Guide to Writing SE Linux Policy

Faye Coker
[email protected]
Last update: 18 March 2004

This document continues on from the Getting Started with SE Linux HOWTO, and covers writing SE Linux policy as well as discussing configuration files you will be dealing with. It is aimed at people starting out with writing their own SE Linux policies. If you have not already done so, please read the Getting Started with SE Linux HOWTO in order to become familiar with basic concepts. Any mention of "old SE Linux" refers to the original release of SE Linux for 2.4.x kernels. "New SE Linux" refers to SE Linux for 2.6.x kernels for which a backport is available for 2.4.

Please make sure you also read the NSA's document called Configuring the SE Linux Policy as material in this HOWTO refers to its contents.

This HOWTO tries to be as basic as possible. With learning how to write SE Linux policy, it's mostly a matter of just getting in there and doing it, as many things are not documented at this time. Keep practising, look at existing policies, study the kernel log messages. A lot of what you try might be guesswork which is perfectly okay, because things will gradually fall in to place.

This document has been tested on a test system but more guinea pigs are always welcome. Please email me if you run in to problems when following my instructions.

Table of Contents

1. Introduction

1.1. Feedback
1.2. Disclaimer
2. All about policies

2.1. What is a policy?
2.2. What can you do with policies?
2.3 How are policies created, and how do they take effect?
2.4 How are decisions made?
3. policy.conf, checkpolicy, the Makefile

3.1. checkpolicy
3.2. the Makefile
4. Attributes: the attrib.te file
5. User related files

5.1. The users file
5.2. The user.te file
5.3. The user_macros.te file
5.3.1 Macros for user login domains
5.3.2 Macros for ordinary user domains
6. System administrator related files

6.1. The admin_macros.te
7. the file_contexts file
8. the types directory

8.1. device.te
8.2. devpts.te
8.3. file.te
8.4. network.te
8.5. nfs.te
8.6. procfs.te
8.7. security.te
9. the macros directory

9.1. core_macros.te
9.2. global_macros.te
9.3. the macros/program directory
10. the flask directory
11. Editing the policy
12. Basic policy editing examples
13. Case study: the policy for INN

13.1. the innd.te file
13.2. the innd.fc file
13.3. the net_contexts file
14. Policy tools
15. Resources

The Guide to Writing SELinux Policy
	Home	Next