[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     b43e53edeed2e3caa3f40bb8d38e7a3cdf36d76d
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Thu Sep 27 13:26:50 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Sep 27 18:02:53 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=b43e53ed

Changes to the dbus policy module and its dependencies

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>
Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/contrib/dbus.fc        |   25 +--
 policy/modules/contrib/dbus.if        |  270 +++++++++++++++------------------
 policy/modules/contrib/dbus.te        |  144 +++++++++++++++---
 policy/modules/contrib/evolution.te   |    6 +-
 policy/modules/contrib/gpg.te         |    4 +-
 policy/modules/contrib/mozilla.te     |    8 +-
 policy/modules/contrib/policykit.te   |    4 +-
 policy/modules/contrib/pulseaudio.te  |    6 +-
 policy/modules/contrib/telepathy.if   |    6 +
 policy/modules/contrib/telepathy.te   |    2 +-
 policy/modules/contrib/thunderbird.te |    4 +-
 policy/modules/contrib/wm.if          |    2 +-
 policy/modules/contrib/wm.te          |    2 +-
 13 files changed, 277 insertions(+), 206 deletions(-)

diff --git a/policy/modules/contrib/dbus.fc b/policy/modules/contrib/dbus.fc
index e6345ce..897f816 100644
--- a/policy/modules/contrib/dbus.fc
+++ b/policy/modules/contrib/dbus.fc
@@ -1,25 +1,18 @@
-/etc/dbus-1(/.*)?		gen_context(system_u:object_r:dbusd_etc_t,s0)
+/etc/dbus-.*(/.*)?	gen_context(system_u:object_r:dbusd_etc_t,s0)
 
-/bin/dbus-daemon 	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-daemon	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
 
-ifdef(`distro_redhat',`
-/lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
-')
+/lib/dbus-.*/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
 
-/usr/bin/dbus-daemon(-1)? --	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-daemon(-1)?	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
 
-ifdef(`distro_debian',`
-/usr/lib/dbus-1.0/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
-')
+/usr/lib/dbus-.*/dbus-daemon-launch-helper	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
 
-ifdef(`distro_gentoo',`
-/usr/libexec/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
-')
+/usr/libexec/dbus-daemon-launch-helper	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
 
-/var/lib/dbus(/.*)?		gen_context(system_u:object_r:system_dbusd_var_lib_t,s0)
+/var/lib/dbus(/.*)?	gen_context(system_u:object_r:system_dbusd_var_lib_t,s0)
 
-/var/run/dbus(/.*)?		gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
+/var/run/dbus(/.*)?	gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
+/var/run/messagebus\.pid	--	gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
 
-ifdef(`distro_redhat',`
 /var/named/chroot/var/run/dbus(/.*)?	gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
-')

diff --git a/policy/modules/contrib/dbus.if b/policy/modules/contrib/dbus.if
index 222d21f..b548647 100644
--- a/policy/modules/contrib/dbus.if
+++ b/policy/modules/contrib/dbus.if
@@ -1,4 +1,4 @@
-## <summary>Desktop messaging bus</summary>
+## <summary>Desktop messaging bus.</summary>
 
 ########################################
 ## <summary>
@@ -19,7 +19,7 @@ interface(`dbus_stub',`
 
 ########################################
 ## <summary>
-##	Role access for dbus
+##	Role access for dbus.
 ## </summary>
 ## <param name="role_prefix">
 ##	<summary>
@@ -41,20 +41,20 @@ interface(`dbus_stub',`
 template(`dbus_role_template',`
 	gen_require(`
 		class dbus { send_msg acquire_svc };
-
 		attribute session_bus_type;
-		type system_dbusd_t, session_dbusd_tmp_t, dbusd_exec_t, dbusd_etc_t;
+		type system_dbusd_t, dbusd_exec_t;
 	')
 
 	##############################
 	#
-	# Delcarations
+	# Declarations
 	#
 
 	type $1_dbusd_t, session_bus_type;
 	domain_type($1_dbusd_t)
 	domain_entry_file($1_dbusd_t, dbusd_exec_t)
 	ubac_constrained($1_dbusd_t)
+
 	role $2 types $1_dbusd_t;
 
 	##############################
@@ -62,118 +62,36 @@ template(`dbus_role_template',`
 	# Local policy
 	#
 
