Sstrhsrtj

I've written a custom selinux module that looks something like this:

require {

    type my_app_t;

    type my_app_file_t;

    class file { getattr lock open read write execute execute_no_trans ioctl append setattr };

    class dir { write search getattr };

}



allow my_app_t my_app_file_t:file { append setattr write getattr execute read open execute_no_trans lock ioctl};

allow my_app_t my_app_file_t:dir { write search getattr};

This mostly works OK, but I'm tired of adding new perms every time a new deny shows up in audit.log. Is there any way to just allow all permissions for files/directories with a given context? For instance:

require {

    type my_app_t;

    type my_app_file_t;

    class file { * };

    class dir { * };

}



allow my_app_t my_app_file_t:file { * };

allow my_app_t my_app_file_t:dir { * };

You should consider using reference policy macros. Using reference policy macros, you can then use manage_files_pattern macro to allow all access, for example:

manage_files_pattern(my_app_t, my_app_file_t, my_app_file_t)

There are also macros for other commonly used patterns, located at /policy/support in the reference policy source.

If my_app_t is defined by a reference policy module, there likely already exists an interface, which you can use to allow access. Interfaces are documented in reference policy API documentation (provided by selinux-policy-doc package) and are also available online (however a bit outdated).

The easiest way to build a reference policy module is by using the makefile in SELinux policy development package (selinux-policy-devel or similar) of your distribution, for example: make -f /usr/share/selinux/devel/Makefile my_app.pp.