_use_all_ttys(hostname_t)
-term_use_all_ptys(hostname_t)
+term_use_all_inherited_ttys(hostname_t)
+term_use_all_inherited_ptys(hostname_t)
 
 init_use_fds(hostname_t)
 init_use_script_fds(hostname_t)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index ea29513..ea9e9d8 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -154,7 +154,9 @@ mls_fd_use_all_levels(init_t)
 
 selinux_set_all_booleans(init_t)
 
-term_use_all_terms(init_t)
+term_use_unallocated_ttys(init_t)
+term_use_console(init_t)
+term_use_all_inherited_terms(init_t)
 
 # Run init scripts.
 init_domtrans_script(init_t)
diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te
index 98d6081..2f974d8 100644
--- a/policy/modules/system/ipsec.te
+++ b/policy/modules/system/ipsec.te
@@ -293,7 +293,7 @@ seutil_dontaudit_search_config(ipsec_mgmt_t)
 
 sysnet_domtrans_ifconfig(ipsec_mgmt_t)
 
-userdom_use_user_terminals(ipsec_mgmt_t)
+userdom_use_inherited_user_terminals(ipsec_mgmt_t)
 
 optional_policy(`
 	consoletype_exec(ipsec_mgmt_t)
diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te
index a3fdcb3..8eb4c11 100644
--- a/policy/modules/system/iptables.te
+++ b/policy/modules/system/iptables.te
@@ -85,7 +85,7 @@ miscfiles_read_localization(iptables_t)
 sysnet_domtrans_ifconfig(iptables_t)
 sysnet_dns_name_resolve(iptables_t)
 
-userdom_use_user_terminals(iptables_t)
+userdom_use_inherited_user_terminals(iptables_t)
 userdom_use_all_users_fds(iptables_t)
 
 optional_policy(`
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 03495c0..472a498 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -107,7 +107,7 @@ domain_use_interactive_fds(auditctl_t)
 
 mls_file_read_all_levels(auditctl_t)
 
-term_use_all_terms(auditctl_t)
+term_use_all_inherited_terms(auditctl_t)
 
 init_dontaudit_use_fds(auditctl_t)
 
@@ -188,7 +188,7 @@ seutil_dontaudit_read_config(auditd_t)
 
 sysnet_dns_name_resolve(auditd_t)
 
-userdom_use_user_terminals(auditd_t)
+userdom_use_inherited_user_terminals(auditd_t)
 userdom_dontaudit_use_unpriv_user_fds(auditd_t)
 userdom_dontaudit_search_user_home_dirs(auditd_t)
 
diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te
index a0a0ebf..9cad698 100644
--- a/policy/modules/system/lvm.te
+++ b/policy/modules/system/lvm.te
@@ -283,7 +283,7 @@ storage_dev_filetrans_fixed_disk(lvm_t)
 # Access raw devices and old /dev/lvm (c 109,0).  Is this needed?
 storage_manage_fixed_disk(lvm_t)
 
-term_use_all_terms(lvm_t)
+term_use_all_inherited_terms(lvm_t)
 
 init_use_fds(lvm_t)
 init_dontaudit_getattr_initctl(lvm_t)
@@ -299,7 +299,7 @@ seutil_read_file_contexts(lvm_t)
 seutil_search_default_contexts(lvm_t)
 seutil_sigchld_newrole(lvm_t)
 
-userdom_use_user_terminals(lvm_t)
+userdom_use_inherited_user_terminals(lvm_t)
 
 ifdef(`distro_redhat',`
 	# this is from the initrd:
diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
index a0eef20..f914237 100644
--- a/policy/modules/system/modutils.te
+++ b/policy/modules/system/modutils.te
@@ -70,7 +70,7 @@ init_use_fds(depmod_t)
 init_use_script_fds(depmod_t)
 init_use_script_ptys(depmod_t)
 
-userdom_use_user_terminals(depmod_t)
+userdom_use_inherited_user_terminals(depmod_t)
 # Read System.map from home directories.
 files_list_home(depmod_t)
 userdom_read_user_home_content_files(depmod_t)
@@ -296,7 +296,7 @@ logging_send_syslog_msg(update_modules_t)
 
 miscfiles_read_localization(update_modules_t)
 
