SELinux: allow line for any application

It's possible to write for SELinux an allow line for every application?

I.e. I am working on a Linux embedded distro and many applications need to explicitly allowed to make use of the pseudoterminal:

allow application_name devpts_t:chr_file { read write };

The process of finding any app that does not have this access is very tedious and has to be repeated for any new application... Any way to write just one line of devpts_t:chr_file rw access instead of doing it in several different policies?

What domain are all those processes running in? unconfined_t? Wouldn't it be a matter of

allow unconfined_t devpts_t:chr_file { read write };

then?

Another option would be to disable SElinux.

Originally Posted by hoes Another option would be to disable SElinux.

There are some security hardening requirements that dictate SELinux should be enabled. It is up to the individual Systems Administrators to determine what to allow or deny in SELinux.