policy_module(staff, 2.1.1)

########################################
#
# Declarations
#

role staff_r;

userdom_unpriv_user_template(staff)
fs_exec_noxattr(staff_t)

# needed for sandbox
allow staff_t self:process setexec;

########################################
#
# Local policy
#

kernel_read_ring_buffer(staff_usertype)
kernel_getattr_core_if(staff_usertype)
kernel_getattr_message_if(staff_usertype)
kernel_read_software_raid_state(staff_usertype)
kernel_read_fs_sysctls(staff_usertype)

domain_read_all_domains_state(staff_usertype)
domain_getattr_all_domains(staff_usertype)
domain_obj_id_change_exemption(staff_t)

files_read_kernel_modules(staff_usertype)

seutil_read_module_store(staff_t)
seutil_run_newrole(staff_t, staff_r)

term_use_unallocated_ttys(staff_usertype)

auth_domtrans_pam_console(staff_t)

init_dbus_chat(staff_t)
init_dbus_chat_script(staff_t)

miscfiles_read_hwdata(staff_usertype)

modutils_read_module_config(staff_usertype)
modutils_read_module_deps(staff_usertype)

netutils_run_ping(staff_t, staff_r)
netutils_signal_ping(staff_t)

optional_policy(`
	apache_role(staff_r, staff_t)
')

optional_policy(`
	mozilla_run_plugin(staff_t, staff_r)
')

optional_policy(`
	auditadm_role_change(staff_r)
')

optional_policy(`
	dbadm_role_change(staff_r)
')

optional_policy(`
	logadm_role_change(staff_r)
')

optional_policy(`
	webadm_role_change(staff_r)
')

optional_policy(`
	kerneloops_manage_tmp_files(staff_t)
')

optional_policy(`
	postgresql_role(staff_r, staff_t)
')

optional_policy(`
	secadm_role_change(staff_r)
')

optional_policy(`
	unconfined_role_change(staff_r)
')

optional_policy(`
	rtkit_scheduled(staff_t)
')

optional_policy(`
	screen_role_template(staff, staff_r, staff_t)
')

optional_policy(`
	ssh_role_template(staff, staff_r, staff_t)
')

optional_policy(`
	sudo_role_template(staff, staff_r, staff_t)
')

optional_policy(`
	sysadm_role_change(staff_r)
	userdom_dontaudit_use_user_terminals(staff_t)
')

optional_policy(`
	telepathy_dbus_session_role(staff_r, staff_t)
')

optional_policy(`
	xserver_role(staff_r, staff_t)
')

ifndef(`distro_redhat',`
	optional_policy(`
		auth_role(staff_r, staff_t)
	')

	optional_policy(`
		bluetooth_role(staff_r, staff_t)
	')

	optional_policy(`
		cdrecord_role(staff_r, staff_t)
	')

	optional_policy(`
		cron_role(staff_r, staff_t)
	')

	optional_policy(`
		dbus_role_template(staff, staff_r, staff_t)
	')

	optional_policy(`
		evolution_role(staff_r, staff_t)
	')

	optional_policy(`
		games_role(staff_r, staff_t)
	')

	optional_policy(`
		gift_role(staff_r, staff_t)
	')

	optional_policy(`
		gnome_role(staff_r, staff_t)
	')

	optional_policy(`
		gpg_role(staff_r, staff_t)
	')

	optional_policy(`
		irc_role(staff_r, staff_t)
	')

	optional_policy(`
		java_role(staff_r, staff_t)
	')

	optional_policy(`
		lockdev_role(staff_r, staff_t)
	')

	optional_policy(`
		lpd_role(staff_r, staff_t)
	')

	optional_policy(`
		mozilla_role(staff_r, staff_t)
	')

	optional_policy(`
		mplayer_role(staff_r, staff_t)
	')

	optional_policy(`
		mta_role(staff_r, staff_t)
	')

	optional_policy(`
		oident_manage_user_content(staff_t)
		oident_relabel_user_content(staff_t)
	')
	optional_policy(`
		pyzor_role(staff_r, staff_t)
	')

	optional_policy(`
		razor_role(staff_r, staff_t)
	')

	optional_policy(`
		rssh_role(staff_r, staff_t)
	')

	optional_policy(`
		spamassassin_role(staff_r, staff_t)
	')

	optional_policy(`
		su_role_template(staff, staff_r, staff_t)
	')

	optional_policy(`
		thunderbird_role(staff_r, staff_t)
	')

	optional_policy(`
		tvtime_role(staff_r, staff_t)
	')

	optional_policy(`
		uml_role(staff_r, staff_t)
	')

	optional_policy(`
		userhelper_role_template(staff, staff_r, staff_t)
	')

	optional_policy(`
		vmware_role(staff_r, staff_t)
	')

	optional_policy(`
		wireshark_role(staff_r, staff_t)
	')
')

optional_policy(`
	accountsd_dbus_chat(staff_t)
	accountsd_read_lib_files(staff_t)
')

optional_policy(`
	gnomeclock_dbus_chat(staff_t)
')

optional_policy(`
	firewallgui_dbus_chat(staff_t)
')

optional_policy(`
	lpd_list_spool(staff_t)
')

optional_policy(`
	kerneloops_dbus_chat(staff_t)
')

optional_policy(`
	rpm_dbus_chat(staff_usertype)
')

optional_policy(`
	sandbox_transition(staff_t, staff_r)
')

optional_policy(`
	setroubleshoot_stream_connect(staff_t)
	setroubleshoot_dbus_chat(staff_t)
	setroubleshoot_dbus_chat_fixit(staff_t)
')

optional_policy(`
	virt_stream_connect(staff_t)
')

optional_policy(`
	userhelper_console_role_template(staff, staff_r, staff_usertype)
')