1Default Object Statements 2========================= 3 4These rules allow a default user, role, type and/or range to be used when computing a context for a new object. These require policy version 27 or 28 with kernels 3.5 or greater. 5 6defaultuser 7----------- 8 9Allows the default user to be taken from the source or target context when computing a new context for the object [`class`](cil_class_and_permission_statements.md#class) identifier. Requires policy version 27. 10 11**Statement definition:** 12 13 (defaultuser class_id default) 14 15**Where:** 16 17<table> 18<colgroup> 19<col width="25%" /> 20<col width="75%" /> 21</colgroup> 22<tbody> 23<tr class="odd"> 24<td align="left"><p><code>defaultuser</code></p></td> 25<td align="left"><p>The <code>defaultuser</code> keyword.</p></td> 26</tr> 27<tr class="even"> 28<td align="left"><p><code>class_id</code></p></td> 29<td align="left"><p>A single previously declared <code>class</code> or <code>classmap</code> identifier, or a list of previously declared <code>class</code> or <code>classmap</code> identifiers enclosed within parentheses.</p></td> 30</tr> 31<tr class="odd"> 32<td align="left"><p><code>default</code></p></td> 33<td align="left"><p>A keyword of either <code>source</code> or <code>target</code>.</p></td> 34</tr> 35</tbody> 36</table> 37 38**Example:** 39 40When creating new `binder`, `property_service`, `zygote` or `memprotect` objects the [`user`](cil_user_statements.md#user) component of the new security context will be taken from the `source` context: 41 42 (class binder (impersonate call set_context_mgr transfer receive)) 43 (class property_service (set)) 44 (class zygote (specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo)) 45 (class memprotect (mmap_zero)) 46 47 (classmap android_classes (android)) 48 (classmapping android_classes android (binder (all))) 49 (classmapping android_classes android (property_service (set))) 50 (classmapping android_classes android (zygote (not (specifycapabilities)))) 51 52 (defaultuser (android_classes memprotect) source) 53 54 ; Will produce the following in the binary policy file: 55 ;; default_user binder source; 56 ;; default_user zygote source; 57 ;; default_user property_service source; 58 ;; default_user memprotect source; 59 60defaultrole 61----------- 62 63Allows the default role to be taken from the source or target context when computing a new context for the object [`class`](cil_class_and_permission_statements.md#class) identifier. Requires policy version 27. 64 65 (defaultrole class_id default) 66 67**Where:** 68 69<table> 70<colgroup> 71<col width="25%" /> 72<col width="75%" /> 73</colgroup> 74<tbody> 75<tr class="odd"> 76<td align="left"><p><code>defaultrole</code></p></td> 77<td align="left"><p>The <code>defaultrole</code> keyword.</p></td> 78</tr> 79<tr class="even"> 80<td align="left"><p><code>class_id</code></p></td> 81<td align="left"><p>A single previously declared <code>class</code> or <code>classmap</code> identifier, or a list of previously declared <code>class</code> or <code>classmap</code> identifiers enclosed within parentheses.</p></td> 82</tr> 83<tr class="odd"> 84<td align="left"><p><code>default</code></p></td> 85<td align="left"><p>A keyword of either <code>source</code> or <code>target</code>.</p></td> 86</tr> 87</tbody> 88</table> 89 90**Example:** 91 92When creating new `binder`, `property_service` or `zygote` objects the [`role`](cil_role_statements.md#role) component of the new security context will be taken from the `target` context: 93 94 (class binder (impersonate call set_context_mgr transfer receive)) 95 (class property_service (set)) 96 (class zygote (specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo)) 97 98 (defaultrole (binder property_service zygote) target) 99 100 ; Will produce the following in the binary policy file: 101 ;; default_role binder target; 102 ;; default_role zygote target; 103 ;; default_role property_service target; 104 105defaulttype 106----------- 107 108Allows the default type to be taken from the source or target context when computing a new context for the object [`class`](cil_class_and_permission_statements.md#class) identifier. Requires policy version 28. 109 110**Statement definition:** 111 112 (defaulttype class_id default) 113 114**Where:** 115 116<table> 117<colgroup> 118<col width="25%" /> 119<col width="75%" /> 120</colgroup> 121<tbody> 122<tr class="odd"> 123<td align="left"><p><code>defaulttype</code></p></td> 124<td align="left"><p>The <code>defaulttype</code> keyword.</p></td> 125</tr> 126<tr class="even"> 127<td align="left"><p><code>class_id</code></p></td> 128<td align="left"><p>A single previously declared <code>class</code> or <code>classmap</code> identifier, or a list of previously declared <code>class</code> or <code>classmap</code> identifiers enclosed within parentheses.</p></td> 129</tr> 130<tr class="odd"> 131<td align="left"><p><code>default</code></p></td> 132<td align="left"><p>A keyword of either <code>source</code> or <code>target</code>.</p></td> 133</tr> 134</tbody> 135</table> 136 137**Example:** 138 139When creating a new `socket` object, the [`type`](cil_type_statements.md#type) component of the new security context will be taken from the `source` context: 140 141 (defaulttype socket source) 142 143defaultrange 144------------ 145 146Allows the default level or range to be taken from the source or target context when computing a new context for the object [`class`](cil_class_and_permission_statements.md#class) identifier. Requires policy version 27. 147 148**Statement definition:** 149 150 (defaultrange class_id default range) 151 152**Where:** 153 154<table> 155<colgroup> 156<col width="25%" /> 157<col width="75%" /> 158</colgroup> 159<tbody> 160<tr class="odd"> 161<td align="left"><p><code>defaultrange</code></p></td> 162<td align="left"><p>The <code>defaultrange</code> keyword.</p></td> 163</tr> 164<tr class="even"> 165<td align="left"><p><code>class_id</code></p></td> 166<td align="left"><p>A single previously declared <code>class</code> or <code>classmap</code> identifier, or a list of previously declared <code>class</code> or <code>classmap</code> identifiers enclosed within parentheses.</p></td> 167</tr> 168<tr class="odd"> 169<td align="left"><p><code>default</code></p></td> 170<td align="left"><p>A keyword of either <code>source</code> or <code>target</code>.</p></td> 171</tr> 172<tr class="even"> 173<td align="left"><p><code>range</code></p></td> 174<td align="left"><p>A keyword of either <code>low</code>, <code>high</code> or <code>low-high</code>.</p></td> 175</tr> 176</tbody> 177</table> 178 179**Example:** 180 181When creating a new `file` object, the appropriate `range` component of the new security context will be taken from the `target` context: 182 183 (defaultrange file target low_high) 184