#include<tunables/global> @{HOME} = /home/*/ /root/ # variable /usr/bin/foo { #include <abstractions/base> network inet tcp, capability setgid, /bin/mount ux, /dev/{,u}random r, /etc/ld.so.cache r, /etc/foo/* r, /lib/ld-*.so* mr, /lib/lib*.so* mr, /proc/[0-9]** r, /usr/lib/** mr, /tmp/ r, /tmp/foo.pid wr, /tmp/foo.* lrw, /@{HOME}/.foo_file rw, /@{HOME}/.foo_lock kw, link /etc/sysconfig/foo -> /etc/foo.conf, deny /etc/shadow w, owner /home/*/** rw, /usr/bin/foobar cx, /bin/** px -> bin_generic # comment on foo's local profile, foobar. foobar { /bin/bash rmix, /bin/cat rmix, /bin/more rmix, /var/log/foobar* rwl, /etc/foobar r, } }