-	allow $1_dbusd_t self:process { getattr sigkill signal };
-	dontaudit $1_dbusd_t self:process ptrace;
-	allow $1_dbusd_t self:file { getattr read write };
-	allow $1_dbusd_t self:fifo_file rw_fifo_file_perms;
-	allow $1_dbusd_t self:dbus { send_msg acquire_svc };
-	allow $1_dbusd_t self:unix_stream_socket create_stream_socket_perms;
-	allow $1_dbusd_t self:unix_dgram_socket create_socket_perms;
-	allow $1_dbusd_t self:tcp_socket create_stream_socket_perms;
-	allow $1_dbusd_t self:netlink_selinux_socket create_socket_perms;
-
-	# For connecting to the bus
 	allow $3 $1_dbusd_t:unix_stream_socket connectto;
-
-	# SE-DBus specific permissions
 	allow $3 $1_dbusd_t:dbus { send_msg acquire_svc };
-	allow $3 system_dbusd_t:dbus { send_msg acquire_svc };
 
-	allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms;
-	read_files_pattern($1_dbusd_t, dbusd_etc_t, dbusd_etc_t)
-	read_lnk_files_pattern($1_dbusd_t, dbusd_etc_t, dbusd_etc_t)
-
-	manage_dirs_pattern($1_dbusd_t, session_dbusd_tmp_t, session_dbusd_tmp_t)
-	manage_files_pattern($1_dbusd_t, session_dbusd_tmp_t, session_dbusd_tmp_t)
-	files_tmp_filetrans($1_dbusd_t, session_dbusd_tmp_t, { file dir })
+	allow $3 system_dbusd_t:dbus { send_msg acquire_svc };
 
 	domtrans_pattern($3, dbusd_exec_t, $1_dbusd_t)
-	allow $3 $1_dbusd_t:process { signull sigkill signal };
 
-	# cjp: this seems very broken
-	corecmd_bin_domtrans($1_dbusd_t, $3)
-	allow $1_dbusd_t $3:process sigkill;
-	allow $3 $1_dbusd_t:fd use;
-	allow $3 $1_dbusd_t:fifo_file rw_fifo_file_perms;
-	allow $3 $1_dbusd_t:process sigchld;
-
-	kernel_read_system_state($1_dbusd_t)
-	kernel_read_kernel_sysctls($1_dbusd_t)
-
-	corecmd_list_bin($1_dbusd_t)
-	corecmd_read_bin_symlinks($1_dbusd_t)
-	corecmd_read_bin_files($1_dbusd_t)
-	corecmd_read_bin_pipes($1_dbusd_t)
-	corecmd_read_bin_sockets($1_dbusd_t)
-
-	corenet_all_recvfrom_unlabeled($1_dbusd_t)
-	corenet_all_recvfrom_netlabel($1_dbusd_t)
-	corenet_tcp_sendrecv_generic_if($1_dbusd_t)
-	corenet_tcp_sendrecv_generic_node($1_dbusd_t)
-	corenet_tcp_sendrecv_all_ports($1_dbusd_t)
-	corenet_tcp_bind_generic_node($1_dbusd_t)
-	corenet_tcp_bind_reserved_port($1_dbusd_t)
-
-	dev_read_urand($1_dbusd_t)
-
- 	domain_use_interactive_fds($1_dbusd_t)
-	domain_read_all_domains_state($1_dbusd_t)
-
-	files_read_etc_files($1_dbusd_t)
-	files_list_home($1_dbusd_t)
-	files_read_usr_files($1_dbusd_t)
-	files_dontaudit_search_var($1_dbusd_t)
-
-	fs_getattr_romfs($1_dbusd_t)
-	fs_getattr_xattr_fs($1_dbusd_t)
-	fs_list_inotifyfs($1_dbusd_t)
-	fs_dontaudit_list_nfs($1_dbusd_t)
-
-	selinux_get_fs_mount($1_dbusd_t)
-	selinux_validate_context($1_dbusd_t)
-	selinux_compute_access_vector($1_dbusd_t)
-	selinux_compute_create_context($1_dbusd_t)
-	selinux_compute_relabel_context($1_dbusd_t)
-	selinux_compute_user_contexts($1_dbusd_t)
-
-	auth_read_pam_console_data($1_dbusd_t)
-	auth_use_nsswitch($1_dbusd_t)
-
-	logging_send_audit_msgs($1_dbusd_t)
-	logging_send_syslog_msg($1_dbusd_t)
-
-	miscfiles_read_localization($1_dbusd_t)
-
-	seutil_read_config($1_dbusd_t)
-	seutil_read_default_contexts($1_dbusd_t)
+	ps_process_pattern($3, $1_dbusd_t)
+	allow $3 $1_dbusd_t:process { ptrace signal_perms };
 
