--- nsaserefpolicy/policy/modules/services/xserver.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/xserver.fc	2008-08-14 13:53:54.000000000 -0400
@@ -1,13 +1,15 @@
 #
 # HOME_DIR
 #
-HOME_DIR/\.fonts\.conf	--	gen_context(system_u:object_r:ROLE_fonts_config_t,s0)
-HOME_DIR/\.fonts(/.*)?		gen_context(system_u:object_r:ROLE_fonts_t,s0)
-HOME_DIR/\.fonts/auto(/.*)?	gen_context(system_u:object_r:ROLE_fonts_cache_t,s0)
-HOME_DIR/\.fonts\.cache-.* --	gen_context(system_u:object_r:ROLE_fonts_cache_t,s0)
-HOME_DIR/\.ICEauthority.* --	gen_context(system_u:object_r:ROLE_iceauth_home_t,s0)
-HOME_DIR/\.xauth.*	--	gen_context(system_u:object_r:ROLE_xauth_home_t,s0)
-HOME_DIR/\.Xauthority.*	--	gen_context(system_u:object_r:ROLE_xauth_home_t,s0)
+HOME_DIR/\.fonts(/.*)?		gen_context(system_u:object_r:fonts_home_t,s0)
+HOME_DIR/\.fontconfig(/.*)?	gen_context(system_u:object_r:fonts_config_home_t,s0)
+HOME_DIR/\.fonts\.conf	--	gen_context(system_u:object_r:fonts_config_home_t,s0)
+HOME_DIR/\.fonts/auto(/.*)?	gen_context(system_u:object_r:fonts_cache_home_t,s0)
+HOME_DIR/\.fonts\.cache-.* --	gen_context(system_u:object_r:fonts_cache_home_t,s0)
+HOME_DIR/\.ICEauthority.* --	gen_context(system_u:object_r:iceauth_home_t,s0)
+HOME_DIR/\.xauth.*	--	gen_context(system_u:object_r:xauth_home_t,s0)
+HOME_DIR/\.Xauthority.*	--	gen_context(system_u:object_r:xauth_home_t,s0)
+HOME_DIR/\.xsession-errors.*	--	gen_context(system_u:object_r:xdm_home_t,s0)
 
 #
 # /dev
@@ -32,11 +34,6 @@
 /etc/X11/wdm/Xstartup.*	--	gen_context(system_u:object_r:xsession_exec_t,s0)
 /etc/X11/Xsession[^/]*	--	gen_context(system_u:object_r:xsession_exec_t,s0)
 
-ifdef(`distro_redhat',`
-/etc/gdm/PostSession/.*	--	gen_context(system_u:object_r:xsession_exec_t,s0)
-/etc/gdm/PreSession/.*	--	gen_context(system_u:object_r:xsession_exec_t,s0)
-')
-
 #
 # /opt
 #
@@ -58,7 +55,8 @@
 #
 
 /usr/(s)?bin/gdm-binary	--	gen_context(system_u:object_r:xdm_exec_t,s0)
-/usr/(s)?bin/[xgkw]dm	--	gen_context(system_u:object_r:xdm_exec_t,s0)
+/usr/bin/[xgkw]dm	--	gen_context(system_u:object_r:xdm_exec_t,s0)
+/usr/sbin/[xgkw]dm	--	gen_context(system_u:object_r:xdm_exec_t,s0)
 /usr/bin/gpe-dm		--	gen_context(system_u:object_r:xdm_exec_t,s0)
 /usr/bin/iceauth	--	gen_context(system_u:object_r:iceauth_exec_t,s0)
 /usr/bin/Xair		--	gen_context(system_u:object_r:xserver_exec_t,s0)
@@ -89,16 +87,23 @@
 
 /var/[xgk]dm(/.*)?		gen_context(system_u:object_r:xserver_log_t,s0)
 
-/var/lib/[xkw]dm(/.*)?		gen_context(system_u:object_r:xdm_var_lib_t,s0)
+/var/lib/[gxkw]dm(/.*)?		gen_context(system_u:object_r:xdm_var_lib_t,s0)
 /var/lib/xkb(/.*)?		gen_context(system_u:object_r:xkb_var_lib_t,s0)
+/var/lib/xorg(/.*)?		gen_context(system_u:object_r:xserver_var_lib_t,s0)
 
-/var/log/[kw]dm\.log	--	gen_context(system_u:object_r:xserver_log_t,s0)
+/var/log/[kw]dm\.log.*	--	gen_context(system_u:object_r:xserver_log_t,s0)
 /var/log/gdm(/.*)?		gen_context(system_u:object_r:xserver_log_t,s0)
 /var/log/XFree86.*	--	gen_context(system_u:object_r:xserver_log_t,s0)
 /var/log/Xorg.*		--	gen_context(system_u:object_r:xserver_log_t,s0)
+/var/log/nvidia-installer\.log.* --	gen_context(system_u:object_r:xserver_log_t,s0)
 
+/var/run/gdm(/.*)?	 	gen_context(system_u:object_r:xdm_var_run_t,s0)
+/var/run/gdm_socket	-s	gen_context(system_u:object_r:xdm_var_run_t,s0)
 /var/run/[gx]dm\.pid	--	gen_context(system_u:object_r:xdm_var_run_t,s0)
+/var/run/video.rom	--	gen_context(system_u:object_r:xserver_var_run_t,s0)
 /var/run/xdmctl(/.*)?		gen_context(system_u:object_r:xdm_var_run_t,s0)
+/var/run/xauth(/.*)?		gen_context(system_u:object_r:xdm_var_run_t,s0)
+/var/run/xorg(/.*)?		gen_context(system_u:object_r:xserver_var_run_t,s0)
 
 ifdef(`distro_suse',`
 /var/lib/pam_devperm/:0	--	gen_context(system_u:object_r:xdm_var_lib_t,s0)
--- nsaserefpolicy/policy/modules/services/xserver.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/xserver.if	2008-08-14 13:53:54.000000000 -0400
@@ -16,6 +16,7 @@
 	gen_require(`
 		type xkb_var_lib_t, xserver_exec_t, xserver_log_t;
 
+		attribute rootwindow_type;
 		attribute x_server_domain;
 		class x_drawable all_x_drawable_perms;
 		class x_colormap all_x_colormap_perms;
@@ -128,18 +129,24 @@
 	dev_rw_agp($1_xserver_t)
 	dev_rw_framebuffer($1_xserver_t)
 	dev_manage_dri_dev($1_xserver_t)
-	dev_create_generic_dirs($1_xserver_t)
-	dev_setattr_generic_dirs($1_xserver_t)
+	dev_manage_generic_dirs($1_xserver_t)
 	# raw memory access is needed if not using the frame buffer
 	dev_read_raw_memory($1_xserver_t)
 	dev_wx_raw_memory($1_xserver_t)
 	# for other device nodes such as the NVidia binary-only driver
 	dev_rw_xserver_misc($1_xserver_t)
+	dev_setattr_xserver_misc_dev($1_xserver_t)
 	# read events - the synaptics touchpad driver reads raw events
 	dev_rw_input_dev($1_xserver_t)
 	dev_rwx_zero($1_xserver_t)
+	dev_read_urand($1_xserver_t)
+	dev_rw_generic_usb_dev($1_xserver_t)
+	dev_rw_generic_usb_pipes($1_xserver_t)
 
