[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/, policy/modules/kernel/, doc/

[Jason Zaman]

commit:     b293bd6062b6007870720a7a8ed255cf2f667280
Author:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
AuthorDate: Mon Jan 31 19:27:56 2022 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Mon Jan 31 19:27:56 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=b293bd60

Update generated policy and doc files

Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 doc/policy.xml                       | 11907 ++++++++++++++++++++-------------
 policy/booleans.conf                 |    64 +-
 policy/modules.conf                  |    35 +
 policy/modules/kernel/corenetwork.if |   421 ++
 policy/modules/kernel/corenetwork.te |    15 +-
 5 files changed, 7744 insertions(+), 4698 deletions(-)

diff --git a/doc/policy.xml b/doc/policy.xml
index 12758be9..35687d71 100644
--- a/doc/policy.xml
+++ b/doc/policy.xml
@@ -3472,22 +3472,33 @@ Role allowed access.
 </module>
 <module name="shutdown" filename="policy/modules/admin/shutdown.if">
 <summary>System shutdown command.</summary>
-<interface name="shutdown_role" lineno="18">
+<template name="shutdown_role" lineno="29">
 <summary>
 Role access for shutdown.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
-<interface name="shutdown_domtrans" lineno="39">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<interface name="shutdown_domtrans" lineno="64">
 <summary>
 Execute a domain transition to run shutdown.
 </summary>
@@ -3497,7 +3508,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="shutdown_run" lineno="65">
+<interface name="shutdown_run" lineno="90">
 <summary>
 Execute shutdown in the shutdown
 domain, and allow the specified role
@@ -3514,7 +3525,7 @@ Role allowed access.
 </summary>
 </param>
 </interface>
-<interface name="shutdown_signal" lineno="84">
+<interface name="shutdown_signal" lineno="109">
 <summary>
 Send generic signals to shutdown.
 </summary>
@@ -3524,7 +3535,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="shutdown_sigchld" lineno="102">
+<interface name="shutdown_sigchld" lineno="127">
 <summary>
 Send SIGCHLD signals to shutdown.
 </summary>
@@ -3534,7 +3545,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="shutdown_getattr_exec_files" lineno="120">
+<interface name="shutdown_getattr_exec_files" lineno="145">
 <summary>
 Get attributes of shutdown executable files.
 </summary>
@@ -3544,6 +3555,16 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
+<tunable name="shutdown_allow_user_exec_domains" dftval="false">
+<desc>
+<p>
+Determine whether the user application exec
+domain attribute should be respected for
+shutdown access. If not enabled, only user
+domains themselves may use shutdown.
+</p>
+</desc>
+</tunable>
 </module>
 <module name="sosreport" filename="policy/modules/admin/sosreport.if">
 <summary>Generate debugging information for system.</summary>
@@ -3650,7 +3671,7 @@ The role associated with the user domain.
 </summary>
 </param>
 </template>
-<template name="su_role_template" lineno="144">
+<template name="su_role_template" lineno="149">
 <summary>
 The role template for the su module.
 </summary>
@@ -3660,18 +3681,23 @@ The prefix of the user role (e.g., user
 is the prefix for user_r).
 </summary>
 </param>
-<param name="user_role">
+<param name="user_domain">
 <summary>
-The role associated with the user domain.
+User domain for the role.
 </summary>
 </param>
-<param name="user_domain">
+<param name="user_exec_domain">
 <summary>
-The type of the user domain.
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
 </summary>
 </param>
 </template>
-<interface name="su_exec" lineno="280">
+<interface name="su_exec" lineno="303">
 <summary>
 Execute su in the caller domain.
 </summary>
@@ -3681,10 +3707,20 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
+<tunable name="su_allow_user_exec_domains" dftval="false">
+<desc>
+<p>
+Determine whether the user application
+exec domain attribute should be respected
+for su access. If not enabled, only user
+domains themselves may use su.
+</p>
+</desc>
+</tunable>
 </module>
 <module name="sudo" filename="policy/modules/admin/sudo.if">
 <summary>Execute a command with a substitute user</summary>
-<template name="sudo_role_template" lineno="31">
+<template name="sudo_role_template" lineno="36">
 <summary>
 The role template for the sudo module.
 </summary>
@@ -3701,18 +3737,23 @@ The prefix of the user role (e.g., user
 is the prefix for user_r).
 </summary>
 </param>
-<param name="user_role">
+<param name="user_domain">
 <summary>
-The user role.
+User domain for the role.
 </summary>
 </param>
-<param name="user_domain">
+<param name="user_exec_domain">
 <summary>
-The user domain associated with the role.
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
 </summary>
 </param>
 </template>
-<interface name="sudo_sigchld" lineno="195">
+<interface name="sudo_sigchld" lineno="215">
 <summary>
 Send a SIGCHLD signal to the sudo domain.
 </summary>
@@ -3733,6 +3774,16 @@ required for users to use sudo.
 </p>
 </desc>
 </tunable>
+<tunable name="sudo_allow_user_exec_domains" dftval="false">
+<desc>
+<p>
+Determine whether the user application exec
+domain attribute should be respected for sudo
+access. If not enabled, only user domains
+themselves may use sudo.
+</p>
+</desc>
+</tunable>
 </module>
 <module name="sxid" filename="policy/modules/admin/sxid.if">
 <summary>SUID/SGID program monitoring.</summary>
@@ -4409,22 +4460,33 @@ Role allowed access.
 </module>
 <module name="cdrecord" filename="policy/modules/apps/cdrecord.if">
 <summary>Record audio or data Compact Discs from a master.</summary>
-<interface name="cdrecord_role" lineno="18">
+<template name="cdrecord_role" lineno="29">
 <summary>
 Role access for cdrecord.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
-<interface name="cdrecord_exec" lineno="44">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<interface name="cdrecord_exec" lineno="59">
 <summary>
 Execute cdrecord in the caller domain.
 </summary>
@@ -4447,22 +4509,33 @@ content files
 </module>
 <module name="chromium" filename="policy/modules/apps/chromium.if">
 <summary>Chromium browser</summary>
-<interface name="chromium_role" lineno="18">
+<template name="chromium_role" lineno="29">
 <summary>
 Role access for chromium
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
-User domain for the role
+User domain for the role.
 </summary>
 </param>
-</interface>
-<interface name="chromium_rw_tmp_pipes" lineno="67">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<interface name="chromium_rw_tmp_pipes" lineno="82">
 <summary>
 Read-write access to Chromiums' temporary fifo files
 </summary>
@@ -4472,7 +4545,7 @@ Domain allowed access
 </summary>
 </param>
 </interface>
-<interface name="chromium_tmp_filetrans" lineno="101">
+<interface name="chromium_tmp_filetrans" lineno="116">
 <summary>
 Automatically use the specified type for resources created in chromium's
 temporary locations
@@ -4498,7 +4571,7 @@ The name of the resource being created
 </summary>
 </param>
 </interface>
-<interface name="chromium_domtrans" lineno="120">
+<interface name="chromium_domtrans" lineno="135">
 <summary>
 Execute a domain transition to the chromium domain (chromium_t)
 </summary>
@@ -4508,7 +4581,7 @@ Domain allowed access
 </summary>
 </param>
 </interface>
-<interface name="chromium_run" lineno="146">
+<interface name="chromium_run" lineno="161">
 <summary>
 Execute chromium in the chromium domain and allow the specified role to access the chromium domain
 </summary>
@@ -4612,21 +4685,32 @@ Domain allowed access.
