[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/services/, policy/modules/admin/, ...

[Jason Zaman]

commit:     0fc88387bdc52d40b6388336d655a4374271b049
Author:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
AuthorDate: Mon Dec 16 17:45:34 2019 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Tue Dec 24 09:58:27 2019 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=0fc88387

Rename gentoo-specific *_var_run_t types to *_runtime_t.

Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/admin/puppet.te            |  2 +-
 policy/modules/apps/qemu.if               |  4 +--
 policy/modules/apps/qemu.te               |  4 +--
 policy/modules/contrib/at.fc              |  4 +--
 policy/modules/contrib/at.te              | 10 +++---
 policy/modules/contrib/bitcoin.if         |  4 +--
 policy/modules/contrib/bitcoin.te         |  4 +--
 policy/modules/contrib/ceph.fc            | 10 +++---
 policy/modules/contrib/ceph.if            | 13 ++++----
 policy/modules/contrib/ceph.te            | 10 +++---
 policy/modules/contrib/dirsrv.fc          |  4 +--
 policy/modules/contrib/dirsrv.if          | 18 +++++------
 policy/modules/contrib/dirsrv.te          | 22 ++++++-------
 policy/modules/contrib/nginx.if           |  4 +--
 policy/modules/contrib/nginx.te           | 10 +++---
 policy/modules/contrib/phpfpm.fc          |  4 +--
 policy/modules/contrib/phpfpm.if          |  8 ++---
 policy/modules/contrib/phpfpm.te          | 10 +++---
 policy/modules/contrib/resolvconf.fc      |  2 +-
 policy/modules/contrib/resolvconf.if      |  4 +--
 policy/modules/contrib/resolvconf.te      | 10 +++---
 policy/modules/contrib/salt.fc            | 10 +++---
 policy/modules/contrib/salt.if            |  8 ++---
 policy/modules/contrib/salt.rst           |  6 ++--
 policy/modules/contrib/salt.te            | 52 +++++++++++++++----------------
 policy/modules/contrib/vde.fc             |  2 +-
 policy/modules/contrib/vde.if             |  6 ++--
 policy/modules/contrib/vde.te             | 12 +++----
 policy/modules/services/apache.te         |  4 +--
 policy/modules/services/clamav.te         |  2 +-
 policy/modules/services/courier.te        |  2 +-
 policy/modules/services/cron.fc           |  4 +--
 policy/modules/services/cron.rst          |  2 +-
 policy/modules/services/dbus.if           |  8 ++---
 policy/modules/services/fail2ban.te       |  4 +--
 policy/modules/services/ldap.te           |  2 +-
 policy/modules/services/munin.rst         |  2 +-
 policy/modules/services/mysql.if          |  8 ++---
 policy/modules/services/networkmanager.fc |  2 +-
 policy/modules/services/networkmanager.te |  8 ++---
 policy/modules/services/ntp.fc            |  2 +-
 policy/modules/system/authlogin.te        |  2 +-
 policy/modules/system/init.te             |  4 +--
 policy/modules/system/lvm.te              |  2 +-
 policy/modules/system/modutils.te         |  4 +--
 policy/modules/system/sysnetwork.fc       |  4 +--
 policy/modules/system/sysnetwork.te       | 10 +++---
 policy/modules/system/tmpfiles.fc         |  2 +-
 policy/modules/system/tmpfiles.if         | 32 +++++++++----------
 policy/modules/system/tmpfiles.rst        |  2 +-
 policy/modules/system/tmpfiles.te         |  8 ++---
 51 files changed, 188 insertions(+), 189 deletions(-)

diff --git a/policy/modules/admin/puppet.te b/policy/modules/admin/puppet.te
index 85c4ac40..75d03e76 100644
--- a/policy/modules/admin/puppet.te
+++ b/policy/modules/admin/puppet.te
@@ -355,7 +355,7 @@ ifdef(`distro_gentoo',`
 
 	rw_files_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
 
-	manage_files_pattern(puppetmaster_t, puppet_var_run_t, puppet_var_run_t)
+	manage_files_pattern(puppetmaster_t, puppet_runtime_t, puppet_runtime_t)
 
 	optional_policy(`
 		usermanage_check_exec_passwd(puppetmaster_t)

diff --git a/policy/modules/apps/qemu.if b/policy/modules/apps/qemu.if
index e373c4d9..413e1347 100644
--- a/policy/modules/apps/qemu.if
+++ b/policy/modules/apps/qemu.if
@@ -427,8 +427,8 @@ interface(`qemu_entry_type',`
 #
 interface(`qemu_rw_pid_sock_files',`
 	gen_require(`
-		type qemu_var_run_t;
+		type qemu_runtime_t;
 	')
 
-	allow $1 qemu_var_run_t:sock_file rw_sock_file_perms;
+	allow $1 qemu_runtime_t:sock_file rw_sock_file_perms;
 ')

diff --git a/policy/modules/apps/qemu.te b/policy/modules/apps/qemu.te
index f99f2161..6188d362 100644
--- a/policy/modules/apps/qemu.te
+++ b/policy/modules/apps/qemu.te
@@ -90,9 +90,9 @@ ifdef(`distro_gentoo',`
 	allow qemu_t self:udp_socket create_socket_perms;
 
 	# Network related socket
-	allow qemu_t qemu_var_run_t:sock_file manage_sock_file_perms;
+	allow qemu_t qemu_runtime_t:sock_file manage_sock_file_perms;
 
-	files_pid_filetrans(qemu_t, qemu_var_run_t, sock_file)
+	files_pid_filetrans(qemu_t, qemu_runtime_t, sock_file)
 
 	optional_policy(`
 		vde_connect(qemu_t)

diff --git a/policy/modules/contrib/at.fc b/policy/modules/contrib/at.fc
index b3cf1863..39c83a99 100644
--- a/policy/modules/contrib/at.fc
+++ b/policy/modules/contrib/at.fc
@@ -1,9 +1,9 @@
 /etc/rc\.d/init\.d/atd	--	gen_context(system_u:object_r:atd_initrc_exec_t,s0)
 
 /usr/bin/at	--	gen_context(system_u:object_r:at_exec_t,s0)
-/usr/sbin/atd	--	gen_context(system_u:object_r:atd_exec_t,s0)
+/usr/bin/atd	--	gen_context(system_u:object_r:atd_exec_t,s0)
 
-/run/atd\.pid	--	gen_context(system_u:object_r:atd_var_run_t,s0)
+/run/atd\.pid	--	gen_context(system_u:object_r:atd_runtime_t,s0)
 
 /var/spool/at(/.*)?	gen_context(system_u:object_r:at_spool_t,s0)
 /var/spool/at/atjobs(/.*)?	gen_context(system_u:object_r:at_job_t,s0)

diff --git a/policy/modules/contrib/at.te b/policy/modules/contrib/at.te
index c28a9e7b..b0900cbf 100644
--- a/policy/modules/contrib/at.te
+++ b/policy/modules/contrib/at.te
@@ -21,8 +21,8 @@ init_daemon_domain(atd_t, atd_exec_t)
 type atd_initrc_exec_t;
 init_script_file(atd_initrc_exec_t)
 
-type atd_var_run_t;
-files_pid_file(atd_var_run_t)
+type atd_runtime_t alias atd_var_run_t;
+files_pid_file(atd_runtime_t)
 
 ########################################
 #
@@ -39,8 +39,8 @@ list_dirs_pattern(atd_t, at_spool_t, at_job_t)
 
 manage_files_pattern(atd_t, at_job_log_t, at_job_log_t)
 
-manage_files_pattern(atd_t, atd_var_run_t, atd_var_run_t)
-files_pid_filetrans(atd_t, atd_var_run_t, file)
+manage_files_pattern(atd_t, atd_runtime_t, atd_runtime_t)
+files_pid_filetrans(atd_t, atd_runtime_t, file)
 
 kernel_read_kernel_sysctls(atd_t)
 
@@ -81,7 +81,7 @@ allow at_t at_spool_t:dir search_dir_perms;
 
 allow at_t atd_t:process signal;
 
-allow at_t atd_var_run_t:file read_file_perms;
+allow at_t atd_runtime_t:file read_file_perms;
 
 domain_use_interactive_fds(at_t)
 

diff --git a/policy/modules/contrib/bitcoin.if b/policy/modules/contrib/bitcoin.if
index 9c7ca8da..7e00c963 100644
--- a/policy/modules/contrib/bitcoin.if
+++ b/policy/modules/contrib/bitcoin.if
@@ -19,7 +19,7 @@ interface(`bitcoin_admin',`
 	gen_require(`
 		type bitcoin_t;
 		type bitcoin_etc_t, bitcoin_tmp_t, bitcoin_log_t;
-		type bitcoin_var_lib_t, bitcoin_var_run_t;
+		type bitcoin_var_lib_t, bitcoin_runtime_t;
 		type bitcoin_initrc_exec_t;
 	')
 
