Converting to github markdown allows for easier integration with the SELinux project wiki and viewing of documentation directly on github without creating PDFs or reading through DocBook XML. The conversion of DocBook to github markdown would not format tables or keyword links properly. By maintaining the documentation in github markdown in the repository, the content is well formatted with a table of contents when viewing in the github wiki or in the repository. The migration from DocBook to github markdown was done using Pandoc and manual fixups. Mappings of CIL keywords to headings that were lost in the DocBook conversion were added back. An introduction and design philosphy was also pulled from the SELinux project wiki to provide more cohesion to the current documentation. Running make will now convert the github markdown into PDF and HTML. Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
7.1 KiB
Conditional Statements
boolean
Declares a run time boolean as true or false in the current namespace. The booleanif
statement contains the CIL code that will be in the binary policy file.
Statement definition:
(boolean boolean_id true|false)
Where:
|
The |
|
The |
|
The initial state of the boolean. This can be changed at run time using |
Example:
See the booleanif
statement for an example.
booleanif
Contains the run time conditional statements that are instantiated in the binary policy according to the computed boolean identifier(s) state.
call
statements are allowed within a booleanif
, however the contents of the resulting macro must be limited to those of the booleanif
statement (i.e. allow
, auditallow
, dontaudit
, typemember
, typetransition
, typechange
and the compile time tunableif
statement)).
Statement definition:
(booleanif boolean_id | expr ...)
(true
cil_statements
...)
(false
cil_statements
...)
)
Where:
|
The |
|
Either a single |
|
Zero or more
|
|
An optional set of CIL statements that will be instantiated when the |
|
An optional set of CIL statements that will be instantiated when the |
Examples:
The second example also shows the kernel policy language equivalent:
(boolean disableAudio false)
(booleanif disableAudio
(false
(allow process mediaserver.audio_device (chr_file_set (rw_file_perms)))
)
)
(boolean disableAudioCapture false)
;;; if(!disableAudio && !disableAudioCapture) {
(booleanif (and (not disableAudio) (not disableAudioCapture))
(true
(allow process mediaserver.audio_capture_device (chr_file_set (rw_file_perms)))
)
)
tunable
Tunables are similar to booleans, however they are used to manage areas of CIL statements that may or may not be in the final CIL policy that will be compiled (whereas booleans are embedded in the binary policy and can be enabled or disabled during run-time).
Note that tunables can be treated as booleans by the CIL compiler command line parameter -P
or --preserve-tunables
flags.
Statement definition:
(tunable tunable_id true|false)
Where:
|
The |
|
The |
|
The initial state of the |
Example:
See the tunableif
statement for an example.
tunableif
Compile time conditional statement that may or may not add CIL statements to be compiled.
Statement definition:
(tunableif tunable_id | expr ...)
(true
cil_statements
...)
(false
cil_statements
...)
)
Where:
|
The |
|
Either a single |
|
Zero or more
|
|
An optional set of CIL statements that will be instantiated when the |
|
An optional set of CIL statements that will be instantiated when the |
Example:
This example will not add the range transition rule to the binary policy:
(tunable range_trans_rule false)
(block init
(class process (process))
(type process)
(tunableif range_trans_rule
(true
(rangetransition process sshd.exec process low_high)
)
) ; End tunableif
) ; End block