 </module>
 <module name="cryfs" filename="policy/modules/apps/cryfs.if">
 <summary>CryFS and similar other tools which mount encrypted directories using FUSE.</summary>
-<interface name="cryfs_role" lineno="18">
+<template name="cryfs_role" lineno="29">
 <summary>
 Role access for CryFS.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
 <tunable name="cryfs_read_generic_user_content" dftval="true">
 <desc>
 <p>
@@ -4658,22 +4742,33 @@ Grant the cryfs domains manage rights on all user content
 </module>
 <module name="evolution" filename="policy/modules/apps/evolution.if">
 <summary>Evolution email client.</summary>
-<interface name="evolution_role" lineno="18">
+<template name="evolution_role" lineno="29">
 <summary>
 Role access for evolution.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
-<interface name="evolution_home_filetrans" lineno="99">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<interface name="evolution_home_filetrans" lineno="118">
 <summary>
 Create objects in the evolution home
 directories with a private type.
@@ -4699,7 +4794,7 @@ The name of the object being created.
 </summary>
 </param>
 </interface>
-<interface name="evolution_read_home_files" lineno="118">
+<interface name="evolution_read_home_files" lineno="137">
 <summary>
 Read evolution home files.
 </summary>
@@ -4709,7 +4804,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="evolution_stream_connect" lineno="137">
+<interface name="evolution_stream_connect" lineno="156">
 <summary>
 Connect to evolution using a unix
 domain stream socket.
@@ -4720,7 +4815,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="evolution_read_orbit_tmp_files" lineno="158">
+<interface name="evolution_read_orbit_tmp_files" lineno="177">
 <summary>
 Read evolution orbit temporary
 files.
@@ -4731,7 +4826,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="evolution_dbus_chat" lineno="179">
+<interface name="evolution_dbus_chat" lineno="198">
 <summary>
 Send and receive messages from
 evolution over dbus.
@@ -4742,7 +4837,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="evolution_alarm_dbus_chat" lineno="200">
+<interface name="evolution_alarm_dbus_chat" lineno="219">
 <summary>
 Send and receive messages from
 evolution_alarm over dbus.
@@ -4753,7 +4848,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="evolution_domtrans" lineno="221">
+<interface name="evolution_domtrans" lineno="240">
 <summary>
 Make a domain transition to the
 evolution target domain.
@@ -4804,22 +4899,33 @@ Grant the evolution domains manage rights on all user content
 </module>
 <module name="games" filename="policy/modules/apps/games.if">
 <summary>Various games.</summary>
-<interface name="games_role" lineno="18">
+<template name="games_role" lineno="29">
 <summary>
 Role access for games.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
-<interface name="games_rw_data" lineno="52">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<interface name="games_rw_data" lineno="67">
 <summary>
 Read and write games data files.
 </summary>
@@ -4829,7 +4935,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="games_domtrans" lineno="71">
+<interface name="games_domtrans" lineno="86">
 <summary>
 Run a game in the game domain.
 </summary>
@@ -4839,7 +4945,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="games_dbus_chat" lineno="91">
+<interface name="games_dbus_chat" lineno="106">
 <summary>
 Send and receive messages from
 games over dbus.
@@ -4911,28 +5017,33 @@ Determine whether Gitosis can send mail.
 </module>
 <module name="gnome" filename="policy/modules/apps/gnome.if">
 <summary>GNU network object model environment.</summary>
-<template name="gnome_role_template" lineno="24">
+<template name="gnome_role_template" lineno="29">
 <summary>
 The role template for gnome.
 </summary>
 <param name="role_prefix">
 <summary>
-The prefix of the user domain (e.g., user
-is the prefix for user_t).
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="user_role">
+<param name="user_domain">
 <summary>
-The role associated with the user domain.
+User domain for the role.
 </summary>
 </param>
-<param name="user_domain">
+<param name="user_exec_domain">
 <summary>
-The type of the user domain.
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
 </summary>
 </param>
 </template>
-<interface name="gnome_exec_gconf" lineno="121">
+<interface name="gnome_exec_gconf" lineno="134">
 <summary>
 Execute gconf in the caller domain.
 </summary>
@@ -4942,7 +5053,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_read_gconf_config" lineno="140">
+<interface name="gnome_read_gconf_config" lineno="153">
 <summary>
 Read gconf configuration content.
 </summary>
@@ -4952,7 +5063,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_dontaudit_read_inherited_gconf_config_files" lineno="162">
+<interface name="gnome_dontaudit_read_inherited_gconf_config_files" lineno="175">
 <summary>
 Do not audit attempts to read
 inherited gconf configuration files.
@@ -4963,7 +5074,7 @@ Domain to not audit.
 </summary>
 </param>
 </interface>
-<interface name="gnome_manage_gconf_config" lineno="181">
+<interface name="gnome_manage_gconf_config" lineno="194">
 <summary>
 Create, read, write, and delete
 gconf configuration content.
@@ -4974,7 +5085,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_stream_connect_gconf" lineno="203">
+<interface name="gnome_stream_connect_gconf" lineno="216">
 <summary>
 Connect to gconf using a unix
 domain stream socket.
@@ -4985,7 +5096,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_domtrans_gconfd" lineno="222">
+<interface name="gnome_domtrans_gconfd" lineno="235">
 <summary>
 Run gconfd in gconfd domain.
 </summary>
@@ -4995,7 +5106,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="gnome_create_generic_home_dirs" lineno="241">
+<interface name="gnome_create_generic_home_dirs" lineno="254">
 <summary>
 Create generic gnome home directories.
 </summary>
@@ -5005,7 +5116,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_setattr_generic_home_dirs" lineno="260">
+<interface name="gnome_setattr_generic_home_dirs" lineno="273">
 <summary>
 Set attributes of generic gnome
 user home directories.
@@ -5016,7 +5127,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_read_generic_home_content" lineno="279">
+<interface name="gnome_read_generic_home_content" lineno="292">
 <summary>
 Read generic gnome home content.
 </summary>
@@ -5026,7 +5137,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_manage_generic_home_content" lineno="303">
+<interface name="gnome_manage_generic_home_content" lineno="316">
 <summary>
 Create, read, write, and delete
 generic gnome home content.
@@ -5037,7 +5148,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_search_generic_home" lineno="326">
+<interface name="gnome_search_generic_home" lineno="339">
 <summary>
 Search generic gnome home directories.
 </summary>
@@ -5047,7 +5158,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_home_filetrans" lineno="361">
+<interface name="gnome_home_filetrans" lineno="374">
 <summary>
 Create objects in gnome user home
 directories with a private type.
@@ -5073,7 +5184,7 @@ The name of the object being created.
