File access macros

[Ian Pilcher <arequipeno@gmail.com>]

I'm writing a policy module to allow containerized and non-containerized
services to share content.  (Basically to give container_t access to
public_content_t and/or public_content_rw_t.)

I don't normally make much use of SELinux policy macros, as the
documentation seems to be rather difficult to find, scattered, and
sometimes conflicting; instead I usually just use the denials generated
by the program that I'm confining to determine exactly what access it
needs.

In this case, however, I'm trying to do something much more generic.
I don't really know exactly what permissions a given containerized
service might need, so I'm looking for a good, standard set of read-only
and read/write permissions for files, directories, and symbolic links.

It sure seems like this must be a solved problem.  I.e. there must be
something like this macro, which Google Gemini so helpfully
hallucinated.

     fs_read_access(<domain_type>, <file_type>);

Thus far, I've been completely unable to find anything like this.

Am I wrong that macros like this exist?

-- 
========================================================================
If your user interface is intuitive in retrospect ... it isn't intuitive
========================================================================