xref: /aosp_15_r20/external/selinux/secilc/docs/cil_reference_guide.md (revision 2d543d20722ada2425b5bdab9d0d1d29470e7bba)
1*2d543d20SAndroid Build Coastguard WorkerCIL Information
2*2d543d20SAndroid Build Coastguard Worker===============
3*2d543d20SAndroid Build Coastguard Worker
4*2d543d20SAndroid Build Coastguard Worker1.  Not all possible alternate statement permutations are shown, however there should be enough variation to work out any other valid formats. There is also an example [`policy.cil`](../test/policy.cil#example-policy) file in the test directory.
5*2d543d20SAndroid Build Coastguard Worker
6*2d543d20SAndroid Build Coastguard Worker2.  The MLS components on contexts and user statements must be declared even if the policy does not support MCS/MLS.
7*2d543d20SAndroid Build Coastguard Worker
8*2d543d20SAndroid Build Coastguard Worker3.  The CIL compiler will not build a policy unless it also has as a minimum: one [`allow`](cil_access_vector_rules.md#allow) rule, one [`sid`](cil_sid_statements.md#sid), [`sidorder`](cil_sid_statements.md#sidorder) and [`sidcontext`](cil_sid_statements.md#sidcontext) statement.
9*2d543d20SAndroid Build Coastguard Worker
10*2d543d20SAndroid Build Coastguard Worker4.  The role `object_r` must be explicitly associated to contexts used for labeling objects. The original **`checkpolicy`**`(8)` and **`checkmodule`**`(8)` compilers did this by default - CIL does not.
11*2d543d20SAndroid Build Coastguard Worker
12*2d543d20SAndroid Build Coastguard Worker5.  Be aware that CIL allows [`class`](cil_class_and_permission_statements.md#class) statements to be declared in a namespace, however the policy author needs to note that applications (and the kernel) generally reference a class by its well known class identifier (e.g. `zygote`) however if declared in a namespace (e.g. `(block zygote (class zygote (...)))` or `(block zygote (class class (...)))`) it would be prefixed with that namespace (e.g. `zygote.zygote` or `zygote.class`). Unless the application / kernel code was updated the class would never be resolved, therefore it is recommended that classes are declared in the global namespace.
13*2d543d20SAndroid Build Coastguard Worker
14*2d543d20SAndroid Build Coastguard Worker6.  Where possible use [`typeattribute`](cil_type_statements.md#typeattribute)'s when defining source/target [`allow`](cil_access_vector_rules.md#allow) rules instead of multiple [`allow`](cil_access_vector_rules.md#allow) rules with individual [`type`](cil_type_statements.md#type)'s. This will lead to the generation of much smaller kernel policy files.
15*2d543d20SAndroid Build Coastguard Worker
16*2d543d20SAndroid Build Coastguard Worker7.  The [](http://github.com/SELinuxProject/cil/wiki) site explains the language however some of the statement definitions are dated.
17*2d543d20SAndroid Build Coastguard Worker
18*2d543d20SAndroid Build Coastguard WorkerDeclarations
19*2d543d20SAndroid Build Coastguard Worker------------
20*2d543d20SAndroid Build Coastguard Worker
21*2d543d20SAndroid Build Coastguard WorkerDeclarations may be named or anonymous and have three different forms:
22*2d543d20SAndroid Build Coastguard Worker
23*2d543d20SAndroid Build Coastguard Worker1.  Named declarations - These create new objects that introduce a name or identifier, for example:
24*2d543d20SAndroid Build Coastguard Worker
25*2d543d20SAndroid Build Coastguard Worker    `(type process)` - creates a [`type`](cil_type_statements.md#type) with an identifier of `process`.
26*2d543d20SAndroid Build Coastguard Worker
27*2d543d20SAndroid Build Coastguard Worker    `(typeattribute domain)` - creates a [`typeattribute`](cil_type_statements.md#typeattribute) with an identifier of `domain`.
