(roleattributeset cil_gen_require system_r) (optional permissivedomains_optional_1 (typeattributeset cil_gen_require tlp_t) (typepermissive tlp_t) )