
diff --git a/policy/modules/admin/sudo.te b/policy/modules/admin/sudo.te
index 2731fa1..3443ba2 100644
--- a/policy/modules/admin/sudo.te
+++ b/policy/modules/admin/sudo.te
@@ -7,3 +7,7 @@ attribute sudodomain;
 
 type sudo_exec_t;
 application_executable_file(sudo_exec_t)
+
+type sudo_db_t;
+files_type(sudo_db_t)
+
diff --git a/policy/modules/admin/sudo.fc b/policy/modules/admin/sudo.fc
index 7bddc02..2b59ed0 100644
--- a/policy/modules/admin/sudo.fc
+++ b/policy/modules/admin/sudo.fc
@@ -1,2 +1,4 @@
 
 /usr/bin/sudo(edit)?	--	gen_context(system_u:object_r:sudo_exec_t,s0)
+
+/var/db/sudo(/.*)?		gen_context(system_u:object_r:sudo_db_t,s0)
diff --git a/policy/modules/admin/sudo.if b/policy/modules/admin/sudo.if
index 975af1a..8b33023 100644
--- a/policy/modules/admin/sudo.if
+++ b/policy/modules/admin/sudo.if
@@ -32,6 +32,7 @@ template(`sudo_role_template',`
 
 	gen_require(`
 		type sudo_exec_t;
+		type sudo_db_t;
 		attribute sudodomain;
 	')
 
@@ -73,9 +74,15 @@ template(`sudo_role_template',`
 	# Enter this derived domain from the user domain
 	domtrans_pattern($3, sudo_exec_t, $1_sudo_t)
 
+	manage_dirs_pattern($1_sudo_t, sudo_db_t, sudo_db_t)
+	manage_files_pattern($1_sudo_t, sudo_db_t, sudo_db_t)
+
 	# By default, revert to the calling domain when a shell is executed.
 	corecmd_shell_domtrans($1_sudo_t, $3)
 	corecmd_bin_domtrans($1_sudo_t, $3)
+	userdom_domtrans_user_home($1_sudo_t, $3)
+	userdom_domtrans_user_tmp($1_sudo_t, $3)
+
 	allow $3 $1_sudo_t:fd use;
 	allow $3 $1_sudo_t:fifo_file rw_fifo_file_perms;
 	allow $3 $1_sudo_t:process signal_perms;
@@ -119,6 +126,8 @@ template(`sudo_role_template',`
 	auth_manage_pam_pid($1_sudo_t)
 	auth_use_nsswitch($1_sudo_t)
 
+	application_signal($1_sudo_t)
+	
 	init_rw_utmp($1_sudo_t)
 
 	logging_send_audit_msgs($1_sudo_t)
@@ -135,8 +144,10 @@ template(`sudo_role_template',`
 	userdom_manage_user_tmp_files($1_sudo_t)
 	userdom_manage_user_tmp_symlinks($1_sudo_t)
 	userdom_use_user_terminals($1_sudo_t)
+	userdom_signal_unpriv_users($1_sudo_t)
 	# for some PAM modules and for cwd
-	userdom_dontaudit_search_user_home_content($1_sudo_t)
+	userdom_search_user_home_content($1_sudo_t)
+	userdom_manage_all_users_keys($1_sudo_t)
 
 	ifdef(`hide_broken_symptoms', `
 		dontaudit $1_sudo_t $3:socket_class_set { read write };
diff --git a/policy/modules/system/application.if b/policy/modules/system/application.if
index ac50333..c604822 100644
--- a/policy/modules/system/application.if
+++ b/policy/modules/system/application.if
@@ -130,3 +130,21 @@ interface(`application_signull',`
 
 	allow $1 application_domain_type:process signull;
 ')
+
+#######################################
+## <summary>
+##  Send signal to all application domains.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`application_signal',`
+    gen_require(`
+        attribute application_domain_type;
+    ')
+
+    allow $1 application_domain_type:process signal;
+')
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 28b88de..20a63d1 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -1573,6 +1573,26 @@ interface(`userdom_user_home_domtrans',`
 	files_search_home($1)
 ')
 
+#######################################
+## <summary>
+##  Search users home directories.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`userdom_search_user_home_content',`
+    gen_require(`
+        type user_home_dir_t;
+    ')
+
+    files_list_home($1)
+    allow $1 user_home_dir_t:dir search_dir_perms;
+    allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	Do not audit attempts to search user home content directories.
@@ -2975,6 +2995,81 @@ interface(`userdom_write_user_tmp_files',`
 	allow $1 user_tmp_t:file write_file_perms;
 ')
 
+#######################################
+## <summary>
+##  Execute a file in a user home directory
+##  in the specified domain.
+## </summary>
+## <desc>
+##  <p>
+##  Execute a file in a user home directory
+##  in the specified domain.
+##  </p>
+##  <p>
+##  No interprocess communication (signals, pipes,
+##  etc.) is provided by this interface since
+##  the domains are not owned by this module.
+##  </p>
+## </desc>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+## <param name="target_domain">
+##  <summary>
+##  The type of the new process.
+##  </summary>
+## </param>
+#
+interface(`userdom_domtrans_user_home',`
+    gen_require(`
+        type user_home_t;
+    ')
+
+    read_lnk_files_pattern($1, user_home_t, user_home_t)
+    domain_transition_pattern($1, user_home_t, $2)
+    type_transition $1 user_home_t:process $2;
+')
+
+#######################################
+## <summary>
+##  Execute a file in a user tmp directory
+##  in the specified domain.
+## </summary>
+## <desc>
+##  <p>
+##  Execute a file in a user tmp directory
+##  in the specified domain.
+##  </p>
+##  <p>
+##  No interprocess communication (signals, pipes,
+##  etc.) is provided by this interface since
+##  the domains are not owned by this module.
+##  </p>
+## </desc>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+## <param name="target_domain">
+##  <summary>
+##  The type of the new process.
+##  </summary>
+## </param>
+#
+interface(`userdom_domtrans_user_tmp',`
+    gen_require(`
+        type user_tmp_t;
+    ')
+
+    files_search_tmp($1)
+    read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
+    domain_transition_pattern($1, user_tmp_t, $2)
+    type_transition $1 user_tmp_t:process $2;
+')
+
 ########################################
 ## <summary>
 ##	Do not audit attempts to use user ttys.
@@ -3139,3 +3234,21 @@ interface(`userdom_dbus_send_all_users',`
 
 	allow $1 userdomain:dbus send_msg;
 ')
+
+#######################################
+## <summary>
+##  Manage keys for all user domains.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`userdom_manage_all_users_keys',`
+    gen_require(`
+        attribute userdomain;
+    ')
+
+    allow $1 userdomain:key manage_key_perms;
+')
