diff --git a/policy/modules/contrib/screen.fc b/policy/modules/contrib/screen.fc
index 661fcc0791..14e7b3c3fa 100644
--- a/policy/modules/contrib/screen.fc
+++ b/policy/modules/contrib/screen.fc
@@ -2,6 +2,9 @@ HOME_DIR/\.screen(/.*)? gen_context(system_u:object_r:screen_home_t,s0)
HOME_DIR/\.screenrc -- gen_context(system_u:object_r:screen_home_t,s0)
HOME_DIR/\.tmux\.conf -- gen_context(system_u:object_r:screen_home_t,s0)
+/root/\.screenrc -- gen_context(system_u:object_r:screen_home_t,s0)
+/root/\.tmux\.conf -- gen_context(system_u:object_r:screen_home_t,s0)
+
/root/\.screen(/.*)? gen_context(system_u:object_r:screen_home_t,s0)
/usr/bin/screen -- gen_context(system_u:object_r:screen_exec_t,s0)
diff --git a/policy/modules/contrib/screen.if b/policy/modules/contrib/screen.if
index 57cc45e211..fb5bb83473 100644
--- a/policy/modules/contrib/screen.if
+++ b/policy/modules/contrib/screen.if
@@ -48,7 +48,7 @@ template(`screen_role_template',`
domtrans_pattern($3, screen_exec_t, $1_screen_t)
allow $3 $1_screen_t:process { signal sigchld };
- dontaudit $3 $1_screen_t:unix_stream_socket { ioctl read write };
+ allow $3 $1_screen_t:unix_stream_socket { ioctl read write };
allow $1_screen_t $3:unix_stream_socket { connectto };
allow $1_screen_t $3:process signal;
allow $3 screen_exec_t:file entrypoint;
@@ -99,6 +99,35 @@ template(`screen_role_template',`
')
')
+#######################################
+##
+## The admin role template for the screen module
+##
+##
+##
+## The prefix of the user role (e.g., user
+## is the prefix for user_r).
+##
+##
+##
+##
+## The role associated with the user domain.
+##
+##
+##
+##
+## The type of the user domain.
+##
+##
+#
+template(`screen_admin_role_template',`
+ screen_role_template($1, $2, $3)
+
+ userdom_admin_home_dir_filetrans($1_screen_t, screen_home_t, file, ".screenrc")
+ userdom_admin_home_dir_filetrans($1_screen_t, screen_home_t, file, ".tmux.conf")
+')
+
+
#######################################
##
## Execute the rssh program
diff --git a/policy/modules/roles/auditadm.te b/policy/modules/roles/auditadm.te
index 404a5c6770..5375a5f0f3 100644
--- a/policy/modules/roles/auditadm.te
+++ b/policy/modules/roles/auditadm.te
@@ -48,7 +48,7 @@ optional_policy(`
')
optional_policy(`
- screen_role_template(auditadm, auditadm_r, auditadm_t)
+ screen_admin_role_template(auditadm, auditadm_r, auditadm_t)
')
optional_policy(`
diff --git a/policy/modules/roles/secadm.te b/policy/modules/roles/secadm.te
index 782a09758c..55868cf9b4 100644
--- a/policy/modules/roles/secadm.te
+++ b/policy/modules/roles/secadm.te
@@ -63,7 +63,7 @@ optional_policy(`
')
optional_policy(`
- screen_role_template(secadm, secadm_r, secadm_t)
+ screen_admin_role_template(secadm, secadm_r, secadm_t)
')
optional_policy(`
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index ea5bf7ae7a..f7afd1be4c 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -561,7 +561,7 @@ optional_policy(`
')
optional_policy(`
- screen_role_template(sysadm, sysadm_r, sysadm_t)
+ screen_admin_role_template(sysadm, sysadm_r, sysadm_t)
allow sysadm_screen_t self:capability { dac_read_search dac_override chown };
')