 </summary>
 </param>
 </interface>
-<interface name="gnome_create_generic_gconf_home_dirs" lineno="380">
+<interface name="gnome_create_generic_gconf_home_dirs" lineno="393">
 <summary>
 Create generic gconf home directories.
 </summary>
@@ -5083,7 +5194,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_read_generic_gconf_home_content" lineno="398">
+<interface name="gnome_read_generic_gconf_home_content" lineno="411">
 <summary>
 Read generic gconf home content.
 </summary>
@@ -5093,7 +5204,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_manage_generic_gconf_home_content" lineno="422">
+<interface name="gnome_manage_generic_gconf_home_content" lineno="435">
 <summary>
 Create, read, write, and delete
 generic gconf home content.
@@ -5104,7 +5215,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_search_generic_gconf_home" lineno="445">
+<interface name="gnome_search_generic_gconf_home" lineno="458">
 <summary>
 Search generic gconf home directories.
 </summary>
@@ -5114,7 +5225,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_home_filetrans_gconf_home" lineno="476">
+<interface name="gnome_home_filetrans_gconf_home" lineno="489">
 <summary>
 Create objects in user home
 directories with the generic gconf
@@ -5136,7 +5247,7 @@ The name of the object being created.
 </summary>
 </param>
 </interface>
-<interface name="gnome_home_filetrans_gnome_home" lineno="506">
+<interface name="gnome_home_filetrans_gnome_home" lineno="519">
 <summary>
 Create objects in user home
 directories with the generic gnome
@@ -5158,7 +5269,7 @@ The name of the object being created.
 </summary>
 </param>
 </interface>
-<interface name="gnome_gconf_home_filetrans" lineno="540">
+<interface name="gnome_gconf_home_filetrans" lineno="553">
 <summary>
 Create objects in gnome gconf home
 directories with a private type.
@@ -5184,7 +5295,7 @@ The name of the object being created.
 </summary>
 </param>
 </interface>
-<interface name="gnome_user_home_dir_filetrans_gstreamer_orcexec" lineno="571">
+<interface name="gnome_user_home_dir_filetrans_gstreamer_orcexec" lineno="584">
 <summary>
 Create objects in user home
 directories with the gstreamer
@@ -5206,7 +5317,7 @@ The name of the object being created.
 </summary>
 </param>
 </interface>
-<interface name="gnome_user_runtime_filetrans_gstreamer_orcexec" lineno="601">
+<interface name="gnome_user_runtime_filetrans_gstreamer_orcexec" lineno="614">
 <summary>
 Create objects in the user
 runtime directories with the
@@ -5228,7 +5339,7 @@ The name of the object being created.
 </summary>
 </param>
 </interface>
-<interface name="gnome_read_keyring_home_files" lineno="619">
+<interface name="gnome_read_keyring_home_files" lineno="632">
 <summary>
 Read generic gnome keyring home files.
 </summary>
@@ -5238,7 +5349,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_dbus_chat_gconfd" lineno="640">
+<interface name="gnome_dbus_chat_gconfd" lineno="653">
 <summary>
 Send and receive messages from
 gnome configuration daemon over
@@ -5250,7 +5361,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<template name="gnome_dbus_chat_gkeyringd" lineno="667">
+<template name="gnome_dbus_chat_gkeyringd" lineno="680">
 <summary>
 Send and receive messages from
 gnome keyring daemon over dbus.
@@ -5267,7 +5378,7 @@ Domain allowed access.
 </summary>
 </param>
 </template>
-<interface name="gnome_dbus_chat_all_gkeyringd" lineno="688">
+<interface name="gnome_dbus_chat_all_gkeyringd" lineno="701">
 <summary>
 Send and receive messages from all
 gnome keyring daemon over dbus.
@@ -5278,7 +5389,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_spec_domtrans_all_gkeyringd" lineno="708">
+<interface name="gnome_spec_domtrans_all_gkeyringd" lineno="721">
 <summary>
 Run all gkeyringd in gkeyringd domain.
 </summary>
@@ -5288,7 +5399,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<template name="gnome_stream_connect_gkeyringd" lineno="735">
+<template name="gnome_stream_connect_gkeyringd" lineno="748">
 <summary>
 Connect to gnome keyring daemon
 with a unix stream socket.
@@ -5305,7 +5416,7 @@ Domain allowed access.
 </summary>
 </param>
 </template>
-<interface name="gnome_stream_connect_all_gkeyringd" lineno="756">
+<interface name="gnome_stream_connect_all_gkeyringd" lineno="769">
 <summary>
 Connect to all gnome keyring daemon
 with a unix stream socket.
@@ -5316,7 +5427,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_manage_gstreamer_orcexec" lineno="778">
+<interface name="gnome_manage_gstreamer_orcexec" lineno="791">
 <summary>
 Manage gstreamer ORC optimized
 code.
@@ -5327,7 +5438,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gnome_mmap_gstreamer_orcexec" lineno="797">
+<interface name="gnome_mmap_gstreamer_orcexec" lineno="810">
 <summary>
 Mmap gstreamer ORC optimized
 code.
@@ -5341,22 +5452,33 @@ Domain allowed access.
 </module>
 <module name="gpg" filename="policy/modules/apps/gpg.if">
 <summary>Policy for GNU Privacy Guard and related programs.</summary>
-<interface name="gpg_role" lineno="18">
+<template name="gpg_role" lineno="29">
 <summary>
 Role access for gpg.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
-<interface name="gpg_domtrans" lineno="64">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<interface name="gpg_domtrans" lineno="80">
 <summary>
 Execute the gpg in the gpg domain.
 </summary>
@@ -5366,7 +5488,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="gpg_exec" lineno="83">
+<interface name="gpg_exec" lineno="99">
 <summary>
 Execute the gpg in the caller domain.
 </summary>
@@ -5376,7 +5498,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gpg_spec_domtrans" lineno="117">
+<interface name="gpg_spec_domtrans" lineno="133">
 <summary>
 Execute gpg in a specified domain.
 </summary>
@@ -5401,7 +5523,7 @@ Domain to transition to.
 </summary>
 </param>
 </interface>
-<interface name="gpg_exec_agent" lineno="136">
+<interface name="gpg_exec_agent" lineno="152">
 <summary>
 Execute the gpg-agent in the caller domain.
 </summary>
@@ -5411,7 +5533,17 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gpg_entry_type" lineno="156">
+<interface name="gpg_dontaudit_exec_agent" lineno="171">
+<summary>
+Do not audit attempts to execute the gpg-agent.
+</summary>
+<param name="domain">
+<summary>
+Domain to not audit.
+</summary>
+</param>
+</interface>
+<interface name="gpg_entry_type" lineno="190">
 <summary>
 Make gpg executable files an
 entrypoint for the specified domain.
@@ -5422,7 +5554,7 @@ The domain for which gpg_exec_t is an entrypoint.
 </summary>
 </param>
 </interface>
-<interface name="gpg_signal" lineno="174">
+<interface name="gpg_signal" lineno="208">
 <summary>
 Send generic signals to gpg.
 </summary>
@@ -5432,7 +5564,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gpg_rw_agent_pipes" lineno="192">
+<interface name="gpg_rw_agent_pipes" lineno="226">
 <summary>
 Read and write gpg agent pipes.
