diff --git a/policy/modules/admin/sudo.if b/policy/modules/admin/sudo.if
index 01f408ef4..1c1fbe7b2 100644
--- a/policy/modules/admin/sudo.if
+++ b/policy/modules/admin/sudo.if
@@ -116,8 +116,8 @@ template(`sudo_role_template',`
 	auth_run_chk_passwd($1_sudo_t, $2)
 	# sudo stores a token in the pam_pid directory
 	auth_manage_pam_pid($1_sudo_t)
+	auth_use_pam($1_sudo_t)
 	auth_pid_filetrans_pam_var_run($1_sudo_t, dir, "sudo")
-	auth_use_nsswitch($1_sudo_t)
 
 	init_rw_utmp($1_sudo_t)
 
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index c7714d3e9..edac2833a 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -484,7 +484,6 @@ term_setattr_unallocated_ttys(xdm_t)
 auth_domtrans_pam_console(xdm_t)
 auth_manage_pam_pid(xdm_t)
 auth_manage_pam_console_data(xdm_t)
-auth_rw_faillog(xdm_t)
 auth_write_login_records(xdm_t)
 
 # Run telinit->init to shutdown.
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
index 9b5e0fe00..0153ab079 100644
--- a/policy/modules/system/authlogin.if
+++ b/policy/modules/system/authlogin.if
@@ -47,6 +47,7 @@ interface(`auth_use_pam',`
 	# for encrypted homedir
 	dev_read_sysfs($1)
 
+	auth_create_faillog_files($1)
 	auth_domtrans_chk_passwd($1)
 	auth_domtrans_upd_passwd($1)
 	auth_dontaudit_read_shadow($1)
@@ -54,6 +55,7 @@ interface(`auth_use_pam',`
 	auth_append_login_records($1)
 	auth_rw_lastlog($1)
 	auth_rw_faillog($1)
+	auth_setattr_faillog_files($1)
 	auth_exec_pam($1)
 	auth_use_nsswitch($1)
 
@@ -744,6 +746,24 @@ interface(`auth_append_faillog',`
 	allow $1 faillog_t:file append_file_perms;
 ')
 
+########################################
+## <summary>
+##	Create fail log lock (in /run/faillock).
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`auth_create_faillog_files',`
+	gen_require(`
+		type faillog_t;
+	')
+
+	create_files_pattern($1, faillog_t, faillog_t)
+')
+
 ########################################
 ## <summary>
 ##	Read and write the login failure log.
@@ -782,6 +802,24 @@ interface(`auth_manage_faillog',`
 	logging_rw_generic_log_dirs($1)
 ')
 
+########################################
+## <summary>
+##	Setattr the login failure logs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`auth_setattr_faillog_files',`
+	gen_require(`
+		type faillog_t;
+	')
+
+	setattr_files_pattern($1, faillog_t, faillog_t)
+')
+
 #######################################
 ## <summary>
 ##	Read the last logins log.