Add the unconfined_read_files() and unconfined_list_dirs() interfaces

As a result of executing "ip netns add NAME" in cli, some domains need
to access files in the user's "/run/netns/NAME" directory.

Related: rhbz#2216911

policy/modules/roles/unconfineduser.if

@@ -275,6 +275,42 @@ interface(`unconfined_signal',`
 	allow $1 unconfined_t:process signal;
 ')
 
+########################################
+## <summary>
+##	List unconfined domain directories
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unconfined_list_dirs',`
+	gen_require(`
+		type unconfined_t;
+	')
+
+	list_dirs_pattern($1, unconfined_t, unconfined_t)
+')
+
+########################################
+## <summary>
+##	Read unconfined domain files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unconfined_read_files',`
+	gen_require(`
+		type unconfined_t;
+	')
+
+	read_files_pattern($1, unconfined_t, unconfined_t)
+')
+
 ########################################
 ## <summary>
 ##	Read unconfined domain unnamed pipes.