policy_module(unconfined, 3.0.0)

########################################

#

# Declarations

#

# usage in this module of types created by these

# calls is not correct, however we dont currently

# have another method to add access to these types

userdom_base_user_template(unconfined)

userdom_manage_home_role(unconfined_r, unconfined_t)

userdom_manage_tmp_role(unconfined_r, unconfined_t)

userdom_manage_tmpfs_role(unconfined_r, unconfined_t)

type unconfined_exec_t;

init_system_domain(unconfined_t, unconfined_exec_t)

type unconfined_execmem_t;

type unconfined_execmem_exec_t;

init_system_domain(unconfined_execmem_t, unconfined_execmem_exec_t)

role unconfined_r types unconfined_execmem_t;

########################################

#

# Local policy

#

domtrans_pattern(unconfined_t, unconfined_execmem_exec_t, unconfined_execmem_t)

files_create_boot_flag(unconfined_t)

mcs_killall(unconfined_t)

mcs_ptrace_all(unconfined_t)

init_run_daemon(unconfined_t, unconfined_r)

libs_run_ldconfig(unconfined_t, unconfined_r)

logging_send_syslog_msg(unconfined_t)

logging_run_auditctl(unconfined_t, unconfined_r)

mount_run_unconfined(unconfined_t, unconfined_r)

seutil_run_setfiles(unconfined_t, unconfined_r)

seutil_run_semanage(unconfined_t, unconfined_r)

unconfined_domain(unconfined_t)

userdom_user_home_dir_filetrans_user_home_content(unconfined_t, { dir file lnk_file fifo_file sock_file })

ifdef(`distro_gentoo',`

	seutil_run_runinit(unconfined_t, unconfined_r)

	seutil_init_script_run_runinit(unconfined_t, unconfined_r)

')

optional_policy(`

	ada_domtrans(unconfined_t)

')

optional_policy(`

	apache_run_helper(unconfined_t, unconfined_r)

	apache_role(unconfined_r, unconfined_t)

')

optional_policy(`

	bind_run_ndc(unconfined_t, unconfined_r)

')

optional_policy(`

	bootloader_run(unconfined_t, unconfined_r)

')

optional_policy(`

	cron_unconfined_role(unconfined_r, unconfined_t)

')

optional_policy(`

	init_dbus_chat_script(unconfined_t)

	dbus_stub(unconfined_t)

	optional_policy(`

		avahi_dbus_chat(unconfined_t)

	')

	optional_policy(`

		bluetooth_dbus_chat(unconfined_t)

	')

	optional_policy(`

		consolekit_dbus_chat(unconfined_t)

	')

	optional_policy(`

		cups_dbus_chat_config(unconfined_t)

	')

	optional_policy(`

		hal_dbus_chat(unconfined_t)

	')

	optional_policy(`

		networkmanager_dbus_chat(unconfined_t)

	')

	optional_policy(`

		oddjob_dbus_chat(unconfined_t)

	')

')

optional_policy(`

	firstboot_run(unconfined_t, unconfined_r)

')

optional_policy(`

	ftp_run_ftpdctl(unconfined_t, unconfined_r)

')

optional_policy(`

	inn_domtrans(unconfined_t)

')

optional_policy(`

	java_domtrans_unconfined(unconfined_t)

')

optional_policy(`

	lpd_run_checkpc(unconfined_t, unconfined_r)

')

optional_policy(`

	modutils_run_update_mods(unconfined_t, unconfined_r)

')

optional_policy(`

	mono_domtrans(unconfined_t)

')

optional_policy(`

	mta_role(unconfined_r, unconfined_t)

')

optional_policy(`

	oddjob_domtrans_mkhomedir(unconfined_t)

')

optional_policy(`

	prelink_run(unconfined_t, unconfined_r)

')

optional_policy(`

	portmap_run_helper(unconfined_t, unconfined_r)

')

optional_policy(`

	postfix_run_map(unconfined_t, unconfined_r)

	# cjp: this should probably be removed:

	postfix_domtrans_master(unconfined_t)

')

optional_policy(`

	pyzor_role(unconfined_r, unconfined_t)

')

optional_policy(`

	# cjp: this should probably be removed:

	rpc_domtrans_nfsd(unconfined_t)

')

optional_policy(`

	rpm_run(unconfined_t, unconfined_r)

')

optional_policy(`

	samba_run_net(unconfined_t, unconfined_r)

	samba_run_winbind_helper(unconfined_t, unconfined_r)

')

optional_policy(`

	spamassassin_role(unconfined_r, unconfined_t)

')

optional_policy(`

	sysnet_run_dhcpc(unconfined_t, unconfined_r)

	sysnet_dbus_chat_dhcpc(unconfined_t)

')

optional_policy(`

	tzdata_run(unconfined_t, unconfined_r)

')

optional_policy(`

	usermanage_run_admin_passwd(unconfined_t, unconfined_r)

')

optional_policy(`

	vpn_run(unconfined_t, unconfined_r)

')

optional_policy(`

	webalizer_run(unconfined_t, unconfined_r)

')

optional_policy(`

	wine_domtrans(unconfined_t)

')

optional_policy(`

	xserver_domtrans(unconfined_t)

')

########################################

#

# Unconfined Execmem Local policy

#

allow unconfined_execmem_t self:process { execstack execmem };

unconfined_domain_noaudit(unconfined_execmem_t)

optional_policy(`

	dbus_stub(unconfined_execmem_t)

	init_dbus_chat_script(unconfined_execmem_t)

	unconfined_dbus_chat(unconfined_execmem_t)

	optional_policy(`

		hal_dbus_chat(unconfined_execmem_t)

	')

')