1# handle_unknown deny 2class CLASS1 3class CLASS2 4class CLASS3 5class dir 6class file 7class process 8sid xen 9common COMMON1 { CPERM1 } 10class CLASS1 { PERM1 } 11class CLASS2 inherits COMMON1 12class CLASS3 inherits COMMON1 { PERM1 } 13default_user { CLASS1 } source; 14default_role { CLASS2 } target; 15default_type { CLASS3 } source; 16policycap open_perms; 17attribute ATTR1; 18attribute ATTR2; 19bool BOOL1 true; 20type TYPE1; 21type TYPE2; 22type TYPE3; 23type TYPE4; 24typealias TYPE1 alias TYPEALIAS1; 25typealias TYPE3 alias TYPEALIAS3A; 26typealias TYPE3 alias TYPEALIAS3B; 27typealias TYPE4 alias TYPEALIAS4; 28typebounds TYPE4 TYPE3; 29typeattribute TYPE4 ATTR2; 30permissive TYPE1; 31allow TYPE1 self:CLASS1 { PERM1 }; 32allow TYPE1 self:CLASS2 { CPERM1 }; 33auditallow TYPE1 TYPE3:CLASS1 { PERM1 }; 34auditallow TYPE2 TYPE3:CLASS1 { PERM1 }; 35dontaudit TYPE1 TYPE2:CLASS3 { CPERM1 PERM1 }; 36dontaudit TYPE1 TYPE3:CLASS3 { CPERM1 PERM1 }; 37type_transition TYPE1 TYPE2:CLASS1 TYPE3; 38type_member TYPE1 TYPE2:CLASS1 TYPE2; 39type_change TYPE1 TYPE2:CLASS1 TYPE3; 40type_transition TYPE1 TYPE3:CLASS1 TYPE1 "FILENAME"; 41type_transition TYPE1 TYPE4:CLASS1 TYPE1 "FILENAME"; 42type_transition TYPE2 TYPE3:CLASS1 TYPE1 "FILENAME"; 43type_transition TYPE2 TYPE4:CLASS1 TYPE1 "FILENAME"; 44if (BOOL1) { 45} else { 46 allow TYPE1 self:CLASS1 { PERM1 }; 47} 48role ROLE1; 49role ROLE2; 50role ROLE3; 51role ROLE1 types { TYPE1 }; 52role_transition ROLE1 TYPE1:CLASS1 ROLE2; 53role_transition ROLE1 TYPE1:process ROLE2; 54allow ROLE1 ROLE2; 55user USER1 roles ROLE1; 56constrain CLASS1 { PERM1 } (u1 == u2 or (r1 == r2 and t1 == t2)); 57validatetrans CLASS2 (u1 == u2 and t3 == ATTR1); 58sid xen USER1:ROLE1:TYPE1 59pirqcon 13 USER1:ROLE1:TYPE1 60iomemcon 0xd USER1:ROLE1:TYPE1 61iomemcon 0x17-0x1f USER1:ROLE1:TYPE1 62ioportcon 0xd USER1:ROLE1:TYPE1 63ioportcon 0x17-0x1f USER1:ROLE1:TYPE1 64pcidevicecon 0xd USER1:ROLE1:TYPE1 65devicetreecon "/path/to/device" USER1:ROLE1:TYPE1 66