1) Reference Policy make targets:General Make targets:install-srcInstall the policy sources into/etc/selinux/NAME/src/policy, where NAME is defined inthe Makefile.  If not defined, the TYPE, as defined inthe Makefile, is used.  The default NAME is refpolicy.A pre-existing source policy will be moved to/etc/selinux/NAME/src/policy.bak.confRegenerate policy.xml, and update/create modules.confand booleans.conf.  This should be done after addingor removing modules, or after running the bare target.If the configuration files exist, their settings willbe preserved.  This must be ran on policy sources thatare checked out from the CVS repository before they canbe used.cleanDelete all temporary files, compiled policies,and file_contexts.  Configuration files are left intact.bareDo the clean make target and also delete configurationfiles, web page documentation, and policy.xml.htmlRegenerate policy.xml and create web page documentationin the doc/html directory.Make targets specific to modular (loadable modules) policies:baseCompile and package the base module.  This is thedefault target for modular policies.modulesCompile and package all Reference Policy modulesconfigured to be built as loadable modules.MODULENAME.ppCompile and package the MODULENAME Reference Policymodule.allCompile and package the base module and all ReferencePolicy modules configured to be built as loadablemodules.installCompile, package, and install the base module andReference Policy modules configured to be built asloadable modules.loadCompile, package, and install the base module andReference Policy modules configured to be built asloadable modules, then insert them into the modulestore.validateValidate if the configured modules can successfullylink and expand.install-headersInstall the policy headers into /usr/share/selinux/NAME.The headers are sufficient for building a policymodule locally, without requiring the completeReference Policy sources.  The build.conf settingsfor this policy configuration should be set beforeusing this target.build-interface-dbBuild the policy interface database with'sepolgen-ifgen'.  This database is required forreference style policy generation by'audit2allow --reference'.Make targets specific to monolithic policies:policyCompile a policy locally for development and testing.This is the default target for monolithic policies.installCompile and install the policy and file contexts.loadCompile and install the policy and file contexts, thenload the policy.enableauditRemove all dontaudit rules from policy.conf.relabelRelabel the filesystem.checklabelsCheck the labels on the filesystem, and report whena file would be relabeled, but do not change its label.restorelabelsRelabel the filesystem and report each file that isrelabeled.2) Reference Policy Build Options (build.conf)TYPEString.  Available options are standard, mls, and mcs.For a type enforcement only system, set standard.This optionally enables multi-level security (MLS) ormulti-category security (MCS) features.  This optioncontrols enable_mls, and enable_mcs policy blocks.NAMEString (optional).  Sets the name of the policy; theNAME is used when installing files to e.g.,/etc/selinux/NAME and /usr/share/selinux/NAME.  If notset, the policy type (TYPE) is used.DISTROString (optional).  Enable distribution-specific policy.Available options are redhat, gentoo, and debian.This option controls distro_redhat, distro_gentoo, anddistro_debian build option policy blocks.MONOLITHICBoolean.  If set, a monolithic policy is built,otherwise a modular policy is built.DIRECT_INITRCBoolean.  If set, sysadm will be allowed to directlyrun init scripts, instead of requiring the run_inittool.  This is a build option instead of a tunable sincerole transitions do not work in conditional policy.This option controls direct_sysadm_daemon policyblocks.OUTPUT_POLICYInteger.  Set the version of the policy created whenbuilding a monolithic policy.  This option has no effecton modular policy.OUTPUT_MODULEInteger.  Set the version of the module policy created whenbuilding a modular policy.  This option has no effecton monolithic policy.UNK_PERMSString.  Set the kernel behavior for handling ofpermissions defined in the kernel but missing from thepolicy.  The permissions can either be allowed (allow),denied (deny), or the policy loading can be rejected(reject).UBACBoolean.  If set, the SELinux user will be usedadditionally for approximate role separation.SYSTEMDBoolean.  If set, systemd will be assumed to be the initprocess provider.MLS_SENSInteger.  Set the number of sensitivities in the MLSpolicy.  Ignored on standard and MCS policies.MLS_CATSInteger.  Set the number of categories in the MLSpolicy.  Ignored on standard and MCS policies.MCS_CATSInteger.  Set the number of categories in the MCSpolicy.  Ignored on standard and MLS policies.QUIETBoolean.  If set, the build system will only displaystatus messages and error messages.  