Selinux: (not) "Black Voodoo Magic?"

[Ivan Gyurdiev]

>
> 7) Because m4 expansion is used, things are written in if-else 
> statements (conditioned on things called booleans), and in 
> functions/interfaces. This has the drawback of having a steep learning 
> curve, because you might not be familiar with the other macros being 
> called. I suggest use of grep, and 
> http://serefpolicy.sourceforge.net/api-docs/ to figure it out. It 
> would be absolutely wrong to write only low-level rules - the policy 
> structure should model the program being confined. Things in a shared 
> library should go into a shared interface.
arg... correction:  Booleans are not handled via m4 expansion, they are 
part of the language (because their state is determined at runtime, not 
at compile time). There's:
    m4 ifelse construct - for conditional policy generation
    language if construct - for booleans, conditional policy at runtime