1*2d543d20SAndroid Build Coastguard WorkerCIL Information 2*2d543d20SAndroid Build Coastguard Worker=============== 3*2d543d20SAndroid Build Coastguard Worker 4*2d543d20SAndroid Build Coastguard Worker1. Not all possible alternate statement permutations are shown, however there should be enough variation to work out any other valid formats. There is also an example [`policy.cil`](../test/policy.cil#example-policy) file in the test directory. 5*2d543d20SAndroid Build Coastguard Worker 6*2d543d20SAndroid Build Coastguard Worker2. The MLS components on contexts and user statements must be declared even if the policy does not support MCS/MLS. 7*2d543d20SAndroid Build Coastguard Worker 8*2d543d20SAndroid Build Coastguard Worker3. The CIL compiler will not build a policy unless it also has as a minimum: one [`allow`](cil_access_vector_rules.md#allow) rule, one [`sid`](cil_sid_statements.md#sid), [`sidorder`](cil_sid_statements.md#sidorder) and [`sidcontext`](cil_sid_statements.md#sidcontext) statement. 9*2d543d20SAndroid Build Coastguard Worker 10*2d543d20SAndroid Build Coastguard Worker4. The role `object_r` must be explicitly associated to contexts used for labeling objects. The original **`checkpolicy`**`(8)` and **`checkmodule`**`(8)` compilers did this by default - CIL does not. 11*2d543d20SAndroid Build Coastguard Worker 12*2d543d20SAndroid Build Coastguard Worker5. Be aware that CIL allows [`class`](cil_class_and_permission_statements.md#class) statements to be declared in a namespace, however the policy author needs to note that applications (and the kernel) generally reference a class by its well known class identifier (e.g. `zygote`) however if declared in a namespace (e.g. `(block zygote (class zygote (...)))` or `(block zygote (class class (...)))`) it would be prefixed with that namespace (e.g. `zygote.zygote` or `zygote.class`). Unless the application / kernel code was updated the class would never be resolved, therefore it is recommended that classes are declared in the global namespace. 13*2d543d20SAndroid Build Coastguard Worker 14*2d543d20SAndroid Build Coastguard Worker6. Where possible use [`typeattribute`](cil_type_statements.md#typeattribute)'s when defining source/target [`allow`](cil_access_vector_rules.md#allow) rules instead of multiple [`allow`](cil_access_vector_rules.md#allow) rules with individual [`type`](cil_type_statements.md#type)'s. This will lead to the generation of much smaller kernel policy files. 15*2d543d20SAndroid Build Coastguard Worker 16*2d543d20SAndroid Build Coastguard Worker7. The [](http://github.com/SELinuxProject/cil/wiki) site explains the language however some of the statement definitions are dated. 17*2d543d20SAndroid Build Coastguard Worker 18*2d543d20SAndroid Build Coastguard WorkerDeclarations 19*2d543d20SAndroid Build Coastguard Worker------------ 20*2d543d20SAndroid Build Coastguard Worker 21*2d543d20SAndroid Build Coastguard WorkerDeclarations may be named or anonymous and have three different forms: 22*2d543d20SAndroid Build Coastguard Worker 23*2d543d20SAndroid Build Coastguard Worker1. Named declarations - These create new objects that introduce a name or identifier, for example: 24*2d543d20SAndroid Build Coastguard Worker 25*2d543d20SAndroid Build Coastguard Worker `(type process)` - creates a [`type`](cil_type_statements.md#type) with an identifier of `process`. 26*2d543d20SAndroid Build Coastguard Worker 27*2d543d20SAndroid Build Coastguard Worker `(typeattribute domain)` - creates a [`typeattribute`](cil_type_statements.md#typeattribute) with an identifier of `domain`. 