@@ -41,5 +41,5 @@ interface(`bitcoin_admin',`
 	admin_pattern($1, bitcoin_var_lib_t)
 
 	files_list_pids($1)
-	admin_pattern($1, bitcoin_var_run_t)
+	admin_pattern($1, bitcoin_runtime_t)
 ')

diff --git a/policy/modules/contrib/bitcoin.te b/policy/modules/contrib/bitcoin.te
index 672516e9..c5667519 100644
--- a/policy/modules/contrib/bitcoin.te
+++ b/policy/modules/contrib/bitcoin.te
@@ -31,8 +31,8 @@ type bitcoin_var_lib_t;
 files_type(bitcoin_var_lib_t)
 init_script_readable_type(bitcoin_var_lib_t)
 
-type bitcoin_var_run_t;
-files_pid_file(bitcoin_var_run_t)
+type bitcoin_runtime_t alias bitcoin_var_run_t;
+files_pid_file(bitcoin_runtime_t)
 
 type bitcoin_tmp_t;
 files_tmp_file(bitcoin_tmp_t)

diff --git a/policy/modules/contrib/ceph.fc b/policy/modules/contrib/ceph.fc
index 8e2e1799..4d1db681 100644
--- a/policy/modules/contrib/ceph.fc
+++ b/policy/modules/contrib/ceph.fc
@@ -23,8 +23,8 @@
 
 /var/log/ceph(/.*)?		gen_context(system_u:object_r:ceph_log_t,s0)
 
-/run/ceph		-d	gen_context(system_u:object_r:ceph_var_run_t,s0)
-/run/ceph/ceph-osd.*		gen_context(system_u:object_r:ceph_osd_var_run_t,s0)
-/run/ceph/ceph-mon.*		gen_context(system_u:object_r:ceph_mon_var_run_t,s0)
-/run/ceph/ceph-mds.*		gen_context(system_u:object_r:ceph_mds_var_run_t,s0)
-/run/ceph/mds.*		--	gen_context(system_u:object_r:ceph_mds_var_run_t,s0)
+/run/ceph		-d	gen_context(system_u:object_r:ceph_runtime_t,s0)
+/run/ceph/ceph-osd.*		gen_context(system_u:object_r:ceph_osd_runtime_t,s0)
+/run/ceph/ceph-mon.*		gen_context(system_u:object_r:ceph_mon_runtime_t,s0)
+/run/ceph/ceph-mds.*		gen_context(system_u:object_r:ceph_mds_runtime_t,s0)
+/run/ceph/mds.*		--	gen_context(system_u:object_r:ceph_mds_runtime_t,s0)

diff --git a/policy/modules/contrib/ceph.if b/policy/modules/contrib/ceph.if
index c922531b..9ff98e6f 100644
--- a/policy/modules/contrib/ceph.if
+++ b/policy/modules/contrib/ceph.if
@@ -17,7 +17,7 @@ template(`ceph_domain_template',`
 		attribute cephpidfile;
 		attribute_role ceph_roles;
 		
-		type ceph_var_run_t;
+		type ceph_runtime_t;
 	')
 
 	type ceph_$1_t, cephdomain;
@@ -28,8 +28,9 @@ template(`ceph_domain_template',`
 	type ceph_$1_data_t, cephdata;
 	files_type(ceph_$1_data_t)
 
-	type ceph_$1_var_run_t, cephpidfile;
-	files_pid_file(ceph_$1_var_run_t)
+	type ceph_$1_runtime_t, cephpidfile;
+	typealias ceph_$1_runtime_t alias ceph_$1_var_run_t;
+	files_pid_file(ceph_$1_runtime_t)
 
 	########################################
 	#
@@ -37,12 +38,12 @@ template(`ceph_domain_template',`
 	#
 	# Rules which cannot be made part of the domain
 
-	allow ceph_$1_t ceph_$1_var_run_t:file manage_file_perms;
-	allow ceph_$1_t ceph_$1_var_run_t:sock_file manage_file_perms;
+	allow ceph_$1_t ceph_$1_runtime_t:file manage_file_perms;
+	allow ceph_$1_t ceph_$1_runtime_t:sock_file manage_file_perms;
 	allow ceph_$1_t ceph_$1_data_t:dir manage_dir_perms;
 	allow ceph_$1_t ceph_$1_data_t:file manage_file_perms;
 
-	filetrans_pattern(ceph_$1_t, ceph_var_run_t, ceph_$1_var_run_t, { file sock_file })
+	filetrans_pattern(ceph_$1_t, ceph_runtime_t, ceph_$1_runtime_t, { file sock_file })
 
 	files_var_lib_filetrans(ceph_$1_t, ceph_$1_data_t, { file dir })
 ')

diff --git a/policy/modules/contrib/ceph.te b/policy/modules/contrib/ceph.te
index 9704dd41..94ebe44f 100644
--- a/policy/modules/contrib/ceph.te
+++ b/policy/modules/contrib/ceph.te
@@ -28,8 +28,8 @@ logging_log_file(ceph_log_t)
 type ceph_var_lib_t;
 files_type(ceph_var_lib_t)
 
-type ceph_var_run_t;
-files_pid_file(ceph_var_run_t)
+type ceph_runtime_t alias ceph_var_run_t;
+files_pid_file(ceph_runtime_t)
 
 #########################################
 #
@@ -48,8 +48,8 @@ allow cephdomain ceph_log_t:file { create_file_perms rw_file_perms };
 allow cephdomain ceph_var_lib_t:dir search_dir_perms;
 allow cephdomain self:netlink_route_socket { rw_netlink_socket_perms };
 allow cephdomain self:tcp_socket { create_socket_perms listen accept }; 
-allow cephdomain ceph_var_run_t:file manage_file_perms;
-allow cephdomain ceph_var_run_t:dir manage_dir_perms;
+allow cephdomain ceph_runtime_t:file manage_file_perms;
+allow cephdomain ceph_runtime_t:dir manage_dir_perms;
 
 kernel_read_system_state(cephdomain)
 
@@ -60,7 +60,7 @@ corenet_tcp_connect_all_unreserved_ports(cephdomain)
 files_read_etc_files(cephdomain)
 files_search_pids(cephdomain)
 files_search_var_lib(cephdomain)
-files_pid_filetrans(cephdomain, ceph_var_run_t, dir)
+files_pid_filetrans(cephdomain, ceph_runtime_t, dir)
 
 fs_getattr_all_fs(cephdomain)
 

diff --git a/policy/modules/contrib/dirsrv.fc b/policy/modules/contrib/dirsrv.fc
index 88b1a6eb..3a33d632 100644
--- a/policy/modules/contrib/dirsrv.fc
+++ b/policy/modules/contrib/dirsrv.fc
@@ -6,7 +6,7 @@
 /var/lock/dirsrv(/.*)?	gen_context(system_u:object_r:dirsrv_var_lock_t,s0)
 /var/log/dirsrv(/.*)?	gen_context(system_u:object_r:dirsrv_var_log_t,s0)
 /var/log/dirsrv/ldap-agent.log	gen_context(system_u:object_r:dirsrv_snmp_var_log_t,s0)
-/run/dirsrv(/.*)?	gen_context(system_u:object_r:dirsrv_var_run_t,s0)
-/run/ldap-agent.pid	gen_context(system_u:object_r:dirsrv_snmp_var_run_t,s0)
+/run/dirsrv(/.*)?	gen_context(system_u:object_r:dirsrv_runtime_t,s0)
+/run/ldap-agent.pid	gen_context(system_u:object_r:dirsrv_snmp_runtime_t,s0)
 
 /etc/dirsrv(/.*)?	gen_context(system_u:object_r:dirsrv_config_t,s0)

diff --git a/policy/modules/contrib/dirsrv.if b/policy/modules/contrib/dirsrv.if
index cbe9ecaf..8c697fc9 100644
--- a/policy/modules/contrib/dirsrv.if
+++ b/policy/modules/contrib/dirsrv.if
@@ -112,11 +112,11 @@ interface(`dirsrv_manage_var_lib',`
 #
 interface(`dirsrv_manage_var_run',`
 	gen_require(`
-		type dirsrv_var_run_t;
+		type dirsrv_runtime_t;
 	')
-	allow $1 dirsrv_var_run_t:dir manage_dir_perms;
-	allow $1 dirsrv_var_run_t:file manage_file_perms;
-	allow $1 dirsrv_var_run_t:sock_file manage_file_perms;
+	allow $1 dirsrv_runtime_t:dir manage_dir_perms;
+	allow $1 dirsrv_runtime_t:file manage_file_perms;
+	allow $1 dirsrv_runtime_t:sock_file manage_file_perms;
 ')
 