+	domain_mmap_low_type($1_xserver_t)
 	domain_mmap_low($1_xserver_t)
+	domain_read_all_domains_state($1_xserver_t)
+	domain_dontaudit_ptrace_all_domains($1_xserver_t)
 
 	files_read_etc_files($1_xserver_t)
 	files_read_etc_runtime_files($1_xserver_t)
@@ -153,7 +160,8 @@
 	fs_getattr_xattr_fs($1_xserver_t)
 	fs_search_nfs($1_xserver_t)
 	fs_search_auto_mountpoints($1_xserver_t)
-	fs_search_ramfs($1_xserver_t)
+	fs_manage_ramfs_files($1_xserver_t)
+	fs_list_inotifyfs($1_xserver_t)
 
 	selinux_validate_context($1_xserver_t)
 	selinux_compute_access_vector($1_xserver_t)
@@ -163,6 +171,9 @@
 
 	init_getpgid($1_xserver_t)
 
+	miscfiles_read_hwdata($1_xserver_t)
+
+	term_search_ptys($1_xserver_t)
 	term_setattr_unallocated_ttys($1_xserver_t)
 	term_use_unallocated_ttys($1_xserver_t)
 
@@ -270,6 +281,8 @@
 	gen_require(`
 		type iceauth_exec_t, xauth_exec_t;
 		attribute fonts_type, fonts_cache_type, fonts_config_type;
+		type fonts_home_t, fonts_cache_home_t, fonts_config_home_t;
+		type iceauth_home_t, xauth_home_t, xauth_tmp_t;
 	')
 
 	##############################
@@ -280,35 +293,25 @@
 	xserver_common_domain_template($1)
 	role $3 types $1_xserver_t;
 
-	type $1_fonts_t, fonts_type;
-	userdom_user_home_content($1, $1_fonts_t)
-
-	type $1_fonts_cache_t, fonts_cache_type;
-	userdom_user_home_content($1, $1_fonts_cache_t)
-
-	type $1_fonts_config_t, fonts_config_type;
-	userdom_user_home_content($1, $1_fonts_cache_t)
+	typealias fonts_home_t alias $1_fonts_t;
+	typealias fonts_cache_home_t alias $1_fonts_cache_t;
+	typealias fonts_config_home_t alias $1_fonts_config_t;
 
 	type $1_iceauth_t;
 	domain_type($1_iceauth_t)
 	domain_entry_file($1_iceauth_t, iceauth_exec_t)
 	role $3 types $1_iceauth_t;
 
-	type $1_iceauth_home_t alias $1_iceauth_rw_t;
-	files_poly_member($1_iceauth_home_t)
-	userdom_user_home_content($1, $1_iceauth_home_t)
+	typealias iceauth_home_t alias $1_iceauth_rw_t;
+	typealias iceauth_home_t alias $1_iceauth_home_t;
 
 	type $1_xauth_t;
 	domain_type($1_xauth_t)
 	domain_entry_file($1_xauth_t, xauth_exec_t)
 	role $3 types $1_xauth_t;
 
-	type $1_xauth_home_t alias $1_xauth_rw_t, xauth_home_type;
-	files_poly_member($1_xauth_home_t)
-	userdom_user_home_content($1, $1_xauth_home_t)
-
-	type $1_xauth_tmp_t;
-	files_tmp_file($1_xauth_tmp_t)
+	typealias xauth_home_t alias $1_xauth_rw_t;
+	typealias xauth_home_t alias $1_xauth_home_t;
 
 	##############################
 	#
@@ -317,24 +320,24 @@
 
 	domtrans_pattern($1_xserver_t, xauth_exec_t, $1_xauth_t)
 
-	allow $1_xserver_t $1_xauth_home_t:file { getattr read };
+	allow $1_xserver_t xauth_home_t:file { getattr read };
 
 	domtrans_pattern($2, xserver_exec_t, $1_xserver_t)
 	allow $1_xserver_t $2:process signal;
 
 	allow $1_xserver_t $2:shm rw_shm_perms;
 
-	manage_dirs_pattern($2, $1_fonts_t, $1_fonts_t)
-	manage_files_pattern($2, $1_fonts_t, $1_fonts_t)
-	relabel_dirs_pattern($2, $1_fonts_t, $1_fonts_t)
-	relabel_files_pattern($2, $1_fonts_t, $1_fonts_t)
-
-	manage_dirs_pattern($2, $1_fonts_config_t, $1_fonts_config_t)
-	manage_files_pattern($2, $1_fonts_config_t, $1_fonts_config_t)
-	relabel_files_pattern($2, $1_fonts_config_t, $1_fonts_config_t)
+	manage_dirs_pattern($2, fonts_home_t, fonts_home_t)
+	manage_files_pattern($2, fonts_home_t, fonts_home_t)
+	relabel_dirs_pattern($2, fonts_home_t, fonts_home_t)
+	relabel_files_pattern($2, fonts_home_t, fonts_home_t)
+
+	manage_dirs_pattern($2, fonts_config_home_t, fonts_config_home_t)
+	manage_files_pattern($2, fonts_config_home_t, fonts_config_home_t)
+	relabel_files_pattern($2, fonts_config_home_t, fonts_config_home_t)
 
 	# For startup relabel
-	allow $2 $1_fonts_cache_t:{ dir file } { relabelto relabelfrom };
+	allow $2 fonts_cache_home_t:{ dir file } { relabelto relabelfrom };
 
 	stream_connect_pattern($2, $1_xserver_tmp_t, $1_xserver_tmp_t, $1_xserver_t)
 
@@ -348,6 +351,8 @@
 
 	locallogin_use_fds($1_xserver_t)
 
+	miscfiles_read_fonts($2)
+
 	userdom_search_user_home_dirs($1, $1_xserver_t)
 	userdom_use_user_ttys($1, $1_xserver_t)
 	userdom_setattr_user_ttys($1, $1_xserver_t)
@@ -355,18 +360,12 @@
 
 	xserver_use_user_fonts($1, $1_xserver_t)
 	xserver_rw_xdm_tmp_files($1_xauth_t)
+	xserver_read_xdm_xserver_tmp_files($2)
 
 	optional_policy(`
 		userhelper_search_config($1_xserver_t)
 	')
 
-	ifdef(`TODO',`
-	ifdef(`xdm.te', `
-		allow $1_t xdm_tmp_t:sock_file unlink;
-		allow $1_xserver_t xdm_var_run_t:dir search;
-	')
-	') dnl end TODO
-
 	##############################
 	#
 	# $1_xauth_t Local policy
@@ -375,12 +374,12 @@
 	allow $1_xauth_t self:process signal;
 	allow $1_xauth_t self:unix_stream_socket create_stream_socket_perms;
 
-	allow $1_xauth_t $1_xauth_home_t:file manage_file_perms;
-	userdom_user_home_dir_filetrans($1, $1_xauth_t, $1_xauth_home_t,file)
+	allow $1_xauth_t xauth_home_t:file manage_file_perms;
+	userdom_user_home_dir_filetrans($1, $1_xauth_t, xauth_home_t, file)
 
-	manage_dirs_pattern($1_xauth_t, $1_xauth_tmp_t, $1_xauth_tmp_t)
-	manage_files_pattern($1_xauth_t, $1_xauth_tmp_t, $1_xauth_tmp_t)
-	files_tmp_filetrans($1_xauth_t, $1_xauth_tmp_t, { file dir })
+	manage_dirs_pattern($1_xauth_t, xauth_tmp_t, xauth_tmp_t)
+	manage_files_pattern($1_xauth_t, xauth_tmp_t, xauth_tmp_t)
+	files_tmp_filetrans($1_xauth_t, xauth_tmp_t, { file dir })
 
 	domtrans_pattern($2, xauth_exec_t, $1_xauth_t)
 
