RichardHaines: New page: = Type Enforcement and Attribute Statements = These statements share the same namespace, therefore the general convention is to use '_' as the final two characters of a type identifier to ...

RichardHaines — Sun, 29 Nov 2009 14:31:21 GMT

New page: = Type Enforcement and Attribute Statements = These statements share the same namespace, therefore the general convention is to use '_' as the final two characters of a type identifier to ...

New page

= Type Enforcement and Attribute Statements =
These statements share the same namespace, therefore the general convention is to use '_' as the final two characters of a type identifier to differentiate it from an attribute identifier as shown in the following examples:
<pre>
<nowiki># Statement</nowiki> Identifier Comment
<nowiki>#---------------------------------------------------</nowiki>
type bin_t;<nowiki> # A type identifier ends with _t</nowiki>
attribute file_type;<nowiki> # An attribute identifier ends with </nowiki>
<nowiki> # anything else</nowiki>
</pre>

== type Statement ==
The type statement declares the type identifier and any optional associated alias or attribute identifiers. Type identifiers are the main component of a Security Context.

'''The statement definition is:'''
<pre>
type type_id;
</pre>

'''Or'''
<pre>
type type_id ,attribute_id;
</pre>
'''Or'''
<pre>
type type_id alias alias_id;
</pre>
'''Or'''
<pre>
type type_id alias alias_id ,attribute_id;
</pre>

'''Where:'''
{|border="1"
|type
|The type keyword.

|-
|type_id
|The type identifier.

|-
|alias
|Optional alias keyword that signifies alternate identifiers for the type_id that are declared in the alias_id list.

|-
|alias_id
|One or more alias identifiers. Multiple entries consist of a space separated list enclosed in braces ({}).

|-
|attribute_id
|One or more optional attribute identifiers that have been previously declared by the attribute Statement. Multiple entries consist of a comma (,) separated list, also note the lead comma.

|}

'''The statement is valid in:'''
{|border="1"
|<center>'''Monolithic Policy'''</center>
|<center>'''Base Policy'''</center>
|<center>'''Module Policy'''</center>
|-
|<center>Yes</center>
|<center>Yes</center>
|<center>Yes</center>
|-
|<center>'''Conditional Policy (if) Statement'''</center>
|<center>'''optional Statement'''</center>
|<center>'''require Statement'''</center>
|-
|<center>No</center>
|<center>No</center>
|<center>Yes</center>
|}

'''Examples:'''
<pre>
<nowiki># Using the </nowiki>type statement to declare a type of shell_exec_t,
<nowiki># where </nowiki>exec_t is used to identify a file as an executable type.

type shell_exec_t;
</pre>

<pre>
<nowiki># Using the </nowiki>type statement to declare a type of bin_t, where
<nowiki># </nowiki>bin_t is used to identify a file as an ordinary program type.

type bin_t;
</pre>

<pre>
<nowiki># Using the </nowiki>type statement to declare a type of bin_t with two
<nowiki># alias names. The </nowiki>sbin_t is used to identify the file as a
<nowiki># system admin program type.</nowiki>

type bin_t alias { ls_exec_t sbin_t };
</pre>

<pre>
<nowiki># Using the </nowiki>type statement to declare a type of boolean_t that
<nowiki># also associates it to a previously declared attribute </nowiki>
<nowiki># </nowiki>booleans_type (see the attribute Statement).

attribute booleans_type;<nowiki># declare the attribute</nowiki>

type boolean_t, booleans_type;<nowiki># and associate with the type</nowiki>
</pre>

<pre>
<nowiki># Using the </nowiki>type statement to declare a type of setfiles_t that
<nowiki># also has an alias of </nowiki>restorecon_t and one previously declared
<nowiki># attribute of </nowiki>can_relabelto_binary_policy associated with it.

attribute can_relabelto_binary_policy;

type setfiles_t alias restorecon_t, can_relabelto_binary_policy;
</pre>

<pre>
<nowiki># Using the </nowiki>type statement to declare a type of
<nowiki># </nowiki>ssh_server_packet_t that also associates it to two previously
<nowiki># declared attributes </nowiki>packet_type and server_packet_type.

attribute packet_type<nowiki>;</nowiki><nowiki># declare attribute 1</nowiki>
attribute server_packet_type<nowiki>;</nowiki><nowiki># declare attribute 2</nowiki>

<nowiki># Associate the type identifier with the two attributes:</nowiki>

type ssh_server_packet_t, packet_type, server_packet_type;
</pre>

== attribute Statement ==
An attribute statement declares an identifier that can then be used to refer to a group of types.

