; Permission groups for processes.
(classmap processes (transform describe relax interact))

; Permission group for changing labels on processes.
(classmapping processes transform (
  process (
    dyntransition transition setcurrent setexec
    setfscreate setkeycreate setsockcreate)))
(classmapping processes transform (
  process2 (nnp_transition nosuid_transition)))
(classmapping processes transform (
  io_uring (override_creds)))

(classmapping processes describe (
  process (
    getsched getsession getpgid getcap getattr getrlimit)))

; Permission group for relaxing security constraints on processes.
(classmapping processes relax (
  process (execheap execmem execstack)))
(classmapping processes relax (
  memprotect (mmap_zero)))

; Permission group for other actions.
(classmapping processes interact (
  process (not (
    dyntransition transition setcurrent setexec
    setfscreate setkeycreate setsockcreate
    getsched getsession getpgid getcap getattr getrlimit
    execheap execmem execstack))))
(classmapping processes interact (
  io_uring (sqpoll)))