1.4 Terms

• Domain
  Domain is the same as domain in SELinux. It is attached to process by domain transition.
• Role
  Role in SPDL is simplified. Role is identified with a domain for user shell. In SPDL, we describe access rights for role. In fact, it is giving access rights for user shell of the role. For example, when you give access right for sysadm_r, access right is given to sysadm_t(Domain for user shell of sysadm_r).
  Note that in generated SELinux policy, all roles can type every types. There is no syntax corresponding to role:x:types:y in simplified language.
• Unconfined domain
  unconfined domain is a domain that is configured to be allowed everything. If process is given unconfined domain, it is passes all SELinux permission checks, so it runs the same as in normal Linux.
  

  To configure unconfined domain allowpriv all; is used.