 </summary>
@@ -5442,7 +5574,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gpg_stream_connect_agent" lineno="210">
+<interface name="gpg_stream_connect_agent" lineno="244">
 <summary>
 Connect to gpg agent socket
 </summary>
@@ -5452,7 +5584,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gpg_search_agent_tmp_dirs" lineno="232">
+<interface name="gpg_search_agent_tmp_dirs" lineno="266">
 <summary>
 Search gpg agent dirs.
 </summary>
@@ -5462,7 +5594,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gpg_agent_tmp_filetrans" lineno="266">
+<interface name="gpg_agent_tmp_filetrans" lineno="300">
 <summary>
 filetrans in gpg_agent_tmp_t dirs
 </summary>
@@ -5488,7 +5620,7 @@ The name of the object being created.
 </summary>
 </param>
 </interface>
-<interface name="gpg_runtime_filetrans" lineno="301">
+<interface name="gpg_runtime_filetrans" lineno="335">
 <summary>
 filetrans in gpg_runtime_t dirs
 </summary>
@@ -5514,7 +5646,7 @@ The name of the object being created.
 </summary>
 </param>
 </interface>
-<interface name="gpg_secret_filetrans" lineno="336">
+<interface name="gpg_secret_filetrans" lineno="370">
 <summary>
 filetrans in gpg_secret_t dirs
 </summary>
@@ -5540,7 +5672,7 @@ The name of the object being created.
 </summary>
 </param>
 </interface>
-<interface name="gpg_pinentry_dbus_chat" lineno="357">
+<interface name="gpg_pinentry_dbus_chat" lineno="391">
 <summary>
 Send messages to and from gpg
 pinentry over DBUS.
@@ -5551,7 +5683,18 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="gpg_list_user_secrets" lineno="377">
+<interface name="gpg_dontaudit_search_user_secrets" lineno="412">
+<summary>
+Do not audit attempts to search gpg
+user secrets.
+</summary>
+<param name="domain">
+<summary>
+Domain to not audit.
+</summary>
+</param>
+</interface>
+<interface name="gpg_list_user_secrets" lineno="430">
 <summary>
 List gpg user secrets.
 </summary>
@@ -5609,21 +5752,32 @@ Grant the gpg domains manage rights on all user content
 </module>
 <module name="irc" filename="policy/modules/apps/irc.if">
 <summary>IRC client policy.</summary>
-<interface name="irc_role" lineno="18">
+<template name="irc_role" lineno="29">
 <summary>
 Role access for IRC.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
 <tunable name="irc_use_any_tcp_ports" dftval="false">
 <desc>
 <p>
@@ -5664,22 +5818,33 @@ Grant the irc domains manage rights on all user content
 </module>
 <module name="java" filename="policy/modules/apps/java.if">
 <summary>Java virtual machine</summary>
-<interface name="java_role" lineno="18">
+<template name="java_role" lineno="29">
 <summary>
 Role access for java.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
-<template name="java_role_template" lineno="90">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<template name="java_role_template" lineno="110">
 <summary>
 The role template for the java module.
 </summary>
@@ -5691,22 +5856,27 @@ for java applications.
 </desc>
 <param name="role_prefix">
 <summary>
-The prefix of the user domain (e.g., user
-is the prefix for user_t).
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="user_role">
+<param name="user_domain">
 <summary>
-The role associated with the user domain.
+User domain for the role.
 </summary>
 </param>
-<param name="user_domain">
+<param name="user_exec_domain">
 <summary>
-The type of the user domain.
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
 </summary>
 </param>
 </template>
-<interface name="java_domtrans" lineno="148">
+<interface name="java_domtrans" lineno="168">
 <summary>
 Execute the java program in the java domain.
 </summary>
@@ -5716,7 +5886,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="java_run" lineno="178">
+<interface name="java_run" lineno="198">
 <summary>
 Execute java in the java domain, and
 allow the specified role the java domain.
@@ -5732,7 +5902,7 @@ Role allowed access.
 </summary>
 </param>
 </interface>
-<interface name="java_domtrans_unconfined" lineno="198">
+<interface name="java_domtrans_unconfined" lineno="218">
 <summary>
 Execute the java program in the
 unconfined java domain.
@@ -5743,7 +5913,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="java_run_unconfined" lineno="224">
+<interface name="java_run_unconfined" lineno="244">
 <summary>
 Execute the java program in the
 unconfined java domain and allow the
@@ -5760,7 +5930,7 @@ Role allowed access.
 </summary>
 </param>
 </interface>
-<interface name="java_exec" lineno="244">
+<interface name="java_exec" lineno="264">
 <summary>
 Execute the java program in
 the callers domain.
@@ -5771,7 +5941,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="java_manage_generic_home_content" lineno="264">
+<interface name="java_manage_generic_home_content" lineno="284">
 <summary>
 Create, read, write, and delete
 generic java home content.
@@ -5782,7 +5952,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="java_manage_java_tmp" lineno="285">
+<interface name="java_manage_java_tmp" lineno="305">
 <summary>
 Create, read, write, and delete
 temporary java content.
@@ -5793,7 +5963,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="java_home_filetrans_java_home" lineno="316">
+<interface name="java_home_filetrans_java_home" lineno="336">
 <summary>
 Create specified objects in user home
 directories with the generic java
@@ -5815,7 +5985,7 @@ The name of the object being created.
 </summary>
 </param>
 </interface>
-<template name="java_noatsecure_domtrans" lineno="341">
+<template name="java_noatsecure_domtrans" lineno="361">
 <summary>
 Run java in javaplugin domain and
 do not clean the environment (atsecure)
@@ -5832,7 +6002,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </template>
-<template name="java_domain_type" lineno="369">
+<template name="java_domain_type" lineno="389">
 <summary>
 The template for using java in a domain.
 </summary>
@@ -5887,21 +6057,32 @@ Grant the java domains manage rights on all user content
 </module>
 <module name="libmtp" filename="policy/modules/apps/libmtp.if">
 <summary>libmtp: An Initiatior implementation of the Media Transfer Protocol (MTP).</summary>
-<interface name="libmtp_role" lineno="18">
+<template name="libmtp_role" lineno="29">
 <summary>
 Role access for libmtp.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
 <tunable name="libmtp_enable_home_dirs" dftval="false">
 <desc>
 <p>
@@ -6135,7 +6316,7 @@ Role allowed access.
 </module>
 <module name="mono" filename="policy/modules/apps/mono.if">
 <summary>Run .NET server and client applications on Linux.</summary>
-<template name="mono_role_template" lineno="30">
+<template name="mono_role_template" lineno="35">
 <summary>
 The role template for the mono module.
 </summary>
@@ -6147,22 +6328,27 @@ for mono applications.
 </desc>
 <param name="role_prefix">
 <summary>
-The prefix of the user domain (e.g., user
-is the prefix for user_t).
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="user_role">
+<param name="user_domain">
 <summary>
-The role associated with the user domain.
+User domain for the role.