28*2d543d20SAndroid Build Coastguard Worker
29*2d543d20SAndroid Build Coastguard Worker    `(class file (read write))` - creates a [`class`](cil_class_and_permission_statements.md#class) with an identifier of `file` that has `read` and `write` permissions associated to it.
30*2d543d20SAndroid Build Coastguard Worker
31*2d543d20SAndroid Build Coastguard Worker    The list of declaration type statement keywords are:
32*2d543d20SAndroid Build Coastguard Worker
33*2d543d20SAndroid Build Coastguard Worker    block
34*2d543d20SAndroid Build Coastguard Worker    optional
35*2d543d20SAndroid Build Coastguard Worker    common
36*2d543d20SAndroid Build Coastguard Worker    class
37*2d543d20SAndroid Build Coastguard Worker    classmap
38*2d543d20SAndroid Build Coastguard Worker    classmapping
39*2d543d20SAndroid Build Coastguard Worker    sid
40*2d543d20SAndroid Build Coastguard Worker    user
41*2d543d20SAndroid Build Coastguard Worker    role
42*2d543d20SAndroid Build Coastguard Worker    roleattribute
43*2d543d20SAndroid Build Coastguard Worker    type
44*2d543d20SAndroid Build Coastguard Worker    classpermission
45*2d543d20SAndroid Build Coastguard Worker    classpermissionset
46*2d543d20SAndroid Build Coastguard Worker    typeattribute
47*2d543d20SAndroid Build Coastguard Worker    typealias
48*2d543d20SAndroid Build Coastguard Worker    tunable
49*2d543d20SAndroid Build Coastguard Worker    sensitivity
50*2d543d20SAndroid Build Coastguard Worker    sensitivityalias
51*2d543d20SAndroid Build Coastguard Worker    category
52*2d543d20SAndroid Build Coastguard Worker    categoryalias
53*2d543d20SAndroid Build Coastguard Worker    categoryset
54*2d543d20SAndroid Build Coastguard Worker    level
55*2d543d20SAndroid Build Coastguard Worker    levelrange
56*2d543d20SAndroid Build Coastguard Worker    context
57*2d543d20SAndroid Build Coastguard Worker    ipaddr
58*2d543d20SAndroid Build Coastguard Worker    macro
59*2d543d20SAndroid Build Coastguard Worker    policycap
60*2d543d20SAndroid Build Coastguard Worker
61*2d543d20SAndroid Build Coastguard Worker2.  Explicit anonymous declarations - These are currently restricted to IP addresses where they can be declared directly in statements by enclosing them within parentheses e.g. `(127.0.0.1)` or `(::1)`. See the [Network Labeling Statements](#network_labeling) section for examples.
62*2d543d20SAndroid Build Coastguard Worker
63*2d543d20SAndroid Build Coastguard Worker3.  Anonymous declarations - These have been previously declared and the object already exists, therefore they may be referenced by their name or identifier within statements. For example the following declare all the components required to specify a context:
64*2d543d20SAndroid Build Coastguard Worker
65*2d543d20SAndroid Build Coastguard Worker    ```secil
66*2d543d20SAndroid Build Coastguard Worker        (sensitivity s0)
67*2d543d20SAndroid Build Coastguard Worker        (category c0)
68*2d543d20SAndroid Build Coastguard Worker        (role object_r)
69*2d543d20SAndroid Build Coastguard Worker
70*2d543d20SAndroid Build Coastguard Worker        (block unconfined
71*2d543d20SAndroid Build Coastguard Worker            (user user)
72*2d543d20SAndroid Build Coastguard Worker            (type object)
73*2d543d20SAndroid Build Coastguard Worker        )
74*2d543d20SAndroid Build Coastguard Worker    ```
75*2d543d20SAndroid Build Coastguard Worker
76*2d543d20SAndroid Build Coastguard Worker    now a [`portcon`](cil_network_labeling_statements.md#portcon) statement can be defined that uses these individual components to build a context as follows:
77*2d543d20SAndroid Build Coastguard Worker
78*2d543d20SAndroid Build Coastguard Worker    ```secil
79*2d543d20SAndroid Build Coastguard Worker        (portcon udp 12345 (unconfined.user object_r unconfined.object ((s0) (s0(c0)))))
80*2d543d20SAndroid Build Coastguard Worker    ```
81*2d543d20SAndroid Build Coastguard Worker
82*2d543d20SAndroid Build Coastguard WorkerDefinitions
83*2d543d20SAndroid Build Coastguard Worker-----------
84*2d543d20SAndroid Build Coastguard Worker
85*2d543d20SAndroid Build Coastguard WorkerStatements that build on the objects, for example:
86*2d543d20SAndroid Build Coastguard Worker
87*2d543d20SAndroid Build Coastguard Worker-   `(typeattributeset domain (process))` - Adds the [`type`](cil_type_statements.md#type) '`process`' to the [`typeattribute`](cil_type_statements.md#typeattribute) '`domain`'.
