diff --git a/hal/.footprint b/hal/.footprint
index 63607d7d0..cb3e063c4 100644
--- a/hal/.footprint
+++ b/hal/.footprint
@@ -1,6 +1,9 @@
 drwxr-xr-x	root/root	etc/
 drwxr-xr-x	root/root	etc/rc.d/
 -rwxr-xr-x	root/root	etc/rc.d/hald
+drwxr-xr-x	root/root	etc/udev/
+drwxr-xr-x	root/root	etc/udev/rules.d/
+-rw-r--r--	root/root	etc/udev/rules.d/90-hal.rules
 drwxr-xr-x	root/root	usr/
 drwxr-xr-x	root/root	usr/bin/
 -rwxr-xr-x	root/root	usr/bin/hal-device
diff --git a/hal/.md5sum b/hal/.md5sum
index 9c6c86fbb..833ea0b74 100644
--- a/hal/.md5sum
+++ b/hal/.md5sum
@@ -1,3 +1,4 @@
 1fa646b45e845031f09515731dba40c7  hal-0.5.7.1-dbus-close.patch
 d7a7741808ba130f8aff3f5d3b5689e4  hal-0.5.7.1.tar.gz
+83d11240bd696260a2da058bd3b71bb2  hal.conf
 cc3d04e7ac09e15f33c530725f43e641  rc.hald
diff --git a/hal/Pkgfile b/hal/Pkgfile
index 368f1255f..e1195c386 100644
--- a/hal/Pkgfile
+++ b/hal/Pkgfile
@@ -5,9 +5,9 @@
 
 name=hal
 version=0.5.7.1
-release=2
+release=3
 source=(http://freedesktop.org/~david/dist/$name-$version.tar.gz \
-	rc.hald $name-$version-dbus-close.patch)
+	rc.hald $name-$version-dbus-close.patch hal.conf)
 
 build() {
 	cd $name-$version
@@ -27,4 +27,8 @@ build() {
 	install -D -o root -g root -m 0755 $SRC/rc.hald \
 		$PKG/etc/rc.d/hald
 	rm -rf $PKG/usr/share/{doc,locale}
+	install -D -m 0644 -o root -g root tools/linux/90-hal.rules \
+		$PKG/etc/udev/rules.d/90-hal.rules
+	install -m 0644 -o root -g root $SRC/hal.conf \
+		$PKG/usr/etc/dbus-1/system.d/
 }
diff --git a/hal/README b/hal/README
index bdaade636..f5cd090cb 100644
--- a/hal/README
+++ b/hal/README
@@ -9,4 +9,10 @@ PRE/POST-INSTALL
 	'useradd -n -u 82 -g haldaemon -d /var/empty -s /bin/false haldaemon'
 	'passwd -l haldaemon'
 
+	If you wish to take advantage of the hotplug and automount-style features
+	that apps like gnome-mount, gnome-volume-manager, or the like offer, create
+	a 'plugdev' group and add your user to it, or change the 'plugdev' group in
+	/usr/etc/dbus-1/system.d/hal.conf to something else and make sure your user
+	is a member of that group.
+
 PRECAUTION
diff --git a/hal/hal.conf b/hal/hal.conf
new file mode 100644
index 000000000..1a45cc263
--- /dev/null
+++ b/hal/hal.conf
@@ -0,0 +1,44 @@
+<!DOCTYPE busconfig PUBLIC
+ "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+
+  <!-- This configuration file specifies the required security policies
+       for the HAL to work. -->
+
+  <!-- Only root or user haldaemon can own the HAL service -->
+  <policy user="haldaemon">
+    <allow own="org.freedesktop.Hal"/>
+  </policy>
+  <policy user="root">
+    <allow own="org.freedesktop.Hal"/>
+  </policy>
+
+  <!-- Allow anyone to invoke methods on the Manager and Device interfaces -->
+  <policy context="default">
+    <allow send_interface="org.freedesktop.Hal.Manager"/>
+    <allow send_interface="org.freedesktop.Hal.Device"/>
+
+    <allow receive_interface="org.freedesktop.Hal.Manager"
+           receive_sender="org.freedesktop.Hal"/>
+    <allow receive_interface="org.freedesktop.Hal.Device"
+           receive_sender="org.freedesktop.Hal"/>
+  </policy>
+
+  <!-- Default policy for the exported interfaces -->
+  <policy context="default">
+    <deny send_interface="org.freedesktop.Hal.Device.SystemPowerManagement"/>
+    <deny send_interface="org.freedesktop.Hal.Device.LaptopPanel"/>
+    <deny send_interface="org.freedesktop.Hal.Device.Volume"/>
+    <deny send_interface="org.freedesktop.Hal.Device.Volume.Crypto"/>
+  </policy>
+
+  <!-- You can change this to a more suitable user, or make per-group -->
+  <policy group="plugdev">
+    <allow send_interface="org.freedesktop.Hal.Device.SystemPowerManagement"/>
+    <allow send_interface="org.freedesktop.Hal.Device.LaptopPanel"/>
+    <allow send_interface="org.freedesktop.Hal.Device.Volume"/>
+    <allow send_interface="org.freedesktop.Hal.Device.Volume.Crypto"/>
+  </policy>
+
+</busconfig>