Remove duplicate role declarations

-This patch is needed since CIL does not allow duplicate
role declarations. The roles for system_r, staff_r, sysadm_r, and
user_r were already declared in kernel.te. Since the roles are
pulled in from require statements in the appropriate interfaces,
the duplicate role declarations could be deleted in modules for
auditadm, staff, sysadm, and userdomain.

-Move a role declaration that used an argument passed into the
userdom_base_user_template into a gen_require statement.

policy/modules/roles/auditadm.te

@@ -6,7 +6,6 @@ policy_module(auditadm, 2.2.0)
 #
 
 role auditadm_r;
-role system_r;
 userdom_unpriv_user_template(auditadm)
 
 ########################################

policy/modules/roles/staff.te

@@ -5,7 +5,7 @@ policy_module(staff, 2.5.1)
 # Declarations
 #
 
-role staff_r;
+#role staff_r;
 
 userdom_unpriv_user_template(staff)
 

policy/modules/roles/sysadm.te

@@ -12,7 +12,7 @@ policy_module(sysadm, 2.7.1)
 ## </desc>
 gen_tunable(allow_ptrace, false)
 
-role sysadm_r;
+#role sysadm_r;
 
 userdom_admin_user_template(sysadm)
 

policy/modules/roles/unprivuser.te

@@ -8,7 +8,7 @@ policy_module(unprivuser, 2.5.1)
 # Declarations
 #
 
-role user_r;
+#role user_r;
 
 userdom_unpriv_user_template(user)
 

policy/modules/system/userdomain.if

@@ -27,6 +27,7 @@ template(`userdom_base_user_template',`
  attribute userdomain;
  type user_devpts_t, user_tty_device_t;
  class context contains;
+ role $1_r;
  ')
 
  attribute $1_file_type;
@@ -37,7 +38,6 @@ template(`userdom_base_user_template',`
  corecmd_bin_entry_type($1_t)
  domain_user_exemption_target($1_t)
  ubac_constrained($1_t)
- role $1_r;
  role $1_r types $1_t;
  allow system_r $1_r;