@@ -389,11 +388,8 @@
 	# allow ps to show xauth
 	ps_process_pattern($2,$1_xauth_t)
 
-	allow $2 $1_xauth_home_t:file manage_file_perms;
-	allow $2 $1_xauth_home_t:file { relabelfrom relabelto };
-
-	allow xdm_t $1_xauth_home_t:file manage_file_perms;
-	userdom_user_home_dir_filetrans($1, xdm_t, $1_xauth_home_t, file)
+	allow $2 xauth_home_t:file manage_file_perms;
+	allow $2 xauth_home_t:file { relabelfrom relabelto };
 
 	domain_use_interactive_fds($1_xauth_t)
 
@@ -435,16 +431,16 @@
 
 	domtrans_pattern($2, iceauth_exec_t, $1_iceauth_t)
 
-	allow $1_iceauth_t $1_iceauth_home_t:file manage_file_perms;
-	userdom_user_home_dir_filetrans($1, $1_iceauth_t, $1_iceauth_home_t, file)
+	allow $1_iceauth_t iceauth_home_t:file manage_file_perms;
+	userdom_user_home_dir_filetrans($1, $1_iceauth_t, iceauth_home_t, file)
 
 	# allow ps to show iceauth
 	ps_process_pattern($2, $1_iceauth_t)
 
-	allow $2 $1_iceauth_home_t:file manage_file_perms;
-	allow $2 $1_iceauth_home_t:file { relabelfrom relabelto };
+	allow $2 iceauth_home_t:file manage_file_perms;
+	allow $2 iceauth_home_t:file { relabelfrom relabelto };
 
-	allow xdm_t $1_iceauth_home_t:file read_file_perms;
+	allow xdm_t iceauth_home_t:file read_file_perms;
 
 	fs_search_auto_mountpoints($1_iceauth_t)
 
@@ -467,34 +463,12 @@
 	#
 
 	# Device rules
-	allow $1_x_domain $1_xserver_t:x_device { read getattr use setattr setfocus grab bell };
+	allow $1_x_domain $1_xserver_t:x_device { getattr use setattr setfocus grab bell };
 
 	allow $1_xserver_t { input_xevent_t $1_input_xevent_type }:x_event send;
+	allow $2 $1_input_xevent_type:x_event send;
 	allow $1_xserver_t { $1_rootwindow_t $1_x_domain }:x_drawable send;
 
-	# manage: xhost X11:ChangeHosts
-	# freeze: metacity X11:GrabKey
-	# force_cursor: metacity X11:GrabPointer
-	allow $2 $1_xserver_t:x_device { manage freeze force_cursor };
-
-	# gnome-settings-daemon XKEYBOARD:SetControls
-	allow $2 $1_xserver_t:x_server manage;
-
-	# gnome-settings-daemon RANDR:SelectInput
-	allow $2 $1_xserver_t:x_resource write;
-
-	# metacity X11:InstallColormap X11:UninstallColormap
-	allow $2 $1_rootwindow_t:x_colormap { install uninstall };
-
-	# read: gnome-settings-daemon RANDR:GetScreenSizeRange
-	# write: gnome-settings-daemon RANDR:SelectInput
-	# setattr: gnome-settings-daemon X11:GrabKey
-	# manage: metacity X11:ChangeWindowAttributes
-	allow $2 $1_rootwindow_t:x_drawable { read write manage setattr };
-
-	# setattr: metacity X11:InstallColormap
-	allow $2 $1_xserver_t:x_screen { saver_setattr saver_getattr setattr };
-
 	# xrdb X11:ChangeProperty prop=RESOURCE_MANAGER
 	allow $2 info_xproperty_t:x_property { create write append };
 
@@ -610,7 +584,7 @@
 #	refpolicywarn(`$0() has been deprecated, please use xserver_user_x_domain_template instead.')
 	gen_require(`
 		type xdm_t, xdm_tmp_t;
-		type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
+		type xauth_home_t, iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
 	')
 
 	allow $2 self:shm create_shm_perms;
@@ -618,8 +592,8 @@
 	allow $2 self:unix_stream_socket { connectto create_stream_socket_perms };
 
 	# Read .Xauthority file
-	allow $2 $1_xauth_home_t:file { getattr read };
-	allow $2 $1_iceauth_home_t:file { getattr read };
+	allow $2 xauth_home_t:file { getattr read };
+	allow $2 iceauth_home_t:file { getattr read };
 
 	# for when /tmp/.X11-unix is created by the system
 	allow $2 xdm_t:fd use;
@@ -643,13 +617,177 @@
 
 	xserver_read_xdm_tmp_files($2)
 