88*2d543d20SAndroid Build Coastguard Worker
89*2d543d20SAndroid Build Coastguard Worker-   `(allow domain process (file (read write))))` - Adds an [`allow`](cil_access_vector_rules.md#allow) rule referencing `domain`, `process` and the `file class`.
90*2d543d20SAndroid Build Coastguard Worker
91*2d543d20SAndroid Build Coastguard WorkerDefinitions may be repeated many times throughout the policy. Duplicates will resolve to a single definition during compilation.
92*2d543d20SAndroid Build Coastguard Worker
93*2d543d20SAndroid Build Coastguard WorkerSymbol Character Set
94*2d543d20SAndroid Build Coastguard Worker--------------------
95*2d543d20SAndroid Build Coastguard Worker
96*2d543d20SAndroid Build Coastguard WorkerSymbols (any string not enclosed in double quotes) must only contain alphanumeric `[a-z A-Z] [0-9]` characters plus the following special characters: `\.@=/-_$%@+!|&^:`
97*2d543d20SAndroid Build Coastguard Worker
98*2d543d20SAndroid Build Coastguard WorkerHowever symbols are checked for any specific character set limitations, for example:
99*2d543d20SAndroid Build Coastguard Worker
100*2d543d20SAndroid Build Coastguard Worker-   Names or identifiers must start with an alpa character `[a-z A-Z]`, the remainder may be alphanumeric `[a-z A-Z] [0-9]` characters plus underscore `[_]` or hyphen `[-]`.
101*2d543d20SAndroid Build Coastguard Worker
102*2d543d20SAndroid Build Coastguard Worker-   IP addresses must conform to IPv4 or IPv6 format.
103*2d543d20SAndroid Build Coastguard Worker
104*2d543d20SAndroid Build Coastguard Worker-   Memory, ports, irqs must be numeric `[0-9]`.
105*2d543d20SAndroid Build Coastguard Worker
106*2d543d20SAndroid Build Coastguard WorkerString Character Set
107*2d543d20SAndroid Build Coastguard Worker--------------------
108*2d543d20SAndroid Build Coastguard Worker
109*2d543d20SAndroid Build Coastguard WorkerStrings are enclosed within double quotes (e.g. `"This is a string"`), and may contain any character except the double quote (").
110*2d543d20SAndroid Build Coastguard Worker
111*2d543d20SAndroid Build Coastguard WorkerComments
112*2d543d20SAndroid Build Coastguard Worker--------
113*2d543d20SAndroid Build Coastguard Worker
114*2d543d20SAndroid Build Coastguard WorkerComments start with a semicolon '`;`' and end when a new line is started.