 ######################################
@@ -131,10 +131,10 @@ interface(`dirsrv_manage_var_run',`
 #
 interface(`dirsrv_pid_filetrans',`
 	gen_require(`
-		type dirsrv_var_run_t;
+		type dirsrv_runtime_t;
 	')
 	# Allow creating a dir in /var/run with this type
-	files_pid_filetrans($1, dirsrv_var_run_t, dir)
+	files_pid_filetrans($1, dirsrv_runtime_t, dir)
 ')
 
 #######################################
@@ -149,10 +149,10 @@ interface(`dirsrv_pid_filetrans',`
 #
 interface(`dirsrv_read_var_run',`
 	gen_require(`
-		type dirsrv_var_run_t;
+		type dirsrv_runtime_t;
 	')
-	allow $1 dirsrv_var_run_t:dir list_dir_perms;
-	allow $1 dirsrv_var_run_t:file read_file_perms;
+	allow $1 dirsrv_runtime_t:dir list_dir_perms;
+	allow $1 dirsrv_runtime_t:file read_file_perms;
 ')
 
 ########################################

diff --git a/policy/modules/contrib/dirsrv.te b/policy/modules/contrib/dirsrv.te
index 1a8b77a1..e7c8d06e 100644
--- a/policy/modules/contrib/dirsrv.te
+++ b/policy/modules/contrib/dirsrv.te
@@ -32,12 +32,12 @@ type dirsrv_snmp_var_log_t;
 logging_log_file(dirsrv_snmp_var_log_t)
 
 # pid files
-type dirsrv_var_run_t;
-files_pid_file(dirsrv_var_run_t)
+type dirsrv_runtime_t alias dirsrv_var_run_t;
+files_pid_file(dirsrv_runtime_t)
 
 # snmp pid file
-type dirsrv_snmp_var_run_t;
-files_pid_file(dirsrv_snmp_var_run_t)
+type dirsrv_snmp_runtime_t alias dirsrv_snmp_var_run_t;
+files_pid_file(dirsrv_snmp_runtime_t)
 
 # lock files
 type dirsrv_var_lock_t;
@@ -95,11 +95,11 @@ allow dirsrv_t dirsrv_var_log_t:dir { setattr };
 logging_log_filetrans(dirsrv_t,dirsrv_var_log_t,{ sock_file file dir })
 
 # pid files
-manage_files_pattern(dirsrv_t, dirsrv_var_run_t, dirsrv_var_run_t)
-files_pid_filetrans(dirsrv_t, dirsrv_var_run_t, { file sock_file })
+manage_files_pattern(dirsrv_t, dirsrv_runtime_t, dirsrv_runtime_t)
+files_pid_filetrans(dirsrv_t, dirsrv_runtime_t, { file sock_file })
 
 # ldapi socket
-manage_sock_files_pattern(dirsrv_t, dirsrv_var_run_t, dirsrv_var_run_t)
+manage_sock_files_pattern(dirsrv_t, dirsrv_runtime_t, dirsrv_runtime_t)
 
 # lock files
 manage_files_pattern(dirsrv_t, dirsrv_var_lock_t, dirsrv_var_lock_t)
@@ -175,7 +175,7 @@ files_manage_var_files(dirsrv_snmp_t)
 rw_files_pattern(dirsrv_snmp_t, dirsrv_tmpfs_t, dirsrv_tmpfs_t)
 
 # stats file
-read_files_pattern(dirsrv_snmp_t, dirsrv_var_run_t, dirsrv_var_run_t)
+read_files_pattern(dirsrv_snmp_t, dirsrv_runtime_t, dirsrv_runtime_t)
 
 # process stuff
 allow dirsrv_snmp_t self:capability { dac_override dac_read_search };
@@ -184,9 +184,9 @@ allow dirsrv_snmp_t self:capability { dac_override dac_read_search };
 read_files_pattern(dirsrv_snmp_t, dirsrv_config_t, dirsrv_config_t)
 
 # pid file
-manage_files_pattern(dirsrv_snmp_t, dirsrv_snmp_var_run_t, dirsrv_snmp_var_run_t)
-files_pid_filetrans(dirsrv_snmp_t, dirsrv_snmp_var_run_t, { file sock_file })
-search_dirs_pattern(dirsrv_snmp_t, dirsrv_var_run_t, dirsrv_var_run_t)
+manage_files_pattern(dirsrv_snmp_t, dirsrv_snmp_runtime_t, dirsrv_snmp_runtime_t)
+files_pid_filetrans(dirsrv_snmp_t, dirsrv_snmp_runtime_t, { file sock_file })
+search_dirs_pattern(dirsrv_snmp_t, dirsrv_runtime_t, dirsrv_runtime_t)
 
 # log file
 manage_files_pattern(dirsrv_snmp_t, dirsrv_var_log_t, dirsrv_snmp_var_log_t);

diff --git a/policy/modules/contrib/nginx.if b/policy/modules/contrib/nginx.if
index ebef6e75..dbd9bcbe 100644
--- a/policy/modules/contrib/nginx.if
+++ b/policy/modules/contrib/nginx.if
@@ -81,7 +81,7 @@ interface(`nginx_domtrans',`
 #
 interface(`nginx_admin',`
 	gen_require(`
-		type nginx_t, nginx_conf_t, nginx_log_t, nginx_var_lib_t, nginx_var_run_t;
+		type nginx_t, nginx_conf_t, nginx_log_t, nginx_var_lib_t, nginx_runtime_t;
 		type nginx_exec_t;
 	')
 
@@ -100,5 +100,5 @@ interface(`nginx_admin',`
 	admin_pattern($1, nginx_log_t)
 
 	files_list_pids($1)
-	admin_pattern($1, nginx_var_run_t)
+	admin_pattern($1, nginx_runtime_t)
 ')

diff --git a/policy/modules/contrib/nginx.te b/policy/modules/contrib/nginx.te
index be59babb..1818be85 100644
--- a/policy/modules/contrib/nginx.te
+++ b/policy/modules/contrib/nginx.te
@@ -69,8 +69,8 @@ type nginx_var_lib_t;
 files_type(nginx_var_lib_t)
 
 # pid files
-type nginx_var_run_t;
-files_pid_file(nginx_var_run_t)
+type nginx_runtime_t alias nginx_var_run_t;
+files_pid_file(nginx_runtime_t)
 
 ########################################
 #
@@ -92,9 +92,9 @@ logging_log_filetrans(nginx_t, nginx_log_t, { file dir })
 
 
 # pid file
-manage_dirs_pattern(nginx_t, nginx_var_run_t, nginx_var_run_t)
-manage_files_pattern(nginx_t, nginx_var_run_t, nginx_var_run_t)
-files_pid_filetrans(nginx_t, nginx_var_run_t, file)
+manage_dirs_pattern(nginx_t, nginx_runtime_t, nginx_runtime_t)
+manage_files_pattern(nginx_t, nginx_runtime_t, nginx_runtime_t)
+files_pid_filetrans(nginx_t, nginx_runtime_t, file)
 
 # tmp files
 manage_files_pattern(nginx_t, nginx_tmp_t, nginx_tmp_t)

diff --git a/policy/modules/contrib/phpfpm.fc b/policy/modules/contrib/phpfpm.fc
index f43358d7..da28e772 100644
--- a/policy/modules/contrib/phpfpm.fc
+++ b/policy/modules/contrib/phpfpm.fc
@@ -1,5 +1,5 @@
 /usr/lib/php.*/bin/php-fpm		gen_context(system_u:object_r:phpfpm_exec_t,s0)
-/run/php*-fpm/*.sock			gen_context(system_u:object_r:phpfpm_var_run_t,s0)
+/run/php*-fpm/*.sock			gen_context(system_u:object_r:phpfpm_runtime_t,s0)
 
