--- nsaserefpolicy/policy/modules/services/consolekit.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/consolekit.fc	2008-08-14 13:53:54.000000000 -0400
@@ -1,3 +1,6 @@
 /usr/sbin/console-kit-daemon	--	gen_context(system_u:object_r:consolekit_exec_t,s0)
 
 /var/run/consolekit\.pid	--	gen_context(system_u:object_r:consolekit_var_run_t,s0)
+/var/run/ConsoleKit(/.*)?	--	gen_context(system_u:object_r:consolekit_var_run_t,s0)
+
+/var/log/ConsoleKit(/.*)?	gen_context(system_u:object_r:consolekit_log_t,s0)
--- nsaserefpolicy/policy/modules/services/consolekit.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/consolekit.if	2008-08-14 13:53:54.000000000 -0400
@@ -38,3 +38,24 @@
 	allow $1 consolekit_t:dbus send_msg;
 	allow consolekit_t $1:dbus send_msg;
 ')
+
+########################################
+## <summary>
+##	Read consolekit log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`consolekit_read_log',`
+	gen_require(`
+		type consolekit_log_t;
+	')
+
+	files_search_pids($1)
+	read_files_pattern($1, consolekit_log_t, consolekit_log_t)
+')
+
+
--- nsaserefpolicy/policy/modules/services/consolekit.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/consolekit.te	2008-08-14 13:53:54.000000000 -0400
@@ -13,6 +13,9 @@
 type consolekit_var_run_t;
 files_pid_file(consolekit_var_run_t)
 
+type consolekit_log_t;
+files_pid_file(consolekit_log_t)
+
 ########################################
 #
 # consolekit local policy
@@ -24,20 +27,27 @@
 allow consolekit_t self:unix_stream_socket create_stream_socket_perms;
 allow consolekit_t self:unix_dgram_socket create_socket_perms;
 
+manage_files_pattern(consolekit_t, consolekit_log_t, consolekit_log_t)
+logging_log_filetrans(consolekit_t, consolekit_log_t, file)
+
+manage_dirs_pattern(consolekit_t, consolekit_var_run_t, consolekit_var_run_t)
 manage_files_pattern(consolekit_t, consolekit_var_run_t, consolekit_var_run_t)
-files_pid_filetrans(consolekit_t, consolekit_var_run_t, file)
+files_pid_filetrans(consolekit_t, consolekit_var_run_t, { file dir })
 
 kernel_read_system_state(consolekit_t)
 
 corecmd_exec_bin(consolekit_t)
+corecmd_exec_shell(consolekit_t)
 
 dev_read_urand(consolekit_t)
 dev_read_sysfs(consolekit_t)
 
 domain_read_all_domains_state(consolekit_t)
 domain_use_interactive_fds(consolekit_t)
+domain_dontaudit_ptrace_all_domains(consolekit_t)
 
 files_read_etc_files(consolekit_t)
+files_read_usr_files(consolekit_t)
 # needs to read /var/lib/dbus/machine-id
 files_read_var_lib_files(consolekit_t)
 
@@ -47,23 +57,72 @@
 
 auth_use_nsswitch(consolekit_t)
 
+init_telinit(consolekit_t)
+init_rw_utmp(consolekit_t)
+init_chat(consolekit_t)
+
 libs_use_ld_so(consolekit_t)
 libs_use_shared_libs(consolekit_t)
 
+logging_send_syslog_msg(consolekit_t)
+
 miscfiles_read_localization(consolekit_t)
 
+# consolekit needs to be able to ptrace all logged in users 
+userdom_ptrace_all_users(consolekit_t)
+unprivuser_dontaudit_read_home_content_files(consolekit_t)
+
+hal_ptrace(consolekit_t)
+mcs_ptrace_all(consolekit_t)
+
 optional_policy(`
-	dbus_system_bus_client_template(consolekit, consolekit_t)
-	dbus_connect_system_bus(consolekit_t)
+	cron_read_system_job_lib_files(consolekit_t)
+')
 
+optional_policy(`
+	dbus_system_domain(consolekit_t, consolekit_exec_t)
+	optional_policy(`
 	hal_dbus_chat(consolekit_t)
+	')
+
+	optional_policy(`
+		rpm_dbus_chat(consolekit_t)
+	')
 
 	optional_policy(`
 		unconfined_dbus_chat(consolekit_t)
 	')
 ')
 
+polkit_read_lib(consolekit_t)
+
+optional_policy(`
+	polkit_domtrans_auth(consolekit_t)
+')
+
 optional_policy(`
 	xserver_read_all_users_xauth(consolekit_t)
 	xserver_stream_connect_xdm_xserver(consolekit_t)
+	xserver_ptrace_xdm(consolekit_t)
+')
+
+optional_policy(`
+	#reading .Xauthity
+	unconfined_ptrace(consolekit_t)
+	unconfined_stream_connect(consolekit_t)
+')
+
+optional_policy(`
+	unprivuser_read_tmp_files(consolekit_t)
+')
+
+tunable_policy(`use_nfs_home_dirs',`
+	fs_dontaudit_list_nfs(consolekit_t)
+	fs_dontaudit_rw_nfs_files(consolekit_t)
 ')
+
+tunable_policy(`use_samba_home_dirs',`
+	fs_dontaudit_list_cifs(consolekit_t)
+	fs_dontaudit_rw_cifs_files(consolekit_t)
+')
+
