1Type Statements 2=============== 3 4type 5---- 6 7Declares a type identifier in the current namespace. 8 9**Statement definition:** 10 11```secil 12 (type type_id) 13``` 14 15**Where:** 16 17<table> 18<colgroup> 19<col width="25%" /> 20<col width="75%" /> 21</colgroup> 22<tbody> 23<tr class="odd"> 24<td align="left"><p><code>type</code></p></td> 25<td align="left"><p>The <code>type</code> keyword.</p></td> 26</tr> 27<tr class="even"> 28<td align="left"><p><code>type_id</code></p></td> 29<td align="left"><p>The <code>type</code> identifier.</p></td> 30</tr> 31</tbody> 32</table> 33 34**Example:** 35 36This example declares a type identifier `bluetooth.process`: 37 38```secil 39 (block bluetooth 40 (type process) 41 ) 42``` 43 44typealias 45--------- 46 47Declares a type alias in the current namespace. 48 49**Statement definition:** 50 51```secil 52 (typealias typealias_id) 53``` 54 55**Where:** 56 57<table> 58<colgroup> 59<col width="25%" /> 60<col width="75%" /> 61</colgroup> 62<tbody> 63<tr class="odd"> 64<td align="left"><p><code>typealias</code></p></td> 65<td align="left"><p>The <code>typealias</code> keyword.</p></td> 66</tr> 67<tr class="even"> 68<td align="left"><p><code>typealias_id</code></p></td> 69<td align="left"><p>The <code>typealias</code> identifier.</p></td> 70</tr> 71</tbody> 72</table> 73 74**Example:** 75 76See the [`typealiasactual`](cil_type_statements.md#typealiasactual) statement for an example that associates the [`typealias`](cil_type_statements.md#typealias) identifier. 77 78typealiasactual 79--------------- 80 81Associates a previously declared [`typealias`](cil_type_statements.md#typealias) identifier to a previously declared [`type`](cil_type_statements.md#type) identifier. 82 83**Statement definition:** 84 85```secil 86 (typealiasactual typealias_id type_id) 87``` 88 89**Where:** 90 91<table> 92<colgroup> 93<col width="25%" /> 94<col width="75%" /> 95</colgroup> 96<tbody> 97<tr class="odd"> 98<td align="left"><p><code>typealiasactual</code></p></td> 99<td align="left"><p>The <code>typealiasactual</code> keyword.</p></td> 100</tr> 101<tr class="even"> 102<td align="left"><p><code>typealias_id</code></p></td> 103<td align="left"><p>A single previously declared <code>typealias</code> identifier.</p></td> 104</tr> 105<tr class="odd"> 106<td align="left"><p><code>type_id</code></p></td> 107<td align="left"><p>A single previously declared <code>type</code> identifier.</p></td> 108</tr> 109</tbody> 110</table> 111 112**Example:** 113 114This example will alias `unconfined.process` as `unconfined_t` in the global namespace: 115 116```secil 117 (typealias unconfined_t) 118 (typealiasactual unconfined_t unconfined.process) 119 120 (block unconfined 121 (type process) 122 ) 123``` 124 125typeattribute 126------------- 127 128Declares a type attribute identifier in the current namespace. The identifier may have zero or more [`type`](cil_type_statements.md#type), [`typealias`](cil_type_statements.md#typealias) and [`typeattribute`](cil_type_statements.md#typeattribute) identifiers associated to it via the [`typeattributeset`](cil_type_statements.md#typeattributeset) statement. 129 130**Statement definition:** 131 132```secil 133 (typeattribute typeattribute_id) 134``` 135 136**Where:** 137 138<table> 139<colgroup> 140<col width="25%" /> 141<col width="75%" /> 142</colgroup> 143<tbody> 144<tr class="odd"> 145<td align="left"><p><code>typeattribute</code></p></td> 146<td align="left"><p>The <code>typeattribute</code> keyword.</p></td> 147</tr> 148<tr class="even"> 149<td align="left"><p><code>typeattribute_id</code></p></td> 150<td align="left"><p>The <code>typeattribute</code> identifier.