 /var/log/php-fpm.log			gen_context(system_u:object_r:phpfpm_log_t,s0)
-/run/php-fpm.pid			gen_context(system_u:object_r:phpfpm_var_run_t,s0)
+/run/php-fpm.pid			gen_context(system_u:object_r:phpfpm_runtime_t,s0)

diff --git a/policy/modules/contrib/phpfpm.if b/policy/modules/contrib/phpfpm.if
index fee2c174..38f7c3e7 100644
--- a/policy/modules/contrib/phpfpm.if
+++ b/policy/modules/contrib/phpfpm.if
@@ -13,7 +13,7 @@
 interface(`phpfpm_admin',`
 	gen_require(`
 		type phpfpm_t;
-		type phpfpm_log_t, phpfpm_tmp_t, phpfpm_var_run_t;
+		type phpfpm_log_t, phpfpm_tmp_t, phpfpm_runtime_t;
 	')
 
 	allow $1 phpfpm_t:process { ptrace signal_perms };
@@ -26,7 +26,7 @@ interface(`phpfpm_admin',`
 	admin_pattern($1, phpfpm_tmp_t)
 
 	files_list_pids($1)
-	admin_pattern($1, phpfpm_var_run_t)
+	admin_pattern($1, phpfpm_runtime_t)
 ')
 
 ########################################
@@ -42,7 +42,7 @@ interface(`phpfpm_admin',`
 #
 interface(`phpfpm_stream_connect',`
 	gen_require(`
-		type phpfpm_t, phpfpm_var_run_t;
+		type phpfpm_t, phpfpm_runtime_t;
 	')
-	stream_connect_pattern($1, phpfpm_var_run_t, phpfpm_var_run_t, phpfpm_t)
+	stream_connect_pattern($1, phpfpm_runtime_t, phpfpm_runtime_t, phpfpm_t)
 ')

diff --git a/policy/modules/contrib/phpfpm.te b/policy/modules/contrib/phpfpm.te
index 826ba859..aefad850 100644
--- a/policy/modules/contrib/phpfpm.te
+++ b/policy/modules/contrib/phpfpm.te
@@ -19,8 +19,8 @@ init_daemon_domain(phpfpm_t, phpfpm_exec_t)
 type phpfpm_tmp_t;
 files_tmp_file(phpfpm_tmp_t)
 
-type phpfpm_var_run_t;
-files_pid_file(phpfpm_var_run_t)
+type phpfpm_runtime_t alias phpfpm_var_run_t;
+files_pid_file(phpfpm_runtime_t)
 
 type phpfpm_log_t;
 logging_log_file(phpfpm_log_t)
@@ -45,10 +45,10 @@ manage_files_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t)
 manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t)
 files_tmp_filetrans(phpfpm_t, phpfpm_tmp_t, {file dir})
 
-manage_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
-files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })
+manage_files_pattern(phpfpm_t, phpfpm_runtime_t, phpfpm_runtime_t)
+files_pid_filetrans(phpfpm_t, phpfpm_runtime_t, { file sock_file })
 
-manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
+manage_sock_files_pattern(phpfpm_t, phpfpm_runtime_t, phpfpm_runtime_t)
 
 kernel_read_kernel_sysctls(phpfpm_t)
 

diff --git a/policy/modules/contrib/resolvconf.fc b/policy/modules/contrib/resolvconf.fc
index 651bbe0a..4e5df895 100644
--- a/policy/modules/contrib/resolvconf.fc
+++ b/policy/modules/contrib/resolvconf.fc
@@ -4,4 +4,4 @@
 
 /usr/sbin/resolvconf	--	gen_context(system_u:object_r:resolvconf_exec_t,s0)
 
-/run/resolvconf(/.*)?       gen_context(system_u:object_r:resolvconf_var_run_t,s0)
+/run/resolvconf(/.*)?       gen_context(system_u:object_r:resolvconf_runtime_t,s0)

diff --git a/policy/modules/contrib/resolvconf.if b/policy/modules/contrib/resolvconf.if
index 7a93eb6c..c6e53fb9 100644
--- a/policy/modules/contrib/resolvconf.if
+++ b/policy/modules/contrib/resolvconf.if
@@ -95,8 +95,8 @@ interface(`resolvconf_exec',`
 #
 interface(`resolvconf_generic_run_filetrans_run',`
 	gen_require(`
-		type resolvconf_var_run_t;
+		type resolvconf_runtime_t;
 	')
 
-	files_pid_filetrans($1, resolvconf_var_run_t, $2, $3)
+	files_pid_filetrans($1, resolvconf_runtime_t, $2, $3)
 ')

diff --git a/policy/modules/contrib/resolvconf.te b/policy/modules/contrib/resolvconf.te
index 58bb165d..18738a1f 100644
--- a/policy/modules/contrib/resolvconf.te
+++ b/policy/modules/contrib/resolvconf.te
@@ -11,8 +11,8 @@ attribute resolvconf_client;
 type resolvconf_conf_t;
 files_config_file(resolvconf_conf_t)
 
-type resolvconf_var_run_t;
-files_pid_file(resolvconf_var_run_t)
+type resolvconf_runtime_t alias resolvconf_var_run_t;
+files_pid_file(resolvconf_runtime_t)
 
 #########################################
 #
@@ -22,13 +22,13 @@ files_pid_file(resolvconf_var_run_t)
 allow resolvconf_t self:fifo_file manage_fifo_file_perms;
 allow resolvconf_t resolvconf_conf_t:file read_file_perms;
 
-manage_dirs_pattern(resolvconf_t, resolvconf_var_run_t, resolvconf_var_run_t)
-manage_files_pattern(resolvconf_t, resolvconf_var_run_t, resolvconf_var_run_t)
+manage_dirs_pattern(resolvconf_t, resolvconf_runtime_t, resolvconf_runtime_t)
+manage_files_pattern(resolvconf_t, resolvconf_runtime_t, resolvconf_runtime_t)
 
 corecmd_exec_bin(resolvconf_t)
 corecmd_exec_shell(resolvconf_t)
 
-files_pid_filetrans(resolvconf_t, resolvconf_var_run_t, { dir file })
+files_pid_filetrans(resolvconf_t, resolvconf_runtime_t, { dir file })
 files_read_etc_files(resolvconf_t)
 
 miscfiles_read_localization(resolvconf_t)

diff --git a/policy/modules/contrib/salt.fc b/policy/modules/contrib/salt.fc
index ccc8028f..1dbef661 100644
--- a/policy/modules/contrib/salt.fc
+++ b/policy/modules/contrib/salt.fc
@@ -16,11 +16,11 @@
 /var/log/salt/master	--	gen_context(system_u:object_r:salt_master_log_t,s0)
 /var/log/salt/minion	--	gen_context(system_u:object_r:salt_minion_log_t,s0)
 
-/run/salt	-d	gen_context(system_u:object_r:salt_var_run_t,s0)
-/run/salt/master(/.*)?	gen_context(system_u:object_r:salt_master_var_run_t,s0)
-/run/salt/minion(/.*)?	gen_context(system_u:object_r:salt_minion_var_run_t,s0)
-/run/salt-master\.pid	--	gen_context(system_u:object_r:salt_master_var_run_t,s0)
-/run/salt-minion\.pid	--	gen_context(system_u:object_r:salt_minion_var_run_t,s0)
+/run/salt	-d	gen_context(system_u:object_r:salt_runtime_t,s0)
+/run/salt/master(/.*)?	gen_context(system_u:object_r:salt_master_runtime_t,s0)
+/run/salt/minion(/.*)?	gen_context(system_u:object_r:salt_minion_runtime_t,s0)
+/run/salt-master\.pid	--	gen_context(system_u:object_r:salt_master_runtime_t,s0)
+/run/salt-minion\.pid	--	gen_context(system_u:object_r:salt_minion_runtime_t,s0)
 
 /var/cache/salt	-d	gen_context(system_u:object_r:salt_cache_t,s0)
 /var/cache/salt/master(/.*)?	gen_context(system_u:object_r:salt_master_cache_t,s0)

diff --git a/policy/modules/contrib/salt.if b/policy/modules/contrib/salt.if
index 27fefaef..a26d6380 100644
--- a/policy/modules/contrib/salt.if
+++ b/policy/modules/contrib/salt.if
@@ -21,8 +21,8 @@ interface(`salt_admin_master',`
 		type salt_master_initrc_exec_t;
 		type salt_master_exec_t;
 		type salt_etc_t;
-		type salt_var_run_t;
-		type salt_master_var_run_t;
+		type salt_runtime_t;
+		type salt_master_runtime_t;
 		attribute_role salt_master_roles;
 	')
 
@@ -40,8 +40,8 @@ interface(`salt_admin_master',`
 	files_list_etc($1)
 	admin_pattern($1, salt_etc_t, salt_etc_t)
 
-	allow $1 salt_var_run_t:dir search_dir_perms;
-	stream_connect_pattern($1, salt_master_var_run_t, salt_master_var_run_t, salt_master_t)
+	allow $1 salt_runtime_t:dir search_dir_perms;
+	stream_connect_pattern($1, salt_master_runtime_t, salt_master_runtime_t, salt_master_t)
 ')
 
