Initial CIL Base SELinux security policy

CIL Base is a minimal SELinux security policy written in Common Intermediate Language that serves as a base for tailored configurations.

Current characteristics of CIL Base SELinux security policy are:

 - All known kernel and user space security classes (83) and access vector permissions (247) are supported.
 - Four security contexts are supported (2 types, 2 identities, 3 roles):

	system_u:system_r:system_t: system processes.
	system_u:object_r:system_t: objects created by the system.

	session_u:session_r:session_t: session processes.
	session_u:object_r:session_t: objects created by sessions.

 - All processes are unrestricted (332 allow rules).
 - Except for a minimal set of file object context specifications, no object contexts are specified.
 - All initial security identifiers are associated with system_u:object_r:system_t, except for kernel which is associated with system_u:system_r:system_t
 - The system_r role is allowed to manually change to the session_r role (1 role allow rule).
	This is a temporary facility to allow login programs to change to the specified security context for sessions.
 - No other rules, identifiers, contraints or statements are specified.

Purpose of CIL Base SELinux security policy:

 - To serve as a base for tailored SElinux security policy configurations
	The nature of Common Intermediate Language and the SELinux Common Intermediate Language Compiler enables for completate customization.

Additional notes:

Although this policy has been verified to work in enforcing mode as is, in Fedora 20 there are issues identified:

 - Some programs such as OpenSSH and RPM rely on particular security contexts being present in the SELinux security policy.
	DO NOT INSTALL, UPDATE, REMOVE SOFTWARE IN ENFORCING MODE USING RPM!
 - Home and runtime directory file context specifications should be generated whenever SELinux security policy is loaded, and whenever a new Linux identity is associated with a custom SELinux identity.
 - This SELinux security policy depends on the SELinux Common Intermediate Language Compiler (secilc), and it currently does not work with many traditional SELinux user space utilities such as semanage and semodule.