From d1ea961fc550d3adfb4030d683dfa7f2167b032c Mon Sep 17 00:00:00 2001
From: zhouzilong <zhouzilong@uniontech.com>
Date: Wed, 11 Sep 2024 11:02:43 +0800
Subject: [PATCH] support v25 usec policy

---
 policy/constraints                            |   15 +
 policy/constraints.orig                       |  250 +
 policy/mcs                                    |   62 +-
 policy/mls                                    |  199 +-
 policy/modules/admin/apt.te                   |    7 +
 policy/modules/admin/apt.te.orig              |  194 +
 policy/modules/admin/dpkg.te                  |   16 +
 policy/modules/admin/dpkg.te.orig             |  394 ++
 policy/modules/kernel/devices.te              |    4 +-
 policy/modules/kernel/domain.if               |   24 +-
 policy/modules/kernel/domain.te               |   28 +-
 policy/modules/kernel/files.te                |   12 +
 policy/modules/kernel/kernel.te               |   16 +-
 policy/modules/kernel/kernel.te.orig          |  602 ++
 policy/modules/kernel/mcs.if                  |   18 +
 policy/modules/kernel/mcs.te                  |    1 +
 policy/modules/kernel/mls.if                  |   18 +
 policy/modules/kernel/mls.te                  |    2 +
 policy/modules/kernel/selinux.te              |    6 +-
 policy/modules/kernel/storage.te              |    8 +-
 policy/modules/roles/sysadm.te                |    5 +
 policy/modules/roles/sysadm.te.orig           | 1350 +++++
 .../modules/services/deepin_perm_control.fc   |   11 +
 .../modules/services/deepin_perm_control.if   |  872 +++
 .../modules/services/deepin_perm_control.te   |  860 +++
 policy/modules/services/xserver.te            |    6 +
 policy/modules/services/xserver.te.orig       | 1095 ++++
 policy/modules/system/authlogin.te            |    6 +-
 policy/modules/system/selinuxutil.te          |    2 +-
 policy/modules/system/userdomain.if           |   41 +
 policy/modules/system/userdomain.if.orig      | 5152 +++++++++++++++++
 policy/modules/system/userdomain.te           |   10 +
 32 files changed, 11130 insertions(+), 156 deletions(-)
 create mode 100644 policy/constraints.orig
 create mode 100644 policy/modules/admin/apt.te.orig
 create mode 100644 policy/modules/admin/dpkg.te.orig
 create mode 100644 policy/modules/kernel/kernel.te.orig
 create mode 100644 policy/modules/roles/sysadm.te.orig
 create mode 100644 policy/modules/services/deepin_perm_control.fc
 create mode 100644 policy/modules/services/deepin_perm_control.if
 create mode 100644 policy/modules/services/deepin_perm_control.te
 create mode 100644 policy/modules/services/xserver.te.orig
 create mode 100644 policy/modules/system/userdomain.if.orig

Index: refpolicy-deepin/policy/constraints
===================================================================
--- refpolicy-deepin.orig/policy/constraints
+++ refpolicy-deepin/policy/constraints
@@ -56,6 +56,17 @@ define(`exempted_ubac_constraint',`
 	')
 ')
 
+define(`exempted_constraint_setattr',`
+	constrain $1 { setattr }
+	(
+		u1 == u2
+		or u1 == system_u
+		or u2 == system_u
+		or t1 != $2
+		or u1 == root
+	);
+')
+
 ########################################
 #
 # File rules
@@ -69,10 +80,14 @@ exempted_ubac_constraint(sock_file, ubac
 exempted_ubac_constraint(chr_file, ubacfile)
 exempted_ubac_constraint(blk_file, ubacfile)
 
+# setattr
+exempted_constraint_setattr(dir_file_class_set, login_userdomain)
+
 # SELinux object identity change constraint:
 constrain dir_file_class_set { create relabelto relabelfrom }
 (
 	u1 == u2
+	or t2 == deepin_file_type
 	or t1 == can_change_object_identity
 );
 
Index: refpolicy-deepin/policy/constraints.orig
===================================================================
--- /dev/null
+++ refpolicy-deepin/policy/constraints.orig
@@ -0,0 +1,250 @@
+
+#
+# Define the constraints
+#
+# constrain class_set perm_set expression ;
+#
+# expression : ( expression )
+#	     | not expression
+#	     | expression and expression
+#	     | expression or expression
+#	     | u1 op u2
+#	     | r1 role_op r2
+#	     | t1 op t2
+#	     | u1 op names
+#	     | u2 op names
+#	     | r1 op names
+#	     | r2 op names
+#	     | t1 op names
+#	     | t2 op names
+#
+# op : == | !=
+# role_op : == | != | eq | dom | domby | incomp
+#
+# names : name | { name_list }
+# name_list : name | name_list name
+#
+
+define(`basic_ubac_conditions',`
+	ifdef(`enable_ubac',`
+		u1 == u2
+		or u1 == system_u
+		or u1 == unconfined_u
+		or u1 == sysadm_u
+		or u2 == system_u
+		or t1 != ubac_constrained_type
+		or t2 != ubac_constrained_type
+	')
+')
+
+define(`basic_ubac_constraint',`
+	ifdef(`enable_ubac',`
+		constrain $1 all_$1_perms
+		(
+			basic_ubac_conditions
+		);
+	')
+')
+
+define(`exempted_ubac_constraint',`
+	ifdef(`enable_ubac',`
+		constrain $1 all_$1_perms
+		(
+			basic_ubac_conditions
+			or t1 == $2
+		);
+	')
+')
+
+########################################
+#
+# File rules
+#
+
+exempted_ubac_constraint(dir, ubacfile)
+exempted_ubac_constraint(file, ubacfile)
+exempted_ubac_constraint(lnk_file, ubacfile)
+exempted_ubac_constraint(fifo_file, ubacfile)
+exempted_ubac_constraint(sock_file, ubacfile)
+exempted_ubac_constraint(chr_file, ubacfile)
+exempted_ubac_constraint(blk_file, ubacfile)
+
+# SELinux object identity change constraint:
+constrain dir_file_class_set { create relabelto relabelfrom }
+(
+	u1 == u2
+	or t1 == can_change_object_identity
+);
+
+########################################
+#
+# Process rules
+#
+
+ifdef(`enable_ubac',`
+	constrain process { sigchld sigkill sigstop signull signal ptrace getsched setsched getsession getpgid setpgid getcap setcap share getattr setrlimit }
+	(
+		basic_ubac_conditions
+		or t1 == ubacproc
+	);
+')
+
+constrain process { transition dyntransition noatsecure siginh rlimitinh }
+(
+	u1 == u2
+	or ( t1 == can_change_process_identity and t2 == process_user_target )
+	or ( t1 == cron_source_domain and ( t2 == cron_job_domain or u2 == system_u ) )
+	or ( t1 == can_system_change and u2 == system_u )
+	or ( t1 == process_uncond_exempt )
+);
+
+constrain process { transition dyntransition noatsecure siginh rlimitinh }
+(
+	r1 == r2
+	or ( t1 == can_change_process_role and t2 == process_user_target )
+	or ( t1 == cron_source_domain and t2 == cron_job_domain )
+	or ( t1 == can_system_change and r2 == system_r )
+	or ( t1 == process_uncond_exempt )
+);
+
+# These permissions do not have ubac constraints:
+# fork
+# setexec
+# setfscreate
+# setcurrent
+# execmem
+# execstack
+# execheap
+# setkeycreate
+# setsockcreate
+
+########################################
+#
+# File descriptor rules
+#
+
+exempted_ubac_constraint(fd, ubacfd)
+
+########################################
+#
+# Socket rules
+#
+
+exempted_ubac_constraint(socket, ubacsock)
+exempted_ubac_constraint(tcp_socket, ubacsock)
+exempted_ubac_constraint(sctp_socket, ubacsock)
+exempted_ubac_constraint(udp_socket, ubacsock)
+exempted_ubac_constraint(rawip_socket, ubacsock)
+exempted_ubac_constraint(netlink_socket, ubacsock)
+exempted_ubac_constraint(packet_socket, ubacsock)
+exempted_ubac_constraint(key_socket, ubacsock)
+exempted_ubac_constraint(unix_stream_socket, ubacsock)
+exempted_ubac_constraint(unix_dgram_socket, ubacsock)
+exempted_ubac_constraint(netlink_route_socket, ubacsock)
+exempted_ubac_constraint(netlink_tcpdiag_socket, ubacsock)
+exempted_ubac_constraint(netlink_nflog_socket, ubacsock)
+exempted_ubac_constraint(netlink_xfrm_socket, ubacsock)
+exempted_ubac_constraint(netlink_selinux_socket, ubacsock)
+exempted_ubac_constraint(netlink_audit_socket, ubacsock)
+exempted_ubac_constraint(netlink_dnrt_socket, ubacsock)
+exempted_ubac_constraint(netlink_kobject_uevent_socket, ubacsock)
+exempted_ubac_constraint(appletalk_socket, ubacsock)
+exempted_ubac_constraint(dccp_socket, ubacsock)
+exempted_ubac_constraint(tun_socket, ubacsock)
+exempted_ubac_constraint(netlink_iscsi_socket, ubacsock)
+exempted_ubac_constraint(netlink_fib_lookup_socket, ubacsock)
+exempted_ubac_constraint(netlink_connector_socket, ubacsock)
+exempted_ubac_constraint(netlink_netfilter_socket, ubacsock)
+exempted_ubac_constraint(netlink_generic_socket, ubacsock)
+exempted_ubac_constraint(netlink_scsitransport_socket, ubacsock)
+exempted_ubac_constraint(netlink_rdma_socket, ubacsock)
+exempted_ubac_constraint(netlink_crypto_socket, ubacsock)
+
+constrain socket_class_set { create relabelto relabelfrom }
+(
+	u1 == u2
+	or t1 == can_change_object_identity
+);
+
+########################################
+#
+# SysV IPC rules
+
+exempted_ubac_constraint(sem, ubacipc)
+exempted_ubac_constraint(msg, ubacipc)
+exempted_ubac_constraint(msgq, ubacipc)
+exempted_ubac_constraint(shm, ubacipc)
+exempted_ubac_constraint(ipc, ubacipc)
+
+########################################
+#
+# SE-X Windows rules
+#
+
+exempted_ubac_constraint(x_drawable, ubacxwin)
+exempted_ubac_constraint(x_screen, ubacxwin)
+exempted_ubac_constraint(x_gc, ubacxwin)
+exempted_ubac_constraint(x_font, ubacxwin)
+exempted_ubac_constraint(x_colormap, ubacxwin)
+exempted_ubac_constraint(x_property, ubacxwin)
+exempted_ubac_constraint(x_selection, ubacxwin)
+exempted_ubac_constraint(x_cursor, ubacxwin)
+exempted_ubac_constraint(x_client, ubacxwin)
+exempted_ubac_constraint(x_device, ubacxwin)
+exempted_ubac_constraint(x_server, ubacxwin)
+exempted_ubac_constraint(x_extension, ubacxwin)
+exempted_ubac_constraint(x_resource, ubacxwin)
+exempted_ubac_constraint(x_event, ubacxwin)
+exempted_ubac_constraint(x_synthetic_event, ubacxwin)
+exempted_ubac_constraint(x_application_data, ubacxwin)
+
+########################################
+#
+# D-BUS rules
+#
+
+exempted_ubac_constraint(dbus, ubacdbus)
+
+########################################
+#
+# Key rules
+#
+
+exempted_ubac_constraint(key, ubackey)
+
+########################################
+#
+# Database rules
+#
+
+exempted_ubac_constraint(db_database, ubacdb)
+exempted_ubac_constraint(db_table, ubacdb)
+exempted_ubac_constraint(db_procedure, ubacdb)
+exempted_ubac_constraint(db_column, ubacdb)
+exempted_ubac_constraint(db_tuple, ubacdb)
+exempted_ubac_constraint(db_blob, ubacdb)
+
+
+
+basic_ubac_constraint(association)
+basic_ubac_constraint(peer)
+
+
+# these classes have no UBAC restrictions
+#class security
+#class system
+#class capability
+#class memprotect
+#class passwd			# userspace
+#class node
+#class netif
+#class packet
+#class capability2
+#class nscd			# userspace
+#class context			# userspace
+
+
+
+undefine(`basic_ubac_constraint')
+undefine(`basic_ubac_conditions')
+undefine(`exempted_ubac_constraint')
Index: refpolicy-deepin/policy/mcs
===================================================================
--- refpolicy-deepin.orig/policy/mcs
+++ refpolicy-deepin/policy/mcs
@@ -68,71 +68,71 @@ gen_levels(1,mcs_num_cats)
 #  - getattr on dirs/files is not constrained.
 
 mlsconstrain dir_file_class_set { open read ioctl lock write setattr append create unlink link rename relabelfrom relabelto }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain file { execute execute_no_trans }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain dir { search add_name remove_name rmdir }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 # New filesystem object labels must be dominated by the relabeling subject
 # clearance, also the objects are single-level.
 mlsconstrain { file lnk_file fifo_file } { create relabelto }
-	((( h1 dom h2 ) and ( l2 eq h2 )) or
+	((( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) and ( l2 eq h2 )) or
 	 ( t1 != mcs_constrained_type ));
 
 #
 # MCS policy for process classes
 #
 mlsconstrain process { transition dyntransition ptrace sigkill sigstop signal getsession getattr getsched setsched getrlimit setrlimit getpgid setpgid getcap setcap share setexec setfscreate setcurrent setsockcreate }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 #
 # MCS policy for socket classes
 #
 mlsconstrain socket_class_set { create ioctl read write setattr append bind connect getopt setopt shutdown }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain stream_socket_class_set { listen accept }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain { tcp_socket udp_socket rawip_socket sctp_socket } node_bind
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain unix_stream_socket connectto
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain unix_dgram_socket sendto
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 
 #
 # MCS policy for key class
 #
 mlsconstrain key { create link read search setattr view write }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 #
 # MCS policy for SysV IPC
 #
 mlsconstrain { ipc sem msgq shm } { create destroy setattr read unix_read write unix_write }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain msg { send receive }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain msgq enqueue
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain shm lock
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 #
 # MCS policy for context class
 #
 mlsconstrain context contains
-	((( h1 dom h2 ) and ( l1 domby l2 )) or ( t1 != mcs_constrained_type ));
+	((( h1 dom h2 ) and ( l1 domby l2 )) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 #
 # MCS policy for network classes
@@ -142,17 +142,17 @@ mlsconstrain context contains
 # because the subject in this particular case is the remote domain which is
 # writing data out the network node which is acting as the object
 mlsconstrain { node } { recvfrom sendto }
-	(( l1 dom l2 ) or ( t1 != mcs_constrained_type ));
+	(( l1 dom l2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain { packet peer } { recv }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mcsexemptiondomain ) or
 	 (( t1 != mcs_constrained_type ) and ( t2 != mcs_constrained_type )));
 
 # The netif ingress/egress ops, the ingress permission is a "write" operation
 # because the subject in this particular case is the remote domain which is
 # writing data out the network interface which is acting as the object
 mlsconstrain { netif } { egress ingress }
-	(( l1 dom l2 ) or ( t1 != mcs_constrained_type ));
+	(( l1 dom l2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 #
 # MCS policy for SELinux-enabled databases
@@ -161,40 +161,40 @@ mlsconstrain { netif } { egress ingress
 # Any database object must be dominated by the relabeling subject
 # clearance, also the objects are single-level.
 mlsconstrain { db_database db_schema db_table db_sequence db_view db_procedure db_language db_column db_blob } { create relabelto }
-	((( h1 dom h2 ) and ( l2 eq h2 )) or ( t1 != mcs_constrained_type ));
+	((( h1 dom h2 ) and ( l2 eq h2 )) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain { db_tuple } { insert relabelto }
-	((( h1 dom h2 ) and ( l2 eq h2 )) or ( t1 != mcs_constrained_type ));
+	((( h1 dom h2 ) and ( l2 eq h2 )) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 # Access control for any database objects based on MCS rules.
 mlsconstrain db_database { drop getattr setattr relabelfrom access install_module load_module get_param set_param }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_schema { drop getattr setattr relabelfrom search }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_table { drop getattr setattr relabelfrom select update insert delete lock }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_column { drop getattr setattr relabelfrom select update insert }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_tuple { relabelfrom select update delete use }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_sequence { drop getattr setattr relabelfrom get_value next_value set_value }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_view { drop getattr setattr relabelfrom expand }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_procedure { drop getattr setattr relabelfrom execute install entrypoint }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_language { drop getattr setattr relabelfrom execute }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_blob { drop getattr setattr relabelfrom read write import export }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or ( t1 != mcs_constrained_type ));
 
 ') dnl end enable_mcs
Index: refpolicy-deepin/policy/mls
===================================================================
--- refpolicy-deepin.orig/policy/mls
+++ refpolicy-deepin/policy/mls
@@ -66,30 +66,30 @@ gen_levels(mls_num_sens,mls_num_cats)
 
 # make sure these file classes are "single level"
 mlsconstrain { file lnk_file fifo_file } { create relabelto }
-	( l2 eq h2 );
+	(( l2 eq h2 ) or ( t1 == mcsexemptiondomain ));
 
 # new file labels must be dominated by the relabeling subjects clearance
 mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } relabelto
-	(( h1 dom h2 ) or
+	(( h1 dom h2 ) or ( t1 == mcsexemptiondomain ) or
 	(( t1 == mlsfilerelabeltoclr ) and ( h1 dom l2 )) or
 	( t1 == mlsfilerelabel ));
 
 # the file "read" ops (note the check is dominance of the low level)
 mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { read getattr execute }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mcsexemptiondomain ) or
 	 (( t1 == mlsfilereadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsfileread ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain dir search
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mcsexemptiondomain ) or
 	 (( t1 == mlsfilereadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsfileread ) or
 	 ( t2 == mlstrustedobject ));
 
 # the "single level" file "write" ops
 mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mcsexemptiondomain ) or ( t1 == mcsexemptiondomain ) or
 	 (( t1 == mlsfilewritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 (( t2 == mlsfilewriteinrange ) and ( l1 dom l2 ) and ( h1 domby h2 )) or
 	 ( t1 == mlsfilewrite ) or
@@ -97,7 +97,7 @@ mlsconstrain { file lnk_file fifo_file d
 
 # Directory "write" ops
 mlsconstrain dir { add_name remove_name reparent rmdir }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mcsexemptiondomain ) or
 	 (( t1 == mlsfilewriteinrange ) and ( l1 dom l2 ) and ( l1 domby h2 )) or
 	 (( t1 == mlsfilewritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsfilewrite ) or
@@ -111,27 +111,27 @@ mlsconstrain dir { add_name remove_name
 
 # the file upgrade/downgrade rule
 mlsvalidatetrans { dir file lnk_file chr_file blk_file sock_file fifo_file }
-	((( l1 eq l2 ) or
+	(( t1 == mlsexemptiondomain ) or ((( l1 eq l2 ) or
 	  (( t3 == mlsfileupgrade ) and ( l1 domby l2 )) or
 	  (( t3 == mlsfiledowngrade ) and ( l1 dom l2 )) or
 	  (( t3 == mlsfiledowngrade ) and ( l1 incomp l2 ))) and
 	 (( h1 eq h2 ) or
 	  (( t3 == mlsfileupgrade ) and ( h1 domby h2 )) or
 	  (( t3 == mlsfiledowngrade ) and ( h1 dom h2 )) or
-	  (( t3 == mlsfiledowngrade ) and ( h1 incomp h2 ))));
+	  (( t3 == mlsfiledowngrade ) and ( h1 incomp h2 )))));
 
 # create can also require the upgrade/downgrade checks if the creating process
 # has used setfscreate (note that both the high and low level of the object
 # default to the process sensitivity level)
 mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } create
-	((( l1 eq l2 ) or
+	(( t1 == mlsexemptiondomain ) or ((( l1 eq l2 ) or
 	  (( t1 == mlsfileupgrade ) and ( l1 domby l2 )) or
 	  (( t1 == mlsfiledowngrade ) and ( l1 dom l2 )) or
 	  (( t1 == mlsfiledowngrade ) and ( l1 incomp l2 ))) and
 	 (( l1 eq h2 ) or
 	  (( t1 == mlsfileupgrade ) and ( l1 domby h2 )) or
 	  (( t1 == mlsfiledowngrade ) and ( l1 dom h2 )) or
-	  (( t1 == mlsfiledowngrade ) and ( l1 incomp h2 ))));
+	  (( t1 == mlsfiledowngrade ) and ( l1 incomp h2 )))));
 
 
 
@@ -142,7 +142,7 @@ mlsconstrain { dir file lnk_file chr_fil
 
 # new filesystem labels must be dominated by the relabeling subjects clearance
 mlsconstrain filesystem relabelto
-	( h1 dom h2 );
+	(( h1 dom h2 ) or ( t1 == mlsexemptiondomain ));
 
 # the filesystem "read" ops (implicit single level)
 mlsconstrain filesystem { getattr quotaget }
@@ -152,7 +152,7 @@ mlsconstrain filesystem { getattr quotag
 
 # all the filesystem "write" ops (implicit single level)
 mlsconstrain filesystem { mount remount unmount relabelfrom quotamod }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsfilewritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsfilewrite ));
 
@@ -168,13 +168,13 @@ mlsconstrain filesystem { mount remount
 
 # new socket labels must be dominated by the relabeling subjects clearance
 mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket } relabelto
-	( h1 dom h2 );
+	(( h1 dom h2 ) or ( t1 == mlsexemptiondomain ));
 
 # the socket "read+write" ops
 # (Socket FDs are generally bidirectional, equivalent to open(..., O_RDWR),
 # require equal levels for unprivileged subjects, or read *and* write overrides)
 mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket sctp_socket } { accept connect }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (((( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
 	   ( t1 == mlsnetread )) and
 	  ((( t1 == mlsnetwriteranged ) and ( l1 dom l2 ) and ( l1 domby h2 )) or
@@ -184,31 +184,31 @@ mlsconstrain { socket tcp_socket udp_soc
 
 # the socket "read" ops (note the check is dominance of the low level)
 mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket } { read getattr listen accept getopt }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsnetread ));
 
 mlsconstrain { netlink_route_socket netlink_tcpdiag_socket netlink_xfrm_socket netlink_audit_socket } nlmsg_read
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsnetread ));
 
 # the socket "write" ops
 mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket } { write setattr relabelfrom connect setopt shutdown }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsnetwriteranged ) and ( l1 dom l2 ) and ( l1 domby h2 )) or
 	 (( t1 == mlsnetwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsnetwrite ));
 
 # used by netlabel to restrict normal domains to same level connections
 mlsconstrain { tcp_socket udp_socket rawip_socket sctp_socket } recvfrom
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsnetread ));
 
 # UNIX domain socket ops
 mlsconstrain unix_stream_socket connectto
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsnetwriteranged ) and ( l1 dom l2 ) and ( l1 domby h2 )) or
 	 (( t1 == mlsnetwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsnetwrite ) or
@@ -216,7 +216,7 @@ mlsconstrain unix_stream_socket connectt
 	 ( t2 == mlstrustedsocket ));
 
 mlsconstrain unix_dgram_socket sendto
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsnetwriteranged ) and ( l1 dom l2 ) and ( l1 domby h2 )) or
 	 (( t1 == mlsnetwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsnetwrite ) or
@@ -247,33 +247,33 @@ mlsconstrain unix_dgram_socket sendto
 
 # the ipc "read" ops (implicit single level)
 mlsconstrain { ipc sem msgq shm } { getattr read unix_read }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsipcreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsipcread ));
 
 mlsconstrain msg receive
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsipcreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsipcread ));
 
 # the ipc "write" ops (implicit single level)
 mlsconstrain { ipc sem msgq shm } { create destroy setattr write unix_write }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsipcwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsipcwrite ));
 
 mlsconstrain msgq enqueue
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsipcwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsipcwrite ));
 
 mlsconstrain shm lock
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsipcwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsipcwrite ));
 
 mlsconstrain msg send
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsipcwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsipcwrite ));
 
@@ -286,7 +286,7 @@ mlsconstrain msg send
 #
 
 mlsconstrain key { create link read search setattr view write }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlskeywritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlskeywrite ));
 
@@ -301,6 +301,7 @@ mlsconstrain key { create link read sear
 # shared among levels (mlsfdshare).
 mlsconstrain fd use (
 	l1 eq l2
+	or t1 == mlsexemptiondomain
 	or t1 == mlsfduse
 	or t2 == mlsfdshare
 );
@@ -313,33 +314,33 @@ mlsconstrain fd use (
 # because the subject in this particular case is the remote domain which is
 # writing data out the network interface which is acting as the object
 mlsconstrain { netif } { ingress }
-	((( l1 dom l2 ) and ( l1 domby h2 )) or
+	((( l1 dom l2 ) and ( l1 domby h2 )) or ( t1 == mlsexemptiondomain ) or
 	 ( t1 == mlsnetinbound ) or
 	 ( t1 == unlabeled_t ));
 mlsconstrain { netif } { egress }
-	((( l1 dom l2 ) and ( l1 domby h2 )) or
+	((( l1 dom l2 ) and ( l1 domby h2 )) or ( t1 == mlsexemptiondomain ) or
 	 ( t1 == mlsnetoutbound ));
 
 # the node recvfrom/sendto ops, the recvfrom permission is a "write" operation
 # because the subject in this particular case is the remote domain which is
 # writing data out the network node which is acting as the object
 mlsconstrain { node } { recvfrom }
-	((( l1 dom l2 ) and ( l1 domby h2 )) or
+	((( l1 dom l2 ) and ( l1 domby h2 )) or ( t1 == mlsexemptiondomain ) or
 	 ( t1 == mlsnetinbound ) or
 	 ( t1 == unlabeled_t ));
 mlsconstrain { node } { sendto }
-	((( l1 dom l2 ) and ( l1 domby h2 )) or
+	((( l1 dom l2 ) and ( l1 domby h2 )) or ( t1 == mlsexemptiondomain ) or
 	 ( t1 == mlsnetoutbound ));
 
 # the forward ops, the forward_in permission is a "write" operation because the
 # subject in this particular case is the remote domain which is writing data
 # to the network with a secmark label, the object in this case
 mlsconstrain { packet } { forward_in }
-	((( l1 dom l2 ) and ( l1 domby h2 )) or
+	((( l1 dom l2 ) and ( l1 domby h2 )) or ( t1 == mlsexemptiondomain ) or
 	 ( t1 == mlsnetinbound ) or
 	 ( t1 == unlabeled_t ));
 mlsconstrain { packet } { forward_out }
-	((( l1 dom l2 ) and ( l1 domby h2 )) or
+	((( l1 dom l2 ) and ( l1 domby h2 )) or ( t1 == mlsexemptiondomain ) or
 	 ( t1 == mlsnetoutbound ) or
 	 ( t1 == unlabeled_t ));
 
@@ -349,7 +350,7 @@ mlsconstrain { packet } { forward_out }
 
 # the peer/packet recv op
 mlsconstrain { peer packet } { recv }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsnetread ));
 
@@ -363,22 +364,22 @@ mlsconstrain { peer packet } { recv }
 # new process labels must be dominated by the relabeling subjects clearance
 # and sensitivity level changes require privilege
 mlsconstrain process transition
-	(( h1 dom h2 ) and
+	((( h1 dom h2 ) and
 	 (( l1 eq l2 ) or ( t1 == mlsprocsetsl ) or
-	  (( t1 == privrangetrans ) and ( t2 == mlsrangetrans ))));
+	  (( t1 == privrangetrans ) and ( t2 == mlsrangetrans )))) or ( t1 == mlsexemptiondomain ));
 mlsconstrain process dyntransition
-	(( h1 dom h2 ) and
-	 (( l1 eq l2 ) or ( t1 == mlsprocsetsl )));
+	((( h1 dom h2 ) and
+	 (( l1 eq l2 ) or ( t1 == mlsprocsetsl ))) or ( t1 == mlsexemptiondomain ));
 
 # all the process "read" ops
 mlsconstrain process { getsched getsession getpgid getcap getattr ptrace share }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsprocreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsprocread ));
 
 # all the process "write" ops (note the check is equality on the low level)
 mlsconstrain process { sigkill sigstop signal setsched setpgid setcap setexec setfscreate setsockcreate setcurrent ptrace share }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsprocwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsprocwrite ));
 
@@ -434,13 +435,13 @@ mlsconstrain process { sigkill sigstop s
 
 # the x_drawable "read" ops (implicit single level)
 mlsconstrain x_drawable { read blend getattr list_child list_property get_property receive }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsxwinread ));
 
 # the x_drawable "write" ops (implicit single level)
 mlsconstrain x_drawable { create destroy write setattr add_child remove_child send manage }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsxwinwrite ));
 
@@ -453,13 +454,13 @@ mlsconstrain x_drawable { create destroy
 
 # the x_gc "read" ops (implicit single level)
 mlsconstrain x_gc { getattr use }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsxwinread ));
 
 # the x_gc "write" ops (implicit single level)
 mlsconstrain x_gc { create destroy setattr }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsxwinwrite ));
 
@@ -470,13 +471,13 @@ mlsconstrain x_gc { create destroy setat
 
 # the x_font "read" ops (implicit single level)
 mlsconstrain x_font { use }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsxwinread ));
 
 # the x_font "write" ops (implicit single level)
 mlsconstrain x_font { create destroy add_glyph remove_glyph }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsxwinwrite ));
 
@@ -490,14 +491,14 @@ mlsconstrain x_font { create destroy add
 
 # the x_colormap "read" ops (implicit single level)
 mlsconstrain x_colormap { read getattr use }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsxwinreadcolormap ) or
 	 ( t1 == mlsxwinread ));
 
 # the x_colormap "write" ops (implicit single level)
 mlsconstrain x_colormap { create destroy write add_color remove_color install uninstall }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsxwinwritecolormap ) or
 	 ( t1 == mlsxwinwrite ));
@@ -509,14 +510,14 @@ mlsconstrain x_colormap { create destroy
 
 # the x_property "read" ops (implicit single level)
 mlsconstrain x_property { read getattr }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsxwinreadproperty ) or
 	 ( t1 == mlsxwinread ));
 
 # the x_property "write" ops (implicit single level)
 mlsconstrain x_property { create destroy write append setattr }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsxwinwriteproperty ) or
 	 ( t1 == mlsxwinwrite ));
@@ -528,14 +529,14 @@ mlsconstrain x_property { create destroy
 
 # the x_selection "read" ops (implicit single level)
 mlsconstrain x_selection { read getattr }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsxwinreadselection ) or
 	 ( t1 == mlsxwinread ));
 
 # the x_selection "write" ops (implicit single level)
 mlsconstrain x_selection { write setattr }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsxwinwriteselection ) or
 	 ( t1 == mlsxwinwrite ));
@@ -547,13 +548,13 @@ mlsconstrain x_selection { write setattr
 
 # the x_cursor "read" ops (implicit single level)
 mlsconstrain x_cursor { read getattr use }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsxwinread ));
 
 # the x_cursor "write" ops (implicit single level)
 mlsconstrain x_cursor { create destroy write setattr }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsxwinwrite ));
 
@@ -564,13 +565,13 @@ mlsconstrain x_cursor { create destroy w
 
 # the x_client "read" ops (implicit single level)
 mlsconstrain x_client { getattr }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsxwinread ));
 
 # the x_client "write" ops (implicit single level)
 mlsconstrain x_client { destroy setattr manage }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsxwinwrite ));
 
@@ -581,13 +582,13 @@ mlsconstrain x_client { destroy setattr
 
 # the x_device "read" ops (implicit single level)
 mlsconstrain x_device { getattr use read getfocus grab }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsxwinread ));
 
 # the x_device "write" ops (implicit single level)
 mlsconstrain x_device { setattr write setfocus bell force_cursor freeze manage }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsxwinwritexinput ) or
 	 ( t1 == mlsxwinwrite ));
@@ -615,13 +616,13 @@ mlsconstrain x_device { setattr write se
 
 # the x_resource "read" ops (implicit single level)
 mlsconstrain x_resource { read }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsxwinread ));
 
 # the x_resource "write" ops (implicit single level)
 mlsconstrain x_resource { write }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsxwinwritexinput ) or
 	 ( t1 == mlsxwinwrite ));
@@ -633,13 +634,13 @@ mlsconstrain x_resource { write }
 
 # the x_event "read" ops (implicit single level)
 mlsconstrain x_event { receive }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsxwinread ));
 
 # the x_event "write" ops (implicit single level)
 mlsconstrain x_event { send }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsxwinwritexinput ) or
 	 ( t1 == mlsxwinwrite ));
@@ -651,11 +652,11 @@ mlsconstrain x_event { send }
 
 # the x_application_data "paste" ops
 mlsconstrain x_application_data { paste }
-	( l1 domby l2 );
+	(( l1 domby l2 ) or ( t1 == mlsexemptiondomain ));
 
 # the x_application_data "paste_after_confirm" ops
 mlsconstrain x_application_data { paste_after_confirm }
-	( l1 dom l2 );
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ));
 
 
 #
@@ -664,13 +665,13 @@ mlsconstrain x_application_data { paste_
 
 # the x_pointer "read" ops
 mlsconstrain x_pointer { getattr use read getfocus grab }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsxwinread ));
 
 # the x_pointer "write" ops (implicit single level)
 mlsconstrain x_pointer { setattr write setfocus bell force_cursor freeze manage }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsxwinwritexinput ) or
 	 ( t1 == mlsxwinwrite ));
@@ -682,13 +683,13 @@ mlsconstrain x_pointer { setattr write s
 
 # the x_keyboard "read" ops
 mlsconstrain x_keyboard { getattr use read getfocus grab }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsxwinread ));
 
 # the x_keyboard "write" ops (implicit single level)
 mlsconstrain x_keyboard { setattr write setfocus bell force_cursor freeze manage }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 ( t1 == mlsxwinwritexinput ) or
 	 ( t1 == mlsxwinwrite ));
@@ -700,7 +701,7 @@ mlsconstrain x_keyboard { setattr write
 #
 
 mlsconstrain dbus { send_msg }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 ( t1 == mlsdbussend ) or
 	 ( t2 == mlsdbusrecv ));
 
@@ -725,18 +726,18 @@ mlsconstrain dbus { send_msg }
 #
 
 mlsconstrain association { recvfrom }
-	((( l1 dom l2 ) and ( l1 domby h2 )) or
+	(((( l1 dom l2 ) and ( l1 domby h2 )) or
 	 (( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsnetread ) or
-	 ( t2 == unlabeled_t ));
+	 ( t2 == unlabeled_t )) or ( t1 == mlsexemptiondomain ));
 
 mlsconstrain association { sendto }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsnetwriteranged ) and ( l1 dom l2 ) and ( l1 domby h2 )) or
 	 ( t2 == unlabeled_t ));
 
 mlsconstrain association { polmatch }
-	(( l1 dom l2 ) and ( h1 domby h2 ));
+	((( l1 dom l2 ) and ( h1 domby h2 )) or ( t1 == mlsexemptiondomain ));
 
 
 
@@ -745,7 +746,7 @@ mlsconstrain association { polmatch }
 #
 
 mlsconstrain context contains
-	(( h1 dom h2 ) and ( l1 domby l2));
+	((( h1 dom h2 ) and ( l1 domby l2)) or ( t1 == mlsexemptiondomain ));
 
 #
 # MLS policy for database classes
@@ -753,142 +754,142 @@ mlsconstrain context contains
 
 # make sure these database classes are "single level"
 mlsconstrain { db_sequence db_view db_procedure db_language db_blob } { create relabelto }
-	( l2 eq h2 );
+	(( l2 eq h2 ) or ( t1 == mlsexemptiondomain ));
 
 mlsconstrain { db_tuple } { insert relabelto }
-	( l2 eq h2 );
+	(( l2 eq h2 ) or ( t1 == mlsexemptiondomain ));
 
 # new database labels must be dominated by the relabeling subjects clearance
 mlsconstrain { db_database db_schema db_table db_column } { relabelto }
-	( h1 dom h2 );
+	(( h1 dom h2 ) or ( t1 == mlsexemptiondomain ));
 
 # the database "read" ops (note the check is dominance of the low level)
 mlsconstrain { db_database } { getattr access get_param }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsdbread ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_schema } { getattr search }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsdbread ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_table } { getattr select lock }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsdbread ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_column } { getattr select }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsdbread ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_sequence } { getattr get_value next_value }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsdbread ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_view } { getattr expand }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsdbread ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_procedure } { getattr execute entrypoint install }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsdbread ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_language } { getattr execute }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsdbread ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_blob } { getattr read export }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsdbread ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_tuple } { use select }
-	(( l1 dom l2 ) or
+	(( l1 dom l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsdbread ) or
 	 ( t2 == mlstrustedobject ));
 
 # the "single level" database "write" ops
 mlsconstrain { db_database } { create drop setattr relabelfrom install_module load_module set_param }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 (( t2 == mlsdbwriteinrange ) and ( l1 dom l2 ) and ( h1 domby h2 )) or
 	 ( t1 == mlsdbwrite ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_schema } { create drop setattr relabelfrom add_name remove_name }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 (( t2 == mlsdbwriteinrange ) and ( l1 dom l2 ) and ( h1 domby h2 )) or
 	 ( t1 == mlsdbwrite ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_table } { create drop setattr relabelfrom update insert delete }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 (( t2 == mlsdbwriteinrange ) and ( l1 dom l2 ) and ( h1 domby h2 )) or
 	 ( t1 == mlsdbwrite ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_column } { create drop setattr relabelfrom update insert }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 (( t2 == mlsdbwriteinrange ) and ( l1 dom l2 ) and ( h1 domby h2 )) or
 	 ( t1 == mlsdbwrite ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_sequence } { create drop setattr relabelfrom set_value }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 (( t2 == mlsdbwriteinrange ) and ( l1 dom l2 ) and ( h1 domby h2 )) or
 	 ( t1 == mlsdbwrite ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_view } { create drop setattr relabelfrom }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 (( t2 == mlsdbwriteinrange ) and ( l1 dom l2 ) and ( h1 domby h2 )) or
 	 ( t1 == mlsdbwrite ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_procedure } { create drop setattr relabelfrom }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 (( t2 == mlsdbwriteinrange ) and ( l1 dom l2 ) and ( h1 domby h2 )) or
 	 ( t1 == mlsdbwrite ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_language } { create drop setattr relabelfrom }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 (( t2 == mlsdbwriteinrange ) and ( l1 dom l2 ) and ( h1 domby h2 )) or
 	 ( t1 == mlsdbwrite ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_blob } { create drop setattr relabelfrom write import }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 (( t2 == mlsdbwriteinrange ) and ( l1 dom l2 ) and ( h1 domby h2 )) or
 	 ( t1 == mlsdbwrite ) or
 	 ( t2 == mlstrustedobject ));
 
 mlsconstrain { db_tuple } { relabelfrom update insert delete }
-	(( l1 eq l2 ) or
+	(( l1 eq l2 ) or ( t1 == mlsexemptiondomain ) or
 	 (( t1 == mlsdbwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
 	 (( t2 == mlsdbwriteinrange ) and ( l1 dom l2 ) and ( h1 domby h2 )) or
 	 ( t1 == mlsdbwrite ) or
@@ -896,13 +897,13 @@ mlsconstrain { db_tuple } { relabelfrom
 
