2 - Raspberry PI Community Projects

GOING FURTHER
The m4 macro language
To properly structure the policy, the SELinux developers used a macrocommand
processor. Instead of duplicating many similar allow directives,
they created “macro functions” to use a higher-level logic, which also results
in a much more readable policy.
In practice, m4 is used to compile those rules. It does the opposite operation: it
expands all those high-level directives into a huge database of allow directives.
The SELinux “interfaces” are only macro functions which will be substituted
by a set of rules at compilation time. Likewise, some rights are in fact sets of
rights which are replaced by their values at compilation time.
policy_module(myapp,1.0.0) 1 1
########################################
#
# Declarations
#
type myapp_t;
1 2
type myapp_exec_t;
domain_type(myapp_t)
domain_entry_file(myapp_t, myapp_exec_t) 1 3
type myapp_log_t;
logging_log_file(myapp_log_t)
1 4
type myapp_tmp_t;
files_tmp_file(myapp_tmp_t)
########################################
#
# Myapp local policy
#
allow myapp_t myapp_log_t:file { read_file_perms append_file_perms }; 1 5
allow myapp_t myapp_tmp_t:file manage_file_perms;
files_tmp_filetrans(myapp_t,myapp_tmp_t,file)
1 1
The module must be identified by its name and version number. This directive is required.
1 2
If the module introduces new types, it must declare them with directives like this one. Do
not hesitate to create as many types as required rather than granting too many useless
rights.
Chapter 14 — Security
397