During policy development, some of the resources used by the policy are or could be shared with other policies. If that is the case, a functionality-driven policy module is created in which those common resources are placed. This allows other policies to use these resources and assign the right permissions through the interfaces declared in the functionality-driven policy.
Most of the work in this recipe is to figure out what resources are shared. This is done by completing the following steps:
Look for common files and directories that might be shared with other applications and whose ownership is not specifically tied to an application, but is more functional in nature. For these resources, declare them in a functionality-driven policy.
Check whether there are devices used that are functionally related to the policy but not to a specific application in particular.
Validate if there is specific user-provided content that is functionally related but not...