 # the database upgrade/downgrade rule
 mlsvalidatetrans { db_database db_schema db_table db_sequence db_view db_procedure db_language db_column db_tuple db_blob }
-	((( l1 eq l2 ) or
+	(((( l1 eq l2 ) or
 	  (( t3 == mlsdbupgrade ) and ( l1 domby l2 )) or
 	  (( t3 == mlsdbdowngrade ) and ( l1 dom l2 )) or
 	  (( t3 == mlsdbdowngrade ) and ( l1 incomp l2 ))) and
 	 (( l1 eq h2 ) or
 	  (( t3 == mlsdbupgrade ) and ( h1 domby h2 )) or
 	  (( t3 == mlsdbdowngrade ) and ( h1 dom h2 )) or
-	  (( t3 == mlsdbdowngrade ) and ( h1 incomp h2 ))));
+	  (( t3 == mlsdbdowngrade ) and ( h1 incomp h2 )))) or ( t1 == mlsexemptiondomain ));
 
 ') dnl end enable_mls
Index: refpolicy-deepin/policy/modules/admin/apt.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/admin/apt.te
+++ refpolicy-deepin/policy/modules/admin/apt.te
@@ -192,3 +192,10 @@ optional_policy(`
 optional_policy(`
 	unconfined_domain(apt_t)
 ')
+
+optional_policy(`
+	deepin_package_manage_domain_set(apt_t)
+	deepin_security_verify_domtrans(apt_t)
+	deepin_executable_file_type_set(apt_t)
+	deepin_access_security_server(apt, true)
+')
Index: refpolicy-deepin/policy/modules/admin/apt.te.orig
===================================================================
--- /dev/null
+++ refpolicy-deepin/policy/modules/admin/apt.te.orig
@@ -0,0 +1,194 @@
+policy_module(apt)
+
+########################################
+#
+# Declarations
+#
+
+attribute_role apt_roles;
+
+type apt_t;
+type apt_exec_t;
+init_system_domain(apt_t, apt_exec_t)
+domain_system_change_exemption(apt_t)
+role apt_roles types apt_t;
+
+type apt_devpts_t;
+term_pty(apt_devpts_t)
+
+type apt_lock_t;
+files_lock_file(apt_lock_t)
+
+type apt_tmp_t;
+files_tmp_file(apt_tmp_t)
+
+type apt_tmpfs_t;
+files_tmpfs_file(apt_tmpfs_t)
+
+type apt_var_cache_t;
+files_type(apt_var_cache_t)
+
+type apt_var_lib_t;
+files_type(apt_var_lib_t)
+
+type apt_var_log_t;
+logging_log_file(apt_var_log_t)
+
+########################################
+#
+# Local policy
+#
+
+allow apt_t self:capability { chown dac_override dac_read_search fowner fsetid kill setgid setuid };
+dontaudit apt_t self:capability net_admin;
+allow apt_t self:process { fork setpgid signal getsched };
+allow apt_t self:fd use;
+allow apt_t self:fifo_file rw_fifo_file_perms;
+allow apt_t self:unix_dgram_socket sendto;
+allow apt_t self:unix_stream_socket { accept connectto listen };
+allow apt_t self:udp_socket { connect create_socket_perms };
+allow apt_t self:tcp_socket create_stream_socket_perms;
+allow apt_t self:shm create_shm_perms;
+allow apt_t self:sem create_sem_perms;
+allow apt_t self:msgq create_msgq_perms;
+allow apt_t self:msg { receive send };
+allow apt_t self:netlink_route_socket r_netlink_socket_perms;
+
+allow apt_t apt_lock_t:dir manage_dir_perms;
+allow apt_t apt_lock_t:file manage_file_perms;
+files_lock_filetrans(apt_t, apt_lock_t, { dir file })
+
+manage_dirs_pattern(apt_t, apt_tmp_t, apt_tmp_t)
+manage_files_pattern(apt_t, apt_tmp_t, apt_tmp_t)
+manage_lnk_files_pattern(apt_t, apt_tmp_t, apt_tmp_t)
+files_tmp_filetrans(apt_t, apt_tmp_t, { file dir })
+allow apt_t apt_tmp_t:file { relabelfrom relabelto };
+
+manage_dirs_pattern(apt_t, apt_tmpfs_t, apt_tmpfs_t)
+manage_files_pattern(apt_t, apt_tmpfs_t, apt_tmpfs_t)
+manage_lnk_files_pattern(apt_t, apt_tmpfs_t, apt_tmpfs_t)
+manage_fifo_files_pattern(apt_t, apt_tmpfs_t, apt_tmpfs_t)
+manage_sock_files_pattern(apt_t, apt_tmpfs_t, apt_tmpfs_t)
+fs_tmpfs_filetrans(apt_t, apt_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+
+manage_files_pattern(apt_t, apt_var_cache_t, apt_var_cache_t)
+manage_dirs_pattern(apt_t, apt_var_cache_t, apt_var_cache_t)
+files_var_filetrans(apt_t, apt_var_cache_t, dir)
+allow apt_t apt_var_cache_t:file map;
+
+manage_files_pattern(apt_t, apt_var_lib_t, apt_var_lib_t)
+files_var_lib_filetrans(apt_t, apt_var_lib_t, dir)
+allow apt_t apt_var_lib_t:dir setattr;
+manage_lnk_files_pattern(apt_t, apt_var_lib_t, apt_var_lib_t)
+
+allow apt_t apt_var_log_t:file manage_file_perms;
+allow apt_t apt_var_log_t:dir manage_dir_perms;
+logging_log_filetrans(apt_t, apt_var_log_t, file)
+
+can_exec(apt_t, apt_exec_t)
+
+kernel_read_system_state(apt_t)
+kernel_read_kernel_sysctls(apt_t)
+
+corecmd_exec_bin(apt_t)
+corecmd_exec_shell(apt_t)
+
+corenet_all_recvfrom_netlabel(apt_t)
+corenet_tcp_sendrecv_generic_if(apt_t)
+corenet_tcp_sendrecv_generic_node(apt_t)
+
+corenet_sendrecv_all_client_packets(apt_t)
+corenet_tcp_connect_all_ports(apt_t)
+
+dev_list_sysfs(apt_t)
+dev_read_urand(apt_t)
+
+domain_getattr_all_domains(apt_t)
+domain_use_interactive_fds(apt_t)
+
+files_exec_usr_files(apt_t)
+files_list_boot(apt_t)
+files_read_etc_files(apt_t)
+files_read_etc_runtime_files(apt_t)
+
+fs_getattr_all_fs(apt_t)
+
+init_get_system_status(apt_t)
+init_read_state(apt_t)
+
+term_create_pty(apt_t, apt_devpts_t)
+term_list_ptys(apt_t)
+term_use_all_terms(apt_t)
+
+libs_exec_ld_so(apt_t)
+libs_exec_lib_files(apt_t)
+
+logging_send_syslog_msg(apt_t)
+
+miscfiles_read_localization(apt_t)
+
+seutil_use_newrole_fds(apt_t)
+
+sysnet_read_config(apt_t)
+
+userdom_use_user_terminals(apt_t)
+
+optional_policy(`
+	backup_manage_store_files(apt_t)
+')
+
+optional_policy(`
+	cron_system_entry(apt_t, apt_exec_t)
+')
+
+optional_policy(`
+	dbus_system_domain(apt_t, apt_exec_t)
+
+	optional_policy(`
+		# for packagekitd
+		policykit_dbus_chat(apt_t)
+	')
+
+	optional_policy(`
+		systemd_dbus_chat_logind(apt_t)
+		systemd_use_logind_fds(apt_t)
+		systemd_write_inherited_logind_inhibit_pipes(apt_t)
+	')
+
+	optional_policy(`
+		unconfined_dbus_send(apt_t)
+	')
+')
+
+optional_policy(`
+	dpkg_read_db(apt_t)
+	dpkg_nnp_domtrans(apt_t)
+	dpkg_lock_db(apt_t)
+')
+
+optional_policy(`
+	networkmanager_dbus_chat(apt_t)
+	networkmanager_status(apt_t)
+')
+
+optional_policy(`
+	nis_use_ypbind(apt_t)
+')
+
+optional_policy(`
+	# rkhunter trigger
+	rkhunter_domtrans(apt_t)
+')
+
+optional_policy(`
+	rpm_read_db(apt_t)
+	rpm_domtrans(apt_t)
+')
+
+optional_policy(`
+	systemd_status_networkd(apt_t)
+')
+
+optional_policy(`
+	unconfined_domain(apt_t)
+')
Index: refpolicy-deepin/policy/modules/admin/dpkg.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/admin/dpkg.te
+++ refpolicy-deepin/policy/modules/admin/dpkg.te
@@ -199,6 +199,17 @@ optional_policy(`
 	usermanage_run_useradd(dpkg_t, dpkg_roles)
 ')
 
+optional_policy(`
+	deepin_package_manage_domain_set(dpkg_t)
+	deepin_security_verify_domtrans(dpkg_t)
+')
+
+optional_policy(`
+	deepin_access_security_server(dpkg, true)
+	deepin_executable_file_type_set(dpkg_t)
+	allow dpkg_t self:file *;
+')
+
 ########################################
 #
 # Script Local policy
@@ -392,3 +403,8 @@ optional_policy(`
 	usermanage_run_groupadd(dpkg_script_t, dpkg_roles)
 	usermanage_run_useradd(dpkg_script_t, dpkg_roles)
 ')
+
+optional_policy(`
+	deepin_package_manage_domain_set(dpkg_script_t)
+	deepin_security_verify_domtrans(dpkg_script_t)
+')
Index: refpolicy-deepin/policy/modules/admin/dpkg.te.orig
===================================================================
--- /dev/null
+++ refpolicy-deepin/policy/modules/admin/dpkg.te.orig
@@ -0,0 +1,394 @@
+policy_module(dpkg)
+
+########################################
+#
+# Declarations
+#
+
+attribute_role dpkg_roles;
+roleattribute system_r dpkg_roles;
+
+type dpkg_t;
+type dpkg_exec_t;
+init_system_domain(dpkg_t, dpkg_exec_t)
+domain_obj_id_change_exemption(dpkg_t)
+domain_role_change_exemption(dpkg_t)
+domain_system_change_exemption(dpkg_t)
+domain_interactive_fd(dpkg_t)
+role dpkg_roles types dpkg_t;
+
+type dpkg_lock_t;
+files_lock_file(dpkg_lock_t)
+
+type dpkg_tmp_t;
+files_tmp_file(dpkg_tmp_t)
+
+type dpkg_tmpfs_t;
+files_tmpfs_file(dpkg_tmpfs_t)
+
+type dpkg_var_lib_t;
+files_type(dpkg_var_lib_t)
+
+type dpkg_script_t;
+application_type(dpkg_script_t)
+domain_entry_file(dpkg_t, dpkg_var_lib_t)
+domain_entry_file(dpkg_script_t, dpkg_var_lib_t)
+corecmd_shell_entry_type(dpkg_script_t)
+corecmd_bin_entry_type(dpkg_script_t)
+domain_obj_id_change_exemption(dpkg_script_t)
+domain_system_change_exemption(dpkg_script_t)
+domain_interactive_fd(dpkg_script_t)
+role dpkg_roles types dpkg_script_t;
+
+type dpkg_script_tmp_t;
+files_tmp_file(dpkg_script_tmp_t)
+# out of order to work around compiler issue
+domain_entry_file(dpkg_script_t, dpkg_script_tmp_t)
+
+type dpkg_script_tmpfs_t;
+files_tmpfs_file(dpkg_script_tmpfs_t)
+
+########################################
+#
+# Local policy
+#
+
+allow dpkg_t self:capability { chown dac_override fowner fsetid kill linux_immutable mknod setgid setuid sys_nice sys_resource sys_tty_config };
+allow dpkg_t self:process { fork getsched setfscreate setpgid };
+allow dpkg_t self:fd use;
+allow dpkg_t self:fifo_file rw_fifo_file_perms;
+allow dpkg_t self:unix_dgram_socket create_socket_perms;
+allow dpkg_t self:unix_stream_socket rw_stream_socket_perms;
+allow dpkg_t self:unix_dgram_socket sendto;
+allow dpkg_t self:unix_stream_socket connectto;
+allow dpkg_t self:udp_socket { connect create_socket_perms };
+allow dpkg_t self:tcp_socket create_stream_socket_perms;
+allow dpkg_t self:shm create_shm_perms;
+allow dpkg_t self:sem create_sem_perms;
+allow dpkg_t self:msgq create_msgq_perms;
+allow dpkg_t self:msg { receive send };
+
+allow dpkg_t dpkg_lock_t:file manage_file_perms;
+
+spec_domtrans_pattern(dpkg_t, dpkg_var_lib_t, dpkg_script_t)
+spec_domtrans_pattern(dpkg_t, dpkg_script_tmp_t, dpkg_script_t)
+
+manage_dirs_pattern(dpkg_t, dpkg_tmp_t, dpkg_tmp_t)
+manage_files_pattern(dpkg_t, dpkg_tmp_t, dpkg_tmp_t)
+files_tmp_filetrans(dpkg_t, dpkg_tmp_t, { file dir })
+
+manage_dirs_pattern(dpkg_t, dpkg_tmpfs_t, dpkg_tmpfs_t)
+manage_files_pattern(dpkg_t, dpkg_tmpfs_t, dpkg_tmpfs_t)
+manage_lnk_files_pattern(dpkg_t, dpkg_tmpfs_t, dpkg_tmpfs_t)
+manage_sock_files_pattern(dpkg_t, dpkg_tmpfs_t, dpkg_tmpfs_t)
+manage_fifo_files_pattern(dpkg_t, dpkg_tmpfs_t, dpkg_tmpfs_t)
+fs_tmpfs_filetrans(dpkg_t, dpkg_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+
+allow dpkg_t dpkg_var_lib_t:file mmap_exec_file_perms;
+manage_files_pattern(dpkg_t, dpkg_var_lib_t, dpkg_var_lib_t)
+files_var_lib_filetrans(dpkg_t, dpkg_var_lib_t, dir)
+
+kernel_read_system_state(dpkg_t)
+kernel_read_kernel_sysctls(dpkg_t)
+
+corecmd_bin_domtrans(dpkg_t, dpkg_script_t)
+
+corenet_all_recvfrom_netlabel(dpkg_t)
+corenet_tcp_sendrecv_generic_if(dpkg_t)
+corenet_tcp_sendrecv_generic_node(dpkg_t)
+
+corenet_sendrecv_all_client_packets(dpkg_t)
+corenet_tcp_connect_all_ports(dpkg_t)
+
+dev_list_sysfs(dpkg_t)
+dev_list_usbfs(dpkg_t)
+dev_read_urand(dpkg_t)
+
+domain_read_all_domains_state(dpkg_t)
+domain_getattr_all_domains(dpkg_t)
+domain_dontaudit_ptrace_all_domains(dpkg_t)
+domain_use_interactive_fds(dpkg_t)
+domain_dontaudit_getattr_all_pipes(dpkg_t)
+domain_dontaudit_getattr_all_tcp_sockets(dpkg_t)
+domain_dontaudit_getattr_all_udp_sockets(dpkg_t)
+domain_dontaudit_getattr_all_packet_sockets(dpkg_t)
+domain_dontaudit_getattr_all_raw_sockets(dpkg_t)
+domain_dontaudit_getattr_all_stream_sockets(dpkg_t)
+domain_dontaudit_getattr_all_dgram_sockets(dpkg_t)
+
+files_exec_etc_files(dpkg_t)
+files_relabel_non_auth_files(dpkg_t)
+files_manage_non_auth_files(dpkg_t)
+
+fs_manage_nfs_dirs(dpkg_t)
+fs_manage_nfs_files(dpkg_t)
+fs_manage_nfs_symlinks(dpkg_t)
+fs_getattr_all_fs(dpkg_t)
+fs_search_auto_mountpoints(dpkg_t)
+
+mls_file_read_all_levels(dpkg_t)
+mls_file_write_all_levels(dpkg_t)
+mls_file_upgrade(dpkg_t)
+
+selinux_get_fs_mount(dpkg_t)
+selinux_validate_context(dpkg_t)
+selinux_compute_access_vector(dpkg_t)
+selinux_compute_create_context(dpkg_t)
+selinux_compute_relabel_context(dpkg_t)
+selinux_compute_user_contexts(dpkg_t)
+
+storage_raw_write_fixed_disk(dpkg_t)
+storage_raw_read_fixed_disk(dpkg_t)
+
+auth_dontaudit_read_shadow(dpkg_t)
+
+init_all_labeled_script_domtrans(dpkg_t)
+init_use_script_ptys(dpkg_t)
+
+libs_exec_ld_so(dpkg_t)
+libs_exec_lib_files(dpkg_t)
+libs_run_ldconfig(dpkg_t, dpkg_roles)
+
+logging_send_syslog_msg(dpkg_t)
+
+miscfiles_read_localization(dpkg_t)
+selinux_use_status_page(dpkg_t)
+seutil_read_file_contexts(dpkg_t)
+
+seutil_manage_src_policy(dpkg_t)
+seutil_manage_bin_policy(dpkg_t)
+
+sysnet_read_config(dpkg_t)
+
+userdom_use_user_terminals(dpkg_t)
+userdom_use_unpriv_users_fds(dpkg_t)
+userdom_use_all_users_fds(dpkg_t)
+
+dpkg_domtrans_script(dpkg_t)
+
+optional_policy(`
+	apt_use_ptys(dpkg_t)
+')
+
+optional_policy(`
+	backup_manage_store_files(dpkg_t)
+')
+
+optional_policy(`
+	cron_system_entry(dpkg_t, dpkg_exec_t)
+')
+
+optional_policy(`
+	nis_use_ypbind(dpkg_t)
+')
+
+optional_policy(`
+	unconfined_domain(dpkg_t)
+')
+
+optional_policy(`
+	modutils_run(dpkg_t, dpkg_roles)
+')
+
+optional_policy(`
+	mta_send_mail(dpkg_t)
+')
+
+optional_policy(`
+	usermanage_run_groupadd(dpkg_t, dpkg_roles)
+	usermanage_run_useradd(dpkg_t, dpkg_roles)
+')
+
+########################################
+#
+# Script Local policy
+#
+
+allow dpkg_script_t self:capability { audit_write chown dac_override dac_read_search fowner fsetid ipc_lock kill mknod net_admin setfcap setgid setuid sys_chroot sys_nice sys_resource sys_ptrace };
+allow dpkg_script_t self:process { dyntransition getattr getcap getpgid getrlimit getsched getsession noatsecure rlimitinh setcap setfscreate setkeycreate setpgid setsched setsockcreate share siginh signal_perms transition setrlimit };
+allow dpkg_script_t self:fd use;
+allow dpkg_script_t self:fifo_file rw_fifo_file_perms;
+allow dpkg_script_t self:unix_dgram_socket create_socket_perms;
+allow dpkg_script_t self:unix_stream_socket rw_stream_socket_perms;
+allow dpkg_script_t self:unix_dgram_socket sendto;
+allow dpkg_script_t self:unix_stream_socket connectto;
+allow dpkg_script_t self:shm create_shm_perms;
+allow dpkg_script_t self:sem create_sem_perms;
+allow dpkg_script_t self:msgq create_msgq_perms;
+allow dpkg_script_t self:msg { receive send };
+allow dpkg_script_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
+allow dpkg_script_t self:udp_socket create_socket_perms;
+
+allow dpkg_script_t dpkg_tmp_t:file read_file_perms;
+
+allow dpkg_script_t dpkg_script_tmp_t:dir { manage_dir_perms mounton };
+allow dpkg_script_t dpkg_script_tmp_t:file manage_file_perms;
+files_tmp_filetrans(dpkg_script_t, dpkg_script_tmp_t, { file dir })
+
+allow dpkg_script_t dpkg_script_tmpfs_t:dir manage_dir_perms;
+allow dpkg_script_t dpkg_script_tmpfs_t:file manage_file_perms;
+allow dpkg_script_t dpkg_script_tmpfs_t:lnk_file manage_lnk_file_perms;
+allow dpkg_script_t dpkg_script_tmpfs_t:sock_file manage_sock_file_perms;
+allow dpkg_script_t dpkg_script_tmpfs_t:fifo_file manage_fifo_file_perms;
+fs_tmpfs_filetrans(dpkg_script_t, dpkg_script_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+
+kernel_getattr_proc(dpkg_script_t)
+kernel_read_kernel_sysctls(dpkg_script_t)
+kernel_read_system_state(dpkg_script_t)
+
+corecmd_exec_all_executables(dpkg_script_t)
+
+dev_list_sysfs(dpkg_script_t)
+dev_getattr_fs(dpkg_script_t)
+# Use named file transition to fix this
+# dev_manage_generic_blk_files(dpkg_script_t)
+# dev_manage_generic_chr_files(dpkg_script_t)
+dev_manage_all_blk_files(dpkg_script_t)
+dev_manage_all_chr_files(dpkg_script_t)
+
+domain_read_all_domains_state(dpkg_script_t)
+domain_getattr_all_domains(dpkg_script_t)
+domain_dontaudit_ptrace_all_domains(dpkg_script_t)
+domain_use_interactive_fds(dpkg_script_t)
+domain_signal_all_domains(dpkg_script_t)
+domain_signull_all_domains(dpkg_script_t)
+
+files_exec_etc_files(dpkg_script_t)
+files_read_etc_runtime_files(dpkg_script_t)
+files_exec_usr_files(dpkg_script_t)
+files_relabel_non_auth_files(dpkg_script_t)
+
+fs_manage_nfs_files(dpkg_script_t)
+fs_getattr_nfs(dpkg_script_t)
+fs_getattr_tmpfs(dpkg_script_t)
+fs_getattr_xattr_fs(dpkg_script_t)
+fs_mount_xattr_fs(dpkg_script_t)
+fs_unmount_xattr_fs(dpkg_script_t)
+fs_search_auto_mountpoints(dpkg_script_t)
+
+mls_file_read_all_levels(dpkg_script_t)
+mls_file_write_all_levels(dpkg_script_t)
+
+selinux_get_fs_mount(dpkg_script_t)
+selinux_validate_context(dpkg_script_t)
+selinux_compute_access_vector(dpkg_script_t)
+selinux_compute_create_context(dpkg_script_t)
+selinux_compute_relabel_context(dpkg_script_t)
+selinux_compute_user_contexts(dpkg_script_t)
+selinux_read_policy(dpkg_script_t)
+
+storage_raw_read_fixed_disk(dpkg_script_t)
+storage_raw_write_fixed_disk(dpkg_script_t)
+
+term_use_all_terms(dpkg_script_t)
+
+files_manage_non_auth_files(dpkg_script_t)
+
+auth_etc_filetrans_shadow(dpkg_script_t, "shadow.upwd-write")
+auth_manage_shadow(dpkg_script_t)
+
+init_all_labeled_script_domtrans(dpkg_script_t)
+init_use_script_fds(dpkg_script_t)
+init_manage_script_service(dpkg_script_t)
+init_startstop_all_script_services(dpkg_script_t)
+init_admin(dpkg_script_t)
+
+libs_exec_ld_so(dpkg_script_t)
+libs_exec_lib_files(dpkg_script_t)
+libs_run_ldconfig(dpkg_script_t, dpkg_roles)
+
+logging_send_syslog_msg(dpkg_script_t)
+
+miscfiles_map_man_cache(dpkg_script_t)
+miscfiles_read_fonts(dpkg_script_t)
+miscfiles_read_localization(dpkg_script_t)
+
+seutil_run_loadpolicy(dpkg_script_t, dpkg_roles)
+seutil_run_setfiles(dpkg_script_t, dpkg_roles)
+
+selinux_use_status_page(dpkg_script_t)
+seutil_read_file_contexts(dpkg_script_t)
+
+userdom_use_all_users_fds(dpkg_script_t)
+
+tunable_policy(`allow_execmem',`
+	allow dpkg_script_t self:process execmem;
+')
+
+optional_policy(`
+	apt_read_cache(dpkg_script_t)
+	apt_rw_pipes(dpkg_script_t)
+	apt_use_fds(dpkg_script_t)
+')
+
+optional_policy(`
+	aptcacher_filetrans_cache_dir(dpkg_script_t)
+	aptcacher_etc_filetrans_conf_dir(dpkg_script_t)
+	aptcacher_filetrans_log_dir(dpkg_script_t)
+')
+
+optional_policy(`
+	bootloader_run(dpkg_script_t, dpkg_roles)
+')
+
+optional_policy(`
+	clamav_filetrans_log(dpkg_script_t)
+')
+
+optional_policy(`
+	dbus_system_bus_client(dpkg_script_t)
+')
+
+optional_policy(`
+	devicekit_dbus_chat_power(dpkg_script_t)
+')
+
+optional_policy(`
+	init_dbus_chat(dpkg_script_t)
+')
+
+optional_policy(`
+	milter_var_lib_filetrans_spamass_state(dpkg_script_t)
+')
+
+optional_policy(`
+	modutils_run(dpkg_script_t, dpkg_roles)
+')
+
+optional_policy(`
+	mta_send_mail(dpkg_script_t)
+')
+
+optional_policy(`
+	mysql_var_lib_filetrans_db_dir(dpkg_script_t)
+	mysql_log_filetrans_log_dir(dpkg_script_t)
+')
+
+optional_policy(`
+	nis_use_ypbind(dpkg_script_t)
+')
+
+optional_policy(`
+	ntp_filetrans_drift(dpkg_script_t)
+')
+
+optional_policy(`
+	policykit_dbus_chat(dpkg_script_t)
+')
+
+optional_policy(`
+	systemd_read_logind_state(dpkg_script_t)
+	systemd_dbus_chat_hostnamed(dpkg_script_t)
+	systemd_dbus_chat_logind(dpkg_script_t)
+	systemd_run_sysusers(dpkg_script_t, dpkg_roles)
+	systemd_watch_passwd_runtime_dirs(dpkg_script_t)
+')
+
+optional_policy(`
+	unconfined_domain(dpkg_script_t)
+')
+
+optional_policy(`
+	usermanage_run_groupadd(dpkg_script_t, dpkg_roles)
+	usermanage_run_useradd(dpkg_script_t, dpkg_roles)
+')
Index: refpolicy-deepin/policy/modules/kernel/devices.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/kernel/devices.te
+++ refpolicy-deepin/policy/modules/kernel/devices.te
@@ -205,8 +205,8 @@ dev_node(mei_device_t)
 type memory_device_t;
 dev_node(memory_device_t)
 
-neverallow ~{ memory_raw_read devices_unconfined_type } memory_device_t:{ chr_file blk_file } read;
-neverallow ~{ memory_raw_write devices_unconfined_type } memory_device_t:{ chr_file blk_file } { append write };
+#(zzl) neverallow~{ memory_raw_read devices_unconfined_type } memory_device_t:{ chr_file blk_file } read;
+#(zzl) neverallow~{ memory_raw_write devices_unconfined_type } memory_device_t:{ chr_file blk_file } { append write };
 
 type misc_device_t;
 dev_node(misc_device_t)
Index: refpolicy-deepin/policy/modules/kernel/domain.if
===================================================================
--- refpolicy-deepin.orig/policy/modules/kernel/domain.if
+++ refpolicy-deepin/policy/modules/kernel/domain.if
@@ -525,9 +525,10 @@ interface(`domain_signull_all_domains',`
 interface(`domain_sigstop_all_domains',`
 	gen_require(`
 		attribute domain;
+		attribute unkillable_domain;
 	')
 
-	allow $1 domain:process sigstop;
+	allow $1 { domain -unkillable_domain }:process sigstop;
 ')
 
 ########################################
@@ -563,9 +564,10 @@ interface(`domain_sigchld_all_domains',`
 interface(`domain_kill_all_domains',`
 	gen_require(`
 		attribute domain;
+		attribute unkillable_domain;
 	')
 
-	allow $1 domain:process sigkill;
+	allow $1 { domain -unkillable_domain }:process sigkill;
 	allow $1 self:capability kill;
 ')
 
@@ -1556,3 +1558,21 @@ interface(`domain_unconfined',`
 	typeattribute $1 set_curr_context;
 	typeattribute $1 process_uncond_exempt;
 ')
+
+########################################
+## <summary>
+##	Let domain to be unkillable.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain unkillable.
+##	</summary>
+## </param>
+#
+interface(`domain_unkillable',`
+	gen_require(`
+		attribute unkillable_domain;
+	')
+
+	typeattribute $1 unkillable_domain;
+')
\ No newline at end of file
Index: refpolicy-deepin/policy/modules/kernel/domain.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/kernel/domain.te
+++ refpolicy-deepin/policy/modules/kernel/domain.te
@@ -17,14 +17,14 @@ gen_tunable(mmap_low_allowed, false)
 attribute domain;
 
 # Transitions only allowed from domains to other domains
-neverallow domain ~domain:process { dyntransition transition };
+#(zzl) neverallowdomain ~domain:process { dyntransition transition };
 
 # Domains that are unconfined
 attribute unconfined_domain_type;
 
 # Domains that can mmap low memory.
 attribute mmap_low_domain_type;
-neverallow { domain -mmap_low_domain_type } self:memprotect mmap_zero;
+#(zzl) neverallow{ domain -mmap_low_domain_type } self:memprotect mmap_zero;
 
 # Domains that can set their current context
 # (perform dynamic transitions)
@@ -33,10 +33,10 @@ attribute set_curr_context;
 # enabling setcurrent breaks process tranquility.  If you do not
 # know what this means or do not understand the implications of a
 # dynamic transition, you should not be using it!!!
-neverallow { domain -set_curr_context } self:process setcurrent;
+#(zzl) neverallow{ domain -set_curr_context } self:process setcurrent;
 
 # No domain needs mac_override as it is unused by SELinux.
-neverallow domain self:capability2 mac_override;
+#(zzl) neverallowdomain self:capability2 mac_override;
 
 # entrypoint executables
 attribute entry_type;
@@ -81,8 +81,19 @@ gen_require(`  #selint-disable:S-001
 	type unlabeled_t;
 ')
 
-neverallow { domain unlabeled_t } ~{ domain unlabeled_t }:process *;
-neverallow ~{ domain unlabeled_t } *:process *;
+# [8] types that can change to deepin_r
+attribute deepin_app_domain;
+attribute deepin_sys_domain;
+attribute deepin_sec_domain;
+attribute deepin_security_server_domain;
+attribute deepin_security_server_sidtwo_domain;
+attribute deepin_package_manage_domain;
+
+#(zzl) neverallow{ domain unlabeled_t } ~{ domain unlabeled_t }:process *;
+#(zzl) neverallow~{ domain unlabeled_t } *:process *;
+
+
+attribute unkillable_domain;
 
 ########################################
 #
@@ -206,3 +217,8 @@ allow unconfined_domain_type domain:key
 
 # receive from all domains over labeled networking
 domain_all_recvfrom_all_domains(unconfined_domain_type)
+
+# for start deepin_elf_verify program
+optional_policy(`
+	deepin_read_elf_verify(domain)
+')
Index: refpolicy-deepin/policy/modules/kernel/files.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/kernel/files.te
+++ refpolicy-deepin/policy/modules/kernel/files.te
@@ -13,6 +13,18 @@ attribute pidfile;
 attribute configfile;
 attribute spoolfile;
 
+# For deepin permission manager
+attribute deepin_sidtwo_type;
+attribute deepin_file_type;
+attribute deepin_readable_file_type;
+attribute deepin_writable_file_type;
+attribute deepin_deletable_file_type;
+attribute deepin_executable_file_type;
+attribute deepin_usaudit_type;
+attribute deepin_usaudit_process_type;
+attribute deepin_usaudit_socket_type;
+attribute deepin_usaudit_file_type;
+
 # For labeling types that are to be polyinstantiated
 attribute polydir;
 
Index: refpolicy-deepin/policy/modules/kernel/kernel.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/kernel/kernel.te
+++ refpolicy-deepin/policy/modules/kernel/kernel.te
@@ -17,7 +17,7 @@ attribute can_load_kernmodule;
 attribute can_receive_kernel_messages;
 attribute can_dump_kernel;
 
-neverallow ~can_load_kernmodule self:capability sys_module;
+#(zzl) neverallow~can_load_kernmodule self:capability sys_module;
 
 # domains with unconfined access to kernel resources
 attribute kern_unconfined;
@@ -88,7 +88,7 @@ genfscon proc /fs/openafs gen_context(sy
 # kernel message interface
 type proc_kmsg_t, proc_type;
 genfscon proc /kmsg gen_context(system_u:object_r:proc_kmsg_t,mls_systemhigh)
-neverallow ~{ can_receive_kernel_messages kern_unconfined } proc_kmsg_t:file read;
+#(zzl) neverallow~{ can_receive_kernel_messages kern_unconfined } proc_kmsg_t:file read;
 
 optional_policy(`
 	init_mountpoint(proc_kmsg_t)
@@ -96,7 +96,7 @@ optional_policy(`
 
 # /proc kcore: inaccessible
 type proc_kcore_t, proc_type;
-neverallow ~{ can_dump_kernel kern_unconfined } proc_kcore_t:file ~{ getattr mounton };
+#(zzl) neverallow~{ can_dump_kernel kern_unconfined } proc_kcore_t:file ~{ getattr mounton };
 genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,mls_systemhigh)
 
 optional_policy(`
@@ -212,14 +212,14 @@ kernel_rootfs_mountpoint(unlabeled_t)
 fs_associate(unlabeled_t)
 sid file gen_context(system_u:object_r:unlabeled_t,s0)
 sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
-neverallow * unlabeled_t:file entrypoint;
+#(zzl) neverallow* unlabeled_t:file entrypoint;
 
 # These initial sids are no longer used, and can be removed:
 sid any_socket		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 sid file_labels		gen_context(system_u:object_r:unlabeled_t,s0)
 sid icmp_socket		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 sid igmp_packet		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
-sid init		gen_context(system_u:object_r:unlabeled_t,s0)
+sid init		gen_context(system_u:system_r:init_t,s0)
 sid kmod		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 sid policy		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 sid scmp_packet		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
@@ -361,6 +361,12 @@ corecmd_exec_bin(kernel_t)
 domain_signal_all_domains(kernel_t)
 domain_search_all_domains_state(kernel_t)
 