115*2d543d20SAndroid Build Coastguard Worker
116*2d543d20SAndroid Build Coastguard WorkerNamespaces
117*2d543d20SAndroid Build Coastguard Worker----------
118*2d543d20SAndroid Build Coastguard Worker
119*2d543d20SAndroid Build Coastguard WorkerCIL supports namespaces via containers such as the [`block`](cil_container_statements.md#block) statement. When a block is resolved to form the parent / child relationship a dot '`.`' is used, for example the following [`allow`](cil_access_vector_rules.md#allow) rule:
120*2d543d20SAndroid Build Coastguard Worker
121*2d543d20SAndroid Build Coastguard Worker```secil
122*2d543d20SAndroid Build Coastguard Worker    (block example_ns
123*2d543d20SAndroid Build Coastguard Worker        (type process)
124*2d543d20SAndroid Build Coastguard Worker        (type object)
125*2d543d20SAndroid Build Coastguard Worker        (class file (open read write getattr))
126*2d543d20SAndroid Build Coastguard Worker
127*2d543d20SAndroid Build Coastguard Worker        (allow process object (file (open read getattr)))
128*2d543d20SAndroid Build Coastguard Worker    )
129*2d543d20SAndroid Build Coastguard Worker```
130*2d543d20SAndroid Build Coastguard Worker
131*2d543d20SAndroid Build Coastguard Workerwill resolve to the following kernel policy language statement:
132*2d543d20SAndroid Build Coastguard Worker
133*2d543d20SAndroid Build Coastguard Worker```
134*2d543d20SAndroid Build Coastguard Worker    allow example_ns.process example_ns.object : example_ns.file { open read getattr };
135*2d543d20SAndroid Build Coastguard Worker```
136*2d543d20SAndroid Build Coastguard Worker
137*2d543d20SAndroid Build Coastguard WorkerGlobal Namespace
138*2d543d20SAndroid Build Coastguard Worker----------------
139*2d543d20SAndroid Build Coastguard Worker
140*2d543d20SAndroid Build Coastguard WorkerCIL has a global namespace that is always present. Any symbol that is declared outside a container is in the global namespace. To reference a symbol in global namespace, the symbol should be prefixed with a dot '`.`' as shown in the following example:
141*2d543d20SAndroid Build Coastguard Worker
142*2d543d20SAndroid Build Coastguard Worker```secil
143*2d543d20SAndroid Build Coastguard Worker    ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
144*2d543d20SAndroid Build Coastguard Worker    ; This example has three namespace 'tmpfs' types declared:
145*2d543d20SAndroid Build Coastguard Worker    ;    1) Global .tmpfs
146*2d543d20SAndroid Build Coastguard Worker    ;    2) file.tmpfs
147*2d543d20SAndroid Build Coastguard Worker    ;    3) other_ns.tmpfs
148*2d543d20SAndroid Build Coastguard Worker    ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
149*2d543d20SAndroid Build Coastguard Worker
150*2d543d20SAndroid Build Coastguard Worker    ; This type is the global tmpfs:
151*2d543d20SAndroid Build Coastguard Worker    (type tmpfs)
152*2d543d20SAndroid Build Coastguard Worker
153*2d543d20SAndroid Build Coastguard Worker    (block file
154*2d543d20SAndroid Build Coastguard Worker        ; file namespace tmpfs
155*2d543d20SAndroid Build Coastguard Worker        (type tmpfs)
156*2d543d20SAndroid Build Coastguard Worker        (class file (open read write getattr))
157*2d543d20SAndroid Build Coastguard Worker
158*2d543d20SAndroid Build Coastguard Worker        ; This rule will reference the local namespace for src and tgt:
159*2d543d20SAndroid Build Coastguard Worker        (allow tmpfs tmpfs (file (open)))
160*2d543d20SAndroid Build Coastguard Worker        ; Resulting policy rule:
161*2d543d20SAndroid Build Coastguard Worker        ; allow file.tmpfs file.tmpfs : file.file open;
162*2d543d20SAndroid Build Coastguard Worker
163*2d543d20SAndroid Build Coastguard Worker        ; This rule will reference the local namespace for src and global for tgt:
