## <summary>Unconfiend user role</summary>

########################################
## <summary>
##	Change from the unconfineduser role.
## </summary>
## <desc>
##	<p>
##	Change from the unconfineduser role to
##	the specified role.
##	</p>
##	<p>
##	This is an interface to support third party modules
##	and its use is not allowed in upstream reference
##	policy.
##	</p>
## </desc>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`unconfined_role_change_to',`
	gen_require(`
		role unconfined_r;
	')

	allow unconfined_r $1;
')

########################################
## <summary>
##	Transition to the unconfined domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_domtrans',`
	gen_require(`
		type unconfined_t, unconfined_exec_t;
	')

	domtrans_pattern($1,unconfined_exec_t,unconfined_t)
')

########################################
## <summary>
##	Execute specified programs in the unconfined domain.
## </summary>
## <param name="domain">
##	<summary>
##	The type of the process performing this action.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to allow the unconfined domain.
##	</summary>
## </param>
#
interface(`unconfined_run',`
	gen_require(`
		type unconfined_t;
	')

	unconfined_domtrans($1)
	role $2 types unconfined_t;
')

########################################
## <summary>
##	Transition to the unconfined domain by executing a shell.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_shell_domtrans',`
	gen_require(`
		attribute unconfined_login_domain;
	')
	typeattribute $1 unconfined_login_domain;
')

########################################
## <summary>
##	Allow unconfined to execute the specified program in
##	the specified domain.
## </summary>
## <desc>
##	<p>
##	Allow unconfined to execute the specified program in
##	the specified domain.
##	</p>
##	<p>
##	This is a interface to support third party modules
##	and its use is not allowed in upstream reference
##	policy.
##	</p>
## </desc>
## <param name="domain">
##	<summary>
##	Domain to execute in.
##	</summary>
## </param>
## <param name="entry_file">
##	<summary>
##	Domain entry point file.
##	</summary>
## </param>
#
interface(`unconfined_domtrans_to',`
	gen_require(`
		type unconfined_t;
	')

	domtrans_pattern(unconfined_t,$2,$1)
')

########################################
## <summary>
##	Allow unconfined to execute the specified program in
##	the specified domain.  Allow the specified domain the
##	unconfined role and use of unconfined user terminals.
## </summary>
## <desc>
##	<p>
##	Allow unconfined to execute the specified program in
##	the specified domain.  Allow the specified domain the
##	unconfined role and use of unconfined user terminals.
##	</p>
##	<p>
##	This is a interface to support third party modules
##	and its use is not allowed in upstream reference
##	policy.
##	</p>
## </desc>
## <param name="domain">
##	<summary>
##	Domain to execute in.
##	</summary>
## </param>
## <param name="entry_file">
##	<summary>
##	Domain entry point file.
##	</summary>
## </param>
#
interface(`unconfined_run_to',`
	gen_require(`
		type unconfined_t;
		role unconfined_r;
	')

	domtrans_pattern(unconfined_t,$2,$1)
	role unconfined_r types $1;
	userdom_use_user_terminals($1)
')

########################################
## <summary>
##	Inherit file descriptors from the unconfined domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_use_fds',`
	gen_require(`
		type unconfined_t;
	')

	allow $1 unconfined_t:fd use;
')

########################################
## <summary>
##	Send a SIGCHLD signal to the unconfined domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_sigchld',`
	gen_require(`
		type unconfined_t;
	')

	allow $1 unconfined_t:process sigchld;
')

########################################
## <summary>
##	Send a SIGNULL signal to the unconfined domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_signull',`
	gen_require(`
		type unconfined_t;
	')

	allow $1 unconfined_t:process signull;
')

########################################
## <summary>
##	Send a SIGNULL signal to the unconfined execmem domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_execmem_signull',`
	gen_require(`
		type unconfined_execmem_t;
	')

	allow $1 unconfined_execmem_t:process signull;
')

########################################
## <summary>
##	Send a signal to the unconfined execmem domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_execmem_signal',`
	gen_require(`
		type unconfined_execmem_t;
	')

	allow $1 unconfined_execmem_t:process signal;
')

########################################
## <summary>
##	Send generic signals to the unconfined domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_signal',`
	gen_require(`
		type unconfined_t;
	')

	allow $1 unconfined_t:process signal;
')

########################################
## <summary>
##	Read unconfined domain unnamed pipes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_read_pipes',`
	gen_require(`
		type unconfined_t;
	')

	allow $1 unconfined_t:fifo_file read_fifo_file_perms;
')

########################################
## <summary>
##	Do not audit attempts to read unconfined domain unnamed pipes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_dontaudit_read_pipes',`
	gen_require(`
		type unconfined_t;
	')

	dontaudit $1 unconfined_t:fifo_file read;
')

########################################
## <summary>
##	Read and write unconfined domain unnamed pipes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_rw_pipes',`
	gen_require(`
		type unconfined_t;
	')

	allow $1 unconfined_t:fifo_file rw_fifo_file_perms;
')

