diff --git a/policy/modules/admin/shorewall.fc b/policy/modules/admin/shorewall.fc
index 029cb7e..48d1363 100644
--- a/policy/modules/admin/shorewall.fc
+++ b/policy/modules/admin/shorewall.fc
@@ -11,4 +11,6 @@
 /var/lib/shorewall6(/.*)?			gen_context(system_u:object_r:shorewall_var_lib_t,s0)
 /var/lib/shorewall-lite(/.*)?			gen_context(system_u:object_r:shorewall_var_lib_t,s0)
 
+/var/lock/subsys/shorewall		--	gen_context(system_u:object_r:shorewall_lock_t,s0)
+
 /var/log/shorewall.*				gen_context(system_u:object_r:shorewall_log_t,s0)
diff --git a/policy/modules/admin/shorewall.if b/policy/modules/admin/shorewall.if
index 0948921..f198119 100644
--- a/policy/modules/admin/shorewall.if
+++ b/policy/modules/admin/shorewall.if
@@ -18,6 +18,24 @@ interface(`shorewall_domtrans',`
 	domtrans_pattern($1, shorewall_exec_t, shorewall_t)
 ')
 
+######################################
+## <summary>
+##      Execute a domain transition to run shorewall.
+## </summary>
+## <param name="domain">
+## <summary>
+##      Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`shorewall_domtrans_lib',`
+        gen_require(`
+                type shorewall_t, shorewall_var_lib_t;
+        ')
+
+        domtrans_pattern($1, shorewall_var_lib_t, shorewall_t)
+')
+
 #######################################
 ## <summary>
 ##	Read shorewall etc configuration files.
@@ -117,6 +135,25 @@ interface(`shorewall_rw_lib_files',`
 
 #######################################
 ## <summary>
+##      Read shorewall tmp files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`shorewall_read_tmp_files',`
+        gen_require(`
+                type shorewall_tmp_t;
+        ')
+
+        files_search_tmp($1)
+        read_files_pattern($1, shorewall_tmp_t, shorewall_tmp_t)
+')
+
+#######################################
+## <summary>
 ##	All of the rules required to administrate 
 ##	an shorewall environment
 ## </summary>
@@ -134,9 +171,10 @@ interface(`shorewall_rw_lib_files',`
 #
 interface(`shorewall_admin',`
 	gen_require(`
-		type shorewall_t, shorewall_var_run_t, shorewall_lock_t;
+		type shorewall_t, shorewall_lock_t;
+		type shorewall_log_t;
 		type shorewall_initrc_exec_t, shorewall_var_lib_t;
-		type shorewall_tmp_t;
+		type shorewall_tmp_t, shorewall_etc_t;
 	')
 
 	allow $1 shorewall_t:process { ptrace signal_perms };
@@ -147,18 +185,18 @@ interface(`shorewall_admin',`
 	role_transition $2 shorewall_initrc_exec_t system_r;
 	allow $2 system_r;
 
-	files_search_etc($1)
+	files_list_etc($1)
 	admin_pattern($1, shorewall_etc_t)
 
-	files_search_locks($1)
+	files_list_locks($1)
 	admin_pattern($1, shorewall_lock_t)
 
-	files_search_pids($1)
-	admin_pattern($1, shorewall_var_run_t)
-
-	files_search_var_lib($1)
+	files_list_var_lib($1)
 	admin_pattern($1, shorewall_var_lib_t)
 
-	files_search_tmp($1)
+	logging_list_logs($1)
+	admin_pattern($1, shorewall_log_t)
+
+	files_list_tmp($1)
 	admin_pattern($1, shorewall_tmp_t)
 ')
diff --git a/policy/modules/admin/shorewall.te b/policy/modules/admin/shorewall.te
index c17b6a6..ab6220e 100644
--- a/policy/modules/admin/shorewall.te
+++ b/policy/modules/admin/shorewall.te
@@ -58,6 +58,9 @@ exec_files_pattern(shorewall_t, shorewall_var_lib_t, shorewall_var_lib_t)
 manage_dirs_pattern(shorewall_t, shorewall_var_lib_t, shorewall_var_lib_t)
 manage_files_pattern(shorewall_t, shorewall_var_lib_t, shorewall_var_lib_t)
 files_var_lib_filetrans(shorewall_t, shorewall_var_lib_t, { dir file })
+allow shorewall_t shorewall_var_lib_t:file entrypoint;
+
+allow shorewall_t shorewall_initrc_exec_t:file read_file_perms;
 
 kernel_read_kernel_sysctls(shorewall_t)
 kernel_read_network_state(shorewall_t)
@@ -80,6 +83,7 @@ fs_getattr_all_fs(shorewall_t)
 
 init_rw_utmp(shorewall_t)
 
+logging_read_generic_logs(shorewall_t)
 logging_send_syslog_msg(shorewall_t)
 
 miscfiles_read_localization(shorewall_t)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 77e8ca8..8b37892 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -781,6 +781,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+    # shorewall-init script run /var/lib/shorewall/firewall
+    shorewall_domtrans_lib(initrc_t)
+')
+
+optional_policy(`
 	squid_read_config(initrc_t)
 	squid_manage_logs(initrc_t)
 ')
diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te
index a3fdcb3..eb2d402 100644
--- a/policy/modules/system/iptables.te
+++ b/policy/modules/system/iptables.te
@@ -123,6 +123,7 @@ optional_policy(`
 ')
 
 optional_policy(`
+	shorewall_read_tmp_files(iptables_t)
 	shorewall_rw_lib_files(iptables_t)
 ')
 
