--- nsaserefpolicy/policy/modules/apps/gnome.fc	2008-08-07 11:15:02.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/apps/gnome.fc	2008-08-14 13:53:54.000000000 -0400
@@ -1,8 +1,10 @@
-HOME_DIR/\.config/gtk-.*	gen_context(system_u:object_r:ROLE_gnome_home_t,s0)
-HOME_DIR/\.gconf(d)?(/.*)?	gen_context(system_u:object_r:ROLE_gconf_home_t,s0)
+HOME_DIR/.gnome2(/.*)?		gen_context(system_u:object_r:gnome_home_t,s0)
+HOME_DIR/\.config/gtk-.*	gen_context(system_u:object_r:gnome_home_t,s0)
+HOME_DIR/\.gconf(d)?(/.*)?	gen_context(system_u:object_r:gconf_home_t,s0)
+HOME_DIR/\.local.*		gen_context(system_u:object_r:gconf_home_t,s0)
 
-/etc/gconf(/.*)?		gen_context(system_u:object_r:gconf_etc_t,s0)
+/tmp/gconfd-USER/.*	--	gen_context(system_u:object_r:gconf_tmp_t,s0)
 
-/tmp/gconfd-USER/.*	--	gen_context(system_u:object_r:ROLE_gconf_tmp_t,s0)
-
-/usr/libexec/gconfd-2 	--	gen_context(system_u:object_r:gconfd_exec_t,s0)
+# Don't use because toolchain is broken
+#/usr/libexec/gconfd-2 	--	gen_context(system_u:object_r:gconfd_exec_t,s0)
+HOME_DIR/.pulse(/.*)?		gen_context(system_u:object_r:gnome_home_t,s0)
--- nsaserefpolicy/policy/modules/apps/gnome.if	2008-08-07 11:15:02.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/apps/gnome.if	2008-08-14 13:53:54.000000000 -0400
@@ -36,6 +36,7 @@
 	gen_require(`
 		type gconfd_exec_t, gconf_etc_t;
 		attribute gnomedomain;
+		type gconf_home_t, gconf_tmp_t;
 	')
 
 	##############################
@@ -47,14 +48,9 @@
 	application_domain($1_gconfd_t, gconfd_exec_t)
 	role $3 types $1_gconfd_t;
 
-	type $1_gconf_home_t;
-	userdom_user_home_content($1, $1_gconf_home_t)
-
-	type $1_gnome_home_t;
-	userdom_user_home_content($1, $1_gnome_home_t)
-
-	type $1_gconf_tmp_t;
-	files_tmp_file($1_gconf_tmp_t)
+	typealias gnome_home_t alias $1_gnome_home_t;
+	typealias gconf_home_t alias $1_gconf_home_t;
+	typealias gconf_tmp_t alias $1_gconf_tmp_t;
 
 	##############################
 	#
@@ -64,21 +60,18 @@
 	allow $1_gconfd_t self:process getsched;
  	allow $1_gconfd_t self:fifo_file rw_fifo_file_perms;
 
-	manage_dirs_pattern($1_gconfd_t, $1_gconf_home_t, $1_gconf_home_t)
-	manage_files_pattern($1_gconfd_t, $1_gconf_home_t, $1_gconf_home_t)
-	userdom_user_home_dir_filetrans($1, $1_gconfd_t, $1_gconf_home_t, dir)
-
-	manage_dirs_pattern($1_gconfd_t, $1_gconf_tmp_t, $1_gconf_tmp_t)
-	manage_files_pattern($1_gconfd_t, $1_gconf_tmp_t, $1_gconf_tmp_t)
-	userdom_user_tmp_filetrans($1, $1_gconfd_t, $1_gconf_tmp_t, { dir file })
-
-	domain_auto_trans($2, gconfd_exec_t, $1_gconfd_t)
-	allow $1_gconfd_t $2:fd use;
-	allow $1_gconfd_t $2:fifo_file write;
-	allow $1_gconfd_t $2:unix_stream_socket connectto;
+	manage_dirs_pattern($1_gconfd_t, gconf_home_t, gconf_home_t)
+	manage_files_pattern($1_gconfd_t, gconf_home_t, gconf_home_t)
+
+	manage_dirs_pattern($1_gconfd_t, gconf_tmp_t, gconf_tmp_t)
+	manage_files_pattern($1_gconfd_t, gconf_tmp_t, gconf_tmp_t)
+	userdom_user_home_dir_filetrans($1, $1_gconfd_t, gconf_home_t, dir)
+	userdom_user_tmp_filetrans($1, $1_gconfd_t, gconf_tmp_t, { dir file })
+	userdom_tmp_filetrans_user_tmp($1, $1_gconfd_t, dir)
 
-	allow $1_gconfd_t gconf_etc_t:dir list_dir_perms;
-	read_files_pattern($1_gconfd_t, gconf_etc_t, gconf_etc_t)
+	domtrans_pattern($2, gconfd_exec_t, $1_gconfd_t)
+	allow $1_gconfd_t $2:unix_stream_socket connectto;
+	allow $2 $1_gconfd_t:unix_stream_socket connectto;
 
 	ps_process_pattern($2, $1_gconfd_t)
 
@@ -86,6 +79,10 @@
 
 	files_read_etc_files($1_gconfd_t)
 
