rewrite core rule
allow get attributes for unconfined type
add role