policy_module(unconfined,1.0)

########################################
#
# Declarations
#

# real declaration moved to mls until
# range_transition works in loadable modules
gen_require(`
	type unconfined_t;
')
type unconfined_exec_t;
init_system_domain(unconfined_t,unconfined_exec_t)
role system_r types unconfined_t;

########################################
#
# Local policy
#

unconfined_domain_template(unconfined_t)

logging_send_syslog_msg(unconfined_t)

ifdef(`targeted_policy',`
	allow unconfined_t self:system syslog_read;

	# Define some type aliases to help with compatibility with
	# macros and domains from the "strict" policy.
	typealias unconfined_t alias { secadm_t sysadm_t };

	init_domtrans_script(unconfined_t)

	userdom_unconfined(unconfined_t)

	optional_policy(`su.te',`
		su_per_userdomain_template(sysadm,unconfined_t,system_r)
	')

	ifdef(`TODO',`
	ifdef(`samba.te', `samba_domain(user)')

	ifdef(`use_mcs',`
	domain_auto_trans(unconfined_t, su_exec_t, sysadm_su_t)
	can_exec(sysadm_su_t, bin_t)
	rw_dir_create_file(sysadm_su_t, home_dir_type)
	')

	') dnl end TODO
')