I've been running as staff_t/sysadm_t. This is my list of denials. Please include as many as you think appropriate. I can supply more log messages for any you request. Some we likely just don't want, and that is ok.



#============= colord_t ==============
allow colord_t systemd_hwdb_etc_t:file { getattr open read };

#============= init_t ==============
allow init_t systemd_logind_var_run_t:file { create rename setattr write };

#============= staff_dbusd_t ==============
allow staff_dbusd_t staff_t:unix_stream_socket { accept getattr getopt };

#============= staff_gkeyringd_t ==============
allow staff_gkeyringd_t staff_t:unix_stream_socket connectto;
allow staff_gkeyringd_t user_tmp_t:sock_file write;

#============= staff_sudo_t ==============
allow staff_sudo_t init_t:process getpgid;

#============= staff_t ==============
allow staff_t cgroup_t:dir { add_name create remove_name rmdir write };

allow staff_t fwupd_cache_t:file { open read };
allow staff_t gpg_agent_t:process signull;
allow staff_t init_t:process signal;
allow staff_t init_t:unix_stream_socket ioctl;
allow staff_t mount_t:process { signal signull };

#!!!! This avc can be allowed using the boolean 'selinuxuser_use_ssh_chroot'
allow staff_t self:capability setuid;
allow staff_t self:capability { sys_admin sys_ptrace };
allow staff_t sshd_key_t:file open;
allow staff_t sysfs_t:file write;

#!!!! This avc can be allowed using the boolean 'xserver_clients_write_xshm'
allow staff_t xserver_tmpfs_t:file write;

#============= systemd_logind_t ==============
allow systemd_logind_t tmpfs_t:file getattr;

#============= telepathy_logger_t ==============
allow telepathy_logger_t staff_t:process sigchld;
allow telepathy_logger_t staff_t:unix_stream_socket connectto;
allow telepathy_logger_t user_tmp_t:sock_file write;

allow telepathy_mission_control_t staff_t:process sigchld;
allow telepathy_mission_control_t staff_t:unix_stream_socket connectto;
allow telepathy_mission_control_t user_tmp_t:sock_file write;