SELinux Policy Editor supports a special domain named “global”. This domain was supported in order to simplify the security policy definitions and improve the safety in defining the security policy. The security policy defined in the “global” domain is inherited by the all other domains and roles. The security policy defined in the “global”domain is absolute, and so all other domains and roles can’t deny this security policy unless this security policy is decontrolled in the each domain and role specifically.
For example, in the case of denying the access to the “/etc/shadow” file in the “global” domain, even if the read-access to the “/etc” directory is allowed in “httpd_t” domain, “httpd_t” domain can’t access the “/etc/shadow” file. If you want to allow “httpd_t” domain to access “/etc/shadow” file, you have to allow “httpd_t” domain to access “/etc/shadow”. Denying the access to the important objects in “global” domain, prevents your mis-defined security policy from allowing to access those important objects.
Using the “global” domain is useful to avoid trouble in defining the security policy. “/lib” directory has some common library files, and so most programs access to this directory. If you define the security policy about this directory in the “global” domain, you need not define the same security policy in the each domain.