-	# Client write xserver shm
-	tunable_policy(`allow_write_xshm',`
-		allow $2 $1_xserver_t:shm rw_shm_perms;
-		allow $2 $1_xserver_tmpfs_t:file rw_file_perms;
 	')
+
+#######################################
+## <summary>
+##	Interface to provide X object permissions on a given X server to
+##	an X client domain.  Provides the minimal set required by a basic
+##	X client application.
+## </summary>
+## <param name="user">
+##	<summary>
+##	The prefix of the X server domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="prefix">
+##	<summary>
+##	The prefix of the X client domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Client domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xserver_use',`
+	gen_require(`
+		type $1_rootwindow_t;
+		type $1_xproperty_t;
+		attribute $1_x_domain, $1_input_xevent_type;
+		attribute x_domain;
+		type $1_xserver_t;
+#		type $2_input_xevent_t;
+	')
+
+#	typeattribute $2_input_xevent_t $1_input_xevent_type;
+
+	# can change properties of root window
+	allow $3 $1_rootwindow_t:x_drawable { list_property get_property set_property };
+	# X Windows
+	# operations allowed on root windows
+	allow $3 $1_rootwindow_t:x_drawable { getattr list_child add_child remove_child send receive override destroy hide };
+#	type_transition $3 $1_rootwindow_t:x_drawable $2_t;
+
+	allow $3 $1_xproperty_t:x_property { write read };
+
+	# X Colormaps
+	# can use the default colormap
+	allow $3 $1_rootwindow_t:x_colormap { read use add_color };
+
+	# manage: xhost X11:ChangeHosts
+	# freeze: metacity X11:GrabKey
+	# force_cursor: metacity X11:GrabPointer
+	allow $3 $1_xserver_t:x_device { manage freeze force_cursor };
+	allow $3 $1_xserver_t:x_device { getfocus setfocus grab use getattr setattr bell };
+
+	# gnome-settings-daemon XKEYBOARD:SetControls
+	allow $3 $1_xserver_t:x_server { manage grab };
+
+	# gnome-settings-daemon RANDR:SelectInput
+	allow $3 $1_xserver_t:x_resource { read write };
+
+	# metacity X11:InstallColormap X11:UninstallColormap
+	allow $3 $1_rootwindow_t:x_colormap { use install uninstall };
+
+	# read: gnome-settings-daemon RANDR:GetScreenSizeRange
+	# write: gnome-settings-daemon RANDR:SelectInput
+	# setattr: gnome-settings-daemon X11:GrabKey
+	# manage: metacity X11:ChangeWindowAttributes
+	allow $3 $1_rootwindow_t:x_drawable { read show write manage setattr get_property blend create add_child write receive set_property };
+
+	# setattr: metacity X11:InstallColormap
+	allow $3 $1_xserver_t:x_screen { getattr saver_setattr saver_getattr setattr };
+')
+
+#######################################
+## <summary>
+##	Interface to provide X object permissions on a given X server to
+##	an X client domain.  Provides the minimal set required by a basic
+##	X client application.
+## </summary>
+## <param name="user">
+##	<summary>
+##	The prefix of the X server domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Client domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xserver_common_app',`
+	gen_require(`
+		type std_xext_t;
+#		type $1_rootwindow_t;
+#		type $1_xproperty_t;
+#		type $1_client_xevent_t;
+#		type $1_focus_xevent_t;
+#		type $1_input_xevent_t;
+#		type $1_manage_xevent_t;
+#		type $1_property_xevent_t;
+		attribute rootwindow_type;
+		attribute xproperty_type;
+
+		class x_drawable all_x_drawable_perms;
+		class x_screen all_x_screen_perms;
+		class x_gc all_x_gc_perms;
+		class x_font all_x_font_perms;
+		class x_colormap all_x_colormap_perms;
+		class x_property all_x_property_perms;
+		class x_selection all_x_selection_perms;
+		class x_cursor all_x_cursor_perms;	
+		class x_client all_x_client_perms;
+		class x_device all_x_device_perms;
+		class x_server all_x_server_perms;
+		class x_extension all_x_extension_perms;
+		class x_resource all_x_resource_perms;
+		class x_event all_x_event_perms;
+		class x_synthetic_event all_x_synthetic_event_perms;
+		type xevent_t, input_xevent_t, client_xevent_t;
+		type xproperty_t, focus_xevent_t, info_xproperty_t, manage_xevent_t;
+		type manage_xevent_t, output_xext_t, property_xevent_t;
+		type shmem_xext_t, xselection_t;
+		attribute xevent_type, xextension_type;
+	')
+	# can receive certain root window events
+	allow $2 self:x_cursor { destroy create use setattr };
+	allow $2 self:x_drawable { write getattr read destroy create add_child };
+	allow $2 self:x_gc { destroy create use setattr };
+	allow $2 self:x_resource { write read };
+
+	allow $2 input_xevent_t:x_synthetic_event receive;
+	allow $2 client_xevent_t:x_synthetic_event { send receive };
+	allow $2 focus_xevent_t:x_event receive;
+	allow $2 info_xproperty_t:x_property read;
+	allow $2 manage_xevent_t:x_event receive;
+	allow $2 manage_xevent_t:x_synthetic_event { send receive };
+	allow $2 output_xext_t:x_extension { query use };
+	allow $2 property_xevent_t:x_event receive;
+	allow $2 shmem_xext_t:x_extension { query use };
+
+#	allow $2 $1_client_xevent_t:x_synthetic_event receive;
+#	allow $2 $1_client_xevent_t:x_event receive;
+#	allow $2 $1_focus_xevent_t:x_event receive;
+#	allow $2 $1_input_xevent_t:x_event receive;
+#	allow $2 $1_input_xevent_t:x_synthetic_event receive;
+#	allow $2 $1_manage_xevent_t:x_event receive;
+#	allow $2 $1_property_xevent_t:x_event receive;
+	allow $2 xevent_type:x_event receive;
+	allow $2 xevent_type:x_synthetic_event receive;
+
+	allow $2 $1_t:x_drawable { get_property setattr show receive blend create manage add_child write read getattr list_child set_property };
+
+#	Broken Compiler
+#	allow $2 $1_xproperty_t:x_property read;
+	allow $2 xproperty_type:x_property { getattr read };
+
+	allow $2 std_xext_t:x_extension { query use };
+	allow $2 xproperty_t:x_property { write create };
+	allow $2 xselection_t:x_selection getattr;
+
+	allow $1_t $2:x_resource { write read };
+
+#	xserver_use($1, $1, $2)
+	xserver_use(xdm, $1, $2)
 ')
 
+
 #######################################
 ## <summary>
 ##	Interface to provide X object permissions on a given X server to
@@ -676,7 +814,7 @@
 #
 template(`xserver_common_x_domain_template',`
 	gen_require(`
-		type $1_rootwindow_t, std_xext_t, shmem_xext_t;
+		type std_xext_t, shmem_xext_t;
 		type xproperty_t, info_xproperty_t, clipboard_xproperty_t;
 		type input_xevent_t, focus_xevent_t, property_xevent_t, manage_xevent_t;
 		type xevent_t, client_xevent_t;
@@ -685,7 +823,6 @@
 		attribute x_server_domain, x_domain;
 		attribute xproperty_type;
 		attribute xevent_type, xextension_type;
-		attribute $1_x_domain, $1_input_xevent_type;
 
 		class x_drawable all_x_drawable_perms;
 		class x_screen all_x_screen_perms;
@@ -709,20 +846,22 @@
 	# Declarations
 	#
 
-	# Type attributes
-	typeattribute $3 $1_x_domain, x_domain;
+	type $2_input_xevent_t, xevent_type;
 
 	# Types for properties
 	type $2_xproperty_t alias $2_default_xproperty_t, xproperty_type;
 
 	# Types for events
-	type $2_input_xevent_t, $1_input_xevent_type, xevent_type;
 	type $2_property_xevent_t, xevent_type;
 	type $2_focus_xevent_t, xevent_type;
 	type $2_manage_xevent_t, xevent_type;
 	type $2_default_xevent_t, xevent_type;
 	type $2_client_xevent_t, xevent_type;
 
+	# Type attributes
+	typeattribute $2_t x_domain;
+	typeattribute $2_t $1_x_domain;
+
 	##############################
 	#
 	# Local Policy
@@ -740,7 +879,7 @@
 	allow $3 x_server_domain:x_server getattr;
 	# everyone can do override-redirect windows.
 	# this could be used to spoof labels
-	allow $3 self:x_drawable override;
+	allow $3 $3:x_drawable override;
 	# everyone can receive management events on the root window
 	# allows to know when new windows appear, among other things
 	allow $3 manage_xevent_t:x_event receive;
@@ -749,7 +888,7 @@
 	# can read server-owned resources
 	allow $3 x_server_domain:x_resource read;
 	# can mess with own clients
-	allow $3 self:x_client { manage destroy };
+	allow $3 $3:x_client { manage destroy };
 
 	# X Protocol Extensions
 	allow $3 std_xext_t:x_extension { query use };
@@ -758,27 +897,17 @@
 
 	# X Properties
 	# can read and write client properties
-	allow $3 $2_xproperty_t:x_property { create destroy read write append };
+	allow $3 $2_xproperty_t:x_property { getattr create destroy read write append };
 	type_transition $3 xproperty_t:x_property $2_xproperty_t;
 	# can read and write cut buffers
-	allow $3 clipboard_xproperty_t:x_property { create read write append };
+	allow $3 clipboard_xproperty_t:x_property { getattr create read write append };
 	# can read info properties
-	allow $3 info_xproperty_t:x_property read;
-	# can change properties of root window
-	allow $3 $1_rootwindow_t:x_drawable { list_property get_property set_property };
+	allow $3 info_xproperty_t:x_property { getattr read };
 	# can change properties of own windows
-	allow $3 self:x_drawable { list_property get_property set_property };
+	allow $3 $3:x_drawable { list_property get_property set_property };
 
-	# X Windows
-	# operations allowed on root windows
-	allow $3 $1_rootwindow_t:x_drawable { getattr list_child add_child remove_child send receive };
 	# operations allowed on my windows
-	allow $3 self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
-	type_transition $3 $1_rootwindow_t:x_drawable $3;
-
-	# X Colormaps
-	# can use the default colormap
-	allow $3 $1_rootwindow_t:x_colormap { read use add_color };
+	allow $3 $3:x_drawable { blend create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
 
