policy_module(secadm, 2.4.0)

########################################
#
# Declarations
#

role secadm_r;

userdom_confined_admin_template(secadm)
userdom_security_admin(secadm_t, secadm_r)
userdom_inherit_append_admin_home_files(secadm_t)
userdom_read_admin_home_files(secadm_t)
userdom_manage_tmp_role(secadm_r, secadm_t)

########################################
#
# Local policy
#

allow secadm_t self:capability { dac_read_search  };

kernel_read_system_state(secadm_t)

corecmd_exec_shell(secadm_t)

dev_relabel_all_dev_nodes(secadm_t)
dev_read_urand(secadm_t)

domain_obj_id_change_exemption(secadm_t)

mls_process_read_up(secadm_t)
mls_file_read_all_levels(secadm_t)
mls_file_write_all_levels(secadm_t)
mls_file_upgrade(secadm_t)
mls_file_downgrade(secadm_t)

auth_role(secadm_r, secadm_t)
files_relabel_all_files(secadm_t)

init_exec(secadm_t)

logging_read_audit_log(secadm_t)
logging_read_generic_logs(secadm_t)
logging_read_audit_config(secadm_t)
logging_map_audit_config(secadm_t)
logging_map_audit_log(secadm_t)

optional_policy(`
	aide_run(secadm_t, secadm_r)
')

optional_policy(`
	auditadm_role_change(secadm_r)
')

optional_policy(`
	dmesg_exec(secadm_t)
')

optional_policy(`
	netlabel_run_mgmt(secadm_t, secadm_r)
')

optional_policy(`
	screen_role_template(secadm, secadm_r, secadm_t)
')

optional_policy(`
	su_role_template(secadm, secadm_r, secadm_t)
')

optional_policy(`
	sudo_role_template(secadm, secadm_r, secadm_t)
')

optional_policy(`
	sysadm_role_change(secadm_r)
')

optional_policy(`
	vlock_run(secadm_t, secadm_r)
')