diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if index 5667bcc..6c0c20b 100644 --- a/policy/modules/kernel/domain.if +++ b/policy/modules/kernel/domain.if @@ -35,11 +35,42 @@ interface(`domain_base_type',` ## ## Make the specified type usable as a domain. ## +## +##

+## Make the specified type usable as a domain. This, +## or an interface that calls this interface, must be +## used on all types that are used as domains. +##

+##

+## Related interfaces: +##

+## +##

+## Example: +##

+##

+## type mydomain_t; +## domain_type(mydomain_t) +## type myfile_t; +## files_type(myfile_t) +## allow mydomain_t myfile_t:file read_file_perms; +##

+##
## ## ## Type to be used as a domain type. ## ## +## # interface(`domain_type',` # start with basic domain @@ -340,11 +371,20 @@ interface(`domain_cron_exemption_target',` ## Inherit and use file descriptors from ## domains with interactive programs. ## +## +##

+## Allow the specified domain to inherit and use file +## descriptors from domains with interactive programs. +## This does not allow access to the objects being referenced +## by the file descriptors. +##

+##
## ## ## Domain allowed access. ## ## +## # interface(`domain_use_interactive_fds',` gen_require(`