164*2d543d20SAndroid Build Coastguard Worker        (allow tmpfs .tmpfs (file (read)))
165*2d543d20SAndroid Build Coastguard Worker        ; Resulting policy rule:
166*2d543d20SAndroid Build Coastguard Worker        ; allow file.tmpfs tmpfs : file.file read;
167*2d543d20SAndroid Build Coastguard Worker
168*2d543d20SAndroid Build Coastguard Worker        ; This rule will reference the global namespace for src and tgt:
169*2d543d20SAndroid Build Coastguard Worker        (allow .tmpfs .tmpfs (file (write)))
170*2d543d20SAndroid Build Coastguard Worker        ; Resulting policy rule:
171*2d543d20SAndroid Build Coastguard Worker        ; allow tmpfs tmpfs : file.file write;
172*2d543d20SAndroid Build Coastguard Worker
173*2d543d20SAndroid Build Coastguard Worker        ; This rule will reference the other_ns namespace for src and
174*2d543d20SAndroid Build Coastguard Worker        ; local namespace for tgt:
175*2d543d20SAndroid Build Coastguard Worker        (allow other_ns.tmpfs tmpfs (file (getattr)))
176*2d543d20SAndroid Build Coastguard Worker        ; Resulting policy rule:
177*2d543d20SAndroid Build Coastguard Worker        ; allow other_ns.tmpfs file.tmpfs : file.file getattr;
178*2d543d20SAndroid Build Coastguard Worker    )
179*2d543d20SAndroid Build Coastguard Worker
180*2d543d20SAndroid Build Coastguard Worker    (block other_ns
181*2d543d20SAndroid Build Coastguard Worker        (type tmpfs)
182*2d543d20SAndroid Build Coastguard Worker    )
183*2d543d20SAndroid Build Coastguard Worker```
184*2d543d20SAndroid Build Coastguard Worker
185*2d543d20SAndroid Build Coastguard WorkerShould the symbol not be prefixed with a dot, the current namespace would be searched first and then the global namespace (provided there is not a symbol of that name in the current namespace).
186*2d543d20SAndroid Build Coastguard Worker
187*2d543d20SAndroid Build Coastguard WorkerExpressions
188*2d543d20SAndroid Build Coastguard Worker-----------
189*2d543d20SAndroid Build Coastguard Worker
190*2d543d20SAndroid Build Coastguard WorkerExpressions may occur in the following CIL statements: [`booleanif`](cil_conditional_statements.md#booleanif), [`tunableif`](cil_conditional_statements.md#tunableif), [`classpermissionset`](cil_class_and_permission_statements.md#classpermissionset), [`typeattributeset`](cil_type_statements.md#typeattributeset), [`roleattributeset`](cil_role_statements.md#roleattributeset), [`categoryset`](cil_mls_labeling_statements.md#categoryset), [`constrain`](cil_constraint_statements.md#constrain), [`mlsconstrain`](cil_constraint_statements.md#mlsconstrain), [`validatetrans`](cil_constraint_statements.md#validatetrans), [`mlsvalidatetrans`](cil_constraint_statements.md#mlsvalidatetrans)
191*2d543d20SAndroid Build Coastguard Worker
192*2d543d20SAndroid Build Coastguard WorkerCIL expressions use the [prefix](http://www.cs.man.ac.uk/~pjj/cs212/fix.html) or Polish notation and may be nested (note that the kernel policy language uses infix notation). The syntax is as follows, where the parenthesis are part of the syntax:
193*2d543d20SAndroid Build Coastguard Worker
194*2d543d20SAndroid Build Coastguard Worker```
195*2d543d20SAndroid Build Coastguard Worker    expr_set = (name ... | expr ...)
196*2d543d20SAndroid Build Coastguard Worker    expr = (expr_key expr_set ...)
197*2d543d20SAndroid Build Coastguard Worker    expr_key = and | or | xor | not | all | eq | neq | dom | domby | incomp | range
198*2d543d20SAndroid Build Coastguard Worker```
199*2d543d20SAndroid Build Coastguard Worker
200*2d543d20SAndroid Build Coastguard WorkerThe number of `expr_set`'s in an `expr` is dependent on the statement type (there are four different classes as defined below) that also influence the valid `expr_key` entries (e.g. `dom`, `domby`, `incomp` are only allowed in constraint statements).