 #########################################

diff --git a/policy/modules/contrib/salt.rst b/policy/modules/contrib/salt.rst
index 0268b95f..ad4ce7d6 100644
--- a/policy/modules/contrib/salt.rst
+++ b/policy/modules/contrib/salt.rst
@@ -124,13 +124,13 @@ salt_master_log_t
 salt_minion_log_t
   is used for the Salt minion log file (*/var/log/salt/minion*)
 
-salt_var_run_t
+salt_runtime_t
   is used for the parent directory for Salt run-time files (*/var/run/salt*)
 
-salt_master_var_run_t
+salt_master_runtime_t
   is used for the Salt master variable run-time files (*/var/run/salt/master*)
 
-salt_minion_var_run_t
+salt_minion_runtime_t
   is used for the Salt minion variable run-time files (*/var/run/salt/minion*)
 
 CONFIGURATION FILES

diff --git a/policy/modules/contrib/salt.te b/policy/modules/contrib/salt.te
index 2eb7b7db..5741c27a 100644
--- a/policy/modules/contrib/salt.te
+++ b/policy/modules/contrib/salt.te
@@ -48,9 +48,9 @@ files_tmp_file(salt_master_tmp_t)
 type salt_master_tmpfs_t;
 files_tmpfs_file(salt_master_tmpfs_t)
 
-type salt_master_var_run_t;
-init_daemon_pid_file(salt_master_var_run_t, file, "salt-master.pid")
-files_pid_file(salt_master_var_run_t)
+type salt_master_runtime_t alias salt_master_var_run_t;
+init_daemon_pid_file(salt_master_runtime_t, file, "salt-master.pid")
+files_pid_file(salt_master_runtime_t)
 
 type salt_minion_t;
 type salt_minion_exec_t;
@@ -75,9 +75,9 @@ files_tmp_file(salt_minion_tmp_t)
 type salt_minion_tmpfs_t;
 files_tmpfs_file(salt_minion_tmpfs_t)
 
-type salt_minion_var_run_t;
-init_daemon_pid_file(salt_minion_var_run_t, file, "salt-minion.pid")
-files_pid_file(salt_minion_var_run_t)
+type salt_minion_runtime_t alias salt_minion_var_run_t;
+init_daemon_pid_file(salt_minion_runtime_t, file, "salt-minion.pid")
+files_pid_file(salt_minion_runtime_t)
 
 type salt_cache_t;
 files_type(salt_cache_t)
@@ -94,8 +94,8 @@ files_type(salt_sls_t)
 type salt_pki_t;
 files_type(salt_pki_t)
 
-type salt_var_run_t;
-files_pid_file(salt_var_run_t)
+type salt_runtime_t alias salt_var_run_t;
+files_pid_file(salt_runtime_t)
 
 #########################################
 #
@@ -150,11 +150,11 @@ can_exec(salt_master_t, salt_master_tmp_t)
 allow salt_master_t salt_master_tmpfs_t:file { manage_file_perms map };
 fs_tmpfs_filetrans(salt_master_t, salt_master_tmpfs_t, file)
 
-# salt_master_var_run_t
-allow salt_master_t salt_master_var_run_t:file manage_file_perms;
-allow salt_master_t salt_master_var_run_t:sock_file manage_sock_file_perms;
-manage_dirs_pattern(salt_master_t, salt_var_run_t, salt_master_var_run_t)
-filetrans_pattern(salt_master_t, salt_var_run_t, salt_master_var_run_t, dir)
+# salt_master_runtime_t
+allow salt_master_t salt_master_runtime_t:file manage_file_perms;
+allow salt_master_t salt_master_runtime_t:sock_file manage_sock_file_perms;
+manage_dirs_pattern(salt_master_t, salt_runtime_t, salt_master_runtime_t)
+filetrans_pattern(salt_master_t, salt_runtime_t, salt_master_runtime_t, dir)
 
 # salt_pki_t
 create_dirs_pattern(salt_master_t, salt_etc_t, salt_pki_t)
@@ -164,10 +164,10 @@ filetrans_pattern(salt_master_t, salt_etc_t, salt_pki_t, dir, "pki")
 read_files_pattern(salt_master_t, salt_sls_t, salt_sls_t)
 allow salt_master_t salt_sls_t:dir list_dir_perms;
 
-# salt_var_run_t
-allow salt_master_t salt_var_run_t:dir create_dir_perms;
-files_pid_filetrans(salt_master_t, salt_var_run_t, dir)
-files_pid_filetrans(salt_master_t, salt_master_var_run_t, file, "salt-master.pid")
+# salt_runtime_t
+allow salt_master_t salt_runtime_t:dir create_dir_perms;
+files_pid_filetrans(salt_master_t, salt_runtime_t, dir)
+files_pid_filetrans(salt_master_t, salt_master_runtime_t, file, "salt-master.pid")
 
 kernel_read_network_state(salt_master_t)
 kernel_read_software_raid_state(salt_master_t)
@@ -269,20 +269,20 @@ can_exec(salt_minion_t, salt_minion_tmp_t)
 allow salt_minion_t salt_minion_tmpfs_t:file { manage_file_perms map };
 fs_tmpfs_filetrans(salt_minion_t, salt_minion_tmpfs_t, file)
 
-# salt_minion_var_run_t
-allow salt_minion_t salt_minion_var_run_t:file manage_file_perms;
-allow salt_minion_t salt_minion_var_run_t:sock_file manage_sock_file_perms;
-manage_dirs_pattern(salt_minion_t, salt_var_run_t, salt_minion_var_run_t)
-filetrans_pattern(salt_minion_t, salt_var_run_t, salt_minion_var_run_t, dir)
+# salt_minion_runtime_t
+allow salt_minion_t salt_minion_runtime_t:file manage_file_perms;
+allow salt_minion_t salt_minion_runtime_t:sock_file manage_sock_file_perms;
+manage_dirs_pattern(salt_minion_t, salt_runtime_t, salt_minion_runtime_t)
+filetrans_pattern(salt_minion_t, salt_runtime_t, salt_minion_runtime_t, dir)
 
 # salt_pki_t
 create_dirs_pattern(salt_minion_t, salt_etc_t, salt_pki_t)
 filetrans_pattern(salt_minion_t, salt_etc_t, salt_pki_t, dir, "pki")
 
-# salt_var_run_t
-allow salt_minion_t salt_var_run_t:dir create_dir_perms;
-files_pid_filetrans(salt_minion_t, salt_var_run_t, dir)
-files_pid_filetrans(salt_minion_t, salt_minion_var_run_t, file, "salt-minion.pid")
+# salt_runtime_t
+allow salt_minion_t salt_runtime_t:dir create_dir_perms;
+files_pid_filetrans(salt_minion_t, salt_runtime_t, dir)
+files_pid_filetrans(salt_minion_t, salt_minion_runtime_t, file, "salt-minion.pid")
 
 kernel_read_network_state(salt_minion_t)
 kernel_read_software_raid_state(salt_minion_t)

diff --git a/policy/modules/contrib/vde.fc b/policy/modules/contrib/vde.fc
index fa0b6b28..bea4fd72 100644
--- a/policy/modules/contrib/vde.fc
+++ b/policy/modules/contrib/vde.fc
@@ -1,5 +1,5 @@
 /etc/rc\.d/init\.d/vde	--	gen_context(system_u:object_r:vde_initrc_exec_t,s0)
 /usr/bin/vde_switch	--	gen_context(system_u:object_r:vde_exec_t,s0)
 /usr/sbin/vde_tunctl	--	gen_context(system_u:object_r:vde_exec_t,s0)
-/run/vde\.ctl(/.*)?		gen_context(system_u:object_r:vde_var_run_t,s0)
+/run/vde\.ctl(/.*)?		gen_context(system_u:object_r:vde_runtime_t,s0)
 /tmp/vde.[0-9-]*	-s	gen_context(system_u:object_r:vde_tmp_t,s0)

diff --git a/policy/modules/contrib/vde.if b/policy/modules/contrib/vde.if
index 00b31b4c..24bc31a9 100644
--- a/policy/modules/contrib/vde.if
+++ b/policy/modules/contrib/vde.if
@@ -19,7 +19,7 @@
 interface(`vde_role',`
 	gen_require(`
 		type vde_t, vde_tmp_t;
-		type vde_var_run_t;
+		type vde_runtime_t;
 		type vde_initrc_exec_t, vde_exec_t;
 	')
 
@@ -49,10 +49,10 @@ interface(`vde_role',`
 #
 interface(`vde_connect',`
 	gen_require(`
-		type vde_t, vde_var_run_t, vde_tmp_t;
+		type vde_t, vde_runtime_t, vde_tmp_t;
 	')
 	
