diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
index 6e60c1431..bfe1625e9 100644
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -164,9 +164,11 @@ dev_write_sound(mozilla_t)
domain_dontaudit_read_all_domains_state(mozilla_t)
+files_watch_etc_dirs(mozilla_t)
files_read_etc_runtime_files(mozilla_t)
files_map_usr_files(mozilla_t)
files_read_usr_files(mozilla_t)
+files_watch_usr_dirs(mozilla_t)
files_read_var_files(mozilla_t)
files_read_var_lib_files(mozilla_t)
files_read_var_symlinks(mozilla_t)
diff --git a/policy/modules/apps/wm.if b/policy/modules/apps/wm.if
index 260a7b015..538d6968f 100644
--- a/policy/modules/apps/wm.if
+++ b/policy/modules/apps/wm.if
@@ -89,6 +89,10 @@ template(`wm_role_template',`
gnome_stream_connect_all_gkeyringd($1_wm_t)
')
+ optional_policy(`
+ networkmanager_watch_etc_dirs($1_wm_t)
+ ')
+
optional_policy(`
policykit_run_auth($1_wm_t, $2)
policykit_signal_auth($1_wm_t)
diff --git a/policy/modules/services/networkmanager.if b/policy/modules/services/networkmanager.if
index 4c6dd3424..175ac7532 100644
--- a/policy/modules/services/networkmanager.if
+++ b/policy/modules/services/networkmanager.if
@@ -171,6 +171,24 @@ interface(`networkmanager_signal',`
allow $1 NetworkManager_t:process signal;
')
+########################################
+###
+### Watch networkmanager etc dirs.
+###
+###
+###
+### Domain allowed access.
+###
+###
+##
+interface(`networkmanager_watch_etc_dirs',`
+ gen_require(`
+ type NetworkManager_etc_t;
+ ')
+
+ allow $1 NetworkManager_etc_t:dir watch;
+')
+
########################################
##
## Read networkmanager etc files.
diff --git a/policy/modules/system/getty.te b/policy/modules/system/getty.te
index 6d3c4284a..02cc2d1d8 100644
--- a/policy/modules/system/getty.te
+++ b/policy/modules/system/getty.te
@@ -46,6 +46,7 @@ files_lock_filetrans(getty_t, getty_lock_t, file)
allow getty_t getty_log_t:file { append_file_perms create_file_perms setattr_file_perms };
logging_log_filetrans(getty_t, getty_log_t, file)
+allow getty_t getty_runtime_t:dir watch;
manage_files_pattern(getty_t, getty_runtime_t, getty_runtime_t)
files_pid_filetrans(getty_t, getty_runtime_t, file)
diff --git a/policy/modules/system/miscfiles.if b/policy/modules/system/miscfiles.if
index 47330a488..ee606537d 100644
--- a/policy/modules/system/miscfiles.if
+++ b/policy/modules/system/miscfiles.if
@@ -367,6 +367,25 @@ interface(`miscfiles_manage_fonts',`
manage_lnk_files_pattern($1, fonts_t, fonts_t)
')
+########################################
+##
+## Watch fonts directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+#
+interface(`miscfiles_watch_fonts_dirs',`
+ gen_require(`
+ type fonts_t;
+ ')
+
+ allow $1 fonts_t:dir watch;
+')
+
########################################
##
## Set the attributes on a fonts cache directory.
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index dd5558509..ce72d9ea5 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -92,8 +92,11 @@ template(`userdom_base_user_template',`
domain_dontaudit_getsession_all_domains($1_t)
files_read_etc_files($1_t)
+ files_watch_etc_dirs($1_t)
files_read_etc_runtime_files($1_t)
files_read_usr_files($1_t)
+ files_watch_usr_dirs($1_t)
+ files_watch_runtime_dirs($1_t)
# Read directories and files with the readable_t type.
# This type is a general type for "world"-readable files.
files_list_world_readable($1_t)
@@ -112,6 +115,7 @@ template(`userdom_base_user_template',`
miscfiles_read_localization($1_t)
miscfiles_read_generic_certs($1_t)
+ miscfiles_watch_fonts_dirs($1_t)
sysnet_read_config($1_t)
@@ -364,6 +368,8 @@ interface(`userdom_manage_home_role',`
# cjp: this should probably be removed:
allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
+ allow $2 user_home_dir_t:dir watch;
+
userdom_manage_user_certs($2)
userdom_user_home_dir_filetrans($2, user_cert_t, dir, ".pki")