RichardHaines: New page: = Default Rules = These rules allow a default user, role, type and/or range to be used when computing a context for a new object. These require policy version 27 or 28 with kernels 3.5 or ...

2012-11-18T14:44:09Z

New page: = Default Rules = These rules allow a default user, role, type and/or range to be used when computing a context for a new object. These require policy version 27 or 28 with kernels 3.5 or ...

New page

= Default Rules =
These rules allow a default user, role, type and/or range to be used when computing a context for a new object. These require policy version 27 or 28 with kernels 3.5 or greater.

== default_user Rule ==
Allows the default user to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 27.

'''The statement definition is:'''
<pre>
default_user class default;
</pre>

'''Where:'''

{|border="1"
| default_user
| The default_user rule keyword.

|-
| class

| One or more class identifiers. Multiple entries consist of a space separated list enclosed in braces ({}).

Entries can be excluded from the list by using the negative operator (-).

|-
| default
| A single keyword consisting of either <tt>source</tt> or <tt>target</tt> that will state whether the default user should be obtained from the source or target context.

|}

'''The statement is valid in:'''

{|border="1"
| <center>'''Monolithic Policy'''</center>
| <center>'''Base Policy'''</center>
| <center>'''Module Policy'''</center>

|-
| <center>Yes</center>
| <center>Yes</center>
| <center>No</center>

|-
| <center>'''Conditional Policy (if) Statement'''</center>
| <center>'''optional Statement'''</center>
| <center>'''require Statement'''</center>

|-
| <center>No</center>
| <center>No</center>
| <center>No</center>

|}

'''Example:'''
<pre>
<nowiki># When computing the context for a new file object, the user</nowiki>
<nowiki># will be obtained from the target context.</nowiki>

default_user file target;

<nowiki># When computing the context for a new x_selection or x_property</nowiki>
<nowiki># object, the user will be obtained from the source context.</nowiki>

default_user { x_selection x_property } source;
</pre>

== default_role Rule ==
Allows the default role to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 27.

'''The statement definition is:'''
<pre>
default_role class default;
</pre>

'''Where:'''

{|border="1"
| default_role
| The default_role rule keyword.

|-
| class

| One or more class identifiers. Multiple entries consist of a space separated list enclosed in braces ({}).

Entries can be excluded from the list by using the negative operator (-).

|-
| default
| A single keyword consisting of either <tt>source</tt> or <tt>target</tt> that will state whether the default role should be obtained from the source or target context.

|}

'''The statement is valid in:'''

{|border="1"
| <center>'''Monolithic Policy'''</center>
| <center>'''Base Policy'''</center>
| <center>'''Module Policy'''</center>

|-
| <center>Yes</center>
| <center>Yes</center>
| <center>No</center>

|-
| <center>'''Conditional Policy (if) Statement'''</center>
| <center>'''optional Statement'''</center>
| <center>'''require Statement'''</center>

|-
| <center>No</center>
| <center>No</center>
| <center>No</center>

|}

'''Example:'''
<pre>
<nowiki># When computing the context for a new file object, the role</nowiki>
<nowiki># will be obtained from the target context.</nowiki>

default_role file target;

<nowiki># When computing the context for a new x_selection or x_property</nowiki>
<nowiki># object, the role will be obtained from the source context.</nowiki>

default_role { x_selection x_property } source;
</pre>

== default_type Rule ==
Allows the default type to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 28.

'''The statement definition is:'''
<pre>
default_type class default;
</pre>

'''Where:'''

{|border="1"
| default_type
| The default_type rule keyword.

|-
| class

| One or more class identifiers. Multiple entries consist of a space separated list enclosed in braces ({}).

Entries can be excluded from the list by using the negative operator (-).

|-
| default
| A single keyword consisting of either <tt>source</tt> or <tt>target</tt> that will state whether the default type should be obtained from the source or target context.

|}

'''The statement is valid in:'''

{|border="1"
| <center>'''Monolithic Policy'''</center>
| <center>'''Base Policy'''</center>
| <center>'''Module Policy'''</center>

|-
| <center>Yes</center>
| <center>Yes</center>
| <center>No</center>

|-
| <center>'''Conditional Policy (if) Statement'''</center>
| <center>'''optional Statement'''</center>
| <center>'''require Statement'''</center>

|-
| <center>No</center>
| <center>No</center>
| <center>No</center>

|}

'''Example:'''
<pre>
<nowiki># When computing the context for a new file object, the type</nowiki>
<nowiki># will be obtained from the target context.</nowiki>

default_type file target;

<nowiki># When computing the context for a new x_selection or x_property</nowiki>
<nowiki># object, the type will be obtained from the source context.</nowiki>

default_type { x_selection x_property } source;
</pre>

== default_range Rule ==
Allows the default range or level to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 27.

'''The statement definition is:'''
<pre>
default_range class default entry;
</pre>

'''Where:'''

{|border="1"
| default_range
| The default_range rule keyword.

|-
| class

| One or more class identifiers. Multiple entries consist of a space separated list enclosed in braces ({}).

Entries can be excluded from the list by using the negative operator (-).

|-
| default
| A single keyword consisting of either <tt>source</tt> or <tt>target</tt> that will state whether the default level or range should be obtained from the source or target context.

|-
| entry
| A single keyword consisting of either: <tt>low</tt>, <tt>high</tt> or <tt>low_high</tt> that will state whether the default level or range should be obtained from the source or target context.

|}

'''The statement is valid in:'''

{|border="1"
| <center>'''Monolithic Policy'''</center>
| <center>'''Base Policy'''</center>
| <center>'''Module Policy'''</center>

|-
| <center>Yes</center>
| <center>Yes</center>
| <center>No</center>

|-
| <center>'''Conditional Policy (if) Statement'''</center>
| <center>'''optional Statement'''</center>
| <center>'''require Statement'''</center>

|-
| <center>No</center>
| <center>No</center>
| <center>No</center>

|}

'''Example:'''
<pre>
<nowiki># When computing the context for a new file object, the lower</nowiki>
<nowiki># level will be taken from the target context range.</nowiki>

default_range file target low;

<nowiki># When computing the context for a new x_selection or x_property</nowiki>
<nowiki># object, the range will be obtained from the source context.</nowiki>

default_type { x_selection x_property } source low_high;
</pre>

----
<references/>

[[Category:Notebook]]

DefaultRules - Revision history

RichardHaines: New page: = Default Rules = These rules allow a default user, role, type and/or range to be used when computing a context for a new object. These require policy version 27 or 28 with kernels 3.5 or ...