Creating fine-grained definitions

Throughout this book, most small SELinux policy adjustments have been made using CIL. These are small, fine-grained definitions that require little development effort, and have the benefit of being directly loadable.

Depending on roles or types

The CIL language requires some order in how types or roles are linked in the policy. Sometimes, when we develop CIL policies, the order of the types might not be addressed properly.

To work around this issue, a default attribute called cil_gen_require is used. When types or roles are assigned to the cil_gen_require attribute, they are automatically linked correctly in the policy. This is not a CIL requirement though, but a convention that the SELinux utilities use.

The attribute actually exists twice, once as a type attribute and once as a role attribute. They might have the same name, but are two different attributes:

(roleattributeset cil_gen_require system_r)
(typeattributeset cil_gen_require...