selinux/secilc/docs/cil_policy_config_statements.md

Policy Configuration Statements

mls

Defines whether the policy is built as an MLS or non-MLS policy by the CIL compiler. There MUST only be one mls entry in the policy otherwise the compiler will exit with an error.

Note that this can be over-ridden by the CIL compiler command line parameter -M true|false or --mls true|false flags.

Statement definition:

    (mls boolean)

Where:

mls	The mls keyword.
boolean	Set to either true or false.

Example:

    (mls true)

handleunknown

Defines how the kernel will handle unknown object classes and permissions when loading the policy. There MUST only be one handleunknown entry in the policy otherwise the compiler will exit with an error.

Note that this can be over-ridden by the CIL compiler command line parameter -U or --handle-unknown flags.

Statement definition:

    (handleunknown action)

Where:

handleunknown	The handleunknown keyword.
action	A keyword of either allow, deny or reject. The kernel will handle these keywords as follows: allow unknown class / permissions. This will set the returned AV with all 1's. deny unknown class / permissions (the default). This will set the returned AV with all 0's. reject loading the policy if it does not contain all the object classes / permissions.

Example:

This will allow unknown classes / permissions to be present in the policy:

    (handleunknown allow)

policycap

Allow policy capabilities to be enabled via policy. These should be declared in the global namespace and be valid policy capabilities as they are checked against those known in libsepol by the CIL compiler.

Statement definition:

    (policycap policycap_id)

Where:

policycap	The policycap keyword.
policycap_id	The policycap identifier (e.g. open_perms).

Example:

These set two valid policy capabilities:

    ; Enable networking controls.
    (policycap network_peer_controls)

    ; Enable open permission check.
    (policycap open_perms)