Selinux policy: inheritance of rules

[Scriptum]

I want to write policy module (mls) for the application that will have same rules as one of existing applications but with additional rules. It there a way to inherit all allow's from other domain?

Smth like

policy_module my_app 1.0
require {
type user_t,xselection_t;
class xselection {read write};
}
#this domain will have same allow's as user_t
type my_app_t : inherits user_t

allow my_app_t xselection_t : xselection {read write};

In short, almost all programs in mls policy run in user_t domain, but one of these programs must have a little more privileges.

I found only one example in reference policy - wm_t, policy for wm_t can't access user's data but I want to keep all user_t restrictions.

[domg472]

You could use type attributes, or type aliases for that i guess.

http://selinuxproject.org/page/TypeStatements

See the attribute, typeattribute, typealias and typebounds statements.

Or you could use templates maybe?

http://selinuxproject.org/page/TypeRules

[Scriptum]

If I create alias:

typealias user_t alias inherit_t;

and then add attribure to alias:

mls_file_write_all_levels(inherit_t);

user_t also gets mls_file_write_all_levels permission. But I want to find a way to make inherit_t trusted and keep user_t untrusted.

[domg472]

Right, i was not sure about that but makes sense come to think of it.

I guess you would have to settle with using type attributes.

See if you can use user_usertype and then extent that (not sure if that will work but this attribute is available in f16)

# seinfo -xauser_usertype
   user_usertype
      user_openoffice_t
      user_java_t
      user_mono_t
      user_wine_t
      user_execmem_t
      user_t

sesearch -ASCT -s user_usertype | grep user_usertype
sesearch -ASCT -t user_usertype | grep user_usertype

If that does not work the way you like then i guess youll have to use type attributes to implement something similar (or use templates) by your self

If you want to clone the user_t user login domain then why not just clone that module, rename it and extent it?