selinux/secilc/docs/cil_default_object_statements.md

Default Object Statements

These rules allow a default user, role, type and/or range to be used when computing a context for a new object. These require policy version 27 or 28 with kernels 3.5 or greater.

defaultuser

Allows the default user to be taken from the source or target context when computing a new context for the object class identifier. Requires policy version 27.

Statement definition:

(defaultuser class_id default)

Where:

defaultuser	The defaultuser keyword.
class_id	A single previously declared class or classmap identifier, or a list of previously declared class or classmap identifiers enclosed within parentheses.
default	A keyword of either source or target.

Example:

When creating new binder, property_service, zygote or memprotect objects the user component of the new security context will be taken from the source context:

(class binder (impersonate call set_context_mgr transfer receive))
(class property_service (set))
(class zygote (specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo))
(class memprotect (mmap_zero))

(classmap android_classes (android))
(classmapping android_classes android (binder (all)))
(classmapping android_classes android (property_service (set)))
(classmapping android_classes android (zygote (not (specifycapabilities))))

(defaultuser (android_classes memprotect) source)

; Will produce the following in the binary policy file:
;; default_user binder source;
;; default_user zygote source;
;; default_user property_service source;
;; default_user memprotect source;

defaultrole

Allows the default role to be taken from the source or target context when computing a new context for the object class identifier. Requires policy version 27.

(defaultrole class_id default)

Where:

defaultrole	The defaultrole keyword.
class_id	A single previously declared class or classmap identifier, or a list of previously declared class or classmap identifiers enclosed within parentheses.
default	A keyword of either source or target.

Example:

When creating new binder, property_service or zygote objects the role component of the new security context will be taken from the target context:

(class binder (impersonate call set_context_mgr transfer receive))
(class property_service (set))
(class zygote (specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo))

(defaultrole (binder property_service zygote) target)

; Will produce the following in the binary policy file:
;; default_role binder target;
;; default_role zygote target;
;; default_role property_service target;

defaulttype

Allows the default type to be taken from the source or target context when computing a new context for the object class identifier. Requires policy version 28.

Statement definition:

(defaulttype class_id default)

Where:

defaulttype	The defaulttype keyword.
class_id	A single previously declared class or classmap identifier, or a list of previously declared class or classmap identifiers enclosed within parentheses.
default	A keyword of either source or target.

Example:

When creating a new socket object, the type component of the new security context will be taken from the source context:

(defaulttype socket source)

defaultrange

Allows the default level or range to be taken from the source or target context when computing a new context for the object class identifier. Requires policy version 27.

Statement definition:

(defaultrange class_id default range)

Where:

defaultrange	The defaultrange keyword.
class_id	A single previously declared class or classmap identifier, or a list of previously declared class or classmap identifiers enclosed within parentheses.
default	A keyword of either source or target.
range	A keyword of either low, high or low-high.

Example:

When creating a new file object, the appropriate range component of the new security context will be taken from the target context:

(defaultrange file target low_high)