Service domains usually have a few binaries that are executed by user domains or through other service or application domains. Each case of these executions need to be properly investigated to see if a domain transition is needed (that is, a specific domain needs to be created for that execution environment) or if the command can run within the privileges of the caller domain.
From an interface point of view, this is provided through the _exec, _run, and _domtrans interfaces.
Execution-related interfaces allow for other policy modules to define the interaction with this application. This interaction can be a regular execution, but can also contain a domain transition to switch the application domain to the newly defined one. The set of execution interfaces are created as follows:
For each execution where the application itself needs to run in the caller domain (so no transition has to occur), create an
_execinterface as follows:##...