SELinux Policy Editor supports a special file named “dynamic labeled file”. The files that are created dynamically by running process are not able to be labeled as the files that exist on filesystem statically. For example, the web server program “httpd” creates the “/var/run/httpd.pid” file at the time of starting. Basically the created file inherits the permissions from the parent directory, and so “/var/run/httpd.pid” file inherits permissions from “/var/run” directory. In this case, you can’t grant exclusive permissions to the “/var/run/httpd.pid” file. So the concept of ‘dynamic labeled file’ becomes effective. First you specify that the files created under the “/var/run” directory by “httpd” are the dynamic labeled file. By specifying like this, the system attaches the particular security label to the files created under the “/var/run” directory by “httpd”. The domains that are not allowed to access this particular security label specifically can’t access those files.
Note that the file that a domain can specify as a dynamic labeled file under a directory is only one.