-	allow $1 vde_var_run_t:sock_file write_sock_file_perms;
+	allow $1 vde_runtime_t:sock_file write_sock_file_perms;
 	allow $1 vde_t:unix_stream_socket { connectto };
 	allow $1 vde_t:unix_dgram_socket { sendto };
 	allow vde_t $1:unix_dgram_socket { sendto };

diff --git a/policy/modules/contrib/vde.te b/policy/modules/contrib/vde.te
index 56f668d7..8e935560 100644
--- a/policy/modules/contrib/vde.te
+++ b/policy/modules/contrib/vde.te
@@ -15,8 +15,8 @@ init_script_file(vde_initrc_exec_t)
 type vde_var_lib_t;
 files_type(vde_var_lib_t)
 
-type vde_var_run_t;
-files_pid_file(vde_var_run_t)
+type vde_runtime_t alias vde_var_run_t;
+files_pid_file(vde_runtime_t)
 
 type vde_tmp_t;
 files_tmp_file(vde_tmp_t)
@@ -34,10 +34,10 @@ allow vde_t self:unix_stream_socket {  create_stream_socket_perms connectto };
 allow vde_t self:unix_dgram_socket create_socket_perms;
 files_tmp_filetrans(vde_t, vde_tmp_t, sock_file)
 
-manage_dirs_pattern(vde_t, vde_var_run_t, vde_var_run_t)
-manage_files_pattern(vde_t, vde_var_run_t, vde_var_run_t)
-manage_sock_files_pattern(vde_t, vde_var_run_t, vde_var_run_t)
-files_pid_filetrans(vde_t, vde_var_run_t, { dir file sock_file unix_dgram_socket })
+manage_dirs_pattern(vde_t, vde_runtime_t, vde_runtime_t)
+manage_files_pattern(vde_t, vde_runtime_t, vde_runtime_t)
+manage_sock_files_pattern(vde_t, vde_runtime_t, vde_runtime_t)
+files_pid_filetrans(vde_t, vde_runtime_t, { dir file sock_file unix_dgram_socket })
 
 files_read_etc_files(vde_t)
 

diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
index 715cc2d6..bda92f4a 100644
--- a/policy/modules/services/apache.te
+++ b/policy/modules/services/apache.te
@@ -1487,8 +1487,8 @@ ifdef(`distro_gentoo',`
 ## </desc>
 gen_tunable(hiawatha_httpd, false)
 
-init_daemon_pid_file(httpd_var_run_t, dir, "apache_ssl_mutex")
-init_daemon_pid_file(httpd_var_run_t, dir, "apache2")
+init_daemon_pid_file(httpd_runtime_t, dir, "apache_ssl_mutex")
+init_daemon_pid_file(httpd_runtime_t, dir, "apache2")
 
 tunable_policy(`hiawatha_httpd',`
 	# bug 513362

diff --git a/policy/modules/services/clamav.te b/policy/modules/services/clamav.te
index 6ceaf130..334ae633 100644
--- a/policy/modules/services/clamav.te
+++ b/policy/modules/services/clamav.te
@@ -330,5 +330,5 @@ optional_policy(`
 ')
 
 ifdef(`distro_gentoo',`
-	init_daemon_pid_file(clamd_var_run_t, dir, "clamav")
+	init_daemon_pid_file(clamd_runtime_t, dir, "clamav")
 ')

diff --git a/policy/modules/services/courier.te b/policy/modules/services/courier.te
index dce1451b..5a4c7ea7 100644
--- a/policy/modules/services/courier.te
+++ b/policy/modules/services/courier.te
@@ -201,7 +201,7 @@ ifdef(`distro_gentoo',`
 	#
 
 	# Startup of courier-imapd creates /var/run/imapd.pid.lock and imapd.lock (bug 534030)
-	files_pid_filetrans(courier_tcpd_t, courier_var_run_t, file)
+	files_pid_filetrans(courier_tcpd_t, courier_runtime_t, file)
 
 	########################################
 	#

diff --git a/policy/modules/services/cron.fc b/policy/modules/services/cron.fc
index 6fdcdb78..ee64e81e 100644
--- a/policy/modules/services/cron.fc
+++ b/policy/modules/services/cron.fc
@@ -5,7 +5,7 @@
 
 /usr/bin/anacron	--	gen_context(system_u:object_r:anacron_exec_t,s0)
 #/usr/bin/at	--	gen_context(system_u:object_r:crontab_exec_t,s0)
-/usr/bin/atd	--	gen_context(system_u:object_r:crond_exec_t,s0)
+#/usr/bin/atd	--	gen_context(system_u:object_r:crond_exec_t,s0)
 /usr/bin/cron(d)?	--	gen_context(system_u:object_r:crond_exec_t,s0)
 /usr/bin/fcron	--	gen_context(system_u:object_r:crond_exec_t,s0)
 /usr/bin/fcronsighup	--	gen_context(system_u:object_r:crontab_exec_t,s0)
@@ -29,7 +29,6 @@
 /var/log/rpmpkgs.*	--	gen_context(system_u:object_r:cron_log_t,s0)
 
 /run/anacron\.pid	--	gen_context(system_u:object_r:crond_runtime_t,s0)
-/run/atd\.pid	--	gen_context(system_u:object_r:crond_runtime_t,s0)
 /run/cron(d)?\.pid	--	gen_context(system_u:object_r:crond_runtime_t,s0)
 /run/cron(d)?\.reboot	--	gen_context(system_u:object_r:crond_runtime_t,s0)
 /run/fcron\.fifo	-s	gen_context(system_u:object_r:crond_runtime_t,s0)
@@ -37,7 +36,6 @@
 /run/.*cron.*	--	gen_context(system_u:object_r:crond_runtime_t,s0)
 
 /var/spool/anacron(/.*)?	gen_context(system_u:object_r:system_cron_spool_t,s0)
-/var/spool/at(/.*)?	gen_context(system_u:object_r:user_cron_spool_t,s0)
 
 /var/spool/cron	-d	gen_context(system_u:object_r:cron_spool_t,s0)
 #/var/spool/cron/root	--	gen_context(system_u:object_r:sysadm_cron_spool_t,s0)

diff --git a/policy/modules/services/cron.rst b/policy/modules/services/cron.rst
index a35c26a4..773af37b 100644
--- a/policy/modules/services/cron.rst
+++ b/policy/modules/services/cron.rst
@@ -208,7 +208,7 @@ cron_var_lib_t
 crond_tmp_t
   is used for the temporary files created/managed by the cron daemon
 
-crond_var_run_t
+crond_runtime_t
   is used for the variable runtime information of the cron daemon
 
 POLICY

diff --git a/policy/modules/services/dbus.if b/policy/modules/services/dbus.if
index 7337fcd3..6169143e 100644
--- a/policy/modules/services/dbus.if
+++ b/policy/modules/services/dbus.if
@@ -607,7 +607,7 @@ interface(`dbus_unconfined',`
 
 ########################################
 ## <summary>
-##	Create resources in /run or /var/run with the system_dbusd_var_run_t
+##	Create resources in /run or /var/run with the system_dbusd_runtime_t
 ##	label. This method is deprecated in favor of the init_daemon_run_dir
 ##	call.
 ## </summary>
@@ -633,7 +633,7 @@ interface(`dbus_generic_pid_filetrans_system_dbusd_var_run',`
 
 ########################################
 ## <summary>
-##	Create directories with the system_dbusd_var_run_t label
+##	Create directories with the system_dbusd_runtime_t label
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -643,10 +643,10 @@ interface(`dbus_generic_pid_filetrans_system_dbusd_var_run',`
 #
 interface(`dbus_create_system_dbusd_var_run_dirs',`
 	gen_require(`
-		type system_dbusd_var_run_t;
+		type system_dbusd_runtime_t;
 	')
 
-	create_dirs_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t)
+	create_dirs_pattern($1, system_dbusd_runtime_t, system_dbusd_runtime_t)
 ')
 
 

diff --git a/policy/modules/services/fail2ban.te b/policy/modules/services/fail2ban.te
index 50264730..067d5caf 100644
--- a/policy/modules/services/fail2ban.te
+++ b/policy/modules/services/fail2ban.te
@@ -163,9 +163,9 @@ ifdef(`distro_gentoo',`
 	files_dontaudit_write_usr_dirs(fail2ban_t)
 
 	# Fix bug 534256 - Startup fails without these
-	allow fail2ban_client_t fail2ban_var_run_t:dir write;
+	allow fail2ban_client_t fail2ban_runtime_t:dir write;
 