28*2d543d20SAndroid Build Coastguard Worker 29*2d543d20SAndroid Build Coastguard Worker `(class file (read write))` - creates a [`class`](cil_class_and_permission_statements.md#class) with an identifier of `file` that has `read` and `write` permissions associated to it. 30*2d543d20SAndroid Build Coastguard Worker 31*2d543d20SAndroid Build Coastguard Worker The list of declaration type statement keywords are: 32*2d543d20SAndroid Build Coastguard Worker 33*2d543d20SAndroid Build Coastguard Worker block 34*2d543d20SAndroid Build Coastguard Worker optional 35*2d543d20SAndroid Build Coastguard Worker common 36*2d543d20SAndroid Build Coastguard Worker class 37*2d543d20SAndroid Build Coastguard Worker classmap 38*2d543d20SAndroid Build Coastguard Worker classmapping 39*2d543d20SAndroid Build Coastguard Worker sid 40*2d543d20SAndroid Build Coastguard Worker user 41*2d543d20SAndroid Build Coastguard Worker role 42*2d543d20SAndroid Build Coastguard Worker roleattribute 43*2d543d20SAndroid Build Coastguard Worker type 44*2d543d20SAndroid Build Coastguard Worker classpermission 45*2d543d20SAndroid Build Coastguard Worker classpermissionset 46*2d543d20SAndroid Build Coastguard Worker typeattribute 47*2d543d20SAndroid Build Coastguard Worker typealias 48*2d543d20SAndroid Build Coastguard Worker tunable 49*2d543d20SAndroid Build Coastguard Worker sensitivity 50*2d543d20SAndroid Build Coastguard Worker sensitivityalias 51*2d543d20SAndroid Build Coastguard Worker category 52*2d543d20SAndroid Build Coastguard Worker categoryalias 53*2d543d20SAndroid Build Coastguard Worker categoryset 54*2d543d20SAndroid Build Coastguard Worker level 55*2d543d20SAndroid Build Coastguard Worker levelrange 56*2d543d20SAndroid Build Coastguard Worker context 57*2d543d20SAndroid Build Coastguard Worker ipaddr 58*2d543d20SAndroid Build Coastguard Worker macro 59*2d543d20SAndroid Build Coastguard Worker policycap 60*2d543d20SAndroid Build Coastguard Worker 61*2d543d20SAndroid Build Coastguard Worker2. Explicit anonymous declarations - These are currently restricted to IP addresses where they can be declared directly in statements by enclosing them within parentheses e.g. `(127.0.0.1)` or `(::1)`. See the [Network Labeling Statements](#network_labeling) section for examples. 62*2d543d20SAndroid Build Coastguard Worker 63*2d543d20SAndroid Build Coastguard Worker3. Anonymous declarations - These have been previously declared and the object already exists, therefore they may be referenced by their name or identifier within statements. For example the following declare all the components required to specify a context: 64*2d543d20SAndroid Build Coastguard Worker 65*2d543d20SAndroid Build Coastguard Worker ```secil 66*2d543d20SAndroid Build Coastguard Worker (sensitivity s0) 67*2d543d20SAndroid Build Coastguard Worker (category c0) 68*2d543d20SAndroid Build Coastguard Worker (role object_r) 69*2d543d20SAndroid Build Coastguard Worker 70*2d543d20SAndroid Build Coastguard Worker (block unconfined 71*2d543d20SAndroid Build Coastguard Worker (user user) 72*2d543d20SAndroid Build Coastguard Worker (type object) 73*2d543d20SAndroid Build Coastguard Worker ) 74*2d543d20SAndroid Build Coastguard Worker ``` 75*2d543d20SAndroid Build Coastguard Worker 76*2d543d20SAndroid Build Coastguard Worker now a [`portcon`](cil_network_labeling_statements.md#portcon) statement can be defined that uses