Index: policy/modules/kernel/corenetwork.te.in
===================================================================
--- policy/modules/kernel/corenetwork.te.in	(revision 2473)
+++ policy/modules/kernel/corenetwork.te.in	(working copy)
@@ -168,6 +168,7 @@
 network_port(xserver, tcp, 6000, s0, tcp,6001,s0, tcp,6002,s0, tcp,6003,s0, tcp,6004,s0, tcp,6005,s0, tcp,6006,s0, tcp,6007,s0, tcp,6008,s0, tcp,6009,s0, tcp,6010,s0, tcp,6011,s0, tcp,6012,s0, tcp,6013,s0, tcp,6014,s0, tcp,6015,s0, tcp,6016,s0, tcp,6017,s0, tcp,6018,s0, tcp,6019,s0)
 network_port(zebra, tcp,2600,s0, tcp,2601,s0, tcp,2602,s0, tcp,2603,s0, tcp,2604,s0, tcp,2606,s0, udp,2600,s0, udp,2601,s0, udp,2602,s0, udp,2603,s0, udp,2604,s0, udp,2606,s0)
 network_port(zope, tcp,8021,s0)
+network_port(xchat, tcp,4990,s0);
 
 # Defaults for reserved ports.  Earlier portcon entries take precedence;
 # these entries just cover any remaining reserved ports not otherwise declared.
Index: policy/modules/apps/xchat.fc
===================================================================
--- policy/modules/apps/xchat.fc	(revision 0)
+++ policy/modules/apps/xchat.fc	(revision 0)
@@ -0,0 +1,3 @@
+/usr/bin/xchat                  --      gen_context(system_u:object_r:xchat_exec_t,s0)
+
+HOME_DIR/\.xchat2(/.*)?         gen_context(system_u:object_r:ROLE_xchat_home_t,s0)
Index: policy/modules/apps/xchat.te
===================================================================
--- policy/modules/apps/xchat.te	(revision 0)
+++ policy/modules/apps/xchat.te	(revision 0)
@@ -0,0 +1,8 @@
+policy_module(xchat,1.0.0) 
+
+########################################
+#
+# Declarations
+#
+type xchat_exec_t;
+application_executable_file(xchat_exec_t)
Index: policy/modules/apps/xchat.if
===================================================================
--- policy/modules/apps/xchat.if	(revision 0)
+++ policy/modules/apps/xchat.if	(revision 0)
@@ -0,0 +1,441 @@
+## <summary>SELinux policy module</summary>
+## <desc>
+##	<p>
+##		SELinux policy module for XChat
+##		XChat scripting engines not supported
+##	</p>
+## </desc>
+
+#######################################
+## <summary>
+##      The per role template for the XChat module.
+## </summary>
+## <desc>
+##      <p>
+##      This template creates derived domains which are used
+##      for XChat.
+##      </p>
+##      <p>
+##      This template is invoked automatically for each user, and
+##      generally does not need to be invoked directly
+##      by policy writers.
+##      </p>
+## </desc>
+## <param name="userdomain_prefix">
+##      <summary>
+##      The prefix of the user domain (e.g., user
+##      is the prefix for user_t).
+##      </summary>
+## </param>
+## <param name="user_domain">
+##      <summary>
+##      The type of the user domain.
+##      </summary>
+## </param>
+## <param name="user_role">
+##      <summary>
+##      The role associated with the user domain.