-userdom_use_user_terminals(update_modules_t)
+userdom_use_inherited_user_terminals(update_modules_t)
 userdom_dontaudit_search_user_home_dirs(update_modules_t)
 
 ifdef(`distro_gentoo',`
diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
index 15832c7..bd989d7 100644
--- a/policy/modules/system/mount.te
+++ b/policy/modules/system/mount.te
@@ -109,7 +109,7 @@ storage_raw_write_fixed_disk(mount_t)
 storage_raw_read_removable_device(mount_t)
 storage_raw_write_removable_device(mount_t)
 
-term_use_all_terms(mount_t)
+term_use_all_inherited_terms(mount_t)
 
 auth_use_nsswitch(mount_t)
 
diff --git a/policy/modules/system/netlabel.te b/policy/modules/system/netlabel.te
index cbbda4a..81ce417 100644
--- a/policy/modules/system/netlabel.te
+++ b/policy/modules/system/netlabel.te
@@ -25,4 +25,4 @@ files_read_etc_files(netlabel_mgmt_t)
 
 seutil_use_newrole_fds(netlabel_mgmt_t)
 
-userdom_use_user_terminals(netlabel_mgmt_t)
+userdom_use_inherited_user_terminals(netlabel_mgmt_t)
diff --git a/policy/modules/system/pcmcia.te b/policy/modules/system/pcmcia.te
index 4d06ae3..5b2e982 100644
--- a/policy/modules/system/pcmcia.te
+++ b/policy/modules/system/pcmcia.te
@@ -105,7 +105,7 @@ sysnet_domtrans_ifconfig(cardmgr_t)
 sysnet_etc_filetrans_config(cardmgr_t)
 sysnet_manage_config(cardmgr_t)
 
-userdom_use_user_terminals(cardmgr_t)
+userdom_use_inherited_user_terminals(cardmgr_t)
 userdom_dontaudit_use_unpriv_user_fds(cardmgr_t)
 userdom_dontaudit_search_user_home_dirs(cardmgr_t)
 
diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
index 7ed9819..94c3d26 100644
--- a/policy/modules/system/selinuxutil.te
+++ b/policy/modules/system/selinuxutil.te
@@ -139,7 +139,7 @@ term_use_console(checkpolicy_t)
 init_use_fds(checkpolicy_t)
 init_use_script_ptys(checkpolicy_t)
 
-userdom_use_user_terminals(checkpolicy_t)
+userdom_use_inherited_user_terminals(checkpolicy_t)
 userdom_use_all_users_fds(checkpolicy_t)
 
 ifdef(`distro_ubuntu',`
@@ -181,7 +181,7 @@ miscfiles_read_localization(load_policy_t)
 
 seutil_libselinux_linked(load_policy_t)
 
-userdom_use_user_terminals(load_policy_t)
+userdom_use_inherited_user_terminals(load_policy_t)
 userdom_use_all_users_fds(load_policy_t)
 
 ifdef(`distro_ubuntu',`
@@ -396,7 +396,7 @@ miscfiles_read_localization(run_init_t)
 seutil_libselinux_linked(run_init_t)
 seutil_read_default_contexts(run_init_t)
 
-userdom_use_user_terminals(run_init_t)
+userdom_use_inherited_user_terminals(run_init_t)
 
 ifndef(`direct_sysadm_daemon',`
 	ifdef(`distro_gentoo',`
diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
index df32316..487ab16 100644
--- a/policy/modules/system/sysnetwork.te
+++ b/policy/modules/system/sysnetwork.te
@@ -137,7 +137,7 @@ miscfiles_read_localization(dhcpc_t)
 
 modutils_domtrans_insmod(dhcpc_t)
 
-userdom_use_user_terminals(dhcpc_t)
+userdom_use_inherited_user_terminals(dhcpc_t)
 userdom_dontaudit_search_user_home_dirs(dhcpc_t)
 
 ifdef(`distro_redhat', `
@@ -305,7 +305,7 @@ modutils_domtrans_insmod(ifconfig_t)
 
 seutil_use_runinit_fds(ifconfig_t)
 
-userdom_use_user_terminals(ifconfig_t)
+userdom_use_inherited_user_terminals(ifconfig_t)
 userdom_use_all_users_fds(ifconfig_t)
 
 ifdef(`distro_ubuntu',`
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 28b88de..7e5effd 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -1129,7 +1129,7 @@ template(`userdom_admin_user_template',`
 	storage_raw_read_removable_device($1_t)
 	storage_raw_write_removable_device($1_t)
 