########################################
## <summary>
##	Do not audit attempts to read and write
##	unconfined domain unnamed pipes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`unconfined_dontaudit_rw_pipes',`
	gen_require(`
		type unconfined_t;
	')

	dontaudit $1 unconfined_t:fifo_file rw_file_perms;
')

########################################
## <summary>
##	Do not audit attempts to read and write
##	unconfined domain stream.
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`unconfined_dontaudit_rw_stream',`
	gen_require(`
		type unconfined_t;
	')

	dontaudit $1 unconfined_t:unix_stream_socket rw_socket_perms;
')

########################################
## <summary>
##	Connect to the unconfined domain using
##	a unix domain stream socket.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_stream_connect',`
	gen_require(`
		type unconfined_t;
	')

	allow $1 unconfined_t:unix_stream_socket connectto;
')

########################################
## <summary>
##	Do not audit attempts to read or write
##	unconfined domain tcp sockets.
## </summary>
## <desc>
##	<p>
##	Do not audit attempts to read or write
##	unconfined domain tcp sockets.
##	</p>
##	<p>
##	This interface was added due to a broken
##	symptom in ldconfig.
##	</p>
## </desc>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`unconfined_dontaudit_rw_tcp_sockets',`
	gen_require(`
		type unconfined_t;
	')

	dontaudit $1 unconfined_t:tcp_socket { read write };
')

########################################
## <summary>
##	Do not audit attempts to read or write
##	unconfined domain packet sockets.
## </summary>
## <desc>
##	<p>
##	Do not audit attempts to read or write
##	unconfined domain packet sockets.
##	</p>
##	<p>
##	This interface was added due to a broken
##	symptom.
##	</p>
## </desc>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`unconfined_dontaudit_rw_packet_sockets',`
	gen_require(`
		type unconfined_t;
	')

	dontaudit $1 unconfined_t:packet_socket { read write };
')

########################################
## <summary>
##	Create keys for the unconfined domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_create_keys',`
	gen_require(`
		type unconfined_t;
	')

	allow $1 unconfined_t:key create;
')

########################################
## <summary>
##	Send messages to the unconfined domain over dbus.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_dbus_send',`
	gen_require(`
		type unconfined_t;
		class dbus send_msg;
	')

	allow $1 unconfined_t:dbus send_msg;
')

########################################
## <summary>
##	Send and receive messages from
##	unconfined_t over dbus.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_dbus_chat',`
	gen_require(`
		type unconfined_t;
		class dbus send_msg;
	')

	allow $1 unconfined_t:dbus send_msg;
	allow unconfined_t $1:dbus send_msg;
')

########################################
## <summary>
##	Connect to the the unconfined DBUS
##	for service (acquire_svc).
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_dbus_connect',`
	gen_require(`
		type unconfined_t;
		class dbus acquire_svc;
	')

	allow $1 unconfined_t:dbus acquire_svc;
')

########################################
## <summary>
##	Allow ptrace of unconfined domain
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_ptrace',`
	gen_require(`
		type unconfined_t;
	')

	allow $1 unconfined_t:process ptrace;
')

########################################
## <summary>
##	Read and write to unconfined shared memory.
## </summary>
## <param name="domain">
##	<summary>
##	The type of the process performing this action.
##	</summary>
## </param>
#
interface(`unconfined_rw_shm',`
	gen_require(`
		type unconfined_t;
	')

	allow $1 unconfined_t:shm rw_shm_perms;
')

########################################
## <summary>
##	Read and write to unconfined execmem shared memory.
## </summary>
## <param name="domain">
##	<summary>
##	The type of the process performing this action.
##	</summary>
## </param>
#
interface(`unconfined_execmem_rw_shm',`
	gen_require(`
		type unconfined_execmem_t;
	')

	allow $1 unconfined_execmem_t:shm rw_shm_perms;
')

########################################
## <summary>
##	Transition to the unconfined_execmem domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_execmem_domtrans',`

	gen_require(`
		type unconfined_execmem_t;
	')

	execmem_domtrans($1, unconfined_execmem_t)
')

########################################
## <summary>
##	execute the execmem applications
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_execmem_exec',`

	gen_require(`
		type execmem_exec_t;
	')

	can_exec($1, execmem_exec_t)
')

########################################
## <summary>
##	Allow apps to set rlimits on userdomain
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_set_rlimitnh',`
	gen_require(`
		type unconfined_t;
	')

	allow $1 unconfined_t:process rlimitinh;
')

########################################
## <summary>
##	Get the process group of unconfined.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_getpgid',`
	gen_require(`
		type unconfined_t;
	')

	allow $1 unconfined_t:process getpgid;
')

########################################
## <summary>
##	Change to the unconfined role.
## </summary>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`unconfined_role_change',`
	gen_require(`
		role unconfined_r;
	')

	allow $1 unconfined_r;
')

########################################
## <summary>
##	Allow domain to attach to TUN devices created by unconfined_t users.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`unconfined_attach_tun_iface',`
	gen_require(`
		type unconfined_t;
	')

	allow $1 unconfined_t:tun_socket relabelfrom;
	allow $1 self:tun_socket relabelto;
')