SELinux Cookbook

Granting privileges to all clients

The approach of using interfaces to aggregate privileges not only benefits domains that have the same functional purpose, but also clients. By combining the privileges for the set of clients, it is possible to enhance client privileges by only updating the interface rather than having to update all the clients' policy modules.

How to do it…

Create a client interface that can be assigned to all clients of a particular functional purpose. The following steps extend an example policy with antimalware support:

1. In the antimalware generic policy, create an avcheck_client attribute:

   attribute avcheck_client;

2. Create the interface that assigns the attribute to a client domain:

   interface(`av_check_client',` gen_require(` attribute ...