+# for start deepin_elf_verify program
+optional_policy(`
+    deepin_elfverify_entry_type(kernel_t)
+    deepin_exec_elf_verify(kernel_t)
+')
+
 files_getattr_rootfs(kernel_t)
 files_manage_root_dir(kernel_t)
 files_delete_root_files(kernel_t)
Index: refpolicy-deepin/policy/modules/kernel/kernel.te.orig
===================================================================
--- /dev/null
+++ refpolicy-deepin/policy/modules/kernel/kernel.te.orig
@@ -0,0 +1,602 @@
+policy_module(kernel)
+
+########################################
+#
+# Declarations
+#
+
+## <desc>
+## <p>
+## Disable kernel module loading.
+## </p>
+## </desc>
+gen_bool(secure_mode_insmod, false)
+
+# assertion related attributes
+attribute can_load_kernmodule;
+attribute can_receive_kernel_messages;
+attribute can_dump_kernel;
+
+neverallow ~can_load_kernmodule self:capability sys_module;
+
+# domains with unconfined access to kernel resources
+attribute kern_unconfined;
+
+# regular entries in proc
+attribute proc_type;
+
+# sysctls
+attribute sysctl_type;
+
+role system_r;
+role sysadm_r;
+role staff_r;
+role user_r;
+
+# here until order dependence is fixed:
+role unconfined_r;
+
+ifdef(`enable_mls',`
+	role secadm_r;
+	role auditadm_r;
+')
+
+#
+# kernel_t is the domain of kernel threads.
+# It is also the target type when checking permissions in the system class.
+#
+type kernel_t, can_load_kernmodule;
+domain_base_type(kernel_t)
+role system_r types kernel_t;
+sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
+
+#
+# DebugFS
+#
+
+type debugfs_t;
+files_mountpoint(debugfs_t)
+fs_type(debugfs_t)
+allow debugfs_t self:filesystem associate;
+genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0)
+
+#
+# kvmFS
+#
+
+type kvmfs_t;
+fs_type(kvmfs_t)
+genfscon kvmfs / gen_context(system_u:object_r:kvmfs_t,s0)
+
+#
+# Procfs types
+#
+
+type proc_t, proc_type;
+files_mountpoint(proc_t)
+fs_type(proc_t)
+genfscon proc / gen_context(system_u:object_r:proc_t,s0)
+genfscon proc /sysvipc gen_context(system_u:object_r:proc_t,s0)
+
+optional_policy(`
+	container_mountpoint(proc_t)
+')
+
+type proc_afs_t, proc_type;
+genfscon proc /fs/openafs gen_context(system_u:object_r:proc_afs_t,s0)
+
+# kernel message interface
+type proc_kmsg_t, proc_type;
+genfscon proc /kmsg gen_context(system_u:object_r:proc_kmsg_t,mls_systemhigh)
+neverallow ~{ can_receive_kernel_messages kern_unconfined } proc_kmsg_t:file read;
+
+optional_policy(`
+	init_mountpoint(proc_kmsg_t)
+')
+
+# /proc kcore: inaccessible
+type proc_kcore_t, proc_type;
+neverallow ~{ can_dump_kernel kern_unconfined } proc_kcore_t:file ~{ getattr mounton };
+genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,mls_systemhigh)
+
+optional_policy(`
+	container_mountpoint(proc_kcore_t)
+')
+
+optional_policy(`
+	init_mountpoint(proc_kcore_t)
+')
+
+type proc_mdstat_t, proc_type;
+genfscon proc /mdstat gen_context(system_u:object_r:proc_mdstat_t,s0)
+
+type proc_net_t, proc_type;
+genfscon proc /net gen_context(system_u:object_r:proc_net_t,s0)
+
+type proc_psi_t, proc_type;
+genfscon proc /pressure gen_context(system_u:object_r:proc_psi_t,s0)
+
+type proc_xen_t, proc_type;
+files_mountpoint(proc_xen_t)
+genfscon proc /xen gen_context(system_u:object_r:proc_xen_t,s0)
+
+#
+# Sysctl types
+#
+
+# /proc/sys directory, base directory of sysctls
+type sysctl_t, sysctl_type;
+files_mountpoint(sysctl_t)
+sid sysctl gen_context(system_u:object_r:sysctl_t,s0)
+genfscon proc /sys gen_context(system_u:object_r:sysctl_t,s0)
+
+optional_policy(`
+	container_mountpoint(sysctl_t)
+')
+
+# /proc/irq directory and files
+type sysctl_irq_t, sysctl_type;
+genfscon proc /irq gen_context(system_u:object_r:sysctl_irq_t,s0)
+
+optional_policy(`
+	init_mountpoint(sysctl_irq_t)
+')
+
+optional_policy(`
+	container_mountpoint(sysctl_irq_t)
+')
+
+# /proc/net/rpc directory and files
+type sysctl_rpc_t, sysctl_type;
+genfscon proc /net/rpc gen_context(system_u:object_r:sysctl_rpc_t,s0)
+
+# /proc/sys/crypto directory and files
+type sysctl_crypto_t, sysctl_type;
+genfscon proc /sys/crypto gen_context(system_u:object_r:sysctl_crypto_t,s0)
+
+# /proc/sys/fs directory and files
+type sysctl_fs_t, sysctl_type;
+files_mountpoint(sysctl_fs_t)
+genfscon proc /sys/fs gen_context(system_u:object_r:sysctl_fs_t,s0)
+
+# /proc/sys/kernel directory and files
+type sysctl_kernel_t, sysctl_type;
+genfscon proc /sys/kernel gen_context(system_u:object_r:sysctl_kernel_t,s0)
+
+optional_policy(`
+	init_mountpoint(sysctl_kernel_t)
+')
+
+# /sys/kernel/ns_last_pid file
+type sysctl_kernel_ns_last_pid_t, sysctl_type;
+genfscon proc /sys/kernel/ns_last_pid gen_context(system_u:object_r:sysctl_kernel_ns_last_pid_t,s0)
+
+# /proc/sys/kernel/modprobe file
+type sysctl_modprobe_t, sysctl_type;
+genfscon proc /sys/kernel/modprobe gen_context(system_u:object_r:sysctl_modprobe_t,s0)
+
+# /proc/sys/kernel/hotplug file
+type sysctl_hotplug_t, sysctl_type;
+genfscon proc /sys/kernel/hotplug gen_context(system_u:object_r:sysctl_hotplug_t,s0)
+
+# /proc/sys/net directory and files
+type sysctl_net_t, sysctl_type;
+genfscon proc /sys/net gen_context(system_u:object_r:sysctl_net_t,s0)
+
+# /proc/sys/net/unix directory and files
+type sysctl_net_unix_t, sysctl_type;
+genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0)
+
+# /proc/sys/vm directory and files
+type sysctl_vm_t, sysctl_type;
+genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0)
+
+type sysctl_vm_overcommit_t, sysctl_type;
+genfscon proc /sys/vm/overcommit_memory gen_context(system_u:object_r:sysctl_vm_overcommit_t,s0)
+
+# /proc/sys/dev directory and files
+type sysctl_dev_t, sysctl_type;
+genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
+
+#
+# unlabeled_t is the type of unlabeled objects.
+# Objects that have no known labeling information or that
+# have labels that are no longer valid are treated as having this type.
+#
+# Mountpoint permissions are for the case when a file has been assigned
+# an extended attribute for the first time (old file_t).  Directories
+# where filesystems are mounted may never get relabeled.
+#
+type unlabeled_t;
+kernel_rootfs_mountpoint(unlabeled_t)
+fs_associate(unlabeled_t)
+sid file gen_context(system_u:object_r:unlabeled_t,s0)
+sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
+neverallow * unlabeled_t:file entrypoint;
+
+# These initial sids are no longer used, and can be removed:
+sid any_socket		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
+sid file_labels		gen_context(system_u:object_r:unlabeled_t,s0)
+sid icmp_socket		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
+sid igmp_packet		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
+sid init		gen_context(system_u:object_r:unlabeled_t,s0)
+sid kmod		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
+sid policy		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
+sid scmp_packet		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
+sid sysctl_modprobe 	gen_context(system_u:object_r:unlabeled_t,s0)
+sid sysctl_fs		gen_context(system_u:object_r:unlabeled_t,s0)
+sid sysctl_kernel	gen_context(system_u:object_r:unlabeled_t,s0)
+sid sysctl_net		gen_context(system_u:object_r:unlabeled_t,s0)
+sid sysctl_net_unix	gen_context(system_u:object_r:unlabeled_t,s0)
+sid sysctl_vm		gen_context(system_u:object_r:unlabeled_t,s0)
+sid sysctl_dev		gen_context(system_u:object_r:unlabeled_t,s0)
+sid tcp_socket		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
+
+########################################
+#
+# kernel local policy
+#
+
+allow kernel_t self:capability { audit_control audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_broadcast net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config };
+allow kernel_t self:capability2 checkpoint_restore;
+allow kernel_t self:process { dyntransition getattr getcap getpgid getrlimit getsched getsession noatsecure rlimitinh setcap setkeycreate setpgid setsched setsockcreate share siginh signal_perms transition };
+allow kernel_t self:shm create_shm_perms;
+allow kernel_t self:sem create_sem_perms;
+allow kernel_t self:msg { receive send };
+allow kernel_t self:msgq create_msgq_perms;
+allow kernel_t self:unix_dgram_socket create_socket_perms;
+allow kernel_t self:unix_stream_socket create_stream_socket_perms;
+allow kernel_t self:unix_dgram_socket sendto;
+allow kernel_t self:unix_stream_socket connectto;
+allow kernel_t self:fifo_file rw_fifo_file_perms;
+allow kernel_t self:sock_file read_sock_file_perms;
+allow kernel_t self:fd use;
+allow kernel_t self:perf_event cpu;
+
+allow kernel_t debugfs_t:dir search_dir_perms;
+
+allow kernel_t proc_t:dir list_dir_perms;
+allow kernel_t proc_t:file read_file_perms;
+allow kernel_t proc_t:lnk_file read_lnk_file_perms;
+
+allow kernel_t proc_net_t:dir list_dir_perms;
+allow kernel_t proc_net_t:file read_file_perms;
+
+allow kernel_t proc_mdstat_t:file read_file_perms;
+
+allow kernel_t proc_kcore_t:file getattr;
+
+allow kernel_t proc_kmsg_t:file getattr;
+
+allow kernel_t sysctl_kernel_t:dir list_dir_perms;
+allow kernel_t sysctl_kernel_t:file read_file_perms;
+allow kernel_t sysctl_t:dir list_dir_perms;
+
+allow kernel_t sysctl_kernel_ns_last_pid_t:file read_file_perms;
+
+# Other possible mount points for the root fs are in files
+allow kernel_t unlabeled_t:dir mounton;
+# Kernel-generated traffic e.g., TCP resets on
+# connections with invalidated labels:
+allow kernel_t unlabeled_t:packet send;
+
+kernel_mounton_proc_dirs(kernel_t)
+kernel_request_load_module(kernel_t)
+
+# Allow unlabeled network traffic
+allow unlabeled_t self:packet { forward_in forward_out };
+corenet_in_generic_if(unlabeled_t)
+corenet_in_generic_node(unlabeled_t)
+
+corenet_all_recvfrom_unlabeled(kernel_t)
+corenet_all_recvfrom_netlabel(kernel_t)
+# Kernel-generated traffic e.g., ICMP replies:
+corenet_raw_sendrecv_all_if(kernel_t)
+corenet_raw_sendrecv_all_nodes(kernel_t)
+corenet_raw_send_generic_if(kernel_t)
+# Kernel-generated traffic e.g., TCP resets:
+corenet_tcp_sendrecv_all_if(kernel_t)
+corenet_tcp_sendrecv_all_nodes(kernel_t)
+corenet_raw_send_generic_node(kernel_t)
+corenet_send_all_packets(kernel_t)
+
+corenet_ib_access_all_pkeys(kernel_t)
+corenet_ib_access_unlabeled_pkeys(kernel_t)
+corenet_ib_manage_subnet_all_endports(kernel_t)
+corenet_ib_manage_subnet_unlabeled_endports(kernel_t)
+
+dev_mounton_sysfs_dirs(kernel_t)
+dev_read_sysfs(kernel_t)
+dev_search_usbfs(kernel_t)
+# devtmpfs handling:
+dev_create_generic_dirs(kernel_t)
+dev_delete_generic_dirs(kernel_t)
+dev_create_generic_blk_files(kernel_t)
+dev_delete_generic_blk_files(kernel_t)
+dev_create_generic_chr_files(kernel_t)
+dev_delete_generic_chr_files(kernel_t)
+dev_mounton(kernel_t)
+dev_delete_generic_symlinks(kernel_t)
+dev_rw_generic_chr_files(kernel_t)
+dev_setattr_generic_blk_files(kernel_t)
+dev_setattr_generic_chr_files(kernel_t)
+dev_getattr_mouse_dev(kernel_t)
+dev_setattr_mouse_dev(kernel_t)
+dev_delete_mouse_dev(kernel_t)
+dev_getattr_fs(kernel_t)
+dev_getattr_sysfs(kernel_t)
+dev_write_kmsg(kernel_t)
+
+# Mount root file system. Used when loading a policy
+# from initrd, then mounting the root filesystem
+fs_mount_all_fs(kernel_t)
+fs_unmount_all_fs(kernel_t)
+
+fs_getattr_tmpfs(kernel_t)
+fs_getattr_tmpfs_dirs(kernel_t)
+fs_manage_tmpfs_dirs(kernel_t)
+fs_manage_tmpfs_files(kernel_t)
+fs_manage_tmpfs_sockets(kernel_t)
+fs_delete_tmpfs_symlinks(kernel_t)
+fs_read_all_inherited_image_files(kernel_t)
+
+mls_rangetrans_source(kernel_t)
+mls_process_set_level(kernel_t)
+
+selinux_getattr_fs(kernel_t)
+selinux_load_policy(kernel_t)
+
+term_getattr_pty_fs(kernel_t)
+term_use_console(kernel_t)
+term_use_generic_ptys(kernel_t)
+
+# for kdevtmpfs
+term_setattr_unlink_unallocated_ttys(kernel_t)
+
+corecmd_exec_shell(kernel_t)
+corecmd_list_bin(kernel_t)
+# /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
+corecmd_exec_bin(kernel_t)
+
+domain_signal_all_domains(kernel_t)
+domain_search_all_domains_state(kernel_t)
+
+files_getattr_rootfs(kernel_t)
+files_manage_root_dir(kernel_t)
+files_delete_root_files(kernel_t)
+files_exec_root_files(kernel_t)
+files_delete_root_symlinks(kernel_t)
+files_delete_root_chr_files(kernel_t)
+files_list_root(kernel_t)
+files_list_etc(kernel_t)
+files_mounton_runtime_dirs(kernel_t)
+files_getattr_etc_runtime_dirs(kernel_t)
+files_mounton_etc_runtime_dirs(kernel_t)
+files_list_home(kernel_t)
+files_read_usr_files(kernel_t)
+files_mounton_default(kernel_t)
+
+mcs_process_set_categories(kernel_t)
+
+mls_process_read_all_levels(kernel_t)
+mls_process_write_all_levels(kernel_t)
+mls_file_write_all_levels(kernel_t)
+mls_file_read_all_levels(kernel_t)
+
+ifdef(`distro_redhat',`
+	# Bugzilla 222337
+	fs_rw_tmpfs_chr_files(kernel_t)
+')
+
+ifdef(`init_systemd',`
+	optional_policy(`
+		dev_manage_input_dev(kernel_t)
+		dev_filetrans_input_dev(kernel_t)
+	')
+
+	optional_policy(`
+		systemd_start_power_units(kernel_t)
+		systemd_status_power_units(kernel_t)
+	')
+
+	optional_policy(`
+		selinux_compute_create_context(kernel_t)
+	')
+
+	optional_policy(`
+		dev_setattr_generic_usb_dev(kernel_t)
+		dev_delete_generic_usb_dev(kernel_t)
+
+		storage_dev_filetrans_fixed_disk(kernel_t, blk_file)
+		storage_setattr_fixed_disk_dev(kernel_t)
+		storage_create_fixed_disk_dev(kernel_t)
+		storage_delete_fixed_disk_dev(kernel_t)
+
+		storage_setattr_scsi_generic_dev(kernel_t)
+		storage_delete_scsi_generic_dev(kernel_t)
+	')
+')
+
+optional_policy(`
+	tunable_policy(`container_spc_create_nfs_servers',`
+		container_stream_connect_spc(kernel_t)
+		container_rw_spc_tcp_sockets(kernel_t)
+
+		container_manage_dirs(kernel_t)
+		container_manage_files(kernel_t)
+		container_manage_chr_files(kernel_t)
+		container_manage_fifo_files(kernel_t)
+		container_manage_lnk_files(kernel_t)
+		container_manage_sock_files(kernel_t)
+	')
+')
+
+optional_policy(`
+	# loop devices
+	fstools_use_fds(kernel_t)
+')
+
+optional_policy(`
+	init_sigchld(kernel_t)
+')
+
+optional_policy(`
+	libs_use_ld_so(kernel_t)
+	libs_use_shared_libs(kernel_t)
+')
+
+optional_policy(`
+	logging_manage_generic_logs(kernel_t)
+	logging_send_syslog_msg(kernel_t)
+')
+
+optional_policy(`
+	mount_use_fds(kernel_t)
+')
+
+optional_policy(`
+	nis_use_ypbind(kernel_t)
+')
+
+optional_policy(`
+	dev_ioctl_dri_dev(kernel_t)
+
+	plymouthd_delete_runtime_files(kernel_t)
+	plymouthd_read_runtime_files(kernel_t)
+	plymouthd_read_spool_files(kernel_t)
+	plymouthd_rw_lib_files(kernel_t)
+
+	term_use_ptmx(kernel_t)
+	term_use_unallocated_ttys(kernel_t)
+')
+
+optional_policy(`
+	# nfs kernel server needs kernel UDP access. It is less risky and painful
+	# to just give it everything.
+	allow kernel_t self:tcp_socket create_stream_socket_perms;
+	allow kernel_t self:udp_socket create_socket_perms;
+
+	# nfs kernel server needs kernel UDP access. It is less risky and painful
+	# to just give it everything.
+	corenet_udp_sendrecv_generic_if(kernel_t)
+	corenet_udp_sendrecv_generic_node(kernel_t)
+	corenet_udp_bind_generic_node(kernel_t)
+	corenet_sendrecv_portmap_client_packets(kernel_t)
+	corenet_sendrecv_generic_server_packets(kernel_t)
+
+	fs_getattr_xattr_fs(kernel_t)
+
+	auth_dontaudit_getattr_shadow(kernel_t)
+
+	sysnet_read_config(kernel_t)
+
+	rpc_manage_nfs_ro_content(kernel_t)
+	rpc_manage_nfs_rw_content(kernel_t)
+	rpc_search_nfs_state_data(kernel_t)
+	rpc_use_nfsd_fds(kernel_t)
+	rpc_tcp_rw_nfs_sockets(kernel_t)
+	rpc_udp_rw_nfs_sockets(kernel_t)
+
+	optional_policy(`
+		gssproxy_stream_connect(kernel_t)
+	')
+
+	tunable_policy(`nfs_export_all_ro',`
+		fs_getattr_noxattr_fs(kernel_t)
+		fs_list_noxattr_fs(kernel_t)
+		fs_read_noxattr_fs_files(kernel_t)
+		fs_read_noxattr_fs_symlinks(kernel_t)
+
+		files_list_non_auth_dirs(kernel_t)
+		files_read_non_auth_files(kernel_t)
+		files_read_non_auth_symlinks(kernel_t)
+	')
+
+	tunable_policy(`nfs_export_all_rw',`
+		fs_getattr_noxattr_fs(kernel_t)
+		fs_list_noxattr_fs(kernel_t)
+		fs_read_noxattr_fs_files(kernel_t)
+		fs_read_noxattr_fs_symlinks(kernel_t)
+
+		files_manage_non_auth_files(kernel_t)
+	')
+')
+
+optional_policy(`
+	seutil_read_config(kernel_t)
+	seutil_read_bin_policy(kernel_t)
+	seutil_domtrans_setfiles(kernel_t)
+')
+
+optional_policy(`
+	storage_dontaudit_read_fixed_disk(kernel_t)
+')
+
+optional_policy(`
+	unconfined_domain_noaudit(kernel_t)
+')
+
+optional_policy(`
+	zfs_filetrans_zpool_cache(kernel_t)
+	zfs_rw_zpool_cache(kernel_t)
+')
+
+########################################
+#
+# Unlabeled process local policy
+#
+
+optional_policy(`
+	# If you load a new policy that removes active domains, processes can
+	# get stuck if you do not allow unlabeled processes to signal init.
+	# If you load an incompatible policy, you should probably reboot,
+	# since you may have compromised system security.
+	init_sigchld(unlabeled_t)
+')
+
+########################################
+#
+# Kernel module loading policy
+#
+
+if(secure_mode_insmod) {
+	dontaudit can_load_kernmodule self:capability sys_module;
+	dontaudit can_load_kernmodule self:system module_load;
+
+	files_dontaudit_load_kernel_modules(can_load_kernmodule)
+
+	dontaudit can_load_kernmodule kernel_t:key search;
+} else {
+	allow can_load_kernmodule self:capability sys_module;
+	allow can_load_kernmodule self:system module_load;
+
+	files_load_kernel_modules(can_load_kernmodule)
+
+	kernel_search_key(can_load_kernmodule)
+}
+
+########################################
+#
+# Rules for unconfined access to this module
+#
+
+allow kern_unconfined proc_type:dir { append execmod execute manage_dir_perms map mounton quotaon relabel_dir_perms watch watch_mount watch_reads watch_sb watch_with_perm };
+allow kern_unconfined proc_type:lnk_file { append execmod execute manage_lnk_file_perms map mounton open quotaon relabel_lnk_file_perms watch watch_mount watch_reads watch_sb watch_with_perm };
+allow kern_unconfined proc_type:file { exec_file_perms manage_file_perms mounton quotaon relabel_file_perms watch watch_mount watch_reads watch_sb watch_with_perm };
+
+allow kern_unconfined sysctl_type:dir { append execmod execute manage_dir_perms map mounton quotaon relabel_dir_perms watch watch_mount watch_reads watch_sb watch_with_perm };
+allow kern_unconfined sysctl_type:file { exec_file_perms manage_file_perms mounton quotaon relabel_file_perms watch watch_mount watch_reads watch_sb watch_with_perm };
+
+allow kern_unconfined kernel_t:system { disable enable halt ipc_info module_load module_request reboot reload start status stop syslog_console syslog_mod syslog_read }; #selint-disable:W-001
+
+allow kern_unconfined unlabeled_t:file { exec_file_perms manage_file_perms mounton quotaon relabel_file_perms watch watch_mount watch_reads watch_sb watch_with_perm };
+allow kern_unconfined unlabeled_t:lnk_file  { append execmod execute manage_lnk_file_perms map mounton open quotaon relabel_lnk_file_perms watch watch_mount watch_reads watch_sb watch_with_perm };
+allow kern_unconfined unlabeled_t:sock_file { execmod execute manage_sock_file_perms map mounton quotaon relabel_sock_file_perms watch watch_mount watch_reads watch_sb watch_with_perm };
+allow kern_unconfined unlabeled_t:fifo_file { execmod execute manage_fifo_file_perms map mounton quotaon relabel_fifo_file_perms watch watch_mount watch_reads watch_sb watch_with_perm };
+allow kern_unconfined unlabeled_t:blk_file { execmod execute manage_blk_file_perms map mounton quotaon relabel_blk_file_perms watch watch_mount watch_reads watch_sb watch_with_perm };
+allow kern_unconfined unlabeled_t:chr_file { execute manage_chr_file_perms map mounton quotaon relabel_chr_file_perms watch watch_mount watch_reads watch_sb watch_with_perm };
+allow kern_unconfined unlabeled_t:dir { add_name append execmod execute manage_dir_perms map mounton quotaon relabelfrom relabelto remove_name reparent rmdir search watch watch_mount watch_reads watch_sb watch_with_perm };
+allow kern_unconfined unlabeled_t:filesystem { associate getattr mount quotaget quotamod relabelfrom relabelto remount unmount watch };
+allow kern_unconfined unlabeled_t:association { polmatch recvfrom sendto setcontext };
+allow kern_unconfined unlabeled_t:packet { forward_in forward_out recv relabelto send };
+allow kern_unconfined unlabeled_t:process { fork getattr getcap getpgid getrlimit getsched getsession noatsecure ptrace rlimitinh setcap setcurrent setexec setfscreate setkeycreate setpgid setrlimit setsched setsockcreate share siginh signal_perms };
Index: refpolicy-deepin/policy/modules/kernel/mcs.if
===================================================================
--- refpolicy-deepin.orig/policy/modules/kernel/mcs.if
+++ refpolicy-deepin/policy/modules/kernel/mcs.if
@@ -114,3 +114,21 @@ interface(`mcs_process_set_categories',`
 
 	typeattribute $1 mcssetcats;
 ')
+
+########################################
+## <summary>
+##	This domain is exemption for MCS rules.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain target for user exemption.
+##	</summary>
+## </param>
+#
+interface(`domain_mcs_exemption',`
+	gen_require(`
+		attribute mcsexemptiondomain;
+	')
+
+	typeattribute $1 mcsexemptiondomain;
+')
Index: refpolicy-deepin/policy/modules/kernel/mcs.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/kernel/mcs.te
+++ refpolicy-deepin/policy/modules/kernel/mcs.te
@@ -11,3 +11,4 @@ attribute mcssetcats;
 attribute mcswriteall;
 attribute mcsreadall;
 attribute mcs_constrained_type;
+attribute mcsexemptiondomain;
Index: refpolicy-deepin/policy/modules/kernel/mls.if
===================================================================
--- refpolicy-deepin.orig/policy/modules/kernel/mls.if
+++ refpolicy-deepin/policy/modules/kernel/mls.if
@@ -966,3 +966,21 @@ interface(`mls_dbus_recv_all_levels',`
 
 	typeattribute $1 mlsdbusrecv;
 ')
+
+########################################
+## <summary>
+##  This domain is exemption for MCS rules.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain target for user exemption.
+##  </summary>
+## </param>
+#
+interface(`domain_mls_exemption',`
+	gen_require(`
+		attribute mlsexemptiondomain;
+	')
+
+	typeattribute $1 mlsexemptiondomain;
+')
\ No newline at end of file
Index: refpolicy-deepin/policy/modules/kernel/mls.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/kernel/mls.te
+++ refpolicy-deepin/policy/modules/kernel/mls.te
@@ -71,3 +71,5 @@ attribute mlsfdshare;
 
 attribute mlsdbusrecv;
 attribute mlsdbussend;
+
+attribute mlsexemptiondomain;
\ No newline at end of file
Index: refpolicy-deepin/policy/modules/kernel/selinux.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/kernel/selinux.te
+++ refpolicy-deepin/policy/modules/kernel/selinux.te
@@ -50,7 +50,7 @@ genfscon securityfs / gen_context(system
 # Controlled setenforce access
 #
 
-neverallow ~{ selinux_unconfined_type can_setenforce } security_t:security setenforce;
+#(zzl) neverallow~{ selinux_unconfined_type can_setenforce } security_t:security setenforce;
 
 allow can_setenforce security_t:dir list_dir_perms;
 allow can_setenforce security_t:file rw_file_perms;
@@ -68,7 +68,7 @@ if(secure_mode_policyload) {
 # Controlled load_policy access
 #
 
-neverallow ~{ selinux_unconfined_type can_load_policy } security_t:security load_policy;
+#(zzl) neverallow~{ selinux_unconfined_type can_load_policy } security_t:security load_policy;
 
 allow can_load_policy security_t:dir list_dir_perms;
 allow can_load_policy security_t:file rw_file_perms;
@@ -86,7 +86,7 @@ if(secure_mode_policyload) {
 # Controlled security parameters access
 #
 
-neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam;
+#(zzl) neverallow~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam;
 
 allow can_setsecparam security_t:dir list_dir_perms;
 allow can_setsecparam security_t:file rw_file_perms;
Index: refpolicy-deepin/policy/modules/kernel/storage.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/kernel/storage.te
+++ refpolicy-deepin/policy/modules/kernel/storage.te
@@ -18,8 +18,8 @@ attribute storage_unconfined_type;
 type fixed_disk_device_t;
 dev_node(fixed_disk_device_t)
 
-neverallow ~{ fixed_disk_raw_read storage_unconfined_type } fixed_disk_device_t:{ chr_file blk_file } read;
-neverallow ~{ fixed_disk_raw_write storage_unconfined_type } fixed_disk_device_t:{ chr_file blk_file } { append write };
+#(zzl) neverallow~{ fixed_disk_raw_read storage_unconfined_type } fixed_disk_device_t:{ chr_file blk_file } read;
+#(zzl) neverallow~{ fixed_disk_raw_write storage_unconfined_type } fixed_disk_device_t:{ chr_file blk_file } { append write };
 
 #
 # fuse_device_t is the type of /dev/fuse
@@ -38,8 +38,8 @@ optional_policy(`
 type scsi_generic_device_t;
 dev_node(scsi_generic_device_t)
 
-neverallow ~{ scsi_generic_read storage_unconfined_type } scsi_generic_device_t:{ chr_file blk_file } read;
-neverallow ~{ scsi_generic_write storage_unconfined_type } scsi_generic_device_t:{ chr_file blk_file } { append write };
+#(zzl) neverallow~{ scsi_generic_read storage_unconfined_type } scsi_generic_device_t:{ chr_file blk_file } read;
+#(zzl) neverallow~{ scsi_generic_write storage_unconfined_type } scsi_generic_device_t:{ chr_file blk_file } { append write };
 
