policy_module(secadm, 2.1.0)

########################################

#

# Declarations

#

role secadm_r;

userdom_unpriv_user_template(secadm)

userdom_security_admin_template(secadm_t, secadm_r)

userdom_inherit_append_admin_home_files(secadm_t)

userdom_read_admin_home_files(secadm_t)

########################################

#

# Local policy

#

allow secadm_t self:capability { dac_read_search dac_override };

corecmd_exec_shell(secadm_t)

dev_relabel_all_dev_nodes(secadm_t)

domain_obj_id_change_exemption(secadm_t)

mls_process_read_up(secadm_t)

mls_file_read_all_levels(secadm_t)

mls_file_write_all_levels(secadm_t)

mls_file_upgrade(secadm_t)

mls_file_downgrade(secadm_t)

auth_role(secadm_r, secadm_t)

auth_relabel_all_files_except_shadow(secadm_t)

auth_relabel_shadow(secadm_t)

init_exec(secadm_t)

logging_read_audit_log(secadm_t)

logging_read_generic_logs(secadm_t)

logging_read_audit_config(secadm_t)

optional_policy(`

	aide_run(secadm_t, secadm_r)

')

optional_policy(`

	auditadm_role_change(secadm_r)

')

optional_policy(`

	dmesg_exec(secadm_t)

')

optional_policy(`

	netlabel_run_mgmt(secadm_t, secadm_r)

')

optional_policy(`

	screen_role_template(secadm, secadm_r, secadm_t)

')

optional_policy(`

	su_role_template(secadm, secadm_r, secadm_t)

')

optional_policy(`

	sudo_role_template(secadm, secadm_r, secadm_t)

')

optional_policy(`

	sysadm_role_change(secadm_r)

')