• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1Multi-Level Security Labeling Statements
2========================================
3
4Because there are many options for MLS labeling, the examples show a limited selection of statements, however there is a simple policy that will build shown in the [`levelrange`](cil_mls_labeling_statements.md#levelrange) section.
5
6sensitivity
7-----------
8
9Declare a sensitivity identifier in the current namespace. Multiple [`sensitivity`](cil_mls_labeling_statements.md#sensitivity) statements in the policy will form an ordered list.
10
11**Statement definition:**
12
13    (sensitivity sensitivity_id)
14
15**Where:**
16
17<table>
18<colgroup>
19<col width="25%" />
20<col width="75%" />
21</colgroup>
22<tbody>
23<tr class="odd">
24<td align="left"><p><code>sensitivity</code></p></td>
25<td align="left"><p>The <code>sensitivity</code> keyword.</p></td>
26</tr>
27<tr class="even">
28<td align="left"><p><code>sensitivity_id</code></p></td>
29<td align="left"><p>The <code>sensitivity</code> identifier.</p></td>
30</tr>
31</tbody>
32</table>
33
34**Example:**
35
36This example declares three [`sensitivity`](cil_mls_labeling_statements.md#sensitivity) identifiers:
37
38    (sensitivity s0)
39    (sensitivity s1)
40    (sensitivity s2)
41
42sensitivityalias
43----------------
44
45Declares a sensitivity alias identifier in the current namespace. See the [`sensitivityaliasactual`](cil_mls_labeling_statements.md#sensitivityaliasactual) statement for an example that associates the [`sensitivityalias`](cil_mls_labeling_statements.md#sensitivityalias) identifier.
46
47**Statement definition:**
48
49    (sensitivityalias sensitivityalias_id)
50
51**Where:**
52
53<table>
54<colgroup>
55<col width="25%" />
56<col width="75%" />
57</colgroup>
58<tbody>
59<tr class="odd">
60<td align="left"><p><code>sensitivityalias</code></p></td>
61<td align="left"><p>The <code>sensitivityalias</code> keyword.</p></td>
62</tr>
63<tr class="even">
64<td align="left"><p><code>sensitivityalias_id</code></p></td>
65<td align="left"><p>The <code>sensitivityalias</code> identifier.</p></td>
66</tr>
67</tbody>
68</table>
69
70**Example:**
71
72See the [`sensitivityaliasactual`](cil_mls_labeling_statements.md#sensitivityaliasactual) statement.
73
74sensitivityaliasactual
75----------------------
76
77Associates a previously declared [`sensitivityalias`](cil_mls_labeling_statements.md#sensitivityalias) identifier to a previously declared [`sensitivity`](cil_mls_labeling_statements.md#sensitivity) identifier.
78
79**Statement definition:**
80
81    (sensitivityaliasactual sensitivityalias_id sensitivity_id)
82
83**Where:**
84
85<table>
86<colgroup>
87<col width="29%" />
88<col width="70%" />
89</colgroup>
90<tbody>
91<tr class="odd">
92<td align="left"><p><code>sensitivityaliasactual</code></p></td>
93<td align="left"><p>The <code>sensitivityaliasactual</code> keyword.</p></td>
94</tr>
95<tr class="even">
96<td align="left"><p><code>sensitivityalias_id</code></p></td>
97<td align="left"><p>A single previously declared <code>sensitivityalias</code> identifier.</p></td>
98</tr>
99<tr class="odd">
100<td align="left"><p><code>sensitivity_id</code></p></td>
101<td align="left"><p>A single previously declared <code>sensitivity</code> identifier.</p></td>
102</tr>
103</tbody>
104</table>
105
106**Example:**
107
108This example will associate sensitivity `s0` with two sensitivity alias's:
109
110    (sensitivity s0)
111    (sensitivityalias unclassified)
112    (sensitivityalias SystemLow)
113    (sensitivityaliasactual unclassified s0)
114    (sensitivityaliasactual SystemLow s0)
115
116sensitivityorder
117----------------
118
119Define the sensitivity order - lowest to highest. Multiple [`sensitivityorder`](cil_mls_labeling_statements.md#sensitivityorder) statements in the policy will form an ordered list.
120
121**Statement definition:**
122
123    (sensitivityorder (sensitivity_id ...))
