Adding build-time policy decisions

The last enhancement we might want to look at is build-time policy decisions. Unlike SELinux Booleans, these are policy blocks that are enabled (or disabled) based on build parameters. We have encountered a few of these in the past already, namely enable_mcs, enable_mls as well as distribution selection parameters, such as distro_gentoo or distro_redhat.

In this recipe, we will enable the xdg_manage_downloads_home call but only when the policy is built for a Gentoo system.

How to do it…

Build-time decisions are added to the policy using the ifdef statements, as can be seen through the next set of steps:

1. Open myskype.te and add in the following block of code:

   ifdef(`distro_gentoo',`
     xdg_manage_downloads_home(skype_t)
   ')

2. Rebuild the policy. On a Gentoo system, we can confirm that the access is now granted through sesearch, whereas other distributions probably don't even know the xdg_downloads_home_t type:

   ~$ sesearch -s skype_t -t xdg_downloads_home_t -A
   

How...