diff --git a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc
index e588faba2..3a642b8e1 100644
--- a/policy/modules/services/xserver.fc
+++ b/policy/modules/services/xserver.fc
@@ -1,6 +1,7 @@
 #
 # HOME_DIR
 #
+HOME_DIR/\.dmrc		--	gen_context(system_u:object_r:dmrc_home_t,s0)
 HOME_DIR/\.fonts\.conf	--	gen_context(system_u:object_r:user_fonts_config_t,s0)
 HOME_DIR/\.fonts(/.*)?		gen_context(system_u:object_r:user_fonts_t,s0)
 HOME_DIR/\.fonts/auto(/.*)?	gen_context(system_u:object_r:user_fonts_cache_t,s0)
diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
index afc157fb4..a5dbdaad1 100644
--- a/policy/modules/services/xserver.if
+++ b/policy/modules/services/xserver.if
@@ -600,6 +600,25 @@ interface(`xserver_read_user_xauth',`
 	userdom_search_user_home_dirs($1)
 ')
 
+########################################
+## <summary>
+##	Read all users .dmrc.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xserver_read_user_dmrc',`
+	gen_require(`
+		type dmrc_home_t;
+	')
+
+	allow $1 dmrc_home_t:file read_file_perms;
+	userdom_search_user_home_dirs($1)
+')
+
 ########################################
 ## <summary>
 ##	Set the attributes of the X windows console named pipes.
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index 54fbf1241..ff3d0cfd6 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -211,6 +211,9 @@ corecmd_executable_file(xsession_exec_t)
 type xserver_log_t;
 logging_log_file(xserver_log_t)
 
+type dmrc_home_t;
+userdom_user_home_content(dmrc_home_t)
+
 ifdef(`enable_mcs',`
 	init_ranged_domain(xdm_t, xdm_exec_t, s0 - mcs_systemhigh)
 	init_ranged_daemon_domain(xdm_t, xdm_exec_t, s0 - mcs_systemhigh)
@@ -467,12 +470,14 @@ sysnet_read_config(xdm_t)
 
 userdom_dontaudit_use_unpriv_user_fds(xdm_t)
 userdom_create_all_users_keys(xdm_t)
-# for .dmrc
-userdom_read_user_home_content_files(xdm_t)
 # Search /proc for any user domain processes.
 userdom_read_all_users_state(xdm_t)
 userdom_signal_all_users(xdm_t)
 
+# for .dmrc: this was used by the Gnome Display Manager (gdm)
+# and it is now obsolete in Gnome3
+xserver_read_user_dmrc(xdm_t)
+
 xserver_rw_session(xdm_t, xdm_tmpfs_t)
 xserver_unconfined(xdm_t)