1 1) Reference Policy make targets:
5 install-src Install the policy sources into
6 /etc/selinux/NAME/src/policy, where NAME is defined in
7 the Makefile. If not defined, the TYPE, as defined in
8 the Makefile, is used. The default NAME is refpolicy.
9 A pre-existing source policy will be moved to
10 /etc/selinux/NAME/src/policy.bak.
12 conf Regenerate policy.xml, and update/create modules.conf
13 and booleans.conf. This should be done after adding
14 or removing modules, or after running the bare target.
15 If the configuration files exist, their settings will
16 be preserved. This must be ran on policy sources that
17 are checked out from the CVS repository before they can
20 clean Delete all temporary files, compiled policies,
21 and file_contexts. Configuration files are left intact.
23 bare Do the clean make target and also delete configuration
24 files, web page documentation, and policy.xml.
26 html Regenerate policy.xml and create web page documentation
27 in the doc/html directory.
29 Make targets specific to modular (loadable modules) policies:
31 base Compile and package the base module. This is the
32 default target for modular policies.
34 modules Compile and package all Reference Policy modules
35 configured to be built as loadable modules.
37 MODULENAME.pp Compile and package the MODULENAME Reference Policy
40 all Compile and package the base module and all Reference
41 Policy modules configured to be built as loadable
44 install Compile, package, and install the base module and
45 Reference Policy modules configured to be built as
48 load Compile, package, and install the base module and
49 Reference Policy modules configured to be built as
50 loadable modules, then insert them into the module
53 validate Validate if the configured modules can successfully
56 install-headers Install the policy headers into /usr/share/selinux/NAME.
57 The headers are sufficient for building a policy
58 module locally, without requiring the complete
59 Reference Policy sources. The build.conf settings
60 for this policy configuration should be set before
63 Make targets specific to monolithic policies:
65 policy Compile a policy locally for development and testing.
66 This is the default target for monolithic policies.
68 install Compile and install the policy and file contexts.
70 load Compile and install the policy and file contexts, then
73 enableaudit Remove all dontaudit rules from policy.conf.
75 relabel Relabel the filesystem.
77 checklabels Check the labels on the filesystem, and report when
78 a file would be relabeled, but do not change its label.
80 restorelabels Relabel the filesystem and report each file that is
84 2) Reference Policy Build Options (build.conf)
86 TYPE String. Available options are standard, mls, and mcs.
87 For a type enforcement only system, set standard.
88 This optionally enables multi-level security (MLS) or
89 multi-category security (MCS) features. This option
90 controls enable_mls, and enable_mcs policy blocks.
92 NAME String (optional). Sets the name of the policy; the
93 NAME is used when installing files to e.g.,
94 /etc/selinux/NAME and /usr/share/selinux/NAME. If not
95 set, the policy type (TYPE) is used.
97 DISTRO String (optional). Enable distribution-specific policy.
98 Available options are redhat, rhel4, gentoo, debian,
99 and suse. This option controls distro_redhat,
100 distro_rhel4, distro_gentoo, distro_debian, and
101 distro_suse policy blocks.
103 MONOLITHIC Boolean. If set, a monolithic policy is built,
104 otherwise a modular policy is built.
106 DIRECT_INITRC Boolean. If set, sysadm will be allowed to directly
107 run init scripts, instead of requiring the run_init
108 tool. This is a build option instead of a tunable since
109 role transitions do not work in conditional policy.
110 This option controls direct_sysadm_daemon policy
113 OUTPUT_POLICY Integer. Set the version of the policy created when
114 building a monolithic policy. This option has no effect
117 UNK_PERMS String. Set the kernel behavior for handling of
118 permissions defined in the kernel but missing from the
119 policy. The permissions can either be allowed, denied,
120 or the policy loading can be rejected.
122 UBAC Boolean. If set, the SELinux user will be used
123 additionally for approximate role separation.
125 MLS_SENS Integer. Set the number of sensitivities in the MLS
126 policy. Ignored on standard and MCS policies.
128 MLS_CATS Integer. Set the number of categories in the MLS
129 policy. Ignored on standard and MCS policies.
131 MCS_CATS Integer. Set the number of categories in the MCS
132 policy. Ignored on standard and MLS policies.