-	term_use_all_terms($1_dbusd_t)
+	allow $1_dbusd_t $3:process sigkill;
 
-	userdom_read_user_home_content_files($1_dbusd_t)
+	corecmd_bin_domtrans($1_dbusd_t, $3)
+	corecmd_shell_domtrans($1_dbusd_t, $3)
 
+	auth_use_nsswitch($1_dbusd_t)
 
-	ifdef(`hide_broken_symptoms', `
+	ifdef(`hide_broken_symptoms',`
 		dontaudit $3 $1_dbusd_t:netlink_selinux_socket { read write };
 	')
 
 	optional_policy(`
-		hal_dbus_chat($1_dbusd_t)
-	')
-
-	optional_policy(`
 		xdg_read_generic_data_home_files($1_dbusd_t)
 	')
-
-	optional_policy(`
-		xserver_use_xdm_fds($1_dbusd_t)
-		xserver_rw_xdm_pipes($1_dbusd_t)
-	')
 ')
 
 #######################################
 ## <summary>
 ##	Template for creating connections to
-##	the system DBUS.
+##	the system bus.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -183,19 +101,16 @@ template(`dbus_role_template',`
 #
 interface(`dbus_system_bus_client',`
 	gen_require(`
-		type system_dbusd_t, system_dbusd_t;
-		type system_dbusd_var_run_t, system_dbusd_var_lib_t;
+		type system_dbusd_t, system_dbusd_var_run_t, system_dbusd_var_lib_t;
 		class dbus send_msg;
 	')
 
-	# SE-DBus specific permissions
 	allow $1 { system_dbusd_t self }:dbus send_msg;
 	allow system_dbusd_t $1:dbus send_msg;
 
 	read_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
 	files_search_var_lib($1)
 
-	# For connecting to the bus
 	files_search_pids($1)
 	stream_connect_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t, system_dbusd_t)
 	dbus_read_config($1)
@@ -203,9 +118,61 @@ interface(`dbus_system_bus_client',`
 
 #######################################
 ## <summary>
-##	Template for creating connections to
-##	a user DBUS.
+##	Acquire service on specified
+##	DBUS session bus.
+## </summary>
+## <param name="role_prefix">
+##	<summary>
+##	The prefix of the user role (e.g., user
+##	is the prefix for user_r).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dbus_connect_session_bus',`
+	gen_require(`
+		type $1_dbusd_t;
+		class dbus acquire_svc;
+	')
+
+	allow $2 $1_dbusd_t:dbus acquire_svc;
+')
+
+#######################################
+## <summary>
+##	Acquire service on all DBUS
+##	session busses.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dbus_connect_all_session_bus',`
+	gen_require(`
+		attribute session_bus_type;
+		class dbus acquire_svc;
+	')
+
+	allow $1 session_bus_type:dbus acquire_svc;
+')
+
+#######################################
+## <summary>
+##	Creating connections to specified
+##	DBUS session bus.
 ## </summary>
+## <param name="role_prefix">
+##	<summary>
+##	The prefix of the user role (e.g., user
+##	is the prefix for user_r).
+##	</summary>
+## </param>
 ## <param name="domain">
 ##	<summary>
 ##	Domain allowed access.
@@ -214,23 +181,48 @@ interface(`dbus_system_bus_client',`
 #
 interface(`dbus_session_bus_client',`
 	gen_require(`
+		type $1_dbusd_t;
+		class dbus send_msg;
+	')
+
+	allow $2 { $1_dbusd_t self }:dbus send_msg;
+	allow $2 $1_dbusd_t:unix_stream_socket connectto;
+	allow $2 $1_dbusd_t:fd use;
+')
+
+#######################################
+## <summary>
+##	Creating connections to all
+##	DBUS session busses.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dbus_all_session_bus_client',`
+	gen_require(`
 		attribute session_bus_type;
 		class dbus send_msg;
 	')
 