these individual components to build a context as follows: 77*2d543d20SAndroid Build Coastguard Worker 78*2d543d20SAndroid Build Coastguard Worker ```secil 79*2d543d20SAndroid Build Coastguard Worker (portcon udp 12345 (unconfined.user object_r unconfined.object ((s0) (s0(c0))))) 80*2d543d20SAndroid Build Coastguard Worker ``` 81*2d543d20SAndroid Build Coastguard Worker 82*2d543d20SAndroid Build Coastguard WorkerDefinitions 83*2d543d20SAndroid Build Coastguard Worker----------- 84*2d543d20SAndroid Build Coastguard Worker 85*2d543d20SAndroid Build Coastguard WorkerStatements that build on the objects, for example: 86*2d543d20SAndroid Build Coastguard Worker 87*2d543d20SAndroid Build Coastguard Worker- `(typeattributeset domain (process))` - Adds the [`type`](cil_type_statements.md#type) '`process`' to the [`typeattribute`](cil_type_statements.md#typeattribute) '`domain`'. 88*2d543d20SAndroid Build Coastguard Worker 89*2d543d20SAndroid Build Coastguard Worker- `(allow domain process (file (read write))))` - Adds an [`allow`](cil_access_vector_rules.md#allow) rule referencing `domain`, `process` and the `file class`. 90*2d543d20SAndroid Build Coastguard Worker 91*2d543d20SAndroid Build Coastguard WorkerDefinitions may be repeated many times throughout the policy. Duplicates will resolve to a single definition during compilation. 92*2d543d20SAndroid Build Coastguard Worker 93*2d543d20SAndroid Build Coastguard WorkerSymbol Character Set 94*2d543d20SAndroid Build Coastguard Worker-------------------- 95*2d543d20SAndroid Build Coastguard Worker 96*2d543d20SAndroid Build Coastguard WorkerSymbols (any string not enclosed in double quotes) must only contain alphanumeric `[a-z A-Z] [0-9]` characters plus the following special characters: `\.@=/-_$%@+!|&^:` 97*2d543d20SAndroid Build Coastguard Worker 98*2d543d20SAndroid Build Coastguard WorkerHowever symbols are checked for any specific character set limitations, for example: 99*2d543d20SAndroid Build Coastguard Worker 100*2d543d20SAndroid Build Coastguard Worker- Names or identifiers must start with an alpa character `[a-z A-Z]`, the remainder may be alphanumeric `[a-z A-Z] [0-9]` characters plus underscore `[_]` or hyphen `[-]`. 101*2d543d20SAndroid Build Coastguard Worker 102*2d543d20SAndroid Build Coastguard Worker- IP addresses must conform to IPv4 or IPv6 format. 103*2d543d20SAndroid Build Coastguard Worker 104*2d543d20SAndroid Build Coastguard Worker- Memory, ports, irqs must be numeric `[0-9]`. 105*2d543d20SAndroid Build Coastguard Worker 106*2d543d20SAndroid Build Coastguard WorkerString Character Set 107*2d543d20SAndroid Build Coastguard Worker-------------------- 108*2d543d20SAndroid Build Coastguard Worker 109*2d543d20SAndroid Build Coastguard WorkerStrings are enclosed within double quotes (e.g. `"This is a string"`), and may contain any character except the double quote ("). 110*2d543d20SAndroid Build Coastguard Worker 111*2d543d20SAndroid Build Coastguard WorkerComments 112*2d543d20SAndroid Build Coastguard Worker-------- 113*2d543d20SAndroid Build Coastguard Worker 114*2d543d20SAndroid Build Coastguard WorkerComments start with a semicolon '`;`' and end when a new line is started. 115*2d543d20SAndroid Build Coastguard Worker 116*2d543d20SAndroid Build Coastguard WorkerNamespaces 117*2d543d20SAndroid Build Coastguard Worker---------- 118*2d543d20SAndroid Build Coastguard Worker 119*2d543d20SAndroid Build Coastguard WorkerCIL supports namespaces via containers such as the [`block`](cil_container_statements.md#block) statement. When a block is resolved to form the parent / child relationship a dot '`.