1# handle_unknown deny 2class CLASS1 3class CLASS2 4class CLASS3 5class dir 6class file 7class process 8sid kernel 9common COMMON1 { CPERM1 } 10class CLASS1 { PERM1 } 11class CLASS2 inherits COMMON1 12class CLASS3 inherits COMMON1 { PERM1 } 13default_user { CLASS1 } source; 14default_role { CLASS2 } target; 15default_type { CLASS3 } source; 16attribute ATTR1; 17attribute ATTR2; 18expandattribute ATTR1 true; 19expandattribute ATTR2 false; 20type TYPE1; 21type TYPE2, ATTR1; 22type TYPE3 alias { TYPEALIAS3A TYPEALIAS3B }; 23type TYPE4 alias TYPEALIAS4, ATTR2; 24typealias TYPE1 alias TYPEALIAS1; 25typeattribute TYPE1 ATTR1; 26typebounds TYPE4 TYPE3; 27bool BOOL1 true; 28tunable TUNABLE1 false; 29tunable TUNABLE2 true; 30type_transition TYPE1 TYPE2 : CLASS1 TYPE3; 31type_transition { TYPE1 TYPE2 } { TYPE3 TYPE4 } : CLASS1 TYPE1 "FILENAME"; 32type_member TYPE1 TYPE2 : CLASS1 TYPE2; 33type_change TYPE1 TYPE2 : CLASS1 TYPE3; 34allow TYPE1 self : CLASS1 { PERM1 }; 35auditallow { TYPE1 TYPE2 } TYPE3 : CLASS1 { PERM1 }; 36dontaudit TYPE1 { TYPE2 TYPE3 } : CLASS3 { PERM1 CPERM1 }; 37neverallow TYPE1 TYPE2 : { CLASS2 CLASS3 } { CPERM1 }; 38permissive TYPE1; 39attribute_role ROLE_ATTR1; 40role ROLE1; 41role ROLE3; 42role ROLE2, ROLE_ATTR1; 43role_transition ROLE1 TYPE1 ROLE2; 44role_transition ROLE1 TYPE1 : CLASS1 ROLE2; 45allow ROLE1 ROLE2; 46roleattribute ROLE3 ROLE_ATTR1; 47role ROLE1 types { TYPE1 }; 48if ! BOOL1 { allow TYPE1 self: CLASS1 *; } 49if TUNABLE1 xor TUNABLE2 { allow TYPE1 self: CLASS2 *; } else { allow TYPE1 self: CLASS3 *; } 50optional { require { class CLASS2 { CPERM1 }; } allow TYPE1 self: CLASS2 *; } 51policycap open_perms; 52user USER1 roles ROLE1; 53constrain CLASS1 { PERM1 } (u1 == u2 or (r1 == r2 and t1 == t2)); 54validatetrans CLASS2 sameuser and t3 == ATTR1; 55sid kernel USER1:ROLE1:TYPE1 56pirqcon 13 USER1:ROLE1:TYPE1 57iomemcon 13 USER1:ROLE1:TYPE1 58iomemcon 23-31 USER1:ROLE1:TYPE1 59ioportcon 13 USER1:ROLE1:TYPE1 60ioportcon 23-31 USER1:ROLE1:TYPE1 61pcidevicecon 13 USER1:ROLE1:TYPE1 62devicetreecon "/path/to/device" USER1:ROLE1:TYPE1 63