Yuli Khodorkovskiy 12c7dfc553 secilc/docs: Convert DocBook documentation into github markdown

Converting to github markdown allows for easier integration with the
SELinux project wiki and viewing of documentation directly on github without
creating PDFs or reading through DocBook XML.

The conversion of DocBook to github markdown would not format tables or
keyword links properly. By maintaining the documentation in github
markdown in the repository, the content is well formatted with a table of
contents when viewing in the github wiki or in the repository.

The migration from DocBook to github markdown was done using Pandoc and
manual fixups. Mappings of CIL keywords to headings that were lost in the DocBook
conversion were added back. An introduction and design philosphy was
also pulled from the SELinux project wiki to provide more cohesion
to the current documentation.

Running make will now convert the github markdown into PDF and HTML.

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>

2015-12-15 16:18:34 -05:00

3 KiB

Raw Blame History

Context Statement

Contexts are formed using previously declared parameters and may be named or anonymous where:

Named - The context is declared with a context identifer that is used as a reference.
Anonymous - They are defined within the CIL labeling statement using user, role etc. identifiers.

Each type is shown in the examples.

context

Declare an SELinux security context identifier for labeling. The range (or current and clearance levels) MUST be defined whether the policy is MLS/MCS enabled or not.

Statement definition:

(context context_id (user_id role_id type_id levelrange_id)))

Where:

`context`	The `context` keyword.
`context_id`	The `context` identifier.
`user_id`	A single previously declared `user` identifier.
`role_id`	A single previously declared `role` identifier.
`type_id`	A single previously declared `type` or `typealias` identifier.
`levelrange_id`	A single previously declared `levelrange` identifier. This entry may also be defined by anonymous or named `level`, `sensitivity`, `sensitivityalias`, `category`, `categoryalias` or `categoryset` as discussed in the Multi-Level Security Labeling Statements section and shown in the examples.

Examples:

This example uses a named context definition:

(context runas_exec_context (u object_r exec low_low))

(filecon "/system/bin/run-as" file runas_exec_context)

to resolve/build a file_contexts entry of (assuming MLS enabled policy):

/system/bin/run-as  -- u:object_r:runas.exec:s0-s0

This example uses an anonymous context where the previously declared user role type levelrange identifiers are used to specifiy two portcon statements:

(portcon udp 1024 (test.user object_r test.process ((s0) (s1))))
(portcon tcp 1024 (test.user object_r test.process (system_low system_high)))

This example uses an anonymous context for the first and named context for the second in a netifcon statement:

(context netif_context (test.user object_r test.process ((s0 (c0)) (s1 (c0)))))

(netifcon eth04 (test.user object_r test.process ((s0 (c0)) (s1 (c0)))) netif_context)

3 KiB Raw Blame History

Context Statement

context

3 KiB

Raw Blame History