-	term_use_all_terms($1_t)
+	term_use_all_inherited_terms($1_t)
 
 	auth_getattr_shadow($1_t)
 	# Manage almost all files
@@ -2572,6 +2572,24 @@ interface(`userdom_use_user_ttys',`
 
 ########################################
 ## <summary>
+##	Read and write a inherited user domain tty.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_use_inherited_user_ttys',`
+	gen_require(`
+		type user_tty_device_t;
+	')
+
+	allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
+')
+
+########################################
+## <summary>
 ##	Read and write a user domain pty.
 ## </summary>
 ## <param name="domain">
@@ -2590,6 +2608,24 @@ interface(`userdom_use_user_ptys',`
 
 ########################################
 ## <summary>
+##	Read and write a inherited user domain pty.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_use_inherited_user_ptys',`
+	gen_require(`
+		type user_devpts_t;
+	')
+
+	allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
+')
+
+########################################
+## <summary>
 ##	Read and write a user TTYs and PTYs.
 ## </summary>
 ## <desc>
@@ -2626,6 +2662,35 @@ interface(`userdom_use_user_terminals',`
 
 ########################################
 ## <summary>
+##	Read and write a inherited user TTYs and PTYs.
+## </summary>
+## <desc>
+##	<p>
+##	Allow the specified domain to read and write inherited user
+##	TTYs and PTYs. This will allow the domain to
+##	interact with the user via the terminal. Typically
+##	all interactive applications will require this
+##	access.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="both" weight="10"/>
+#
+interface(`userdom_use_inherited_user_terminals',`
+	gen_require(`
+		type user_tty_device_t, user_devpts_t;
+	')
+
+	allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
+	allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
+')
+
+########################################
+## <summary>
 ##	Do not audit attempts to read and write
 ##	a user domain tty and pty.
 ## </summary>
diff --git a/policy/support/obj_perm_sets.spt b/policy/support/obj_perm_sets.spt
index f7380b3..a5f732c 100644
--- a/policy/support/obj_perm_sets.spt
+++ b/policy/support/obj_perm_sets.spt
@@ -28,8 +28,7 @@ define(`devfile_class_set', `{ chr_file blk_file }')
 #
 # All socket classes.
 #
-define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket }')
-
+define(`socket_class_set', `{ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket }')
 
 #
 # Datagram socket classes.
@@ -105,7 +104,7 @@ define(`mount_fs_perms', `{ mount remount unmount getattr }')
 #
 # Permissions for using sockets.
 # 
-define(`rw_socket_perms', `{ ioctl read getattr write setattr append bind connect getopt setopt shutdown }')
+define(`rw_socket_perms', `{ ioctl read getattr lock write setattr append bind connect getopt setopt shutdown }')
 