This option has noeffect on policy.WERRORBoolean.  If set, the build system will treat warningsas errors.  If any warnings are encountered, the buildwill fail.3) Reference Policy Files and DirectoriesAll directories relative to the root of the Reference Policy sources directory.MakefileGeneral rules for building the policy.Rules.modularMakefile rules specific to building loadable modulepolicies.Rules.monolithicMakefile rules specific to building monolithic policies.build.confOptions which influence the building of the policy,such as the policy type and distribution.config/appconfig-*Application configuration files for all configurationsof the Reference Policy (targeted/strict with or withoutMLS or MCS).  These are used by SELinux-aware programs.config/local.usersThe file read by load policy for adding SELinux usersto the policy on the fly.doc/html/*This contains the contents of the in-policy XMLdocumentation, presented in web page form.doc/policy.dtdThe doc/policy.xml file is validated against this DTD.doc/policy.xmlThis file is generated/updated by the conf and html maketargets.  It contains the complete XML documentationincluded in the policy.doc/templates/*Templates used for documentation web pages.policy/booleans.confThis file is generated/updated by the conf make target.It contains the booleans in the policy, and theirdefault values.  If tunables are implemented asbooleans, tunables will also be included.  This filewill be installed as the /etc/selinux/NAME/booleansfile.policy/constraintsThis file defines additional constraints on permissionsin the form of boolean expressions that must besatisfied in order for specified permissions to begranted.  These constraints are used to further refinethe type enforcement rules and the role allow rules.Typically, these constraints are used to restrictchanges in user identity or role to certain domains.policy/global_booleansThis file defines all booleans that have a global scope,their default value, and documentation.policy/global_tunablesThis file defines all tunables that have a global scope,their default value, and documentation.policy/flask/initial_sids  This file has declarations for each initial SID.policy/flask/security_classes  This file has declarations for each security class.policy/flask/access_vectors  This file defines the access vectors.  Commonprefixes for access vectors may be defined at thebeginning of the file.  After the common prefixes aredefined, an access vector may be defined for eachsecurity class.policy/mcsThe multi-category security (MCS) configuration.policy/mlsThe multi-level security (MLS) configuration.policy/modules/*Each directory represents a layer in Reference Policyall of the modules are contained in one of these layers.policy/modules.confThis file contains a listing of available modules, andhow they will be used when building Reference Policy. Toprevent a module from  being used, set the module to"off".  For monolithic policies, modules set to "base"and "module" will be included in the policy.  Formodular policies, modules set to "base"will be includedin the base module; those set to "module" will becompiled as individual loadablemodules.policy/support/*Support macros.policy/usersThis file defines the users included in the policy.support/*Tools used in the build process.4) Building policy modules using Reference Policy headers:The system must first have the Reference Policy headers installed, typicallyby the distribution.  Otherwise, the headers can be installed using theinstall-headers target from the full Reference Policy sources.To set up a directory to build a local module, one must simply place a .tefile in a directory.  A sample Makefile to use in the directory is theMakefile.example in the doc directory.  This may be installed in/usr/share/doc, under the directory for the distribution's policy.Alternatively, the primary Makefile in the headers directory (typically/usr/share/selinux/NAME/Makefile) can be called directly, using make's -foption.Larger projects can set up a structure of layers, just as in ReferencePolicy, by creating policy/modules/LAYERNAME directories.  Each layer alsomust have a metadata.xml file which is an XML file with a summary tag andoptional desc (long description) tag.  This should describe the purpose ofthe layer.Metadata.xml example:<summary>ABC modules for the XYZ components.</summary>Make targets for modules built from headers:MODULENAME.ppCompile and package the MODULENAME local module.allCompile and package the modules in the currentdirectory.loadCompile and package the modules in the currentdirectory, then insert them into the module store.refreshAttempts to reinsert all modules that are currentlyin the module store from the local and system modulepackages.xmlBuild a policy.xml from the XML included with thebase policy headers and any XML in the modules inthe current directory.