 </summary>
 </param>
-<param name="user_domain">
+<param name="user_exec_domain">
 <summary>
-The type of the user domain.
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
 </summary>
 </param>
 </template>
-<interface name="mono_domtrans" lineno="80">
+<interface name="mono_domtrans" lineno="85">
 <summary>
 Execute mono in the mono domain.
 </summary>
@@ -6172,7 +6358,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="mono_run" lineno="105">
+<interface name="mono_run" lineno="110">
 <summary>
 Execute mono in the mono domain, and
 allow the specified role the mono domain.
@@ -6188,7 +6374,7 @@ Role allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mono_exec" lineno="124">
+<interface name="mono_exec" lineno="129">
 <summary>
 Execute mono in the caller domain.
 </summary>
@@ -6198,7 +6384,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mono_rw_shm" lineno="143">
+<interface name="mono_rw_shm" lineno="148">
 <summary>
 Read and write mono shared memory.
 </summary>
@@ -6211,22 +6397,33 @@ Domain allowed access.
 </module>
 <module name="mozilla" filename="policy/modules/apps/mozilla.if">
 <summary>Policy for Mozilla and related web browsers.</summary>
-<interface name="mozilla_role" lineno="18">
+<template name="mozilla_role" lineno="29">
 <summary>
 Role access for mozilla.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
-<interface name="mozilla_role_plugin" lineno="90">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<interface name="mozilla_role_plugin" lineno="105">
 <summary>
 Role access for mozilla plugin.
 </summary>
@@ -6241,7 +6438,7 @@ User domain for the role.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_read_user_home" lineno="151">
+<interface name="mozilla_read_user_home" lineno="166">
 <summary>
 Read mozilla home directory content.
 </summary>
@@ -6251,7 +6448,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_read_user_home_files" lineno="172">
+<interface name="mozilla_read_user_home_files" lineno="187">
 <summary>
 Read mozilla home directory files
 </summary>
@@ -6261,7 +6458,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_write_user_home_files" lineno="193">
+<interface name="mozilla_write_user_home_files" lineno="208">
 <summary>
 Write mozilla home directory files.
 </summary>
@@ -6271,7 +6468,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_dontaudit_rw_user_home_files" lineno="213">
+<interface name="mozilla_dontaudit_rw_user_home_files" lineno="228">
 <summary>
 Do not audit attempts to read and
 write mozilla home directory files.
@@ -6282,7 +6479,7 @@ Domain to not audit.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_dontaudit_manage_user_home_files" lineno="233">
+<interface name="mozilla_dontaudit_manage_user_home_files" lineno="248">
 <summary>
 Do not audit attempt to Create,
 read, write, and delete mozilla
@@ -6294,7 +6491,7 @@ Domain to not audit.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_exec_user_plugin_home_files" lineno="253">
+<interface name="mozilla_exec_user_plugin_home_files" lineno="268">
 <summary>
 Execute mozilla plugin home directory files.
 </summary>
@@ -6304,7 +6501,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_execmod_user_plugin_home_files" lineno="273">
+<interface name="mozilla_execmod_user_plugin_home_files" lineno="288">
 <summary>
 Mozilla plugin home directory file
 text relocation.
@@ -6315,7 +6512,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_read_tmp_files" lineno="291">
+<interface name="mozilla_read_tmp_files" lineno="306">
 <summary>
 Read temporary mozilla files.
 </summary>
@@ -6325,7 +6522,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_domtrans" lineno="309">
+<interface name="mozilla_domtrans" lineno="324">
 <summary>
 Run mozilla in the mozilla domain.
 </summary>
@@ -6335,7 +6532,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_domtrans_plugin" lineno="329">
+<interface name="mozilla_domtrans_plugin" lineno="344">
 <summary>
 Execute a domain transition to
 run mozilla plugin.
@@ -6346,7 +6543,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_run_plugin" lineno="356">
+<interface name="mozilla_run_plugin" lineno="371">
 <summary>
 Execute mozilla plugin in the
 mozilla plugin domain, and allow
@@ -6364,7 +6561,7 @@ Role allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_domtrans_plugin_config" lineno="376">
+<interface name="mozilla_domtrans_plugin_config" lineno="391">
 <summary>
 Execute a domain transition to
 run mozilla plugin config.
@@ -6375,7 +6572,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_run_plugin_config" lineno="403">
+<interface name="mozilla_run_plugin_config" lineno="418">
 <summary>
 Execute mozilla plugin config in
 the mozilla plugin config domain,
@@ -6393,7 +6590,7 @@ Role allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_dbus_chat" lineno="423">
+<interface name="mozilla_dbus_chat" lineno="438">
 <summary>
 Send and receive messages from
 mozilla over dbus.
@@ -6404,7 +6601,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_dbus_chat_plugin" lineno="444">
+<interface name="mozilla_dbus_chat_plugin" lineno="459">
 <summary>
 Send and receive messages from
 mozilla plugin over dbus.
@@ -6415,7 +6612,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_rw_tcp_sockets" lineno="464">
+<interface name="mozilla_rw_tcp_sockets" lineno="479">
 <summary>
 Read and write mozilla TCP sockets.
 </summary>
@@ -6425,7 +6622,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_manage_plugin_rw_files" lineno="483">
+<interface name="mozilla_manage_plugin_rw_files" lineno="498">
 <summary>
 Create, read, write, and delete
 mozilla plugin rw files.
@@ -6436,7 +6633,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_plugin_read_tmpfs_files" lineno="502">
+<interface name="mozilla_plugin_read_tmpfs_files" lineno="517">
 <summary>
 Read mozilla_plugin tmpfs files.
 </summary>
@@ -6446,7 +6643,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_plugin_delete_tmpfs_files" lineno="521">
+<interface name="mozilla_plugin_delete_tmpfs_files" lineno="536">
 <summary>
 Delete mozilla_plugin tmpfs files.
 </summary>
@@ -6456,7 +6653,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_rw_tmp_pipes" lineno="540">
+<interface name="mozilla_rw_tmp_pipes" lineno="555">
 <summary>
 Read/write to mozilla's tmp fifo files
 </summary>
@@ -6466,7 +6663,7 @@ Domain allowed access
 </summary>
 </param>
 </interface>
-<interface name="mozilla_manage_generic_plugin_home_content" lineno="559">
+<interface name="mozilla_manage_generic_plugin_home_content" lineno="574">
 <summary>
 Create, read, write, and delete
 generic mozilla plugin home content.
@@ -6477,7 +6674,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_home_filetrans_plugin_home" lineno="594">
+<interface name="mozilla_home_filetrans_plugin_home" lineno="609">
 <summary>
 Create objects in user home
 directories with the generic mozilla
@@ -6499,7 +6696,7 @@ The name of the object being created.