`' is used, for example the following [`allow`](cil_access_vector_rules.md#allow) rule: 120*2d543d20SAndroid Build Coastguard Worker 121*2d543d20SAndroid Build Coastguard Worker```secil 122*2d543d20SAndroid Build Coastguard Worker (block example_ns 123*2d543d20SAndroid Build Coastguard Worker (type process) 124*2d543d20SAndroid Build Coastguard Worker (type object) 125*2d543d20SAndroid Build Coastguard Worker (class file (open read write getattr)) 126*2d543d20SAndroid Build Coastguard Worker 127*2d543d20SAndroid Build Coastguard Worker (allow process object (file (open read getattr))) 128*2d543d20SAndroid Build Coastguard Worker ) 129*2d543d20SAndroid Build Coastguard Worker``` 130*2d543d20SAndroid Build Coastguard Worker 131*2d543d20SAndroid Build Coastguard Workerwill resolve to the following kernel policy language statement: 132*2d543d20SAndroid Build Coastguard Worker 133*2d543d20SAndroid Build Coastguard Worker``` 134*2d543d20SAndroid Build Coastguard Worker allow example_ns.process example_ns.object : example_ns.file { open read getattr }; 135*2d543d20SAndroid Build Coastguard Worker``` 136*2d543d20SAndroid Build Coastguard Worker 137*2d543d20SAndroid Build Coastguard WorkerGlobal Namespace 138*2d543d20SAndroid Build Coastguard Worker---------------- 139*2d543d20SAndroid Build Coastguard Worker 140*2d543d20SAndroid Build Coastguard WorkerCIL has a global namespace that is always present. Any symbol that is declared outside a container is in the global namespace. To reference a symbol in global namespace, the symbol should be prefixed with a dot '`.`' as shown in the following example: 141*2d543d20SAndroid Build Coastguard Worker 142*2d543d20SAndroid Build Coastguard Worker```secil 143*2d543d20SAndroid Build Coastguard Worker ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; 144*2d543d20SAndroid Build Coastguard Worker ; This example has three namespace 'tmpfs' types declared: 145*2d543d20SAndroid Build Coastguard Worker ; 1) Global .tmpfs 146*2d543d20SAndroid Build Coastguard Worker ; 2) file.tmpfs 147*2d543d20SAndroid Build Coastguard Worker ; 3) other_ns.tmpfs 148*2d543d20SAndroid Build Coastguard Worker ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; 149*2d543d20SAndroid Build Coastguard Worker 150*2d543d20SAndroid Build Coastguard Worker ; This type is the global tmpfs: 151*2d543d20SAndroid Build Coastguard Worker (type tmpfs) 152*2d543d20SAndroid Build Coastguard Worker 153*2d543d20SAndroid Build Coastguard Worker (block file 154*2d543d20SAndroid Build Coastguard Worker ; file namespace tmpfs 155*2d543d20SAndroid Build Coastguard Worker (type tmpfs) 156*2d543d20SAndroid Build Coastguard Worker (class file (open read write getattr)) 157*2d543d20SAndroid Build Coastguard Worker 158*2d543d20SAndroid Build Coastguard Worker ; This rule will reference the local namespace for src and tgt: 159*2d543d20SAndroid Build Coastguard Worker (allow tmpfs tmpfs (file (open))) 160*2d543d20SAndroid Build Coastguard Worker ; Resulting policy rule: 161*2d543d20SAndroid Build Coastguard Worker ; allow file.tmpfs file.tmpfs : file.file open; 162*2d543d20SAndroid Build Coastguard Worker 163*2d543d20SAndroid Build Coastguard Worker ; This rule will reference the local namespace for src and global for tgt: 164*2d543d20SAndroid Build Coastguard Worker (allow tmpfs .tmpfs (file (read))) 165*2d543d20SAndroid Build