Using and understanding the policy macros

Across the various SELinux policy definitions, we have come across macros that are not tied to a specific SELinux policy module. These are support macros, available inside the policy/support/*.spt files.

The most common macros are those declared inside the obj_perm_sets.spt file (which group common permissions for the same class in a single definition) and the *_patterns.spt files (which group permissions across different classes in a single definition).

Making use of single-class permission groups

Single-class permission groups allow developers to ignore possible extensions of the SELinux supported permissions as time goes by. For instance, if you want to allow a domain to execute a certain resource, it is most often not enough to allow the execute permission. You also need the open and read permissions (as otherwise, the domain cannot read the executable) and the map permission (to allow mapping the file in memory).

If you were...