201*2d543d20SAndroid Build Coastguard Worker
202*2d543d20SAndroid Build Coastguard Worker| expr_key | classpermissionset roleattributeset typeattributeset | categoryset | booleanif tunableif | constrain mlsconstrain validatetrans mlsvalidatetrans |
203*2d543d20SAndroid Build Coastguard Worker|:----------:|:----------:|:----------:|:----------:|:----------:|
204*2d543d20SAndroid Build Coastguard Worker| **`dom`**    |                        |                      |                      | **X**           |
205*2d543d20SAndroid Build Coastguard Worker| **`domby`**  |                        |                      |                      | **X**           |
206*2d543d20SAndroid Build Coastguard Worker| **`incomp`** |                        |                      |                      | **X**           |
207*2d543d20SAndroid Build Coastguard Worker| **`eq`**     |                        |                      | **X**                | **X**           |
208*2d543d20SAndroid Build Coastguard Worker| **`ne`**     |                        |                      | **X**                | **X**           |
209*2d543d20SAndroid Build Coastguard Worker| **`and`**    | **X**                  | **X**                | **X**                | **X**           |
210*2d543d20SAndroid Build Coastguard Worker| **`or`**     | **X**                  | **X**                | **X**                | **X**           |
211*2d543d20SAndroid Build Coastguard Worker| **`not`**    | **X**                  | **X**                | **X**                | **X**           |
212*2d543d20SAndroid Build Coastguard Worker| **`xor`**    | **X**                  | **X**                | **X**                |                 |
213*2d543d20SAndroid Build Coastguard Worker| **`all`**    | **X**                  | **X**                |                      |                 |
214*2d543d20SAndroid Build Coastguard Worker| **`range`**  |                        | **X**                |                      |                 |
215*2d543d20SAndroid Build Coastguard Worker
216*2d543d20SAndroid Build Coastguard Worker1.  The [`classpermissionset`](cil_class_and_permission_statements.md#classpermissionset), [`roleattributeset`](cil_role_statements.md#roleattributeset) and [`typeattributeset`](cil_type_statements.md#typeattributeset) statements allow `expr_set` to mix names and `expr`s with `expr_key` values of: `and`, `or`, `xor`, `not`, `all` as shown in the examples:
217*2d543d20SAndroid Build Coastguard Worker
218*2d543d20SAndroid Build Coastguard Worker    This example includes all `fs_type type` entries except `file.usermodehelper` and `file.proc_security` in the associated [`typeattribute`](cil_type_statements.md#typeattribute) identifier `all_fs_type_except_usermodehelper_and_proc_security`:
219*2d543d20SAndroid Build Coastguard Worker
220*2d543d20SAndroid Build Coastguard Worker    ```secil
221*2d543d20SAndroid Build Coastguard Worker        (typeattribute all_fs_type_except_usermodehelper_and_proc_security)
222*2d543d20SAndroid Build Coastguard Worker
223*2d543d20SAndroid Build Coastguard Worker        (typeattributeset all_fs_type_except_usermodehelper_and_proc_security
224*2d543d20SAndroid Build Coastguard Worker            (and
225*2d543d20SAndroid Build Coastguard Worker                (and
226*2d543d20SAndroid Build Coastguard Worker                    fs_type
227*2d543d20SAndroid Build Coastguard Worker                    (not file.usermodehelper)
228*2d543d20SAndroid Build Coastguard Worker                )
229*2d543d20SAndroid Build Coastguard Worker                (not file.proc_security)
230*2d543d20SAndroid Build Coastguard Worker            )
231*2d543d20SAndroid Build Coastguard Worker        )
232*2d543d20SAndroid Build Coastguard Worker    ```
233*2d543d20SAndroid Build Coastguard Worker
234*2d543d20SAndroid Build Coastguard Worker    The `cps_1 classpermissionset` identifier includes all permissions except `load_policy` and `setenforce`:
235*2d543d20SAndroid Build Coastguard Worker
236*2d543d20SAndroid Build Coastguard Worker    ```secil
237*2d543d20SAndroid Build Coastguard Worker        (class security (compute_av compute_create compute_member check_context load_policy compute_relabel compute_user setenforce setbool setsecparam setcheckreqprot read_policy))
238*2d543d20SAndroid Build Coastguard Worker