 </summary>
 </param>
 </interface>
-<interface name="mozilla_dontaudit_use_fds" lineno="614">
+<interface name="mozilla_dontaudit_use_fds" lineno="629">
 <summary>
 Do not audit use of mozilla file descriptors
 </summary>
@@ -6509,7 +6706,7 @@ Domain to dont audit access from
 </summary>
 </param>
 </interface>
-<interface name="mozilla_send_dgram_plugin" lineno="632">
+<interface name="mozilla_send_dgram_plugin" lineno="647">
 <summary>
 Send messages to mozilla plugin unix datagram sockets
 </summary>
@@ -6575,22 +6772,33 @@ unreserved ports (for instance when dealing with Google Talk)
 </module>
 <module name="mplayer" filename="policy/modules/apps/mplayer.if">
 <summary>Mplayer media player and encoder.</summary>
-<interface name="mplayer_role" lineno="18">
+<template name="mplayer_role" lineno="29">
 <summary>
 Role access for mplayer
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
-User domain for the role
+User domain for the role.
 </summary>
 </param>
-</interface>
-<interface name="mplayer_domtrans" lineno="65">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<interface name="mplayer_domtrans" lineno="81">
 <summary>
 Run mplayer in mplayer domain.
 </summary>
@@ -6600,7 +6808,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="mplayer_exec" lineno="85">
+<interface name="mplayer_exec" lineno="101">
 <summary>
 Execute mplayer in the caller domain.
 </summary>
@@ -6610,7 +6818,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mplayer_read_user_home_files" lineno="104">
+<interface name="mplayer_read_user_home_files" lineno="120">
 <summary>
 Read mplayer user home content files.
 </summary>
@@ -6620,7 +6828,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mplayer_manage_generic_home_content" lineno="124">
+<interface name="mplayer_manage_generic_home_content" lineno="140">
 <summary>
 Create, read, write, and delete
 generic mplayer home content.
@@ -6631,7 +6839,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="mplayer_home_filetrans_mplayer_home" lineno="157">
+<interface name="mplayer_home_filetrans_mplayer_home" lineno="173">
 <summary>
 Create specified objects in user home
 directories with the generic mplayer
@@ -6720,22 +6928,33 @@ Grant the mplayer domains manage rights on all user content
 </module>
 <module name="openoffice" filename="policy/modules/apps/openoffice.if">
 <summary>Openoffice suite.</summary>
-<interface name="ooffice_role" lineno="18">
+<template name="ooffice_role" lineno="29">
 <summary>
 Role access for openoffice.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
-<interface name="ooffice_domtrans" lineno="48">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<interface name="ooffice_domtrans" lineno="63">
 <summary>
 Run openoffice in its own domain.
 </summary>
@@ -6745,7 +6964,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="ooffice_dontaudit_exec_tmp_files" lineno="67">
+<interface name="ooffice_dontaudit_exec_tmp_files" lineno="82">
 <summary>
 Do not audit attempts to execute
 files in temporary directories.
@@ -6756,7 +6975,7 @@ Domain to not audit.
 </summary>
 </param>
 </interface>
-<interface name="ooffice_rw_tmp_files" lineno="86">
+<interface name="ooffice_rw_tmp_files" lineno="101">
 <summary>
 Read and write temporary
 openoffice files.
@@ -6767,7 +6986,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="ooffice_dbus_chat" lineno="106">
+<interface name="ooffice_dbus_chat" lineno="121">
 <summary>
 Send and receive dbus messages
 from and to the openoffice
@@ -6779,7 +6998,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="ooffice_stream_connect" lineno="127">
+<interface name="ooffice_stream_connect" lineno="142">
 <summary>
 Connect to openoffice using a
 unix domain stream socket.
@@ -6843,22 +7062,44 @@ Grant the openoffice domains manage rights on all user content
 </module>
 <module name="pulseaudio" filename="policy/modules/apps/pulseaudio.if">
 <summary>Pulseaudio network sound server.</summary>
-<interface name="pulseaudio_role" lineno="18">
+<template name="pulseaudio_role" lineno="29">
 <summary>
 Role access for pulseaudio.
 </summary>
+<param name="role_prefix">
+<summary>
+The prefix of the user role (e.g., user
+is the prefix for user_r).
+</summary>
+</param>
+<param name="user_domain">
+<summary>
+User domain for the role.
+</summary>
+</param>
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
 <param name="role">
 <summary>
-Role allowed access.
+Role allowed access
 </summary>
 </param>
+</template>
+<interface name="pulseaudio_client_domain" lineno="73">
+<summary>
+Connect to pulseaudio and manage
+pulseaudio config data.
+</summary>
 <param name="domain">
 <summary>
-User domain for the role.
+Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_domtrans" lineno="56">
+<interface name="pulseaudio_domtrans" lineno="91">
 <summary>
 Execute a domain transition to run pulseaudio.
 </summary>
@@ -6868,7 +7109,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_run" lineno="85">
+<interface name="pulseaudio_run" lineno="117">
 <summary>
 Execute pulseaudio in the pulseaudio
 domain, and allow the specified role
@@ -6885,7 +7126,7 @@ Role allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_exec" lineno="104">
+<interface name="pulseaudio_exec" lineno="137">
 <summary>
 Execute pulseaudio in the caller domain.
 </summary>
@@ -6895,7 +7136,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_dontaudit_exec" lineno="123">
+<interface name="pulseaudio_dontaudit_exec" lineno="156">
 <summary>
 Do not audit attempts to execute pulseaudio.
 </summary>
@@ -6905,7 +7146,7 @@ Domain to not audit.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_signull" lineno="142">
+<interface name="pulseaudio_signull" lineno="175">
 <summary>
 Send null signals to pulseaudio.
 processes.
@@ -6916,7 +7157,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_use_fds" lineno="161">
+<interface name="pulseaudio_use_fds" lineno="194">
 <summary>
 Use file descriptors for
 pulseaudio.
@@ -6927,7 +7168,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_dontaudit_use_fds" lineno="180">
+<interface name="pulseaudio_dontaudit_use_fds" lineno="213">
 <summary>
 Do not audit attempts to use the
 file descriptors for pulseaudio.
@@ -6938,7 +7179,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_stream_connect" lineno="199">
+<interface name="pulseaudio_stream_connect" lineno="232">
 <summary>
 Connect to pulseaudio with a unix
 domain stream socket.
@@ -6949,7 +7190,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_dbus_chat" lineno="219">
+<interface name="pulseaudio_dbus_chat" lineno="252">
 <summary>
 Send and receive messages from
 pulseaudio over dbus.
@@ -6960,7 +7201,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_setattr_home_dir" lineno="239">
+<interface name="pulseaudio_setattr_home_dir" lineno="272">
 <summary>
 Set attributes of pulseaudio home directories.
 </summary>
@@ -6970,7 +7211,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_read_home" lineno="257">
+<interface name="pulseaudio_read_home" lineno="290">
 <summary>
 Read pulseaudio home content.
 </summary>
@@ -6980,7 +7221,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_rw_home_files" lineno="278">
+<interface name="pulseaudio_rw_home_files" lineno="311">
 <summary>
 Read and write Pulse Audio files.
 </summary>
@@ -6990,7 +7231,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_manage_home" lineno="299">
+<interface name="pulseaudio_manage_home" lineno="332">
 <summary>
 Create, read, write, and delete
 pulseaudio home content.