-	# SE-DBus specific permissions
 	allow $1 { session_bus_type self }:dbus send_msg;
-
-	# For connecting to the bus
 	allow $1 session_bus_type:unix_stream_socket connectto;
-
-	dontaudit $1 session_bus_type:fd use;
+	allow $1 session_bus_type:fd use;
 ')
 
-########################################
+#######################################
 ## <summary>
-##	Send a message the session DBUS.
+##	Send messages to specified
+##	DBUS session bus.
 ## </summary>
+## <param name="role_prefix">
+##	<summary>
+##	The prefix of the user role (e.g., user
+##	is the prefix for user_r).
+##	</summary>
+## </param>
 ## <param name="domain">
 ##	<summary>
 ##	Domain allowed access.
@@ -239,16 +231,16 @@ interface(`dbus_session_bus_client',`
 #
 interface(`dbus_send_session_bus',`
 	gen_require(`
-		attribute session_bus_type;
+		type $1_dbusd_t;
 		class dbus send_msg;
 	')
 
-	allow $1 session_bus_type:dbus send_msg;
+	allow $2 $1_dbusd_t:dbus send_msg;
 ')
 
 ########################################
 ## <summary>
-##	Read dbus configuration.
+##	Read dbus configuration content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -307,29 +299,15 @@ interface(`dbus_manage_lib_files',`
 
 ########################################
 ## <summary>
-##	Connect to the system DBUS
-##	for service (acquire_svc).
+##	Allow a application domain to be
+##	started by the specified session bus.
 ## </summary>
-## <param name="domain">
+## <param name="role_prefix">
 ##	<summary>
-##	Domain allowed access.
+##	The prefix of the user role (e.g., user
+##	is the prefix for user_r).
 ##	</summary>
 ## </param>
-#
-interface(`dbus_connect_session_bus',`
-	gen_require(`
-		attribute session_bus_type;
-		class dbus acquire_svc;
-	')
-
-	allow $1 session_bus_type:dbus acquire_svc;
-')
-
-########################################
-## <summary>
-##	Allow a application domain to be started
-##	by the session dbus.
-## </summary>
 ## <param name="domain">
 ##	<summary>
 ##	Type to be used as a domain.
@@ -344,19 +322,18 @@ interface(`dbus_connect_session_bus',`
 #
 interface(`dbus_session_domain',`
 	gen_require(`
-		attribute session_bus_type;
+		type $1_dbusd_t;
 	')
 
-	domtrans_pattern(session_bus_type, $2, $1)
+	domtrans_pattern($1_dbusd_t, $2, $3)
 
-	dbus_session_bus_client($1)
-	dbus_connect_session_bus($1)
+	dbus_session_bus_client($1, $2)
+	dbus_connect_session_bus($1, $2)
 ')
 
 ########################################
 ## <summary>
-##	Connect to the system DBUS
-##	for service (acquire_svc).
+##	Acquire service on the DBUS system bus.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -375,7 +352,7 @@ interface(`dbus_connect_system_bus',`
 
 ########################################
 ## <summary>
-##	Send a message on the system DBUS.
+##	Send messages to the DBUS system bus.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -438,7 +415,7 @@ interface(`dbus_create_system_dbusd_var_run_dirs',`
 
 ########################################
 ## <summary>
-##	Allow unconfined access to the system DBUS.
+##	Unconfined access to DBUS system bus.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -457,8 +434,8 @@ interface(`dbus_system_bus_unconfined',`
 
 ########################################
 ## <summary>
-##	Create a domain for processes
-##	which can be started by the system dbus
+##	Create a domain for processes which
+##	can be started by the DBUS system bus.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -498,7 +475,8 @@ interface(`dbus_system_domain',`
 
 ########################################
 ## <summary>
-##	Use and inherit system DBUS file descriptors.
+##	Use and inherit DBUS system bus
+##	file descriptors.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -516,7 +494,8 @@ interface(`dbus_use_system_bus_fds',`
 
 ########################################
 ## <summary>
-##	Dontaudit Read, and write system dbus TCP sockets.
+##	Do not audit attempts to read and
+##	write DBUS system bus TCP sockets.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -529,13 +508,12 @@ interface(`dbus_dontaudit_system_bus_rw_tcp_sockets',`
 		type system_dbusd_t;
 	')
 
-	allow $1 system_dbusd_t:tcp_socket { read write };
-	allow $1 system_dbusd_t:fd use;
+	dontaudit $1 system_dbusd_t:tcp_socket { read write };
 ')
 