</p></td> 151</tr> 152</tbody> 153</table> 154 155**Example:** 156 157This example declares a type attribute `domain` in global namespace that will have an empty set: 158 159```secil 160 (typeattribute domain) 161``` 162 163typeattributeset 164---------------- 165 166Allows the association of one or more previously declared [`type`](cil_type_statements.md#type), [`typealias`](cil_type_statements.md#typealias) or [`typeattribute`](cil_type_statements.md#typeattribute) identifiers to a [`typeattribute`](cil_type_statements.md#typeattribute) identifier. Expressions may be used to refine the associations as shown in the examples. 167 168**Statement definition:** 169 170```secil 171 (typeattributeset typeattribute_id (type_id ... | expr ...)) 172``` 173 174**Where:** 175 176<table> 177<colgroup> 178<col width="25%" /> 179<col width="75%" /> 180</colgroup> 181<tbody> 182<tr class="odd"> 183<td align="left"><p><code>typeattributeset</code></p></td> 184<td align="left"><p>The <code>typeattributeset</code> keyword.</p></td> 185</tr> 186<tr class="even"> 187<td align="left"><p><code>typeattribute_id</code></p></td> 188<td align="left"><p>A single previously declared <code>typeattribute</code> identifier.</p></td> 189</tr> 190<tr class="odd"> 191<td align="left"><p><code>type_id</code></p></td> 192<td align="left"><p>Zero or more previously declared <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifiers.</p> 193<p>Note that there must be at least one <code>type_id</code> or <code>expr</code> parameter declared.</p></td> 194</tr> 195<tr class="even"> 196<td align="left"><p><code>expr</code></p></td> 197<td align="left"><p>Zero or more <code>expr</code>'s, the valid operators and syntax are:</p> 198<p><code> (and (type_id ...) (type_id ...))</code></p> 199<p><code> (or (type_id ...) (type_id ...))</code></p> 200<p><code> (xor (type_id ...) (type_id ...))</code></p> 201<p><code> (not (type_id ...))</code></p> 202<p><code> (all)</code></p></td> 203</tr> 204</tbody> 205</table> 206 207**Examples:** 208 209This example will take all the policy types and exclude those in `appdomain`. It is equivalent to `~appdomain` in the kernel policy language. 210 211```secil 212 (typeattribute not_in_appdomain) 213 214 (typeattributeset not_in_appdomain (not (appdomain))) 215``` 216 217This example is equivalent to `{ domain -kernel.process -ueventd.process -init.process }` in the kernel policy language: 218 219```secil 220 (typeattribute na_kernel_or_ueventd_or_init_in_domain) 221 222 (typeattributeset na_kernel_or_ueventd_or_init_in_domain 223 (and 224 (and 225 (and 226 (domain) 227 (not (kernel.process)) 228 ) 229 (not (ueventd.process)) 230 ) 231 (not (init.process)) 232 ) 233 ) 234``` 235 236expandtypeattribute 237------------------- 238 239Overrides the compiler defaults for the expansion of one or more 240previously declared [`typeattribute`](cil_type_statements.md#typeattribute) 241identifiers. 242 243This rule gives more control over type attribute expansion and 244removal. When the value is true, all rules involving the type 245attribute will be expanded and the type attribute will be removed from 246the policy. When the value is false, the type attribute will not be 247removed from the policy, even if the default expand rules or "-X" 248option cause the rules involving the type attribute to be expanded. 249 250**Statement definition:** 251 252```secil 253 (expandtypeattribute typeattribute_id expand_value) 254``` 255 256**Where:** 257 258<table> 259<colgroup> 260<col width="25%" /> 261<col width="75%" /> 262</colgroup> 263<tbody> 264<tr class="odd"> 265<td align="left"><p><code>expandtypeattribute</code></p></td> 266<td align="left"><p>The <code>expandtypeattribute</code> keyword.</p></td> 267</tr> 268<tr class="even"> 269<td align="left"><p><code>typeattribute_id</code></p></td> 270<td align="left"><p>One or more previously declared <code>typeattribute</code> identifiers. Multiple entries consist of a space separated list enclosed in parentheses '()'.</p></td> 271</tr> 272<tr class="odd"> 273<td align="left"><p><code>expand_value</code></p></td> 274<td align="left"><p>Either true or false.