#DESC Unconfined - The unconfined domain

# This is the initial domain, and is used for everything that

# is not explicitly confined.  It has no restrictions.

# It needs to be carefully protected from the confined domains.

type unconfined_t, domain, privuser, privhome, privrole, privowner, admin, auth_write, fs_domain, privmem;

role system_r types unconfined_t;

role user_r types unconfined_t;

unconfined_domain(unconfined_t)

allow domain unconfined_t:fd use;

allow domain unconfined_t:process sigchld;

# Define some type aliases to help with compatibility with

# macros and domains from the "strict" policy.

typealias unconfined_t alias { logrotate_t sendmail_t sshd_t secadm_t sysadm_t rpm_t rpm_script_t xdm_t };

typeattribute tty_device_t admin_tty_type;

typeattribute devpts_t admin_tty_type;

# User home directory type.

type user_home_t, file_type, sysadmfile, home_type;

type user_home_dir_t, file_type, sysadmfile, home_dir_type;

file_type_auto_trans(unconfined_t, home_root_t, user_home_dir_t, dir)

allow privhome home_root_t:dir { getattr search };

file_type_auto_trans(privhome, user_home_dir_t, user_home_t)

define(`user_typealias', `

ifelse($1,`user',`',`

typealias user_home_t alias $1_home_t;

typealias user_home_dir_t alias $1_home_dir_t;

')

typealias tty_device_t alias $1_tty_device_t;

typealias devpts_t alias $1_devpts_t;

')

user_typealias(sysadm)

user_typealias(staff)

user_typealias(user)

attribute user_file_type;

attribute staff_file_type;

attribute sysadm_file_type;

allow unconfined_t unlabeled_t:filesystem *;

allow unconfined_t self:system syslog_read;

allow unlabeled_t self:filesystem associate;

# Support NFS home directories

bool use_nfs_home_dirs false;

# Allow making anonymous memory executable, e.g. 

# for runtime-code generation or executable stack.

bool allow_execmem true;

# Allow making the stack executable via mprotect.

# Also requires allow_execmem.

bool allow_execstack true;

# Allow making a modified private file mapping executable (text relocation).

bool allow_execmod true;

# Support SAMBA home directories

bool use_samba_home_dirs false;

ifdef(`samba.te', `samba_domain(user)')

ifdef(`i18n_input.te', `i18n_input_domain(user)')

# Allow system to run with NIS

bool allow_ypbind false;

# Allow system to run with Kerberos

bool allow_kerberos false;

# allow reading of default file context

bool read_default_t true;

if (allow_execmem) {

allow domain self:process execmem;

}

#Removing i18n_input from targeted for now, since wants to read users homedirs

typealias bin_t alias i18n_input_exec_t;

typealias unconfined_t alias i18n_input_t;

typealias var_run_t alias i18n_input_var_run_t;

ifdef(`su.te', `

typealias unconfined_t alias { sysadm_chkpwd_t };

typealias tmp_t alias { sysadm_tmp_t sshd_tmp_t };

su_domain(sysadm)

typeattribute sysadm_su_t unconfinedtrans;

role system_r types sysadm_su_t;

')