+##      </summary>
+## </param>
+#
+template(`xchat_per_role_template',`
+		gen_require(`
+				type xchat_exec_t;
+		')
+
+		########################################
+		#
+		# Declarations
+		#
+		type $1_xchat_t;
+		application_domain($1_xchat_t,xchat_exec_t)
+		role $3 types $1_xchat_t;
+
+		type $1_xchat_home_t alias $1_xchat_rw_t;
+		files_poly_member($1_xchat_home_t)
+		userdom_user_home_content($1,$1_xchat_home_t)
+
+		type $1_xchat_tmpfs_t;
+		files_tmpfs_file($1_xchat_tmpfs_t)
+
+		########################################
+		#
+		# Local Policy
+		#
+		allow $1_xchat_t self:process { signal getsched setsched sigkill };
+		allow $1_xchat_t self:fifo_file rw_fifo_file_perms;
+		allow $1_xchat_t self:sem create_sem_perms;
+		allow $1_xchat_t self:netlink_route_socket r_netlink_socket_perms;
+		allow $1_xchat_t self:tcp_socket { create_socket_perms accept listen };
+		allow $1_xchat_t self:udp_socket create_socket_perms;
+
+		allow $1_xchat_t $2:fd use;
+		allow $1_xchat_t $2:process sigchld;
+
+		# XChat(GConfd-2) wants to stream connect to /tmp/orbit-*
+		allow $1_xchat_t $2:unix_stream_socket connectto;
+		allow $2 $1_xchat_t:unix_stream_socket connectto;
+
+		allow $2 $1_xchat_t:fd use;
+		allow $2 $1_xchat_t:shm { associate getattr unix_read unix_write };
+		allow $2 $1_xchat_t:process ptrace;
+
+		manage_dirs_pattern($1_xchat_t,$1_xchat_home_t,$1_xchat_home_t)
+		manage_files_pattern($1_xchat_t,$1_xchat_home_t,$1_xchat_home_t)
+		manage_sock_files_pattern($1_xchat_t,$1_xchat_home_t,$1_xchat_home_t)
+
+		userdom_user_home_dir_filetrans($1,$1_xchat_t,$1_xchat_home_t,{ dir sock_file file })
+		userdom_search_user_home_dirs($1,$1_xchat_t)
+
+		userdom_list_user_home_content_dirs($1,$1_xchat_t)
+
+		userdom_dbus_sendrecv_all_users($1_xchat_t)
+
+		userdom_read_user_home_content_files($1,$1_xchat_t)
+		userdom_read_user_home_content_symlinks($1,$1_xchat_t)
+		userdom_read_user_tmp_files($1,$1_xchat_t)
+		userdom_manage_user_tmp_dirs($1,$1_xchat_t)
+		userdom_manage_user_tmp_files($1,$1_xchat_t)
+		userdom_manage_user_tmp_sockets($1,$1_xchat_t)
+		userdom_tmp_filetrans_user_tmp($1,$1_xchat_t, { file dir sock_file })
+
+		# XChat wants getattr to Beagle sock_file in home
+		dontaudit $1_xchat_t $1_home_t:sock_file getattr;
+
+		userdom_unlink_unpriv_users_home_content_files($1_xchat_t)
+		userdom_dontaudit_write_user_home_content_files($1,$1_xchat_t)
+
+		manage_dirs_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+		manage_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+		manage_sock_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+
+		relabel_dirs_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+		relabel_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+		relabel_sock_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+
+		manage_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)
+		manage_lnk_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)
+		manage_fifo_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)
+		manage_sock_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)
+		fs_tmpfs_filetrans($1_xchat_t,$1_xchat_tmpfs_t,{ file lnk_file sock_file fifo_file })
+		fs_rw_tmpfs_files($1_xchat_t)
+
+		corenet_tcp_bind_xchat_port($1_xchat_t)
+
+		corenet_all_recvfrom_netlabel($1_xchat_t)
+		corenet_tcp_sendrecv_all_ports($1_xchat_t)
+		corenet_tcp_connect_all_ports($1_xchat_t)
+		corenet_tcp_connect_generic_port($1_xchat_t)
+		corenet_all_recvfrom_unlabeled($1_xchat_t)
+		corenet_tcp_sendrecv_all_if($1_xchat_t)
+		corenet_tcp_sendrecv_all_nodes($1_xchat_t)
+		corenet_tcp_bind_all_nodes($1_xchat_t)
+		corenet_raw_sendrecv_generic_if($1_xchat_t)
+		corenet_raw_sendrecv_all_nodes($1_xchat_t)
+		corenet_sendrecv_generic_client_packets($1_xchat_t)
+
+		corenet_dontaudit_tcp_sendrecv_generic_port($1_xchat_t)
+		corenet_dontaudit_tcp_bind_generic_port($1_xchat_t)
+
+		kernel_read_system_state($1_xchat_t)
+		sysnet_read_config($1_xchat_t)
+
+		files_read_etc_files($1_xchat_t)
+		files_read_etc_symlinks($1_xchat_t)
+		files_read_etc_runtime_files($1_xchat_t)
+
+		files_read_usr_files($1_xchat_t)
+		files_read_usr_symlinks($1_xchat_t)
+
