fooapp - SELinux policy

fooapp.te

policy_module(fooapp, 1.0.19)

require {
        type unconfined_t;
        role unconfined_r;
        class process { transition siginh noatsecure rlimitinh };
}

attribute_role fooapp_roles;
roleattribute system_r fooapp_roles;

type fooapp_t;
type fooapp_exec_t;

application_domain(fooapp_t, fooapp_exec_t)

role fooapp_roles types fooapp_t;

# for the purpose of demonstation, allow transitioning from unconfined user shell directly into fooapp_t
role unconfined_r types fooapp_t;
type_transition unconfined_t fooapp_exec_t:process fooapp_t;
allow unconfined_t fooapp_t:process { siginh rlimitinh noatsecure transition };

userdom_use_inherited_user_ptys(fooapp_t)