Creating application-level policies

Application-level policies provide confinement for applications or services. There are a number of different types of application-level policies around:

• End user application policies, which focus on accessing end user data, and will often call various userdom_* interfaces (which are provided through the system/userdomain.if file). Most of these applications are inside the apps/ directory).
• Administration applications, which are still user-facing, are more likely to enable interacting with system services and resources.
• Services, which are generally daemonized applications, often interact mostly with their own resources and have a simpler structure.

When we covered the sepolicy generate command in Chapter 14, Dealing with New Applications, we could select these types (and more) to generate a simple skeleton for those applications.

Let's look into some example policies and identify useful calls that you might need when...