+		kernel_dontaudit_list_unlabeled($1_xchat_t)
+		kernel_dontaudit_getattr_unlabeled_files($1_xchat_t)
+		kernel_dontaudit_read_unlabeled_files($1_xchat_t)
+
+		files_dontaudit_list_non_security($1_xchat_t)
+		files_dontaudit_getattr_non_security_files($1_xchat_t)
+		fs_dontaudit_getattr_all_fs($1_xchat_t)
+
+		dev_getattr_sysfs_dirs($1_xchat_t)
+		fs_search_auto_mountpoints($1_xchat_t)
+		fs_list_inotifyfs($1_xchat_t)
+
+		term_dontaudit_getattr_pty_dirs($1_xchat_t)
+
+		selinux_dontaudit_getattr_fs($1_xchat_t)
+
+		dev_dontaudit_getattr_all_blk_files($1_xchat_t)
+		dev_dontaudit_getattr_all_chr_files($1_xchat_t)
+
+		domain_auto_trans($2, xchat_exec_t, $1_xchat_t)
+		allow $2 $1_xchat_t:process { noatsecure siginh rlimitinh };
+
+		ps_process_pattern($2,$1_xchat_t)
+		allow $2 $1_xchat_t:process signal_perms;
+
+		libs_exec_lib_files($1_xchat_t)
+		libs_use_ld_so($1_xchat_t)
+
+		miscfiles_read_localization($1_xchat_t)
+
+		logging_send_syslog_msg($1_xchat_t)
+
+		corecmd_exec_bin($1_xchat_t)
+		corecmd_dontaudit_exec_all_executables($1_xchat_t)
+		corecmd_bin_entry_type($1_xchat_t)
+		corecmd_read_bin_symlinks($1_xchat_t)
+		corecmd_shell_entry_type($1_xchat_t)
+
+		dev_read_urand($1_xchat_t)      
+		dev_read_rand($1_xchat_t)
+
+		dev_read_sound($1_xchat_t)
+		dev_write_sound($1_xchat_t)
+
+		alsa_read_rw_config($1_xchat_t)
+
+		userdom_use_user_terminals($1,$1_xchat_t)
+
+		xserver_user_client_template($1,$1_xchat_t,$1_xchat_tmpfs_t)
+
+		xserver_dontaudit_read_xdm_tmp_files($1_xchat_t)
+		xserver_dontaudit_getattr_xdm_tmp_sockets($1_xchat_t)
+
+		ifdef(`enable_mls',`',`
+				fs_search_removable($1_xchat_t)
+				fs_read_removable_files($1_xchat_t)
+				fs_read_removable_symlinks($1_xchat_t)
+		')
+
+		tunable_policy(`write_untrusted_content',`
+				userdom_manage_user_home_content_dirs($1,$1_xchat_t)
+				userdom_manage_user_home_content_files($1,$1_xchat_t)
+				userdom_manage_user_home_content_sockets($1,$1_xchat_t)
+				userdom_read_user_home_content_symlinks($1,$1_xchat_t)
+		')
+
+		tunable_policy(`use_nfs_home_dirs',`
+				fs_manage_nfs_dirs($1_xchat_t)
+				fs_manage_nfs_files($1_xchat_t)
+				fs_manage_nfs_symlinks($1_xchat_t)
+		')
+
+		tunable_policy(`use_samba_home_dirs',`
+				fs_manage_cifs_dirs($1_xchat_t)
+				fs_manage_cifs_files($1_xchat_t)
+				fs_manage_cifs_symlinks($1_xchat_t)
+		')
+
+		optional_policy(`
+				dbus_user_bus_client_template($1,$1_xchat,$1_xchat_t)
+				dbus_manage_user_bus($1,$1_xchat_t)
+				dbus_system_bus_client_template($1_xchat,$1_xchat_t)
+				dbus_send_system_bus($1_xchat_t)
+		')
+
+		optional_policy(`
+				gnome_manage_user_gnome_config($1,$1_xchat_t)
+				gnome_domtrans_user_gconf($1,$1_xchat_t)
+				gnome_stream_connect_gconf_template($1,$1_xchat_t)
+		')
+
+		optional_policy(`
+				mozilla_read_user_home_files($1,$1_xchat_t)
+				mozilla_domtrans_user_mozilla($1,$1_xchat_t)
+				mozilla_dbus_chat($1,$1_xchat_t)
+		')
+')
+
+########################################
+## <summary>
+##      Read XChat per user homedir
+## </summary>
+## <desc>
+##      <p>
+##      Read XChat per user homedir
+##      </p>
+##      <p>
+##      This is a templated interface, and should only
+##      be called from a per-userdomain template.
+##      </p>
+## </desc>
+## <param name="userdomain_prefix">
+##      <summary>
+##      The prefix of the user domain (e.g., user
+##      is the prefix for user_t).
+##      </summary>
+## </param>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+template(`xchat_read_user_home_files',`
+        gen_require(`
+                type $1_xchat_home_t;
+        ')
+
+        allow $2 $1_xchat_home_t:dir list_dir_perms;
+        allow $2 $1_xchat_home_t:file read_file_perms;
+')
+
+########################################
+## <summary>
+##      Write XChat per user homedir
+## </summary>
+## <desc>
+##      <p>
+##      Write XChat per user homedir
+##      </p>
+##      <p>
+##      This is a templated interface, and should only
+##      be called from a per-userdomain template.
+##      </p>
+## </desc>
+## <param name="userdomain_prefix">
+##      <summary>
+##      The prefix of the user domain (e.g., user
+##      is the prefix for user_t).
