Macros and Processing, Compilation

In good old unix style all the files that make up a system policy are concatenated and processed through the macro processor M4. This has the unfortunate effect that the individual policy files do not show the true content. The resulting large policy file is then processed, C code generated and the resulting binary policy is loaded into the kernel.

A change in police - e.g. adding a user - requires the whole process to be repeated.