 	# X Input
 	# can receive own events
@@ -805,6 +934,12 @@
 	allow $3 manage_xevent_t:x_synthetic_event send;
 	allow $3 client_xevent_t:x_synthetic_event send;
 
+	allow $3 input_xevent_t:x_event receive;
+	allow $3 input_xevent_t:x_synthetic_event send;
+	allow $3 $2_client_xevent_t:x_synthetic_event send;
+	allow $3 xproperty_t:x_property { read destroy };
+	allow $3 xselection_t:x_selection setattr;
+
 	# X Selections
 	# can use the clipboard
 	allow $3 clipboard_xselection_t:x_selection { getattr setattr read };
@@ -813,13 +948,15 @@
 
 	# Other X Objects
 	# can create and use cursors
-	allow $3 self:x_cursor *;
+	allow $3 $3:x_cursor *;
 	# can create and use graphics contexts
-	allow $3 self:x_gc *;
+	allow $3 $3:x_gc *;
 	# can create and use colormaps
-	allow $3 self:x_colormap *;
+	allow $3 $3:x_colormap *;
 	# can read and write own objects
-	allow $3 self:x_resource { read write };
+	allow $3 $3:x_resource { read write };
+
+	xserver_common_app($1, $3)
 
 	tunable_policy(`! xserver_object_manager',`
 		# should be xserver_unconfined($3),
@@ -879,17 +1016,17 @@
 #
 template(`xserver_user_x_domain_template',`
 	gen_require(`
-		type xdm_t, xdm_tmp_t;
-		type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
+		type xdm_t, xdm_tmp_t, xdm_xproperty_t;
+		type xauth_home_t, iceauth_home_t;
 	')
 
-	allow $3 self:shm create_shm_perms;
-	allow $3 self:unix_dgram_socket create_socket_perms;
-	allow $3 self:unix_stream_socket { connectto create_stream_socket_perms };
+	allow $3 $3:shm create_shm_perms;
+	allow $3 $3:unix_dgram_socket create_socket_perms;
+	allow $3 $3:unix_stream_socket { connectto create_stream_socket_perms };
 
 	# Read .Xauthority file
-	allow $3 $1_xauth_home_t:file { getattr read };
-	allow $3 $1_iceauth_home_t:file { getattr read };
+	allow $3 xauth_home_t:file { getattr read };
+	allow $3 iceauth_home_t:file { getattr read };
 
 	# for when /tmp/.X11-unix is created by the system
 	allow $3 xdm_t:fd use;
@@ -916,11 +1053,9 @@
 	# X object manager
 	xserver_common_x_domain_template($1, $2, $3)
 
-	# Client write xserver shm
-	tunable_policy(`allow_write_xshm',`
-		allow $3 $1_xserver_t:shm rw_shm_perms;
-		allow $3 $1_xserver_tmpfs_t:file rw_file_perms;
-	')
+	allow $3 xdm_t:x_client { getattr destroy };
+	allow $3 xdm_t:x_drawable { receive get_property getattr send list_child };
+	allow $3 xdm_xproperty_t:x_property { write read };
 ')
 
 ########################################
@@ -952,26 +1087,43 @@
 #
 template(`xserver_use_user_fonts',`
 	gen_require(`
-		type $1_fonts_t, $1_fonts_cache_t, $1_fonts_config_t;
+		type fonts_home_t, fonts_cache_home_t, fonts_config_home_t;
 	')
 
 	# Read per user fonts
-	allow $2 $1_fonts_t:dir list_dir_perms;
-	allow $2 $1_fonts_t:file read_file_perms;
+	read_files_pattern($2, fonts_home_t,  fonts_home_t)
 
 	# Manipulate the global font cache
-	manage_dirs_pattern($2, $1_fonts_cache_t, $1_fonts_cache_t)
-	manage_files_pattern($2, $1_fonts_cache_t, $1_fonts_cache_t)
+	manage_dirs_pattern($2, fonts_cache_home_t, fonts_cache_home_t)
+	manage_files_pattern($2, fonts_cache_home_t, fonts_cache_home_t)
 
 	# Read per user font config
-	allow $2 $1_fonts_config_t:dir list_dir_perms;
-	allow $2 $1_fonts_config_t:file read_file_perms;
+	allow $2 fonts_config_home_t:dir list_dir_perms;
+	allow $2 fonts_config_home_t:file read_file_perms;
 
 	userdom_search_user_home_dirs($1, $2)
 ')
 
 ########################################
 ## <summary>
+##	Get the attributes of xauth executable
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xserver_getattr_xauth',`
+	gen_require(`
+		type xauth_exec_t;
+	')
+
+	allow $1 xauth_exec_t:file getattr;
+')
+
+########################################
+## <summary>
 ##	Transition to a user Xauthority domain.
 ## </summary>
 ## <desc>
@@ -1005,6 +1157,73 @@
 
 ########################################
 ## <summary>
+##	Read a user Xauthority domain.
+## </summary>
+## <desc>
+##	<p>
+##	read to a user Xauthority domain.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`xserver_read_user_xauth',`
+	gen_require(`
+		type xauth_home_t;
+	')
+
+	allow $2 xauth_home_t:file { getattr read };
+')
+
+########################################
+## <summary>
+##	Read a user Iceauthority domain.
+## </summary>
+## <desc>
+##	<p>
+##	read to a user Iceauthority domain.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`xserver_read_user_iceauth',`
+	gen_require(`
+		type iceauth_home_t;
+	')
+
+	# Read .Iceauthority file
+	allow $2 iceauth_home_t:file { getattr read };
+')
+
+########################################
+## <summary>
 ##	Transition to a user Xauthority domain.
 ## </summary>
 ## <desc>
@@ -1030,10 +1249,10 @@
 #
 template(`xserver_user_home_dir_filetrans_user_xauth',`
 	gen_require(`
-		type $1_xauth_home_t;
+		type xauth_home_t;
 	')
 
-	userdom_user_home_dir_filetrans($1, $2, $1_xauth_home_t, file)
+	userdom_user_home_dir_filetrans($1, $2, xauth_home_t, file)
 ')
 
 ########################################
@@ -1219,6 +1438,25 @@
 
 ########################################
 ## <summary>
+##	Connect to apmd over an unix stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xserver_stream_connect',`
+	gen_require(`
+		type xdm_xserver_t, xserver_var_run_t;
+	')
+
+	files_search_pids($1)
+	stream_connect_pattern($1, xserver_var_run_t, xserver_var_run_t, xdm_xserver_t)
+')
+
+########################################
+## <summary>
 ##	Read xdm-writable configuration files.
 ## </summary>
 ## <param name="domain">
@@ -1273,6 +1511,7 @@
 	files_search_tmp($1)
 	allow $1 xdm_tmp_t:dir list_dir_perms;
 	create_sock_files_pattern($1, xdm_tmp_t, xdm_tmp_t)
+	allow $1 xdm_tmp_t:sock_file unlink;
 ')
 
 ########################################
@@ -1291,7 +1530,7 @@
 	')
 
 	files_search_pids($1)
-	allow $1 xdm_var_run_t:file read_file_perms;
+	read_files_pattern($1, xdm_var_run_t, xdm_var_run_t)
 ')
 
