Defining application role interfaces

Finally, before testing the policy, we need to create a role interface and assign it to the user domain that will be used to test (and run) the application. If we don't create a role interface and assign it to a user domain, then the user domain will either have no privileges to execute the application at all, or the application will run with the user context rather than the newly defined skype_t domain. If the user domain isn't unconfined, then chances are that the application will fail.

How to do it…

Role interfaces are the gateways of a policy. They ensure that domains and SELinux users can interact with the application and that the set of privileges for a particular application are coherent.

We create such an interface in the .if file and then assign this interface to a user domain in order to test the interface:

1. Create the myskype.if file with the following interface in it:

   interface(`skype_role',`
     gen_require(`
       type skype_t, skype_exec_t, skype_tmp_t...