 ########################################
 ## <summary>
-##	Allow unconfined access to the system DBUS.
+##	Unconfined access to DBUS.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

diff --git a/policy/modules/contrib/dbus.te b/policy/modules/contrib/dbus.te
index 192037d..1020bac 100644
--- a/policy/modules/contrib/dbus.te
+++ b/policy/modules/contrib/dbus.te
@@ -1,4 +1,4 @@
-policy_module(dbus, 1.17.0)
+policy_module(dbus, 1.18.0)
 
 gen_require(`
 	class dbus all_dbus_perms;
@@ -6,7 +6,7 @@ gen_require(`
 
 ##############################
 #
-# Delcarations
+# Declarations
 #
 
 attribute dbusd_unconfined;
@@ -45,45 +45,53 @@ ifdef(`enable_mls',`
 	init_ranged_system_domain(system_dbusd_t, dbusd_exec_t, s0 - mls_systemhigh)
 ')
 
-##############################
+######################################
 #
-# System bus local policy
+# Local policy
 #
 
-# dac_override: /var/run/dbus is owned by messagebus on Debian
-# cjp: dac_override should probably go in a distro_debian
-allow system_dbusd_t self:capability { dac_override setgid setpcap setuid };
+allow system_dbusd_t self:capability { sys_resource dac_override setgid setpcap setuid };
 dontaudit system_dbusd_t self:capability sys_tty_config;
 allow system_dbusd_t self:process { getattr getsched signal_perms setpgid getcap setcap setrlimit };
 allow system_dbusd_t self:fifo_file rw_fifo_file_perms;
 allow system_dbusd_t self:dbus { send_msg acquire_svc };
-allow system_dbusd_t self:unix_stream_socket { connectto create_stream_socket_perms connectto };
-allow system_dbusd_t self:unix_dgram_socket create_socket_perms;
-# Receive notifications of policy reloads and enforcing status changes.
+allow system_dbusd_t self:unix_stream_socket { accept connectto listen };
 allow system_dbusd_t self:netlink_selinux_socket { create bind read };
 
-can_exec(system_dbusd_t, dbusd_exec_t)
-
 allow system_dbusd_t dbusd_etc_t:dir list_dir_perms;
 read_files_pattern(system_dbusd_t, dbusd_etc_t, dbusd_etc_t)
 read_lnk_files_pattern(system_dbusd_t, dbusd_etc_t, dbusd_etc_t)
 
 manage_dirs_pattern(system_dbusd_t, system_dbusd_tmp_t, system_dbusd_tmp_t)
 manage_files_pattern(system_dbusd_t, system_dbusd_tmp_t, system_dbusd_tmp_t)
-files_tmp_filetrans(system_dbusd_t, system_dbusd_tmp_t, { file dir })
+files_tmp_filetrans(system_dbusd_t, system_dbusd_tmp_t, { dir file })
 
 read_files_pattern(system_dbusd_t, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
 
+manage_dirs_pattern(system_dbusd_t, system_dbusd_var_run_t, system_dbusd_var_run_t)
 manage_files_pattern(system_dbusd_t, system_dbusd_var_run_t, system_dbusd_var_run_t)
 manage_sock_files_pattern(system_dbusd_t, system_dbusd_var_run_t, system_dbusd_var_run_t)
-files_pid_filetrans(system_dbusd_t, system_dbusd_var_run_t, file)
+files_pid_filetrans(system_dbusd_t, system_dbusd_var_run_t, { dir file })
+
+can_exec(system_dbusd_t, dbusd_exec_t)
 
 kernel_read_system_state(system_dbusd_t)
 kernel_read_kernel_sysctls(system_dbusd_t)
 
+corecmd_list_bin(system_dbusd_t)
+corecmd_read_bin_pipes(system_dbusd_t)
+corecmd_read_bin_sockets(system_dbusd_t)
+corecmd_exec_shell(system_dbusd_t)
+
 dev_read_urand(system_dbusd_t)
 dev_read_sysfs(system_dbusd_t)
 
