Hi, the following cil constraint works correctly: (constrain (kernel_service (create_files_as)) (eq t1 t2 )) but the te-style constraint fails at load_policy time: constrain kernel_service create_files_as ( t1 == t2 ); with Invalid syntax Invalid constraint syntax Bad expression tree for constraint Bad constrain declaration at /var/lib/selinux/debian/tmp/modules/100/base/cil:957 /usr/sbin/semodule: Failed! make: *** [Rules.modular:59: load] Error 1