@@ -7001,7 +7242,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_home_filetrans_pulseaudio_home" lineno="332">
+<interface name="pulseaudio_home_filetrans_pulseaudio_home" lineno="365">
 <summary>
 Create objects in user home
 directories with the pulseaudio
@@ -7023,7 +7264,7 @@ The name of the object being created.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_tmpfs_content" lineno="351">
+<interface name="pulseaudio_tmpfs_content" lineno="384">
 <summary>
 Make the specified tmpfs file type
 pulseaudio tmpfs content.
@@ -7034,7 +7275,7 @@ File type to make pulseaudio tmpfs content.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_read_tmpfs_files" lineno="369">
+<interface name="pulseaudio_read_tmpfs_files" lineno="402">
 <summary>
 Read pulseaudio tmpfs files.
 </summary>
@@ -7044,7 +7285,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_rw_tmpfs_files" lineno="389">
+<interface name="pulseaudio_rw_tmpfs_files" lineno="422">
 <summary>
 Read and write pulseaudio tmpfs
 files.
@@ -7055,23 +7296,6 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="pulseaudio_client_domain" lineno="417">
-<summary>
-Mark the specified domain as a PulseAudio client domain
-and the related tmpfs file type as a (shared) PulseAudio tmpfs
-file type used for the shared memory access
-</summary>
-<param name="domain">
-<summary>
-Domain to become a PulseAudio client domain
-</summary>
-</param>
-<param name="tmpfstype">
-<summary>
-Tmpfs type used for shared memory of the given domain
-</summary>
-</param>
-</interface>
 <tunable name="pulseaudio_execmem" dftval="false">
 <desc>
 <p>
@@ -7307,22 +7531,33 @@ access to the network.
 </module>
 <module name="rssh" filename="policy/modules/apps/rssh.if">
 <summary>Restricted (scp/sftp) only shell.</summary>
-<interface name="rssh_role" lineno="18">
+<template name="rssh_role" lineno="29">
 <summary>
 Role access for rssh.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
-<interface name="rssh_spec_domtrans" lineno="46">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<interface name="rssh_spec_domtrans" lineno="57">
 <summary>
 Execute rssh in the rssh domain.
 </summary>
@@ -7332,7 +7567,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="rssh_exec" lineno="66">
+<interface name="rssh_exec" lineno="77">
 <summary>
 Execute the rssh program
 in the caller domain.
@@ -7343,7 +7578,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="rssh_domtrans_chroot_helper" lineno="86">
+<interface name="rssh_domtrans_chroot_helper" lineno="97">
 <summary>
 Execute a domain transition to
 run rssh chroot helper.
@@ -7354,7 +7589,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="rssh_read_ro_content" lineno="105">
+<interface name="rssh_read_ro_content" lineno="116">
 <summary>
 Read users rssh read-only content.
 </summary>
@@ -7367,7 +7602,7 @@ Domain allowed access.
 </module>
 <module name="screen" filename="policy/modules/apps/screen.if">
 <summary>GNU terminal multiplexer.</summary>
-<template name="screen_role_template" lineno="24">
+<template name="screen_role_template" lineno="29">
 <summary>
 The role template for the screen module.
 </summary>
@@ -7377,18 +7612,23 @@ The prefix of the user role (e.g., user
 is the prefix for user_r).
 </summary>
 </param>
-<param name="user_role">
+<param name="user_domain">
 <summary>
-The role associated with the user domain.
+The type of the user domain.
 </summary>
 </param>
-<param name="user_domain">
+<param name="user_exec_domain">
 <summary>
-The type of the user domain.
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="user_role">
+<summary>
+The role associated with the user domain.
 </summary>
 </param>
 </template>
-<interface name="screen_execute_sock_file" lineno="103">
+<interface name="screen_execute_sock_file" lineno="114">
 <summary>
 Execute the screen runtime sock file.
 </summary>
@@ -7476,21 +7716,32 @@ Domain allowed access.
 </module>
 <module name="syncthing" filename="policy/modules/apps/syncthing.if">
 <summary>Application that lets you synchronize your files across multiple devices.</summary>
-<interface name="syncthing_role" lineno="18">
+<template name="syncthing_role" lineno="29">
 <summary>
 Role access for Syncthing
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
-User domain for the role
+User domain for the role.
 </summary>
 </param>
-</interface>
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
 <tunable name="syncthing_read_generic_user_content" dftval="true">
 <desc>
 <p>
@@ -7532,7 +7783,7 @@ Domain prefix to be used.
 </summary>
 </param>
 </template>
-<template name="telepathy_role_template" lineno="59">
+<template name="telepathy_role_template" lineno="64">
 <summary>
 The role template for the telepathy module.
 </summary>
@@ -7544,22 +7795,27 @@ for window manager applications.
 </desc>
 <param name="role_prefix">
 <summary>
-The prefix of the user domain (e.g., user
-is the prefix for user_t).
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="user_role">
+<param name="user_domain">
 <summary>
-The role associated with the user domain.
+User domain for the role.
 </summary>
 </param>
-<param name="user_domain">
+<param name="user_exec_domain">
 <summary>
-The type of the user domain.
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
 </summary>
 </param>
 </template>
-<interface name="telepathy_gabble_stream_connect" lineno="137">
+<interface name="telepathy_gabble_stream_connect" lineno="146">
 <summary>
 Connect to gabble with a unix
 domain stream socket.
@@ -7570,7 +7826,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="telepathy_gabble_dbus_chat" lineno="157">
+<interface name="telepathy_gabble_dbus_chat" lineno="166">
 <summary>
 Send dbus messages to and from
 gabble.
@@ -7581,7 +7837,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="telepathy_mission_control_dbus_chat" lineno="178">
+<interface name="telepathy_mission_control_dbus_chat" lineno="187">
 <summary>
 Send dbus messages to and from
 mission control.
@@ -7592,7 +7848,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="telepathy_mission_control_read_state" lineno="198">
+<interface name="telepathy_mission_control_read_state" lineno="207">
 <summary>
 Read mission control process state files.
 </summary>
@@ -7602,7 +7858,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="telepathy_msn_stream_connect" lineno="220">
+<interface name="telepathy_msn_stream_connect" lineno="229">
 <summary>
 Connect to msn with a unix
 domain stream socket.
@@ -7613,7 +7869,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="telepathy_salut_stream_connect" lineno="240">
+<interface name="telepathy_salut_stream_connect" lineno="249">
 <summary>
 Connect to salut with a unix
 domain stream socket.
@@ -7643,22 +7899,33 @@ managers can connect to any port.
 </module>
 <module name="thunderbird" filename="policy/modules/apps/thunderbird.if">
 <summary>Thunderbird email client.</summary>
-<interface name="thunderbird_role" lineno="18">
+<template name="thunderbird_role" lineno="29">
 <summary>
 Role access for thunderbird.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
-<interface name="thunderbird_domtrans" lineno="52">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<interface name="thunderbird_domtrans" lineno="67">
 <summary>
 Execute thunderbird in the thunderbird domain.
 </summary>
@@ -7699,40 +7966,62 @@ Grant the thunderbird domains manage rights on all user content
 </module>
 <module name="tvtime" filename="policy/modules/apps/tvtime.if">
 <summary>High quality television application.</summary>
-<interface name="tvtime_role" lineno="18">
+<template name="tvtime_role" lineno="29">
 <summary>
 Role access for tvtime
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
-User domain for the role
+User domain for the role.
