SELinux Policy Editor supports the concept of “Inheritance of permissions” in the access control to directories. If you do not allow permissions to be inherited by subdirectories when you define the access controls to a directory, defined access controls are inherited by only files under the directory. If you allow the inheritance, defined access controls are inherited by files and subdirectories under the directory.
If the permissions granted to the parent directory overlap with the permissions granted to the child directory, the permissions granted to child directory are taken precedence. This rule is effective even if you allow the inheritance of permissions.
For example, if you grant “httpd_t” domain write-access to “/etc/rc.d” directory and read-access to “/etc” directory, “httpd_t” domain can write-access to “/etc/rc.d” directory.
For example, in the case of denying “global” domain to access “/etc/rc.d” directory, even if you grant “httpd_t” domain read-access to “/etc” directory, “httpd_t” domain can’t access “/etc/rc.d” directory.
For example, if you grant “httpd_t” domain write-access to “/etc/rc.d” directory without allowing the inheritance and read-access to “/etc” directory with allowing the inheritance, “httpd_t” domain can only read “/etc/rc.d/init.d/httpd”.