home_container.cil

(block home_container
	(blockabstract home_container)

	(optional home_container_optional
		(allow process process (capability (dac_override)))

		(allow process home_root_t list_dir_perms)
		(allow process user_home_dir_t list_dir_perms)
		(allow process user_home_t list_dir_perms)

		(allow process user_home_dir_t read_file_perms)
		(allow process user_home_t read_file_perms)
	)
)

(block home_rw_container
	(blockabstract home_rw_container)

	(blockinherit home_container)

	(optional home_rw_container_optional
		(allow process home_root_t rw_dir_perms)
		(allow process user_home_dir_t rw_dir_perms)
		(allow process user_home_t rw_dir_perms)

		(allow process user_home_dir_t rw_file_perms)
		(allow process user_home_t rw_file_perms)
	)
)

(block home_manage_container
	(blockabstract home_manage_container)

	(blockinherit home_rw_container)

	(optional home_manage_container_optional
		(allow process home_root_t manage_dir_perms)
		(allow process user_home_dir_t manage_dir_perms)
		(allow process user_home_t manage_dir_perms)

		(allow process user_home_dir_t manage_file_perms)
		(allow process user_home_t manage_file_perms)
	)
)