+domain_use_interactive_fds(system_dbusd_t)
+domain_read_all_domains_state(system_dbusd_t)
+
+files_list_home(system_dbusd_t)
+files_read_usr_files(system_dbusd_t)
+
 fs_getattr_all_fs(system_dbusd_t)
 fs_list_inotifyfs(system_dbusd_t)
 fs_search_auto_mountpoints(system_dbusd_t)
@@ -108,16 +116,9 @@ term_dontaudit_use_console(system_dbusd_t)
 auth_use_nsswitch(system_dbusd_t)
 auth_read_pam_console_data(system_dbusd_t)
 
-corecmd_list_bin(system_dbusd_t)
-corecmd_read_bin_pipes(system_dbusd_t)
-corecmd_read_bin_sockets(system_dbusd_t)
-
-domain_use_interactive_fds(system_dbusd_t)
-domain_read_all_domains_state(system_dbusd_t)
-
-files_read_etc_files(system_dbusd_t)
-files_list_home(system_dbusd_t)
-files_read_usr_files(system_dbusd_t)
+init_use_fds(system_dbusd_t)
+init_use_script_ptys(system_dbusd_t)
+init_domtrans_script(system_dbusd_t)
 
 init_use_fds(system_dbusd_t)
 init_use_script_ptys(system_dbusd_t)
@@ -141,6 +142,14 @@ optional_policy(`
 ')
 
 optional_policy(`
+	bluetooth_stream_connect(system_dbusd_t)
+')
+
+optional_policy(`
+	cpufreqselector_dbus_chat(system_dbusd_t)
+')
+
+optional_policy(`
 	policykit_dbus_chat(system_dbusd_t)
 	policykit_domtrans_auth(system_dbusd_t)
 	policykit_search_lib(system_dbusd_t)
@@ -156,7 +165,92 @@ optional_policy(`
 
 ########################################
 #
+# Common session bus local policy
+#
+
+allow session_bus_type self:capability2 block_suspend;
+dontaudit session_bus_type self:capability sys_resource;
+allow session_bus_type self:process { getattr sigkill signal };
+dontaudit session_bus_type self:process { ptrace setrlimit };
+allow session_bus_type self:file { getattr read write };
+allow session_bus_type self:fifo_file rw_fifo_file_perms;
+allow session_bus_type self:dbus { send_msg acquire_svc };
+allow session_bus_type self:unix_stream_socket { accept listen };
+allow session_bus_type self:tcp_socket { accept listen };
+allow session_bus_type self:netlink_selinux_socket create_socket_perms;
+
+allow session_bus_type dbusd_etc_t:dir list_dir_perms;
+read_files_pattern(session_bus_type, dbusd_etc_t, dbusd_etc_t)
+read_lnk_files_pattern(session_bus_type, dbusd_etc_t, dbusd_etc_t)
+
+manage_dirs_pattern(session_bus_type, session_dbusd_tmp_t, session_dbusd_tmp_t)
+manage_files_pattern(session_bus_type, session_dbusd_tmp_t, session_dbusd_tmp_t)
+files_tmp_filetrans(session_bus_type, session_dbusd_tmp_t, { dir file })
+
+kernel_read_system_state(session_bus_type)
+kernel_read_kernel_sysctls(session_bus_type)
+
+corecmd_list_bin(session_bus_type)
+corecmd_read_bin_symlinks(session_bus_type)
+corecmd_read_bin_files(session_bus_type)
+corecmd_read_bin_pipes(session_bus_type)
+corecmd_read_bin_sockets(session_bus_type)
+
+corenet_all_recvfrom_unlabeled(session_bus_type)
+corenet_all_recvfrom_netlabel(session_bus_type)
+corenet_tcp_sendrecv_generic_if(session_bus_type)
+corenet_tcp_sendrecv_generic_node(session_bus_type)
+corenet_tcp_sendrecv_all_ports(session_bus_type)
+corenet_tcp_bind_generic_node(session_bus_type)
+
+corenet_sendrecv_all_server_packets(session_bus_type)
+corenet_tcp_bind_reserved_port(session_bus_type)
+
+dev_read_urand(session_bus_type)
+
+domain_read_all_domains_state(session_bus_type)
+domain_use_interactive_fds(session_bus_type)
+
+files_list_home(session_bus_type)
+files_read_usr_files(session_bus_type)
+files_dontaudit_search_var(session_bus_type)
+
+fs_getattr_romfs(session_bus_type)
+fs_getattr_xattr_fs(session_bus_type)
+fs_list_inotifyfs(session_bus_type)
+fs_dontaudit_list_nfs(session_bus_type)
+
+selinux_get_fs_mount(session_bus_type)
+selinux_validate_context(session_bus_type)
+selinux_compute_access_vector(session_bus_type)
+selinux_compute_create_context(session_bus_type)
+selinux_compute_relabel_context(session_bus_type)
+selinux_compute_user_contexts(session_bus_type)
+
+auth_read_pam_console_data(session_bus_type)
+
+logging_send_audit_msgs(session_bus_type)
+logging_send_syslog_msg(session_bus_type)
+
+miscfiles_read_localization(session_bus_type)
+
+seutil_read_config(session_bus_type)
+seutil_read_default_contexts(session_bus_type)
+
+term_use_all_terms(session_bus_type)
+
+optional_policy(`
+	hal_dbus_chat(session_bus_type)
+')
+
+optional_policy(`
+	xserver_use_xdm_fds(session_bus_type)
+	xserver_rw_xdm_pipes(session_bus_type)
+')
+
+########################################
+#
 # Unconfined access to this module
 #
 