 ########################################
@@ -1314,6 +1553,24 @@
 
 ########################################
 ## <summary>
+##      dontaudit search of XDM var lib directories.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`xserver_dontaudit_xdm_lib_search',`
+	gen_require(`
+		type xdm_var_lib_t;
+	')
+
+	dontaudit $1 xdm_var_lib_t:dir search_dir_perms;
+')
+
+########################################
+## <summary>
 ##	Execute the X server in the XDM X server domain.
 ## </summary>
 ## <param name="domain">
@@ -1324,15 +1581,47 @@
 #
 interface(`xserver_domtrans_xdm_xserver',`
 	gen_require(`
-		type xdm_xserver_t, xserver_exec_t;
+		type xdm_xserver_t, xserver_exec_t, xdm_t;
 	')
 
  	allow $1 xdm_xserver_t:process siginh;
+ 	allow xdm_t $1:process sigchld;
 	domtrans_pattern($1, xserver_exec_t, xdm_xserver_t)
 ')
 
 ########################################
 ## <summary>
+##	Execute xsever in the xdm_xserver domain, and
+##	allow the specified role the xdm_xserver domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed the xdm_xserver domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the terminal allow the xdm_xserver domain to use.
+##	</summary>
+## </param>
+#
+interface(`xserver_run_xdm_xserver',`
+	gen_require(`
+		type xdm_xserver_t;
+	')
+
+	xserver_domtrans_xdm_xserver($1)
+	role $2 types xdm_xserver_t;
+	allow xdm_xserver_t $3:chr_file rw_term_perms;
+')
+
+########################################
+## <summary>
 ##	Make an X session script an entrypoint for the specified domain.
 ## </summary>
 ## <param name="domain">
@@ -1482,7 +1771,7 @@
 		type xdm_xserver_tmp_t;
 	')
 
-	allow $1 xdm_xserver_tmp_t:file { getattr read };
+	read_files_pattern($1, xdm_xserver_tmp_t, xdm_xserver_tmp_t)
 ')
 
 ########################################
@@ -1674,6 +1963,65 @@
 
 ########################################
 ## <summary>
+##	Connect to apmd over an unix stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xserver_xdm_stream_connect',`
+	gen_require(`
+		type xdm_t, xdm_var_run_t;
+	')
+
+	files_search_pids($1)
+	allow $1 xdm_var_run_t:sock_file write;
+	allow $1 xdm_t:unix_stream_socket connectto;
+')
+
+########################################
+## <summary>
+##	xdm xserver RW shared memory socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xserver_xdm_rw_shm',`
+	gen_require(`
+		type xdm_xserver_t;
+	')
+
+	allow xdm_xserver_t $1:fd use;
+	allow $1 xdm_xserver_t:shm rw_shm_perms;
+	allow xdm_xserver_t $1:shm rw_shm_perms;
+
+')
+
+########################################
+## <summary>
+##	Ptrace XDM 
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit
+##	</summary>
+## </param>
+#
+interface(`xserver_ptrace_xdm',`
+	gen_require(`
+		type xdm_t;
+	')
+
+	allow $1 xdm_t:process ptrace;
+')
+
+########################################
+## <summary>
 ##	Interface to provide X object permissions on a given X server to
 ##	an X client domain.  Gives the domain complete control over the
 ##	display.
@@ -1686,8 +2034,126 @@
 #
 interface(`xserver_unconfined',`
 	gen_require(`
-		attribute xserver_unconfined_type;
+		attribute xserver_unconfined_type, x_domain;
+	')
+
+	typeattribute $1 xserver_unconfined_type, x_domain;
+')
+
+########################################
+## <summary>
+##	Execute xserver files created in /var/run
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xserver_exec_pid',`
+	gen_require(`
+		type xserver_var_run_t;
+	')
+
+	files_search_pids($1)
+	exec_files_pattern($1, xserver_var_run_t, xserver_var_run_t)
+')
+
+########################################
+## <summary>
+##	Write xserver files created in /var/run
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xserver_write_pid',`
+	gen_require(`
+		type xserver_var_run_t;
+	')
+
+	files_search_pids($1)
+	write_files_pattern($1, xserver_var_run_t, xserver_var_run_t)
+')
+
+########################################
+## <summary>
+##	Read user homedir fonts.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`xserver_manage_home_fonts',`
+	gen_require(`
+		type fonts_home_t;
+		type fonts_config_home_t;
+	')
+
+	manage_dirs_pattern($1, fonts_home_t, fonts_home_t)
+	manage_files_pattern($1, fonts_home_t, fonts_home_t)
+	manage_lnk_files_pattern($1, fonts_home_t, fonts_home_t)
+
+	manage_files_pattern($1, fonts_config_home_t, fonts_config_home_t)
+')
+
+########################################
+## <summary>
+##	Read user homedir fonts.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`xserver_read_home_fonts',`
+	gen_require(`
+		type fonts_home_t;
+	')
+
+	read_files_pattern($1, fonts_home_t, fonts_home_t)
+	read_lnk_files_pattern($1, fonts_home_t, fonts_home_t)
+')
+
+########################################
+## <summary>
+##	write to .xsession-errors file
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xserver_rw_xdm_home_files',`
+	gen_require(`
+		type xdm_home_t;
+	')
+
+	allow $1 xdm_home_t:file rw_file_perms;
+')
+
+########################################
+## <summary>
+##	Dontaudit write to .xsession-errors file
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit
+##	</summary>
+## </param>
+#
+interface(`xserver_dontaudit_rw_xdm_home_files',`
+	gen_require(`
+		type xdm_home_t;
 	')
 
-	typeattribute $1 xserver_unconfined_type;
+	dontaudit $1 xdm_home_t:file rw_file_perms;
 ')
--- nsaserefpolicy/policy/modules/services/xserver.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/xserver.te	2008-08-14 13:53:54.000000000 -0400
@@ -8,6 +8,14 @@
 
 ## <desc>
 ## <p>
+## Allows X clients to read the x devices (keyboard/mouse)
+## </p>
+## </desc>
+gen_tunable(allow_read_x_device, true)
+
+
+## <desc>
+## <p>
 ## Allows clients to write to the X server shared
 ## memory segments.
 ## </p>
@@ -16,6 +24,13 @@
 
 ## <desc>
 ## <p>
+## Allows XServer to execute writable memory
+## </p>
+## </desc>
+gen_tunable(allow_xserver_execmem, false)
+
+## <desc>
+## <p>
 ## Allow xdm logins as sysadm
 ## </p>
 ## </desc>
@@ -36,6 +51,7 @@
 # Domains
 attribute xserver_unconfined_type;
 attribute x_server_domain;
+attribute x_server_domain_tmpfs;
 
 # Per-object attributes
 attribute rootwindow_type;
@@ -92,7 +108,7 @@
 files_lock_file(xdm_lock_t)
 
 type xdm_rw_etc_t;
-files_type(xdm_rw_etc_t)
+files_config_file(xdm_rw_etc_t)
 
 type xdm_var_lib_t;
 files_type(xdm_var_lib_t)
@@ -100,6 +116,12 @@
 type xdm_var_run_t;
 files_pid_file(xdm_var_run_t)
 
+type xserver_var_lib_t;
+files_type(xserver_var_lib_t)
+
+type xserver_var_run_t;
+files_pid_file(xserver_var_run_t)
+
 type xdm_tmp_t;
 files_tmp_file(xdm_tmp_t)
 typealias xdm_tmp_t alias ice_tmp_t;
@@ -107,6 +129,9 @@
 type xdm_tmpfs_t;
 files_tmpfs_file(xdm_tmpfs_t)
 
