Actually, it's easier than that. There are type attributes which may
be assigned to an arbitrary set of types, and each "type" field in an
access rule may use either a type or an attribute. So you don't
actually need to modify existing rules when adding new types, you
just add the appropriate existing attributes to your new type. For
example, you could set up a "logfile" attribute which allows
logrotate to archive old versions and allows audit-admin users to
modify/delete them, then whenever you need to add a new logfile you
just declare the "my_foo_log_t" type to have the "logfile" attribute.
On the other hand, I seem to recall that typical "targeted" policies
don't grant most of the additional access via access rules, they
instead add a special case to the fundamental "constraints" in the
policy (IE: If the subject type has the "trusted" attribute then skip
some of the other type-based checks).
Cheers,
Kyle Moffett
-