 #
 # removable_device_t is the type of
Index: refpolicy-deepin/policy/modules/roles/sysadm.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/roles/sysadm.te
+++ refpolicy-deepin/policy/modules/roles/sysadm.te
@@ -1348,3 +1348,8 @@ ifndef(`distro_redhat',`
 		wm_role_template(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
 	')
 ')
+
+# for manage deepin_elf_verify program
+optional_policy(`
+	deepin_elfverify_entry_type(sysadm_t)
+')
\ No newline at end of file
Index: refpolicy-deepin/policy/modules/roles/sysadm.te.orig
===================================================================
--- /dev/null
+++ refpolicy-deepin/policy/modules/roles/sysadm.te.orig
@@ -0,0 +1,1350 @@
+policy_module(sysadm)
+
+########################################
+#
+# Declarations
+#
+
+## <desc>
+## <p>
+## Allow sysadm to debug or ptrace all processes.
+## </p>
+## </desc>
+gen_tunable(allow_ptrace, false)
+
+## <desc>
+## <p>
+## Allow sysadm to read/write to fifo files inherited from
+## a domain allowed to change role.
+## </p>
+## </desc>
+gen_tunable(sysadm_allow_rw_inherited_fifo, false)
+
+#role sysadm_r;
+
+userdom_admin_user_template(sysadm)
+
+ifndef(`enable_mls',`
+	userdom_security_admin_template(sysadm_t, sysadm_r)
+')
+
+########################################
+#
+# Local policy
+#
+
+# for networkctl and possibly other networking tools
+allow sysadm_t self:netlink_route_socket rw_netlink_socket_perms;
+
+allow sysadm_t self:netlink_generic_socket { create setopt bind write read };
+
+# for ptrace
+allow sysadm_t self:netlink_tcpdiag_socket { create write nlmsg_read read };
+
+allow sysadm_t self:capability audit_write;
+allow sysadm_t self:system status;
+
+kernel_request_load_module(sysadm_t)
+
+corecmd_exec_shell(sysadm_t)
+
+corenet_ib_access_unlabeled_pkeys(sysadm_t)
+corenet_ib_manage_subnet_unlabeled_endports(sysadm_t)
+
+domain_getsched_all_domains(sysadm_t)
+
+dev_read_cpuid(sysadm_t)
+dev_read_kmsg(sysadm_t)
+dev_rw_ipmi_dev(sysadm_t)
+
+logging_watch_all_logs(sysadm_t)
+logging_watch_audit_log(sysadm_t)
+
+mls_process_read_all_levels(sysadm_t)
+
+selinux_read_policy(sysadm_t)
+
+ubac_process_exempt(sysadm_t)
+ubac_file_exempt(sysadm_t)
+ubac_fd_exempt(sysadm_t)
+
+init_exec(sysadm_t)
+init_admin(sysadm_t)
+init_rw_stream_sockets(sysadm_t)
+
+# Add/remove user home directories
+userdom_manage_user_home_dirs(sysadm_t)
+userdom_home_filetrans_user_home_dir(sysadm_t)
+
+# for systemd-analyze
+files_get_etc_unit_status(sysadm_t)
+
+ifdef(`direct_sysadm_daemon',`
+	optional_policy(`
+		init_run_daemon(sysadm_t, sysadm_r)
+	')
+',`
+	ifdef(`distro_gentoo',`
+		optional_policy(`
+			seutil_init_script_run_runinit(sysadm_t, sysadm_r)
+		')
+	')
+')
+
+ifdef(`distro_gentoo',`
+	init_exec_rc(sysadm_t)
+')
+
+ifndef(`enable_mls',`
+	logging_manage_audit_log(sysadm_t)
+	logging_manage_audit_config(sysadm_t)
+	logging_run_auditctl(sysadm_t, sysadm_r)
+')
+
+ifdef(`init_systemd',`
+	# Allow managing runtime units, for example mount units generated
+	# from /etc/fstab.
+	init_get_runtime_units_status(sysadm_t)
+	init_start_runtime_units(sysadm_t)
+	init_stop_runtime_units(sysadm_t)
+
+	# Allow sysadm to resolve the username of dynamic users by calling
+	# LookupDynamicUserByUID on org.freedesktop.systemd1.
+	init_dbus_chat(sysadm_t)
+
+	# Allow sysadm to get the status of and set properties of other users,
+	# sessions, and seats on the system.
+	systemd_dbus_chat_logind(sysadm_t)
+
+	# Allow sysadm to query and set networking settings on the system.
+	systemd_dbus_chat_networkd(sysadm_t)
+	fs_read_nsfs_files(sysadm_t)
+
+	systemd_run_nspawn(sysadm_t, sysadm_r)
+	systemd_run_passwd_agent(sysadm_t, sysadm_r)
+	systemd_watch_passwd_runtime_dirs(sysadm_t)
+
+	# Allow sysadm to follow logs in the journal, i.e. with podman logs -f
+	systemd_watch_journal_dirs(sysadm_t)
+')
+
+tunable_policy(`allow_ptrace',`
+	domain_ptrace_all_domains(sysadm_t)
+')
+
+optional_policy(`
+	abrt_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	accountsd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	acct_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	acpi_admin(sysadm_t, sysadm_r)
+	acpi_run_client(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	afs_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	aide_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	aisexecd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	amanda_run_recover(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	amavis_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	amtu_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	apache_admin(sysadm_t, sysadm_r)
+	apache_run_helper(sysadm_t, sysadm_r)
+	#apache_run_all_scripts(sysadm_t, sysadm_r)
+	#apache_domtrans_sys_script(sysadm_t)
+	apache_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	apcupsd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	apt_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	aptcacher_run_acngtool(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	arpwatch_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	asterisk_admin(sysadm_t, sysadm_r)
+	asterisk_stream_connect(sysadm_t)
+')
+
+optional_policy(`
+	auditadm_role_change(sysadm_r)
+')
+
+optional_policy(`
+	automount_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	avahi_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	backup_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	bacula_run_admin(sysadm_t, sysadm_r)
+	bacula_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	bind_admin(sysadm_t, sysadm_r)
+	bind_run_ndc(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	bird_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	bitlbee_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	boinc_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	bootloader_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	bugzilla_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cachefilesd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	calamaris_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	canna_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	certbot_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	certmaster_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	certmonger_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	certwatch_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cfengine_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cgroup_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	chkrootkit_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	chronyd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	clamav_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	clock_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cobbler_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cockpit_admin(sysadm_t)
+')
+
+optional_policy(`
+	collectd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	condor_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	consoletype_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	container_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	corosync_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	couchdb_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cron_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ctdb_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cups_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cvs_admin(sysadm_t, sysadm_r)
+	cvs_exec(sysadm_t)
+')
+
+optional_policy(`
+	cyphesis_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cyrus_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dante_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ddclient_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	devicekit_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dev_rw_xen(sysadm_t)
+')
+
+optional_policy(`
+	dhcpd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dictd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dirmngr_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	distcc_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dkim_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dmesg_exec(sysadm_t)
+')
+
+optional_policy(`
+	dmidecode_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dnsmasq_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dovecot_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dphysswapfile_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dpkg_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	drbd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	entropyd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	exim_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	fail2ban_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	fapolicyd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	fcoe_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	fetchmail_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	firewalld_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	firstboot_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	fstools_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ftp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	fwupd_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	gatekeeper_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	gdomap_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	glance_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	glusterfs_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	gpm_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	gpsd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	gssproxy_admin(sysadm_t)
+')
+
+optional_policy(`
+	hadoop_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	haproxy_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	hddtemp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	hostname_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	hwloc_admin(sysadm_t)
+	hwloc_run_dhwd(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	hypervkvp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	i18n_input_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	icecast_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ifplugd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	inn_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	iodine_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ipsec_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	iptables_admin(sysadm_t, sysadm_r)
+	iptables_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	irqbalance_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	iscsi_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	isnsd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	jabber_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	kdump_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	kerberos_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	kerneloops_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	keystone_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	knot_admin(sysadm_t, sysadm_r)
+	knot_run_client(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	kismet_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ksmtuned_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	kubernetes_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	l2tp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ldap_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	libmtp_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	libs_run_ldconfig(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	lightsquid_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	likewise_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	lircd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	lldpad_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	logrotate_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	lpd_run_checkpc(sysadm_t, sysadm_r)
+	lpd_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	lsmd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	lvm_admin(sysadm_t, sysadm_r)
+	lvm_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	mandb_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	mcelog_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	memcached_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	minidlna_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	minissdpd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	modutils_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	mongodb_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	monit_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	monop_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	mount_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	mozilla_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	mpd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	mplayer_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	mrtg_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	mta_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	munin_stream_connect(sysadm_t)
+')
+
+optional_policy(`
+	mysql_admin(sysadm_t, sysadm_r)
+	mysql_stream_connect(sysadm_t)
+')
+
+optional_policy(`
+	nagios_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	nessus_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	netutils_run(sysadm_t, sysadm_r)
+	netutils_run_ping(sysadm_t, sysadm_r)
+	netutils_run_traceroute(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	networkmanager_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	nis_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	nscd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+        nsd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	nslcd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ntop_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ntp_admin(sysadm_t, sysadm_r)
+	corenet_udp_bind_ntp_port(sysadm_t)
+')
+
+optional_policy(`
+	numad_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	nut_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	oident_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ooffice_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	openct_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	openhpi_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	opensm_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	openvpn_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	openvswitch_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pacemaker_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pads_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pcscd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pegasus_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	perdition_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pingd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pkcs_admin_slotd(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	plymouthd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	portage_run(sysadm_t, sysadm_r)
+	portage_run_fetch(sysadm_t, sysadm_r)
+	portage_run_gcc_config(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	portmap_run_helper(sysadm_t, sysadm_r)
+	portmap_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	portreserve_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	postfix_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	postfixpolicyd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	postgrey_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ppp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	prelude_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	privoxy_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	psad_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	puppet_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pxe_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pyzor_admin(sysadm_t, sysadm_r)
+	pyzor_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	qpidd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	quantum_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	quota_run(sysadm_t, sysadm_r)
+	quota_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rabbitmq_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	radius_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	radvd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	raid_run_mdadm(sysadm_r, sysadm_t)
+	raid_admin_mdadm(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	razor_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	redis_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	resmgr_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rhsmcertd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rkhunter_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rngd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rpc_admin(sysadm_t, sysadm_r)
+	rpc_domtrans_nfsd(sysadm_t)
+')
+
+optional_policy(`
+	rpcbind_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rpm_run(sysadm_t, sysadm_r)
+	rpm_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rssh_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	rsync_admin(sysadm_t, sysadm_r)
+	rsync_exec(sysadm_t)
+')
+
+optional_policy(`
+	rtkit_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rwho_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	samba_admin(sysadm_t, sysadm_r)
+	samba_run_smbcontrol(sysadm_t, sysadm_r)
+	samba_run_smbmount(sysadm_t, sysadm_r)
+	samba_run_net(sysadm_t, sysadm_r)
+	samba_run_winbind_helper(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	samhain_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	sanlock_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	sasl_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	sblim_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	screen_role_template(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	secadm_role_change(sysadm_r)
+')
+
+optional_policy(`
+	sensord_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	setrans_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	setroubleshoot_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	seutil_run_setfiles(sysadm_t, sysadm_r)
+	seutil_run_runinit(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	shorewall_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	shutdown_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	slpd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	smartmon_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	smokeping_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	smstools_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	snmp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	snort_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	soundserver_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	spamassassin_admin(sysadm_t, sysadm_r)
+	spamassassin_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	ssh_role_template(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	sssd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	staff_role_change(sysadm_r)
+')
+
+optional_policy(`
+	stapserver_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	su_role_template(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	sudo_role_template(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	svnserve_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	sysnet_run_ifconfig(sysadm_t, sysadm_r)
+	sysnet_run_dhcpc(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	sysstat_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	systemd_dbus_chat_hostnamed(sysadm_t)
+')
+
+optional_policy(`
+	systemd_dbus_chat_logind(sysadm_t)
+')
+
+optional_policy(`
+	tboot_run_txtstat(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	tcsd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	tftp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	tgtd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	thunderbird_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	tor_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	transproxy_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	tripwire_run_siggen(sysadm_t, sysadm_r)
+	tripwire_run_tripwire(sysadm_t, sysadm_r)
+	tripwire_run_twadmin(sysadm_t, sysadm_r)
+	tripwire_run_twprint(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	tvtime_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	tzdata_domtrans(sysadm_t)
+')
+
+optional_policy(`
+	udev_run_udevadm(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ulogd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	uml_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	unconfined_domtrans(sysadm_t)
+')
+
+optional_policy(`
+	unprivuser_role_change(sysadm_r)
+')
+
+optional_policy(`
+	uptime_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dev_rw_generic_usb_dev(sysadm_t)
+	usbmodules_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	userhelper_role_template(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	usermanage_run_admin_passwd(sysadm_t, sysadm_r)
+	usermanage_run_groupadd(sysadm_t, sysadm_r)
+	usermanage_run_useradd(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	uucp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	uuidd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	varnishd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	varnishd_admin_varnishlog(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	vdagent_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	vhostmd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	virt_admin(sysadm_t, sysadm_r)
+	virt_stream_connect(sysadm_t)
+')
+
+optional_policy(`
+	vmware_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	vnstatd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	vpn_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	watchdog_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	wdmd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	webalizer_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	wireguard_admin(sysadm_t, sysadm_r)
+	wireguard_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	wireshark_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	vlock_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	xscreensaver_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	xserver_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+')
+
+optional_policy(`
+	xfs_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	zabbix_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	zarafa_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	zebra_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	zfs_admin(sysadm_t, sysadm_r)
+')
+
+ifndef(`distro_redhat',`
+	optional_policy(`
+		auth_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+
+	optional_policy(`
+		bluetooth_admin(sysadm_t, sysadm_r)
+		bluetooth_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+
+	optional_policy(`
+		bubblewrap_role(sysadm, sysadm_t, sysadm_r)
+	')
+
+	optional_policy(`
+		cdrecord_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+
+	optional_policy(`
+		chromium_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+
+	optional_policy(`
+		cron_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+
+	optional_policy(`
+		cryfs_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+
+	optional_policy(`
+		dirmngr_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+
+	optional_policy(`
+		evolution_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+
+	optional_policy(`
+		feedbackd_role(sysadm, sysadm_t, sysadm_r)
+	')
+
+	optional_policy(`
+		games_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+
+	optional_policy(`
+		gnome_role_template(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+
+	optional_policy(`
+		gpg_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+
+	optional_policy(`
+		irc_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+
+	optional_policy(`
+		ircd_admin(sysadm_t, sysadm_r)
+	')
+
+	optional_policy(`
+		java_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+
+	optional_policy(`
+		wm_role_template(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	')
+')
Index: refpolicy-deepin/policy/modules/services/deepin_perm_control.fc
===================================================================
--- /dev/null
+++ refpolicy-deepin/policy/modules/services/deepin_perm_control.fc
@@ -0,0 +1,11 @@
+/usr/sbin/permission_manager_dbus_daemon   --   gen_context(system_u:object_r:deepin_perm_manager_exec_t,s0)
+/usr/sbin/usecd   --   gen_context(system_u:object_r:deepin_perm_manager_exec_t,s0)
+/usr/sbin/deepin-elf-verify   --   gen_context(system_u:object_r:deepin_elf_verify_exec_t,s0)
+/usr/bin/permission_manager_dbus_sessin_daemon   --   gen_context(system_u:object_r:deepin_perm_manager_session_exec_t,s0)
+/usr/lib/systemd/system/permission-manager\.service      --      gen_context(system_u:object_r:deepin_perm_manager_unit_t,s0)
+/usr/bin/deepin-security-verify   --   gen_context(system_u:object_r:deepin_security_verify_exec_t,s0)
+/etc/lpr/dbusadaptor/LocalPropertyRepository.db   --   gen_context(system_u:object_r:deepin_perm_manager_file_t,s0)
+/etc/etc/permission-manager\.db   --   gen_context(system_u:object_r:deepin_perm_manager_file_t,s0)
+/usr/sbin/deepin-security-enhance   --   gen_context(system_u:object_r:deepin_security_enhance_exec_t,s0)
+/home/\.sec    -d   gen_context(system_u:object_r:deepin_home_sec_t,s0)
+/home/\.sec(/.*)?   gen_context(system_u:object_r:deepin_home_sec_t,s0)
Index: refpolicy-deepin/policy/modules/services/deepin_perm_control.if
===================================================================
--- /dev/null
+++ refpolicy-deepin/policy/modules/services/deepin_perm_control.if
@@ -0,0 +1,872 @@
+## <summary>Policy for deepin_perm_control and related programs.</summary>
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_sidtwo_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_sidtwo_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_sidtwo_type_set',`
+	gen_require(`
+		attribute deepin_sidtwo_type;
+	')
+
+	typeattribute $1 deepin_sidtwo_type;
+')
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_file_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_file_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_file_type_set',`
+	gen_require(`
+		attribute deepin_file_type;
+	')
+
+	deepin_sidtwo_type_set($1)
+	typeattribute $1 deepin_file_type;
+')
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_readable_file_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_readable_file_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_readable_file_type_set',`
+	gen_require(`
+		attribute deepin_readable_file_type;
+	')
+
+	deepin_sidtwo_type_set($1)
+	typeattribute $1 deepin_readable_file_type;
+')
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_writable_file_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_writable_file_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_writable_file_type_set',`
+	gen_require(`
+		attribute deepin_writable_file_type;
+	')
+
+	deepin_sidtwo_type_set($1)
+	typeattribute $1 deepin_writable_file_type;
+')
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_deletable_file_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_deletable_file_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_deletable_file_type_set',`
+	gen_require(`
+		attribute deepin_deletable_file_type;
+	')
+
+	deepin_sidtwo_type_set($1)
+	typeattribute $1 deepin_deletable_file_type;
+')
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_executable_file_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_executable_file_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_executable_file_type_set',`
+	gen_require(`
+		attribute deepin_executable_file_type;
+	')
+
+	deepin_sidtwo_type_set($1)
+	typeattribute $1 deepin_executable_file_type;
+')
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_usaudit_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_usaudit_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_usaudit_type_set',`
+	gen_require(`
+		attribute deepin_usaudit_type;
+	')
+
+	typeattribute $1 deepin_usaudit_type;
+')
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_usaudit_process_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_usaudit_process_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_usaudit_process_type_set',`
+	gen_require(`
+		attribute deepin_usaudit_process_type;
+	')
+
+	typeattribute $1 deepin_usaudit_process_type;
+')
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_usaudit_socket_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_usaudit_socket_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_usaudit_socket_type_set',`
+	gen_require(`
+		attribute deepin_usaudit_socket_type;
+	')
+
+	typeattribute $1 deepin_usaudit_socket_type;
+')
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_usaudit_file_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_usaudit_file_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_usaudit_file_type_set',`
+	gen_require(`
+		attribute deepin_usaudit_file_type;
+	')
+
+	typeattribute $1 deepin_usaudit_file_type;
+')
+
+########################################
+## <summary>
+##  Make the specified domain usable for
+##  the deepin_app_domain.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Type to be used for deepin_app_domain.
+##  </summary>
+## </param>
+#
+interface(`deepin_app_domain_set',`
+	gen_require(`
+		attribute deepin_app_domain;
+	')
+
+	deepin_executable_file_type_set($1)
+	typeattribute $1 deepin_app_domain;
+')
+
+########################################
+## <summary>
+##  Make the specified domain usable for
+##  the deepin_sys_domain.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Type to be used for deepin_sys_domain.
+##  </summary>
+## </param>
+#
+interface(`deepin_sys_domain_set',`
+	gen_require(`
+		attribute deepin_sys_domain;
+	')
+	deepin_app_domain_set($1)
+	typeattribute $1 deepin_sys_domain;
+')
+
+########################################
+## <summary>
+##  Make the specified domain usable for
+##  the deepin_sec_domain.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Type to be used for deepin_sec_domain.
+##  </summary>
+## </param>
+#
+interface(`deepin_sec_domain_set',`
+	gen_require(`
+		attribute deepin_sec_domain;
+	')
+	deepin_app_domain_set($1)
+	typeattribute $1 deepin_sec_domain;
+')
+
+########################################
+## <summary>
+##  Make the specified domain usable for
+##  the deepin_security_server_domain.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Type to be used for deepin_security_server_domain.
+##  </summary>
+## </param>
+#
+interface(`deepin_security_server_domain_set',`
+	gen_require(`
+		attribute deepin_security_server_domain;
+	')
+
+	typeattribute $1 deepin_security_server_domain;
+')
+
+########################################
+## <summary>
+##  Make the specified domain usable for
+##  the deepin_package_manage_domain.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Type to be used for deepin_package_manage_domain.
+##  </summary>
+## </param>
+#
+interface(`deepin_package_manage_domain_set',`
+	gen_require(`
+		attribute deepin_package_manage_domain;
+	')
+	typeattribute $1 deepin_package_manage_domain;
+')
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_app_private_file_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_app_private_file_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_app_private_file_type_set',`
+	gen_require(`
+		attribute deepin_app_private_file_type;
+	')
+
+	deepin_sidtwo_type_set($1)
+	typeattribute $1 deepin_app_private_file_type;
+')
+
+########################################
+## <summary>
+##  Make the specified domain usable for
+##  the deepin_app_access_camera_domain.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Type to be used for deepin_app_access_camera_domain.
+##  </summary>
+## </param>
+#
+interface(`deepin_app_access_camera_domain_set',`
+	gen_require(`
+		attribute deepin_app_access_camera_domain;
+	')
+
+	typeattribute $1 deepin_app_access_camera_domain;
+')
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_camera_resource_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_camera_resource_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_camera_resource_type_set',`
+	gen_require(`
+		attribute deepin_camera_resource_type;
+	')
+
+	typeattribute $1 deepin_camera_resource_type;
+')
+
+########################################
+## <summary>
+##  allow domain to access camera resource.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_access_camera_resource',`
+	gen_require(`
+		attribute deepin_camera_resource_type;
+	')
+
+	## <desc>
+	##  <p>
+	##  Grant the $1_t domains access camera resource by condition
+	##  </p>
+	## </desc>
+	gen_tunable(`allow_$1_access_camera', $2)
+
+	tunable_policy(`allow_$1_access_camera',`
+		allow $1_t deepin_camera_resource_type:chr_file { getattr ioctl map open read };
+	')
+')
+
+########################################
+## <summary>
+##  Make the specified domain usable for
+##  the deepin_app_access_microphone_domain.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Type to be used for deepin_app_access_microphone_domain.
+##  </summary>
+## </param>
+#
+interface(`deepin_app_access_microphone_domain_set',`
+	gen_require(`
+		attribute deepin_app_access_microphone_domain;
+	')
+
+	typeattribute $1 deepin_app_access_microphone_domain;
+')
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_microphone_resource_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_microphone_resource_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_microphone_resource_type_set',`
+	gen_require(`
+		attribute deepin_microphone_resource_type;
+	')
+
+	typeattribute $1 deepin_microphone_resource_type;
+')
+
+########################################
+## <summary>
+##  allow domain to access microphone resource.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_access_microphone_resource',`
+	gen_require(`
+		attribute deepin_microphone_resource_type;
+	')
+
+	## <desc>
+	##  <p>
+	##  Grant the $1_t domains access microphone resource by condition
+	##  </p>
+	## </desc>
+	gen_tunable(`allow_$1_access_microphone', $2)
+
+	tunable_policy(`allow_$1_access_microphone',`
+		allow $1_t deepin_microphone_resource_type:chr_file { getattr ioctl map open read };
+	')
+')
+
+########################################
+## <summary>
+##  let domain unkillable.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_process_unkillable',`
+	gen_require(`
+		attribute deepin_executable_file_type;
+		class service { stop reload disable };
+	')
+
+	## <desc>
+	##  <p>
+	##  Let $1 be unkillable.
+	##  </p>
+	## </desc>
+	gen_tunable(`allow_$1_be_unkillable', $2)
+
+	tunable_policy(`! allow_$1_be_unkillable',`
+		allow deepin_executable_file_type $1_t:process { sigkill sigstop signal };
+		allow deepin_executable_file_type $1_t:service { stop reload disable };
+	')
+')
+
+########################################
+## <summary>
+##  let exec file writable.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_execfile_protection',`
+	gen_require(`
+		attribute deepin_executable_file_type;
+	')
+
+	## <desc>
+	##  <p>
+	##  Let $1 can be write.
+	##  </p>
+	## </desc>
+	gen_tunable(`allow_$1_execfile_protection', $2)
+
+	tunable_policy(`! allow_$1_execfile_protection',`
+		allow deepin_executable_file_type $1_t:dir_file_class_set ~{ relabelfrom relabelto };
+	')
+')
+
+########################################
+## <summary>
+##  allow specific domain to access security service.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_access_security_server',`
+	gen_require(`
+		attribute deepin_security_server_domain;
+		class dbus { send_msg };
+	')
+
+	## <desc>
+	##  <p>
+	##  Allow $1 to access security service.
+	##  </p>
+	## </desc>
+	gen_tunable(`allow_$1_access_security_server', $2)
+
+	tunable_policy(`allow_$1_access_security_server',`
+		allow $1_t deepin_security_server_domain:dbus send_msg;
+	')
+')
+
+########################################
+## <summary>
+##  allow specific domain to manage all files which
+##  were labeled to deepin_sidtwo_type.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_manage_all_sidtwo',`
+	gen_require(`
+		attribute deepin_sidtwo_type;
+	')
+
+	## <desc>
+	##  <p>
+	##  Allow $1 to manage deepin_sidtwo_type.
+	##  </p>
+	## </desc>
+	gen_tunable(`allow_$1_manage_all_sidtwo', $2)
+
+	tunable_policy(`allow_$1_manage_all_sidtwo',`
+		allow $1_t deepin_sidtwo_type:dir_file_class_set ~{ relabelfrom relabelto };
+	')
+')
+
+########################################
+## <summary>
+##  Make the specified type usable for
+##  the deepin_wall_paper_resource_type.
+## </summary>
+## <param name="type">
+##  <summary>
+##  Type to be used for deepin_wall_paper_resource_type.
+##  </summary>
+## </param>
+#
+interface(`deepin_wall_paper_resource_type_set',`
+	gen_require(`
+		attribute deepin_wall_paper_resource_type;
+	')
+
+	typeattribute $1 deepin_wall_paper_resource_type;
+')
+
+########################################
+## <summary>
+##  allow specific domain to manage all files which
+##  were labeled to deepin_wall_paper_resource_type.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_manage_wall_paper',`
+	gen_require(`
+		attribute deepin_wall_paper_resource_type;
+	')
+
+	## <desc>
+	##  <p>
+	##  Allow $1 to manage deepin_wall_paper_resource_type.
+	##  </p>
+	## </desc>
+	gen_tunable(`allow_$1_manage_wall_paper', $2)
+
+	tunable_policy(`allow_$1_manage_wall_paper',`
+		allow $1_t deepin_wall_paper_resource_type:file ~{ relabelfrom relabelto };
+		allow $1_t deepin_wall_paper_resource_type:dir ~{ relabelfrom relabelto };
+		allow $1_t deepin_wall_paper_resource_type:lnk_file ~{ relabelfrom relabelto };
+	')
+')
+
+########################################
+## <summary>
+##  Execute a domain transition to
+##  run deepin security verify.
+## </summary>
+## <param name="domain">
+## <summary>
+##  Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`deepin_security_verify_domtrans',`
+	gen_require(`
+		type deepin_security_verify_t, deepin_security_verify_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	files_search_var_lib($1)
+	libs_search_lib($1)
+
+	domtrans_pattern($1, deepin_security_verify_exec_t, deepin_security_verify_t)
+')
+
+########################################
+## <summary>
+##  Execute a domain transition to
+##  run deepin permission manager.
+## </summary>
+## <param name="domain">
+## <summary>
+##  Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`deepin_perm_manager_domtrans',`
+	gen_require(`
+		type deepin_perm_manager_t, deepin_perm_manager_exec_t;
+	')
+
+	domtrans_pattern($1, deepin_perm_manager_exec_t, deepin_perm_manager_t)
+')
+
+########################################
+## <summary>
+##  allow specific domain to send dbus to security enhance.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_dbus_chat_security_enhance',`
+	gen_require(`
+		class dbus { send_msg };
+	')
+	allow $1_t deepin_security_verify_t:dbus send_msg;
+	allow deepin_security_verify_t $1_t:dbus send_msg;
+')
+
+########################################
+## <summary>
+##  allow specific domain to access network.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allow access.
+##  </summary>
+## </param>
+#
+interface(`deepin_access_network',`
+
+	## <desc>
+	##  <p>
+	##  allow $1 to access upstream network.
+	##  </p>
+	## </desc>
+	gen_tunable(`allow_$1_access_net_up', $2)
+
+	## <desc>
+	##  <p>
+	##  allow $1 to access downstream network.
+	##  </p>
+	## </desc>
+	gen_tunable(`allow_$1_access_net_down', $2)
+
+	tunable_policy(`allow_$1_access_net_up',`
+		allow $1_t self:socket { create write };
+	')
+
+	tunable_policy(`allow_$1_access_net_down',`
+		allow $1_t self:socket { create read };
+	')
+')
+
+########################################
+## <summary>
+##  allow domain to access all sensitive resources.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_access_all_sensitive_resource',`
+	# 摄像头
+	deepin_access_camera_resource($1, false)
+
+	# 麦克风
+	deepin_access_microphone_resource($1, false)
+
+	# 文件保护, 可执行文件必须可读, 因此无法配置是否可读
+	deepin_execfile_protection($1, false)
+
+	# 进程防杀
+	deepin_process_unkillable($1, false)
+
+	# 联网管控，默认允许访问网络
+	deepin_access_network($1, true)
+
+	#其他敏感级资源的相关接口调用
+	#....
+')
+
+########################################
+## <summary>
+##  allow domain to access all system resources.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_access_all_system_resource',`
+
+	deepin_access_all_sensitive_resource($1)
+
+	# 拥有访问所有sidtwo的权限
+	deepin_manage_all_sidtwo($1, false)
+
+	# 管理墙纸
+	deepin_manage_wall_paper($1, false)
+
+	# 其他系统级资源的相关接口调用
+	#....
+')
+
+########################################
+## <summary>
+##  allow domain to access all security resources.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_access_all_security_resource',`
+
+	deepin_access_all_sensitive_resource($1)
+
+	# 访问安全服务
+	deepin_access_security_server($1, false)
+
+	# 拥有访问所有sidtwo的权限
+	deepin_manage_all_sidtwo($1, false)
+
+	# 其他安全级资源的相关接口调用
+	#....
+')
+
+
+########################################
+## <summary>
+##  Make general progams in deepin-elf-verify an entrypoint for
+##  the specified domain.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  The domain for which deepin_elf_verify_exec_t is an entrypoint.
+##  </summary>
+## </param>
+#
+interface(`deepin_elfverify_entry_type',`
+	gen_require(`
+		type deepin_elf_verify_exec_t;
+	')
+
+	domain_entry_file($1, deepin_elf_verify_exec_t)
+')
+
+########################################
+## <summary>
+##  Also allow to read a possible deepin-elf-verify symlink.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_read_elf_verify',`
+	gen_require(`
+		type deepin_elf_verify_exec_t;
+	')
+
+	read_lnk_files_pattern($1, deepin_elf_verify_exec_t, deepin_elf_verify_exec_t)
+	read_files_pattern($1, deepin_elf_verify_exec_t, deepin_elf_verify_exec_t)
+')
+
+
+########################################
+## <summary>
+##  Get the attributes of files in bin directories.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_getattr_elf_verify_files',`
+	gen_require(`
+		type deepin_elf_verify_exec_t;
+	')
+
+	getattr_files_pattern($1, deepin_elf_verify_exec_t, deepin_elf_verify_exec_t)
+')
+
+########################################
+## <summary>
+##  execute deepin-elf-verify program.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_exec_elf_verify',`
+	gen_require(`
+		type deepin_elf_verify_exec_t;
+	')
+
+	can_exec($1, deepin_elf_verify_exec_t)
+')
+
+########################################
+## <summary>
+##  Send and receive messages from
+##  deepin-elf-verify over dbus.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`deepin_dbus_chat_deepin_login_counts',`
+	gen_require(`
+		type deepin_login_count_t;
+		class dbus send_msg;
+	')
+
+	allow $1 deepin_login_count_t:dbus send_msg;
+	allow deepin_login_count_t $1:dbus send_msg;
+')
Index: refpolicy-deepin/policy/modules/services/deepin_perm_control.te
===================================================================
--- /dev/null
+++ refpolicy-deepin/policy/modules/services/deepin_perm_control.te
@@ -0,0 +1,860 @@
+policy_module(deepin_perm_control, 1.0.0)
+
+## <desc>
+## <p>
+## deepin gdb flag.
+## </p>
+## </desc>
+gen_tunable(open_deepin_gdb, false)
+
+## <desc>
+## <p>
+## whether init process can enable security service.
+## </p>
+## </desc>
+gen_tunable(can_enable_security_service, true)
+
+## <desc>
+## <p>
+## whether init process can disable security service.
+## </p>
+## </desc>
+gen_tunable(can_disable_security_service, false)
+
+## <desc>
+## <p>
+## enable process audit.
+## </p>
+## </desc>
+gen_tunable(deepin_enable_process_audit, false)
+
+## <desc>
+## <p>
+## enable file audit.
+## </p>
+## </desc>
+gen_tunable(deepin_enable_file_audit, true)
+
+## <desc>
+## <p>
+## enable socket audit.
+## </p>
+## </desc>
+gen_tunable(deepin_enable_socket_audit, false)
+
+## <desc>
+## <p>
+## enable sysadm can gdb security service.
+## </p>
+## </desc>
+gen_tunable(can_gdb_security_service, false)
+
+## <desc>
+## <p>
+## enable process unkillable.
+## </p>
+## </desc>
+gen_tunable(enable_process_unkillable, true)
+
+## <desc>
+##  <p>
+##  Let dpkg can upgrade package.
+##  </p>
+## </desc>
+gen_tunable(`allow_dpkg_upgrade', false)
+
+## <desc>
+##  <p>
+##  use failsafe context directly when root login.
+##  </p>
+## </desc>
+gen_tunable(`root_use_failsafe_context_directly', true)
+
+## <desc>
+##  <p>
+##  open app networking control.
+##  </p>
+## </desc>
+gen_tunable(`open_app_networking_control', false)
+
+## <desc>
+##  <p>
+##  open developer mode of usec.
+##  </p>
+## </desc>
+gen_tunable(`open_usec_developer_mode', false)
+
+########################################
+#
+# permission_manager_dbus_daemon policy
+#
+require {
+	attribute domain;
+	attribute deepin_app_domain;
+	attribute deepin_sys_domain;
+	attribute deepin_sec_domain;
+	attribute deepin_sidtwo_type;
+	attribute deepin_file_type;
+	attribute deepin_readable_file_type;
+	attribute deepin_writable_file_type;
+	attribute deepin_deletable_file_type;
+	attribute deepin_executable_file_type;
+	attribute deepin_usaudit_type;
+	attribute deepin_usaudit_process_type;
+	attribute deepin_usaudit_socket_type;
+	attribute deepin_usaudit_file_type;
+	attribute files_unconfined_type;
+	attribute deepin_security_server_domain;
+	attribute deepin_security_server_sidtwo_domain;
+	attribute deepin_package_manage_domain;
+	attribute unkillable_domain;
+	attribute file_type;
+	attribute packet_type;
+	attribute port_type;
+	attribute node_type;
+	attribute netif_type;
+	attribute proc_type;
+	attribute device_node;
+	attribute filesystem_type;
+	attribute ipsec_spd_type;
+	attribute sysctl_type;
+	attribute systemd_user_session_type;
+	attribute login_userdomain;
+	type sysadm_t;
+	type security_t;
+	class dbus { acquire_svc send_msg };
+	class nscd all_nscd_perms;
+	class context contains;
+	class service all_service_perms;
+	class passwd { passwd chfn chsh rootok crontab };
+	role system_r;
+	type sysadm_t;
+	type sysadm_sudo_t;
+	type dpkg_t;
+	type apt_t;
+	type dpkg_script_t;
+	type unlabeled_t;
+	type kernel_t;
+	type init_t;
+	type systemd_unit_t;
+	type home_root_t;
+	type deepin_elf_verify_t;
+}
+
+# This is default usec label
+type deepin_usec_t;
+deepin_app_domain_set(deepin_usec_t)
+deepin_app_domain_set(kernel_t)
+
+# for app to read selinux config
+selinux_read_policy(deepin_app_domain)
+seutil_read_file_contexts(deepin_app_domain)
+seutil_libselinux_linked(deepin_app_domain)
+
+type deepin_elf_verify_exec_t;
+# files_ro_base_file(deepin_elf_verify_exec_t)
+corecmd_executable_file(deepin_elf_verify_exec_t)
+dev_associate(deepin_elf_verify_exec_t)    #For /dev/MAKEDEV
+
+type deepin_elf_verify_t;
+init_daemon_domain(deepin_elf_verify_t, deepin_elf_verify_exec_t)
+# deepin_domain_set(deepin_elf_verify_t)
+mls_dbus_recv_all_levels(deepin_elf_verify_t)
+domain_mls_exemption(deepin_elf_verify_t)
+
+unconfined_domain(deepin_elf_verify_t)
+mcs_process_set_categories(deepin_elf_verify_t)
+mls_trusted_object(deepin_elf_verify_t)
+mls_process_write_all_levels(deepin_elf_verify_t)
+mls_process_read_all_levels(deepin_elf_verify_t)
+mls_socket_write_all_levels(deepin_elf_verify_t)
+mls_socket_read_all_levels(deepin_elf_verify_t)
+mls_dbus_send_all_levels(deepin_elf_verify_t)
+mls_file_read_all_levels(deepin_elf_verify_t)
+mls_file_write_all_levels(deepin_elf_verify_t)
+mls_fd_use_all_levels(deepin_elf_verify_t)
+mls_fd_share_all_levels(deepin_elf_verify_t)
+deepin_executable_file_type_set(deepin_elf_verify_t)
+read_files_pattern(domain, deepin_elf_verify_t, deepin_elf_verify_t)
+
+permissive deepin_elf_verify_t;
+
+type deepin_perm_manager_unit_t;
+deepin_file_type_set(deepin_perm_manager_unit_t)
+deepin_readable_file_type_set(deepin_perm_manager_unit_t)
+filetrans_pattern(domain, systemd_unit_t, deepin_perm_manager_unit_t, { dir file lnk_file }, "permission-manager.service")
+allow deepin_executable_file_type deepin_perm_manager_unit_t:service status;
+allow { kernel_t init_t } deepin_perm_manager_unit_t:service ~{ enable disable };
+allow deepin_package_manage_domain deepin_perm_manager_unit_t:service *;
+allow deepin_package_manage_domain deepin_perm_manager_unit_t:{ file lnk_file } ~{ relabelfrom };
+allow { kernel_t init_t initrc_t } deepin_perm_manager_unit_t:{ file lnk_file } *;
+allow { deepin_package_manage_domain deepin_elf_verify_t } self:dir_file_class_set ~{ audit_access relabelfrom relabelto };
+
+tunable_policy(`can_enable_security_service',`
+	allow { init_t initrc_t } deepin_perm_manager_unit_t:service enable;
+	allow { init_t initrc_t } deepin_perm_manager_unit_t:lnk_file create_lnk_file_perms;
+')
+
+tunable_policy(`can_disable_security_service',`
+	allow { init_t initrc_t } deepin_perm_manager_unit_t:service disable;
+	allow { init_t initrc_t } deepin_perm_manager_unit_t:lnk_file delete_lnk_file_perms;
+')
+
+role system_r types deepin_sidtwo_type;
+type deepin_perm_manager_exec_t;
+type deepin_perm_manager_t, deepin_security_server_domain;
+dbus_system_domain(deepin_perm_manager_t, deepin_perm_manager_exec_t)
+init_system_domain(deepin_perm_manager_t, deepin_perm_manager_exec_t)
+domain_unconfined(deepin_perm_manager_t)
+domain_mcs_exemption(deepin_perm_manager_t)
+domain_mls_exemption(deepin_perm_manager_t)
+
+type deepin_perm_manager_session_exec_t;
+application_domain(deepin_perm_manager_t, deepin_perm_manager_session_exec_t)
+domtrans_pattern(systemd_user_session_type, deepin_perm_manager_session_exec_t, deepin_perm_manager_t)
+domtrans_pattern(login_userdomain, deepin_perm_manager_session_exec_t, deepin_perm_manager_t)
+
+type deepin_perm_manager_sidtwo_t, deepin_security_server_domain, deepin_security_server_sidtwo_domain;
+deepin_sec_domain_set(deepin_perm_manager_sidtwo_t)
+domain_unkillable(deepin_perm_manager_sidtwo_t)
+domain_mcs_exemption(deepin_perm_manager_sidtwo_t)
+domain_mls_exemption(deepin_perm_manager_sidtwo_t)
+
+type deepin_perm_manager_file_t;
+deepin_file_type_set(deepin_perm_manager_file_t)
+deepin_readable_file_type_set(deepin_perm_manager_file_t)
+type_transition deepin_perm_manager_t etc_t:file deepin_perm_manager_file_t "LocalPropertyRepository.db";
+type_transition deepin_perm_manager_t home_root_t:{ dir file } deepin_home_sec_t ".sec";
+
+type deepin_security_enhance_exec_t;
+type deepin_security_enhance_t, deepin_security_server_domain;
+dbus_system_domain(deepin_security_enhance_t, deepin_security_enhance_exec_t)
+init_system_domain(deepin_security_enhance_t, deepin_security_enhance_exec_t)
+deepin_executable_file_type_set(deepin_security_enhance_t)
+domain_unconfined(deepin_security_enhance_t)
+
+type deepin_security_verify_exec_t;
+type deepin_security_verify_t, deepin_security_server_domain;
+userdom_user_application_domain(deepin_security_verify_t, deepin_security_verify_exec_t)
+deepin_executable_file_type_set(deepin_security_verify_t)
+
+type deepin_security_verify_sidtwo_t, deepin_security_server_domain;
+deepin_sec_domain_set(deepin_security_verify_sidtwo_t)
+
+# for test
+type deepin_perm_manager_test_exec_t;
+domain_entry_file(sysadm_t, deepin_perm_manager_test_exec_t)
+domtrans_pattern(deepin_perm_manager_t, deepin_perm_manager_test_exec_t, sysadm_t)
+
+tunable_policy(`open_deepin_gdb',`
+	allow deepin_usec_t deepin_app_domain:process { ptrace signal sigkill sigstop };
+')
+
+tunable_policy(`open_usec_developer_mode',`
+	allow deepin_usec_t security_t:dir list_dir_perms;
+	allow deepin_usec_t security_t:file rw_file_perms;
+
+	allow deepin_usec_t security_t:security setbool;
+
+	allow deepin_usec_t security_t:security setenforce;
+')
+
+# 注意, 这里由deepin_perm_manager_unit_t 保证服务不被stop就能防止通过systemctl stop来杀安全服务了
+allow initrc_t deepin_security_server_domain:process { signal sigkill sigstop };
+
+tunable_policy(`can_gdb_security_service',`
+	allow deepin_usec_t deepin_security_server_domain:process { ptrace signal sigkill sigstop };
+	allow deepin_usec_t deepin_perm_manager_unit_t:service *;
+	allow sysadm_t deepin_perm_manager_unit_t:service *;
+	allow sysadm_sudo_t deepin_perm_manager_unit_t:service *;
+	deepin_perm_manager_domtrans(sysadm_t)
+	deepin_perm_manager_domtrans(sysadm_sudo_t)
+')
+
+tunable_policy(`! enable_process_unkillable',`
+	allow deepin_executable_file_type unkillable_domain:process { signal sigkill sigstop };
+')
+
+# temporary plan
+deepin_process_unkillable(deepin_perm_manager_sidtwo, true)
+deepin_execfile_protection(deepin_perm_manager_sidtwo, true)
+deepin_process_unkillable(deepin_security_verify_sidtwo, true)
+
+role system_r types deepin_security_server_domain;
+
+allow deepin_security_server_domain self:process *;
+allow deepin_security_server_domain self:dbus *;
+allow deepin_security_server_domain self:association *;
+allow deepin_security_server_domain self:packet *;
+allow deepin_security_server_domain self:fd *;
+allow deepin_security_server_domain self:key *;
+allow deepin_security_server_domain self:context *;
+allow deepin_security_server_domain self:capability *;
+allow deepin_security_server_domain self:capability2 *;
+allow deepin_security_server_domain self:cap_userns *;
+allow deepin_security_server_domain self:cap2_userns *;
+allow deepin_security_server_domain self:socket_class_set *;
+allow deepin_security_server_domain self:key_socket *;
+allow deepin_security_server_domain self:filesystem *;
+allow deepin_security_server_domain self:system *;
+allow deepin_security_server_domain self:service *;
+allow deepin_security_server_domain self:dir_file_class_set *;
+allow deepin_security_server_domain self:{ sem msg msgq shm ipc } *;
+allow deepin_security_server_domain self:nscd *;
+allow deepin_security_server_domain self:passwd *;
+allow deepin_security_server_domain self:bpf *;
+allow deepin_security_server_domain { deepin_executable_file_type unlabeled_t }:process *;
+allow deepin_security_server_domain { deepin_executable_file_type unlabeled_t }:fd *;
+allow deepin_security_server_domain { deepin_executable_file_type unlabeled_t }:key *;
+allow deepin_security_server_domain { deepin_executable_file_type unlabeled_t }:key_socket *;
+allow deepin_security_server_domain { deepin_executable_file_type unlabeled_t }:socket_class_set *;
+allow deepin_security_server_domain { deepin_executable_file_type unlabeled_t }:{ sem msg msgq shm ipc } *;
+allow deepin_security_server_domain { deepin_executable_file_type unlabeled_t }:association *;
+allow deepin_security_server_domain { deepin_executable_file_type unlabeled_t }:dbus { acquire_svc send_msg };
+allow deepin_security_server_domain { deepin_executable_file_type unlabeled_t }:dir_file_class_set *;
+allow deepin_security_server_domain { deepin_executable_file_type unlabeled_t }:system *;
+allow deepin_security_server_domain ipsec_spd_type:association *;
+allow deepin_security_server_domain port_type:{ tcp_socket udp_socket rawip_socket sctp_socket } *;
+allow deepin_security_server_domain { packet_type unlabeled_t }:packet *;
+allow deepin_security_server_domain { node_type unlabeled_t }:node *;
+allow deepin_security_server_domain { netif_type unlabeled_t }:netif *;
+allow deepin_security_server_domain { file_type filesystem_type proc_type sysctl_type }:dir_file_class_set *;
+allow deepin_security_server_domain device_node:dir_file_class_set *;
+allow deepin_security_server_domain { filesystem_type unlabeled_t }:filesystem *;
+allow deepin_security_server_domain { file_type deepin_file_type }:service *;
+allow deepin_security_server_domain security_t:security *;
+allow deepin_security_server_domain file_type:system *;
+allow deepin_security_server_domain deepin_file_type:filesystem *;
+allow deepin_security_server_domain deepin_file_type:dir_file_class_set *;
+allow deepin_security_server_domain deepin_executable_file_type:dir_file_class_set *;
+corenet_all_recvfrom_unlabeled(deepin_security_server_domain)
+domain_all_recvfrom_all_domains(deepin_security_server_domain)
+
+########################################
+#
+# app permission control policy
+#
+
+corecmd_exec_bin(deepin_app_domain)
+corecmd_exec_shell(deepin_app_domain)
+
+# file protect
+allow deepin_executable_file_type deepin_file_type:filesystem { getattr quotaget };
+allow deepin_file_type filesystem_type:filesystem associate;
+allow deepin_file_type self:filesystem associate;
+allow kernel_t deepin_file_type:dir_file_class_set { unlink setattr relabelfrom relabelto };
+allow deepin_executable_file_type deepin_file_type:service *;
+allow deepin_executable_file_type deepin_file_type:dir_file_class_set getattr;
+# 需要允许udev对所有管控和未管控的设备文件都有setattr权限
+allow deepin_executable_file_type deepin_file_type:{ chr_file blk_file } setattr;
+
+allow deepin_executable_file_type deepin_readable_file_type:dir list_dir_perms;
+allow deepin_executable_file_type deepin_readable_file_type:file read_file_perms;
+allow deepin_executable_file_type deepin_readable_file_type:lnk_file read_lnk_file_perms;
+allow deepin_executable_file_type deepin_readable_file_type:chr_file read_chr_file_perms;
+allow deepin_executable_file_type deepin_readable_file_type:blk_file read_blk_file_perms;
+allow deepin_executable_file_type deepin_readable_file_type:sock_file read_sock_file_perms;
+allow deepin_executable_file_type deepin_readable_file_type:fifo_file read_fifo_file_perms;
+allow deepin_executable_file_type deepin_readable_file_type:dir_file_class_set { mounton lock execmod map  };
+allow deepin_executable_file_type deepin_readable_file_type:filesystem { mount remount };
+
+allow deepin_executable_file_type deepin_writable_file_type:dir { setattr_dir_perms create_dir_perms add_entry_dir_perms del_entry_dir_perms };
+allow deepin_executable_file_type deepin_writable_file_type:file { setattr_file_perms create_file_perms write_file_perms map };
+allow deepin_executable_file_type deepin_writable_file_type:lnk_file { setattr_lnk_file_perms create_lnk_file_perms write_lnk_file_perms };
+allow deepin_executable_file_type deepin_writable_file_type:chr_file { setattr_chr_file_perms create_chr_file_perms write_chr_file_perms };
+allow deepin_executable_file_type deepin_writable_file_type:blk_file { setattr_blk_file_perms create_blk_file_perms write_blk_file_perms };
+allow deepin_executable_file_type deepin_writable_file_type:sock_file { setattr_sock_file_perms create_sock_file_perms write_sock_file_perms };
+allow deepin_executable_file_type deepin_writable_file_type:fifo_file { setattr_fifo_file_perms create_fifo_file_perms write_fifo_file_perms };
+allow deepin_executable_file_type deepin_writable_file_type:dir_file_class_set { mounton lock };
+allow deepin_executable_file_type deepin_writable_file_type:filesystem { mount remount };
+
+allow deepin_executable_file_type deepin_deletable_file_type:dir { rename_dir_perms delete_dir_perms reparent };
+allow deepin_executable_file_type deepin_deletable_file_type:file { rename_file_perms delete_file_perms };
+allow deepin_executable_file_type deepin_deletable_file_type:lnk_file { rename_lnk_file_perms delete_lnk_file_perms };
+allow deepin_executable_file_type deepin_deletable_file_type:chr_file { rename_chr_file_perms delete_chr_file_perms };
+allow deepin_executable_file_type deepin_deletable_file_type:blk_file { rename_blk_file_perms delete_blk_file_perms };
+allow deepin_executable_file_type deepin_deletable_file_type:sock_file { rename_sock_file_perms delete_sock_file_perms };
+allow deepin_executable_file_type deepin_deletable_file_type:fifo_file { rename_fifo_file_perms delete_fifo_file_perms };
+allow deepin_executable_file_type deepin_deletable_file_type:dir_file_class_set { mounton lock };
+allow deepin_executable_file_type deepin_deletable_file_type:filesystem { mount remount };
+
+allow deepin_executable_file_type deepin_executable_file_type:dir { list_dir_perms link };
+allow deepin_executable_file_type deepin_executable_file_type:file { exec_file_perms link execmod };
+allow deepin_executable_file_type deepin_executable_file_type:dbus send_msg;
+allow deepin_executable_file_type deepin_executable_file_type:process ~{ setcurrent setexec transition dyntransition setfscreate setsockcreate setkeycreate sigkill sigstop signal };
+allow deepin_executable_file_type deepin_executable_file_type:fd use;
+allow deepin_executable_file_type deepin_executable_file_type:key *;
+allow deepin_executable_file_type deepin_executable_file_type:key_socket ~{ relabelfrom relabelto };
+allow deepin_executable_file_type deepin_executable_file_type:{ sem msg msgq shm ipc } *;
+allow deepin_executable_file_type deepin_executable_file_type:association *;
+allow deepin_executable_file_type deepin_executable_file_type:socket_class_set ~{ relabelfrom relabelto };
+allow deepin_executable_file_type deepin_executable_file_type:dir_file_class_set { mounton lock };
+allow deepin_executable_file_type deepin_executable_file_type:filesystem { mount remount };
+allow deepin_executable_file_type deepin_executable_file_type:service ~{ stop reload };
+
+allow deepin_executable_file_type self:file { exec_file_perms link execmod };
+
+# Implement a blacklist mechanism
+
+########################################
+#
+# deepin_app_domain
+#
+allow deepin_app_domain deepin_executable_file_type:association *;
+allow deepin_app_domain filesystem_type:filesystem associate;
+
+allow deepin_app_domain self:process ~{ setcurrent setexec };
+allow deepin_app_domain self:process2 *;
+allow deepin_app_domain self:dbus *;
+allow deepin_app_domain self:association *;
+allow deepin_app_domain self:packet *;
+allow deepin_app_domain self:fd use;
+allow deepin_app_domain self:key *;
+allow deepin_app_domain self:passwd *;
+allow deepin_app_domain self:context contains;
+allow deepin_app_domain self:capability ~{ sys_boot };
+allow deepin_app_domain self:capability2 ~{ mac_admin };
+allow deepin_app_domain self:cap_userns ~{ sys_boot };
+allow deepin_app_domain self:cap2_userns ~{ mac_admin };
+allow deepin_app_domain self:socket_class_set ~{ relabelfrom relabelto };
+allow deepin_app_domain self:key_socket ~{ relabelfrom relabelto };
+allow deepin_app_domain self:filesystem associate;
+allow { deepin_app_domain -deepin_file_type } self:dir_file_class_set ~{ audit_access relabelfrom relabelto };
+allow deepin_app_domain self:{ sem msg msgq shm ipc } *;
+
+allow deepin_app_domain deepin_executable_file_type:process ~{ setcurrent setexec setfscreate setsockcreate setkeycreate ptrace sigkill sigstop signal };
+allow deepin_app_domain deepin_executable_file_type:process ptrace;
+allow deepin_app_domain deepin_executable_file_type:process2 *;
+allow deepin_app_domain deepin_executable_file_type:system *;
+allow deepin_app_domain deepin_executable_file_type:fd use;
+allow deepin_app_domain deepin_executable_file_type:key *;
+allow deepin_app_domain deepin_executable_file_type:key_socket ~{ relabelfrom relabelto };
+allow deepin_app_domain deepin_executable_file_type:{ sem msg msgq shm ipc } *;
+allow deepin_app_domain deepin_executable_file_type:socket_class_set ~{ relabelfrom relabelto };
+allow deepin_app_domain deepin_app_domain:dir list_dir_perms;
+allow deepin_app_domain { deepin_executable_file_type -deepin_executable_file_type }:{ file lnk_file } ~{ relabelfrom relabelto };
+
+allow deepin_app_domain port_type:{ tcp_socket udp_socket rawip_socket sctp_socket } ~{ relabelfrom relabelto };
+allow deepin_app_domain packet_type:packet *;
+allow deepin_app_domain node_type:node *;
+allow deepin_app_domain netif_type:netif *;
+
+allow deepin_app_domain { file_type filesystem_type proc_type sysctl_type }:dir_file_class_set ~{ relabelfrom relabelto };
+allow deepin_app_domain { file_type filesystem_type proc_type sysctl_type }:system { ipc_info syslog_read syslog_mod syslog_console module_request module_load };
+
+allow deepin_app_domain device_node:{ blk_file chr_file} ~{ audit_access relabelfrom relabelto };
+allow deepin_app_domain filesystem_type:filesystem ~{ relabelfrom relabelto };
+
+# dbus
+allow deepin_app_domain deepin_executable_file_type:dbus send_msg;
+
+# 应用联网管控总开关
+tunable_policy(`! open_app_networking_control',`
+	allow deepin_app_domain self:socket { create read write };
+')
+
+# 默认允许联网
+allow deepin_file_type self:socket { create read write };
+# 文件保护标签不开启防杀，只有进程保护类的标签才能设置防杀
+allow deepin_executable_file_type deepin_file_type:process ~{ setcurrent setexec transition setfscreate setsockcreate setkeycreate };
+
+# dpkg upgrade
+allow deepin_package_manage_domain deepin_sidtwo_type:dir_file_class_set { relabelfrom relabelto };
+allow deepin_package_manage_domain self:capability2 { mac_admin };
+tunable_policy(`allow_dpkg_upgrade',`
+	allow deepin_package_manage_domain deepin_app_domain:dir_file_class_set *;
+	allow deepin_package_manage_domain deepin_file_type:dir_file_class_set *;
+	allow deepin_package_manage_domain deepin_executable_file_type:dir_file_class_set *;
+	allow deepin_package_manage_domain deepin_executable_file_type:process { sigkill signal sigstop setexec };
+')
+
+########################################
+#
+# deepin_sys_domain
+#
+allow deepin_sys_domain self:capability sys_boot;
+allow deepin_sys_domain self:cap_userns sys_boot;
+
+########################################
+#
+# deepin_sec_domain
+#
+allow deepin_sec_domain self:capability sys_boot;
+allow deepin_sec_domain self:cap_userns sys_boot;
+
+# 定义应用程序私有文件的集合，并赋予系统管理员和系统特权域集合files_unconfined_type（包管理器、kernel_t等均加入了此属性集合）访问其的权限
+# 如果应用程序希望定义一个只有自己能访问的类型，则需在应用程序的策略模块中将定义的这个类型加入此属性，并且不将此类型加入file_type属性集合。
+attribute deepin_app_private_file_type;
+allow deepin_app_private_file_type filesystem_type:filesystem associate;
+allow deepin_security_server_domain deepin_app_private_file_type:dir_file_class_set *;
+allow deepin_executable_file_type deepin_app_private_file_type:dir_file_class_set getattr;
+
+# 敏感资源定义
+# ======== storage device control ========
+type deepin_na_storage_device_t;
+deepin_file_type_set(deepin_na_storage_device_t)
+
+type deepin_ro_storage_device_t;
+deepin_file_type_set(deepin_ro_storage_device_t)
+deepin_readable_file_type_set(deepin_ro_storage_device_t)
+
+type deepin_wo_storage_device_t;
+deepin_file_type_set(deepin_wo_storage_device_t)
+deepin_writable_file_type_set(deepin_wo_storage_device_t)
+
+type deepin_wd_storage_device_t;
+deepin_file_type_set(deepin_wd_storage_device_t)
+deepin_writable_file_type_set(deepin_wd_storage_device_t)
+deepin_deletable_file_type_set(deepin_wd_storage_device_t)
+
+type deepin_rw_storage_device_t;
+deepin_file_type_set(deepin_rw_storage_device_t)
+deepin_readable_file_type_set(deepin_rw_storage_device_t)
+deepin_writable_file_type_set(deepin_rw_storage_device_t)
+
+type deepin_rwd_storage_device_t;
+deepin_file_type_set(deepin_rwd_storage_device_t)
+deepin_readable_file_type_set(deepin_rwd_storage_device_t)
+deepin_writable_file_type_set(deepin_rwd_storage_device_t)
+deepin_deletable_file_type_set(deepin_rwd_storage_device_t)
+
+# aa=all access=rwd
+type deepin_aa_storage_device_t;
+deepin_file_type_set(deepin_aa_storage_device_t)
+deepin_readable_file_type_set(deepin_aa_storage_device_t)
+deepin_writable_file_type_set(deepin_aa_storage_device_t)
+deepin_deletable_file_type_set(deepin_aa_storage_device_t)
+
+type deepin_rx_storage_device_t;
+deepin_file_type_set(deepin_rx_storage_device_t)
+deepin_readable_file_type_set(deepin_rx_storage_device_t)
+deepin_executable_file_type_set(deepin_rx_storage_device_t)
+typeattribute deepin_rx_storage_device_t deepin_app_domain;
+
+type deepin_rwx_storage_device_t;
+deepin_file_type_set(deepin_rwx_storage_device_t)
+deepin_readable_file_type_set(deepin_rwx_storage_device_t)
+deepin_writable_file_type_set(deepin_rwx_storage_device_t)
+deepin_executable_file_type_set(deepin_rwx_storage_device_t)
+typeattribute deepin_rwx_storage_device_t deepin_app_domain;
+
+type deepin_rwdx_storage_device_t;
+deepin_file_type_set(deepin_rwdx_storage_device_t)
+deepin_readable_file_type_set(deepin_rwdx_storage_device_t)
+deepin_writable_file_type_set(deepin_rwdx_storage_device_t)
+deepin_deletable_file_type_set(deepin_rwdx_storage_device_t)
+deepin_executable_file_type_set(deepin_rwdx_storage_device_t)
+typeattribute deepin_rwdx_storage_device_t deepin_app_domain;
+
+# ======== file protection ========
+type deepin_na_file_t;
+deepin_file_type_set(deepin_na_file_t)
+
+type deepin_ro_file_t;
+deepin_file_type_set(deepin_ro_file_t)
+deepin_readable_file_type_set(deepin_ro_file_t)
+
+type deepin_wo_file_t;
+deepin_file_type_set(deepin_wo_file_t)
+deepin_writable_file_type_set(deepin_wo_file_t)
+
+type deepin_rw_file_t;
+deepin_file_type_set(deepin_rw_file_t)
+deepin_readable_file_type_set(deepin_rw_file_t)
+deepin_writable_file_type_set(deepin_rw_file_t)
+
+type deepin_wd_file_t;
+deepin_file_type_set(deepin_wd_file_t)
+deepin_writable_file_type_set(deepin_wd_file_t)
+deepin_deletable_file_type_set(deepin_wd_file_t)
+
+type deepin_rwd_file_t;
+deepin_file_type_set(deepin_rwd_file_t)
+deepin_readable_file_type_set(deepin_rwd_file_t)
+deepin_writable_file_type_set(deepin_rwd_file_t)
+deepin_deletable_file_type_set(deepin_rwd_file_t)
+
+type deepin_rx_file_t;
+deepin_file_type_set(deepin_rx_file_t)
+deepin_readable_file_type_set(deepin_rx_file_t)
+deepin_executable_file_type_set(deepin_rx_file_t)
+typeattribute deepin_rx_file_t deepin_app_domain;
+typeattribute deepin_rx_file_t deepin_executable_file_type;
+
+type deepin_rwx_file_t;
+deepin_file_type_set(deepin_rwx_file_t)
+deepin_readable_file_type_set(deepin_rwx_file_t)
+deepin_writable_file_type_set(deepin_rwx_file_t)
+deepin_executable_file_type_set(deepin_rwx_file_t)
+typeattribute deepin_rwx_file_t deepin_app_domain;
+typeattribute deepin_rwx_file_t deepin_executable_file_type;
+
+type deepin_rwdx_file_t;
+deepin_file_type_set(deepin_rwdx_file_t)
+deepin_readable_file_type_set(deepin_rwdx_file_t)
+deepin_writable_file_type_set(deepin_rwdx_file_t)
+deepin_deletable_file_type_set(deepin_rwdx_file_t)
+deepin_executable_file_type_set(deepin_rwdx_file_t)
+typeattribute deepin_rwdx_file_t deepin_app_domain;
+typeattribute deepin_rwdx_file_t deepin_executable_file_type;
+
+# ======== device protection ========
+type deepin_na_dev_t;
+deepin_file_type_set(deepin_na_dev_t)
+
+type deepin_ro_dev_t;
+deepin_file_type_set(deepin_ro_dev_t)
+deepin_readable_file_type_set(deepin_ro_dev_t)
+
+type deepin_wo_dev_t;
+deepin_file_type_set(deepin_wo_dev_t)
+deepin_writable_file_type_set(deepin_wo_dev_t)
+
+type deepin_rw_dev_t;
+deepin_file_type_set(deepin_rw_dev_t)
+deepin_readable_file_type_set(deepin_rw_dev_t)
+deepin_writable_file_type_set(deepin_rw_dev_t)
+
+type deepin_wd_dev_t;
+deepin_file_type_set(deepin_wd_dev_t)
+deepin_writable_file_type_set(deepin_wd_dev_t)
+deepin_deletable_file_type_set(deepin_wd_dev_t)
+
+type deepin_rwd_dev_t;
+deepin_file_type_set(deepin_rwd_dev_t)
+deepin_readable_file_type_set(deepin_rwd_dev_t)
+deepin_writable_file_type_set(deepin_rwd_dev_t)
+deepin_deletable_file_type_set(deepin_rwd_dev_t)
+
+# ======== camera ========
+attribute deepin_app_access_camera_domain;
+attribute deepin_camera_resource_type;
+type deepin_camera_dev_t;
+deepin_file_type_set(deepin_camera_dev_t)
+allow deepin_app_access_camera_domain deepin_camera_resource_type:chr_file ~{ relabelfrom relabelto setattr };
+
+# ======== microphone ========
+attribute deepin_app_access_microphone_domain;
+attribute deepin_microphone_resource_type;
+type deepin_microphone_dev_t;
+deepin_file_type_set(deepin_microphone_dev_t)
+allow deepin_app_access_microphone_domain deepin_microphone_resource_type:chr_file ~{ relabelfrom relabelto setattr };
+
+# ======== cdrom ========
+attribute deepin_app_access_cdrom_domain;
+
+# ======== wall paper resources ========
+attribute deepin_wall_paper_resource_type;
+type deepin_wall_paper_res_t;
+deepin_wall_paper_resource_type_set(deepin_wall_paper_res_t)
+deepin_file_type_set(deepin_wall_paper_res_t)
+deepin_readable_file_type_set(deepin_wall_paper_res_t)
+
+# ======== reboot ========
+#power_unit_t
+
+# ======== Mandatory controled ========
+require {
+	type selinux_config_t;
+	type policy_config_t;
+	type security_t;
+	type default_context_t;
+	type file_context_t;
+	type policy_src_t;
+	type semanage_store_t;
+	type semanage_read_lock_t;
+	type semanage_trans_lock_t;
+	type restorecond_run_t;
+	type restorecond_unit_t;
+	type checkpolicy_exec_t, checkpolicy_t;
+	type load_policy_exec_t, load_policy_t;
+	type newrole_exec_t, newrole_t;
+	type setfiles_exec_t, setfiles_t;
+	type restorecond_exec_t, restorecond_t;
+	type run_init_exec_t, run_init_t;
+	type semanage_exec_t, semanage_t;
+	type dpkg_exec_t;
+	type init_exec_t;
+	type shadow_t;
+	type etc_t;
+	type usr_t;
+	type boot_t;
+	type system_map_t;
+	type var_t;
+	type var_lib_t;
+	type systemd_journal_t;
+	type auditd_log_t;
+	type bin_t;
+	type lib_t;
+}
+
+# selinux resource
+#deepin_controlled_resource_type_set(selinux_config_t)
+#deepin_controlled_resource_type_set(policy_config_t)
+#deepin_controlled_resource_type_set(security_t)
+#deepin_controlled_resource_type_set(default_context_t)
+#deepin_controlled_resource_type_set(file_context_t)
+#deepin_controlled_resource_type_set(policy_src_t)
+#deepin_controlled_resource_type_set(semanage_store_t)
+#deepin_controlled_resource_type_set(semanage_read_lock_t)
+#deepin_controlled_resource_type_set(semanage_trans_lock_t)
+#deepin_controlled_resource_type_set(restorecond_run_t)
+#deepin_controlled_resource_type_set(restorecond_unit_t)
+#deepin_controlled_resource_type_set(checkpolicy_exec_t)
+#deepin_controlled_resource_type_set(load_policy_exec_t)
+#deepin_controlled_resource_type_set(newrole_exec_t)
+#deepin_controlled_resource_type_set(setfiles_exec_t)
+#deepin_controlled_resource_type_set(restorecond_exec_t)
+#deepin_controlled_resource_type_set(run_init_exec_t)
+#deepin_controlled_resource_type_set(semanage_exec_t)
+
+#deepin_controlled_resource_domain_set(checkpolicy_t)
+#deepin_controlled_resource_domain_set(load_policy_t)
+#deepin_controlled_resource_domain_set(newrole_t)
+#deepin_controlled_resource_domain_set(setfiles_t)
+#deepin_controlled_resource_domain_set(restorecond_t)
+#deepin_controlled_resource_domain_set(run_init_t)
+#deepin_controlled_resource_domain_set(semanage_t)
+
+# system admin and security resource
+#deepin_controlled_resource_type_set(dpkg_exec_t)
+#deepin_controlled_resource_type_set(init_exec_t)
+#deepin_controlled_resource_type_set(shadow_t)
+#deepin_controlled_resource_type_set(etc_t)
+#deepin_controlled_resource_type_set(usr_t)
+#deepin_controlled_resource_type_set(boot_t)
+#deepin_controlled_resource_type_set(system_map_t)
+#deepin_controlled_resource_type_set(systemd_journal_t)
+#deepin_controlled_resource_type_set(auditd_log_t)
+#deepin_controlled_resource_type_set(bin_t)
+#deepin_controlled_resource_type_set(lib_t)
+#deepin_controlled_resource_type_set(var_t)
+#deepin_controlled_resource_type_set(var_lib_t)
+
+# ptrace control
+#deepin_controlled_ptrace_domain_set(kernel_t)
+#deepin_controlled_ptrace_domain_set(init_t)
+
+# =============== audit =================
+dontaudit deepin_usaudit_type self:capability audit_control;
+tunable_policy(`deepin_enable_process_audit',`
+	allow deepin_usaudit_type self:capability audit_control;
+	allow deepin_usaudit_process_type self:capability audit_control;
+')
+
+dontaudit deepin_usaudit_type self:dir_file_class_set audit_access;
+tunable_policy(`deepin_enable_file_audit',`
+	allow deepin_usaudit_file_type self:dir_file_class_set audit_access;
+')
+
+dontaudit deepin_usaudit_type self:capability audit_write;
+tunable_policy(`deepin_enable_socket_audit',`
+	allow deepin_usaudit_type self:capability audit_write;
+	allow deepin_usaudit_socket_type self:capability audit_write;
+')
+
+# support xattr
+type deepin_usaudit_t;
+deepin_file_type_set(deepin_usaudit_t)
+deepin_usaudit_type_set(deepin_usaudit_t)
+
+# p: process audit, s: socket audit, f: file audit
+type deepin_usaudit_pxx_t;
+deepin_file_type_set(deepin_usaudit_pxx_t)
+deepin_usaudit_process_type_set(deepin_usaudit_pxx_t)
+
+type deepin_usaudit_xsx_t;
+deepin_file_type_set(deepin_usaudit_xsx_t)
+deepin_usaudit_socket_type_set(deepin_usaudit_xsx_t)
+
+type deepin_usaudit_xxf_t;
+deepin_file_type_set(deepin_usaudit_xxf_t)
+deepin_usaudit_file_type_set(deepin_usaudit_xxf_t)
+
+type deepin_usaudit_psx_t;
+deepin_file_type_set(deepin_usaudit_psx_t)
+deepin_usaudit_process_type_set(deepin_usaudit_psx_t)
+deepin_usaudit_socket_type_set(deepin_usaudit_psx_t)
+
+type deepin_usaudit_pxf_t;
+deepin_file_type_set(deepin_usaudit_pxf_t)
+deepin_usaudit_process_type_set(deepin_usaudit_pxf_t)
+deepin_usaudit_file_type_set(deepin_usaudit_pxf_t)
+
+type deepin_usaudit_xsf_t;
+deepin_file_type_set(deepin_usaudit_xsf_t)
+deepin_usaudit_socket_type_set(deepin_usaudit_xsf_t)
+deepin_usaudit_file_type_set(deepin_usaudit_xsf_t)
+
+type deepin_usaudit_psf_t;
+deepin_file_type_set(deepin_usaudit_psf_t)
+deepin_usaudit_process_type_set(deepin_usaudit_psf_t)
+deepin_usaudit_socket_type_set(deepin_usaudit_psf_t)
+deepin_usaudit_file_type_set(deepin_usaudit_psf_t)
+
+# don't support xattr (use mount_point_sid, so, need grant them appropriate permissions)
+dontaudit deepin_file_type self:capability audit_control;
+dontaudit deepin_file_type self:dir_file_class_set audit_access;
+dontaudit deepin_file_type self:capability audit_write;
+
+type deepin_na_usaudit_t;
+deepin_file_type_set(deepin_na_usaudit_t)
+deepin_usaudit_file_type_set(deepin_na_usaudit_t)
+
+type deepin_ro_usaudit_t;
+deepin_file_type_set(deepin_ro_usaudit_t)
+deepin_readable_file_type_set(deepin_ro_usaudit_t)
+deepin_usaudit_file_type_set(deepin_ro_usaudit_t)
+
+type deepin_wo_usaudit_t;
+deepin_file_type_set(deepin_wo_usaudit_t)
+deepin_writable_file_type_set(deepin_wo_usaudit_t)
+deepin_usaudit_file_type_set(deepin_wo_usaudit_t)
+
+type deepin_rw_usaudit_t;
+deepin_file_type_set(deepin_rw_usaudit_t)
+deepin_readable_file_type_set(deepin_rw_usaudit_t)
+deepin_writable_file_type_set(deepin_rw_usaudit_t)
+deepin_usaudit_file_type_set(deepin_rw_usaudit_t)
+
+type deepin_wd_usaudit_t;
+deepin_file_type_set(deepin_wd_usaudit_t)
+deepin_writable_file_type_set(deepin_wd_usaudit_t)
+deepin_deletable_file_type_set(deepin_wd_usaudit_t)
+deepin_usaudit_file_type_set(deepin_wd_usaudit_t)
+
+type deepin_rwd_usaudit_t;
+deepin_file_type_set(deepin_rwd_usaudit_t)
+deepin_readable_file_type_set(deepin_rwd_usaudit_t)
+deepin_writable_file_type_set(deepin_rwd_usaudit_t)
+deepin_deletable_file_type_set(deepin_rwd_usaudit_t)
+deepin_usaudit_file_type_set(deepin_rwd_usaudit_t)
+
+type deepin_rx_usaudit_t;
+deepin_file_type_set(deepin_rx_usaudit_t)
+deepin_readable_file_type_set(deepin_rx_usaudit_t)
+deepin_executable_file_type_set(deepin_rx_usaudit_t)
+deepin_usaudit_file_type_set(deepin_rx_usaudit_t)
+
+type deepin_rwx_usaudit_t;
+deepin_file_type_set(deepin_rwx_usaudit_t)
+deepin_readable_file_type_set(deepin_rwx_usaudit_t)
+deepin_writable_file_type_set(deepin_rwx_usaudit_t)
+deepin_executable_file_type_set(deepin_rwx_usaudit_t)
+deepin_usaudit_file_type_set(deepin_rwx_usaudit_t)
+
+type deepin_rwdx_usaudit_t;
+deepin_file_type_set(deepin_rwdx_usaudit_t)
+deepin_readable_file_type_set(deepin_rwdx_usaudit_t)
+deepin_writable_file_type_set(deepin_rwdx_usaudit_t)
+deepin_executable_file_type_set(deepin_rwdx_usaudit_t)
+deepin_deletable_file_type_set(deepin_rwd_usaudit_t)
+deepin_usaudit_file_type_set(deepin_rwdx_usaudit_t)
+
+# sid1 that all deepin_executable_file_type can access
+type deepin_home_sec_t;
+files_type(deepin_home_sec_t)
+allow deepin_home_sec_t filesystem_type:filesystem associate;
+allow deepin_home_sec_t self:filesystem associate;
+allow deepin_executable_file_type deepin_home_sec_t:file ~{ relabelfrom relabelto };
+allow deepin_executable_file_type deepin_home_sec_t:dir list_dir_perms;
Index: refpolicy-deepin/policy/modules/services/xserver.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/services/xserver.te
+++ refpolicy-deepin/policy/modules/services/xserver.te
@@ -423,6 +423,12 @@ corecmd_exec_shell(xdm_t)
 corecmd_exec_bin(xdm_t)
 corecmd_shell_entry_type(xdm_t)
 
