## <summary>The unconfined domain.</summary>

########################################

## <summary>

##	Make the specified domain unconfined.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to make unconfined.

##	</summary>

## </param>

#

interface(`unconfined_domain_noaudit',`

	gen_require(`

		type unconfined_t;

		class dbus all_dbus_perms;

		class nscd all_nscd_perms;

		class passwd all_passwd_perms;

	')

	# Use any Linux capability.

	allow $1 self:capability *;

	allow $1 self:fifo_file manage_fifo_file_perms;

	# Transition to myself, to make get_ordered_context_list happy.

	allow $1 self:process transition;

	# Write access is for setting attributes under /proc/self/attr.

	allow $1 self:file rw_file_perms;

	# Userland object managers

	allow $1 self:nscd *;

	allow $1 self:dbus *;

	allow $1 self:passwd *;

	allow $1 self:association *;

	kernel_unconfined($1)

	corenet_unconfined($1)

	dev_unconfined($1)

	domain_unconfined($1)

	domain_dontaudit_read_all_domains_state($1)

	domain_dontaudit_ptrace_all_domains($1)

	files_unconfined($1)

	fs_unconfined($1)

	selinux_unconfined($1)

	tunable_policy(`allow_execheap',`

		# Allow making the stack executable via mprotect.

		allow $1 self:process execheap;

	')

	tunable_policy(`allow_execmem',`

		# Allow making anonymous memory executable, e.g. 

		# for runtime-code generation or executable stack.

		allow $1 self:process execmem;

	')

	tunable_policy(`allow_execstack',`

		# Allow making the stack executable via mprotect;

		# execstack implies execmem;

		allow $1 self:process { execstack execmem };

#		auditallow $1 self:process execstack;

	')

	optional_policy(`

		auth_unconfined($1)

	')

	optional_policy(`

		# Communicate via dbusd.

		dbus_system_bus_unconfined($1)

	')

	optional_policy(`

		ipsec_setcontext_default_spd($1)

		ipsec_match_default_spd($1)

	')

	optional_policy(`

		# this is to handle execmod on shared

		# libs with text relocations

		libs_use_shared_libs($1)

	')

	optional_policy(`

		nscd_unconfined($1)

	')

	optional_policy(`

		seutil_create_bin_policy($1)

		seutil_relabelto_bin_policy($1)

	')

	optional_policy(`

		storage_unconfined($1)

	')

')

########################################

## <summary>

##	Make the specified domain unconfined and

##	audit executable memory and executable heap

##	usage.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to make unconfined.

##	</summary>

## </param>

#

interface(`unconfined_domain',`

	unconfined_domain_noaudit($1)

	tunable_policy(`allow_execheap',`

		auditallow $1 self:process execheap;

	')

# Turn off this audit for FC5

#	tunable_policy(`allow_execmem',`

#		auditallow $1 self:process execmem;

#	')

')

########################################

## <summary>

##	Add an alias type to the unconfined domain.  (Deprecated)

## </summary>

## <desc>

##	

##	Add an alias type to the unconfined domain.  (Deprecated)

##	

##	

##	This is added to support targeted policy.  Its

##	use should be limited.  It has no effect

##	on the strict policy.

##	

## </desc>

## <param name="domain">

##	<summary>

##	New alias of the unconfined domain.

##	</summary>

## </param>

#

interface(`unconfined_alias_domain',`

	refpolicywarn(`$0($1) has been deprecated.')

')

########################################

## <summary>

##	Add an alias type to the unconfined execmem

##	program file type.  (Deprecated)

## </summary>

## <desc>

##	

##	Add an alias type to the unconfined execmem

##	program file type.  (Deprecated)

##	

##	

##	This is added to support targeted policy.  Its

##	use should be limited.  It has no effect

##	on the strict policy.

##	

## </desc>

## <param name="domain">

##	<summary>

##	New alias of the unconfined execmem program type.

##	</summary>

## </param>

#

interface(`unconfined_execmem_alias_program',`

	refpolicywarn(`$0($1) has been deprecated.')

