1) Reference Policy make targets:

General Make targets:

install-src Install the policy sources into /etc/selinux/NAME/src/policy, where NAME is defined in the Makefile. If not defined, the TYPE, as defined in the Makefile, is used. The default NAME is refpolicy. A pre-existing source policy will be moved to /etc/selinux/NAME/src/policy.bak.

conf Regenerate policy.xml, and update/create modules.conf and booleans.conf. This should be done after adding or removing modules, or after running the bare target. If the configuration files exist, their settings will be preserved. This must be ran on policy sources that are checked out from the CVS repository before they can be used.

clean Delete all temporary files, compiled policies, and file_contexts. Configuration files are left intact.

bare Do the clean make target and also delete configuration files, web page documentation, and policy.xml.

html Regenerate policy.xml and create web page documentation in the doc/html directory.

Make targets specific to modular (loadable modules) policies:

base Compile and package the base module. This is the default target for modular policies.

modules Compile and package all Reference Policy modules configured to be built as loadable modules.

MODULENAME.pp Compile and package the MODULENAME Reference Policy module.

all Compile and package the base module and all Reference Policy modules configured to be built as loadable modules.

install Compile, package, and install the base module and Reference Policy modules configured to be built as loadable modules.

load Compile, package, and install the base module and Reference Policy modules configured to be built as loadable modules, then insert them into the module store.

validate Validate if the configured modules can successfully link and expand.

install-headers Install the policy headers into /usr/share/selinux/NAME. The headers are sufficient for building a policy module locally, without requiring the complete Reference Policy sources. The build.conf settings for this policy configuration should be set before using this target.

Make targets specific to monolithic policies:

policy Compile a policy locally for development and testing. This is the default target for monolithic policies.

install Compile and install the policy and file contexts.

load Compile and install the policy and file contexts, then load the policy.

enableaudit Remove all dontaudit rules from policy.conf.

relabel Relabel the filesystem.

checklabels Check the labels on the filesystem, and report when a file would be relabeled, but do not change its label.

restorelabels Relabel the filesystem and report each file that is relabeled.

2) Reference Policy Build Options (build.conf)

TYPE String. Available options are standard, mls, and mcs. For a type enforcement only system, set standard. This optionally enables multi-level security (MLS) or multi-category security (MCS) features. This option controls enable_mls, and enable_mcs policy blocks.

NAME String (optional). Sets the name of the policy; the NAME is used when installing files to e.g., /etc/selinux/NAME and /usr/share/selinux/NAME. If not set, the policy type (TYPE) is used.

DISTRO String (optional). Enable distribution-specific policy. Available options are redhat, gentoo, and debian. This option controls distro_redhat, distro_gentoo, and distro_debian build option policy blocks.

MONOLITHIC Boolean. If set, a monolithic policy is built, otherwise a modular policy is built.

DIRECT_INITRC Boolean. If set, sysadm will be allowed to directly run init scripts, instead of requiring the run_init tool. This is a build option instead of a tunable since role transitions do not work in conditional policy. This option controls direct_sysadm_daemon policy blocks.

OUTPUT_POLICY Integer. Set the version of the policy created when building a monolithic policy. This option has no effect on modular policy.

UNK_PERMS String. Set the kernel behavior for handling of permissions defined in the kernel but missing from the policy. The permissions can either be allowed (allow), denied (deny), or the policy loading can be rejected (reject).

UBAC Boolean. If set, the SELinux user will be used additionally for approximate role separation.

SYSTEMD Boolean. If set, systemd will be assumed to be the init process provider.

MLS_SENS Integer. Set the number of sensitivities in the MLS policy. Ignored on standard and MCS policies.

MLS_CATS Integer. Set the number of categories in the MLS policy. Ignored on standard and MCS policies.

MCS_CATS Integer. Set the number of categories in the MCS policy. Ignored on standard and MLS policies.

QUIET Boolean. If set, the build system will only display status messages and error messages. This option has no effect on policy.

WERROR Boolean. If set, the build system will treat warnings as errors. If any warnings are encountered, the build will fail.

3) Reference Policy Files and Directories All directories relative to the root of the Reference Policy sources directory.

Makefile General rules for building the policy.

Rules.modular Makefile rules specific to building loadable module policies.

Rules.monolithic Makefile rules specific to building monolithic policies.

build.conf Options which influence the building of the policy, such as the policy type and distribution.

config/appconfig-* Application configuration files for all configurations of the Reference Policy (targeted/strict with or without MLS or MCS). These are used by SELinux-aware programs.

config/local.users The file read by load policy for adding SELinux users to the policy on the fly.

doc/html/* This contains the contents of the in-policy XML documentation, presented in web page form.

doc/policy.dtd The doc/policy.xml file is validated against this DTD.

doc/policy.xml This file is generated/updated by the conf and html make targets. It contains the complete XML documentation included in the policy.

doc/templates/* Templates used for documentation web pages.

policy/booleans.conf This file is generated/updated by the conf make target. It contains the booleans in the policy, and their default values. If tunables are implemented as booleans, tunables will also be included. This file will be installed as the /etc/selinux/NAME/booleans file.

policy/constraints This file defines additional constraints on permissions in the form of boolean expressions that must be satisfied in order for specified permissions to be granted. These constraints are used to further refine the type enforcement rules and the role allow rules. Typically, these constraints are used to restrict changes in user identity or role to certain domains.

policy/global_booleans This file defines all booleans that have a global scope, their default value, and documentation.

policy/global_tunables This file defines all tunables that have a global scope, their default value, and documentation.

policy/flask/initial_sids This file has declarations for each initial SID.

policy/flask/security_classes This file has declarations for each security class.

policy/flask/access_vectors This file defines the access vectors. Common prefixes for access vectors may be defined at the beginning of the file. After the common prefixes are defined, an access vector may be defined for each security class.

policy/mcs The multi-category security (MCS) configuration.

policy/mls The multi-level security (MLS) configuration.

policy/modules/* Each directory represents a layer in Reference Policy all of the modules are contained in one of these layers.

policy/modules.conf This file contains a listing of available modules, and how they will be used when building Reference Policy. To prevent a module from being used, set the module to "off". For monolithic policies, modules set to "base" and "module" will be included in the policy. For modular policies, modules set to "base" will be included in the base module; those set to "module" will be compiled as individual loadable modules.

policy/support/* Support macros.

policy/users This file defines the users included in the policy.

support/* Tools used in the build process.

4) Building policy modules using Reference Policy headers:

The system must first have the Reference Policy headers installed, typically by the distribution. Otherwise, the headers can be installed using the install-headers target from the full Reference Policy sources.

To set up a directory to build a local module, one must simply place a .te file in a directory. A sample Makefile to use in the directory is the Makefile.example in the doc directory. This may be installed in /usr/share/doc, under the directory for the distribution's policy. Alternatively, the primary Makefile in the headers directory (typically /usr/share/selinux/NAME/Makefile) can be called directly, using make's -f option.

Larger projects can set up a structure of layers, just as in Reference Policy, by creating policy/modules/LAYERNAME directories. Each layer also must have a metadata.xml file which is an XML file with a summary tag and optional desc (long description) tag. This should describe the purpose of the layer.

Metadata.xml example:

Make targets for modules built from headers:

MODULENAME.pp Compile and package the MODULENAME local module.

all Compile and package the modules in the current directory.

load Compile and package the modules in the current directory, then insert them into the module store.

refresh Attempts to reinsert all modules that are currently in the module store from the local and system module packages.

xml Build a policy.xml from the XML included with the base policy headers and any XML in the modules in the current directory.