+
+# for start deepin_elf_verify program
+optional_policy(`
+    deepin_exec_elf_verify(xdm_t)
+')
+
 dev_read_rand(xdm_t)
 dev_read_sysfs(xdm_t)
 dev_getattr_framebuffer_dev(xdm_t)
Index: refpolicy-deepin/policy/modules/services/xserver.te.orig
===================================================================
--- /dev/null
+++ refpolicy-deepin/policy/modules/services/xserver.te.orig
@@ -0,0 +1,1095 @@
+policy_module(xserver)
+
+gen_require(`
+	class x_drawable all_x_drawable_perms;
+	class x_screen all_x_screen_perms;
+	class x_gc all_x_gc_perms;
+	class x_font all_x_font_perms;
+	class x_colormap all_x_colormap_perms;
+	class x_property all_x_property_perms;
+	class x_selection all_x_selection_perms;
+	class x_cursor all_x_cursor_perms;
+	class x_client all_x_client_perms;
+	class x_device all_x_device_perms;
+	class x_pointer all_x_pointer_perms;
+	class x_keyboard all_x_keyboard_perms;
+	class x_server all_x_server_perms;
+	class x_extension all_x_extension_perms;
+	class x_resource all_x_resource_perms;
+	class x_event all_x_event_perms;
+	class x_synthetic_event all_x_synthetic_event_perms;
+')
+
+########################################
+#
+# Declarations
+#
+
+## <desc>
+## <p>
+## Allows the X server to use TCP/IP
+## networking functionality (insecure).
+## </p>
+## </desc>
+gen_tunable(xserver_can_network, false)
+
+## <desc>
+## <p>
+## Allows the X display manager to use
+## TCP/IP networking functionality (insecure).
+## </p>
+## </desc>
+gen_tunable(xserver_xdm_can_network, false)
+
+## <desc>
+## <p>
+## Allow xdm logins as sysadm
+## </p>
+## </desc>
+gen_tunable(xdm_sysadm_login, false)
+
+## <desc>
+## <p>
+## Allows clients to write to the X server shared
+## memory segments.
+## </p>
+## </desc>
+gen_tunable(allow_write_xshm, false)
+
+## <desc>
+## <p>
+## Allows clients to write to the X server tmpfs
+## files.
+## </p>
+## </desc>
+gen_tunable(xserver_client_writes_xserver_tmpfs, false)
+
+## <desc>
+## <p>
+## Use gnome-shell in gdm mode as the
+## X Display Manager (XDM)
+## </p>
+## </desc>
+gen_tunable(xserver_gnome_xdm, false)
+
+## <desc>
+## <p>
+## Support X userspace object manager
+## </p>
+## </desc>
+gen_tunable(xserver_object_manager, false)
+
+## <desc>
+## <p>
+## Allow DRI access
+## </p>
+## </desc>
+gen_tunable(xserver_allow_dri, false)
+
+# for sddm to use pam for greeter
+role xdm_r;
+allow system_r xdm_r;
+
+attribute x_domain;
+
+# X Events
+attribute xevent_type;
+attribute input_xevent_type;
+type xevent_t, xevent_type;
+
+type client_xevent_t, xevent_type;
+
+type input_xevent_t, xevent_type, input_xevent_type;
+
+# X Extensions
+attribute xextension_type;
+type xextension_t, xextension_type;
+type security_xextension_t, xextension_type;
+
+# X Properties
+attribute xproperty_type;
+type xproperty_t, xproperty_type;
+type seclabel_xproperty_t, xproperty_type;
+type clipboard_xproperty_t, xproperty_type;
+
+# X Selections
+attribute xselection_type;
+type xselection_t, xselection_type;
+type clipboard_xselection_t, xselection_type;
+#type settings_xselection_t, xselection_type;
+#type dbus_xselection_t, xselection_type;
+
+# X Drawables
+attribute xdrawable_type;
+attribute xcolormap_type;
+type root_xdrawable_t, xdrawable_type;
+type root_xcolormap_t, xcolormap_type;
+
+attribute xserver_unconfined_type;
+
+xserver_object_types_template(root)
+xserver_object_types_template(user)
+
+type dmrc_home_t;
+userdom_user_home_content(dmrc_home_t)
+
+type remote_t;
+xserver_object_types_template(remote)
+xserver_common_x_domain_template(remote, remote_t)
+
+type user_fonts_t;
+userdom_user_home_content(user_fonts_t)
+
+type user_fonts_cache_t;
+xdg_cache_content(user_fonts_cache_t)
+
+type user_fonts_config_t;
+userdom_user_home_content(user_fonts_config_t)
+
+type iceauth_t;
+type iceauth_exec_t;
+userdom_user_application_domain(iceauth_t, iceauth_exec_t)
+
+type iceauth_home_t;
+userdom_user_home_content(iceauth_home_t)
+userdom_user_runtime_content(iceauth_home_t)
+
+type xauth_t;
+type xauth_exec_t;
+userdom_manage_user_tmp_dirs(xauth_t)
+userdom_user_application_domain(xauth_t, xauth_exec_t)
+
+type xauth_home_t;
+userdom_user_home_content(xauth_home_t)
+
+type xauth_tmp_t;
+userdom_user_tmp_file(xauth_tmp_t)
+
+# this is not actually a device, its a pipe
+type xconsole_device_t;
+files_type(xconsole_device_t)
+dev_associate(xconsole_device_t)
+fs_associate_tmpfs(xconsole_device_t)
+files_associate_tmp(xconsole_device_t)
+
+type xdm_t;
+role xdm_r types { xdm_t xserver_t };
+type xdm_exec_t;
+auth_login_pgm_domain(xdm_t)
+init_domain(xdm_t, xdm_exec_t)
+init_daemon_domain(xdm_t, xdm_exec_t)
+xserver_object_types_template(xdm)
+xserver_common_x_domain_template(xdm, xdm_t)
+
+type xdm_lock_t;
+files_lock_file(xdm_lock_t)
+
+type xdm_rw_etc_t;
+files_type(xdm_rw_etc_t)
+
+type xdm_auth_t;
+files_type(xdm_auth_t)
+
+type xdm_var_lib_t;
+files_type(xdm_var_lib_t)
+
+type xdm_var_run_t;
+files_runtime_file(xdm_var_run_t)
+
+# type for /run/user/%{USERID}/*
+type xdm_runtime_t;
+userdom_user_runtime_content(xdm_runtime_t)
+
+type xdm_tmp_t;
+files_tmp_file(xdm_tmp_t)
+
+type xdm_tmpfs_t;
+files_tmpfs_file(xdm_tmpfs_t)
+
+# type for /var/lib/xkb
+type xkb_var_lib_t;
+files_type(xkb_var_lib_t)
+
+# Type for the executable used to start the X server, e.g. Xwrapper.
+type xserver_t;
+type xserver_exec_t;
+init_system_domain(xserver_t, xserver_exec_t)
+ubac_constrained(xserver_t)
+
+type xserver_tmp_t;
+userdom_user_tmp_file(xserver_tmp_t)
+
+type xserver_tmpfs_t;
+userdom_user_tmpfs_file(xserver_tmpfs_t)
+
+type xsession_exec_t;
+corecmd_executable_file(xsession_exec_t)
+
+type xsession_log_t;
+userdom_user_home_content(xsession_log_t)
+
+# Type for the X server log file.
+type xserver_log_t;
+logging_log_file(xserver_log_t)
+
+type mesa_shader_cache_t;
+xdg_cache_content(mesa_shader_cache_t)
+
+optional_policy(`
+	prelink_object_file(xkb_var_lib_t)
+')
+
+########################################
+#
+# Iceauth local policy
+#
+
+allow iceauth_t iceauth_home_t:file manage_file_perms;
+userdom_user_home_dir_filetrans(iceauth_t, iceauth_home_t, file)
+userdom_user_runtime_filetrans(iceauth_t, iceauth_home_t, file)
+
+allow xdm_t iceauth_home_t:file read_file_perms;
+
+fs_search_auto_mountpoints(iceauth_t)
+
+userdom_use_user_terminals(iceauth_t)
+userdom_read_user_tmp_files(iceauth_t)
+
+xserver_write_inherited_xsession_log(iceauth_t)
+
+tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_files(iceauth_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_files(iceauth_t)
+')
+
+########################################
+#
+# Xauth local policy
+#
+
+allow xauth_t self:process signal;
+allow xauth_t self:unix_stream_socket create_stream_socket_perms;
+
+allow xauth_t xauth_home_t:file manage_file_perms;
+userdom_user_home_dir_filetrans(xauth_t, xauth_home_t, file)
+
+manage_dirs_pattern(xauth_t, xauth_tmp_t, xauth_tmp_t)
+manage_files_pattern(xauth_t, xauth_tmp_t, xauth_tmp_t)
+files_tmp_filetrans(xauth_t, xauth_tmp_t, { file dir })
+
+allow xdm_t xauth_home_t:file manage_file_perms;
+userdom_user_home_dir_filetrans(xdm_t, xauth_home_t, file, ".Xauthority")
+
+allow xauth_t xdm_t:process sigchld;
+allow xauth_t xdm_t:fd use;
+allow xauth_t xdm_t:fifo_file { getattr read };
+allow xauth_t xdm_t:unix_stream_socket { read write };
+
+kernel_request_load_module(xauth_t)
+
+dev_read_sysfs(xauth_t)
+
+domain_use_interactive_fds(xauth_t)
+
+files_read_etc_files(xauth_t)
+files_search_runtime(xauth_t)
+
+fs_getattr_xattr_fs(xauth_t)
+fs_search_auto_mountpoints(xauth_t)
+
+# cjp: why?
+term_use_ptmx(xauth_t)
+
+auth_use_nsswitch(xauth_t)
+
+userdom_use_user_terminals(xauth_t)
+userdom_user_tmp_filetrans(xauth_t, xauth_home_t, file)
+userdom_read_user_tmp_files(xauth_t)
+
+xserver_rw_xdm_tmp_files(xauth_t)
+xserver_stream_connect(xauth_t)
+
+tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_files(xauth_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_files(xauth_t)
+')
+
+optional_policy(`
+	ssh_sigchld(xauth_t)
+	ssh_read_pipes(xauth_t)
+	ssh_dontaudit_rw_tcp_sockets(xauth_t)
+')
+
+########################################
+#
+# XDM Local policy
+#
+
+allow xdm_t self:capability { chown dac_override dac_read_search fowner fsetid ipc_owner kill mknod net_bind_service setgid setuid sys_nice sys_rawio sys_resource sys_tty_config };
+dontaudit xdm_t self:capability sys_admin;
+allow xdm_t self:process { getsched setexec setpgid setrlimit setsched signal_perms };
+allow xdm_t self:fifo_file rw_fifo_file_perms;
+allow xdm_t self:shm create_shm_perms;
+allow xdm_t self:sem create_sem_perms;
+allow xdm_t self:unix_stream_socket { connectto create_stream_socket_perms };
+allow xdm_t self:unix_dgram_socket create_socket_perms;
+allow xdm_t self:socket create_socket_perms;
+allow xdm_t self:appletalk_socket create_socket_perms;
+allow xdm_t self:key { link search write };
+
+# for dbus-broker
+allow xdm_t self:system { start reload };
+
+allow xdm_t xconsole_device_t:fifo_file { read_fifo_file_perms setattr_fifo_file_perms };
+
+# Allow gdm to run gdm-binary
+can_exec(xdm_t, xdm_exec_t)
+
+allow xdm_t xdm_lock_t:file manage_file_perms;
+files_lock_filetrans(xdm_t, xdm_lock_t, file)
+
+# wdm has its own config dir /etc/X11/wdm
+# this is ugly, daemons should not create files under /etc!
+manage_files_pattern(xdm_t, xdm_rw_etc_t, xdm_rw_etc_t)
+
+# files in /run/user/%{USERID}/*
+manage_dirs_pattern(xdm_t, xdm_runtime_t, xdm_runtime_t)
+manage_files_pattern(xdm_t, xdm_runtime_t, xdm_runtime_t)
+
+manage_dirs_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
+manage_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
+manage_sock_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
+files_tmp_filetrans(xdm_t, xdm_tmp_t, { file dir sock_file })
+
+manage_dirs_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
+manage_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
+manage_lnk_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
+manage_fifo_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
+manage_sock_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
+fs_tmpfs_filetrans(xdm_t, xdm_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+
+# this file should be accessed only by xdm_t (rw) and xserver_t (ro)
+manage_dirs_pattern(xdm_t, xdm_auth_t, xdm_auth_t)
+manage_files_pattern(xdm_t, xdm_auth_t, xdm_auth_t)
+xserver_xdm_auth_filetrans(xdm_t, xdm_auth_t, file)
+
+manage_dirs_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)
+manage_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)
+files_var_lib_filetrans(xdm_t, xdm_var_lib_t, file)
+
+manage_dirs_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
+manage_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
+manage_fifo_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
+files_runtime_filetrans(xdm_t, xdm_var_run_t, { dir file fifo_file })
+
+allow xdm_t xserver_t:process signal;
+allow xdm_t xserver_t:unix_stream_socket connectto;
+
+allow xdm_t xserver_tmp_t:sock_file rw_sock_file_perms;
+allow xdm_t xserver_tmp_t:dir { list_dir_perms setattr };
+
+# transition to the xdm xserver
+domtrans_pattern(xdm_t, xserver_exec_t, xserver_t)
+allow xserver_t xdm_t:process signal;
+allow xdm_t xserver_t:process { noatsecure rlimitinh siginh sigkill signal };
+
+allow xdm_t xserver_t:shm rw_shm_perms;
+
+# connect to xdm xserver over stream socket
+stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)
+
+# Remove /tmp/.X11-unix/X0.
+delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
+delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
+
+manage_dirs_pattern(xdm_t, xserver_log_t, xserver_log_t)
+manage_files_pattern(xdm_t, xserver_log_t, xserver_log_t)
+manage_fifo_files_pattern(xdm_t, xserver_log_t, xserver_log_t)
+logging_log_filetrans(xdm_t, xserver_log_t, file)
+
+kernel_read_system_state(xdm_t)
+kernel_read_kernel_sysctls(xdm_t)
+kernel_read_net_sysctls(xdm_t)
+kernel_read_network_state(xdm_t)
+kernel_view_key(xdm_t)
+
+corecmd_exec_shell(xdm_t)
+corecmd_exec_bin(xdm_t)
+corecmd_shell_entry_type(xdm_t)
+
+dev_read_rand(xdm_t)
+dev_read_sysfs(xdm_t)
+dev_getattr_framebuffer_dev(xdm_t)
+dev_setattr_framebuffer_dev(xdm_t)
+dev_getattr_mouse_dev(xdm_t)
+dev_setattr_mouse_dev(xdm_t)
+dev_rw_acpi_bios(xdm_t)
+dev_setattr_acpi_bios_dev(xdm_t)
+dev_rw_dri(xdm_t)
+dev_rw_agp(xdm_t)
+dev_getattr_xserver_misc_dev(xdm_t)
+dev_setattr_xserver_misc_dev(xdm_t)
+dev_getattr_misc_dev(xdm_t)
+dev_setattr_misc_dev(xdm_t)
+dev_dontaudit_rw_misc(xdm_t)
+dev_getattr_video_dev(xdm_t)
+dev_setattr_video_dev(xdm_t)
+dev_getattr_scanner_dev(xdm_t)
+dev_setattr_scanner_dev(xdm_t)
+dev_getattr_sound_dev(xdm_t)
+dev_setattr_sound_dev(xdm_t)
+dev_getattr_power_mgmt_dev(xdm_t)
+dev_setattr_power_mgmt_dev(xdm_t)
+
+domain_use_interactive_fds(xdm_t)
+# Do not audit denied probes of /proc.
+domain_dontaudit_read_all_domains_state(xdm_t)
+
+files_read_etc_files(xdm_t)
+files_read_var_files(xdm_t)
+files_read_etc_runtime_files(xdm_t)
+files_exec_etc_files(xdm_t)
+files_list_mnt(xdm_t)
+# Read /usr/share/terminfo/l/linux and /usr/share/icons/default/index.theme...
+files_map_usr_files(xdm_t)
+files_read_usr_files(xdm_t)
+# Poweroff wants to create the /poweroff file when run from xdm
+files_create_boot_flag(xdm_t)
+
+fs_getattr_all_fs(xdm_t)
+fs_search_auto_mountpoints(xdm_t)
+fs_watch_memory_pressure(xdm_t)
+
+mount_watch_reads_runtime_files(xdm_t)
+
+storage_dontaudit_read_fixed_disk(xdm_t)
+storage_dontaudit_write_fixed_disk(xdm_t)
+storage_dontaudit_setattr_fixed_disk_dev(xdm_t)
+storage_dontaudit_raw_read_removable_device(xdm_t)
+storage_dontaudit_raw_write_removable_device(xdm_t)
+storage_dontaudit_setattr_removable_dev(xdm_t)
+storage_dontaudit_rw_scsi_generic(xdm_t)
+
+term_setattr_console(xdm_t)
+term_use_unallocated_ttys(xdm_t)
+term_setattr_unallocated_ttys(xdm_t)
+
+auth_domtrans_pam_console(xdm_t)
+auth_manage_pam_runtime_dirs(xdm_t)
+auth_manage_pam_runtime_files(xdm_t)
+auth_manage_pam_console_data(xdm_t)
+auth_read_shadow_history(xdm_t)
+auth_use_pam_motd_dynamic(xdm_t)
+auth_write_login_records(xdm_t)
+
+# Run telinit->init to shutdown.
+init_telinit(xdm_t)
+
+init_pgm_entrypoint(xdm_t)
+
+libs_exec_lib_files(xdm_t)
+
+logging_read_generic_logs(xdm_t)
+
+miscfiles_read_hwdata(xdm_t)
+miscfiles_read_localization(xdm_t)
+miscfiles_read_fonts(xdm_t)
+
+sysnet_read_config(xdm_t)
+
+userdom_dontaudit_use_unpriv_user_fds(xdm_t)
+userdom_create_all_users_keys(xdm_t)
+# Search /proc for any user domain processes.
+userdom_read_all_users_state(xdm_t)
+userdom_signal_all_users(xdm_t)
+userdom_user_runtime_filetrans(xdm_t, xdm_runtime_t, dir)
+
+# for .dmrc: this was used by the Gnome Display Manager (gdm)
+# and it is now obsolete in Gnome3
+xserver_read_user_dmrc(xdm_t)
+
+xserver_manage_xsession_log(xdm_t)
+xserver_rw_session(xdm_t, xdm_tmpfs_t)
+xserver_unconfined(xdm_t)
+xserver_user_home_dir_filetrans_user_xsession_log(xdm_t)
+
+tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_dirs(xdm_t)
+	fs_manage_nfs_files(xdm_t)
+	fs_manage_nfs_symlinks(xdm_t)
+	fs_exec_nfs_files(xdm_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_dirs(xdm_t)
+	fs_manage_cifs_files(xdm_t)
+	fs_manage_cifs_symlinks(xdm_t)
+	fs_exec_cifs_files(xdm_t)
+')
+
+tunable_policy(`xdm_sysadm_login',`
+	userdom_xsession_spec_domtrans_all_users(xdm_t)
+	# FIXME:
+#	xserver_rw_session_template(xdm,userdomain)
+',`
+	userdom_xsession_spec_domtrans_unpriv_users(xdm_t)
+	# FIXME:
+#	xserver_rw_session_template(xdm,unpriv_userdomain)
+#	dontaudit xserver_t sysadm_t:shm { unix_read unix_write };
+#	allow xserver_t xdm_tmpfs_t:file rw_file_perms;
+')
+
+tunable_policy(`xserver_gnome_xdm',`
+	allow xdm_t self:process execmem;
+')
+
+tunable_policy(`xserver_xdm_can_network',`
+	allow xdm_t self:tcp_socket create_stream_socket_perms;
+	allow xdm_t self:udp_socket create_socket_perms;
+
+	corenet_all_recvfrom_netlabel(xdm_t)
+	corenet_tcp_sendrecv_generic_if(xdm_t)
+	corenet_udp_sendrecv_generic_if(xdm_t)
+	corenet_tcp_sendrecv_generic_node(xdm_t)
+	corenet_udp_sendrecv_generic_node(xdm_t)
+	corenet_tcp_bind_generic_node(xdm_t)
+	corenet_udp_bind_generic_node(xdm_t)
+	corenet_tcp_connect_all_ports(xdm_t)
+	corenet_sendrecv_all_client_packets(xdm_t)
+	# xdm tries to bind to biff_port_t
+	corenet_dontaudit_tcp_bind_all_ports(xdm_t)
+')
+
+optional_policy(`
+	alsa_domtrans(xdm_t)
+')
+
+optional_policy(`
+	avahi_dbus_chat(xdm_t)
+')
+
+optional_policy(`
+	consoletype_exec(xdm_t)
+')
+
+optional_policy(`
+	allow xdm_t self:process getcap;
+
+	dbus_exec(xdm_t)
+	dbus_system_bus_client(xdm_t)
+	dbus_connect_system_bus(xdm_t)
+
+	optional_policy(`
+		accountsd_dbus_chat(xdm_t)
+	')
+
+	optional_policy(`
+		bluetooth_dbus_chat(xdm_t)
+	')
+
+	optional_policy(`
+		colord_dbus_chat(xdm_t)
+	')
+
+	optional_policy(`
+		devicekit_dbus_chat_power(xdm_t)
+	')
+
+	optional_policy(`
+		auth_use_pam_systemd(xdm_t)
+		systemd_dbus_chat_hostnamed(xdm_t)
+		systemd_read_logind_runtime_files(xdm_t)
+	')
+')
+
+
+optional_policy(`
+	gnome_spec_domtrans_all_gkeyringd(xdm_t)
+')
+
+optional_policy(`
+	# Talk to the console mouse server.
+	gpm_stream_connect(xdm_t)
+	gpm_setattr_gpmctl(xdm_t)
+')
+
+optional_policy(`
+	hostname_exec(xdm_t)
+')
+
+optional_policy(`
+	loadkeys_exec(xdm_t)
+')
+
+optional_policy(`
+	locallogin_signull(xdm_t)
+')
+
+optional_policy(`
+	modemmanager_dbus_chat(xdm_t)
+')
+
+optional_policy(`
+	# Do not audit attempts to check whether user root has email
+	mta_dontaudit_getattr_spool_files(xdm_t)
+')
+
+optional_policy(`
+	plymouthd_domtrans_plymouth(xdm_t)
+')
+
+optional_policy(`
+	resmgr_stream_connect(xdm_t)
+')
+
+optional_policy(`
+	seutil_sigchld_newrole(xdm_t)
+')
+
+optional_policy(`
+	shutdown_domtrans(xdm_t)
+')
+
+optional_policy(`
+	systemd_dbus_chat_locale(xdm_t)
+')
+
+optional_policy(`
+	unconfined_domain(xdm_t)
+	unconfined_domtrans(xdm_t)
+')
+
+optional_policy(`
+	userhelper_dontaudit_search_config(xdm_t)
+')
+
+optional_policy(`
+	usermanage_read_crack_db(xdm_t)
+')
+
+optional_policy(`
+	xfs_stream_connect(xdm_t)
+')
+
+########################################
+#
+# X server local policy
+#
+
+# X Object Manager rules
+type_transition xserver_t xserver_t:x_drawable root_xdrawable_t;
+type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
+type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t;
+
+allow xserver_t { root_xdrawable_t x_domain }:x_drawable send;
+allow xserver_t input_xevent_t:x_event send;
+
+# setuid/setgid for the wrapper program to change UID
+# sys_rawio is for iopl access - should not be needed for frame-buffer
+# sys_admin, locking shared mem?  chowning IPC message queues or semaphores?
+# admin of APM bios?
+# sys_nice is so that the X server can set a negative nice value
+# execheap needed until the X module loader is fixed.
+# NVIDIA Needs execstack
+
+allow xserver_t self:capability { dac_override fowner fsetid ipc_owner mknod net_bind_service setgid setuid sys_admin sys_nice sys_rawio sys_tty_config };
+dontaudit xserver_t self:capability chown;
+allow xserver_t self:capability2 wake_alarm;
+allow xserver_t self:process { dyntransition fork getattr getcap getpgid getrlimit getsched getsession noatsecure rlimitinh setcap setkeycreate setpgid setsched setsockcreate share siginh signal_perms transition };
+allow xserver_t self:fd use;
+allow xserver_t self:fifo_file rw_fifo_file_perms;
+allow xserver_t self:sock_file read_sock_file_perms;
+allow xserver_t self:shm create_shm_perms;
+allow xserver_t self:sem create_sem_perms;
+allow xserver_t self:msgq create_msgq_perms;
+allow xserver_t self:msg { receive send };
+allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
+allow xserver_t self:unix_stream_socket { connectto create_stream_socket_perms };
+allow xserver_t self:netlink_kobject_uevent_socket create_socket_perms;
+
+# this file should be accessed only by xserver_t (ro) and xdm_t (rw)
+allow xserver_t xdm_auth_t:file read_file_perms;
+
+manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
+manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
+manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
+files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
+
+filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file)
+
+manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
+manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
+manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
+manage_fifo_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
+manage_sock_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
+fs_tmpfs_filetrans(xserver_t, xserver_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+allow xserver_t xserver_tmpfs_t:file map;
+
+# Run xkbcomp
+manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
+manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
+files_search_var_lib(xserver_t)
+
+manage_dirs_pattern(xserver_t, mesa_shader_cache_t, mesa_shader_cache_t)
+manage_files_pattern(xserver_t, mesa_shader_cache_t, mesa_shader_cache_t)
+allow xserver_t mesa_shader_cache_t:file map;
+xdg_cache_filetrans(xserver_t, mesa_shader_cache_t, dir, "mesa_shader_cache")
+xdg_generic_user_home_dir_filetrans_cache(xserver_t, dir, ".cache")
+
+# for writing to ~/.local/share/sddm/xorg-session.log
+xdg_manage_data(xauth_t)
+
+domtrans_pattern(xserver_t, xauth_exec_t, xauth_t)
+allow xserver_t xauth_home_t:file read_file_perms;
+
+# Create files in /var/log with the xserver_log_t type.
+manage_files_pattern(xserver_t, xserver_log_t, xserver_log_t)
+logging_log_filetrans(xserver_t, xserver_log_t, file)
+
+kernel_read_system_state(xserver_t)
+kernel_read_device_sysctls(xserver_t)
+kernel_read_modprobe_sysctls(xserver_t)
+# Xorg wants to check if kernel is tainted
+kernel_read_kernel_sysctls(xserver_t)
+kernel_write_proc_files(xserver_t)
+
+# Run helper programs in xserver_t.
+corecmd_exec_bin(xserver_t)
+corecmd_exec_shell(xserver_t)
+
+dev_getattr_sysfs(xserver_t)
+dev_rw_sysfs(xserver_t)
+dev_rw_mouse(xserver_t)
+dev_rw_mtrr(xserver_t)
+dev_rw_acpi_bios(xserver_t)
+dev_rw_agp(xserver_t)
+dev_rw_framebuffer(xserver_t)
+dev_manage_dri_dev(xserver_t)
+dev_filetrans_dri(xserver_t)
+dev_create_generic_dirs(xserver_t)
+dev_setattr_generic_dirs(xserver_t)
+# for other device nodes such as the NVidia binary-only driver
+dev_rw_xserver_misc(xserver_t)
+dev_map_xserver_misc(xserver_t)
+# read events - the synaptics touchpad driver reads raw events
+dev_rw_input_dev(xserver_t)
+dev_rwx_zero(xserver_t)
+
+domain_dontaudit_search_all_domains_state(xserver_t)
+
+files_read_etc_files(xserver_t)
+files_read_etc_runtime_files(xserver_t)
+files_read_usr_files(xserver_t)
+
+# for nscd
+files_dontaudit_search_runtime(xserver_t)
+
+fs_getattr_xattr_fs(xserver_t)
+fs_search_nfs(xserver_t)
+fs_search_auto_mountpoints(xserver_t)
+fs_search_ramfs(xserver_t)
+
+mls_xwin_read_to_clearance(xserver_t)
+
+selinux_validate_context(xserver_t)
+selinux_compute_access_vector(xserver_t)
+selinux_compute_create_context(xserver_t)
+
+auth_use_nsswitch(xserver_t)
+
+init_getpgid(xserver_t)
+
+term_setattr_unallocated_ttys(xserver_t)
+term_use_unallocated_ttys(xserver_t)
+
+getty_use_fds(xserver_t)
+
+locallogin_use_fds(xserver_t)
+
+logging_send_syslog_msg(xserver_t)
+logging_send_audit_msgs(xserver_t)
+
+miscfiles_read_localization(xserver_t)
+miscfiles_read_fonts(xserver_t)
+
+modutils_domtrans(xserver_t)
+
+# read x_contexts
+seutil_read_default_contexts(xserver_t)
+
+userdom_search_user_home_dirs(xserver_t)
+userdom_use_user_ttys(xserver_t)
+userdom_setattr_user_ttys(xserver_t)
+userdom_read_user_tmp_files(xserver_t)
+userdom_map_user_tmpfs_files(xserver_t)
+userdom_rw_user_tmpfs_files(xserver_t)
+
+xserver_use_user_fonts(xserver_t)
+
+ifdef(`enable_mls',`
+	range_transition xserver_t xserver_tmp_t:sock_file s0 - mls_systemhigh;
+	range_transition xserver_t xserver_t:x_drawable s0 - mls_systemhigh;
+')
+
+tunable_policy(`xserver_can_network',`
+	allow xserver_t self:tcp_socket create_stream_socket_perms;
+	allow xserver_t self:udp_socket create_socket_perms;
+
+	corenet_all_recvfrom_netlabel(xserver_t)
+	corenet_tcp_sendrecv_generic_if(xserver_t)
+	corenet_udp_sendrecv_generic_if(xserver_t)
+	corenet_tcp_sendrecv_generic_node(xserver_t)
+	corenet_udp_sendrecv_generic_node(xserver_t)
+	corenet_tcp_bind_generic_node(xserver_t)
+	corenet_tcp_bind_xserver_port(xserver_t)
+	corenet_tcp_connect_all_ports(xserver_t)
+	corenet_sendrecv_xserver_server_packets(xserver_t)
+	corenet_sendrecv_all_client_packets(xserver_t)
+
+	# VNC v4 module in X server
+	corenet_tcp_bind_vnc_port(xserver_t)
+')
+
+tunable_policy(`!xserver_object_manager',`
+	# should be xserver_unconfined(xserver_t),
+	# but typeattribute doesnt work in conditionals
+
+	allow xserver_t self:x_server { debug getattr grab manage record setattr };
+	allow xserver_t { x_domain root_xdrawable_t }:x_drawable { add_child blend create destroy get_property getattr hide list_child list_property manage override read receive remove_child send set_property setattr show write };
+	allow xserver_t self:x_screen { getattr hide_cursor saver_getattr saver_hide saver_setattr saver_show setattr show_cursor };
+	allow xserver_t x_domain:x_gc { create destroy getattr setattr use };
+	allow xserver_t { x_domain root_xcolormap_t }:x_colormap { add_color create destroy getattr install read remove_color uninstall use write };
+	allow xserver_t xproperty_type:x_property { append create destroy getattr read setattr write };
+	allow xserver_t xselection_type:x_selection { getattr read setattr write };
+	allow xserver_t x_domain:x_cursor { create destroy getattr read setattr use write };
+	allow xserver_t x_domain:x_client { destroy getattr manage setattr };
+	allow xserver_t { x_domain xserver_t }:x_device { add bell create destroy force_cursor freeze get_property getattr getfocus grab list_property manage read remove set_property setattr setfocus use write };
+	allow xserver_t { x_domain xserver_t }:x_pointer { add bell create destroy force_cursor freeze get_property getattr getfocus grab list_property manage read remove set_property setattr setfocus use write };
+	allow xserver_t { x_domain xserver_t }:x_keyboard { add bell create destroy force_cursor freeze get_property getattr getfocus grab list_property manage read remove set_property setattr setfocus use write };
+	allow xserver_t xextension_type:x_extension { query use };
+	allow xserver_t { x_domain xserver_t }:x_resource { read write };
+	allow xserver_t xevent_type:{ x_event x_synthetic_event } { receive send };
+')
+
+optional_policy(`
+	acpi_stream_connect(xserver_t)
+')
+
+optional_policy(`
+	auth_search_pam_console_data(xserver_t)
+')
+
+optional_policy(`
+	udev_read_runtime_files(xserver_t)
+')
+
+optional_policy(`
+	unconfined_domain_noaudit(xserver_t)
+	unconfined_domtrans(xserver_t)
+')
+
+optional_policy(`
+	userhelper_search_config(xserver_t)
+')
+
+optional_policy(`
+	xfs_stream_connect(xserver_t)
+')
+
+########################################
+#
+# XDM Xserver local policy
+#
+# cjp: when xdm is configurable via tunable these
+# rules will be enabled only when xdm is enabled
+
+allow xserver_t xdm_t:process { getpgid signal };
+allow xserver_t xdm_t:shm rw_shm_perms;
+
+# NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open
+# handle of a file inside the dir!!!
+allow xserver_t xdm_var_lib_t:file read_inherited_file_perms;
+dontaudit xserver_t xdm_var_lib_t:dir search;
+
+read_files_pattern(xserver_t, xdm_var_run_t, xdm_var_run_t)
+
+# Label pid and temporary files with derived types.
+manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
+manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
+manage_sock_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
+
+# for sddm to use pam for greeter, sddm greeter needs execmod
+allow xdm_t xdm_tmpfs_t:file execmod;
+
+# Run Xorg.wrap
+can_exec(xserver_t, xserver_exec_t)
+
+init_use_fds(xserver_t)
+
+tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_dirs(xserver_t)
+	fs_manage_nfs_files(xserver_t)
+	fs_manage_nfs_symlinks(xserver_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_dirs(xserver_t)
+	fs_manage_cifs_files(xserver_t)
+	fs_manage_cifs_symlinks(xserver_t)
+')
+
+optional_policy(`
+	dbus_system_bus_client(xserver_t)
+')
+
+optional_policy(`
+	resmgr_stream_connect(xserver_t)
+')
+
+########################################
+#
+# Rules common to all X window domains
+#
+
+# Hacks
+# everyone can do override-redirect windows.
+# this could be used to spoof labels
+allow x_domain self:x_drawable override;
+# firefox gets nosy with other people's windows
+allow x_domain x_domain:x_drawable { list_child receive };
+
+# X Server
+# can get X server attributes
+allow x_domain xserver_t:x_server getattr;
+# can grab the server
+allow x_domain xserver_t:x_server grab;
+# can read and write server-owned generic resources
+allow x_domain xserver_t:x_resource { read write };
+# can mess with own clients
+allow x_domain self:x_client { destroy getattr manage };
+
+# X Protocol Extensions
+allow x_domain xextension_t:x_extension { query use };
+allow x_domain security_xextension_t:x_extension { query use };
+
+# X Properties
+# can change properties of root window
+allow x_domain root_xdrawable_t:x_drawable { get_property list_property set_property };
+# can change properties of my own windows
+allow x_domain self:x_drawable { get_property list_property set_property };
+# can read and write cut buffers
+allow x_domain clipboard_xproperty_t:x_property { append create read write };
+# can read security labels
+allow x_domain seclabel_xproperty_t:x_property { getattr read };
+# can change all other properties
+allow x_domain xproperty_t:x_property { append create destroy getattr read write };
+
+# X Windows
+# operations allowed on root windows
+allow x_domain root_xdrawable_t:x_drawable { add_child getattr hide list_child receive remove_child send setattr show };
+# operations allowed on my windows
+allow x_domain self:x_drawable { add_child create destroy getattr hide list_child manage read receive remove_child send setattr show write };
+allow x_domain self:x_drawable { blend };
+# operations allowed on all windows
+allow x_domain x_domain:x_drawable { get_property getattr remove_child set_property };
+
+# X Colormaps
+# can use the default colormap
+allow x_domain root_xcolormap_t:x_colormap { add_color install read remove_color uninstall use };
+# can create and use colormaps
+allow x_domain self:x_colormap { add_color create destroy getattr install read remove_color uninstall use write };
+
+# X Devices
+# operations allowed on my own devices
+allow x_domain self:{ x_device x_pointer x_keyboard } { add bell create destroy force_cursor freeze get_property getattr getfocus grab list_property manage read remove set_property setattr setfocus use write };
+# operations allowed on generic devices
+allow x_domain xserver_t:x_device { bell force_cursor freeze getattr getfocus grab setattr setfocus use };
+# operations allowed on core keyboard
+allow x_domain xserver_t:x_keyboard { bell getattr getfocus grab setattr setfocus use };
+# operations allowed on core pointer
+allow x_domain xserver_t:x_pointer { bell force_cursor freeze getattr getfocus grab read setattr setfocus use };
+
+# all devices can generate input events
+allow x_domain root_xdrawable_t:x_drawable send;
+allow x_domain x_domain:x_drawable send;
+allow x_domain input_xevent_t:x_event send;
+
+# dontaudit keyloggers repeatedly polling
+#dontaudit x_domain xserver_t:x_keyboard read;
+
+# X Input
+# can receive default events
+allow x_domain xevent_t:{ x_event x_synthetic_event } receive;
+# can receive ICCCM events
+allow x_domain client_xevent_t:{ x_event x_synthetic_event } receive;
+# can send ICCCM events to the root window
+allow x_domain client_xevent_t:x_synthetic_event send;
+# can receive root window input events
+allow x_domain root_input_xevent_t:x_event receive;
+
+# X Selections
+# can use the clipboard
+allow x_domain clipboard_xselection_t:x_selection { getattr read setattr };
+# can use default selections
+allow x_domain xselection_t:x_selection { getattr read setattr };
+
+# Other X Objects
+# can create and use cursors
+allow x_domain self:x_cursor { create destroy getattr read setattr use write };
+# can create and use graphics contexts
+allow x_domain self:x_gc { create destroy getattr setattr use };
+# can read and write own objects
+allow x_domain self:x_resource { read write };
+# can mess with the screensaver
+allow x_domain xserver_t:x_screen { getattr saver_getattr };
+
+########################################
+#
+# Rules for unconfined access to this module
+#
+
+tunable_policy(`! xserver_object_manager',`
+	# should be xserver_unconfined(x_domain),
+	# but typeattribute doesnt work in conditionals
+
+	allow x_domain xserver_t:x_server { debug getattr grab manage record setattr };
+	allow x_domain xdrawable_type:x_drawable { add_child blend create destroy get_property getattr hide list_child list_property manage override read receive remove_child send set_property setattr show write };
+	allow x_domain xserver_t:x_screen { getattr hide_cursor saver_getattr saver_hide saver_setattr saver_show setattr show_cursor };
+	allow x_domain x_domain:x_gc { create destroy getattr setattr use };
+	allow x_domain xcolormap_type:x_colormap { add_color create destroy getattr install read remove_color uninstall use write };
+	allow x_domain xproperty_type:x_property { append create destroy getattr read setattr write };
+	allow x_domain xselection_type:x_selection { getattr read setattr write };
+	allow x_domain x_domain:x_cursor { create destroy getattr read setattr use write };
+	allow x_domain x_domain:x_client { destroy getattr manage setattr };
+	allow x_domain { x_domain xserver_t }:x_device { add bell create destroy force_cursor freeze get_property getattr getfocus grab list_property manage read remove set_property setattr setfocus use write };
+	allow x_domain { x_domain xserver_t }:x_pointer { add bell create destroy force_cursor freeze get_property getattr getfocus grab list_property manage read remove set_property setattr setfocus use write };
+	allow x_domain { x_domain xserver_t }:x_keyboard { add bell create destroy force_cursor freeze get_property getattr getfocus grab list_property manage read remove set_property setattr setfocus use write };
+	allow x_domain xextension_type:x_extension { query use };
+	allow x_domain { x_domain xserver_t }:x_resource { read write };
+	allow x_domain xevent_type:{ x_event x_synthetic_event } { receive send };
+')
+
+allow xserver_unconfined_type xserver_t:x_server { debug getattr grab manage record setattr };
+allow xserver_unconfined_type xdrawable_type:x_drawable { add_child blend create destroy get_property getattr hide list_child list_property manage override read receive remove_child send set_property setattr show write };
+allow xserver_unconfined_type xserver_t:x_screen { getattr hide_cursor saver_getattr saver_hide saver_setattr saver_show setattr show_cursor };
+allow xserver_unconfined_type x_domain:x_gc { create destroy getattr setattr use };
+allow xserver_unconfined_type xcolormap_type:x_colormap { add_color create destroy getattr install read remove_color uninstall use write };
+allow xserver_unconfined_type xproperty_type:x_property { append create destroy getattr read setattr write };
+allow xserver_unconfined_type xselection_type:x_selection { getattr read setattr write };
+allow xserver_unconfined_type x_domain:x_cursor { create destroy getattr read setattr use write };
+allow xserver_unconfined_type x_domain:x_client { destroy getattr manage setattr };
+allow xserver_unconfined_type { x_domain xserver_t }:x_device { add bell create destroy force_cursor freeze get_property getattr getfocus grab list_property manage read remove set_property setattr setfocus use write };
+allow xserver_unconfined_type { x_domain xserver_t }:x_pointer { add bell create destroy force_cursor freeze get_property getattr getfocus grab list_property manage read remove set_property setattr setfocus use write };
+allow xserver_unconfined_type { x_domain xserver_t }:x_keyboard { add bell create destroy force_cursor freeze get_property getattr getfocus grab list_property manage read remove set_property setattr setfocus use write };
+allow xserver_unconfined_type xextension_type:x_extension { query use };
+allow xserver_unconfined_type { x_domain xserver_t }:x_resource { read write };
+allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } { receive send };
+
+# for sddm to use pam for greeter
+gen_user(xdm,, xdm_r, s0, s0)
Index: refpolicy-deepin/policy/modules/system/authlogin.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/system/authlogin.te
+++ refpolicy-deepin/policy/modules/system/authlogin.te
@@ -68,9 +68,9 @@ files_runtime_file(pam_var_console_t)
 
