Update Unconfined, the unconfined flag and default allow

Unconfined,-the-unconfined-flag-and-default-allow.md

@@ -1 +1,37 @@
-foo
+# Introduction
+
+The relationship between the unconfined profile, the unconfined flag, and the default-allow flag is can be confusing, and requires some knowledge of how AppArmor mediation works and why.
+
+# short circuiting mediation
+
+AppArmor does short circuiting of mediation when ever it can to reduce the performance impact mediation can have. Ideally when AppArmor is not enforcing policy it would have no overhead, allowing it to be enabled on systems and made available for the cases where mediation is desired.
+
+Unfortunately it is not possible to have zero overhead but AppArmor strives to reduce overhead where ever possible. Where possible, it does this by doing quick low overhead checks about mediation before entering into code that can have a performance impact. If mediation is not required the only overhead is the early check.
+
+## unconfined check
+
+## mediated check
+
+
+# mediation classes and compatibility
+
+
+
+
+# flags=(unconfined)
+
+unconfined status
+
+# flags=(default_allow)
+
+
+
+
+# unconfined profile
+
+The unconfined profile is the default profile for every policy namespace. It has the unconfined flag set and a special predefined state machine that does not generally do mediation.
+
+reserved "unconfined" name
+
+no status
+