mirror of
https://github.com/SELinuxProject/selinux
synced 2024-12-21 21:50:00 +00:00
057d72af2d
Also fixes the occasional missing brackets as higlighted by my editor, however the individual examples where not reviewed much closer. secilc was chosen as language name because the compiler is named secilc and outside of SELinux the name cil is less searchable and could lead to confusion. Signed-off-by: Jonathan Hettwer <j2468h@gmail.com>
138 lines
2.9 KiB
Markdown
138 lines
2.9 KiB
Markdown
SID Statements
|
|
==============
|
|
|
|
sid
|
|
---
|
|
|
|
Declares a new SID identifier in the current namespace.
|
|
|
|
**Statement definition:**
|
|
|
|
```secil
|
|
(sid sid_id)
|
|
```
|
|
|
|
**Where:**
|
|
|
|
<table>
|
|
<colgroup>
|
|
<col width="25%" />
|
|
<col width="75%" />
|
|
</colgroup>
|
|
<tbody>
|
|
<tr class="odd">
|
|
<td align="left"><p><code>sid</code></p></td>
|
|
<td align="left"><p>The <code>sid</code> keyword.</p></td>
|
|
</tr>
|
|
<tr class="even">
|
|
<td align="left"><p><code>sid_id</code></p></td>
|
|
<td align="left"><p>The <code>sid</code> identifier.</p></td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
**Examples:**
|
|
|
|
These examples show three [`sid`](cil_sid_statements.md#sid) declarations:
|
|
|
|
```secil
|
|
(sid kernel)
|
|
(sid security)
|
|
(sid igmp_packet)
|
|
```
|
|
|
|
sidorder
|
|
--------
|
|
|
|
Defines the order of [sid](#sid)'s. This is a mandatory statement when SIDs are defined. Multiple [`sidorder`](cil_sid_statements.md#sidorder) statements declared in the policy will form an ordered list.
|
|
|
|
**Statement definition:**
|
|
|
|
```secil
|
|
(sidorder (sid_id ...))
|
|
```
|
|
|
|
**Where:**
|
|
|
|
<table>
|
|
<colgroup>
|
|
<col width="25%" />
|
|
<col width="75%" />
|
|
</colgroup>
|
|
<tbody>
|
|
<tr class="odd">
|
|
<td align="left"><p><code>sidorder</code></p></td>
|
|
<td align="left"><p>The <code>sidorder</code> keyword.</p></td>
|
|
</tr>
|
|
<tr class="even">
|
|
<td align="left"><p><code>sid_id</code></p></td>
|
|
<td align="left"><p>One or more <code>sid</code> identifiers.</p></td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
**Example:**
|
|
|
|
This will produce an ordered list of "`kernel security unlabeled`"
|
|
|
|
```secil
|
|
(sid kernel)
|
|
(sid security)
|
|
(sid unlabeled)
|
|
(sidorder (kernel security))
|
|
(sidorder (security unlabeled))
|
|
```
|
|
|
|
sidcontext
|
|
----------
|
|
|
|
Associates an SELinux security [context](#context) to a previously declared [`sid`](cil_sid_statements.md#sid) identifier.
|
|
|
|
**Statement definition:**
|
|
|
|
```secil
|
|
(sidcontext sid_id context_id)
|
|
```
|
|
|
|
**Where:**
|
|
|
|
<table>
|
|
<colgroup>
|
|
<col width="25%" />
|
|
<col width="75%" />
|
|
</colgroup>
|
|
<tbody>
|
|
<tr class="odd">
|
|
<td align="left"><p><code>sidcontext</code></p></td>
|
|
<td align="left"><p>The <code>sidcontext</code> keyword.</p></td>
|
|
</tr>
|
|
<tr class="even">
|
|
<td align="left"><p><code>sid_id</code></p></td>
|
|
<td align="left"><p>A single previously declared <code>sid</code> identifier.</p></td>
|
|
</tr>
|
|
<tr class="odd">
|
|
<td align="left"><p><code>context_id</code></p></td>
|
|
<td align="left"><p>A previously declared <code>context</code> identifier or an anonymous security context (<code>user role type levelrange</code>), the range MUST be defined whether the policy is MLS/MCS enabled or not.</p></td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
**Examples:**
|
|
|
|
This shows two named security context examples plus an anonymous context:
|
|
|
|
```secil
|
|
; Two named context:
|
|
(sid kernel)
|
|
(context kernel_context (u r process low_low))
|
|
(sidcontext kernel kernel_context)
|
|
|
|
(sid security)
|
|
(context security_context (u object_r process low_low))
|
|
(sidcontext security security_context)
|
|
|
|
; An anonymous context:
|
|
(sid unlabeled)
|
|
(sidcontext unlabeled (u object_r ((s0) (s0))))
|
|
```
|