</p></td> 275</tr> 276</tbody> 277</table> 278 279**Examples:** 280 281This example uses the expandtypeattribute statement to forcibly expand a previously declared `domain` type attribute. 282 283```secil 284 (expandtypeattribute domain true) 285``` 286 287This example uses the expandtypeattribute statement to not expand previously declared `file_type` and `port_type` type attributes regardless of compiler defaults. 288 289```secil 290 (expandtypeattribute (file_type port_type) false) 291``` 292 293typebounds 294---------- 295 296This defines a hierarchical relationship between domains where the bounded domain cannot have more permissions than its bounding domain (the parent). 297 298Requires kernel 2.6.28 and above to control the security context associated to threads in multi-threaded applications. Note that an [`allow`](cil_access_vector_rules.md#allow) rule must be used to authorise the bounding. 299 300**Statement definition:** 301 302```secil 303 (typebounds parent_type_id child_type_id) 304``` 305 306**Where:** 307 308<table> 309<colgroup> 310<col width="25%" /> 311<col width="75%" /> 312</colgroup> 313<tbody> 314<tr class="odd"> 315<td align="left"><p><code>typebounds</code></p></td> 316<td align="left"><p>The <code>typebounds</code> keyword.</p></td> 317</tr> 318<tr class="even"> 319<td align="left"><p><code>parent_type_id</code></p></td> 320<td align="left"><p>A single previously declared <code>type</code> or <code>typealias</code> identifier that is the parent domain.</p></td> 321</tr> 322<tr class="odd"> 323<td align="left"><p><code>child_type_id</code></p></td> 324<td align="left"><p>A single previously declared <code>type</code> or <code>typealias</code> identifier that is the bound (child) domain.</p></td> 325</tr> 326</tbody> 327</table> 328 329**Example:** 330 331In this example the `httpd.child.process` cannot have `file (write)` due to lack of permissions on `httpd.process` which is the parent. It means the child domain will always have equal or less privileges than the parent: 332 333```secil 334 (class file (getattr read write)) 335 336 (block httpd 337 (type process) 338 (type object) 339 340 (typebounds process child.process) 341 ; The parent is allowed file 'getattr' and 'read': 342 (allow process object (file (getattr read))) 343 344 (block child 345 (type process) 346 (type object) 347 348 ; However the child process has been given 'write' access that will be denied. 349 (allow process httpd.object (file (read write))) 350 ) 351 ) 352``` 353 354typechange 355---------- 356 357The type change rule is used to define a different label of an object for userspace SELinux-aware applications. These applications would use **`security_compute_relabel`**`(3)` and [`typechange`](cil_type_statements.md#typechange) rules in the policy to determine the new context to be applied. Note that an [`allow`](cil_access_vector_rules.md#allow) rule must be used to authorise the change. 358 359**Statement definition:** 360 361```secil 362 (typechange source_type_id target_type_id class_id change_type_id) 363``` 364 365**Where:** 366 367<table> 368<colgroup> 369<col width="25%" /> 370<col width="75%" /> 371</colgroup> 372<tbody> 373<tr class="odd"> 374<td align="left"><p><code>typechange</code></p></td> 375<td align="left"><p>The <code>typechange</code> keyword.</p></td> 376</tr> 377<tr class="even"> 378<td align="left"><p><code>source_type_id</code></p></td> 379<td align="left"><p>A single previously declared <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td> 380</tr> 381<tr class="odd"> 382<td align="left"><p><code>target_type_id</code></p></td> 383<td align="left"><p>A single previously declared <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td> 384</tr> 385<tr class="even"> 386<td align="left"><p><code>class_id</code></p></td> 387<td align="left"><p>A single previously declared <code>class</code> or <code>classmap</code> identifier.