--- nsaserefpolicy/policy/modules/services/razor.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/razor.fc	2008-08-14 13:53:54.000000000 -0400
@@ -1,4 +1,4 @@
-HOME_DIR/\.razor(/.*)?		gen_context(system_u:object_r:ROLE_razor_home_t,s0)
+HOME_DIR/\.razor(/.*)?		gen_context(system_u:object_r:razor_home_t,s0)
 
 /etc/razor(/.*)?		gen_context(system_u:object_r:razor_etc_t,s0)
 
--- nsaserefpolicy/policy/modules/services/razor.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/razor.if	2008-08-14 13:53:54.000000000 -0400
@@ -137,6 +137,7 @@
 template(`razor_per_role_template',`
 	gen_require(`
 		type razor_exec_t;
+		type razor_home_t, razor_tmp_t;
 	')
 
 	type $1_razor_t;
@@ -145,12 +146,8 @@
 	razor_common_domain_template($1_razor)
 	role $3 types $1_razor_t;
 
-	type $1_razor_home_t alias $1_razor_rw_t;
-	files_poly_member($1_razor_home_t)
-	userdom_user_home_content($1, $1_razor_home_t)
-
-	type $1_razor_tmp_t;
-	files_tmp_file($1_razor_tmp_t)
+	typealias razor_home_t alias $1_razor_home_t;
+	typealias razor_tmp_t alias $1_razor_tmp_t;
 
 	##############################
 	#
@@ -159,10 +156,10 @@
 
 	allow $1_razor_t self:unix_stream_socket create_stream_socket_perms;
 
-	manage_dirs_pattern($1_razor_t, $1_razor_home_t, $1_razor_home_t)
-	manage_files_pattern($1_razor_t, $1_razor_home_t, $1_razor_home_t)
-	manage_lnk_files_pattern($1_razor_t, $1_razor_home_t, $1_razor_home_t)
-	userdom_user_home_dir_filetrans($1, $1_razor_t, $1_razor_home_t, dir)
+	manage_dirs_pattern($1_razor_t, razor_home_t, razor_home_t)
+	manage_files_pattern($1_razor_t, razor_home_t, razor_home_t)
+	manage_lnk_files_pattern($1_razor_t, razor_home_t, razor_home_t)
+	userdom_user_home_dir_filetrans($1, $1_razor_t, razor_home_t, dir)
 
 	manage_dirs_pattern($1_razor_t, $1_razor_tmp_t, $1_razor_tmp_t)
 	manage_files_pattern($1_razor_t, $1_razor_tmp_t, $1_razor_tmp_t)
@@ -170,12 +167,12 @@
 
 	domtrans_pattern($2, razor_exec_t, $1_razor_t)
 
-	manage_dirs_pattern($2, $1_razor_home_t, $1_razor_home_t)
-	manage_files_pattern($2, $1_razor_home_t, $1_razor_home_t)
-	manage_lnk_files_pattern($2, $1_razor_home_t, $1_razor_home_t)
-	relabel_dirs_pattern($2, $1_razor_home_t, $1_razor_home_t)
-	relabel_files_pattern($2, $1_razor_home_t, $1_razor_home_t)
-	relabel_lnk_files_pattern($2, $1_razor_home_t, $1_razor_home_t)
+	manage_dirs_pattern($2, razor_home_t, razor_home_t)
+	manage_files_pattern($2, razor_home_t, razor_home_t)
+	manage_lnk_files_pattern($2, razor_home_t, razor_home_t)
+	relabel_dirs_pattern($2, razor_home_t, razor_home_t)
+	relabel_files_pattern($2, razor_home_t, razor_home_t)
+	relabel_lnk_files_pattern($2, razor_home_t, razor_home_t)
 
 	logging_send_syslog_msg($1_razor_t)
 
@@ -218,3 +215,61 @@
 
 	domtrans_pattern($1, razor_exec_t, razor_t)
 ')
+
+########################################
+## <summary>
+##	Create, read, write, and delete razor files
+##	in a user home subdirectory.
+## </summary>
+## <desc>
+##	<p>
+##	Create, read, write, and delete razor files
+##	in a user home subdirectory.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`razor_manage_user_home_files',`
+	gen_require(`
+		type user_home_dir_t, razor_home_t;
+	')
+
+	files_search_home($2)
+	allow $2 user_home_dir_t:dir search_dir_perms;
+	manage_files_pattern($2, razor_home_t, razor_home_t)
+	read_lnk_files_pattern($2, razor_home_t, razor_home_t)
+')
+
+########################################
+## <summary>
+##	read razor lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`razor_read_lib_files',`
+	gen_require(`
+		type razor_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	read_files_pattern($1, razor_var_lib_t, razor_var_lib_t)
+')
+
--- nsaserefpolicy/policy/modules/services/razor.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/razor.te	2008-08-14 13:53:54.000000000 -0400
@@ -6,21 +6,51 @@
 # Declarations
 #
 
+ifdef(`distro_redhat',`
+
+	gen_require(`
+		type spamc_t;
+		type spamc_exec_t;
+		type spamd_log_t;
+		type spamd_spool_t;
+		type spamd_var_lib_t;
+		type spamd_etc_t;
+		type spamassassin_home_t;
+		type spamc_tmp_t;
+	')
+
+	typealias spamc_t alias razor_t;
+	typealias spamc_exec_t alias razor_exec_t;
+	typealias spamd_log_t alias razor_log_t;
+	typealias spamd_var_lib_t alias razor_var_lib_t;
+	typealias spamd_etc_t alias razor_etc_t;
+	typealias spamassassin_home_t alias razor_home_t;
+
+',`
+
 type razor_t;
 type razor_exec_t;
 domain_type(razor_t)
 domain_entry_file(razor_t, razor_exec_t)
 role system_r types razor_t;
 
-type razor_etc_t;
-files_config_file(razor_etc_t)
-
 type razor_log_t;
 logging_log_file(razor_log_t)
 
 type razor_var_lib_t;
 files_type(razor_var_lib_t)
 
+type razor_etc_t;
+files_config_file(razor_etc_t)
+
+type razor_home_t;
+userdom_user_home_content(user, razor_home_t)
+
+type razor_tmp_t;
+files_tmp_file(razor_tmp_t)
+
+')
+
 razor_common_domain_template(razor)
 
 ########################################
