SELinux policy for Chrome OS lives here.
platform2/sepolicy
|- policy
SELinux policies live here. It contains sids, access vectors, mls, security classes, users, and roles definitions, type definitions, necessary macros for policy writing, and AVC rules.|- base
sids, access vectors, mls, security classes, users, roles definitions. fs_use, and genfs definitions. fs_use defines context for different filesystems, e.g, devtmpfs -> u:object_r:device:s0, ext4 -> u:object_r:labeledfs:s0. genfscon defines file labels from the policy (so no need to xattr actual inode), mostly for procfs.|- chromeos
All Chrome OS AVCs except for those in chromeos_base live here. Chrome OS file type definitions also live here.|- te_macros
Chrome OS-specific macros to write .te files, excluding those in policy/base
or in shared
.|- attributes
Chrome OS attributes.|- file.te
Chrome OS file labels.|- **.te
AVC rules for different domains.|- chromeos_base
minijail, cros_init, and cros init script domains live here. Inside structure similar to chromeos
.|- mask_only
an NO-OP mask to make sure (base + mask_only) combined is a valid monotlithic policy.|- file_contexts
file labels on system image, stateful partition, devtmpfs, sysfs live here.\- shared
shared macros live here.Docs are located at SELinux in ChromeOS