1# handle_unknown deny 2class CLASS1 3class CLASS2 4class CLASS3 5class dir 6class file 7class process 8sid xen 9common COMMON1 { CPERM1 } 10class CLASS1 { PERM1 } 11class CLASS2 inherits COMMON1 12class CLASS3 inherits COMMON1 { PERM1 } 13default_user { CLASS1 } source; 14default_role { CLASS2 } target; 15default_type { CLASS3 } source; 16policycap open_perms; 17attribute ATTR1; 18attribute ATTR2; 19bool BOOL1 true; 20type TYPE1; 21type TYPE2; 22type TYPE3; 23type TYPE4; 24typealias TYPE1 alias TYPEALIAS1; 25typealias TYPE3 alias TYPEALIAS3A; 26typealias TYPE3 alias TYPEALIAS3B; 27typealias TYPE4 alias TYPEALIAS4; 28typebounds TYPE4 TYPE3; 29typeattribute TYPE4 ATTR2; 30permissive TYPE1; 31allow TYPE1 self:CLASS1 { PERM1 }; 32allow TYPE1 self:CLASS2 { CPERM1 }; 33auditallow TYPE1 TYPE3:CLASS1 { PERM1 }; 34auditallow TYPE2 TYPE3:CLASS1 { PERM1 }; 35dontaudit TYPE1 TYPE2:CLASS3 { CPERM1 PERM1 }; 36dontaudit TYPE1 TYPE3:CLASS3 { CPERM1 PERM1 }; 37type_transition TYPE1 TYPE2:CLASS1 TYPE3; 38type_member TYPE1 TYPE2:CLASS1 TYPE2; 39type_change TYPE1 TYPE2:CLASS1 TYPE3; 40type_transition TYPE1 TYPE3:CLASS1 TYPE1 "FILENAME"; 41type_transition TYPE1 TYPE4:CLASS1 TYPE1 "FILENAME"; 42type_transition TYPE2 TYPE3:CLASS1 TYPE1 "FILENAME"; 43type_transition TYPE2 TYPE4:CLASS1 TYPE1 "FILENAME"; 44role ROLE1; 45role ROLE2; 46role ROLE3; 47role ROLE1 types { TYPE1 }; 48role_transition ROLE1 TYPE1:CLASS1 ROLE2; 49role_transition ROLE1 TYPE1:process ROLE2; 50allow ROLE1 ROLE2; 51user USER1 roles ROLE1; 52constrain CLASS1 { PERM1 } (u1 == u2 or (r1 == r2 and t1 == t2)); 53validatetrans CLASS2 (u1 == u2 and t3 == ATTR1); 54sid xen USER1:ROLE1:TYPE1 55pirqcon 13 USER1:ROLE1:TYPE1 56iomemcon 0xd USER1:ROLE1:TYPE1 57iomemcon 0x17-0x1f USER1:ROLE1:TYPE1 58ioportcon 0xd USER1:ROLE1:TYPE1 59ioportcon 0x17-0x1f USER1:ROLE1:TYPE1 60pcidevicecon 0xd USER1:ROLE1:TYPE1 61devicetreecon "/path/to/device" USER1:ROLE1:TYPE1 62