The last enhancement we might want to look at is build-time policy decisions. Unlike SELinux Booleans, these are policy blocks that are enabled (or disabled) based on build parameters. We have encountered a few of these in the past already, namely enable_mcs
, enable_mls
as well as distribution selection parameters, such as distro_gentoo
or distro_redhat
.
In this recipe, we will enable the xdg_manage_downloads_home
call but only when the policy is built for a Gentoo system.
Build-time decisions are added to the policy using the ifdef
statements, as can be seen through the next set of steps:
Open
myskype.te
and add in the following block of code:ifdef(`distro_gentoo',` xdg_manage_downloads_home(skype_t) ')
Rebuild the policy. On a Gentoo system, we can confirm that the access is now granted through
sesearch
, whereas other distributions probably don't even know thexdg_downloads_home_t
type:~$ sesearch -s skype_t -t xdg_downloads_home_t -A