diff --git a/policy/modules/admin/dpkg.te b/policy/modules/admin/dpkg.te
index 33a7014756..ddd565de2f 100644
--- a/policy/modules/admin/dpkg.te
+++ b/policy/modules/admin/dpkg.te
@@ -286,7 +286,7 @@ term_use_all_terms(dpkg_script_t)
 
 files_manage_non_auth_files(dpkg_script_t)
 
-auth_etc_filetrans_shadow(dpkg_script_t, "shadow.upwd-write")
+auth_etc_filetrans_shadow(dpkg_script_t)
 auth_manage_shadow(dpkg_script_t)
 
 init_all_labeled_script_domtrans(dpkg_script_t)
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
index 35e6e7c2f8..523ba84725 100644
--- a/policy/modules/system/authlogin.if
+++ b/policy/modules/system/authlogin.if
@@ -732,18 +732,22 @@ interface(`auth_manage_shadow',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
-## <param name="name" optional="true">
-##	<summary>
-##	The name of the object being created.
-##	</summary>
-## </param>
 #
 interface(`auth_etc_filetrans_shadow',`
 	gen_require(`
 		type shadow_t;
 	')
 
-	files_etc_filetrans($1, shadow_t, file, $2)
+	ifelse(`$2',`',`
+		files_etc_filetrans($1, shadow_t, file, "shadow")
+		files_etc_filetrans($1, shadow_t, file, "shadow-")
+		files_etc_filetrans($1, shadow_t, file, "shadow.upwd-write")
+		files_etc_filetrans($1, shadow_t, file, "gshadow")
+		files_etc_filetrans($1, shadow_t, file, "gshadow-")
+	',`
+		refpolicywarn(`$0($*) second parameter is deprecated.')
+		files_etc_filetrans($1, shadow_t, file, $2)
+	')
 ')
 
 ########################################
@@ -862,7 +866,10 @@ interface(`auth_rw_shadow_lock',`
 		type shadow_lock_t;
 	')
 
-	rw_files_pattern($1, shadow_lock_t, shadow_lock_t)
+	allow $1 shadow_lock_t:file rw_file_perms;
+	files_etc_filetrans($1, shadow_lock_t, file, ".pwd.lock")
+	files_etc_filetrans($1, shadow_lock_t, file, "passwd.lock")
+	files_etc_filetrans($1, shadow_lock_t, file, "group.lock")
 ')
 
 ########################################
diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
index 7587fd4b50..941a98720c 100644
--- a/policy/modules/system/authlogin.te
+++ b/policy/modules/system/authlogin.te
@@ -412,6 +412,7 @@ term_dontaudit_use_console(updpwd_t)
 term_dontaudit_use_unallocated_ttys(updpwd_t)
 
 auth_manage_shadow(updpwd_t)
+auth_etc_filetrans_shadow(updpwd_t)
 auth_use_nsswitch(updpwd_t)
 
 logging_send_syslog_msg(updpwd_t)