</p></td> 388</tr> 389<tr class="odd"> 390<td align="left"><p><code>change_type_id</code></p></td> 391<td align="left"><p>A single previously declared <code>type</code> or <code>typealias</code> identifier that will become the new type.</p></td> 392</tr> 393</tbody> 394</table> 395 396**Example:** 397 398Whenever **`security_compute_relabel`**`(3)` is called with the following parameters: 399 400` scon=unconfined.object tcon=unconfined.object class=file` 401 402the function will return a context of: 403 404` unconfined.object:object_r:unconfined.change_label:s0` 405 406```secil 407 (class file (getattr read write)) 408 409 (block unconfined 410 (type process) 411 (type object) 412 (type change_label) 413 414 (typechange object object file change_label) 415 ) 416``` 417 418typemember 419---------- 420 421The type member rule is used to define a new polyinstantiated label of an object for SELinux-aware applications. These applications would use **`avc_compute_member`**`(3)` or **`security_compute_member`**`(3)` with the [`typemember`](cil_type_statements.md#typemember) rules in the policy to determine the context to be applied. The application would then manage any required polyinstantiation. Note that an [`allow`](cil_access_vector_rules.md#allow) rule must be used to authorise the membership. 422 423**Statement definition:** 424 425```secil 426 (typemember source_type_id target_type_id class_id member_type_id) 427``` 428 429**Where:** 430 431<table> 432<colgroup> 433<col width="25%" /> 434<col width="75%" /> 435</colgroup> 436<tbody> 437<tr class="odd"> 438<td align="left"><p><code>typemember</code></p></td> 439<td align="left"><p>The <code>typemember</code> keyword.</p></td> 440</tr> 441<tr class="even"> 442<td align="left"><p><code>source_type_id</code></p></td> 443<td align="left"><p>A single previously declared <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td> 444</tr> 445<tr class="odd"> 446<td align="left"><p><code>target_type_id</code></p></td> 447<td align="left"><p>A single previously declared <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td> 448</tr> 449<tr class="even"> 450<td align="left"><p><code>class_id</code></p></td> 451<td align="left"><p>A single previously declared <code>class</code> or <code>classmap</code> identifier.</p></td> 452</tr> 453<tr class="odd"> 454<td align="left"><p><code>member_type_id</code></p></td> 455<td align="left"><p>A single previously declared <code>type</code> or <code>typealias</code> identifier that will become the new member type.</p></td> 456</tr> 457</tbody> 458</table> 459 460**Example:** 461 462Whenever **`avc_compute_member`**`(3)` or **`security_compute_member`**`(3)` is called with the following parameters: 463 464` scon=unconfined.object tcon=unconfined.object class=file` 465 466the function will return a context of: 467 468` unconfined.object:object_r:unconfined.member_label:s0` 469 470```secil 471 (class file (getattr read write)) 472 473 (block unconfined 474 (type process) 475 (type object) 476 (type change_label) 477 478 (typemember object object file member_label) 479 ) 480``` 481 482typetransition 483-------------- 484 485The type transition rule specifies the labeling and object creation allowed between the `source_type` and `target`\_type when a domain transition is requested. Kernels from 2.6.39 with policy versions from 25 and above also support a 'name transition' rule, however this is not allowed inside conditionals and currently only supports the file classes. Note that an [`allow`](cil_access_vector_rules.md#allow) rule must be used to authorise the transition. 486 487**Statement definition:** 488 489```secil 490 (typetransition source_type_id target_type_id class_id [object_name] default_type_id) 491``` 492 493**Where:** 494 495<table> 496<colgroup> 497<col width="25%" /> 498<col width="75%" /> 499</colgroup> 500<tbody> 501<tr class="odd"> 502<td align="left"><p><code>typetransition</code></p></td> 503<td align="left"><p>The <code>typetransition</code> keyword.