-	init_daemon_pid_file(fail2ban_var_run_t, dir, "fail2ban")
+	init_daemon_pid_file(fail2ban_runtime_t, dir, "fail2ban")
 	init_use_script_ptys(fail2ban_client_t)
 ')
 

diff --git a/policy/modules/services/ldap.te b/policy/modules/services/ldap.te
index 50d7769d..31b895d7 100644
--- a/policy/modules/services/ldap.te
+++ b/policy/modules/services/ldap.te
@@ -154,7 +154,7 @@ optional_policy(`
 ')
 
 ifdef(`distro_gentoo',`
-	init_daemon_pid_file(slapd_var_run_t, dir, "openldap")
+	init_daemon_pid_file(slapd_runtime_t, dir, "openldap")
 
 	########################################
 	#

diff --git a/policy/modules/services/munin.rst b/policy/modules/services/munin.rst
index 220c75e1..207c2f19 100644
--- a/policy/modules/services/munin.rst
+++ b/policy/modules/services/munin.rst
@@ -71,7 +71,7 @@ munin_plugin_state_t
 munin_var_lib_t
   is used for the variable information used by munin
 
-munin_var_run_t
+munin_runtime_t
   is used for the variable runtime state information of munin
 
 POLICY

diff --git a/policy/modules/services/mysql.if b/policy/modules/services/mysql.if
index 82b5f1e2..bf5c0b70 100644
--- a/policy/modules/services/mysql.if
+++ b/policy/modules/services/mysql.if
@@ -449,10 +449,10 @@ interface(`mysql_admin',`
 #
 interface(`mysql_setattr_run_dirs',`
 	gen_require(`
-		type mysqld_var_run_t;
+		type mysqld_runtime_t;
 	')
 
-	setattr_dirs_pattern($1, mysqld_var_run_t, mysqld_var_run_t)
+	setattr_dirs_pattern($1, mysqld_runtime_t, mysqld_runtime_t)
 ')
 
 #######################################
@@ -467,10 +467,10 @@ interface(`mysql_setattr_run_dirs',`
 #
 interface(`mysql_create_run_dirs',`
 	gen_require(`
-		type mysqld_var_run_t;
+		type mysqld_runtime_t;
 	')
 
-	create_dirs_pattern($1, mysqld_var_run_t, mysqld_var_run_t)
+	create_dirs_pattern($1, mysqld_runtime_t, mysqld_runtime_t)
 ')
 
 #######################################

diff --git a/policy/modules/services/networkmanager.fc b/policy/modules/services/networkmanager.fc
index d37b86de..e7c1b89e 100644
--- a/policy/modules/services/networkmanager.fc
+++ b/policy/modules/services/networkmanager.fc
@@ -47,4 +47,4 @@
 /run/nm-dns-dnsmasq\.conf	--	gen_context(system_u:object_r:NetworkManager_runtime_t,s0)
 /run/wpa_supplicant(/.*)?	gen_context(system_u:object_r:NetworkManager_runtime_t,s0)
 /run/wpa_supplicant-global	-s	gen_context(system_u:object_r:NetworkManager_runtime_t,s0)
-/run/wpa_cli-.*		--	gen_context(system_u:object_r:wpa_cli_var_run_t,s0)
+/run/wpa_cli-.*		--	gen_context(system_u:object_r:wpa_cli_runtime_t,s0)

diff --git a/policy/modules/services/networkmanager.te b/policy/modules/services/networkmanager.te
index 309e3363..e3af7618 100644
--- a/policy/modules/services/networkmanager.te
+++ b/policy/modules/services/networkmanager.te
@@ -38,8 +38,8 @@ type wpa_cli_exec_t;
 init_system_domain(wpa_cli_t, wpa_cli_exec_t)
 
 ifdef(`distro_gentoo',`
-	type wpa_cli_var_run_t;
-	files_pid_file(wpa_cli_var_run_t)
+	type wpa_cli_runtime_t alias wpa_cli_var_run_t;
+	files_pid_file(wpa_cli_runtime_t)
 ')
 
 ########################################
@@ -425,8 +425,8 @@ ifdef(`distro_gentoo',`
 	#
 	# wpa_cli_t policy
 	#
-	manage_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t)
-	files_pid_filetrans(wpa_cli_t, wpa_cli_var_run_t, file)
+	manage_files_pattern(wpa_cli_t, wpa_cli_runtime_t, wpa_cli_runtime_t)
+	files_pid_filetrans(wpa_cli_t, wpa_cli_runtime_t, file)
 
 	corecmd_exec_bin(wpa_cli_t)
 	corecmd_exec_shell(wpa_cli_t)

diff --git a/policy/modules/services/ntp.fc b/policy/modules/services/ntp.fc
index 623451cf..b16c5739 100644
--- a/policy/modules/services/ntp.fc
+++ b/policy/modules/services/ntp.fc
@@ -39,7 +39,7 @@
 /var/log/ntp.*				--	gen_context(system_u:object_r:ntpd_log_t,s0)
 /var/log/ntpstats(/.*)?				gen_context(system_u:object_r:ntpd_log_t,s0)
 /var/log/xntpd.*			--	gen_context(system_u:object_r:ntpd_log_t,s0)
-/run/ntpd\.sock	-s	gen_context(system_u:object_r:ntpd_var_run_t,s0)
+/run/ntpd\.sock	-s	gen_context(system_u:object_r:ntpd_pid_t,s0)
 
 ifdef(`distro_gentoo',`
 /var/lib/openntpd/ntpd.drift	--	gen_context(system_u:object_r:ntp_drift_t,s0)

diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
index 2bf22f72..2b34a4f9 100644
--- a/policy/modules/system/authlogin.te
+++ b/policy/modules/system/authlogin.te
@@ -477,5 +477,5 @@ optional_policy(`
 ')
 
 ifdef(`distro_gentoo',`
-	init_daemon_pid_file(pam_var_run_t, dir, "sepermit")
+	init_daemon_pid_file(pam_runtime_t, dir, "sepermit")
 ')

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index fe9b8535..4d152ee1 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -1383,8 +1383,8 @@ ifdef(`distro_gentoo',`
 	read_files_pattern(initrc_t, init_script_readable, init_script_readable)
 	read_lnk_files_pattern(initrc_t, init_script_readable, init_script_readable)
 
-	manage_dirs_pattern(initrc_t, initrc_var_run_t, initrc_var_run_t)
-	files_pid_filetrans(initrc_t, initrc_var_run_t, dir)
+	manage_dirs_pattern(initrc_t, initrc_runtime_t, initrc_runtime_t)
+	files_pid_filetrans(initrc_t, initrc_runtime_t, dir)
 
 	kernel_write_proc_files(initrc_t)
 

diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te
index 857c6f23..6b705bfe 100644
--- a/policy/modules/system/lvm.te
+++ b/policy/modules/system/lvm.te
@@ -401,7 +401,7 @@ ifdef(`distro_gentoo',`
 	# Bug 529430 comment 6
 	create_dirs_pattern(lvm_t, lvm_etc_t, lvm_etc_t)
 	# Bug 529430 comment 8
-	manage_fifo_files_pattern(lvm_t, lvm_var_run_t, lvm_var_run_t)
+	manage_fifo_files_pattern(lvm_t, lvm_runtime_t, lvm_runtime_t)
 
 	# Bug 615300
 	init_read_script_pipes(lvm_t)

diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
index df4193d6..33729a23 100644
--- a/policy/modules/system/modutils.te
+++ b/policy/modules/system/modutils.te
@@ -216,6 +216,6 @@ ifdef(`distro_gentoo',`
 	files_manage_kernel_modules(kmod_t)
 
 	# for /run/tmpfiles.d/kmod.conf
-	tmpfiles_create_var_run_files(kmod_t)
-	filetrans_add_pattern(kmod_t, tmpfiles_var_run_t, kmod_tmpfiles_conf_t, file)
+	tmpfiles_create_runtime_files(kmod_t)
+	filetrans_add_pattern(kmod_t, tmpfiles_runtime_t, kmod_tmpfiles_conf_t, file)
 ')

diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
index 69b6ce88..1a8f7281 100644
--- a/policy/modules/system/sysnetwork.fc
+++ b/policy/modules/system/sysnetwork.fc
@@ -93,6 +93,6 @@ ifdef(`distro_debian',`
 
 ifdef(`distro_gentoo',`
 /usr/lib/dhcpcd/dhcpcd-run-hooks	--	gen_context(system_u:object_r:dhcpc_script_exec_t,s0)
-/run/dhcpcd\.sock			-s	gen_context(system_u:object_r:dhcpc_var_run_t,s0)
-/run/dhcpcd\.unpriv\.sock		-s	gen_context(system_u:object_r:dhcpc_var_run_t,s0)
+/run/dhcpcd\.sock			-s	gen_context(system_u:object_r:dhcpc_runtime_t,s0)
+/run/dhcpcd\.unpriv\.sock		-s	gen_context(system_u:object_r:dhcpc_runtime_t,s0)
 ')

diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
index bacb3794..bb54a544 100644
--- a/policy/modules/system/sysnetwork.te
+++ b/policy/modules/system/sysnetwork.te
@@ -434,14 +434,14 @@ ifdef(`distro_gentoo',`
 	allow dhcpc_t self:netlink_socket client_stream_socket_perms;
 
