;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl>
;; SPDX-License-Identifier: Unlicense

(in file

    (call auth.relabelto.type (unconfined.typeattr))
    (call auth.write.type (unconfined.typeattr))

    (block auth

	(macro type ((type ARG1))
	    (typeattributeset typeattr ARG1))

	(blockinherit file.all_macro_template_dirs)
	(blockinherit file.all_macro_template_fifo_files)
	(blockinherit file.all_macro_template_files)
	(blockinherit file.all_macro_template_lnk_files)
	(blockinherit file.all_macro_template_sock_files)

	(typeattribute typeattr)

	(call file.exception.type (typeattr))

	(call .xattr.associate_fs (typeattr))

	(block base_template

	    (blockabstract base_template)

	    (blockinherit .file.base_template)

	    (call .file.auth.type (file)))

	(block relabelto

	    (macro type ((type ARG1))
		(typeattributeset typeattr ARG1))

	    (typeattribute not_typeattr)
	    (typeattribute typeattr)

	    (typeattributeset not_typeattr (not typeattr))

	    (neverallow not_typeattr auth.typeattr (file (relabelto))))

	(block template

	    (blockabstract template)

	    (blockinherit .file.auth.base_template)
	    (blockinherit .file.macro_template_dirs)
	    (blockinherit .file.macro_template_fifo_files)
	    (blockinherit .file.macro_template_files)
	    (blockinherit .file.macro_template_lnk_files)
	    (blockinherit .file.macro_template_sock_files))

	(block write

	    (macro type ((type ARG1))
		(typeattributeset typeattr ARG1))

	    (typeattribute not_typeattr)
	    (typeattribute typeattr)

	    (typeattributeset not_typeattr (not typeattr))

	    (neverallow not_typeattr auth.typeattr (file (append write))))))