134 QUIET Boolean. If set, the build system will only display
135 status messages and error messages. This option has no
139 3) Reference Policy Files and Directories
140 All directories relative to the root of the Reference Policy sources directory.
142 Makefile General rules for building the policy.
144 Rules.modular Makefile rules specific to building loadable module
147 Rules.monolithic Makefile rules specific to building monolithic policies.
149 build.conf Options which influence the building of the policy,
150 such as the policy type and distribution.
152 config/appconfig-* Application configuration files for all configurations
153 of the Reference Policy (targeted/strict with or without
154 MLS or MCS). These are used by SELinux-aware programs.
156 config/local.users The file read by load policy for adding SELinux users
157 to the policy on the fly.
159 doc/html/* This contains the contents of the in-policy XML
160 documentation, presented in web page form.
162 doc/policy.dtd The doc/policy.xml file is validated against this DTD.
164 doc/policy.xml This file is generated/updated by the conf and html make
165 targets. It contains the complete XML documentation
166 included in the policy.
168 doc/templates/* Templates used for documentation web pages.
170 policy/booleans.conf This file is generated/updated by the conf make target.
171 It contains the booleans in the policy, and their
172 default values. If tunables are implemented as
173 booleans, tunables will also be included. This file
174 will be installed as the /etc/selinux/NAME/booleans
177 policy/constraints This file defines additional constraints on permissions
178 in the form of boolean expressions that must be
179 satisfied in order for specified permissions to be
180 granted. These constraints are used to further refine
181 the type enforcement rules and the role allow rules.
182 Typically, these constraints are used to restrict
183 changes in user identity or role to certain domains.
185 policy/global_booleans This file defines all booleans that have a global scope,
186 their default value, and documentation.
188 policy/global_tunables This file defines all tunables that have a global scope,
189 their default value, and documentation.
191 policy/flask/initial_sids This file has declarations for each initial SID.
193 policy/flask/security_classes This file has declarations for each security class.
195 policy/flask/access_vectors This file defines the access vectors. Common
196 prefixes for access vectors may be defined at the
197 beginning of the file. After the common prefixes are
198 defined, an access vector may be defined for each
201 policy/mcs The multi-category security (MCS) configuration.
203 policy/mls The multi-level security (MLS) configuration.
205 policy/modules/* Each directory represents a layer in Reference Policy
206 all of the modules are contained in one of these layers.
208 policy/modules.conf This file contains a listing of available modules, and
209 how they will be used when building Reference Policy. To
210 prevent a module from being used, set the module to
211 "off". For monolithic policies, modules set to "base"
212 and "module" will be included in the policy. For
213 modular policies, modules set to "base" will be included
214 in the base module; those set to "module" will be
215 compiled as individual loadable modules.
217 policy/rolemap This file contains prefix and user domain type that
218 corresponds to each user role. The contents of this
219 file will be used to expand the per-user domain
220 templates for each module.
222 policy/support/* Support macros.
224 policy/users This file defines the users included in the policy.
226 support/* Tools used in the build process.
229 4) Building policy modules using Reference Policy headers:
231 The system must first have the Reference Policy headers installed, typically
232 by the distribution. Otherwise, the headers can be installed using the
233 install-headers target from the full Reference Policy sources.
235 To set up a directory to build a local module, one must simply place a .te
236 file in a directory. A sample Makefile to use in the directory is the
237 Makefile.example in the doc directory. This may be installed in
238 /usr/share/doc, under the directory for the distribution's policy.
239 Alternatively, the primary Makefile in the headers directory (typically
240 /usr/share/selinux/NAME/Makefile) can be called directly, using make's -f
243 Larger projects can set up a structure of layers, just as in Reference
244 Policy, by creating policy/modules/LAYERNAME directories. Each layer also
245 must have a metadata.xml file which is an XML file with a summary tag and
246 optional desc (long description) tag. This should describe the purpose of
249 Metadata.xml example:
251 <summary>ABC modules for the XYZ components.</summary>
253 Make targets for modules built from headers:
255 MODULENAME.pp Compile and package the MODULENAME local module.
257 all Compile and package the modules in the current
260 load Compile and package the modules in the current
261 directory, then insert them into the module store.
263 refresh Attempts to reinsert all modules that are currently
264 in the module store from the local and system module
267 xml Build a policy.xml from the XML included with the
268 base policy headers and any XML in the modules in
269 the current directory.