'''The statement definition is:'''
<pre>
attribute attribute_id;
</pre>

'''Where:'''
{|border="1"
|attribute
|The attribute keyword.

|-
|attribute_id
|The attribute identifier.

|}

'''The statement is valid in:'''
{|border="1"
|<center>'''Monolithic Policy'''</center>
|<center>'''Base Policy'''</center>
|<center>'''Module Policy'''</center>

|-
|<center>Yes</center>
|<center>Yes</center>
|<center>Yes</center>

|-
|<center>'''Conditional Policy (if) Statement'''</center>
|<center>'''optional Statement'''</center>
|<center>'''require Statement'''</center>

|-
|<center>No</center>
|<center>Yes</center>
|<center>Yes</center>

|}

'''Examples:'''
<pre>
<nowiki># Using the </nowiki>attribute statement to declare attributes domain,
<nowiki># </nowiki>daemon, file_type and non_security_file_type:

attribute domain;
attribute daemon;
attribute file_type;
attribute non_security_file_type;
</pre>

== typeattribute Statement ==
The typeattribute statement allows the association of previously declared types to one or more previously declared attributes.

'''The statement definition is:'''
<pre>
<nowiki>typeattribute type_id attribute_id [ ,attribute_id ];</nowiki>
</pre>

'''Where:'''
{|border="1"
|typeattribute
|The typeattribute keyword.

|-
|type_id
|The identifier of a previously declared type.

|-
|attribute_id
|One or more previously declared attribute identifiers. Multiple entries consist of a comma (,) separated list.

|}

'''The statement is valid in:'''
{|border="1"
|<center>'''Monolithic Policy'''</center>
|<center>'''Base Policy'''</center>
|<center>'''Module Policy'''</center>

|-
|<center>Yes</center>
|<center>Yes</center>
|<center>Yes</center>

|-
|<center>'''Conditional Policy (if) Statement'''</center>
|<center>'''optional Statement'''</center>
|<center>'''require Statement'''</center>

|-
|<center>No</center>
|<center>Yes</center>
|<center>No</center>

|}

'''Examples:'''
<pre>
<nowiki># </nowiki>Using the typeattribute statement to associate a previously
<nowiki># declared type of</nowiki> setroubleshootd_t to a previously declared
<nowiki># </nowiki>domain attribute.
<nowiki># The previously declared attribute:</nowiki>

attribute domain;

<nowiki># The previously declared type:</nowiki>

type setroubleshootd_t;

<nowiki># The association using the typeattribute statement:</nowiki>

typeattribute setroubleshootd_t domain;

<nowiki># </nowiki>Using the typeattribute statement to associate a type of
<nowiki>#</nowiki> setroubleshootd_exec_t to two attributes file_type and
<nowiki># </nowiki>non_security_file_type.
<nowiki># These are the previously declared attributes:</nowiki>

attribute file_type;
attribute non_security_file_type;

<nowiki># The previously declared type:</nowiki>

type setroubleshootd_exec_t;

<nowiki># These are the associations using the </nowiki>typeattribute statement:

typeattribute setroubleshootd_exec_t file_type, non_security_file_type;
</pre>

== typealias Statement ==
The typealias statement allows the association of a previously declared type to one or more alias identifiers (an alternative way is to use the type Statement).

'''The statement definition is:'''
<pre>
typealias type_id alias alias_id;
</pre>

'''Where:'''
{|border="1"
|typealias
|The typealias keyword.

|-
|type_id
|The identifier of a previously declared type.

|-
|alias
|The alias keyword.

|-
|alias_id
|One or more alias identifiers. Multiple entries consist of a space separated list enclosed in braces ({}).

|}

'''The statement is valid in:'''
{|border="1"
|<center>'''Monolithic Policy'''</center>
|<center>'''Base Policy'''</center>
|<center>'''Module Policy'''</center>

|-
|<center>Yes</center>
|<center>Yes</center>
|<center>Yes</center>

|-
|<center>'''Conditional Policy (if) Statement'''</center>
|<center>'''optional Statement'''</center>
|<center>'''require Statement'''</center>

|-
|<center>No</center>
|<center>Yes</center>
|<center>No</center>

|}

'''Examples:'''
<pre>
<nowiki># Using the </nowiki>typealias statement to associate the previously
<nowiki># declared type </nowiki>mount_t with an alias of mount_ntfs_t.
<nowiki># Declare the type:</nowiki>

type mount_t;

<nowiki># Then alias the identifier:</nowiki>

typealias mount_t alias mount_ntfs_t;
</pre>

<pre>
<nowiki># Using the </nowiki>typealias statement to associate the previously
<nowiki># declared type </nowiki>netif_t with two alias, lo_netif_t and netif_lo_t.
<nowiki># Declare the type:</nowiki>

type netif_t;

<nowiki># Then assign two alias identifiers </nowiki>lo_netif_t and netif_lo_t:

typealias netif_t alias { lo_netif_t netif_lo_t };
</pre>

TypeStatements - Revision history

RichardHaines: New page: = Type Enforcement and Attribute Statements = These statements share the same namespace, therefore the general convention is to use '_' as the final two characters of a type identifier to ...