12c7dfc553
Converting to github markdown allows for easier integration with the SELinux project wiki and viewing of documentation directly on github without creating PDFs or reading through DocBook XML. The conversion of DocBook to github markdown would not format tables or keyword links properly. By maintaining the documentation in github markdown in the repository, the content is well formatted with a table of contents when viewing in the github wiki or in the repository. The migration from DocBook to github markdown was done using Pandoc and manual fixups. Mappings of CIL keywords to headings that were lost in the DocBook conversion were added back. An introduction and design philosphy was also pulled from the SELinux project wiki to provide more cohesion to the current documentation. Running make will now convert the github markdown into PDF and HTML. Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
2.9 KiB
SID Statements
sid
Declares a new SID identifier in the current namespace.
Statement definition:
(sid sid_id)
Where:
|
The |
|
The |
Examples:
These examples show three sid declarations:
(sid kernel)
(sid security)
(sid igmp_packet)
sidorder
Defines the order of sid's. This is a mandatory statement when SIDs are defined. Multiple sidorder statements declared in the policy will form an ordered list.
Statement definition:
(sidorder (sid_id ...))
Where:
|
The |
|
One or more |
Example:
This will produce an ordered list of "kernel security unlabeled"
(sid kernel)
(sid security)
(sid unlabeled)
(sidorder (kernel security))
(sidorder (security unlabeled))
sidcontext
Associates an SELinux security context to a previously declared sid identifier.
Statement definition:
(sidcontext sid_id context_id)
Where:
|
The |
|
A single previously declared |
|
A previously declared |
Examples:
This shows two named security context examples plus an anonymous context:
; Two named context:
(sid kernel)
(context kernel_context (u r process low_low))
(sidcontext kernel kernel_context)
(sid security)
(context security_context (u object_r process low_low))
(sidcontext security security_context)
; An anonymous context:
(sid unlabeled)
(sidcontext unlabeled (u object_r ((s0) (s0))))