+type xdm_home_t;
+userdom_user_home_content(user, xdm_home_t)
+
 # type for /var/lib/xkb
 type xkb_var_lib_t;
 files_type(xkb_var_lib_t)
@@ -122,6 +147,27 @@
 type xserver_log_t;
 logging_log_file(xserver_log_t)
 
+type fonts_cache_home_t, fonts_cache_type;
+userdom_user_home_content(user, fonts_cache_home_t)
+
+type fonts_home_t, fonts_type;
+userdom_user_home_content(user, fonts_home_t)
+
+type fonts_config_home_t, fonts_config_type;
+userdom_user_home_content(user, fonts_config_home_t)
+
+type iceauth_home_t;
+userdom_user_home_content(user, iceauth_home_t)
+
+type xauth_home_t, xauth_home_type;
+userdom_user_home_content(user, xauth_home_t)
+
+type admin_xauth_home_t;
+files_type(admin_xauth_home_t)
+
+type xauth_tmp_t;
+files_tmp_file(xauth_tmp_t)
+
 xserver_common_domain_template(xdm)
 xserver_common_x_domain_template(xdm, xdm, xdm_t)
 init_system_domain(xdm_xserver_t, xserver_exec_t)
@@ -140,8 +186,9 @@
 # XDM Local policy
 #
 
-allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service };
-allow xdm_t self:process { setexec setpgid getsched setsched setrlimit signal_perms setkeycreate };
+allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service sys_ptrace };
+allow xdm_t self:process { setexec setpgid getsched setsched setrlimit signal_perms setkeycreate ptrace };
+allow xdm_t self:process { getattr getcap setcap };
 allow xdm_t self:fifo_file rw_fifo_file_perms;
 allow xdm_t self:shm create_shm_perms;
 allow xdm_t self:sem create_sem_perms;
@@ -154,6 +201,12 @@
 allow xdm_t self:key { search link write };
 
 allow xdm_t xconsole_device_t:fifo_file { getattr setattr };
+manage_dirs_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t)
+manage_files_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t)
+
+manage_files_pattern(xdm_t, xdm_home_t, xdm_home_t)
+unprivuser_home_dir_filetrans(xdm_t, xdm_home_t, file)
+#userdom_manage_user_home_content_files(user, xdm_t)
 
 # Allow gdm to run gdm-binary
 can_exec(xdm_t, xdm_exec_t)
@@ -169,6 +222,8 @@
 manage_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
 manage_sock_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
 files_tmp_filetrans(xdm_t, xdm_tmp_t, { file dir sock_file })
+relabelfrom_dirs_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
+relabelfrom_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
 
 manage_dirs_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
 manage_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
@@ -176,15 +231,25 @@
 manage_fifo_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
 manage_sock_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
 fs_tmpfs_filetrans(xdm_t, xdm_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
+fs_rw_tmpfs_files(xdm_xserver_t)
+fs_getattr_all_fs(xdm_t)
+fs_search_inotifyfs(xdm_t)
+fs_list_all(xdm_t)
+
+manage_files_pattern(xdm_t, fonts_home_t, fonts_home_t)
 
 manage_dirs_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)	
 manage_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)
-files_var_lib_filetrans(xdm_t, xdm_var_lib_t, file)
+manage_sock_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)
+files_var_lib_filetrans(xdm_t, xdm_var_lib_t, { file dir })
+# Read machine-id
+files_read_var_lib_files(xdm_t)
 
 manage_dirs_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
 manage_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
 manage_fifo_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
-files_pid_filetrans(xdm_t, xdm_var_run_t, { dir file fifo_file })
+manage_sock_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
+files_pid_filetrans(xdm_t, xdm_var_run_t, { dir file fifo_file sock_file })
 
 allow xdm_t xdm_xserver_t:process signal;
 allow xdm_t xdm_xserver_t:unix_stream_socket connectto;
@@ -198,6 +263,7 @@
 allow xdm_t xdm_xserver_t:process { noatsecure siginh rlimitinh signal sigkill };
 
 allow xdm_t xdm_xserver_t:shm rw_shm_perms;
+read_files_pattern(xdm_t, xdm_xserver_t, xdm_xserver_t)
 
 # connect to xdm xserver over stream socket
 stream_connect_pattern(xdm_t, xdm_xserver_tmp_t, xdm_xserver_tmp_t, xdm_xserver_t)
@@ -229,6 +295,7 @@
 corenet_udp_sendrecv_all_ports(xdm_t)
 corenet_tcp_bind_all_nodes(xdm_t)
 corenet_udp_bind_all_nodes(xdm_t)
+corenet_udp_bind_xdmcp_port(xdm_t)
 corenet_tcp_connect_all_ports(xdm_t)
 corenet_sendrecv_all_client_packets(xdm_t)
 # xdm tries to bind to biff_port_t
@@ -241,6 +308,7 @@
 dev_getattr_mouse_dev(xdm_t)
 dev_setattr_mouse_dev(xdm_t)
 dev_rw_apm_bios(xdm_t)
+dev_rw_input_dev(xdm_t)
 dev_setattr_apm_bios_dev(xdm_t)
 dev_rw_dri(xdm_t)
 dev_rw_agp(xdm_t)
@@ -253,14 +321,17 @@
 dev_setattr_video_dev(xdm_t)
 dev_getattr_scanner_dev(xdm_t)
 dev_setattr_scanner_dev(xdm_t)
-dev_getattr_sound_dev(xdm_t)
-dev_setattr_sound_dev(xdm_t)
+dev_read_sound(xdm_t)
+dev_write_sound(xdm_t)
 dev_getattr_power_mgmt_dev(xdm_t)
 dev_setattr_power_mgmt_dev(xdm_t)
+dev_getattr_null_dev(xdm_t)
+dev_setattr_null_dev(xdm_t)
 
 domain_use_interactive_fds(xdm_t)
 # Do not audit denied probes of /proc.
 domain_dontaudit_read_all_domains_state(xdm_t)
+domain_dontaudit_ptrace_all_domains(xdm_t)
 
 files_read_etc_files(xdm_t)
 files_read_var_files(xdm_t)
@@ -271,9 +342,13 @@
 files_read_usr_files(xdm_t)
 # Poweroff wants to create the /poweroff file when run from xdm
 files_create_boot_flag(xdm_t)
+files_dontaudit_getattr_boot_dirs(xdm_t)
+files_dontaudit_write_usr_files(xdm_t)
 
 fs_getattr_all_fs(xdm_t)
 fs_search_auto_mountpoints(xdm_t)
+fs_rw_anon_inodefs_files(xdm_t)
+fs_mount_tmpfs(xdm_t)
 
 storage_dontaudit_read_fixed_disk(xdm_t)
 storage_dontaudit_write_fixed_disk(xdm_t)
@@ -282,6 +357,7 @@
 storage_dontaudit_raw_write_removable_device(xdm_t)
 storage_dontaudit_setattr_removable_dev(xdm_t)
 storage_dontaudit_rw_scsi_generic(xdm_t)
+storage_dontaudit_rw_fuse(xdm_t)
 
 term_setattr_console(xdm_t)
 term_use_unallocated_ttys(xdm_t)
@@ -290,6 +366,7 @@
 auth_domtrans_pam_console(xdm_t)
 auth_manage_pam_pid(xdm_t)
 auth_manage_pam_console_data(xdm_t)
+auth_signal_pam(xdm_t)
 auth_rw_faillog(xdm_t)
 auth_write_login_records(xdm_t)
 