+##      </summary>
+## </param>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+template(`xchat_write_user_home_files',`
+        gen_require(`
+                type $1_xchat_home_t;
+        ')
+
+        allow $2 $1_xchat_home_t:dir list_dir_perms;
+        allow $2 $1_xchat_home_t:file write;
+')
+
+########################################
+## <summary>
+##      Run XChat in user XChat domain.
+## </summary>
+## <desc>
+##      <p>
+##      Run XChat in user XChat domain.
+##      </p>
+##      <p>
+##      This is a templated interface, and should only
+##      be called from a per-userdomain template.
+##      </p>
+## </desc>
+## <param name="userdomain_prefix">
+##      <summary>
+##      The prefix of the user domain (e.g., user
+##      is the prefix for user_t).
+##      </summary>
+## </param>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+template(`xchat_domtrans_user_xchat',`
+        gen_require(`
+                type $1_xchat_t, xchat_exec_t;
+        ')
+
+        domtrans_pattern($2, xchat_exec_t,$1_xchat_t)
+')
+
+########################################
+## <summary>
+##      Read/write XChat per user tcp_socket
+## </summary>
+## <desc>
+##      <p>
+##      Read/write XChat per user tcp_socket
+##      </p>
+##      <p>
+##      This is a templated interface, and should only
+##      be called from a per-userdomain template.
+##      </p>
+## </desc>
+## <param name="userdomain_prefix">
+##      <summary>
+##      The prefix of the user domain (e.g., user
+##      is the prefix for user_t).
+##      </summary>
+## </param>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+template(`xchat_rw_user_tcp_sockets',`
+        gen_require(`
+                type $1_xchat_t;
+        ')
+
+        allow $2 $1_xchat_t:tcp_socket rw_socket_perms;
+')
+
+########################################
+## <summary>
+##	XChat connection template.
+## </summary>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="user_domain">
+##	<summary>
+##	The type of the user domain.
+##	</summary>
+## </param>
+#
+template(`xchat_stream_connect_template',`
+	gen_require(`
+		type $1_xchat_t;
+	')
+
+	allow $2 $1_xchat_t:unix_stream_socket connectto;
+')
+
+########################################
+## <summary>
+##	Send and receive messages from
+##	XChat over dbus.
+## </summary>
+## <desc>
+##	<p>
+##	Send and receive messages from
+##	XChat over dbus.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`xchat_dbus_chat',`
+	gen_require(`
+		type $1_xchat_t;
+		class dbus send_msg;
+	')
+
+	allow $2 $1_xchat_t:dbus send_msg;
+	allow $1_xchat_t $2:dbus send_msg;
+')
Index: policy/modules/services/dbus.if
===================================================================
--- policy/modules/services/dbus.if	(revision 2473)
+++ policy/modules/services/dbus.if	(working copy)
@@ -369,3 +369,29 @@
 
 	allow $1 system_dbusd_t:dbus *;
 ')
+
+########################################
+## <summary>
+##	Send a message and acquire service 
+##	on user/application specific DBUS.
+## </summary>
+## <param name="user_prefix">
+##	<summary>
+##	The prefix of the domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`dbus_manage_user_bus',`
+	gen_require(`
+		type $1_dbusd_t;
+		class dbus all_dbus_perms;
+	')
+
+	allow $2 $1_dbusd_t:dbus *;
+')
Index: policy/modules/system/userdomain.if
===================================================================
--- policy/modules/system/userdomain.if	(revision 2473)
+++ policy/modules/system/userdomain.if	(working copy)
@@ -5559,3 +5559,82 @@
 interface(`userdom_unconfined',`
 	refpolicywarn(`$0($*) has been deprecated.')
 ')
+
+########################################
+## <summary>
+##	List directories
+##	in a user home subdirectory.
+## </summary>
+## <desc>
+##	<p>
+##	List directories
+##	in a user home subdirectory.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`userdom_list_user_home_content_dirs',`
+	gen_require(`
+		type $1_home_dir_t, $1_home_t;
+		attribute user_home_type;
+	')
+
+	files_search_home($2)
+	list_dirs_pattern($2,{ $1_home_dir_t user_home_type },$1_home_t)
+')
+
+########################################
+## <summary>
+##	Send and receive a dbus message to
+##	and from all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_dbus_sendrecv_all_users',`
+	gen_require(`
+		attribute userdomain;
+		class dbus send_msg;
+	')
+
+	allow $1 userdomain:dbus send_msg;
+	allow userdomain $1:dbus send_msg;
+')
+
+########################################
+## <summary>
+##	Unlink all unprivileged users home directory
+##	files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_unlink_unpriv_users_home_content_files',`
+	gen_require(`
+		attribute user_home_dir_type, user_home_type;
+	')
+
+	files_search_home($1)
+	allow $1 user_home_dir_type:dir list_dir_perms;
+	allow $1 user_home_type:file unlink;
+')