 type shadow_t;
 files_auth_file(shadow_t)
-neverallow ~can_read_shadow_passwords shadow_t:file read;
-neverallow ~can_write_shadow_passwords shadow_t:file { create write };
-neverallow ~can_relabelto_shadow_passwords shadow_t:file relabelto;
+#(zzl) neverallow~can_read_shadow_passwords shadow_t:file read;
+#(zzl) neverallow~can_write_shadow_passwords shadow_t:file { create write };
+#(zzl) neverallow~can_relabelto_shadow_passwords shadow_t:file relabelto;
 
 type shadow_lock_t;
 files_lock_file(shadow_lock_t)
Index: refpolicy-deepin/policy/modules/system/selinuxutil.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/system/selinuxutil.te
+++ refpolicy-deepin/policy/modules/system/selinuxutil.te
@@ -69,7 +69,7 @@ role newrole_roles types newrole_t;
 type policy_config_t;
 files_security_file(policy_config_t)
 
-neverallow ~can_relabelto_binary_policy policy_config_t:file relabelto;
+#(zzl) neverallow~can_relabelto_binary_policy policy_config_t:file relabelto;
 #neverallow ~can_write_binary_policy policy_config_t:file { write append };
 
 #
Index: refpolicy-deepin/policy/modules/system/userdomain.if
===================================================================
--- refpolicy-deepin.orig/policy/modules/system/userdomain.if
+++ refpolicy-deepin/policy/modules/system/userdomain.if
@@ -969,11 +969,14 @@ template(`userdom_common_user_template',
 #
 template(`userdom_login_user_template', `
 	gen_require(`
+		attribute login_userdomain;
 		class context contains;
 	')
 
 	userdom_base_user_template($1)
 
+	typeattribute $1_t login_userdomain;
+
 	userdom_manage_home_role($1_r, $1_t)
 
 	userdom_manage_tmp_role($1_r, $1_t)
@@ -4803,6 +4806,44 @@ interface(`userdom_dontaudit_use_user_pt
 
 ########################################
 ## <summary>
+##      Delete user_tmp_t device nodes (probably should not have been
+##	created in the first place)
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain to allow deleting
+##      </summary>
+## </param>
+#
+interface(`userdom_unlink_user_tmp_devices',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	allow $1 user_tmp_t:{ chr_file blk_file } unlink;
+')
+
+########################################
+## <summary>
+##  Mount a filesystem on user tmp dir
+##  directories.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allow access.
+##  </summary>
+## </param>
+#
+interface(`userdom_mounton_user_tmp_dirs',`
+    gen_require(`
+        type user_tmp_t;
+    ')
+
+    allow $1 user_tmp_t:dir mounton;
+')
+
+########################################
+## <summary>
 ##	Relabel files to unprivileged user pty types.
 ## </summary>
 ## <param name="domain">
@@ -4876,25 +4917,6 @@ interface(`userdom_dontaudit_write_user_
 ')
 