 </summary>
 </param>
-</interface>
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
 </module>
 <module name="uml" filename="policy/modules/apps/uml.if">
 <summary>User mode linux tools and services.</summary>
-<interface name="uml_role" lineno="18">
+<template name="uml_role" lineno="29">
 <summary>
 Role access for uml.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
-<interface name="uml_setattr_util_sockets" lineno="55">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<interface name="uml_setattr_util_sockets" lineno="70">
 <summary>
 Set attributes of uml pid sock files.
 </summary>
@@ -7742,7 +8031,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="uml_manage_util_files" lineno="74">
+<interface name="uml_manage_util_files" lineno="89">
 <summary>
 Create, read, write, and delete
 uml pid files.
@@ -7756,28 +8045,33 @@ Domain allowed access.
 </module>
 <module name="userhelper" filename="policy/modules/apps/userhelper.if">
 <summary>A wrapper that helps users run system programs.</summary>
-<template name="userhelper_role_template" lineno="24">
+<template name="userhelper_role_template" lineno="29">
 <summary>
 The role template for the userhelper module.
 </summary>
-<param name="userrole_prefix">
+<param name="role_prefix">
 <summary>
 The prefix of the user role (e.g., user
 is the prefix for user_r).
 </summary>
 </param>
-<param name="user_role">
+<param name="user_domain">
 <summary>
-The user role.
+User domain for the role.
 </summary>
 </param>
-<param name="user_domain">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
 <summary>
-The user domain associated with the role.
+Role allowed access
 </summary>
 </param>
 </template>
-<interface name="userhelper_search_config" lineno="110">
+<interface name="userhelper_search_config" lineno="123">
 <summary>
 Search userhelper configuration directories.
 </summary>
@@ -7787,7 +8081,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="userhelper_dontaudit_search_config" lineno="129">
+<interface name="userhelper_dontaudit_search_config" lineno="142">
 <summary>
 Do not audit attempts to search
 userhelper configuration directories.
@@ -7798,7 +8092,7 @@ Domain to not audit.
 </summary>
 </param>
 </interface>
-<interface name="userhelper_dbus_chat_all_consolehelper" lineno="148">
+<interface name="userhelper_dbus_chat_all_consolehelper" lineno="161">
 <summary>
 Send and receive messages from
 consolehelper over dbus.
@@ -7809,7 +8103,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="userhelper_use_fd" lineno="168">
+<interface name="userhelper_use_fd" lineno="181">
 <summary>
 Use userhelper all userhelper file descriptors.
 </summary>
@@ -7819,7 +8113,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="userhelper_sigchld" lineno="186">
+<interface name="userhelper_sigchld" lineno="199">
 <summary>
 Send child terminated signals to all userhelper.
 </summary>
@@ -7829,7 +8123,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="userhelper_exec" lineno="204">
+<interface name="userhelper_exec" lineno="217">
 <summary>
 Execute the userhelper program in the caller domain.
 </summary>
@@ -7839,7 +8133,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="userhelper_exec_consolehelper" lineno="224">
+<interface name="userhelper_exec_consolehelper" lineno="237">
 <summary>
 Execute the consolehelper program
 in the caller domain.
@@ -7915,22 +8209,33 @@ Role allowed to access.
 </module>
 <module name="vmware" filename="policy/modules/apps/vmware.if">
 <summary>VMWare Workstation virtual machines.</summary>
-<interface name="vmware_role" lineno="18">
+<template name="vmware_role" lineno="29">
 <summary>
 Role access for vmware.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
-<interface name="vmware_exec_host" lineno="50">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<interface name="vmware_exec_host" lineno="65">
 <summary>
 Execute vmware host executables
 </summary>
@@ -7940,7 +8245,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="vmware_read_system_config" lineno="69">
+<interface name="vmware_read_system_config" lineno="84">
 <summary>
 Read vmware system configuration files.
 </summary>
@@ -7950,7 +8255,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="vmware_append_system_config" lineno="88">
+<interface name="vmware_append_system_config" lineno="103">
 <summary>
 Append vmware system configuration files.
 </summary>
@@ -7960,7 +8265,7 @@ Domain allowed access.
 </summary>
 </param>
 </interface>
-<interface name="vmware_append_log" lineno="107">
+<interface name="vmware_append_log" lineno="122">
 <summary>
 Append vmware log files.
 </summary>
@@ -8025,22 +8330,33 @@ be labeled public_content_rw_t.
 </module>
 <module name="wine" filename="policy/modules/apps/wine.if">
 <summary>Run Windows programs in Linux.</summary>
-<interface name="wine_role" lineno="18">
+<template name="wine_role" lineno="29">
 <summary>
 Role access for wine.
 </summary>
-<param name="role">
+<param name="role_prefix">
 <summary>
-Role allowed access.
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="domain">
+<param name="user_domain">
 <summary>
 User domain for the role.
 </summary>
 </param>
-</interface>
-<template name="wine_role_template" lineno="73">
+<param name="user_exec_domain">
+<summary>
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
+</summary>
+</param>
+</template>
+<template name="wine_role_template" lineno="89">
 <summary>
 The role template for the wine module.
 </summary>
@@ -8052,22 +8368,27 @@ for wine applications.
 </desc>
 <param name="role_prefix">
 <summary>
-The prefix of the user domain (e.g., user
-is the prefix for user_t).
+The prefix of the user role (e.g., user
+is the prefix for user_r).
 </summary>
 </param>
-<param name="user_role">
+<param name="user_domain">
 <summary>
-The role associated with the user domain.
+User domain for the role.
 </summary>
 </param>
-<param name="user_domain">
+<param name="user_exec_domain">
 <summary>
-The type of the user domain.
+User exec domain for execute and transition access.
+</summary>
+</param>
+<param name="role">
+<summary>
+Role allowed access
 </summary>
 </param>
 </template>
-<interface name="wine_domtrans" lineno="114">
+<interface name="wine_domtrans" lineno="130">
 <summary>
 Execute the wine program in the wine domain.
 </summary>
@@ -8077,7 +8398,7 @@ Domain allowed to transition.
 </summary>
 </param>
 </interface>
-<interface name="wine_run" lineno="140">
+<interface name="wine_run" lineno="156">
 <summary>
 Execute wine in the wine domain,
 and allow the specified role
@@ -8094,7 +8415,7 @@ Role allowed access.
 </summary>
 </param>
 </interface>
-<interface name="wine_rw_shm" lineno="160">
+<interface name="wine_rw_shm" lineno="176">
 <summary>
 Read and write wine Shared
 memory segments.
@@ -8117,22 +8438,33 @@ be silently blocked.
 </module>
 <module name="wireshark" filename="policy/modules/apps/wireshark.if">
 <summary>Wireshark packet capture tool.</summary>
-<interface name="wireshark_role" lineno="18">
+<template name="wireshark_role" lineno="29">
 <summary>
 Role access for wireshark.
 </summary>
2551<