 	# Allow dhcpcd to set its control sockets
-	allow dhcpc_t dhcpc_var_run_t:sock_file manage_sock_file_perms;
+	allow dhcpc_t dhcpc_runtime_t:sock_file manage_sock_file_perms;
 
 	# Allow dhcpc to set hostname (/proc/sys/kernel/hostname)
 	allow dhcpc_t self:capability sys_admin;
 	kernel_rw_kernel_sysctl(dhcpc_t)
 
 	# Fixes bug 468878
-	files_pid_filetrans(dhcpc_t, dhcpc_var_run_t, sock_file)
+	files_pid_filetrans(dhcpc_t, dhcpc_runtime_t, sock_file)
 	allow dhcpc_t self:unix_stream_socket { create_stream_socket_perms connectto };
 
 	optional_policy(`
@@ -479,9 +479,9 @@ ifdef(`distro_gentoo',`
 	manage_files_pattern(dhcpc_script_t, dhcpc_script_tmp_t, dhcpc_script_tmp_t)
 	files_tmp_filetrans(dhcpc_script_t, dhcpc_script_tmp_t, { file dir })
 
-	manage_files_pattern(dhcpc_script_t, dhcpc_var_run_t, dhcpc_var_run_t)
-	create_dirs_pattern(dhcpc_script_t, dhcpc_var_run_t, dhcpc_var_run_t)
-	files_pid_filetrans(dhcpc_script_t, dhcpc_var_run_t, { file dir })
+	manage_files_pattern(dhcpc_script_t, dhcpc_runtime_t, dhcpc_runtime_t)
+	create_dirs_pattern(dhcpc_script_t, dhcpc_runtime_t, dhcpc_runtime_t)
+	files_pid_filetrans(dhcpc_script_t, dhcpc_runtime_t, { file dir })
 
 	kernel_read_network_state(dhcpc_script_t)
 	kernel_read_system_state(dhcpc_script_t)

diff --git a/policy/modules/system/tmpfiles.fc b/policy/modules/system/tmpfiles.fc
index 16d821a8..5a13949c 100644
--- a/policy/modules/system/tmpfiles.fc
+++ b/policy/modules/system/tmpfiles.fc
@@ -1,7 +1,7 @@
 
 ifndef(`init_systemd',`
 /etc/tmpfiles.d(/.*)?				gen_context(system_u:object_r:tmpfiles_conf_t,s0)
-/run/tmpfiles.d(/.*)?				gen_context(system_u:object_r:tmpfiles_var_run_t,s0)
+/run/tmpfiles.d(/.*)?				gen_context(system_u:object_r:tmpfiles_runtime_t,s0)
 ')
 
 /usr/bin/tmpfiles				--	gen_context(system_u:object_r:tmpfiles_exec_t,s0)

diff --git a/policy/modules/system/tmpfiles.if b/policy/modules/system/tmpfiles.if
index 09897fc0..361dc8c4 100644
--- a/policy/modules/system/tmpfiles.if
+++ b/policy/modules/system/tmpfiles.if
@@ -10,14 +10,14 @@
 ##	</summary>
 ## </param>
 #
-interface(`tmpfiles_read_var_run',`
+interface(`tmpfiles_read_runtime',`
 	gen_require(`
-		type tmpfiles_var_run_t;
+		type tmpfiles_runtime_t;
 	')
 
 	files_search_pids($1)
-	allow $1 tmpfiles_var_run_t:dir list_dir_perms;
-	allow $1 tmpfiles_var_run_t:file read_file_perms;
+	allow $1 tmpfiles_runtime_t:dir list_dir_perms;
+	allow $1 tmpfiles_runtime_t:file read_file_perms;
 ')
 
 ########################################
@@ -30,14 +30,14 @@ interface(`tmpfiles_read_var_run',`
 ##	</summary>
 ## </param>
 #
-interface(`tmpfiles_create_var_run_files',`
+interface(`tmpfiles_create_runtime_files',`
 	gen_require(`
-		type tmpfiles_var_run_t;
+		type tmpfiles_runtime_t;
 	')
 
-	create_files_pattern($1, tmpfiles_var_run_t, tmpfiles_var_run_t)
+	create_files_pattern($1, tmpfiles_runtime_t, tmpfiles_runtime_t)
 
-	tmpfiles_read_var_run($1)
+	tmpfiles_read_runtime($1)
 ')
 
 ########################################
@@ -50,14 +50,14 @@ interface(`tmpfiles_create_var_run_files',`
 ##	</summary>
 ## </param>
 #
-interface(`tmpfiles_write_var_run_files',`
+interface(`tmpfiles_write_runtime_files',`
 	gen_require(`
-		type tmpfiles_var_run_t;
+		type tmpfiles_runtime_t;
 	')
 
-	write_files_pattern($1, tmpfiles_var_run_t, tmpfiles_var_run_t)
+	write_files_pattern($1, tmpfiles_runtime_t, tmpfiles_runtime_t)
 
-	tmpfiles_read_var_run($1)
+	tmpfiles_read_runtime($1)
 ')
 
 ########################################
@@ -70,14 +70,14 @@ interface(`tmpfiles_write_var_run_files',`
 ##	</summary>
 ## </param>
 #
-interface(`tmpfiles_manage_var_run_files',`
+interface(`tmpfiles_manage_runtime_files',`
 	gen_require(`
-		type tmpfiles_var_run_t;
+		type tmpfiles_runtime_t;
 	')
 
-	tmpfiles_read_var_run($1)
+	tmpfiles_read_runtime($1)
 
-	manage_files_pattern($1, tmpfiles_var_run_t, tmpfiles_var_run_t)
+	manage_files_pattern($1, tmpfiles_runtime_t, tmpfiles_runtime_t)
 ')
 
 ########################################

diff --git a/policy/modules/system/tmpfiles.rst b/policy/modules/system/tmpfiles.rst
index 748032b4..a445072a 100644
--- a/policy/modules/system/tmpfiles.rst
+++ b/policy/modules/system/tmpfiles.rst
@@ -49,7 +49,7 @@ tmpfiles_conf_t
 tmpfiles_exec_t
   is used as entrypoint for the tmpfiles application
 
-tmpfiles_var_run_t
+tmpfiles_runtime_t
   is used as the variable run-time data used by the tmpfiles application
 
 POLICY

diff --git a/policy/modules/system/tmpfiles.te b/policy/modules/system/tmpfiles.te
index 9063ca3e..57be1edc 100644
--- a/policy/modules/system/tmpfiles.te
+++ b/policy/modules/system/tmpfiles.te
@@ -23,8 +23,8 @@ init_daemon_domain(tmpfiles_t, tmpfiles_exec_t)
 type tmpfiles_conf_t;
 files_config_file(tmpfiles_conf_t)
 
-type tmpfiles_var_run_t;
-files_pid_file(tmpfiles_var_run_t)
+type tmpfiles_runtime_t alias tmpfiles_var_run_t;
+files_pid_file(tmpfiles_runtime_t)
 
 
 ########################################
@@ -42,8 +42,8 @@ allow tmpfiles_t tmpfiles_exec_t:file execute_no_trans;
 list_dirs_pattern(tmpfiles_t, tmpfiles_conf_t, tmpfiles_conf_t)
 read_files_pattern(tmpfiles_t, tmpfiles_conf_t, tmpfiles_conf_t)
 
-manage_files_pattern(tmpfiles_t, tmpfiles_var_run_t, tmpfiles_var_run_t)
-manage_dirs_pattern(tmpfiles_t, tmpfiles_var_run_t, tmpfiles_var_run_t)
+manage_files_pattern(tmpfiles_t, tmpfiles_runtime_t, tmpfiles_runtime_t)
+manage_dirs_pattern(tmpfiles_t, tmpfiles_runtime_t, tmpfiles_runtime_t)
 
 corecmd_exec_bin(tmpfiles_t)
 corecmd_exec_shell(tmpfiles_t)