-The interface file creates the macros that other modules will use to gain access to my resources. This allows the module that created the type or attribute to define appropriate uses. Additionally, it provides a single point for documentation. Create myapp.if and add the following: +The interface file creates the macros that other modules will use to gain access +to my resources. This allows the module that created the type or attribute to +define appropriate uses. Additionally, it provides a single point for +documentation. Create myapp.if and add the following:
-## <module name="myapp" layer="apps"> ## <summary>Myapp example policy</summary> -## <description>More descriptive text about myapp</description> +## <desc> +## <p> +## More descriptive text about myapp. The <desc> +## tag can also use <p>, <ul>, and <ol> +## html tags for formatting. +## </p> +## <p> +## This policy supports the following myapp features: +## <ul> +## <li>Feature A</li> +## <li>Feature B</li> +## <li>Feature C</li> +## </ul> +## </p> +## </desc> -## <interface name="myapp_domtrans"> ## <summary> ## Execute a domain transition to run myapp. ## </summary> -## <parameter name="domain"> +## <param name="domain"> ## Domain allowed to transition. -## </parameter> -## </interface> -define(`myapp_domtrans',` +## </param> +interface(`myapp_domtrans',` gen_requires(` type myapp_t, myapp_exec_t; class fd use; @@ -82,15 +96,13 @@ define(`myapp_domtrans',` allow $1 myapp_t:process sigchld; ') -## <interface name="myapp_read_log"> ## <summary> ## Read myapp log files. ## </summary> -## <parameter name="domain"> +## <param name="domain"> ## Domain allowed to read the log files. -## </parameter> -## </interface> -define(`myapp_read_log',` +## </param> +interface(`myapp_read_log',` gen_requires(` type myapp_log_t; class file r_file_perms; @@ -99,8 +111,6 @@ define(`myapp_read_log',` logging_search_logs($1) allow $1 myapp_log_t:file r_file_perms; ') - -## </module>