239*2d543d20SAndroid Build Coastguard Worker        (classpermission cps_1)
240*2d543d20SAndroid Build Coastguard Worker
241*2d543d20SAndroid Build Coastguard Worker        (classpermissionset cps_1 (security (not (load_policy setenforce))))
242*2d543d20SAndroid Build Coastguard Worker    ```
243*2d543d20SAndroid Build Coastguard Worker
244*2d543d20SAndroid Build Coastguard Worker    This example includes all permissions in the associated [`classpermissionset`](cil_class_and_permission_statements.md#classpermissionset) identifier `security_all_perms`:
245*2d543d20SAndroid Build Coastguard Worker
246*2d543d20SAndroid Build Coastguard Worker    ```secil
247*2d543d20SAndroid Build Coastguard Worker        (class security (compute_av compute_create compute_member check_context load_policy
248*2d543d20SAndroid Build Coastguard Worker            compute_relabel compute_user setenforce setbool setsecparam setcheckreqprot
249*2d543d20SAndroid Build Coastguard Worker            read_policy)
250*2d543d20SAndroid Build Coastguard Worker        )
251*2d543d20SAndroid Build Coastguard Worker
252*2d543d20SAndroid Build Coastguard Worker        (classpermission security_all_perms)
253*2d543d20SAndroid Build Coastguard Worker
254*2d543d20SAndroid Build Coastguard Worker        (classpermissionset security_all_perms (security (all)))
255*2d543d20SAndroid Build Coastguard Worker    ```
256*2d543d20SAndroid Build Coastguard Worker
257*2d543d20SAndroid Build Coastguard Worker2.  The [`categoryset`](cil_mls_labeling_statements.md#categoryset) statement allows `expr_set` to mix names and `expr_key` values of: `and`, `or`, `not`, `xor`, `all`, `range` as shown in the examples.
258*2d543d20SAndroid Build Coastguard Worker
259*2d543d20SAndroid Build Coastguard Worker    Category expressions are also allowed in [`sensitivitycategory`](cil_mls_labeling_statements.md#sensitivitycategory), [`level`](cil_mls_labeling_statements.md#level), and [`levelrange`](cil_mls_labeling_statements.md#levelrange) statements.
260*2d543d20SAndroid Build Coastguard Worker
261*2d543d20SAndroid Build Coastguard Worker3.  The [`booleanif`](cil_conditional_statements.md#booleanif) and [`tunableif`](cil_conditional_statements.md#tunableif) statements only allow an `expr_set` to have one `name` or `expr` with `expr_key` values of `and`, `or`, `xor`, `not`, `eq`, `neq` as shown in the examples:
262*2d543d20SAndroid Build Coastguard Worker
263*2d543d20SAndroid Build Coastguard Worker    ```secil
264*2d543d20SAndroid Build Coastguard Worker        (booleanif disableAudio
265*2d543d20SAndroid Build Coastguard Worker            (false
266*2d543d20SAndroid Build Coastguard Worker                (allow process device.audio_device (chr_file_set (rw_file_perms)))
267*2d543d20SAndroid Build Coastguard Worker            )
268*2d543d20SAndroid Build Coastguard Worker        )
269*2d543d20SAndroid Build Coastguard Worker
270*2d543d20SAndroid Build Coastguard Worker        (booleanif (and (not disableAudio) (not disableAudioCapture))
271*2d543d20SAndroid Build Coastguard Worker            (true
272*2d543d20SAndroid Build Coastguard Worker                (allow process device.audio_capture_device (chr_file_set (rw_file_perms)))
273*2d543d20SAndroid Build Coastguard Worker            )
274*2d543d20SAndroid Build Coastguard Worker        )
275*2d543d20SAndroid Build Coastguard Worker    ```
276*2d543d20SAndroid Build Coastguard Worker
277*2d543d20SAndroid Build Coastguard Worker4.  The [`constrain`](cil_constraint_statements.md#constrain), [`mlsconstrain`](cil_constraint_statements.md#mlsconstrain), [`validatetrans`](cil_constraint_statements.md#validatetrans) and [`mlsvalidatetrans`](cil_constraint_statements.md#mlsvalidatetrans) statements only allow an `expr_set` to have one `name` or `expr` with `expr_key` values of `and`, `or`, `not`, `all`, `eq`, `neq`, `dom`, `domby`, `incomp`. When `expr_key` is `dom`, `domby` or `incomp`, it must be followed by a string (e.g. `h1`, `l2`) and another string or a set of `name`s. The following examples show CIL constraint statements and their policy language equivalents:
278*2d543d20SAndroid Build Coastguard Worker
279*2d543d20SAndroid Build Coastguard Worker    ```secil
280*2d543d20SAndroid Build Coastguard Worker        ; Process transition:  Require equivalence unless the subject is trusted.
