Index: policy/modules/kernel/devices.fc
===================================================================
--- policy/modules/kernel/devices.fc	(revision 2539)
+++ policy/modules/kernel/devices.fc	(working copy)
@@ -28,12 +28,12 @@
 /dev/i915		-c	gen_context(system_u:object_r:dri_device_t,s0)
 /dev/irlpt[0-9]+	-c	gen_context(system_u:object_r:printer_device_t,s0)
 /dev/js.*		-c	gen_context(system_u:object_r:mouse_device_t,s0)
-/dev/kmem		-c	gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
+/dev/kmem		-c	gen_context(system_u:object_r:memory_device_t,s0)
 /dev/kmsg		-c	gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
 /dev/logibm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
 /dev/lp.*		-c	gen_context(system_u:object_r:printer_device_t,s0)
 /dev/mcelog		-c	gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
-/dev/mem		-c	gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
+/dev/mem		-c	gen_context(system_u:object_r:memory_device_t,s0)
 /dev/mice		-c	gen_context(system_u:object_r:mouse_device_t,s0)
 /dev/microcode		-c	gen_context(system_u:object_r:cpu_device_t,s0)
 /dev/midi.*		-c	gen_context(system_u:object_r:sound_device_t,s0)
Index: policy/modules/services/xwindows.te
===================================================================
--- policy/modules/services/xwindows.te	(revision 2539)
+++ policy/modules/services/xwindows.te	(working copy)
@@ -11,7 +11,7 @@
 ## Support X userspace object manager
 ## </p>
 ## </desc>
-gen_tunable(xwindows_object_manager,false)
+gen_tunable(xwindows_object_manager,true)
 
 # Domains
 attribute x_unconfined;
Index: policy/modules/services/xwindows.fc
===================================================================
--- policy/modules/services/xwindows.fc	(revision 2539)
+++ policy/modules/services/xwindows.fc	(working copy)
@@ -13,3 +13,6 @@
 /usr/libexec/gnome-settings-daemon --	gen_context(system_u:object_r:xpriv_exec_t,s0)
 
 /usr/local/bin/Xorg		--	gen_context(system_u:object_r:xserver_exec_t,s0)
+
+/usr/local/X/bin/Xorg		--	gen_context(system_u:object_r:xserver_exec_t,s0)
+/usr/local/X/var/log		--	gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
Index: policy/modules/services/xwindows.if
===================================================================
--- policy/modules/services/xwindows.if	(revision 2539)
+++ policy/modules/services/xwindows.if	(working copy)
@@ -96,16 +96,16 @@
 	typeattribute $3 xclient_type;
 
 	# Type for windows
-	tunable_policy(`xwindows_object_manager',`
+#	tunable_policy(`xwindows_object_manager',`
 		type_transition $3 x_rootwindow_t:x_drawable $3;
-	')
+#	')
 
 	# Types for properties
 	type $2_default_xproperty_t, $1_default_xproperty_type, xproperty_type;
 	role $4 types $2_default_xproperty_t;
-	tunable_policy(`xwindows_object_manager',`
+#	tunable_policy(`xwindows_object_manager',`
 		type_transition $3 default_xproperty_t:x_property $2_default_xproperty_t;
-	')
+#	')
 
 	# Types for events
 	attribute $2_xevent_type;
@@ -119,13 +119,13 @@
 	role $4 types $2_manage_xevent_t;
 	type $2_default_xevent_t, $2_xevent_type, xevent_type;
 	role $4 types $2_default_xevent_t;
-	tunable_policy(`xwindows_object_manager',`
+#	tunable_policy(`xwindows_object_manager',`
 		type_transition $3 input_xevent_t:x_event $2_input_xevent_t;
 		type_transition $3 focus_xevent_t:x_event $2_focus_xevent_t;
 		type_transition $3 property_xevent_t:x_event $2_property_xevent_t;
 		type_transition $3 manage_xevent_t:x_event $2_manage_xevent_t;
 		type_transition $3 default_xevent_t:x_event $2_default_xevent_t;
-	')
+#	')
 	type $2_client_xevent_t, $2_xevent_type, xevent_type;
 	role $4 types $2_client_xevent_t;
 
@@ -134,7 +134,7 @@
 	# Local Policy
 	#
 
-	tunable_policy(`xwindows_object_manager',`
+#	tunable_policy(`xwindows_object_manager',`
 		# Hacks
 		# everyone can get the input focus of everyone else
 		# this is a fundamental brokenness in the X protocol
@@ -225,7 +225,7 @@
 		allow $3 self:x_colormap *;
 		# can read and write own objects
 		allow $3 self:x_resource { read write };
-	')
+#	')
 ')
 
