A keyword of either allow , deny or reject . The kernel will handle these keywords as follows:
allow unknown class / permissions. This will set the returned AV with all 1's.
deny unknown class / permissions (the default). This will set the returned AV with all 0's.
reject loading the policy if it does not contain all the object classes / permissions.
|