@@ -301,21 +378,25 @@
 libs_exec_lib_files(xdm_t)
 
 logging_read_generic_logs(xdm_t)
+logging_send_audit_msgs(xdm_t)
 
 miscfiles_read_localization(xdm_t)
 miscfiles_read_fonts(xdm_t)
-
-sysnet_read_config(xdm_t)
+miscfiles_manage_localization(xdm_t)
 
 userdom_dontaudit_use_unpriv_user_fds(xdm_t)
 userdom_create_all_users_keys(xdm_t)
 # for .dmrc
-userdom_read_unpriv_users_home_content_files(xdm_t)
+unprivuser_read_home_content_files(xdm_t)
+unprivuser_dontaudit_write_home_content_files(xdm_t)
+
 # Search /proc for any user domain processes.
 userdom_read_all_users_state(xdm_t)
 userdom_signal_all_users(xdm_t)
-
-sysadm_dontaudit_search_home_dirs(xdm_t)
+#
+# Wants to delete .xsession-errors file
+#
+userdom_unlink_unpriv_users_home_content_files(xdm_t)
 
 xserver_rw_session_template(xdm, xdm_t, xdm_tmpfs_t)
 xserver_unconfined(xdm_t)
@@ -348,10 +429,12 @@
 
 optional_policy(`
 	alsa_domtrans(xdm_t)
+	alsa_read_rw_config(xdm_t)
 ')
 
 optional_policy(`
 	consolekit_dbus_chat(xdm_t)
+	consolekit_read_log(xdm_t)
 ')
 
 optional_policy(`
@@ -359,6 +442,22 @@
 ')
 
 optional_policy(`
+	# Use dbus to start other processes as xdm_t
+	dbus_per_role_template(xdm, xdm_t, system_r)
+	corecmd_bin_entry_type(xdm_t)
+
+	dbus_system_bus_client_template(xdm, xdm_t)
+
+	optional_policy(`
+		hal_dbus_chat(xdm_t)
+	')
+
+	optional_policy(`
+		networkmanager_dbus_chat(xdm_t)
+	')
+')
+
+optional_policy(`
 	# Talk to the console mouse server.
 	gpm_stream_connect(xdm_t)
 	gpm_setattr_gpmctl(xdm_t)
@@ -382,16 +481,32 @@
 ')
 
 optional_policy(`
+	polkit_domtrans_auth(xdm_t)
+	polkit_read_lib(xdm_t)
+')
+
+# On crash gdm execs gdb to dump stack
+optional_policy(`
+	rpm_read_db(xdm_t)
+	rpm_dontaudit_manage_db(xdm_t)
+')
+
+optional_policy(`
 	seutil_sigchld_newrole(xdm_t)
 ')
 
 optional_policy(`
+	sysadm_dontaudit_search_home_dirs(xdm_t)
+	sysadm_dontaudit_read_home_sym_links(xdm_t)
+')
+
+optional_policy(`
 	udev_read_db(xdm_t)
 ')
 
 optional_policy(`
-	unconfined_domain(xdm_t)
 	unconfined_domtrans(xdm_t)
+	unconfined_signal(xdm_t)
 
 	ifndef(`distro_redhat',`
 		allow xdm_t self:process { execheap execmem };
@@ -427,7 +542,7 @@
 allow xdm_xserver_t xdm_var_lib_t:file { getattr read };
 dontaudit xdm_xserver_t xdm_var_lib_t:dir search;
 
-allow xdm_xserver_t xdm_var_run_t:file { getattr read };
+read_files_pattern(xdm_xserver_t, xdm_var_run_t, xdm_var_run_t)
 
 # Label pid and temporary files with derived types.
 manage_files_pattern(xdm_xserver_t, xdm_tmp_t, xdm_tmp_t)
@@ -439,6 +554,15 @@
 can_exec(xdm_xserver_t, xkb_var_lib_t)
 files_search_var_lib(xdm_xserver_t)
 
+manage_dirs_pattern(xdm_xserver_t, xserver_var_lib_t, xserver_var_lib_t)	
+manage_files_pattern(xdm_xserver_t, xserver_var_lib_t, xserver_var_lib_t)
+files_var_lib_filetrans(xdm_xserver_t, xserver_var_lib_t, dir)
+
+manage_dirs_pattern(xdm_xserver_t, xserver_var_run_t, xserver_var_run_t)	
+manage_files_pattern(xdm_xserver_t, xserver_var_run_t, xserver_var_run_t)
+manage_sock_files_pattern(xdm_xserver_t, xdm_var_run_t, xdm_var_run_t)
+files_pid_filetrans(xdm_xserver_t, xserver_var_run_t, { dir file })
+
 # VNC v4 module in X server
 corenet_tcp_bind_vnc_port(xdm_xserver_t)
 
@@ -450,10 +574,19 @@
 # xdm_xserver_t may no longer have any reason
 # to read ROLE_home_t - examine this in more detail
 # (xauth?)
-userdom_read_unpriv_users_home_content_files(xdm_xserver_t)
+unprivuser_read_home_content_files(xdm_xserver_t)
+unprivuser_manage_tmp_files(xdm_xserver_t)
 
 xserver_use_all_users_fonts(xdm_xserver_t)
 
+getty_use_fds(xdm_xserver_t)
+locallogin_use_fds(xdm_xserver_t)
+userdom_dontaudit_write_user_home_content_files(user, xdm_xserver_t)
+
+optional_policy(`
+	userhelper_search_config(xdm_xserver_t)
+')
+
 tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_dirs(xdm_xserver_t)
 	fs_manage_nfs_files(xdm_xserver_t)
@@ -468,8 +601,19 @@
 
 optional_policy(`
 	dbus_system_bus_client_template(xdm_xserver, xdm_xserver_t)
+
+	optional_policy(`
 	hal_dbus_chat(xdm_xserver_t)
 ')
+')
+
+optional_policy(`
+	locallogin_use_fds(xdm_xserver_t)
+')
+
+optional_policy(`
+	mono_rw_shm(xdm_xserver_t)
+')
 
 optional_policy(`
 	resmgr_stream_connect(xdm_t)
@@ -481,8 +625,25 @@
 ')
 
 optional_policy(`
-	unconfined_domain_noaudit(xdm_xserver_t)
-	unconfined_domtrans(xdm_xserver_t)
+	rpm_dontaudit_rw_shm(xdm_xserver_t)
+	rpm_rw_tmpfs_files(xdm_xserver_t)
+')
+
+optional_policy(`
+	unconfined_rw_shm(xdm_xserver_t)
+	unconfined_execmem_rw_shm(xdm_xserver_t)
+	unconfined_rw_tmpfs_files(xdm_xserver_t)
+
+	# xserver signals unconfined user on startx
+	unconfined_signal(xdm_xserver_t)
+	unconfined_getpgid(xdm_xserver_t)
+	unconfined_domain(xdm_xserver_t)
+')
+
+
+tunable_policy(`allow_xserver_execmem',`
+	allow xdm_xserver_t self:process { execheap execmem execstack };
+')
 
 	ifndef(`distro_redhat',`
 		allow xdm_xserver_t self:process { execheap execmem };
@@ -491,7 +652,6 @@
 	ifdef(`distro_rhel4',`
 		allow xdm_xserver_t self:process { execheap execmem };
 	')
-')
 
 ########################################
 #
@@ -544,3 +704,10 @@
 #
 allow pam_t xdm_t:fifo_file { getattr ioctl write };
 ') dnl end TODO
+
+# Client write xserver shm
+tunable_policy(`allow_write_xshm',`
+	allow x_domain x_server_domain:shm rw_shm_perms;
+	allow x_domain xdm_xserver_tmpfs_t:file rw_file_perms;
+')
+
