diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc
index 9b924c394..53c2e97b3 100644
--- a/policy/modules/system/udev.fc
+++ b/policy/modules/system/udev.fc
@@ -6,8 +6,11 @@
/etc/hotplug\.d/default/udev.* -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
+/etc/udev/rules.d(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0)
/etc/udev/scripts/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
+/lib/udev/udev-acl -- gen_context(system_u:object_r:udev_exec_t,s0)
+
/sbin/start_udev -- gen_context(system_u:object_r:udev_exec_t,s0)
/sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
/sbin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
diff --git a/policy/modules/system/udev.if b/policy/modules/system/udev.if
index beec752c1..0bd4103e8 100644
--- a/policy/modules/system/udev.if
+++ b/policy/modules/system/udev.if
@@ -1,5 +1,23 @@
## Policy for udev.
+########################################
+##
+## Send generic signals to udev.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`udev_signal',`
+ gen_require(`
+ type udev_t;
+ ')
+
+ allow $1 udev_t:process signal;
+')
+
########################################
##
## Execute udev in the udev domain.
@@ -169,3 +187,23 @@ interface(`udev_rw_db',`
dev_list_all_dev_nodes($1)
allow $1 udev_tbl_t:file rw_file_perms;
')
+
+########################################
+##
+## Create, read, write, and delete
+## udev pid files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`udev_manage_pid_files',`
+ gen_require(`
+ type udev_var_run_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, udev_var_run_t, udev_var_run_t)
+')
diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index 132115c54..c86fad8e0 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -1,5 +1,5 @@
-policy_module(udev, 1.11.0)
+policy_module(udev, 1.11.1)
########################################
#
@@ -66,9 +66,11 @@ dev_filetrans(udev_t, udev_tbl_t, file)
manage_dirs_pattern(udev_t, udev_var_run_t, udev_var_run_t)
manage_files_pattern(udev_t, udev_var_run_t, udev_var_run_t)
+manage_lnk_files_pattern(udev_t, udev_var_run_t, udev_var_run_t)
files_pid_filetrans(udev_t, udev_var_run_t, { dir file })
kernel_read_system_state(udev_t)
+kernel_request_load_module(udev_t)
kernel_getattr_core_if(udev_t)
kernel_use_fds(udev_t)
kernel_read_device_sysctls(udev_t)
@@ -99,7 +101,7 @@ dev_relabel_all_dev_nodes(udev_t)
dev_relabel_generic_symlinks(udev_t)
domain_read_all_domains_state(udev_t)
-domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these
+domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these
files_read_usr_files(udev_t)
files_read_etc_runtime_files(udev_t)
@@ -111,6 +113,7 @@ files_search_mnt(udev_t)
fs_getattr_all_fs(udev_t)
fs_list_inotifyfs(udev_t)
+fs_rw_anon_inodefs_files(udev_t)
mcs_ptrace_all(udev_t)
@@ -140,6 +143,7 @@ logging_send_syslog_msg(udev_t)
logging_send_audit_msgs(udev_t)
miscfiles_read_localization(udev_t)
+miscfiles_read_hwdata(udev_t)
modutils_domtrans_insmod(udev_t)
# read modules.inputmap:
@@ -193,6 +197,10 @@ optional_policy(`
alsa_read_rw_config(udev_t)
')
+optional_policy(`
+ bluetooth_domtrans(udev_t)
+')
+
optional_policy(`
brctl_domtrans(udev_t)
')
@@ -205,10 +213,19 @@ optional_policy(`
consoletype_exec(udev_t)
')
+optional_policy(`
+ cups_domtrans_config(udev_t)
+')
+
optional_policy(`
dbus_system_bus_client(udev_t)
')
+optional_policy(`
+ devicekit_read_pid_files(udev_t)
+ devicekit_dgram_send(udev_t)
+')
+
optional_policy(`
lvm_domtrans(udev_t)
')
@@ -227,6 +244,10 @@ optional_policy(`
hotplug_search_pids(udev_t)
')
+optional_policy(`
+ mount_domtrans(udev_t)
+')
+
optional_policy(`
openct_read_pid_files(udev_t)
openct_domtrans(udev_t)
@@ -241,6 +262,14 @@ optional_policy(`
raid_domtrans_mdadm(udev_t)
')
+optional_policy(`
+ unconfined_signal(udev_t)
+')
+
+optional_policy(`
+ vbetool_domtrans(udev_t)
+')
+
optional_policy(`
kernel_write_xen_state(udev_t)
kernel_read_xen_state(udev_t)