-allow dbusd_unconfined session_bus_type:dbus all_dbus_perms;
+allow dbusd_unconfined { system_dbusd_t session_bus_type }:dbus all_dbus_perms;

diff --git a/policy/modules/contrib/evolution.te b/policy/modules/contrib/evolution.te
index 73cb712..1c536fe 100644
--- a/policy/modules/contrib/evolution.te
+++ b/policy/modules/contrib/evolution.te
@@ -1,4 +1,4 @@
-policy_module(evolution, 2.3.0)
+policy_module(evolution, 2.3.1)
 
 ########################################
 #
@@ -283,7 +283,7 @@ optional_policy(`
 
 optional_policy(`
 	dbus_system_bus_client(evolution_t)
-	dbus_session_bus_client(evolution_t)
+	dbus_all_session_bus_client(evolution_t)
 ')
 
 optional_policy(`
@@ -383,7 +383,7 @@ tunable_policy(`use_samba_home_dirs',`
 ')
 
 optional_policy(`
-	dbus_session_bus_client(evolution_alarm_t)
+	dbus_all_session_bus_client(evolution_alarm_t)
 ')
 
 optional_policy(`

diff --git a/policy/modules/contrib/gpg.te b/policy/modules/contrib/gpg.te
index 3afaba2..c999516 100644
--- a/policy/modules/contrib/gpg.te
+++ b/policy/modules/contrib/gpg.te
@@ -1,4 +1,4 @@
-policy_module(gpg, 2.6.2)
+policy_module(gpg, 2.6.3)
 
 ########################################
 #
@@ -341,7 +341,7 @@ tunable_policy(`use_samba_home_dirs',`
 ')
 
 optional_policy(`
-	dbus_session_bus_client(gpg_pinentry_t)
+	dbus_all_session_bus_client(gpg_pinentry_t)
 	dbus_system_bus_client(gpg_pinentry_t)
 ')
 

diff --git a/policy/modules/contrib/mozilla.te b/policy/modules/contrib/mozilla.te
index 012b782..201a4a9 100644
--- a/policy/modules/contrib/mozilla.te
+++ b/policy/modules/contrib/mozilla.te
@@ -1,4 +1,4 @@
-policy_module(mozilla, 2.6.0)
+policy_module(mozilla, 2.6.1)
 
 ########################################
 #
@@ -287,8 +287,8 @@ optional_policy(`
 ')
 
 optional_policy(`
-	dbus_session_bus_client(mozilla_t)
 	dbus_system_bus_client(mozilla_t)
+	dbus_all_session_bus_client(mozilla_t)
 
 	optional_policy(`
 		networkmanager_dbus_chat(mozilla_t)
@@ -493,9 +493,9 @@ optional_policy(`
 ')
 
 optional_policy(`
-	dbus_read_lib_files(mozilla_plugin_t)
-	dbus_session_bus_client(mozilla_plugin_t)
 	dbus_system_bus_client(mozilla_plugin_t)
+	dbus_all_session_bus_client(mozilla_plugin_t)
+	dbus_read_lib_files(mozilla_plugin_t)
 ')
 
 optional_policy(`

diff --git a/policy/modules/contrib/policykit.te b/policy/modules/contrib/policykit.te
index fd58d32..2c37cce 100644
--- a/policy/modules/contrib/policykit.te
+++ b/policy/modules/contrib/policykit.te
@@ -1,4 +1,4 @@
-policy_module(policykit, 1.2.1)
+policy_module(policykit, 1.2.2)
 