 
@@ -258,7 +258,7 @@
 	typeattribute $1 xdevice_type;
 	typeattribute $1 xresource_type;
 
-	tunable_policy(`xwindows_object_manager',`
+#	tunable_policy(`xwindows_object_manager',`
 		# Labeling rules for default windows, screens, and colormaps
 		type_transition $1 $1:x_drawable x_rootwindow_t;
 		type_transition $1 $1:x_colormap x_rootcolormap_t;
@@ -268,7 +268,7 @@
 		selinux_validate_context($1)
 		selinux_compute_access_vector($1)
 		selinux_compute_create_context($1)
-	')
+#	')
 
 	xwindows_unconfined($1)
 ')
@@ -350,6 +350,7 @@
 template(`xwindows_per_role_template',`
 	gen_require(`
 		type $1_dbusd_t;
+		type $1_xserver_t;
 	')
 
 	##############################
@@ -377,7 +378,7 @@
 	xwindows_domain_template($1,$1_xpriv,$1_xpriv_t,$3)
 	xwindows_unconfined($1_xpriv_t)
 
-	tunable_policy(`xwindows_object_manager',`
+#	tunable_policy(`xwindows_object_manager',`
 		domain_auto_trans($2,xpriv_exec_t,$1_xpriv_t)
 		domain_auto_trans($1_dbusd_t,xpriv_exec_t,$1_xpriv_t)
 
@@ -387,5 +388,26 @@
 
 		allow $2 input_xevent_t:x_event send;
 		allow $2 x_rootwindow_t:x_drawable send;
-	')
+#	')
+
+
+	# mlsdemo
+	allow $1_dbusd_t self:x_client manage;
+	allow $1_dbusd_t self:x_drawable { write read create getattr };
+	allow $1_dbusd_t self:x_gc { destroy create use setattr };
+
+	allow $1_dbusd_t $1_xserver_t:x_colormap use;
+	allow $1_dbusd_t $1_xserver_t:x_drawable { get_property setattr show receive create manage send add_child write read getattr list_child override set_property };
+	allow $1_dbusd_t $1_xserver_t:x_screen { saver_setattr saver_getattr };
+
+	allow $2 $1_dbusd_t:x_client destroy;
+	allow $2 $1_dbusd_t:x_drawable getattr;
+	allow $2 $1_xserver_t:x_colormap use;
+	allow $2 $1_xserver_t:x_drawable { get_property show read manage add_child remove_child list_child hide setattr receive create send write getattr override destroy set_property };
+
+	allow $1_xserver_t self:x_drawable send;
+
+	xwindows_unconfined($1_dbusd_t)
+	xwindows_unconfined($2)
+
 ')
Index: policy/modules/system/logging.fc
===================================================================
--- policy/modules/system/logging.fc	(revision 2539)
+++ policy/modules/system/logging.fc	(working copy)
@@ -26,6 +26,7 @@
 /var/dnscache/log/main(/.*)?	gen_context(system_u:object_r:var_log_t,s0)
 
 /var/log		-d	gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
+/usr/local/X/var/log		-d	gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
 /var/log/.*			gen_context(system_u:object_r:var_log_t,s0)
 /var/log/audit(/.*)?		gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
 
Index: build.conf
===================================================================
--- build.conf	(revision 2539)
+++ build.conf	(working copy)
@@ -12,13 +12,13 @@
 
 # Policy Type
 # standard, mls, mcs
-TYPE = standard
+TYPE = mls
 
 # Policy Name
 # If set, this will be used as the policy
 # name.  Otherwise the policy type will be
 # used for the name.
-NAME = refpolicy
+NAME = xselinux-trunk
 
 # Distribution
 # Some distributions have portions of policy
@@ -27,7 +27,7 @@
 # for the distribution.
 # redhat, gentoo, debian, suse, and rhel4 are current options.
 # Fedora users should enable redhat.
-#DISTRO = redhat
+DISTRO = redhat
 
 # Unknown Permissions Handling
 # The behavior for handling permissions defined in the
@@ -46,7 +46,7 @@
 
 # Build monolithic policy.  Putting n here
 # will build a loadable module policy.
-MONOLITHIC=y
+MONOLITHIC=n
 
 # Number of MLS Sensitivities
 # The sensitivities will be s0 to s(MLS_SENS-1).