diff --git a/policy/modules/apps/telepathy.if b/policy/modules/apps/telepathy.if
index d81dc193d..b0554ef0c 100644
--- a/policy/modules/apps/telepathy.if
+++ b/policy/modules/apps/telepathy.if
@@ -41,18 +41,23 @@ template(`telepathy_domain_template',`
##
##
##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## The role associated with the user domain.
+## The prefix of the user role (e.g., user
+## is the prefix for user_r).
##
##
##
##
-## The type of the user domain.
+## User domain for the role.
+##
+##
+##
+##
+## User exec domain for execute and transition access.
+##
+##
+##
+##
+## Role allowed access
##
##
#
@@ -74,7 +79,7 @@ template(`telepathy_role_template',`
type telepathy_mission_control_home_t;
')
- role $2 types telepathy_domain;
+ role $4 types telepathy_domain;
allow $3 telepathy_domain:process { ptrace signal_perms };
ps_process_pattern($3, telepathy_domain)
@@ -93,34 +98,38 @@ template(`telepathy_role_template',`
dbus_spec_session_domain($1, telepathy_stream_engine_t, telepathy_stream_engine_exec_t)
dbus_spec_session_domain($1, telepathy_msn_t, telepathy_msn_exec_t)
- allow $3 { telepathy_mission_control_xdg_cache_t telepathy_xdg_cache_t telepathy_logger_xdg_cache_t }:dir { manage_dir_perms relabel_dir_perms };
- allow $3 { telepathy_gabble_xdg_cache_t telepathy_mission_control_home_t telepathy_xdg_data_t }:dir { manage_dir_perms relabel_dir_perms };
- allow $3 { telepathy_mission_control_xdg_data_t telepathy_sunshine_home_t telepathy_logger_xdg_data_t }:dir { manage_dir_perms relabel_dir_perms };
+ allow $2 { telepathy_mission_control_xdg_cache_t telepathy_xdg_cache_t telepathy_logger_xdg_cache_t }:dir { manage_dir_perms relabel_dir_perms };
+ allow $2 { telepathy_gabble_xdg_cache_t telepathy_mission_control_home_t telepathy_xdg_data_t }:dir { manage_dir_perms relabel_dir_perms };
+ allow $2 { telepathy_mission_control_xdg_data_t telepathy_sunshine_home_t telepathy_logger_xdg_data_t }:dir { manage_dir_perms relabel_dir_perms };
- allow $3 { telepathy_mission_control_xdg_cache_t telepathy_xdg_cache_t telepathy_logger_xdg_cache_t }:file { manage_file_perms relabel_file_perms };
- allow $3 { telepathy_gabble_xdg_cache_t telepathy_mission_control_home_t telepathy_xdg_data_t }:file { manage_file_perms relabel_file_perms };
- allow $3 { telepathy_mission_control_xdg_data_t telepathy_sunshine_home_t telepathy_logger_xdg_data_t }:file { manage_file_perms relabel_file_perms };
+ allow $2 { telepathy_mission_control_xdg_cache_t telepathy_xdg_cache_t telepathy_logger_xdg_cache_t }:file { manage_file_perms relabel_file_perms };
+ allow $2 { telepathy_gabble_xdg_cache_t telepathy_mission_control_home_t telepathy_xdg_data_t }:file { manage_file_perms relabel_file_perms };
+ allow $2 { telepathy_mission_control_xdg_data_t telepathy_sunshine_home_t telepathy_logger_xdg_data_t }:file { manage_file_perms relabel_file_perms };
- filetrans_pattern($3, telepathy_xdg_cache_t, telepathy_gabble_xdg_cache_t, dir, "gabble")
- # gnome_cache_filetrans($3, telepathy_gabble_cache_home_t, dir, "wocky")
+ filetrans_pattern($2, telepathy_xdg_cache_t, telepathy_gabble_xdg_cache_t, dir, "gabble")
+ # gnome_cache_filetrans($2, telepathy_gabble_cache_home_t, dir, "wocky")
- filetrans_pattern($3, telepathy_xdg_cache_t, telepathy_logger_xdg_cache_t, dir, "logger")
- # gnome_data_filetrans($3, telepathy_logger_data_home_t, dir, "TpLogger")
+ filetrans_pattern($2, telepathy_xdg_cache_t, telepathy_logger_xdg_cache_t, dir, "logger")
+ # gnome_data_filetrans($2, telepathy_logger_data_home_t, dir, "TpLogger")
- userdom_user_home_dir_filetrans($3, telepathy_mission_control_home_t, dir, ".mission-control")
- filetrans_pattern($3, telepathy_xdg_data_t, telepathy_mission_control_xdg_data_t, dir, "mission-control")
- # gnome_cache_filetrans($3, telepathy_mission_control_cache_home_t, file, ".mc_connections")
+ userdom_user_home_dir_filetrans($2, telepathy_mission_control_home_t, dir, ".mission-control")
+ filetrans_pattern($2, telepathy_xdg_data_t, telepathy_mission_control_xdg_data_t, dir, "mission-control")
+ # gnome_cache_filetrans($2, telepathy_mission_control_cache_home_t, file, ".mc_connections")
- userdom_user_home_dir_filetrans($3, telepathy_sunshine_home_t, dir, ".telepathy-sunshine")
+ userdom_user_home_dir_filetrans($2, telepathy_sunshine_home_t, dir, ".telepathy-sunshine")
- # gnome_cache_filetrans($3, telepathy_cache_home_t, dir, "telepathy")
- # gnome_data_filetrans($3, telepathy_data_home_t, dir, "telepathy")
+ # gnome_cache_filetrans($2, telepathy_cache_home_t, dir, "telepathy")
+ # gnome_data_filetrans($2, telepathy_data_home_t, dir, "telepathy")
- allow $3 telepathy_tmp_content:dir { manage_dir_perms relabel_dir_perms };
- allow $3 telepathy_tmp_content:file { manage_file_perms relabel_file_perms };
- allow $3 telepathy_tmp_content:sock_file { manage_sock_file_perms relabel_sock_file_perms };
+ allow $2 telepathy_tmp_content:dir { manage_dir_perms relabel_dir_perms };
+ allow $2 telepathy_tmp_content:file { manage_file_perms relabel_file_perms };
+ allow $2 telepathy_tmp_content:sock_file { manage_sock_file_perms relabel_sock_file_perms };
telepathy_mission_control_dbus_chat($3)
+
+ optional_policy(`
+ systemd_user_app_status($1, telepathy_domain)
+ ')
')
########################################
diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index e9f6e4dbe..d85f8de2a 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -179,7 +179,7 @@ ifndef(`distro_redhat',`
')
optional_policy(`
- telepathy_role_template(staff, staff_r, staff_t)
+ telepathy_role_template(staff, staff_t, staff_application_exec_domain, staff_r)
')
optional_policy(`
diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index 32153e42f..829546399 100644
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -163,7 +163,7 @@ ifndef(`distro_redhat',`
')
optional_policy(`
- telepathy_role_template(user, user_r, user_t)
+ telepathy_role_template(user, user_t, user_application_exec_domain, user_r)
')
optional_policy(`