http://selinuxproject.org/w/?title=DefaultRules&action=history&feed=atomDefaultRules - Revision history2024-03-28T18:09:53ZRevision history for this page on the wikiMediaWiki 1.23.13http://selinuxproject.org/w/?title=DefaultRules&diff=1735&oldid=prevRichardHaines at 14:11, 11 December 20142014-12-11T14:11:35Z<p></p>
<table class='diff diff-contentalign-left'>
<col class='diff-marker' />
<col class='diff-content' />
<col class='diff-marker' />
<col class='diff-content' />
<tr style='vertical-align: top;'>
<td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td>
<td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 14:11, 11 December 2014</td>
</tr><tr><td colspan="2" class="diff-lineno">Line 2:</td>
<td colspan="2" class="diff-lineno">Line 2:</td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>These rules allow a default user, role, type and/or range to be used when computing a context for a new object. These require policy version 27 or 28 with kernels 3.5 or greater.</div></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>These rules allow a default user, role, type and/or range to be used when computing a context for a new object. These require policy version 27 or 28 with kernels 3.5 or greater.</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td class='diff-marker'>−</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>== default_user <del class="diffchange diffchange-inline">Rule </del>==</div></td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>== default_user ==</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>Allows the default user to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 27.</div></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>Allows the default user to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 27.</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td colspan="2" class="diff-lineno">Line 71:</td>
<td colspan="2" class="diff-lineno">Line 71:</td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td class='diff-marker'>−</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>== default_role <del class="diffchange diffchange-inline">Rule </del>==</div></td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>== default_role ==</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>Allows the default role to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 27.</div></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>Allows the default role to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 27.</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td colspan="2" class="diff-lineno">Line 141:</td>
<td colspan="2" class="diff-lineno">Line 141:</td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td class='diff-marker'>−</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>== default_type <del class="diffchange diffchange-inline">Rule </del>==</div></td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>== default_type ==</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>Allows the default type to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 28.</div></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>Allows the default type to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 28.</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td colspan="2" class="diff-lineno">Line 211:</td>
<td colspan="2" class="diff-lineno">Line 211:</td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td class='diff-marker'>−</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>== default_range <del class="diffchange diffchange-inline">Rule </del>==</div></td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>== default_range ==</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>Allows the default range or level to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 27.</div></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>Allows the default range or level to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 27.</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr>
</table>RichardHaineshttp://selinuxproject.org/w/?title=DefaultRules&diff=1731&oldid=prevRichardHaines at 13:47, 11 December 20142014-12-11T13:47:54Z<p></p>
<a href="http://selinuxproject.org/w/?title=DefaultRules&diff=1731&oldid=1297">Show changes</a>RichardHaineshttp://selinuxproject.org/w/?title=DefaultRules&diff=1297&oldid=prevRichardHaines: New page: = Default Rules = These rules allow a default user, role, type and/or range to be used when computing a context for a new object. These require policy version 27 or 28 with kernels 3.5 or ...2012-11-18T14:44:09Z<p>New page: = Default Rules = These rules allow a default user, role, type and/or range to be used when computing a context for a new object. These require policy version 27 or 28 with kernels 3.5 or ...</p>
<p><b>New page</b></p><div>= Default Rules =<br />
These rules allow a default user, role, type and/or range to be used when computing a context for a new object. These require policy version 27 or 28 with kernels 3.5 or greater.<br />
<br />
== default_user Rule ==<br />
Allows the default user to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 27.<br />
<br />
'''The statement definition is:'''<br />
<pre><br />
default_user class default;<br />
</pre><br />
<br />
'''Where:'''<br />
<br />
{|border="1"<br />
| default_user<br />
| The default_user rule keyword.<br />
<br />
|-<br />
| class<br />
<br />
<br />
<br />
| One or more class identifiers. Multiple entries consist of a space separated list enclosed in braces ({}). <br />
<br />
Entries can be excluded from the list by using the negative operator (-).<br />
<br />
|-<br />
| default<br />
| A single keyword consisting of either <tt>source</tt> or <tt>target</tt> that will state whether the default user should be obtained from the source or target context.<br />
<br />
|}<br />
<br />
<br />
'''The statement is valid in:'''<br />
<br />
{|border="1"<br />
| <center>'''Monolithic Policy'''</center><br />
| <center>'''Base Policy'''</center><br />
| <center>'''Module Policy'''</center><br />
<br />
|-<br />
| <center>Yes</center><br />
| <center>Yes</center><br />
| <center>No</center><br />
<br />
|-<br />
| <center>'''Conditional Policy (if) Statement'''</center><br />
| <center>'''optional Statement'''</center><br />
| <center>'''require Statement'''</center><br />
<br />
|-<br />
| <center>No</center><br />
| <center>No</center><br />
| <center>No</center><br />
<br />
|}<br />
<br />
<br />
'''Example:'''<br />
<pre><br />
<nowiki># When computing the context for a new file object, the user</nowiki><br />
