RichardHaines: New page: = Xen Statements = Xen policy supports additional policy language statements: `iomemcon`, `ioportcon`, `pcidevicecon` and `pirqcon` that are discussed in the se...

RichardHaines — Mon, 19 Nov 2012 13:43:00 GMT

New page: = Xen Statements = Xen policy supports additional policy language statements: <tt>iomemcon</tt>, <tt>ioportcon</tt>, <tt>pcidevicecon</tt> and <tt>pirqcon</tt> that are discussed in the se...

New page

= Xen Statements =
Xen policy supports additional policy language statements: <tt>iomemcon</tt>, <tt>ioportcon</tt>, <tt>pcidevicecon</tt> and <tt>pirqcon</tt> that are discussed in the sections that follow.

To compile these additional statements using <tt>'''semodule'''(8)</tt>, ensure that the <tt>'''semanage.conf'''(5)</tt> file has the <tt>policy-target=xen</tt> entry.

== iomemcon Statement ==
The sid statement declares the actual SID identifier and is defined at the start of a policy source file.

'''The statement definition is:'''
<pre>
iomemcon addr context;
</pre>

'''Where:'''
{|border="1"
| iomemcon
| The iomemcon keyword.

|-
| addr
| The memory address to apply the context. This may also be a range that consists of a start and end address separated by a hypen ('<tt>-</tt>').

|-
| context
| The security context to be applied.

|}

'''The statement is valid in:'''
{|border="1"
| <center>'''Monolithic Policy'''</center>
| <center>'''Base Policy'''</center>
| <center>'''Module Policy'''</center>

|-
| <center>Yes</center>
| <center>Yes</center>
| <center>No</center>

|-
| <center>'''Conditional Policy (if]) Statement'''</center>
| <center>'''optional Statement'''</center>
| <center>'''require Statement'''</center>

|-
| <center>No</center>
| <center>No</center>
| <center>No</center>

|}

'''Example:'''
<pre>
iomemcon 0xfebd9 system_u:object_r:nicP_t;

iomemcon 0xfebe0-0xfebff system_u:object_r:nicP_t;
</pre>

== ioportcon Statement ==
The sid statement declares the actual SID identifier and is defined at the start of a policy source file.

'''The statement definition is:'''
<pre>
ioportcon port context;
</pre>

'''Where:'''
{|border="1"
| ioportcon
| The ioportcon keyword.

|-
| port
| The port to apply the context. This may also be a range that consists of a start and end port number separated by a hypen ('<tt>-</tt>').

|-
| context
| The security context to be applied.

|}

'''The statement is valid in:'''
{|border="1"
| <center>'''Monolithic Policy'''</center>
| <center>'''Base Policy'''</center>
| <center>'''Module Policy'''</center>

|-
| <center>Yes</center>
| <center>Yes</center>
| <center>No</center>

|-
| <center>'''Conditional Policy (if]) Statement'''</center>
| <center>'''optional Statement'''</center>
| <center>'''require Statement'''</center>

|-
| <center>No</center>
| <center>No</center>
| <center>No</center>

|}

'''Example:'''
<pre>
ioportcon 0xeac0 system_u:object_r:nicP_t;

ioportcon 0xecc0-0xecdf system_u:object_r:nicP_t;
</pre>

== pcidevicecon Statement ==
The sid statement declares the actual SID identifier and is defined at the start of a policy source file.

'''The statement definition is:'''
<pre>
pcidevicecon pci_id context;
</pre>

'''Where:'''
{|border="1"
| pcidevicecon
| The pcidevicecon keyword.

|-
| pci_id
| The PCI indentifer.

|-
| context
| The security context to be applied.

|}

'''The statement is valid in:'''
{|border="1"
| <center>'''Monolithic Policy'''</center>
| <center>'''Base Policy'''</center>
| <center>'''Module Policy'''</center>

|-
| <center>Yes</center>
| <center>Yes</center>
| <center>No</center>

|-
| <center>'''Conditional Policy (if]) Statement'''</center>
| <center>'''optional Statement'''</center>
| <center>'''require Statement'''</center>

|-
| <center>No</center>
| <center>No</center>
| <center>No</center>

|}

'''Example:'''
<pre>
pcidevicecon 0xc800 system_u:object_r:nicP_t;
</pre>

== pirqcon Statement ==
The sid statement declares the actual SID identifier and is defined at the start of a policy source file.

'''The statement definition is:'''
<pre>
pirqcon irq context;
</pre>

'''Where:'''
{|border="1"
| pirqcon
| The pirqcon keyword.

|-
| irq
| The interrupt request number.

|-
| context
| The security context to be applied.

|}

'''The statement is valid in:'''
{|border="1"
| <center>'''Monolithic Policy'''</center>
| <center>'''Base Policy'''</center>
| <center>'''Module Policy'''</center>

|-
| <center>Yes</center>
| <center>Yes</center>
| <center>No</center>

|-
| <center>'''Conditional Policy (if]) Statement'''</center>
| <center>'''optional Statement'''</center>
| <center>'''require Statement'''</center>

|-
| <center>No</center>
| <center>No</center>
| <center>No</center>

|}

'''Example:'''
<pre>
pirqcon 33 system_u:object_r:nicP_t;
</pre>

----
<references/>

[[Category:Notebook]]

XENStatements - Revision history

RichardHaines: New page: = Xen Statements = Xen policy supports additional policy language statements: iomemcon, ioportcon, pcidevicecon and pirqcon that are discussed in the se...

RichardHaines: New page: = Xen Statements = Xen policy supports additional policy language statements: `iomemcon`, `ioportcon`, `pcidevicecon` and `pirqcon` that are discussed in the se...