+	fs_list_inotifyfs($1_gconfd_t)
+
+	auth_use_nsswitch($1_gconfd_t)
+
 	libs_use_ld_so($1_gconfd_t)
 	libs_use_shared_libs($1_gconfd_t)
 
@@ -93,11 +90,8 @@
 
 	logging_send_syslog_msg($1_gconfd_t)
 
-	userdom_manage_user_tmp_sockets($1, $1_gconfd_t)
-	userdom_manage_user_tmp_dirs($1, $1_gconfd_t)
-	userdom_tmp_filetrans_user_tmp($1, $1_gconfd_t,dir)
-
-	gnome_stream_connect_gconf_template($1, $2)
+	unprivuser_manage_tmp_sockets($1_gconfd_t)
+	unprivuser_manage_tmp_dirs($1_gconfd_t)
 
 	optional_policy(`
 		nscd_dontaudit_search_pid($1_gconfd_t)
@@ -107,6 +101,10 @@
 		xserver_use_xdm_fds($1_gconfd_t)
 		xserver_rw_xdm_pipes($1_gconfd_t)
 	')
+
+#	optional_policy(`
+#		mozilla_stream_connect_template($1, $1_gconfd_t)
+#	')
 ')
 	
 ########################################
@@ -127,20 +125,39 @@
 #
 template(`gnome_stream_connect_gconf_template',`
 	gen_require(`
-		type $1_gconfd_t, $1_gconf_tmp_t;
+		type $1_gconfd_t, gconf_tmp_t;
 	')
 
 	read_files_pattern($2, $1_gconf_tmp_t, $1_gconf_tmp_t)
 	allow $2 $1_gconfd_t:unix_stream_socket connectto;
 ')
 
+
+########################################
+## <summary>
+##	Send general signals to all gconf domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gnome_signal_all',`
+	gen_require(`
+		attribute gnomedomain;
+	')
+
+	allow $1 gnomedomain:process signal;
+')
+
 ########################################
 ## <summary>
 ##	Run gconfd in the role-specific gconfd domain.
 ## </summary>
 ## <desc>
 ##	<p>
-##	Run gconfd in the role-specfic gconfd domain.
+##	Run gconfd in the role-specific gconfd domain.
 ##	</p>
 ##	<p>
 ##	This is a templated interface, and should only
@@ -169,7 +186,7 @@
 
 ########################################
 ## <summary>
-##	manage gnome homedir content (.config)
+##	read gnome homedir content (.config)
 ## </summary>
 ## <param name="userdomain_prefix">
 ##	<summary>
@@ -183,11 +200,71 @@
 ##	</summary>
 ## </param>
 #
+template(`gnome_read_gnome_config',`
+	gen_require(`
+		type gnome_home_t;
+	')
+
+	read_files_pattern($2, gnome_home_t, gnome_home_t)
+')
+
+########################################
+## <summary>
+##	manage gnome homedir content (.config)
+## </summary>
+## <param name="userdomain_prefix">
+##	<summary>nn
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="user_domain">
+##	<summary>
+##	The type of the user domain.
+##	</summary>
+## </param>
+#
 template(`gnome_manage_user_gnome_config',`
 	gen_require(`
-		type $1_gnome_home_t;
+		type gnome_home_t;
+	')
+
+	manage_dirs_pattern($2, gnome_home_t, gnome_home_t)
+	manage_files_pattern($2, gnome_home_t, gnome_home_t)
+')
+
+########################################
+## <summary>
+##	Execute gconf programs in 
+##	in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gnome_exec_gconf',`
+	gen_require(`
+		type gconfd_exec_t;
+	')
+
+	can_exec($1, gconfd_exec_t)
+')
+########################################
+## <summary>
+##	Read gconf home files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gnome_read_gconf_home_files',`
+	gen_require(`
+		type gconf_home_t;
 	')
 
-	allow $2 $1_gnome_home_t:dir manage_dir_perms;
-	allow $2 $1_gnome_home_t:file manage_file_perms;
+	read_files_pattern($1, gconf_home_t, gconf_home_t)
 ')
--- nsaserefpolicy/policy/modules/apps/gnome.te	2008-08-07 11:15:03.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/apps/gnome.te	2008-08-14 13:53:54.000000000 -0400
@@ -8,8 +8,34 @@
 
 attribute gnomedomain;
 
-type gconf_etc_t;
-files_type(gconf_etc_t)
-
 type gconfd_exec_t;
 application_executable_file(gconfd_exec_t)
+
+type gnome_home_t;
+userdom_user_home_type(gnome_home_t)
+userdom_user_home_content(user, gnome_home_t)
+
+type gconf_home_t;
+userdom_user_home_content(user, gconf_home_t)
+
+type gconf_tmp_t;
+files_tmp_file(gconf_tmp_t)
+
+typealias gnome_home_t alias unconfined_gnome_home_t;
+typealias gconf_home_t alias unconfined_gconf_home_t;
+typealias gconf_tmp_t alias unconfined_gconf_tmp_t;
+
+
+##############################
+#
+# Declarations
+#
+type gconfd_t, gnomedomain;
+application_domain(gconfd_t, gconfd_exec_t)
+role system_r types gconfd_exec_t;
+
+##############################
+#
+# Local Policy
+#
+