 #
 # Permissions for creating and using sockets.
@@ -199,12 +198,14 @@ define(`relabel_dir_perms',`{ getattr relabelfrom relabelto }')
 #
 define(`getattr_file_perms',`{ getattr }')
 define(`setattr_file_perms',`{ setattr }')
-define(`read_file_perms',`{ getattr open read lock ioctl }')
+define(`read_inherited_file_perms',`{ getattr read ioctl lock }')
+define(`read_file_perms',`{ open read_inherited_file_perms }')
 define(`mmap_file_perms',`{ getattr open read execute ioctl }')
 define(`exec_file_perms',`{ getattr open read execute ioctl execute_no_trans }')
 define(`append_file_perms',`{ getattr open append lock ioctl }')
 define(`write_file_perms',`{ getattr open write append lock ioctl }')
-define(`rw_file_perms',`{ getattr open read write append ioctl lock }')
+define(`rw_inherited_file_perms',`{ getattr read write append ioctl lock }')
+define(`rw_file_perms',`{ open rw_inherited_file_perms }')
 define(`create_file_perms',`{ getattr create open }')
 define(`rename_file_perms',`{ getattr rename }')
 define(`delete_file_perms',`{ getattr unlink }')
@@ -225,7 +226,7 @@ define(`rw_lnk_file_perms',`{ getattr read write lock ioctl }')
 define(`create_lnk_file_perms',`{ create getattr }')
 define(`rename_lnk_file_perms',`{ getattr rename }')
 define(`delete_lnk_file_perms',`{ getattr unlink }')
-define(`manage_lnk_file_perms',`{ create read write getattr setattr link unlink rename }')
+define(`manage_lnk_file_perms',`{ create getattr setattr read write append rename link unlink ioctl lock }')
 define(`relabelfrom_lnk_file_perms',`{ getattr relabelfrom }')
 define(`relabelto_lnk_file_perms',`{ getattr relabelto }')
 define(`relabel_lnk_file_perms',`{ getattr relabelfrom relabelto }')
@@ -238,7 +239,8 @@ define(`setattr_fifo_file_perms',`{ setattr }')
 define(`read_fifo_file_perms',`{ getattr open read lock ioctl }')
 define(`append_fifo_file_perms',`{ getattr open append lock ioctl }')
 define(`write_fifo_file_perms',`{ getattr open write append lock ioctl }')
-define(`rw_fifo_file_perms',`{ getattr open read write append ioctl lock }')
+define(`rw_inherited_fifo_file_perms',`{ getattr read write append ioctl lock }')
+define(`rw_fifo_file_perms',`{ open rw_inherited_fifo_file_perms }')
 define(`create_fifo_file_perms',`{ getattr create open }')
 define(`rename_fifo_file_perms',`{ getattr rename }')
 define(`delete_fifo_file_perms',`{ getattr unlink }')
@@ -254,7 +256,8 @@ define(`getattr_sock_file_perms',`{ getattr }')
 define(`setattr_sock_file_perms',`{ setattr }')
 define(`read_sock_file_perms',`{ getattr open read }')
 define(`write_sock_file_perms',`{ getattr write open append }')
-define(`rw_sock_file_perms',`{ getattr open read write append }')
+define(`rw_inherited_sock_file_perms',`{ getattr read write append }')
+define(`rw_sock_file_perms',`{ open rw_inherited_sock_file_perms }')
 define(`create_sock_file_perms',`{ getattr create open }')
 define(`rename_sock_file_perms',`{ getattr rename }')
 define(`delete_sock_file_perms',`{ getattr unlink }')
@@ -271,7 +274,8 @@ define(`setattr_blk_file_perms',`{ setattr }')
 define(`read_blk_file_perms',`{ getattr open read lock ioctl }')
 define(`append_blk_file_perms',`{ getattr open append lock ioctl }')
 define(`write_blk_file_perms',`{ getattr open write append lock ioctl }')
-define(`rw_blk_file_perms',`{ getattr open read write append ioctl lock }')
+define(`rw_inherited_blk_file_perms',`{ getattr read write append ioctl lock }')
+define(`rw_blk_file_perms',`{ open rw_inherited_blk_file_perms }')
 define(`create_blk_file_perms',`{ getattr create }')
 define(`rename_blk_file_perms',`{ getattr rename }')
 define(`delete_blk_file_perms',`{ getattr unlink }')
@@ -288,7 +292,8 @@ define(`setattr_chr_file_perms',`{ setattr }')
 define(`read_chr_file_perms',`{ getattr open read lock ioctl }')
 define(`append_chr_file_perms',`{ getattr open append lock ioctl }')
 define(`write_chr_file_perms',`{ getattr open write append lock ioctl }')
-define(`rw_chr_file_perms',`{ getattr open read write append ioctl lock }')
+define(`rw_inherited_chr_file_perms',`{ getattr read write append ioctl lock }')
+define(`rw_chr_file_perms',`{ open rw_inherited_chr_file_perms }')
 define(`create_chr_file_perms',`{ getattr create }')
 define(`rename_chr_file_perms',`{ getattr rename }')
 define(`delete_chr_file_perms',`{ getattr unlink }')
@@ -305,7 +310,8 @@ define(`relabel_chr_file_perms',`{ getattr relabelfrom relabelto }')
 #
 # Use (read and write) terminals
 #
-define(`rw_term_perms', `{ getattr open read write append ioctl }')
+define(`rw_inherited_term_perms', `{ getattr read write append ioctl }')
+define(`rw_term_perms', `{ rw_inherited_term_perms open }')
 
 #
 # Sockets