Coastguard Worker ; Resulting policy rule: 166*2d543d20SAndroid Build Coastguard Worker ; allow file.tmpfs tmpfs : file.file read; 167*2d543d20SAndroid Build Coastguard Worker 168*2d543d20SAndroid Build Coastguard Worker ; This rule will reference the global namespace for src and tgt: 169*2d543d20SAndroid Build Coastguard Worker (allow .tmpfs .tmpfs (file (write))) 170*2d543d20SAndroid Build Coastguard Worker ; Resulting policy rule: 171*2d543d20SAndroid Build Coastguard Worker ; allow tmpfs tmpfs : file.file write; 172*2d543d20SAndroid Build Coastguard Worker 173*2d543d20SAndroid Build Coastguard Worker ; This rule will reference the other_ns namespace for src and 174*2d543d20SAndroid Build Coastguard Worker ; local namespace for tgt: 175*2d543d20SAndroid Build Coastguard Worker (allow other_ns.tmpfs tmpfs (file (getattr))) 176*2d543d20SAndroid Build Coastguard Worker ; Resulting policy rule: 177*2d543d20SAndroid Build Coastguard Worker ; allow other_ns.tmpfs file.tmpfs : file.file getattr; 178*2d543d20SAndroid Build Coastguard Worker ) 179*2d543d20SAndroid Build Coastguard Worker 180*2d543d20SAndroid Build Coastguard Worker (block other_ns 181*2d543d20SAndroid Build Coastguard Worker (type tmpfs) 182*2d543d20SAndroid Build Coastguard Worker ) 183*2d543d20SAndroid Build Coastguard Worker``` 184*2d543d20SAndroid Build Coastguard Worker 185*2d543d20SAndroid Build Coastguard WorkerShould the symbol not be prefixed with a dot, the current namespace would be searched first and then the global namespace (provided there is not a symbol of that name in the current namespace). 186*2d543d20SAndroid Build Coastguard Worker 187*2d543d20SAndroid Build Coastguard WorkerExpressions 188*2d543d20SAndroid Build Coastguard Worker----------- 189*2d543d20SAndroid Build Coastguard Worker 190*2d543d20SAndroid Build Coastguard WorkerExpressions may occur in the following CIL statements: [`booleanif`](cil_conditional_statements.md#booleanif), [`tunableif`](cil_conditional_statements.md#tunableif), [`classpermissionset`](cil_class_and_permission_statements.md#classpermissionset), [`typeattributeset`](cil_type_statements.md#typeattributeset), [`roleattributeset`](cil_role_statements.md#roleattributeset), [`categoryset`](cil_mls_labeling_statements.md#categoryset), [`constrain`](cil_constraint_statements.md#constrain), [`mlsconstrain`](cil_constraint_statements.md#mlsconstrain), [`validatetrans`](cil_constraint_statements.md#validatetrans), [`mlsvalidatetrans`](cil_constraint_statements.md#mlsvalidatetrans) 191*2d543d20SAndroid Build Coastguard Worker 192*2d543d20SAndroid Build Coastguard WorkerCIL expressions use the [prefix](http://www.cs.man.ac.uk/~pjj/cs212/fix.html) or Polish notation and may be nested (note that the kernel policy language uses infix notation). The syntax is as follows, where the parenthesis are part of the syntax: 193*2d543d20SAndroid Build Coastguard Worker 194*2d543d20SAndroid Build Coastguard Worker``` 195*2d543d20SAndroid Build Coastguard Worker expr_set = (name ... | expr ...) 196*2d543d20SAndroid Build Coastguard Worker expr = (expr_key expr_set ...) 197*2d543d20SAndroid Build Coastguard Worker expr_key = and | or | xor | not | all | eq | neq | dom | domby | incomp | range 198*2d543d20SAndroid Build Coastguard Worker``` 199*2d543d20SAndroid Build Coastguard Worker 200*2d543d20SAndroid Build Coastguard WorkerThe number of `expr_set`'s in an `expr` is dependent on the statement type (there are four different classes as defined below) that also influence the valid `expr_key` entries (e.g. `dom`, `domby`, `incomp` are only allowed in constraint statements). 