So my impression is that the "unconfined" module is the "man, users
do weird stuff" grabbag module, and that it is good and helpful to
run without it because *in theory*, nothing should actually need
the unconfined module to work.
I noticed on my system that there's also an unconfineduser module ,
but that I can't disable it:
# semodule -d unconfineduser
Failed to resolve 'unconfined_u' in selinuxuser statement at line 19116 of
/var/lib/selinux/targeted/tmp/modules/100/base/cil
semodule: Failed!
And so I'm vaguely curious as to what that module is for and how it
relates to the unconfined module; "man unconfined_selinux" does not
make it obvious.