 ########################################
-## <summary>
-##      Delete user_tmp_t device nodes (probably should not have been
-##	created in the first place)
-## </summary>
-## <param name="domain">
-##      <summary>
-##      Domain to allow deleting
-##      </summary>
-## </param>
-#
-interface(`userdom_unlink_user_tmp_devices',`
-	gen_require(`
-		type user_tmp_t;
-	')
-
-	allow $1 user_tmp_t:{ chr_file blk_file } unlink;
-')
-
-########################################
 ## <summary>
 ##	Do not audit attempts to use user ttys.
 ## </summary>
Index: refpolicy-deepin/policy/modules/system/userdomain.if.orig
===================================================================
--- /dev/null
+++ refpolicy-deepin/policy/modules/system/userdomain.if.orig
@@ -0,0 +1,5152 @@
+## <summary>Policy for user domains</summary>
+
+#######################################
+## <summary>
+##	The template containing the most basic rules common to all users.
+## </summary>
+## <desc>
+##	<p>
+##	The template containing the most basic rules common to all users.
+##	</p>
+##	<p>
+##	This template creates a user domain, types, and
+##	rules for the user's tty and pty.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <rolebase/>
+#
+template(`userdom_base_user_template',`
+
+	gen_require(`
+		attribute userdomain;
+		type user_devpts_t, user_tty_device_t;
+		class context contains;
+		role $1_r;
+	')
+
+	attribute $1_file_type;
+	attribute $1_application_exec_domain;
+
+	type $1_t, userdomain, $1_application_exec_domain;
+	domain_type($1_t)
+	corecmd_shell_entry_type($1_t)
+	corecmd_bin_entry_type($1_t)
+	domain_user_exemption_target($1_t)
+	ubac_constrained($1_t)
+	role $1_r types $1_t;
+	allow system_r $1_r;
+
+	term_user_pty($1_t, user_devpts_t)
+
+	term_user_tty($1_t, user_tty_device_t)
+
+	allow $1_t self:process { getattr getpgid getsched getsession setcap setpgid setsched share signal_perms };
+	allow $1_t self:fd use;
+	allow $1_t self:key manage_key_perms;
+	allow $1_t self:fifo_file rw_fifo_file_perms;
+	allow $1_t self:unix_dgram_socket { create_socket_perms sendto };
+	allow $1_t self:unix_stream_socket { connectto create_stream_socket_perms };
+	allow $1_t self:shm create_shm_perms;
+	allow $1_t self:sem create_sem_perms;
+	allow $1_t self:msgq create_msgq_perms;
+	allow $1_t self:msg { receive send };
+	allow $1_t self:context contains;
+	dontaudit $1_t self:socket create;
+
+	allow $1_t user_devpts_t:chr_file { rw_chr_file_perms setattr };
+	term_create_pty($1_t, user_devpts_t)
+	# avoid annoying messages on terminal hangup on role change
+	dontaudit $1_t user_devpts_t:chr_file ioctl;
+
+	allow $1_t user_tty_device_t:chr_file { rw_chr_file_perms setattr };
+	# avoid annoying messages on terminal hangup on role change
+	dontaudit $1_t user_tty_device_t:chr_file ioctl;
+
+	kernel_read_kernel_sysctls($1_t)
+	kernel_read_crypto_sysctls($1_t)
+	kernel_read_fs_sysctls($1_t)
+	kernel_read_vm_overcommit_sysctl($1_t)
+	kernel_dontaudit_list_unlabeled($1_t)
+	kernel_dontaudit_getattr_unlabeled_files($1_t)
+	kernel_dontaudit_getattr_unlabeled_symlinks($1_t)
+	kernel_dontaudit_getattr_unlabeled_pipes($1_t)
+	kernel_dontaudit_getattr_unlabeled_sockets($1_t)
+	kernel_dontaudit_getattr_unlabeled_blk_files($1_t)
+	kernel_dontaudit_getattr_unlabeled_chr_files($1_t)
+
+	dev_dontaudit_getattr_all_blk_files($1_t)
+	dev_dontaudit_getattr_all_chr_files($1_t)
+	dev_dontaudit_setattr_null_dev($1_t)
+
+	# for X session unlock
+	allow $1_t self:netlink_audit_socket { create_socket_perms nlmsg_relay };
+
+	# for KDE
+	allow $1_t self:netlink_kobject_uevent_socket connected_socket_perms;
+
+	# When the user domain runs ps, there will be a number of access
+	# denials when ps tries to search /proc. Do not audit these denials.
+	domain_dontaudit_read_all_domains_state($1_t)
+	domain_dontaudit_getattr_all_domains($1_t)
+	domain_dontaudit_getsession_all_domains($1_t)
+
+	files_read_etc_files($1_t)
+	files_watch_etc_dirs($1_t)
+	files_read_etc_runtime_files($1_t)
+	files_read_usr_files($1_t)
+	files_watch_usr_dirs($1_t)
+	files_watch_runtime_dirs($1_t)
+	# Read directories and files with the readable_t type.
+	# This type is a general type for "world"-readable files.
+	files_list_world_readable($1_t)
+	files_read_world_readable_files($1_t)
+	files_read_world_readable_symlinks($1_t)
+	files_read_world_readable_pipes($1_t)
+	files_read_world_readable_sockets($1_t)
+	# old broswer_domain():
+	files_dontaudit_list_non_security($1_t)
+	files_dontaudit_getattr_non_security_files($1_t)
+	files_dontaudit_getattr_non_security_symlinks($1_t)
+	files_dontaudit_getattr_non_security_pipes($1_t)
+	files_dontaudit_getattr_non_security_sockets($1_t)
+
+	libs_exec_ld_so($1_t)
+
+	miscfiles_read_localization($1_t)
+	miscfiles_read_generic_certs($1_t)
+	miscfiles_watch_fonts_dirs($1_t)
+
+	userdom_write_user_runtime_sockets($1_t)
+
+	sysnet_read_config($1_t)
+
+	# kdeinit wants systemd status
+	init_get_system_status($1_t)
+
+	optional_policy(`
+		apt_read_cache($1_t)
+		apt_read_db($1_t)
+	')
+
+	tunable_policy(`allow_execmem',`
+		# Allow loading DSOs that require executable stack.
+		allow $1_t self:process execmem;
+	')
+
+	tunable_policy(`allow_execmem && allow_execstack',`
+		# Allow making the stack executable via mprotect.
+		allow $1_t self:process execstack;
+	')
+
+	tunable_policy(`user_all_users_send_syslog',`
+		logging_send_syslog_msg($1_t)
+	')
+
+	optional_policy(`
+		devicekit_dbus_chat_disk($1_t)
+		devicekit_dbus_chat_power($1_t)
+	')
+
+	optional_policy(`
+		# allow all users to register fingerprints
+		fprintd_dbus_chat($1_t)
+	')
+
+	optional_policy(`
+		kerneloops_dbus_chat($1_t)
+	')
+')
+
+#######################################
+## <summary>
+##	Template for handling user content through standard tunables
+## </summary>
+## <desc>
+##	<p>
+##	This template generates the tunable blocks for accessing
+##	end user content, either the generic one (user_home_t)
+##	or the complete one (based on user_home_content_type).
+##	</p>
+##	<p>
+##	It calls the *_read_generic_user_content,
+##	*_read_all_user_content, *_manage_generic_user_content, and
+##	*_manage_all_user_content booleans.
+##	</p>
+## </desc>
+## <param name="prefix">
+##	<summary>
+##	The application domain prefix to use, meant for the boolean
+##	calls
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	The application domain which is granted the necessary privileges
+##	</summary>
+## </param>
+## <rolebase/>
+#
+template(`userdom_user_content_access_template',`
+	## <desc>
+	##	<p>
+	##	Grant the $1 domains read access to generic user content
+	##	</p>
+	## </desc>
+	gen_tunable(`$1_read_generic_user_content', true)
+
+	## <desc>
+	##	<p>
+	##	Grant the $1 domains read access to all user content
+	##	</p>
+	## </desc>
+	gen_tunable(`$1_read_all_user_content', false)
+
+	## <desc>
+	##	<p>
+	##	Grant the $1 domains manage rights on generic user content
+	##	</p>
+	## </desc>
+	gen_tunable(`$1_manage_generic_user_content', false)
+
+	## <desc>
+	##	<p>
+	##	Grant the $1 domains manage rights on all user content
+	##	</p>
+	## </desc>
+	gen_tunable(`$1_manage_all_user_content', false)
+
+	tunable_policy(`$1_read_generic_user_content',`
+		userdom_list_user_tmp($2)
+		userdom_list_user_home_content($2)
+		userdom_read_user_home_content_files($2)
+		userdom_read_user_home_content_symlinks($2)
+		userdom_read_user_tmp_files($2)
+		userdom_read_user_tmp_symlinks($2)
+	',`
+		files_dontaudit_list_home($2)
+		files_dontaudit_list_tmp($2)
+
+		userdom_dontaudit_list_user_home_dirs($2)
+		userdom_dontaudit_list_user_tmp($2)
+		userdom_dontaudit_read_user_home_content_files($2)
+		userdom_dontaudit_read_user_tmp_files($2)
+	')
+
+	tunable_policy(`$1_read_all_user_content',`
+		userdom_list_user_tmp($2)
+		userdom_read_all_user_home_content($2)
+	')
+
+	tunable_policy(`$1_manage_generic_user_content',`
+		userdom_manage_user_tmp_dirs($2)
+		userdom_manage_user_tmp_files($2)
+		userdom_manage_user_tmp_symlinks($2)
+		userdom_manage_user_home_content_dirs($2)
+		userdom_manage_user_home_content_files($2)
+		userdom_manage_user_home_content_symlinks($2)
+	')
+
+	tunable_policy(`$1_manage_all_user_content',`
+		userdom_manage_all_user_home_content($2)
+	')
+')
+
+#######################################
+## <summary>
+##	Associate the specified domain to be
+##	a domain capable of executing other
+##	applications on behalf of the specified
+##	user.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <rolebase/>
+#
+interface(`userdom_application_exec_domain',`
+	gen_require(`
+		attribute $2_application_exec_domain;
+	')
+
+	typeattribute $1 $2_application_exec_domain;
+')
+
+#######################################
+## <summary>
+##	Allow a home directory for which the
+##	role has read-only access.
+## </summary>
+## <desc>
+##	<p>
+##	Allow a home directory for which the
+##	role has read-only access.
+##	</p>
+##	<p>
+##	This does not allow execute access.
+##	</p>
+## </desc>
+## <param name="role" unused="true">
+##	<summary>
+##	The user role
+##	</summary>
+## </param>
+## <param name="userdomain">
+##	<summary>
+##	The user domain
+##	</summary>
+## </param>
+## <rolebase/>
+#
+interface(`userdom_ro_home_role',`
+	gen_require(`
+		type user_home_t, user_home_dir_t;
+	')
+
+	##############################
+	#
+	# Domain access to home dir
+	#
+
+	type_member $2 user_home_dir_t:dir user_home_dir_t;
+
+	# read-only home directory
+	allow $2 user_home_dir_t:dir list_dir_perms;
+	allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
+	allow $2 user_home_t:dir list_dir_perms;
+	allow $2 user_home_t:file entrypoint;
+	read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
+	read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
+	read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
+	read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
+	files_list_home($2)
+
+	allow $2 { user_home_t user_home_dir_t }:dir {  watch watch_mount watch_reads watch_sb watch_with_perm };
+	allow $2 user_home_t:file { watch watch_mount watch_reads watch_sb watch_with_perm };
+	allow $2 user_home_t:lnk_file { watch watch_mount watch_reads watch_sb watch_with_perm };
+	allow $2 user_home_t:sock_file { watch watch_mount watch_reads watch_sb watch_with_perm };
+	allow $2 user_home_t:fifo_file { watch watch_mount watch_reads watch_sb watch_with_perm };
+
+	tunable_policy(`use_nfs_home_dirs',`
+		fs_list_nfs($2)
+		fs_read_nfs_files($2)
+		fs_read_nfs_symlinks($2)
+		fs_read_nfs_named_sockets($2)
+		fs_read_nfs_named_pipes($2)
+	',`
+		fs_dontaudit_list_nfs($2)
+		fs_dontaudit_read_nfs_files($2)
+	')
+
+	tunable_policy(`use_samba_home_dirs',`
+		fs_list_cifs($2)
+		fs_read_cifs_files($2)
+		fs_read_cifs_symlinks($2)
+		fs_read_cifs_named_sockets($2)
+		fs_read_cifs_named_pipes($2)
+	',`
+		fs_dontaudit_list_cifs($2)
+		fs_dontaudit_read_cifs_files($2)
+	')
+')
+
+#######################################
+## <summary>
+##	Allow a home directory for which the
+##	role has full access.
+## </summary>
+## <desc>
+##	<p>
+##	Allow a home directory for which the
+##	role has full access.
+##	</p>
+##	<p>
+##	This does not allow execute access.
+##	</p>
+## </desc>
+## <param name="role" unused="true">
+##	<summary>
+##	The user role
+##	</summary>
+## </param>
+## <param name="userdomain">
+##	<summary>
+##	The user domain
+##	</summary>
+## </param>
+## <rolebase/>
+#
+interface(`userdom_manage_home_role',`
+	gen_require(`
+		type user_home_t, user_home_dir_t;
+		type user_bin_t, user_cert_t;
+	')
+
+	##############################
+	#
+	# Domain access to home dir
+	#
+
+	type_member $2 user_home_dir_t:dir user_home_dir_t;
+
+	allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
+
+	# full control of the home directory
+	allow $2 user_home_t:file entrypoint;
+	manage_dirs_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
+	manage_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
+	manage_lnk_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
+	manage_sock_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
+	manage_fifo_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
+	relabel_dirs_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
+	relabel_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
+	relabel_lnk_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
+	relabel_sock_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
+	relabel_fifo_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
+	filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
+	files_list_home($2)
+
+	# cjp: this should probably be removed:
+	allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
+
+	allow $2 { user_home_t user_home_dir_t }:dir { watch watch_mount watch_reads watch_sb watch_with_perm };
+	allow $2 user_home_t:file { watch watch_mount watch_reads watch_sb watch_with_perm };
+	allow $2 user_home_t:lnk_file { watch watch_mount watch_reads watch_sb watch_with_perm };
+	allow $2 user_home_t:sock_file { watch watch_mount watch_reads watch_sb watch_with_perm };
+	allow $2 user_home_t:fifo_file { watch watch_mount watch_reads watch_sb watch_with_perm };
+
+	userdom_manage_user_bin($2)
+	userdom_exec_user_bin_files($2)
+	userdom_user_home_dir_filetrans($2, user_bin_t, dir, "bin")
+
+	userdom_manage_user_certs($2)
+	userdom_user_home_dir_filetrans($2, user_cert_t, dir, ".pki")
+
+	tunable_policy(`use_nfs_home_dirs',`
+		fs_manage_nfs_dirs($2)
+		fs_manage_nfs_files($2)
+		fs_manage_nfs_symlinks($2)
+		fs_manage_nfs_named_sockets($2)
+		fs_manage_nfs_named_pipes($2)
+	',`
+		fs_dontaudit_manage_nfs_dirs($2)
+		fs_dontaudit_manage_nfs_files($2)
+	')
+
+	tunable_policy(`use_samba_home_dirs',`
+		fs_manage_cifs_dirs($2)
+		fs_manage_cifs_files($2)
+		fs_manage_cifs_symlinks($2)
+		fs_manage_cifs_named_sockets($2)
+		fs_manage_cifs_named_pipes($2)
+	',`
+		fs_dontaudit_manage_cifs_dirs($2)
+		fs_dontaudit_manage_cifs_files($2)
+	')
+
+	optional_policy(`
+		xdg_data_filetrans($2, user_bin_t, dir, "bin")
+	')
+')
+
+#######################################
+## <summary>
+##	Manage user temporary files
+## </summary>
+## <param name="role" unused="true">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolebase/>
+#
+interface(`userdom_manage_tmp_role',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	files_poly_member_tmp($2, user_tmp_t)
+
+	manage_dirs_pattern($2, user_tmp_t, user_tmp_t)
+	manage_files_pattern($2, user_tmp_t, user_tmp_t)
+	manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
+	manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
+	manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
+	files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
+	userdom_user_runtime_filetrans_user_tmp($2, { dir file lnk_file sock_file fifo_file })
+')
+
+#######################################
+## <summary>
+##	The execute access user temporary files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolebase/>
+#
+interface(`userdom_exec_user_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	exec_files_pattern($1, user_tmp_t, user_tmp_t)
+	files_search_tmp($1)
+	userdom_search_user_runtime($1)
+')
+
+#######################################
+## <summary>
+##	Role access for the user tmpfs type
+##	that the user has full access.
+## </summary>
+## <desc>
+##	<p>
+##	Role access for the user tmpfs type
+##	that the user has full access.
+##	</p>
+##	<p>
+##	This does not allow execute access.
+##	</p>
+## </desc>
+## <param name="role" unused="true">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`userdom_manage_tmpfs_role',`
+	gen_require(`
+		type user_tmpfs_t;
+	')
+
+	manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t)
+	manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
+	manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
+	manage_sock_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
+	manage_fifo_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
+	fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+')
+
+#######################################
+## <summary>
+##	The template allowing the user basic
+##	network permissions
+## </summary>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <rolebase/>
+#
+template(`userdom_basic_networking_template',`
+	gen_require(`
+		type $1_t;
+	')
+
+	allow $1_t self:tcp_socket create_stream_socket_perms;
+	allow $1_t self:udp_socket create_socket_perms;
+
+	corenet_all_recvfrom_netlabel($1_t)
+	corenet_tcp_sendrecv_generic_if($1_t)
+	corenet_udp_sendrecv_generic_if($1_t)
+	corenet_tcp_sendrecv_generic_node($1_t)
+	corenet_udp_sendrecv_generic_node($1_t)
+	corenet_tcp_connect_all_ports($1_t)
+	corenet_sendrecv_all_client_packets($1_t)
+
+	corenet_all_recvfrom_labeled($1_t, $1_t)
+
+	optional_policy(`
+		init_tcp_recvfrom_all_daemons($1_t)
+		init_udp_recvfrom_all_daemons($1_t)
+	')
+
+	optional_policy(`
+		ipsec_match_default_spd($1_t)
+	')
+')
+
+#######################################
+## <summary>
+##	The template for allowing the user to change passwords.
+## </summary>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <rolebase/>
+#
+template(`userdom_change_password_template',`
+	gen_require(`
+		type $1_t;
+		role $1_r;
+	')
+
+	optional_policy(`
+		usermanage_run_chfn($1_t, $1_r)
+		usermanage_run_passwd($1_t, $1_r)
+	')
+')
+
+#######################################
+## <summary>
+##	The template containing rules common to unprivileged
+##	users and administrative users.
+## </summary>
+## <desc>
+##	<p>
+##	This template creates a user domain, types, and
+##	rules for the user's tty, pty, tmp, and tmpfs files.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+#
+template(`userdom_common_user_template',`
+	gen_require(`
+		attribute unpriv_userdomain;
+		type user_runtime_t;
+	')
+
+	userdom_basic_networking_template($1)
+
+	##############################
+	#
+	# User domain Local policy
+	#
+
+	# evolution and gnome-session try to create a netlink socket
+	dontaudit $1_t self:netlink_socket { append bind connect create getattr getopt ioctl read setattr setopt shutdown write };
+	dontaudit $1_t self:netlink_route_socket { append bind connect create getattr getopt ioctl nlmsg_read nlmsg_write read setattr setopt shutdown write };
+
+	# gnome-settings-daemon and some applications create a netlink socket
+	allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
+
+	allow $1_t unpriv_userdomain:fd use;
+
+	kernel_read_system_state($1_t)
+	kernel_read_network_state($1_t)
+	kernel_read_net_sysctls($1_t)
+	# Very permissive allowing every domain to see every type:
+	kernel_get_sysvipc_info($1_t)
+	# Find CDROM devices:
+	kernel_read_device_sysctls($1_t)
+
+	corecmd_exec_bin($1_t)
+
+	corenet_udp_bind_generic_node($1_t)
+	corenet_udp_bind_generic_port($1_t)
+
+	dev_read_rand($1_t)
+	dev_write_sound($1_t)
+	dev_read_sound($1_t)
+	dev_read_sound_mixer($1_t)
+	dev_write_sound_mixer($1_t)
+	dev_read_wireless($1_t)
+
+	files_exec_etc_files($1_t)
+	files_search_locks($1_t)
+	# List mounted filesystems (cdrom, FAT, NTFS and so on)
+	files_list_mnt($1_t)
+	# cjp: perhaps should cut back on file reads:
+	files_read_var_files($1_t)
+	files_read_var_symlinks($1_t)
+	files_read_generic_spool($1_t)
+	files_read_var_lib_files($1_t)
+	# Stat lost+found.
+	files_getattr_lost_found_dirs($1_t)
+	files_watch_etc_dirs($1_t)
+	files_watch_usr_dirs($1_t)
+
+	fs_read_cgroup_files($1_t)
+
+	# cjp: some of this probably can be removed
+	selinux_get_fs_mount($1_t)
+	selinux_validate_context($1_t)
+	selinux_compute_access_vector($1_t)
+	selinux_compute_create_context($1_t)
+	selinux_compute_relabel_context($1_t)
+	selinux_compute_user_contexts($1_t)
+
+	# for eject
+	storage_getattr_fixed_disk_dev($1_t)
+
+	auth_use_nsswitch($1_t)
+	auth_read_login_records($1_t)
+	auth_search_pam_console_data($1_t)
+	auth_run_pam($1_t, $1_r)
+	auth_run_utempter($1_t, $1_r)
+
+	init_read_utmp($1_t)
+
+	seutil_read_file_contexts($1_t)
+	seutil_read_default_contexts($1_t)
+	seutil_run_newrole($1_t, $1_r)
+	seutil_exec_checkpolicy($1_t)
+	seutil_exec_setfiles($1_t)
+	# for when the network connection is killed
+	# this is needed when a login role can change
+	# to this one.
+	seutil_dontaudit_signal_newrole($1_t)
+
+	ifndef(`enable_mls',`
+		tunable_policy(`user_write_removable',`
+			# Read/write floppies and other removable devices
+			storage_raw_read_removable_device($1_t)
+			storage_raw_write_removable_device($1_t)
+		',`
+			# Read floppies
+			storage_raw_read_removable_device($1_t)
+		')
+	')
+
+	tunable_policy(`user_direct_mouse',`
+		dev_read_mouse($1_t)
+	')
+
+	tunable_policy(`user_rw_noexattrfile',`
+		fs_manage_noxattr_fs_dirs($1_t)
+		fs_manage_noxattr_fs_files($1_t)
+		fs_manage_noxattr_fs_symlinks($1_t)
+	',`
+		fs_read_noxattr_fs_files($1_t)
+		fs_read_noxattr_fs_symlinks($1_t)
+	')
+
+	tunable_policy(`user_ttyfile_stat',`
+		term_getattr_all_ttys($1_t)
+	')
+
+	tunable_policy(`user_write_removable',`
+		# Read/write USB devices (e.g. external removable USB mass storage devices)
+		dev_rw_generic_usb_dev($1_t)
+	',`
+		# Read USB devices (e.g. external removable USB mass storage devices)
+		dev_read_generic_usb_dev($1_t)
+	')
+
+
+	optional_policy(`
+		alsa_home_filetrans_alsa_home($1_t, file, ".asoundrc")
+		alsa_manage_home_files($1_t)
+		alsa_read_config($1_t)
+		alsa_relabel_home_files($1_t)
+	')
+
+	optional_policy(`
+		# Allow graphical boot to check battery lifespan
+		acpi_stream_connect($1_t)
+	')
+
+	optional_policy(`
+		canna_stream_connect($1_t)
+	')
+
+	optional_policy(`
+		cockpit_role_template($1, $1_t, $1_r)
+	')
+
+	optional_policy(`
+		dbus_role_template($1, $1_r, $1_t)
+		dbus_system_bus_client($1_t)
+
+		optional_policy(`
+			accountsd_dbus_chat($1_t)
+		')
+
+		optional_policy(`
+			bluetooth_dbus_chat($1_t)
+		')
+
+		optional_policy(`
+			colord_dbus_chat($1_t)
+		')
+
+		optional_policy(`
+			cups_dbus_chat_config($1_t)
+		')
+
+		optional_policy(`
+			devicekit_dbus_chat_disk($1_t)
+			devicekit_dbus_chat_power($1_t)
+		')
+
+		optional_policy(`
+			networkmanager_dbus_chat($1_t)
+		')
+
+		optional_policy(`
+			policykit_dbus_chat($1_t)
+		')
+
+		optional_policy(`
+			rtkit_daemon_dbus_chat($1_t)
+		')
+
+		optional_policy(`
+			xserver_dbus_chat_xdm($1_t)
+		')
+
+		optional_policy(`
+			systemd_role_template($1, $1_r, $1_t)
+			systemd_user_app_socket_create($1, $1_t, user_runtime_t)
+		')
+	')
+
+	optional_policy(`
+		dpkg_read_db($1_t)
+	')
+
+	optional_policy(`
+		gssproxy_stream_connect($1_t)
+	')
+
+	optional_policy(`
+		hwloc_exec_dhwd($1_t)
+		hwloc_read_runtime_files($1_t)
+	')
+
+	optional_policy(`
+		inetd_use_fds($1_t)
+		inetd_rw_tcp_sockets($1_t)
+	')
+
+	optional_policy(`
+		inn_read_config($1_t)
+		inn_read_news_lib($1_t)
+		inn_read_news_spool($1_t)
+	')
+
+	optional_policy(`
+		kerberos_manage_krb5_home_files($1_t)
+		kerberos_relabel_krb5_home_files($1_t)
+		kerberos_home_filetrans_krb5_home($1_t, file, ".k5login")
+	')
+
+	optional_policy(`
+		locate_read_lib_files($1_t)
+	')
+
+	optional_policy(`
+		mpd_manage_user_data_content($1_t)
+		mpd_relabel_user_data_content($1_t)
+	')
+
+	# for running depmod as part of the kernel packaging process
+	optional_policy(`
+		modutils_read_module_config($1_t)
+	')
+
+	optional_policy(`
+		mta_rw_spool($1_t)
+	')
+
+	optional_policy(`
+		mysql_manage_mysqld_home_files($1_t)
+		mysql_relabel_mysqld_home_files($1_t)
+		mysql_home_filetrans_mysqld_home($1_t, file, ".my.cnf")
+
+		tunable_policy(`allow_user_mysql_connect',`
+			mysql_stream_connect($1_t)
+		')
+	')
+
+	optional_policy(`
+		oident_manage_user_content($1_t)
+		oident_relabel_user_content($1_t)
+		oident_home_filetrans_oidentd_home($1_t, file, ".oidentd.conf")
+	')
+
+	optional_policy(`
+		pcscd_read_runtime_files($1_t)
+		pcscd_stream_connect($1_t)
+	')
+
+	optional_policy(`
+		tunable_policy(`allow_user_postgresql_connect',`
+			postgresql_stream_connect($1_t)
+			postgresql_tcp_connect($1_t)
+		')
+	')
+
+	optional_policy(`
+		ppp_manage_home_files($1_t)
+		ppp_relabel_home_files($1_t)
+		ppp_home_filetrans_ppp_home($1_t, file, ".ppprc")
+	')
+
+	optional_policy(`
+		resmgr_stream_connect($1_t)
+	')
+
+	optional_policy(`
+		rpc_dontaudit_getattr_exports($1_t)
+		rpc_manage_nfs_rw_content($1_t)
+	')
+
+	optional_policy(`
+		samba_stream_connect_winbind($1_t)
+	')
+
+	optional_policy(`
+		slrnpull_search_spool($1_t)
+	')
+
+	optional_policy(`
+		udev_read_runtime_files($1_t)
+	')
+
+	optional_policy(`
+		usernetctl_run($1_t, $1_r)
+	')
+
+	optional_policy(`
+		systemd_dbus_chat_locale($1_t)
+		systemd_stream_connect_userdb($1_t)
+	')
+
+	optional_policy(`
+		virt_home_filetrans_virt_home($1_t, dir, ".libvirt")
+		virt_home_filetrans_virt_home($1_t, dir, ".virtinst")
+		virt_home_filetrans_virt_content($1_t, dir, "isos")
+		virt_home_filetrans_svirt_home($1_t, dir, "qemu")
+		virt_home_filetrans_virt_home($1_t, dir, "VirtualMachines")
+	')
+')
+
+#######################################
+## <summary>
+##	The template for creating a login user.
+## </summary>
+## <desc>
+##	<p>
+##	This template creates a user domain, types, and
+##	rules for the user's tty, pty, home directories,
+##	tmp, and tmpfs files.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+#
+template(`userdom_login_user_template', `
+	gen_require(`
+		class context contains;
+	')
+
+	userdom_base_user_template($1)
+
+	userdom_manage_home_role($1_r, $1_t)
+
+	userdom_manage_tmp_role($1_r, $1_t)
+	userdom_manage_tmpfs_role($1_r, $1_t)
+
+	userdom_exec_user_tmp_files($1_t)
+	userdom_exec_user_home_content_files($1_t)
+
+	userdom_execmod_user_tmpfs_files($1_t)
+	userdom_map_user_tmpfs_files($1_t)
+
+	userdom_change_password_template($1)
+
+	##############################
+	#
+	# User domain Local policy
+	#
+
+	allow $1_t self:capability { chown fowner setgid };
+	dontaudit $1_t self:capability { fsetid sys_nice };
+
+	allow $1_t self:process { dyntransition getattr getcap getpgid getrlimit getsched getsession noatsecure ptrace rlimitinh setcap setfscreate setkeycreate setpgid setsched setsockcreate share siginh signal_perms transition };
+	dontaudit $1_t self:process setrlimit;
+	dontaudit $1_t self:netlink_route_socket { append bind connect create getattr getopt ioctl nlmsg_read nlmsg_write read setattr setopt shutdown write };
+
+	allow $1_t self:context contains;
+
+	allow $1_t self:anon_inode { create read write map };
+
+	kernel_dontaudit_read_system_state($1_t)
+
+	dev_read_sysfs($1_t)
+	dev_read_urand($1_t)
+
+	domain_use_interactive_fds($1_t)
+	# Command completion can fire hundreds of denials
+	domain_dontaudit_exec_all_entry_files($1_t)
+
+	files_dontaudit_list_default($1_t)
+	files_dontaudit_read_default_files($1_t)
+	# Stat lost+found.
+	files_getattr_lost_found_dirs($1_t)
+
+	fs_get_all_fs_quotas($1_t)
+	fs_getattr_all_fs($1_t)
+	fs_getattr_all_dirs($1_t)
+	fs_search_auto_mountpoints($1_t)
+	fs_list_cgroup_dirs($1_t)
+	fs_list_inotifyfs($1_t)
+	fs_rw_anon_inodefs_files($1_t)
+	fs_dontaudit_rw_cgroup_files($1_t)
+
+	auth_dontaudit_write_login_records($1_t)
+
+	application_exec_all($1_t)
+
+	# The library functions always try to open read-write first,
+	# then fall back to read-only if it fails.
+	init_dontaudit_rw_utmp($1_t)
+	# Stop warnings about access to /dev/console
+	init_dontaudit_use_fds($1_t)
+	init_dontaudit_use_script_fds($1_t)
+
+	# read interface is needed for lock access
+	libs_read_lib_files($1_t)
+	libs_watch_lib_dirs($1_t)
+	libs_exec_lib_files($1_t)
+
+	logging_dontaudit_getattr_all_logs($1_t)
+
+	miscfiles_read_man_pages($1_t)
+	# map is needed for man-dbs apropos program
+	miscfiles_map_man_cache($1_t)
+	miscfiles_read_public_files($1_t)
+	# for running TeX programs
+	miscfiles_read_tetex_data($1_t)
+	miscfiles_exec_tetex_data($1_t)
+
+	seutil_read_config($1_t)
+
+	optional_policy(`
+		cups_read_config($1_t)
+		cups_stream_connect($1_t)
+	')
+
+	optional_policy(`
+		kerberos_use($1_t)
+	')
+
+	optional_policy(`
+		mta_dontaudit_read_spool_symlinks($1_t)
+	')
+
+	optional_policy(`
+		quota_dontaudit_getattr_db($1_t)
+	')
+
+	optional_policy(`
+		rpm_read_db($1_t)
+		rpm_dontaudit_manage_db($1_t)
+	')
+')
+
+#######################################
+## <summary>
+##	The template for creating a unprivileged login user.
+## </summary>
+## <desc>
+##	<p>
+##	This template creates a user domain, types, and
+##	rules for the user's tty, pty, home directories,
+##	tmp, and tmpfs files.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+#
+template(`userdom_restricted_user_template',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	userdom_login_user_template($1)
+
+	typeattribute $1_t unpriv_userdomain;
+	domain_interactive_fd($1_t)
+
+	##############################
+	#
+	# Local policy
+	#
+
+	optional_policy(`
+		loadkeys_run($1_t, $1_r)
+	')
+')
+
+#######################################
+## <summary>
+##	The template for creating a unprivileged xwindows login user.
+## </summary>
+## <desc>
+##	<p>
+##	The template for creating a unprivileged xwindows login user.
+##	</p>
+##	<p>
+##	This template creates a user domain, types, and
+##	rules for the user's tty, pty, home directories,
+##	tmp, and tmpfs files.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+#
+template(`userdom_restricted_xwindows_user_template',`
+
+	userdom_restricted_user_template($1)
+
+	##############################
+	#
+	# Local policy
+	#
+
+	auth_role($1, $1_t, $1_application_exec_domain, $1_r)
+	auth_search_pam_console_data($1_t)
+
+	dev_read_sound($1_t)
+	dev_write_sound($1_t)
+	# gnome keyring wants to read this.
+	dev_dontaudit_read_rand($1_t)
+
+	logging_send_syslog_msg($1_t)
+	logging_dontaudit_send_audit_msgs($1_t)
+
+	selinux_get_enforce_mode($1_t)
+
+	xserver_restricted_role($1, $1_t, $1_application_exec_domain, $1_r)
+
+	optional_policy(`
+		alsa_read_config($1_t)
+	')
+
+	optional_policy(`
+		dbus_role_template($1, $1_r, $1_t)
+		dbus_system_bus_client($1_t)
+
+		optional_policy(`
+			cups_dbus_chat($1_t)
+		')
+
+		optional_policy(`
+			gnome_role_template($1, $1_t, $1_application_exec_domain, $1_r)
+		')
+
+		optional_policy(`
+			systemd_role_template($1, $1_r, $1_t)
+		')
+
+		optional_policy(`
+			wm_role_template($1, $1_t, $1_application_exec_domain, $1_r)
+		')
+	')
+
+	optional_policy(`
+		java_role($1, $1_t, $1_application_exec_domain, $1_r)
+	')
+
+	optional_policy(`
+		pulseaudio_role($1, $1_t, $1_application_exec_domain, $1_r)
+	')
+
+	optional_policy(`
+		setroubleshoot_dontaudit_stream_connect($1_t)
+	')
+')
+
+#######################################
+## <summary>
+##	The template for creating a unprivileged user roughly
+##	equivalent to a regular linux user.
+## </summary>
+## <desc>
+##	<p>
+##	The template for creating a unprivileged user roughly
+##	equivalent to a regular linux user.
+##	</p>
+##	<p>
+##	This template creates a user domain, types, and
+##	rules for the user's tty, pty, home directories,
+##	tmp, and tmpfs files.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+#
+template(`userdom_unpriv_user_template', `
+
+	##############################
+	#
+	# Declarations
+	#
+
+	# Inherit rules for ordinary users.
+	userdom_restricted_user_template($1)
+	userdom_common_user_template($1)
+
+	##############################
+	#
+	# Local policy
+	#
+
+	# port access is audited even if dac would not have allowed it, so dontaudit it here
+	corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
+	# Need the following rule to allow users to run vpnc
+	corenet_tcp_bind_xserver_port($1_t)
+
+	files_exec_usr_files($1_t)
+	files_watch_etc_symlinks($1_t)
+
+	miscfiles_manage_public_files($1_t)
+	miscfiles_watch_localization($1_t)
+	miscfiles_watch_public_dirs($1_t)
+
+	tunable_policy(`user_dmesg',`
+		kernel_read_ring_buffer($1_t)
+	',`
+		kernel_dontaudit_read_ring_buffer($1_t)
+	')
+
+	tunable_policy(`user_exec_noexattrfile',`
+		fs_exec_noxattr($1_t)
+	')
+
+	# Allow users to run TCP servers (bind to ports and accept connection from
+	# the same domain and outside users) disabling this forces FTP passive mode
+	# and may change other protocols
+	tunable_policy(`user_tcp_server',`
+		corenet_tcp_bind_generic_node($1_t)
+		corenet_tcp_bind_generic_port($1_t)
+		corenet_tcp_bind_all_unreserved_ports($1_t)
+	')
+
+	# Allow users to run UDP servers (bind to ports and accept connection from
+	# the same domain and outside users)
+	tunable_policy(`user_udp_server',`
+		corenet_udp_bind_generic_node($1_t)
+		corenet_udp_bind_generic_port($1_t)
+		corenet_udp_bind_all_unreserved_ports($1_t)
+	')
+
+	optional_policy(`
+		netutils_run_ping_cond($1_t, $1_r)
+		netutils_run_traceroute_cond($1_t, $1_r)
+	')
+
+	# Run pppd in pppd_t by default for user
+	optional_policy(`
+		ppp_run_cond($1_t, $1_r)
+	')
+
+	optional_policy(`
+		setroubleshoot_stream_connect($1_t)
+	')
+
+	optional_policy(`
+		# kwalletd5 inherits a socket from init
+		init_rw_inherited_stream_socket($1_t)
+		init_use_fds($1_t)
+		# for polkit-kde-auth
+		init_read_state($1_t)
+
+		systemd_dbus_chat_logind($1_t)
+		systemd_use_logind_fds($1_t)
+		systemd_dbus_chat_hostnamed($1_t)
+		systemd_write_inherited_logind_inhibit_pipes($1_t)
+	')
+
+	# Allow users to manage xdg content in their home directories
+	optional_policy(`
+		userdom_xdg_user_template($1)
+	')
+
+	# Allow controlling usbguard
+	optional_policy(`
+		tunable_policy(`usbguard_user_modify_rule_files',`
+			usbguard_stream_connect($1_t)
+		')
+	')
+')
+
+#######################################
+## <summary>
+##	The template for creating an administrative user.
+## </summary>
+## <desc>
+##	<p>
+##	This template creates a user domain, types, and
+##	rules for the user's tty, pty, home directories,
+##	tmp, and tmpfs files.
+##	</p>
+##	<p>
+##	The privileges given to administrative users are:
+##	<ul>
+##		<li>Raw disk access</li>
+##		<li>Set all sysctls</li>
+##		<li>All kernel ring buffer controls</li>
+##		<li>Create, read, write, and delete all files but shadow</li>
+##		<li>Manage source and binary format SELinux policy</li>
+##		<li>Run insmod</li>
+##	</ul>
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., sysadm
+##	is the prefix for sysadm_t).
+##	</summary>
+## </param>
+#
+template(`userdom_admin_user_template',`
+	gen_require(`
+		attribute admindomain;
+		class passwd { chfn chsh passwd rootok };
+	')
+
+	##############################
+	#
+	# Declarations
+	#
+
+	# Inherit rules for ordinary users.
+	userdom_login_user_template($1)
+	userdom_common_user_template($1)
+
+	domain_obj_id_change_exemption($1_t)
+	role system_r types $1_t;
+
+	typeattribute $1_t admindomain;
+
+	ifdef(`direct_sysadm_daemon',`
+		domain_system_change_exemption($1_t)
+	')
+
+	##############################
+	#
+	# $1_t local policy
+	#
+
+	allow $1_t self:capability { chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_broadcast net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config };
+	allow $1_t self:cap_userns sys_ptrace;
+	allow $1_t self:process { setexec setfscreate };
+	allow $1_t self:netlink_audit_socket nlmsg_readpriv;
+	allow $1_t self:netlink_tcpdiag_socket create_netlink_socket_perms;
+	allow $1_t self:tun_socket create;
+	# Set password information for other users.
+	allow $1_t self:passwd { chfn chsh passwd };
+	# Skip authentication when pam_rootok is specified.
+	allow $1_t self:passwd rootok;
+
+	kernel_read_software_raid_state($1_t)
+	kernel_getattr_core_if($1_t)
+	kernel_getattr_message_if($1_t)
+	kernel_change_ring_buffer_level($1_t)
+	kernel_clear_ring_buffer($1_t)
+	kernel_read_ring_buffer($1_t)
+	kernel_read_psi($1_t)
+	kernel_get_sysvipc_info($1_t)
+	kernel_rw_all_sysctls($1_t)
+	# signal unlabeled processes:
+	kernel_kill_unlabeled($1_t)
+	kernel_signal_unlabeled($1_t)
+	kernel_sigstop_unlabeled($1_t)
+	kernel_signull_unlabeled($1_t)
+	kernel_sigchld_unlabeled($1_t)
+
+	corenet_tcp_bind_generic_port($1_t)
+	# allow setting up tunnels
+	corenet_rw_tun_tap_dev($1_t)
+
+	dev_getattr_generic_blk_files($1_t)
+	dev_getattr_generic_chr_files($1_t)
+	# for lsof
+	dev_getattr_mtrr_dev($1_t)
+	# Allow MAKEDEV to work
+	dev_create_all_blk_files($1_t)
+	dev_create_all_chr_files($1_t)
+	dev_delete_all_blk_files($1_t)
+	dev_delete_all_chr_files($1_t)
+	dev_rename_all_blk_files($1_t)
+	dev_rename_all_chr_files($1_t)
+	dev_create_generic_symlinks($1_t)
+	dev_rw_wireless($1_t)
+
+	domain_setpriority_all_domains($1_t)
+	domain_read_all_domains_state($1_t)
+	domain_getattr_all_domains($1_t)
+	domain_dontaudit_ptrace_all_domains($1_t)
+	# signal all domains:
+	domain_kill_all_domains($1_t)
+	domain_signal_all_domains($1_t)
+	domain_signull_all_domains($1_t)
+	domain_sigstop_all_domains($1_t)
+	domain_sigstop_all_domains($1_t)
+	domain_sigchld_all_domains($1_t)
+	# for lsof
+	domain_getattr_all_sockets($1_t)
+
+	files_exec_usr_src_files($1_t)
+
+	fs_getattr_all_fs($1_t)
+	fs_set_all_quotas($1_t)
+	fs_exec_noxattr($1_t)
+
+	storage_read_tape($1_t)
+	storage_write_tape($1_t)
+	storage_raw_read_removable_device($1_t)
+	storage_raw_write_removable_device($1_t)
+
+	term_use_all_terms($1_t)
+
+	auth_getattr_shadow($1_t)
+	auth_getattr_shadow_history($1_t)
+	# Manage almost all files
+	files_manage_non_auth_files($1_t)
+	files_map_non_auth_files($1_t)
+	# Relabel almost all files
+	files_relabel_non_auth_files($1_t)
+
+	init_telinit($1_t)
+
+	logging_send_syslog_msg($1_t)
+
+	modutils_domtrans($1_t)
+
+	# The following rule is temporary until such time that a complete
+	# policy management infrastructure is in place so that an administrator
+	# cannot directly manipulate policy files with arbitrary programs.
+	seutil_manage_src_policy($1_t)
+	# Violates the goal of limiting write access to checkpolicy.
+	# But presently necessary for installing the file_contexts file.
+	seutil_manage_bin_policy($1_t)
+
+	userdom_manage_user_home_content_dirs($1_t)
+	userdom_manage_user_home_content_files($1_t)
+	userdom_manage_user_home_content_symlinks($1_t)
+	userdom_manage_user_home_content_pipes($1_t)
+	userdom_manage_user_home_content_sockets($1_t)
+	userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
+
+	optional_policy(`
+		postgresql_unconfined($1_t)
+	')
+
+	optional_policy(`
+		usbguard_stream_connect($1_t)
+	')
+
+	optional_policy(`
+		userhelper_exec($1_t)
+	')
+')
+
+########################################
+## <summary>
+##	Allow user to run as a secadm
+## </summary>
+## <desc>
+##	<p>
+##	Create objects in a user home directory
+##	with an automatic type transition to
+##	a specified private type.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role  of the object to create.
+##	</summary>
+## </param>
+#
+interface(`userdom_security_admin_template',`
+	allow $1 self:capability { dac_override dac_read_search };
+
+	corecmd_exec_shell($1)
+
+	domain_obj_id_change_exemption($1)
+
+	dev_relabel_all_dev_nodes($1)
+
+	files_create_boot_flag($1)
+
+	# Necessary for managing /boot/efi
+	fs_manage_dos_files($1)
+
+	kernel_relabelfrom_unlabeled_dirs($1)
+	kernel_relabelfrom_unlabeled_files($1)
+	kernel_relabelfrom_unlabeled_symlinks($1)
+	kernel_relabelfrom_unlabeled_pipes($1)
+	kernel_relabelfrom_unlabeled_sockets($1)
+	kernel_relabelfrom_unlabeled_blk_devs($1)
+	kernel_relabelfrom_unlabeled_chr_devs($1)
+
+	mls_process_read_all_levels($1)
+	mls_file_read_all_levels($1)
+	mls_file_upgrade($1)
+	mls_file_downgrade($1)
+
+	selinux_set_enforce_mode($1)
+	selinux_set_all_booleans($1)
+	selinux_set_parameters($1)
+	selinux_read_policy($1)
+
+	files_relabel_non_auth_files($1)
+	auth_relabel_shadow($1)
+
+	init_exec($1)
+
+	logging_send_syslog_msg($1)
+	logging_read_audit_log($1)
+	logging_read_generic_logs($1)
+	logging_read_audit_config($1)
+
+	seutil_manage_bin_policy($1)
+	seutil_run_checkpolicy($1, $2)
+	seutil_run_loadpolicy($1, $2)
+	seutil_run_semanage($1, $2)
+	seutil_run_setfiles($1, $2)
+
+	optional_policy(`
+		aide_run($1, $2)
+	')
+
+	optional_policy(`
+		consoletype_exec($1)
+	')
+
+	optional_policy(`
+		dmesg_exec($1)
+	')
+
+	optional_policy(`
+		ipsec_run_setkey($1, $2)
+	')
+
+	optional_policy(`
+		netlabel_run_mgmt($1, $2)
+	')
+
+	optional_policy(`
+		samhain_run($1, $2)
+	')
+')
+
+########################################
+## <summary>
+##	Allow user to interact with xdg content types
+## </summary>
+## <desc>
+##	<p>
+##  Create rules to allow a user to manage xdg
+##  content in a user home directory with an
+##  automatic type transition to those types.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`userdom_xdg_user_template',`
+	xdg_manage_all_cache($1_t)
+	xdg_relabel_all_cache($1_t)
+	xdg_watch_all_cache_dirs($1_t)
+	xdg_manage_all_config($1_t)
+	xdg_relabel_all_config($1_t)
+	xdg_watch_all_config_dirs($1_t)
+	xdg_manage_all_data($1_t)
+	xdg_relabel_all_data($1_t)
+	xdg_watch_all_data_dirs($1_t)
+	xdg_watch_all_data_files($1_t)
+	xdg_exec_data($1_t)
+
+	xdg_generic_user_home_dir_filetrans_cache($1_t, dir, ".cache")
+	xdg_generic_user_home_dir_filetrans_config($1_t, dir, ".config")
+	xdg_generic_user_home_dir_filetrans_data($1_t, dir, ".local")
+
+	xdg_generic_user_home_dir_filetrans_documents($1_t, dir, "Documents")
+	xdg_generic_user_home_dir_filetrans_downloads($1_t, dir, "Downloads")
+	xdg_generic_user_home_dir_filetrans_music($1_t, dir, "Music")
+	xdg_generic_user_home_dir_filetrans_pictures($1_t, dir, "Pictures")
+	xdg_generic_user_home_dir_filetrans_videos($1_t, dir, "Videos")
+
+	xdg_manage_documents($1_t)
+	xdg_relabel_documents($1_t)
+	xdg_watch_documents_dirs($1_t)
+	xdg_manage_downloads($1_t)
+	xdg_relabel_downloads($1_t)
+	xdg_watch_downloads_dirs($1_t)
+	xdg_manage_music($1_t)
+	xdg_relabel_music($1_t)
+	xdg_watch_music_dirs($1_t)
+	xdg_manage_pictures($1_t)
+	xdg_relabel_pictures($1_t)
+	xdg_watch_pictures_dirs($1_t)
+	xdg_manage_videos($1_t)
+	xdg_relabel_videos($1_t)
+	xdg_watch_videos_dirs($1_t)
+')
+
+########################################
+## <summary>
+##	Make the specified type usable as
+##	a user application domain type.
+## </summary>
+## <param name="type">
+##	<summary>
+##	Type to be used as a user application domain.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_application_type',`
+	application_type($1)
+	ubac_constrained($1)
+')
+
+########################################
+## <summary>
+##	Make the specified type usable as
+##	a user application domain.
+## </summary>
+## <param name="type">
+##	<summary>
+##	Type to be used as a user application domain.
+##	</summary>
+## </param>
+## <param name="type">
+##	<summary>
+##	Type to be used as the domain entry point.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_application_domain',`
+	application_domain($1, $2)
+	ubac_constrained($1)
+')
+
+########################################
+## <summary>
+##	Make the specified type usable in a
+##	user home directory.
+## </summary>
+## <param name="type">
+##	<summary>
+##	Type to be used as a file in the
+##	user home directory.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_home_content',`
+	gen_require(`
+		attribute user_home_content_type;
+		type user_home_t;
+	')
+
+	typeattribute $1 user_home_content_type;
+
+	allow $1 user_home_t:filesystem associate;
+	files_type($1)
+	files_poly_member($1)
+	ubac_constrained($1)
+')
+
+########################################
+## <summary>
+##	Make the specified type usable as a
+##	user temporary file.
+## </summary>
+## <param name="type">
+##	<summary>
+##	Type to be used as a file in the
+##	temporary directories.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_tmp_file',`
+	files_tmp_file($1)
+	ubac_constrained($1)
+')
+
+########################################
+## <summary>
+##	Make the specified type usable as a
+##	user tmpfs file.
+## </summary>
+## <param name="type">
+##	<summary>
+##	Type to be used as a file in
+##	tmpfs directories.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_tmpfs_file',`
+	files_tmpfs_file($1)
+	ubac_constrained($1)
+')
+
+########################################
+## <summary>
+##	Allow domain to attach to TUN devices created by administrative users.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_attach_admin_tun_iface',`
+	gen_require(`
+		attribute admindomain;
+	')
+
+	allow $1 admindomain:tun_socket relabelfrom;
+	allow $1 self:tun_socket relabelto;
+')
+
+########################################
+## <summary>
+##	Set the attributes of a user pty.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_setattr_user_ptys',`
+	gen_require(`
+		type user_devpts_t;
+	')
+
+	allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
+')
+
+########################################
+## <summary>
+##	Create a user pty.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_create_user_pty',`
+	gen_require(`
+		type user_devpts_t;
+	')
+
+	term_create_pty($1, user_devpts_t)
+')
+
+########################################
+## <summary>
+##	Get the attributes of user home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_getattr_user_home_dirs',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	allow $1 user_home_dir_t:dir getattr_dir_perms;
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to get the attributes of user home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_getattr_user_home_dirs',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
+')
+
+########################################
+## <summary>
+##	Search user home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_search_user_home_dirs',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	allow $1 user_home_dir_t:dir search_dir_perms;
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to search user home directories.
+## </summary>
+## <desc>
+##	<p>
+##	Do not audit attempts to search user home directories.
+##	This will suppress SELinux denial messages when the specified
+##	domain is denied the permission to search these directories.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`userdom_dontaudit_search_user_home_dirs',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	dontaudit $1 user_home_dir_t:dir search_dir_perms;
+')
+
+########################################
+## <summary>
+##	List user home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_list_user_home_dirs',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	allow $1 user_home_dir_t:dir list_dir_perms;
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to list user home subdirectories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_list_user_home_dirs',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	dontaudit $1 user_home_dir_t:dir list_dir_perms;
+')
+
+########################################
+## <summary>
+##	Create user home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_create_user_home_dirs',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	allow $1 user_home_dir_t:dir create_dir_perms;
+')
+
+########################################
+## <summary>
+##	Manage user home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_home_dirs',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	allow $1 user_home_dir_t:dir manage_dir_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to manage user
+##	home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_manage_user_home_dirs',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	dontaudit $1 user_home_dir_t:dir manage_dir_perms;
+')
+
+########################################
+## <summary>
+##	Relabel to user home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_relabelto_user_home_dirs',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	allow $1 user_home_dir_t:dir relabelto;
+')
+
+########################################
+## <summary>
+##	Create directories in the home dir root with
+##	the user home directory type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`userdom_home_filetrans_user_home_dir',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	files_home_filetrans($1, user_home_dir_t, dir, $2)
+')
+
+########################################
+## <summary>
+##	Do a domain transition to the specified
+##	domain when executing a program in the
+##	user home directory.
+## </summary>
+## <desc>
+##	<p>
+##	Do a domain transition to the specified
+##	domain when executing a program in the
+##	user home directory.
+##	</p>
+##	<p>
+##	No interprocess communication (signals, pipes,
+##	etc.) is provided by this interface since
+##	the domains are not owned by this module.
+##	</p>
+## </desc>
+## <param name="source_domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="target_domain">
+##	<summary>
+##	Domain to transition to.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_home_domtrans',`
+	gen_require(`
+		type user_home_dir_t, user_home_t;
+	')
+
+	domain_auto_transition_pattern($1, user_home_t, $2)
+	allow $1 user_home_dir_t:dir search_dir_perms;
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to search user home content directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_search_user_home_content',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	dontaudit $1 user_home_t:dir search_dir_perms;
+')
+
+########################################
+## <summary>
+##	List all users home content directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_list_all_user_home_content',`
+	gen_require(`
+		attribute user_home_content_type;
+	')
+
+	userdom_search_user_home_dirs($1)
+	allow $1 user_home_content_type:dir list_dir_perms;
+')
+
+########################################
+## <summary>
+##	List contents of users home directory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_list_user_home_content',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	allow $1 user_home_t:dir list_dir_perms;
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete directories
+##	in a user home subdirectory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_home_content_dirs',`
+	gen_require(`
+		type user_home_dir_t, user_home_t;
+	')
+
+	manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Delete all user home content directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_all_user_home_content_dirs',`
+	gen_require(`
+		attribute user_home_content_type;
+		type user_home_dir_t;
+	')
+
+	userdom_search_user_home_dirs($1)
+	delete_files_pattern($1, { user_home_dir_t user_home_content_type }, user_home_content_type)
+')