 ########################################
 #
@@ -106,7 +106,7 @@ userdom_dontaudit_read_user_home_content_files(policykit_auth_t)
 
 optional_policy(`
 	dbus_system_bus_client(policykit_auth_t)
-	dbus_session_bus_client(policykit_auth_t)
+	dbus_all_session_bus_client(policykit_auth_t)
 
 	optional_policy(`
 		consolekit_dbus_chat(policykit_auth_t)

diff --git a/policy/modules/contrib/pulseaudio.te b/policy/modules/contrib/pulseaudio.te
index 901ac9b..b48444a 100644
--- a/policy/modules/contrib/pulseaudio.te
+++ b/policy/modules/contrib/pulseaudio.te
@@ -1,4 +1,4 @@
-policy_module(pulseaudio, 1.5.0)
+policy_module(pulseaudio, 1.5.1)
 
 ########################################
 #
@@ -104,8 +104,8 @@ optional_policy(`
 optional_policy(`
 	dbus_system_domain(pulseaudio_t, pulseaudio_exec_t)
 	dbus_system_bus_client(pulseaudio_t)
-	dbus_session_bus_client(pulseaudio_t)
-	dbus_connect_session_bus(pulseaudio_t)
+	dbus_all_session_bus_client(pulseaudio_t)
+	dbus_connect_all_session_bus(pulseaudio_t)
 
 	optional_policy(`
 		consolekit_dbus_chat(pulseaudio_t)

diff --git a/policy/modules/contrib/telepathy.if b/policy/modules/contrib/telepathy.if
index f09171e..a3530f5 100644
--- a/policy/modules/contrib/telepathy.if
+++ b/policy/modules/contrib/telepathy.if
@@ -44,6 +44,12 @@ template(`telepathy_domain_template',`
 ##	The type of the user domain.
 ##	</summary>
 ## </param>
+## <param name="role_prefix">
+##	<summary>
+##	The prefix of the user role (e.g., user
+##	is the prefix for user_r).
+##	</summary>
+## </param>
 #
 template(`telepathy_role', `
 	gen_require(`

diff --git a/policy/modules/contrib/telepathy.te b/policy/modules/contrib/telepathy.te
index 1ff3f20..f01a972 100644
--- a/policy/modules/contrib/telepathy.te
+++ b/policy/modules/contrib/telepathy.te
@@ -1,4 +1,4 @@
-policy_module(telepathy, 1.3.2)
+policy_module(telepathy, 1.3.3)
 
 ########################################
 #

diff --git a/policy/modules/contrib/thunderbird.te b/policy/modules/contrib/thunderbird.te
index bf37d98..4a87f58 100644
--- a/policy/modules/contrib/thunderbird.te
+++ b/policy/modules/contrib/thunderbird.te
@@ -1,4 +1,4 @@
-policy_module(thunderbird, 2.3.0)
+policy_module(thunderbird, 2.3.1)
 
 ########################################
 #
@@ -179,7 +179,7 @@ tunable_policy(`mail_read_content',`
 
 optional_policy(`
 	dbus_system_bus_client(thunderbird_t)
-	dbus_session_bus_client(thunderbird_t)
+	dbus_all_session_bus_client(thunderbird_t)
 ')
 
 optional_policy(`

diff --git a/policy/modules/contrib/wm.if b/policy/modules/contrib/wm.if
index b3efef7..e6497fb 100644
--- a/policy/modules/contrib/wm.if
+++ b/policy/modules/contrib/wm.if
@@ -79,7 +79,7 @@ template(`wm_role_template',`
 
 	optional_policy(`
 		dbus_system_bus_client($1_wm_t)
-		dbus_session_bus_client($1_wm_t)
+		dbus_session_bus_client($1, $1_wm_t)
 	')
 
 	optional_policy(`

diff --git a/policy/modules/contrib/wm.te b/policy/modules/contrib/wm.te
index 19d447e..8e1a668 100644
--- a/policy/modules/contrib/wm.te
+++ b/policy/modules/contrib/wm.te
@@ -1,4 +1,4 @@
-policy_module(wm, 1.2.0)
+policy_module(wm, 1.2.1)
 
 ########################################
 #