201*2d543d20SAndroid Build Coastguard Worker 202*2d543d20SAndroid Build Coastguard Worker| expr_key | classpermissionset roleattributeset typeattributeset | categoryset | booleanif tunableif | constrain mlsconstrain validatetrans mlsvalidatetrans | 203*2d543d20SAndroid Build Coastguard Worker|:----------:|:----------:|:----------:|:----------:|:----------:| 204*2d543d20SAndroid Build Coastguard Worker| **`dom`** | | | | **X** | 205*2d543d20SAndroid Build Coastguard Worker| **`domby`** | | | | **X** | 206*2d543d20SAndroid Build Coastguard Worker| **`incomp`** | | | | **X** | 207*2d543d20SAndroid Build Coastguard Worker| **`eq`** | | | **X** | **X** | 208*2d543d20SAndroid Build Coastguard Worker| **`ne`** | | | **X** | **X** | 209*2d543d20SAndroid Build Coastguard Worker| **`and`** | **X** | **X** | **X** | **X** | 210*2d543d20SAndroid Build Coastguard Worker| **`or`** | **X** | **X** | **X** | **X** | 211*2d543d20SAndroid Build Coastguard Worker| **`not`** | **X** | **X** | **X** | **X** | 212*2d543d20SAndroid Build Coastguard Worker| **`xor`** | **X** | **X** | **X** | | 213*2d543d20SAndroid Build Coastguard Worker| **`all`** | **X** | **X** | | | 214*2d543d20SAndroid Build Coastguard Worker| **`range`** | | **X** | | | 215*2d543d20SAndroid Build Coastguard Worker 216*2d543d20SAndroid Build Coastguard Worker1. The [`classpermissionset`](cil_class_and_permission_statements.md#classpermissionset), [`roleattributeset`](cil_role_statements.md#roleattributeset) and [`typeattributeset`](cil_type_statements.md#typeattributeset) statements allow `expr_set` to mix names and `expr`s with `expr_key` values of: `and`, `or`, `xor`, `not`, `all` as shown in the examples: 217*2d543d20SAndroid Build Coastguard Worker 218*2d543d20SAndroid Build Coastguard Worker This example includes all `fs_type type` entries except `file.usermodehelper` and `file.proc_security` in the associated [`typeattribute`](cil_type_statements.md#typeattribute) identifier `all_fs_type_except_usermodehelper_and_proc_security`: 219*2d543d20SAndroid Build Coastguard Worker 220*2d543d20SAndroid Build Coastguard Worker ```secil 221*2d543d20SAndroid Build Coastguard Worker (typeattribute all_fs_type_except_usermodehelper_and_proc_security) 222*2d543d20SAndroid Build Coastguard Worker 223*2d543d20SAndroid Build Coastguard Worker (typeattributeset all_fs_type_except_usermodehelper_and_proc_security 224*2d543d20SAndroid Build Coastguard Worker (and 225*2d543d20SAndroid Build Coastguard Worker (and 226*2d543d20SAndroid Build Coastguard Worker fs_type 227*2d543d20SAndroid Build Coastguard Worker (not file.usermodehelper) 228*2d543d20SAndroid Build Coastguard Worker ) 229*2d543d20SAndroid Build Coastguard Worker (not file.proc_security) 230*2d543d20SAndroid Build Coastguard Worker ) 231*2d543d20SAndroid Build Coastguard Worker ) 232*2d543d20SAndroid Build Coastguard Worker ``` 233*2d543d20SAndroid Build Coastguard Worker 234*2d543d20SAndroid Build Coastguard Worker The `cps_1 classpermissionset` identifier includes all permissions except `load_policy` and `setenforce`: 235*2d543d20SAndroid Build Coastguard Worker 236*2d543d20SAndroid Build Coastguard Worker ```secil 237*2d543d20SAndroid Build Coastguard Worker (class security (compute_av compute_create compute_member check_context load_policy compute_relabel compute_user setenforce setbool setsecparam setcheckreqprot