+
+########################################
+## <summary>
+##	Delete directories in a user home subdirectory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_user_home_content_dirs',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	allow $1 user_home_t:dir delete_dir_perms;
+')
+
+########################################
+## <summary>
+##	Set attributes of all user home content directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_setattr_all_user_home_content_dirs',`
+	gen_require(`
+		attribute user_home_content_type;
+	')
+
+	userdom_search_user_home_dirs($1)
+	allow $1 user_home_content_type:dir setattr_dir_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to set the
+##	attributes of user home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_setattr_user_home_content_files',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	dontaudit $1 user_home_t:file setattr_file_perms;
+')
+
+########################################
+## <summary>
+##	Map user home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_map_user_home_content_files',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	allow $1 user_home_t:file map;
+')
+
+########################################
+## <summary>
+##	Mmap user home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_mmap_user_home_content_files',`
+	gen_require(`
+		type user_home_dir_t, user_home_t;
+	')
+
+	mmap_exec_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Read user home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_read_user_home_content_files',`
+	gen_require(`
+		type user_home_dir_t, user_home_t;
+	')
+
+	read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read user home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_read_user_home_content_files',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	dontaudit $1 user_home_t:dir list_dir_perms;
+	dontaudit $1 user_home_t:file read_file_perms;
+')
+
+########################################
+## <summary>
+##	Read all user home content, including application-specific resources.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+#
+interface(`userdom_read_all_user_home_content',`
+	gen_require(`
+		attribute user_home_content_type;
+	')
+
+	list_dirs_pattern($1, user_home_content_type, user_home_content_type)
+	read_files_pattern($1, user_home_content_type, user_home_content_type)
+	read_lnk_files_pattern($1, user_home_content_type, user_home_content_type)
+	read_fifo_files_pattern($1, user_home_content_type, user_home_content_type)
+	read_sock_files_pattern($1, user_home_content_type, user_home_content_type)
+')
+
+########################################
+## <summary>
+##	Manage all user home content, including application-specific resources.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_all_user_home_content',`
+	gen_require(`
+		attribute user_home_content_type;
+	')
+
+	manage_dirs_pattern($1, user_home_content_type, user_home_content_type)
+	manage_files_pattern($1, user_home_content_type, user_home_content_type)
+	manage_lnk_files_pattern($1, user_home_content_type, user_home_content_type)
+	manage_fifo_files_pattern($1, user_home_content_type, user_home_content_type)
+	manage_sock_files_pattern($1, user_home_content_type, user_home_content_type)
+')
+
+########################################
+## <summary>
+##	Map all user home content, including application-specific resources.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+#
+interface(`userdom_map_all_user_home_content_files',`
+	gen_require(`
+		attribute user_home_content_type;
+	')
+
+	allow $1 user_home_content_type:file map;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to append user home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_append_user_home_content_files',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	dontaudit $1 user_home_t:file append_file_perms;
+')
+
+########################################
+## <summary>
+##	Allow append on inherited user home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to allow.
+##	</summary>
+## </param>
+#
+interface(`userdom_append_inherited_user_home_content_files',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	allow $1 user_home_t:file { append getattr ioctl };
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to write user home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_write_user_home_content_files',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	dontaudit $1 user_home_t:file write_file_perms;
+')
+
+########################################
+## <summary>
+##	Delete all user home content files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_all_user_home_content_files',`
+	gen_require(`
+		attribute user_home_content_type;
+		type user_home_dir_t;
+	')
+
+	userdom_search_user_home_content($1)
+	delete_files_pattern($1, { user_home_dir_t user_home_content_type }, user_home_content_type)
+')
+
+########################################
+## <summary>
+##	Delete files in a user home subdirectory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_user_home_content_files',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	allow $1 user_home_t:file delete_file_perms;
+')
+
+########################################
+## <summary>
+##	Relabel generic user home dirs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_relabel_generic_user_home_dirs',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	allow $1 user_home_t:dir relabel_dir_perms;
+')
+
+########################################
+## <summary>
+##	Relabel generic user home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_relabel_generic_user_home_files',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	allow $1 user_home_t:file relabel_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to relabel user home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_relabel_user_home_content_files',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	dontaudit $1 user_home_t:file relabel_file_perms;
+')
+
+########################################
+## <summary>
+##	Read user home subdirectory symbolic links.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_read_user_home_content_symlinks',`
+	gen_require(`
+		type user_home_dir_t, user_home_t;
+	')
+
+	read_lnk_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Execute user home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`userdom_exec_user_home_content_files',`
+	gen_require(`
+		type user_home_dir_t, user_home_t;
+	')
+
+	files_search_home($1)
+	exec_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
+
+	tunable_policy(`use_nfs_home_dirs',`
+		fs_exec_nfs_files($1)
+	')
+
+	tunable_policy(`use_samba_home_dirs',`
+		fs_exec_cifs_files($1)
+	')
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to execute user home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_exec_user_home_content_files',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	dontaudit $1 user_home_t:file exec_file_perms;
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete files
+##	in a user home subdirectory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_home_content_files',`
+	gen_require(`
+		type user_home_dir_t, user_home_t;
+	')
+
+	manage_files_pattern($1, user_home_t, user_home_t)
+	allow $1 user_home_dir_t:dir search_dir_perms;
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to create, read, write, and delete directories
+##	in a user home subdirectory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_manage_user_home_content_dirs',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	dontaudit $1 user_home_t:dir manage_dir_perms;
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete symbolic links
+##	in a user home subdirectory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_home_content_symlinks',`
+	gen_require(`
+		type user_home_dir_t, user_home_t;
+	')
+
+	manage_lnk_files_pattern($1, user_home_t, user_home_t)
+	allow $1 user_home_dir_t:dir search_dir_perms;
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Delete all user home content symbolic links.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_all_user_home_content_symlinks',`
+	gen_require(`
+		attribute user_home_content_type;
+		type user_home_dir_t;
+	')
+
+	userdom_search_user_home_dirs($1)
+	delete_lnk_files_pattern($1, { user_home_dir_t user_home_content_type }, user_home_content_type)
+')
+
+########################################
+## <summary>
+##	Delete symbolic links in a user home directory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_user_home_content_symlinks',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	allow $1 user_home_t:lnk_file delete_lnk_file_perms;
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete named pipes
+##	in a user home subdirectory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_home_content_pipes',`
+	gen_require(`
+		type user_home_dir_t, user_home_t;
+	')
+
+	manage_fifo_files_pattern($1, user_home_t, user_home_t)
+	allow $1 user_home_dir_t:dir search_dir_perms;
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete named sockets
+##	in a user home subdirectory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_home_content_sockets',`
+	gen_require(`
+		type user_home_dir_t, user_home_t;
+	')
+
+	allow $1 user_home_dir_t:dir search_dir_perms;
+	manage_sock_files_pattern($1, user_home_t, user_home_t)
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Create objects in a user home directory
+##	with an automatic type transition to
+##	a specified private type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="private_type">
+##	<summary>
+##	The type of the object to create.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	The class of the object to be created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_home_dir_filetrans',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Create objects in a directory located
+##	in a user home directory with an
+##	automatic type transition to
+##	a specified private type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="private_type">
+##	<summary>
+##	The type of the object to create.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	The class of the object to be created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_home_content_filetrans',`
+	gen_require(`
+		type user_home_dir_t, user_home_t;
+	')
+
+	filetrans_pattern($1, user_home_t, $2, $3, $4)
+	allow $1 user_home_dir_t:dir search_dir_perms;
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Automatically use the user_cert_t label for selected resources
+##	created in a users home directory
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+## <param name="class">
+##	<summary>
+##	Resource type(s) for which the label should be used
+##	</summary>
+## </param>
+## <param name="filename" optional="true">
+##	<summary>
+##	Name of the resource that is being created
+##	</summary>
+## </param>
+#
+interface(`userdom_user_home_dir_filetrans_user_cert',`
+	gen_require(`
+		type user_cert_t;
+	')
+
+	userdom_user_home_dir_filetrans($1, user_cert_t, $2, $3)
+')
+
+########################################
+## <summary>
+##	Create objects in a user home directory
+##	with an automatic type transition to
+##	the user home file type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	The class of the object to be created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_home_dir_filetrans_user_home_content',`
+	gen_require(`
+		type user_home_dir_t, user_home_t;
+	')
+
+	filetrans_pattern($1, user_home_dir_t, user_home_t, $2, $3)
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Execute user executable files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_exec_user_bin_files',`
+	gen_require(`
+		type user_bin_t;
+	')
+
+	exec_files_pattern($1, user_bin_t, user_bin_t)
+	read_lnk_files_pattern($1, user_bin_t, user_bin_t)
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Manage user executable files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_bin',`
+	gen_require(`
+		type user_bin_t;
+	')
+
+	allow $1 user_bin_t:dir { manage_dir_perms relabel_dir_perms };
+	allow $1 user_bin_t:file { manage_file_perms relabel_file_perms };
+	allow $1 user_bin_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Read user SSL certificates.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`userdom_read_user_certs',`
+	gen_require(`
+		type user_cert_t;
+	')
+
+	allow $1 user_cert_t:dir list_dir_perms;
+	read_files_pattern($1, user_cert_t, user_cert_t)
+	read_lnk_files_pattern($1, user_cert_t, user_cert_t)
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to manage
+##	the user SSL certificates.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`userdom_dontaudit_manage_user_certs',`
+	gen_require(`
+		type user_cert_t;
+	')
+
+	dontaudit $1 user_cert_t:dir manage_dir_perms;
+	dontaudit $1 user_cert_t:file manage_file_perms;
+	dontaudit $1 user_cert_t:lnk_file manage_lnk_file_perms;
+')
+
+########################################
+## <summary>
+##	Manage user SSL certificates.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_certs',`
+	gen_require(`
+		type user_cert_t;
+	')
+
+	manage_dirs_pattern($1, user_cert_t, user_cert_t)
+	manage_files_pattern($1, user_cert_t, user_cert_t)
+	manage_lnk_files_pattern($1, user_cert_t, user_cert_t)
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Write to user temporary named sockets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_write_user_tmp_sockets',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	allow $1 user_tmp_t:sock_file write_sock_file_perms;
+	files_search_tmp($1)
+	userdom_search_user_runtime($1)
+')
+
+########################################
+## <summary>
+##	List user temporary directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_list_user_tmp',`
+	gen_require(`
+		type user_tmp_t, user_runtime_t;
+	')
+
+	allow $1 user_tmp_t:dir list_dir_perms;
+	allow $1 user_runtime_t:dir list_dir_perms;
+	files_search_tmp($1)
+	userdom_search_user_runtime($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to list user
+##	temporary directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_list_user_tmp',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	dontaudit $1 user_tmp_t:dir list_dir_perms;
+')
+
+########################################
+## <summary>
+##	Delete users temporary directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_user_tmp_dirs',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	delete_dirs_pattern($1, user_tmp_t, user_tmp_t)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to manage users
+##	temporary directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_manage_user_tmp_dirs',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	dontaudit $1 user_tmp_t:dir manage_dir_perms;
+')
+
+########################################
+## <summary>
+##	Read user temporary files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_read_user_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	read_files_pattern($1, user_tmp_t, user_tmp_t)
+	allow $1 user_tmp_t:dir list_dir_perms;
+	files_search_tmp($1)
+	userdom_search_user_runtime($1)
+')
+
+########################################
+## <summary>
+##	Map user temporary files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_map_user_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	allow $1 user_tmp_t:file map;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read users
+##	temporary files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_read_user_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	dontaudit $1 user_tmp_t:file read_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to append users
+##	temporary files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_append_user_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	dontaudit $1 user_tmp_t:file append_file_perms;
+')
+
+########################################
+## <summary>
+##	Read and write user temporary files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_rw_user_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	allow $1 user_tmp_t:dir list_dir_perms;
+	rw_files_pattern($1, user_tmp_t, user_tmp_t)
+	files_search_tmp($1)
+	userdom_search_user_runtime($1)
+')
+
+########################################
+## <summary>
+##	Delete users temporary files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_user_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	delete_files_pattern($1, user_tmp_t, user_tmp_t)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to manage users
+##	temporary files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_manage_user_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	dontaudit $1 user_tmp_t:file manage_file_perms;
+')
+
+########################################
+## <summary>
+##	Read user temporary symbolic links.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_read_user_tmp_symlinks',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
+	allow $1 user_tmp_t:dir list_dir_perms;
+	files_search_tmp($1)
+	userdom_search_user_runtime($1)
+')
+
+########################################
+## <summary>
+##	Delete users temporary symbolic links.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_user_tmp_symlinks',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	delete_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete user
+##	temporary directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_tmp_dirs',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
+	files_search_tmp($1)
+	userdom_search_user_runtime($1)
+')
+
+########################################
+## <summary>
+##	Delete users temporary named pipes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_user_tmp_named_pipes',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	delete_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete user
+##	temporary files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	manage_files_pattern($1, user_tmp_t, user_tmp_t)
+	files_search_tmp($1)
+	userdom_search_user_runtime($1)
+')
+
+########################################
+## <summary>
+##	Delete users temporary named sockets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_user_tmp_named_sockets',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	delete_sock_files_pattern($1, user_tmp_t, user_tmp_t)
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete user
+##	temporary symbolic links.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_tmp_symlinks',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
+	files_search_tmp($1)
+	userdom_search_user_runtime($1)
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete user
+##	temporary named pipes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_tmp_pipes',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
+	files_search_tmp($1)
+	userdom_search_user_runtime($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read and write
+##	temporary pipes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_rw_user_tmp_pipes',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	dontaudit $1 user_tmp_t:fifo_file rw_fifo_file_perms;
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete user
+##	temporary named sockets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_tmp_sockets',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
+	files_search_tmp($1)
+	userdom_search_user_runtime($1)
+')
+
+########################################
+## <summary>
+##	Create objects in a user temporary directory
+##	with an automatic type transition to
+##	a specified private type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="private_type">
+##	<summary>
+##	The type of the object to create.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	The class of the object to be created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_tmp_filetrans',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	filetrans_pattern($1, user_tmp_t, $2, $3, $4)
+	files_search_tmp($1)
+	userdom_search_user_runtime($1)
+')
+
+########################################
+## <summary>
+##	Create objects in the temporary directory
+##	with an automatic type transition to
+##	the user temporary type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	The class of the object to be created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`userdom_tmp_filetrans_user_tmp',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	files_tmp_filetrans($1, user_tmp_t, $2, $3)
+')
+
+########################################
+## <summary>
+##	Map user tmpfs files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_map_user_tmpfs_files',`
+	gen_require(`
+		type user_tmpfs_t;
+	')
+
+	allow $1 user_tmpfs_t:file map;
+')
+
+########################################
+## <summary>
+##	Read user tmpfs files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_read_user_tmpfs_files',`
+	gen_require(`
+		type user_tmpfs_t;
+	')
+
+	read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+	allow $1 user_tmpfs_t:dir list_dir_perms;
+	fs_search_tmpfs($1)
+')
+
+########################################
+## <summary>
+##	dontaudit Read attempts of user tmpfs files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_read_user_tmpfs_files',`
+	gen_require(`
+		type user_tmpfs_t;
+	')
+
+	dontaudit $1 user_tmpfs_t:file read_file_perms;
+	dontaudit $1 user_tmpfs_t:dir list_dir_perms;
+')
+
+########################################
+## <summary>
+##	dontaudit Execution attempts of user tmpfs files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_execute_user_tmpfs_files',`
+	gen_require(`
+		type user_tmpfs_t;
+	')
+
+	dontaudit $1 user_tmpfs_t:file execute;
+')
+
+########################################
+## <summary>
+##	relabel to/from user tmpfs dirs
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_relabel_user_tmpfs_dirs',`
+	gen_require(`
+		type user_tmpfs_t;
+	')
+
+	allow $1 user_tmpfs_t:dir { list_dir_perms relabel_dir_perms };
+	fs_search_tmpfs($1)
+')
+
+########################################
+## <summary>
+##	relabel to/from user tmpfs files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_relabel_user_tmpfs_files',`
+	gen_require(`
+		type user_tmpfs_t;
+	')
+
+	allow $1 user_tmpfs_t:dir list_dir_perms;
+	allow $1 user_tmpfs_t:file relabel_file_perms;
+	fs_search_tmpfs($1)
+')
+
+########################################
+## <summary>
+##	Make the specified type usable in
+##	the directory /run/user/%{USERID}/.
+## </summary>
+## <param name="type">
+##	<summary>
+##	Type to be used as a file in the
+##	user_runtime_content_dir_t.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_runtime_content',`
+	gen_require(`
+		attribute user_runtime_content_type;
+	')
+
+	typeattribute $1 user_runtime_content_type;
+	files_type($1)
+	ubac_constrained($1)
+')
+
+########################################
+## <summary>
+##	Search users runtime directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_search_user_runtime',`
+	gen_require(`
+		type user_runtime_t;
+	')
+
+	allow $1 user_runtime_t:dir search_dir_perms;
+	userdom_search_user_runtime_root($1)
+')
+
+########################################
+## <summary>
+##	Search user runtime root directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_search_user_runtime_root',`
+	gen_require(`
+		type user_runtime_root_t;
+	')
+
+	allow $1 user_runtime_root_t:dir search_dir_perms;
+	files_search_runtime($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to search
+##	user runtime root directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_search_user_runtime_root',`
+	gen_require(`
+		type user_runtime_root_t;
+	')
+
+	dontaudit $1 user_runtime_root_t:dir search;
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete user
+##	runtime root dirs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_runtime_root_dirs',`
+	gen_require(`
+		type user_runtime_root_t;
+	')
+
+	allow $1 user_runtime_root_t:dir manage_dir_perms;
+	files_search_runtime($1)
+')
+
+########################################
+## <summary>
+##	Relabel to and from user runtime root dirs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_relabel_user_runtime_root_dirs',`
+	gen_require(`
+		type user_runtime_root_t;
+	')
+
+	allow $1 user_runtime_root_t:dir relabel_dir_perms;
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete user
+##	runtime dirs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_runtime_dirs',`
+	gen_require(`
+		type user_runtime_t;
+	')
+
+	allow $1 user_runtime_t:dir manage_dir_perms;
+	userdom_search_user_runtime_root($1)
+')
+
+########################################
+## <summary>
+##	Watch user runtime dirs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_watch_user_runtime_dirs',`
+	gen_require(`
+		type user_runtime_t;
+	')
+
+	allow $1 user_runtime_t:dir watch;
+	userdom_search_user_runtime_root($1)
+')
+
+########################################
+## <summary>
+##	Mount a filesystem on user runtime dir
+##	directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_mounton_user_runtime_dirs',`
+	gen_require(`
+		type user_runtime_t;
+	')
+
+	allow $1 user_runtime_t:dir mounton;
+')
+
+########################################
+## <summary>
+##	Relabel to user runtime directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_relabelto_user_runtime_dirs',`
+	gen_require(`
+		type user_runtime_t;
+	')
+
+	allow $1 user_runtime_t:dir relabelto;
+')
+
+########################################
+## <summary>
+##	Relabel from user runtime directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_relabelfrom_user_runtime_dirs',`
+	gen_require(`
+		type user_runtime_t;
+	')
+
+	allow $1 user_runtime_t:dir relabelfrom;
+')
+
+########################################
+## <summary>
+##     write user runtime socket files
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`userdom_write_all_user_runtime_named_sockets',`
+	gen_require(`
+		attribute user_runtime_content_type;
+	')
+
+	allow $1 user_runtime_content_type:dir list_dir_perms;
+	allow $1 user_runtime_content_type:sock_file write;
+')
+
+########################################
+## <summary>
+##	delete user runtime files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_user_runtime_files',`
+	gen_require(`
+		type user_runtime_t;
+	')
+
+	allow $1 user_runtime_t:dir list_dir_perms;
+	allow $1 user_runtime_t:file delete_file_perms;
+')
+
+########################################
+## <summary>
+##	write user runtime sockets
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_write_user_runtime_sockets',`
+	gen_require(`
+		type user_runtime_t;
+	')
+
+	allow $1 user_runtime_t:sock_file write;
+')
+
+########################################
+## <summary>
+##	Search users runtime directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_search_all_user_runtime',`
+	gen_require(`
+		attribute user_runtime_content_type;
+	')
+
+	allow $1 user_runtime_content_type:dir search_dir_perms;
+	userdom_search_user_runtime_root($1)
+')
+
+########################################
+## <summary>
+##	List user runtime directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_list_all_user_runtime',`
+	gen_require(`
+		attribute user_runtime_content_type;
+	')
+
+	allow $1 user_runtime_content_type:dir list_dir_perms;
+	userdom_search_user_runtime($1)
+')
+
+########################################
+## <summary>
+##	delete user runtime directories
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_all_user_runtime_dirs',`
+	gen_require(`
+		attribute user_runtime_content_type;
+	')
+
+	delete_dirs_pattern($1, user_runtime_content_type, user_runtime_content_type)
+')
+
+########################################
+## <summary>
+##	delete user runtime files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_all_user_runtime_files',`
+	gen_require(`
+		attribute user_runtime_content_type;
+	')
+
+	delete_files_pattern($1, user_runtime_content_type, user_runtime_content_type)
+')
+
+########################################
+## <summary>
+##	delete user runtime symlink files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_all_user_runtime_symlinks',`
+	gen_require(`
+		attribute user_runtime_content_type;
+	')
+
+	delete_lnk_files_pattern($1, user_runtime_content_type, user_runtime_content_type)
+')
+
+########################################
+## <summary>
+##	delete user runtime fifo files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_all_user_runtime_named_pipes',`
+	gen_require(`
+		attribute user_runtime_content_type;
+	')
+
+	delete_fifo_files_pattern($1, user_runtime_content_type, user_runtime_content_type)
+')
+
+########################################
+## <summary>
+##	delete user runtime socket files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_all_user_runtime_named_sockets',`
+	gen_require(`
+		attribute user_runtime_content_type;
+	')
+
+	delete_sock_files_pattern($1, user_runtime_content_type, user_runtime_content_type)
+')
+
+########################################
+## <summary>
+##	delete user runtime blk files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_all_user_runtime_blk_files',`
+	gen_require(`
+		attribute user_runtime_content_type;
+	')
+
+	delete_blk_files_pattern($1, user_runtime_content_type, user_runtime_content_type)
+')
+
+########################################
+## <summary>
+##	delete user runtime chr files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_all_user_runtime_chr_files',`
+	gen_require(`
+		attribute user_runtime_content_type;
+	')
+
+	delete_chr_files_pattern($1, user_runtime_content_type, user_runtime_content_type)
+')
+
+########################################
+## <summary>
+##	Create objects in the runtime directory
+##	with an automatic type transition to
+##	the user runtime root type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	The class of the object to be created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`userdom_runtime_filetrans_user_runtime_root',`
+	gen_require(`
+		type user_runtime_root_t;
+	')
+
+	files_runtime_filetrans($1, user_runtime_root_t, $2, $3)
+')
+
+########################################
+## <summary>
+##	Create objects in a user runtime
+##	directory with an automatic type
+##	transition to a specified private
+##	type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="private_type">
+##	<summary>
+##	The type of the object to create.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	The class of the object to be created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_runtime_filetrans',`
+	gen_require(`
+		type user_runtime_t;
+	')
+
+	filetrans_pattern($1, user_runtime_t, $2, $3, $4)
+	userdom_search_user_runtime_root($1)
+')
+
+########################################
+## <summary>
+##	Create objects in the user runtime directory
+##	with an automatic type transition to
+##	the user temporary type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	The class of the object to be created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_runtime_filetrans_user_tmp',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	userdom_user_runtime_filetrans($1, user_tmp_t, $2, $3)
+')
+
+########################################
+## <summary>
+##	Create objects in the user runtime root
+##	directory with an automatic type transition
+##	to the user runtime dir type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	The class of the object to be created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_runtime_root_filetrans_user_runtime',`
+	gen_require(`
+		type user_runtime_root_t, user_runtime_t;
+	')
+
+	filetrans_pattern($1, user_runtime_root_t, user_runtime_t, $2, $3)
+	files_search_runtime($1)
+')
+
+########################################
+## <summary>
+##	Create objects in the user runtime root
+##	directory with an automatic type transition
+##	to the user runtime dir type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	The class of the object to be created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`userdom_user_run_filetrans_user_runtime',`
+	gen_require(`
+		type user_runtime_t;
+	')
+
+	fs_tmpfs_filetrans($1, user_runtime_t, $2, $3)
+')
+
+########################################
+## <summary>
+##	Read and write user tmpfs files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_rw_user_tmpfs_files',`
+	gen_require(`
+		type user_tmpfs_t;
+	')
+
+	rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+	read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+	allow $1 user_tmpfs_t:dir list_dir_perms;
+	fs_search_tmpfs($1)
+')
+
+########################################
+## <summary>
+##	Delete user tmpfs files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_delete_user_tmpfs_files',`
+	gen_require(`
+		type user_tmpfs_t;
+	')
+
+	delete_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+	fs_search_tmpfs($1)
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete user tmpfs files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_tmpfs_files',`
+	gen_require(`
+		type user_tmpfs_t;
+	')
+
+	manage_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+	allow $1 user_tmpfs_t:dir list_dir_perms;
+	fs_search_tmpfs($1)
+')
+
+########################################
+## <summary>
+##	execute and execmod user tmpfs files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_execmod_user_tmpfs_files',`
+	gen_require(`
+		type user_tmpfs_t;
+	')
+
+	allow $1 user_tmpfs_t:file { execute execmod };
+')
+
+########################################
+## <summary>
+##	Get the attributes of a user domain tty.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_getattr_user_ttys',`
+	gen_require(`
+		type user_tty_device_t;
+	')
+
+	allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to get the attributes of a user domain tty.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_getattr_user_ttys',`
+	gen_require(`
+		type user_tty_device_t;
+	')
+
+	dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
+')
+
+########################################
+## <summary>
+##	Set the attributes of a user domain tty.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_setattr_user_ttys',`
+	gen_require(`
+		type user_tty_device_t;
+	')
+
+	allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to set the attributes of a user domain tty.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_setattr_user_ttys',`
+	gen_require(`
+		type user_tty_device_t;
+	')
+
+	dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
+')
+
+########################################
+## <summary>
+##	watch a user domain tty.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_watch_user_ttys',`
+	gen_require(`
+		type user_tty_device_t;
+	')
+
+	allow $1 user_tty_device_t:chr_file watch;
+')
+
+########################################
+## <summary>
+##	Read and write a user domain tty.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_use_user_ttys',`
+	gen_require(`
+		type user_tty_device_t;
+	')
+
+	allow $1 user_tty_device_t:chr_file rw_term_perms;
+')
+
+########################################
+## <summary>
+##	Read and write a user domain pty.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_use_user_ptys',`
+	gen_require(`
+		type user_devpts_t;
+	')
+
+	term_list_ptys($1)
+	allow $1 user_devpts_t:chr_file rw_term_perms;
+')
+
+########################################
+## <summary>
+##	Read and write a user TTYs and PTYs.
+## </summary>
+## <desc>
+##	<p>
+##	Allow the specified domain to read and write user
+##	TTYs and PTYs. This will allow the domain to
+##	interact with the user via the terminal. Typically
+##	all interactive applications will require this
+##	access.
+##	</p>
+##	<p>
+##	However, this also allows the applications to spy
+##	on user sessions or inject information into the
+##	user session.  Thus, this access should likely
+##	not be allowed for non-interactive domains.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="both" weight="10"/>
+#
+interface(`userdom_use_inherited_user_terminals',`
+	gen_require(`
+		type user_devpts_t, user_tty_device_t;
+	')
+
+	term_list_ptys($1)
+	allow $1 { user_devpts_t user_tty_device_t }:chr_file rw_inherited_term_perms;
+')
+
+########################################
+## <summary>
+##	Read, write and open a user TTYs and PTYs.
+## </summary>
+## <desc>
+##	<p>
+##	Allow the specified domain to read and write user
+##	TTYs and PTYs. This will allow the domain to
+##	interact with the user via the terminal. Typically
+##	all interactive applications will require this
+##	access.
+##	</p>
+##	<p>
+##	This interface will also allow to open these user
+##	terminals, which should not be necessary in general
+##	and userdom_use_inherited_user_terminals() should
+##	be sufficient.
+##	</p>
+##	<p>
+##	However, this also allows the applications to spy
+##	on user sessions or inject information into the
+##	user session.  Thus, this access should likely
+##	not be allowed for non-interactive domains.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="both" weight="10"/>
+#
+interface(`userdom_use_user_terminals',`
+	userdom_use_user_ptys($1)
+	userdom_use_user_ttys($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read and write
+##	a user domain tty and pty.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_use_user_terminals',`
+	gen_require(`
+		type user_tty_device_t, user_devpts_t;
+	')
+
+	dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
+	dontaudit $1 user_devpts_t:chr_file rw_term_perms;
+')
+
+########################################
+## <summary>
+##	Lock user TTYs and PTYs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_lock_user_terminals',`
+	gen_require(`
+		type user_tty_device_t, user_devpts_t;
+	')
+
+	allow $1 user_tty_device_t:chr_file lock;
+	allow $1 user_devpts_t:chr_file lock;
+')
+
+########################################
+## <summary>
+##	Execute a shell in all user domains.  This
+##	is an explicit transition, requiring the
+##	caller to use setexeccon().
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`userdom_spec_domtrans_all_users',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	corecmd_shell_spec_domtrans($1, userdomain)
+	allow userdomain $1:fd use;
+	allow userdomain $1:fifo_file rw_inherited_fifo_file_perms;
+	allow userdomain $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Execute an Xserver session in all user domains.  This
+##	is an explicit transition, requiring the
+##	caller to use setexeccon().
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`userdom_xsession_spec_domtrans_all_users',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	xserver_xsession_spec_domtrans($1, userdomain)
+	allow userdomain $1:fd use;
+	allow userdomain $1:fifo_file rw_inherited_fifo_file_perms;
+	allow userdomain $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Execute a shell in all unprivileged user domains.  This
+##	is an explicit transition, requiring the
+##	caller to use setexeccon().
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`userdom_spec_domtrans_unpriv_users',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	corecmd_shell_spec_domtrans($1, unpriv_userdomain)
+	allow unpriv_userdomain $1:fd use;
+	allow unpriv_userdomain $1:fifo_file rw_inherited_fifo_file_perms;
+	allow unpriv_userdomain $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Execute an Xserver session in all unprivileged user domains.  This
+##	is an explicit transition, requiring the
+##	caller to use setexeccon().
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`userdom_xsession_spec_domtrans_unpriv_users',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	xserver_xsession_spec_domtrans($1, unpriv_userdomain)
+	allow unpriv_userdomain $1:fd use;
+	allow unpriv_userdomain $1:fifo_file rw_inherited_fifo_file_perms;
+	allow unpriv_userdomain $1:process sigchld;
+')
+
+#######################################
+## <summary>
+##	Read and write unpriviledged user SysV sempaphores.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_rw_unpriv_user_semaphores',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	allow $1 unpriv_userdomain:sem rw_sem_perms;
+')
+
+########################################
+## <summary>
+##	Manage unpriviledged user SysV sempaphores.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_unpriv_user_semaphores',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	allow $1 unpriv_userdomain:sem create_sem_perms;
+')
+
+#######################################
+## <summary>
+##	Read and write unpriviledged user SysV shared
+##	memory segments.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_rw_unpriv_user_shared_mem',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	allow $1 unpriv_userdomain:shm rw_shm_perms;
+')
+
+########################################
+## <summary>
+##	Manage unpriviledged user SysV shared
+##	memory segments.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_unpriv_user_shared_mem',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	allow $1 unpriv_userdomain:shm create_shm_perms;
+')
+
+########################################
+## <summary>
+##	Execute bin_t in the unprivileged user domains. This
+##	is an explicit transition, requiring the
+##	caller to use setexeccon().
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`userdom_bin_spec_domtrans_unpriv_users',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	corecmd_bin_spec_domtrans($1, unpriv_userdomain)
+	allow unpriv_userdomain $1:fd use;
+	allow unpriv_userdomain $1:fifo_file rw_inherited_fifo_file_perms;
+	allow unpriv_userdomain $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Execute all entrypoint files in unprivileged user
+##	domains. This is an explicit transition, requiring the
+##	caller to use setexeccon().
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_entry_spec_domtrans_unpriv_users',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	domain_entry_file_spec_domtrans($1, unpriv_userdomain)
+	allow unpriv_userdomain $1:fd use;
+	allow unpriv_userdomain $1:fifo_file rw_inherited_fifo_file_perms;
+	allow unpriv_userdomain $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Search users home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_search_user_home_content',`
+	gen_require(`
+		type user_home_dir_t, user_home_t;
+	')
+
+	files_list_home($1)
+	allow $1 { user_home_dir_t user_home_t }:dir search_dir_perms;
+')
+
+########################################
+## <summary>
+##	watch users home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_watch_user_home_dirs',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	allow $1 user_home_dir_t:dir watch;
+')
+
+########################################
+## <summary>
+##	Send signull to unprivileged user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_signull_unpriv_users',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	allow $1 unpriv_userdomain:process signull;
+')
+
+########################################
+## <summary>
+##	Send general signals to unprivileged user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_signal_unpriv_users',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	allow $1 unpriv_userdomain:process signal;
+')
+
+########################################
+## <summary>
+##	Inherit the file descriptors from unprivileged user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_use_unpriv_users_fds',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	allow $1 unpriv_userdomain:fd use;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to inherit the file descriptors
+##	from unprivileged user domains.
+## </summary>
+## <desc>
+##	<p>
+##	Do not audit attempts to inherit the file descriptors
+##	from unprivileged user domains. This will suppress
+##	SELinux denial messages when the specified domain is denied
+##	the permission to inherit these file descriptors.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`userdom_dontaudit_use_unpriv_user_fds',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	dontaudit $1 unpriv_userdomain:fd use;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to use user ptys.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_use_user_ptys',`
+	gen_require(`
+		type user_devpts_t;
+	')
+
+	dontaudit $1 user_devpts_t:chr_file rw_chr_file_perms;
+')
+
+########################################
+## <summary>
+##	Relabel files to unprivileged user pty types.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_relabelto_user_ptys',`
+	gen_require(`
+		type user_devpts_t;
+	')
+
+	allow $1 user_devpts_t:chr_file relabelto;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to relabel files from
+##	user pty types.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_relabelfrom_user_ptys',`
+	gen_require(`
+		type user_devpts_t;
+	')
+
+	dontaudit $1 user_devpts_t:chr_file relabelfrom;
+')
+
+########################################
+## <summary>
+##	Write all users files in /tmp
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_write_user_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	allow $1 user_tmp_t:file write_file_perms;
+')
+
+########################################
+## <summary>
+##      Do not audit attempts to write users
+##      temporary files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_write_user_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	dontaudit $1 user_tmp_t:file write;
+')
+
+########################################
+## <summary>
+##      Delete user_tmp_t device nodes (probably should not have been
+##	created in the first place)
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain to allow deleting
+##      </summary>
+## </param>
+#
+interface(`userdom_unlink_user_tmp_devices',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	allow $1 user_tmp_t:{ chr_file blk_file } unlink;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to use user ttys.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_use_user_ttys',`
+	gen_require(`
+		type user_tty_device_t;
+	')
+
+	dontaudit $1 user_tty_device_t:chr_file rw_chr_file_perms;
+')
+
+########################################
+## <summary>
+##	Read the process state of all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_read_all_users_state',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	read_files_pattern($1, userdomain, userdomain)
+	read_lnk_files_pattern($1, userdomain, userdomain)
+	kernel_search_proc($1)
+')
+
+########################################
+## <summary>
+##	Get the attributes of all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_getattr_all_users',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	allow $1 userdomain:process getattr;
+')
+
+########################################
+## <summary>
+##	Inherit the file descriptors from all user domains
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_use_all_users_fds',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	allow $1 userdomain:fd use;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to inherit the file
+##	descriptors from any user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_use_all_users_fds',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	dontaudit $1 userdomain:fd use;
+')
+
+########################################
+## <summary>
+##	Send general signals to all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_signal_all_users',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	allow $1 userdomain:process signal;
+')
+
+########################################
+## <summary>
+##	Send a SIGCHLD signal to all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_sigchld_all_users',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	allow $1 userdomain:process sigchld;
+')
+
+########################################
+## <summary>
+##	Read keys for all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_read_all_users_keys',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	allow $1 userdomain:key read;
+')
+
+########################################
+## <summary>
+##	Write keys for all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_write_all_users_keys',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	allow $1 userdomain:key write;
+')
+
+########################################
+## <summary>
+##	Read and write keys for all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_rw_all_users_keys',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	allow $1 userdomain:key { read view write };
+')
+
+########################################
+## <summary>
+##	Create keys for all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_create_all_users_keys',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	allow $1 userdomain:key create;
+')
+
+########################################
+## <summary>
+##	Manage keys for all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_all_users_keys',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	allow $1 userdomain:key manage_key_perms;
+')
+
+########################################
+## <summary>
+##	Send a dbus message to all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_dbus_send_all_users',`
+	gen_require(`
+		attribute userdomain;
+		class dbus send_msg;
+	')
+
+	allow $1 userdomain:dbus send_msg;
+')
+
+########################################
+## <summary>
+##     Do not audit attempts to read and write
+##     unserdomain stream.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_dontaudit_rw_all_users_stream_sockets',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
+')
Index: refpolicy-deepin/policy/modules/system/userdomain.te
===================================================================
--- refpolicy-deepin.orig/policy/modules/system/userdomain.te
+++ refpolicy-deepin/policy/modules/system/userdomain.te
@@ -80,6 +80,16 @@ attribute userdomain;
 # unprivileged user domains
 attribute unpriv_userdomain;
 
+# all login user domains
+attribute login_userdomain;
+
+# for /run/user/%{USERID}/gvfs
+userdom_mounton_user_tmp_dirs(login_userdomain)
+
+# for startdde
+systemd_read_hwdb(login_userdomain)
+kernel_getattr_message_if(login_userdomain)
+
 attribute user_home_content_type;
 
 # dirs/files/etc created in /run/user/%{USERID}/