281*2d543d20SAndroid Build Coastguard Worker        (mlsconstrain (process (transition dyntransition))
282*2d543d20SAndroid Build Coastguard Worker            (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
283*2d543d20SAndroid Build Coastguard Worker
284*2d543d20SAndroid Build Coastguard Worker        ; The equivalent policy language mlsconstrain statement is:
285*2d543d20SAndroid Build Coastguard Worker        ;mlsconstrain process { transition dyntransition }
286*2d543d20SAndroid Build Coastguard Worker        ;    ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject);
287*2d543d20SAndroid Build Coastguard Worker
288*2d543d20SAndroid Build Coastguard Worker        ; Process read operations: No read up unless trusted.
289*2d543d20SAndroid Build Coastguard Worker        (mlsconstrain (process (getsched getsession getpgid getcap getattr ptrace share))
290*2d543d20SAndroid Build Coastguard Worker            (or (dom l1 l2) (eq t1 mlstrustedsubject)))
291*2d543d20SAndroid Build Coastguard Worker
292*2d543d20SAndroid Build Coastguard Worker        ; The equivalent policy language mlsconstrain statement is:
293*2d543d20SAndroid Build Coastguard Worker        ;mlsconstrain process { getsched getsession getpgid getcap getattr ptrace share }
294*2d543d20SAndroid Build Coastguard Worker        ;    (l1 dom l2 or t1 == mlstrustedsubject);
295*2d543d20SAndroid Build Coastguard Worker    ```
296*2d543d20SAndroid Build Coastguard Worker
297*2d543d20SAndroid Build Coastguard WorkerName String
298*2d543d20SAndroid Build Coastguard Worker-----------
299*2d543d20SAndroid Build Coastguard Worker
300*2d543d20SAndroid Build Coastguard WorkerUsed to define [`macro`](cil_call_macro_statements.md#macro) statement parameter string types:
301*2d543d20SAndroid Build Coastguard Worker
302*2d543d20SAndroid Build Coastguard Worker```secil
303*2d543d20SAndroid Build Coastguard Worker    (call macro1("__kmsg__"))
304*2d543d20SAndroid Build Coastguard Worker
305*2d543d20SAndroid Build Coastguard Worker    (macro macro1 ((string ARG1))
306*2d543d20SAndroid Build Coastguard Worker        (typetransition audit.process device.device chr_file ARG1 device.klog_device)
307*2d543d20SAndroid Build Coastguard Worker    )
308*2d543d20SAndroid Build Coastguard Worker```
309*2d543d20SAndroid Build Coastguard Worker
310*2d543d20SAndroid Build Coastguard WorkerAlternatively:
311*2d543d20SAndroid Build Coastguard Worker
312*2d543d20SAndroid Build Coastguard Worker```secil
313*2d543d20SAndroid Build Coastguard Worker    (call macro1("__kmsg__"))
314*2d543d20SAndroid Build Coastguard Worker
315*2d543d20SAndroid Build Coastguard Worker    (macro macro1 ((name ARG1))
316*2d543d20SAndroid Build Coastguard Worker        (typetransition audit.process device.device chr_file ARG1 device.klog_device)
317*2d543d20SAndroid Build Coastguard Worker    )
318*2d543d20SAndroid Build Coastguard Worker```
319