SELinux Cookbook

Chapter 4. Creating a Desktop Application Policy

In this chapter, we will cover the following topics:

• Researching the application's logical design
• Creating a skeleton policy
• Setting context definitions
• Defining application role interfaces
• Testing and enhancing the policy
• Ignoring permissions we don't need
• Creating application resource interfaces
• Adding conditional policy rules
• Adding build-time policy decisions

Introduction

Up until now, we've modified and enhanced existing policies and interacted with the SELinux subsystem through the available administrative commands. But, in order to truly benefit from the protection measures that SELinux provides, we need to create our own policies for applications that would otherwise run with either too many privileges, ...