')

########################################

## <summary>

##	Transition to the unconfined domain.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_domtrans',`

	gen_require(`

		type unconfined_t, unconfined_exec_t;

	')

	domtrans_pattern($1,unconfined_exec_t,unconfined_t)

')

########################################

## <summary>

##	Execute specified programs in the unconfined domain.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the process performing this action.

##	</summary>

## </param>

## <param name="role">

##	<summary>

##	The role to allow the unconfined domain.

##	</summary>

## </param>

## <param name="terminal">

##	<summary>

##	The type of the terminal allow the unconfined domain to use.

##	</summary>

## </param>

#

interface(`unconfined_run',`

	gen_require(`

		type unconfined_t;

	')

	unconfined_domtrans($1)

	role $2 types unconfined_t;

	allow unconfined_t $3:chr_file rw_term_perms;

')

########################################

## <summary>

##	Transition to the unconfined domain by executing a shell.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_shell_domtrans',`

	gen_require(`

		type unconfined_t;

	')

	corecmd_shell_domtrans($1,unconfined_t)

	allow unconfined_t $1:fd use;

	allow unconfined_t $1:fifo_file rw_file_perms;

	allow unconfined_t $1:process sigchld;

')

########################################

## <summary>

##	Allow unconfined to execute the specified program in

##	the specified domain.

## </summary>

## <desc>

##	

##	Allow unconfined to execute the specified program in

##	the specified domain.

##	

##	

##	This is a interface to support third party modules

##	and its use is not allowed in upstream reference

##	policy.

##	

## </desc>

## <param name="domain">

##	<summary>

##	Domain to execute in.

##	</summary>

## </param>

## <param name="entry_file">

##	<summary>

##	Domain entry point file.

##	</summary>

## </param>

#

interface(`unconfined_domtrans_to',`

	gen_require(`

		type unconfined_t;

	')

	domtrans_pattern(unconfined_t,$2,$1)

')

########################################

## <summary>

##	Allow unconfined to execute the specified program in

##	the specified domain.  Allow the specified domain the

##	unconfined role and use of unconfined user terminals.

## </summary>

## <desc>

##	

##	Allow unconfined to execute the specified program in

##	the specified domain.  Allow the specified domain the

##	unconfined role and use of unconfined user terminals.

##	

##	

##	This is a interface to support third party modules

##	and its use is not allowed in upstream reference

##	policy.

##	

## </desc>

## <param name="domain">

##	<summary>

##	Domain to execute in.

##	</summary>

## </param>

## <param name="entry_file">

##	<summary>

##	Domain entry point file.

##	</summary>

## </param>

#

interface(`unconfined_run_to',`

	gen_require(`

		type unconfined_t, unconfined_devpts_t, unconfined_tty_device_t;

		role unconfined_r;

	')

	domtrans_pattern(unconfined_t,$2,$1)

	role unconfined_r types $1;

	allow $1 { unconfined_devpts_t unconfined_tty_device_t }:chr_file rw_term_perms;

')

########################################

## <summary>

##	Inherit file descriptors from the unconfined domain.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_use_fds',`

	gen_require(`

		type unconfined_t;

	')

	allow $1 unconfined_t:fd use;

')

########################################

## <summary>

##	Send a SIGCHLD signal to the unconfined domain.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_sigchld',`

	gen_require(`

		type unconfined_t;

	')

	allow $1 unconfined_t:process sigchld;

')

########################################

## <summary>

##	Send a SIGNULL signal to the unconfined domain.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_signull',`

	gen_require(`

		type unconfined_t;

	')

	allow $1 unconfined_t:process signull;

')

########################################

## <summary>

##	Send generic signals to the unconfined domain.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_signal',`

	gen_require(`

		type unconfined_t;

	')

	allow $1 unconfined_t:process signal;

')

