# FLASK

#

# Define the security context for each initial SID

# sid sidname   context

sid kernel	system_u:system_r:kernel_t

sid security	system_u:object_r:security_t

sid unlabeled	system_u:object_r:unlabeled_t

sid fs		system_u:object_r:fs_t

sid file	system_u:object_r:file_t

# Persistent label mapping is gone.  This initial SID can be removed.

sid file_labels	system_u:object_r:unlabeled_t

# init_t is still used, but an initial SID is no longer required.

sid init	system_u:object_r:unlabeled_t

# any_socket is no longer used.

sid any_socket 	system_u:object_r:unlabeled_t

sid port	system_u:object_r:port_t

sid netif	system_u:object_r:netif_t

# netmsg is no longer used.

sid netmsg	system_u:object_r:unlabeled_t

sid node	system_u:object_r:node_t

# These sockets are now labeled with the kernel SID,

# and do not require their own initial SIDs.

sid igmp_packet system_u:object_r:unlabeled_t

sid icmp_socket system_u:object_r:unlabeled_t

sid tcp_socket  system_u:object_r:unlabeled_t

# Most of the sysctl SIDs are now computed at runtime

# from genfs_contexts, so the corresponding initial SIDs

# are no longer required.

sid sysctl_modprobe	system_u:object_r:unlabeled_t

# But we still need the base sysctl initial SID as a default.

sid sysctl	system_u:object_r:sysctl_t

sid sysctl_fs	system_u:object_r:unlabeled_t

sid sysctl_kernel	system_u:object_r:unlabeled_t

sid sysctl_net	system_u:object_r:unlabeled_t

sid sysctl_net_unix	system_u:object_r:unlabeled_t

sid sysctl_vm	system_u:object_r:unlabeled_t

sid sysctl_dev	system_u:object_r:unlabeled_t

# No longer used, can be removed.

sid kmod	system_u:object_r:unlabeled_t

sid policy	system_u:object_r:unlabeled_t

sid scmp_packet	system_u:object_r:unlabeled_t

sid devnull	system_u:object_r:null_device_t

# FLASK