2 - Raspberry PI Community Projects

# myapp executable will have:
# label: system_u:object_r:myapp_exec_t
# MLS sensitivity: s0
# MCS categories:
/usr/sbin/myapp -- gen_context(system_u:object_r:myapp_exec_t,s0)
Example 14.2
example.fc file
14.4.4.2. Writing a .if File
In the sample below, the first interface (“myapp_domtrans”) controls who can execute the
application. The second one (“myapp_read_log”) grants read rights on the application's log
files.
Each interface must generate a valid set of rules which can be embedded in a .te file. You should
thus declare all the types that you use (with the gen_require macro), and use standard directives
to grant rights. Note, however, that you can use interfaces provided by other modules. The next
section will give more explanations about how to express those rights.
## Myapp example policy
##
##
## More descriptive text about myapp. The
## tag can also use , , and
## html tags for formatting.
##
##
## This policy supports the following myapp features:
##
## Feature A
## Feature B
## Feature C
##
##
##
#
########################################
##
## Execute a domain transition to run myapp.
##
##
Chapter 14 — Security
395