read_policy)) 238*2d543d20SAndroid Build Coastguard Worker 239*2d543d20SAndroid Build Coastguard Worker (classpermission cps_1) 240*2d543d20SAndroid Build Coastguard Worker 241*2d543d20SAndroid Build Coastguard Worker (classpermissionset cps_1 (security (not (load_policy setenforce)))) 242*2d543d20SAndroid Build Coastguard Worker ``` 243*2d543d20SAndroid Build Coastguard Worker 244*2d543d20SAndroid Build Coastguard Worker This example includes all permissions in the associated [`classpermissionset`](cil_class_and_permission_statements.md#classpermissionset) identifier `security_all_perms`: 245*2d543d20SAndroid Build Coastguard Worker 246*2d543d20SAndroid Build Coastguard Worker ```secil 247*2d543d20SAndroid Build Coastguard Worker (class security (compute_av compute_create compute_member check_context load_policy 248*2d543d20SAndroid Build Coastguard Worker compute_relabel compute_user setenforce setbool setsecparam setcheckreqprot 249*2d543d20SAndroid Build Coastguard Worker read_policy) 250*2d543d20SAndroid Build Coastguard Worker ) 251*2d543d20SAndroid Build Coastguard Worker 252*2d543d20SAndroid Build Coastguard Worker (classpermission security_all_perms) 253*2d543d20SAndroid Build Coastguard Worker 254*2d543d20SAndroid Build Coastguard Worker (classpermissionset security_all_perms (security (all))) 255*2d543d20SAndroid Build Coastguard Worker ``` 256*2d543d20SAndroid Build Coastguard Worker 257*2d543d20SAndroid Build Coastguard Worker2. The [`categoryset`](cil_mls_labeling_statements.md#categoryset) statement allows `expr_set` to mix names and `expr_key` values of: `and`, `or`, `not`, `xor`, `all`, `range` as shown in the examples. 258*2d543d20SAndroid Build Coastguard Worker 259*2d543d20SAndroid Build Coastguard Worker Category expressions are also allowed in [`sensitivitycategory`](cil_mls_labeling_statements.md#sensitivitycategory), [`level`](cil_mls_labeling_statements.md#level), and [`levelrange`](cil_mls_labeling_statements.md#levelrange) statements. 260*2d543d20SAndroid Build Coastguard Worker 261*2d543d20SAndroid Build Coastguard Worker3. The [`booleanif`](cil_conditional_statements.md#booleanif) and [`tunableif`](cil_conditional_statements.md#tunableif) statements only allow an `expr_set` to have one `name` or `expr` with `expr_key` values of `and`, `or`, `xor`, `not`, `eq`, `neq` as shown in the examples: 262*2d543d20SAndroid Build Coastguard Worker 263*2d543d20SAndroid Build Coastguard Worker ```secil 264*2d543d20SAndroid Build Coastguard Worker (booleanif disableAudio 265*2d543d20SAndroid Build Coastguard Worker (false 266*2d543d20SAndroid Build Coastguard Worker (allow process device.audio_device (chr_file_set (rw_file_perms))) 267*2d543d20SAndroid Build Coastguard Worker ) 268*2d543d20SAndroid Build Coastguard Worker ) 269*2d543d20SAndroid Build Coastguard Worker 270*2d543d20SAndroid Build Coastguard Worker (booleanif (and (not disableAudio) (not disableAudioCapture)) 271*2d543d20SAndroid Build Coastguard Worker (true 272*2d543d20SAndroid Build Coastguard Worker (allow process device.audio_capture_device (chr_file_set (rw_file_perms))) 273*2d543d20SAndroid Build Coastguard Worker ) 274*2d543d20SAndroid Build Coastguard Worker ) 275*2d543d20SAndroid Build Coastguard Worker ``` 276*2d543d20SAndroid Build Coastguard Worker 277*2d543d20SAndroid Build Coastguard Worker4. The [`constrain`](cil_constraint_statements.md#constrain), [`mlsconstrain`](cil_constraint_statements.md#mlsconstrain), [`validatetrans`](cil_constraint_statements.md#validatetrans) and [`mlsvalidatetrans`](cil_constraint_statements.md#mlsvalidatetrans) statements only allow an `expr_set` to have one `name` or `expr` with `expr_key` values of `and`, `or`, `not`, `all`, `eq`, `neq`, `dom`, `domby`, `incomp`. When `expr_key` is `dom`, `domby` or `incomp`, it must be followed by a string (e.g. `h1`, `l2`) and another string or a set of `name`s. The following examples show CIL constraint statements and their policy language equivalents: 278*2d543d20SAndroid Build Coastguard Worker 279*2d543d20SAndroid Build Coastguard Worker ```secil 280*2d543d20SAndroid Build Coastguard Worker ; Process transition: Require equivalence unless the subject is trusted. 281*2d543d20SAndroid Build Coastguard Worker (mlsconstrain (process (transition dyntransition)) 282*2d543d20SAndroid Build Coastguard Worker (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject))) 283*2d543d20SAndroid Build Coastguard Worker 284*2d543d20SAndroid Build Coastguard Worker ; The equivalent policy language mlsconstrain statement is: 285*2d543d20SAndroid Build Coastguard Worker ;mlsconstrain process { transition dyntransition } 286*2d543d20SAndroid Build Coastguard Worker ; ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject); 287*2d543d20SAndroid Build Coastguard Worker 288*2d543d20SAndroid Build Coastguard Worker ; Process read operations: No read up unless trusted. 289*2d543d20SAndroid Build Coastguard Worker (mlsconstrain (process (getsched getsession getpgid getcap getattr ptrace share)) 290*2d543d20SAndroid Build Coastguard Worker (or (dom l1 l2) (eq t1 mlstrustedsubject))) 291*2d543d20SAndroid Build Coastguard Worker 292*2d543d20SAndroid Build Coastguard Worker ; The equivalent policy language mlsconstrain statement is: 293*2d543d20SAndroid Build Coastguard Worker ;mlsconstrain process { getsched getsession getpgid getcap getattr ptrace share } 294*2d543d20SAndroid Build Coastguard Worker ; (l1 dom l2 or t1 == mlstrustedsubject); 295*2d543d20SAndroid Build Coastguard Worker ``` 296*2d543d20SAndroid Build Coastguard Worker 297*2d543d20SAndroid Build Coastguard WorkerName String 298*2d543d20SAndroid Build Coastguard Worker----------- 299*2d543d20SAndroid Build Coastguard Worker 300*2d543d20SAndroid Build Coastguard WorkerUsed to define [`macro`](cil_call_macro_statements.md#macro) statement parameter string types: 301*2d543d20SAndroid Build Coastguard Worker 302*2d543d20SAndroid Build Coastguard Worker```secil 303*2d543d20SAndroid Build Coastguard Worker (call macro1("__kmsg__")) 304*2d543d20SAndroid Build Coastguard Worker 305*2d543d20SAndroid Build Coastguard Worker (macro macro1 ((string ARG1)) 306*2d543d20SAndroid Build Coastguard Worker (typetransition audit.process device.device chr_file ARG1 device.klog_device) 307*2d543d20SAndroid Build Coastguard Worker ) 308*2d543d20SAndroid Build Coastguard Worker``` 309*2d543d20SAndroid Build Coastguard Worker 310*2d543d20SAndroid Build Coastguard WorkerAlternatively: 311*2d543d20SAndroid Build Coastguard Worker 312*2d543d20SAndroid Build Coastguard Worker```secil 313*2d543d20SAndroid Build Coastguard Worker (call macro1("__kmsg__")) 314*2d543d20SAndroid Build Coastguard Worker 315*2d543d20SAndroid Build Coastguard Worker (macro macro1 ((name ARG1)) 316*2d543d20SAndroid Build Coastguard Worker (typetransition audit.process device.device chr_file ARG1 device.klog_device) 317*2d543d20SAndroid Build Coastguard Worker ) 318*2d543d20SAndroid Build Coastguard Worker``` 319