########################################

## <summary>

##	Read unconfined domain unnamed pipes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_read_pipes',`

	gen_require(`

		type unconfined_t;

	')

	allow $1 unconfined_t:fifo_file read_fifo_file_perms;

')

########################################

## <summary>

##	Do not audit attempts to read unconfined domain unnamed pipes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_dontaudit_read_pipes',`

	gen_require(`

		type unconfined_t;

	')

	dontaudit $1 unconfined_t:fifo_file read;

')

########################################

## <summary>

##	Read and write unconfined domain unnamed pipes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_rw_pipes',`

	gen_require(`

		type unconfined_t;

	')

	allow $1 unconfined_t:fifo_file rw_fifo_file_perms;

')

########################################

## <summary>

##	Do not audit attempts to read and write

##	unconfined domain unnamed pipes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`unconfined_dontaudit_rw_pipes',`

	gen_require(`

		type unconfined_t;

	')

	dontaudit $1 unconfined_t:fifo_file rw_file_perms;

')

########################################

## <summary>

##	Connect to the unconfined domain using

##	a unix domain stream socket.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_stream_connect',`

	gen_require(`

		type unconfined_t;

	')

	allow $1 unconfined_t:unix_stream_socket connectto;

')

########################################

## <summary>

##	Do not audit attempts to read or write

##	unconfined domain tcp sockets.

## </summary>

## <desc>

##	

##	Do not audit attempts to read or write

##	unconfined domain tcp sockets.

##	

##	

##	This interface was added due to a broken

##	symptom in ldconfig.

##	

## </desc>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`unconfined_dontaudit_rw_tcp_sockets',`

	gen_require(`

		type unconfined_t;

	')

	dontaudit $1 unconfined_t:tcp_socket { read write };

')

########################################

## <summary>

##	Create keys for the unconfined domain.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_create_keys',`

	gen_require(`

		type unconfined_t;

	')

	allow $1 unconfined_t:key create;

')

########################################

## <summary>

##	Send messages to the unconfined domain over dbus.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_dbus_send',`

	gen_require(`

		type unconfined_t;

		class dbus send_msg;

	')

	allow $1 unconfined_t:dbus send_msg;

')

########################################

## <summary>

##	Send and receive messages from

##	unconfined_t over dbus.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_dbus_chat',`

	gen_require(`

		type unconfined_t;

		class dbus send_msg;

	')

	allow $1 unconfined_t:dbus send_msg;

	allow unconfined_t $1:dbus send_msg;

')

########################################

## <summary>

##	Connect to the the unconfined DBUS

##	for service (acquire_svc).

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_dbus_connect',`

	gen_require(`

		type unconfined_t;

		class dbus acquire_svc;

	')

	allow $1 unconfined_t:dbus acquire_svc;

')

########################################

## <summary>

##	Read files in unconfined users home directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_read_home_content_files',`

	gen_require(`

		type unconfined_home_dir_t, unconfined_home_t;

	')

	files_search_home($1)

	allow $1 { unconfined_home_dir_t unconfined_home_t }:dir list_dir_perms;

	read_files_pattern($1, { unconfined_home_dir_t unconfined_home_t }, unconfined_home_t)

	read_lnk_files_pattern($1, { unconfined_home_dir_t unconfined_home_t }, unconfined_home_t)

')

########################################

## <summary>

##	Read unconfined users temporary files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_read_tmp_files',`

	gen_require(`

		type unconfined_tmp_t;

	')

	files_search_tmp($1)

	allow $1 unconfined_tmp_t:dir list_dir_perms;

	read_files_pattern($1, unconfined_tmp_t, unconfined_tmp_t)

	read_lnk_files_pattern($1, unconfined_tmp_t, unconfined_tmp_t)

')

########################################

## <summary>

##	Write unconfined users temporary files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`unconfined_write_tmp_files',`

	gen_require(`

		type unconfined_tmp_t;

	')

	allow $1 unconfined_tmp_t:file { getattr write append };

')