diff --git a/roles/collectd/base/files/selinux/fi-collectd.mod b/roles/collectd/base/files/selinux/fi-collectd.mod
index f7115c0073..4af2e74cda 100644
Binary files a/roles/collectd/base/files/selinux/fi-collectd.mod and b/roles/collectd/base/files/selinux/fi-collectd.mod differ
diff --git a/roles/collectd/base/files/selinux/fi-collectd.pp b/roles/collectd/base/files/selinux/fi-collectd.pp
index ad2e044dc2..5622184753 100644
Binary files a/roles/collectd/base/files/selinux/fi-collectd.pp and b/roles/collectd/base/files/selinux/fi-collectd.pp differ
diff --git a/roles/collectd/base/files/selinux/fi-collectd.te b/roles/collectd/base/files/selinux/fi-collectd.te
index cce9f1e52d..d00778c309 100644
--- a/roles/collectd/base/files/selinux/fi-collectd.te
+++ b/roles/collectd/base/files/selinux/fi-collectd.te
@@ -1,5 +1,5 @@
 
-module fi-collectd 1.8;
+module fi-collectd 1.9.1;
 
 require {
     type shell_exec_t;
@@ -11,14 +11,14 @@ require {
 	class sock_file { read write getattr };
 	class unix_stream_socket connectto;
 	class capability { setuid dac_read_search sys_ptrace setgid dac_override };
-	class file { read execute execute_no_trans };
+	class file { read getattr open execute execute_no_trans };
 	class dir getattr;
 }
 
 #============= collectd_t ==============
-allow collectd_t bin_t:file { execute execute_no_trans };
+allow collectd_t bin_t:file { read getattr open execute execute_no_trans };
 allow collectd_t configfs_t:dir getattr;
 allow collectd_t init_t:unix_stream_socket connectto;
 allow collectd_t self:capability { setuid dac_read_search sys_ptrace setgid dac_override };
 allow collectd_t var_run_t:sock_file { read write getattr };
-allow collectd_t shell_exec_t:file execute;
+allow collectd_t shell_exec_t:file { read open execute };