<nowiki># will be obtained from the target context.</nowiki><br />
<br />
default_user file target;<br />
<br />
<nowiki># When computing the context for a new x_selection or x_property</nowiki><br />
<nowiki># object, the user will be obtained from the source context.</nowiki><br />
<br />
default_user { x_selection x_property } source;<br />
</pre><br />
<br />
<br />
== default_role Rule ==<br />
Allows the default role to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 27.<br />
<br />
'''The statement definition is:'''<br />
<pre><br />
default_role class default;<br />
</pre><br />
<br />
<br />
'''Where:'''<br />
<br />
{|border="1"<br />
| default_role<br />
| The default_role rule keyword.<br />
<br />
|-<br />
| class<br />
<br />
<br />
<br />
| One or more class identifiers. Multiple entries consist of a space separated list enclosed in braces ({}). <br />
<br />
Entries can be excluded from the list by using the negative operator (-).<br />
<br />
|-<br />
| default<br />
| A single keyword consisting of either <tt>source</tt> or <tt>target</tt> that will state whether the default role should be obtained from the source or target context.<br />
<br />
|}<br />
<br />
<br />
'''The statement is valid in:'''<br />
<br />
{|border="1"<br />
| <center>'''Monolithic Policy'''</center><br />
| <center>'''Base Policy'''</center><br />
| <center>'''Module Policy'''</center><br />
<br />
|-<br />
| <center>Yes</center><br />
| <center>Yes</center><br />
| <center>No</center><br />
<br />
|-<br />
| <center>'''Conditional Policy (if) Statement'''</center><br />
| <center>'''optional Statement'''</center><br />
| <center>'''require Statement'''</center><br />
<br />
|-<br />
| <center>No</center><br />
| <center>No</center><br />
| <center>No</center><br />
<br />
|}<br />
<br />
<br />
'''Example:'''<br />
<pre><br />
<nowiki># When computing the context for a new file object, the role</nowiki><br />
<nowiki># will be obtained from the target context.</nowiki><br />
<br />
default_role file target;<br />
<br />
<nowiki># When computing the context for a new x_selection or x_property</nowiki><br />
<nowiki># object, the role will be obtained from the source context.</nowiki><br />
<br />
default_role { x_selection x_property } source;<br />
</pre><br />
<br />
<br />
== default_type Rule ==<br />
Allows the default type to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 28.<br />
<br />
'''The statement definition is:'''<br />
<pre><br />
default_type class default;<br />
</pre><br />
<br />
<br />
'''Where:'''<br />
<br />
{|border="1"<br />
| default_type<br />
| The default_type rule keyword.<br />
<br />
|-<br />
| class<br />
<br />
<br />
<br />
| One or more class identifiers. Multiple entries consist of a space separated list enclosed in braces ({}). <br />
<br />
Entries can be excluded from the list by using the negative operator (-).<br />
<br />
|-<br />
| default<br />
| A single keyword consisting of either <tt>source</tt> or <tt>target</tt> that will state whether the default type should be obtained from the source or target context.<br />
<br />
|}<br />
<br />
<br />
'''The statement is valid in:'''<br />
<br />
{|border="1"<br />
| <center>'''Monolithic Policy'''</center><br />
| <center>'''Base Policy'''</center><br />
| <center>'''Module Policy'''</center><br />
<br />
|-<br />
| <center>Yes</center><br />
| <center>Yes</center><br />
| <center>No</center><br />
<br />
|-<br />
| <center>'''Conditional Policy (if) Statement'''</center><br />
| <center>'''optional Statement'''</center><br />
| <center>'''require Statement'''</center><br />
<br />
|-<br />
| <center>No</center><br />
| <center>No</center><br />
| <center>No</center><br />
<br />
|}<br />
<br />
<br />
'''Example:'''<br />
<pre><br />
<nowiki># When computing the context for a new file object, the type</nowiki><br />
<nowiki># will be obtained from the target context.</nowiki><br />
<br />
default_type file target;<br />
<br />
<nowiki># When computing the context for a new x_selection or x_property</nowiki><br />
<nowiki># object, the type will be obtained from the source context.</nowiki><br />
<br />
default_type { x_selection x_property } source;<br />
</pre><br />
<br />
<br />
== default_range Rule ==<br />
Allows the default range or level to be taken from the source or target context when computing a new context for an object of the defined class. Requires policy version 27.<br />
<br />
'''The statement definition is:'''<br />
<pre><br />
default_range class default entry;<br />
</pre><br />
<br />
<br />
'''Where:'''<br />
<br />
{|border="1"<br />
| default_range<br />
| The default_range rule keyword.<br />
<br />
|-<br />
| class<br />
<br />
<br />
<br />
| One or more class identifiers. Multiple entries consist of a space separated list enclosed in braces ({}). <br />
<br />
Entries can be excluded from the list by using the negative operator (-).<br />
<br />
|-<br />
| default<br />
| A single keyword consisting of either <tt>source</tt> or <tt>target</tt> that will state whether the default level or range should be obtained from the source or target context.<br />
<br />
|-<br />
| entry<br />
| A single keyword consisting of either: <tt>low</tt>, <tt>high</tt> or <tt>low_high</tt> that will state whether the default level or range should be obtained from the source or target context.<br />
<br />
|}<br />
<br />
<br />
'''The statement is valid in:'''<br />
<br />
{|border="1"<br />
| <center>'''Monolithic Policy'''</center><br />
| <center>'''Base Policy'''</center><br />
| <center>'''Module Policy'''</center><br />
<br />
|-<br />
| <center>Yes</center><br />
| <center>Yes</center><br />
| <center>No</center><br />
<br />
|-<br />
| <center>'''Conditional Policy (if) Statement'''</center><br />
| <center>'''optional Statement'''</center><br />
| <center>'''require Statement'''</center><br />
<br />
|-<br />
| <center>No</center><br />
| <center>No</center><br />
| <center>No</center><br />
<br />
|}<br />
<br />
<br />
'''Example:'''<br />
<pre><br />
<nowiki># When computing the context for a new file object, the lower</nowiki><br />
<nowiki># level will be taken from the target context range.</nowiki><br />
<br />
default_range file target low;<br />
<br />
<nowiki># When computing the context for a new x_selection or x_property</nowiki><br />
<nowiki># object, the range will be obtained from the source context.</nowiki><br />
<br />
default_type { x_selection x_property } source low_high;<br />
</pre><br />
<br />
<br />
----<br />
<references/><br />
<br />
[[Category:Notebook]]</div>RichardHaines