Index: policy/flask/security_classes
===================================================================
--- policy/flask/security_classes	(revision 1890)
+++ policy/flask/security_classes	(working copy)
@@ -90,4 +90,7 @@
 
 class packet
 
+# Kernel access key retention
+class key
+
 # FLASK
Index: policy/flask/access_vectors
===================================================================
--- policy/flask/access_vectors	(revision 1890)
+++ policy/flask/access_vectors	(working copy)
@@ -252,6 +252,7 @@
 	execmem
 	execstack
 	execheap
+	setkeycreate
 }
 
 
@@ -617,3 +618,14 @@
 	recv
 	relabelto
 }
+
+class key
+{
+	view
+	read
+	write
+	search
+	link
+	setattr
+	create
+}
Index: policy/modules/services/xserver.te
===================================================================
--- policy/modules/services/xserver.te	(revision 1890)
+++ policy/modules/services/xserver.te	(working copy)
@@ -80,7 +80,7 @@
 #
 
 allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service };
-allow xdm_t self:process { setexec setpgid setsched setrlimit signal_perms };
+allow xdm_t self:process { setexec setpgid setsched setrlimit signal_perms setkeycreate };
 allow xdm_t self:fifo_file rw_file_perms;
 allow xdm_t self:shm create_shm_perms;
 allow xdm_t self:sem create_sem_perms;
@@ -214,6 +214,7 @@
 
 userdom_dontaudit_use_unpriv_user_fds(xdm_t)
 userdom_dontaudit_search_sysadm_home_dirs(xdm_t)
+userdom_create_all_users_keys(xdm_t)
 # for .dmrc
 userdom_read_unpriv_users_home_content_files(xdm_t)
 # Search /proc for any user domain processes.
Index: policy/modules/system/locallogin.te
===================================================================
--- policy/modules/system/locallogin.te	(revision 1890)
+++ policy/modules/system/locallogin.te	(working copy)
@@ -169,6 +169,7 @@
 userdom_search_all_users_home_content(local_login_t)
 userdom_use_unpriv_users_fds(local_login_t)
 userdom_sigchld_all_users(local_login_t)
+userdom_create_all_users_keys(local_login_t)
 
 # Search for mail spool file.
 mta_getattr_spool(local_login_t)
Index: policy/modules/system/userdomain.if
===================================================================
--- policy/modules/system/userdomain.if	(revision 1890)
+++ policy/modules/system/userdomain.if	(working copy)
@@ -4732,6 +4732,28 @@
 
 ########################################
 ## <summary>
+##	Create keys for all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_create_all_users_keys',`
+	ifdef(`strict_policy',`
+		gen_require(`
+			attribute userdomain;
+		')
+
+		allow $1 userdomain:key create;
+	',`
+		unconfined_create_keys($1)
+	')
+')
+
+########################################
+## <summary>
 ##	Send a dbus message to all user domains.
 ## </summary>
 ## <param name="domain">
Index: policy/modules/system/unconfined.if
===================================================================
--- policy/modules/system/unconfined.if	(revision 1890)
+++ policy/modules/system/unconfined.if	(working copy)
@@ -360,6 +360,24 @@
 
 ########################################
 ## <summary>
+##	Create keys for the unconfined domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unconfined_create_keys',`
+	gen_require(`
+		type unconfined_t;
+	')
+
+	allow $1 unconfined_t:key create;
+')
+
+########################################
+## <summary>
 ##	Send messages to the unconfined domain over dbus.
 ## </summary>
 ## <param name="domain">