</p></td> 504</tr> 505<tr class="even"> 506<td align="left"><p><code>source_type_id</code></p></td> 507<td align="left"><p>A single previously declared <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td> 508</tr> 509<tr class="odd"> 510<td align="left"><p><code>target_type_id</code></p></td> 511<td align="left"><p>A single previously declared <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td> 512</tr> 513<tr class="even"> 514<td align="left"><p><code>class_id</code></p></td> 515<td align="left"><p>A single previously declared <code>class</code> or <code>classmap</code> identifier.</p></td> 516</tr> 517<tr class="odd"> 518<td align="left"><p><code>object_name</code></p></td> 519<td align="left"><p>A optional string within double quotes representing an object name for the 'name transition' rule. This string will be matched against the objects name (if a path then the last component of that path). If the string matches exactly, the <code>default_type_id</code> will then become the new type.</p></td> 520</tr> 521<tr class="even"> 522<td align="left"><p><code>default_type_id</code></p></td> 523<td align="left"><p>A single previously declared <code>type</code> or <code>typealias</code> identifier that will become the new type.</p></td> 524</tr> 525</tbody> 526</table> 527 528**Examples:** 529 530This example shows a process transition rule with its supporting [`allow`](cil_access_vector_rules.md#allow) rule: 531 532```secil 533 (macro domain_auto_trans ((type ARG1) (type ARG2) (type ARG3)) 534 ; Allow the necessary permissions. 535 (call domain_trans (ARG1 ARG2 ARG3)) 536 ; Make the transition occur by default. 537 (typetransition ARG1 ARG2 process ARG3) 538 ) 539``` 540 541This example shows a file object transition rule with its supporting [`allow`](cil_access_vector_rules.md#allow) rule: 542 543```secil 544 (macro tmpfs_domain ((type ARG1)) 545 (type tmpfs) 546 (typeattributeset file_type (tmpfs)) 547 (typetransition ARG1 file.tmpfs file tmpfs) 548 (allow ARG1 tmpfs (file (read write execute execmod))) 549 ) 550``` 551 552This example shows the 'name transition' rule with its supporting [`allow`](cil_access_vector_rules.md#allow) rule: 553 554```secil 555 (macro write_klog ((type ARG1)) 556 (typetransition ARG1 device.device chr_file "__kmsg__" device.klog_device) 557 (allow ARG1 device.klog_device (chr_file (create open write unlink))) 558 (allow ARG1 device.device (dir (write add_name remove_name))) 559 ) 560``` 561 562typepermissive 563-------------- 564 565Policy database version 23 introduced the permissive statement to allow the named domain to run in permissive mode instead of running all SELinux domains in permissive mode (that was the only option prior to version 23). Note that the permissive statement only tests the source context for any policy denial. 566 567**Statement definition:** 568 569```secil 570 (typepermissive source_type_id) 571``` 572 573**Where:** 574 575<table> 576<colgroup> 577<col width="25%" /> 578<col width="75%" /> 579</colgroup> 580<tbody> 581<tr class="odd"> 582<td align="left"><p><code>typepermissive</code></p></td> 583<td align="left"><p>The <code>typepermissive</code> keyword.</p></td> 584</tr> 585<tr class="even"> 586<td align="left"><p><code>source_type_id</code></p></td> 587<td align="left"><p>A single previously declared <code>type</code> or <code>typealias</code> identifier.</p></td> 588</tr> 589</tbody> 590</table> 591 592**Example:** 593 594This example will allow SELinux to run the `healthd.process` domain in permissive mode even when enforcing is enabled: 595 596```secil 597 (block healthd 598 (type process) 599 (typepermissive process) 600 601 (allow ...) 602 ) 603``` 604