124
125**Where:**
126
127<table>
128<colgroup>
129<col width="25%" />
130<col width="75%" />
131</colgroup>
132<tbody>
133<tr class="odd">
134<td align="left"><p><code>sensitivityorder</code></p></td>
135<td align="left"><p>The <code>sensitivityorder</code> keyword.</p></td>
136</tr>
137<tr class="even">
138<td align="left"><p><code>sensitivity_id</code></p></td>
139<td align="left"><p>One or more previously declared <code>sensitivity</code> or <code>sensitivityalias</code> identifiers..</p></td>
140</tr>
141</tbody>
142</table>
143
144**Example:**
145
146This example shows two [`sensitivityorder`](cil_mls_labeling_statements.md#sensitivityorder) statements that when compiled will form an ordered list. Note however that the second [`sensitivityorder`](cil_mls_labeling_statements.md#sensitivityorder) statement starts with `s2` so that the ordered list can be built.
147
148    (sensitivity s0)
149    (sensitivityalias s0 SystemLow)
150    (sensitivity s1)
151    (sensitivity s2)
152    (sensitivityorder (SystemLow s1 s2))
153
154    (sensitivity s3)
155    (sensitivity s4)
156    (sensitivityalias s4 SystemHigh)
157    (sensitivityorder (s2 s3 SystemHigh))
158
159category
160--------
161
162Declare a category identifier in the current namespace. Multiple category statements declared in the policy will form an ordered list.
163
164**Statement definition:**
165
166    (category category_id)
167
168**Where:**
169
170<table>
171<colgroup>
172<col width="25%" />
173<col width="75%" />
174</colgroup>
175<tbody>
176<tr class="odd">
177<td align="left"><p><code>category</code></p></td>
178<td align="left"><p>The <code>category</code> keyword.</p></td>
179</tr>
180<tr class="even">
181<td align="left"><p><code>category_id</code></p></td>
182<td align="left"><p>The <code>category</code> identifier.</p></td>
183</tr>
184</tbody>
185</table>
186
187**Example:**
188
189This example declares a three [`category`](cil_mls_labeling_statements.md#category) identifiers:
190
191    (category c0)
192    (category c1)
193    (category c2)
194
195categoryalias
196-------------
197
198Declares a category alias identifier in the current namespace. See the [`categoryaliasactual`](cil_mls_labeling_statements.md#categoryaliasactual) statement for an example that associates the [`categoryalias`](cil_mls_labeling_statements.md#categoryalias) identifier.
199
200**Statement definition:**
201
202    (categoryalias categoryalias_id)
203
204**Where:**
205
206<table>
207<colgroup>
208<col width="25%" />
209<col width="75%" />
210</colgroup>
211<tbody>
212<tr class="odd">
213<td align="left"><p><code>categoryalias</code></p></td>
214<td align="left"><p>The <code>categoryalias</code> keyword.</p></td>
215</tr>
216<tr class="even">
217<td align="left"><p><code>categoryalias_id</code></p></td>
218<td align="left"><p>The <code>categoryalias</code> identifier.</p></td>
219</tr>
220</tbody>
221</table>
222
223categoryaliasactual
224-------------------
225
226Associates a previously declared [`categoryalias`](cil_mls_labeling_statements.md#categoryalias) identifier to a previously declared [`category`](cil_mls_labeling_statements.md#category) identifier.
227
228**Statement definition:**
229
230    (categoryaliasactual categoryalias_id category_id)
231
232**Where:**
233
234<table>
235<colgroup>
236<col width="25%" />
237<col width="75%" />
238</colgroup>
239<tbody>
240<tr class="odd">
241<td align="left"><p><code>categoryaliasactual</code></p></td>
242<td align="left"><p>The <code>categoryaliasactual</code> keyword.</p></td>
243</tr>
244<tr class="even">
245<td align="left"><p><code>categoryalias_id</code></p></td>
246<td align="left"><p>A single previously declared <code>categoryalias</code> identifier.</p></td>
247</tr>
248<tr class="odd">
249<td align="left"><p><code>category_id</code></p></td>
250<td align="left"><p>A single previously declared <code>category</code> identifier.</p></td>
251</tr>
252</tbody>
253</table>
254
255**Example:**
256
257Declares a category `c0`, a category alias of `documents`, and then associates them:
258
259    (category c0)
260    (categoryalias documents)
261    (categoryaliasactual documents c0)
262
263categoryorder
264-------------
265
266Define the category order. Multiple [`categoryorder`](cil_mls_labeling_statements.md#categoryorder) statements declared in the policy will form an ordered list. Note that this statement orders the categories to allow validation of category ranges.
267
268**Statement definition:**
269
270    (categoryorder (category_id ...))
271
272**Where:**
273
274<table>
275<colgroup>
276<col width="25%" />
277<col width="75%" />
278</colgroup>
279<tbody>
280<tr class="odd">
281<td align="left"><p><code>categoryorder</code></p></td>
282<td align="left"><p>The <code>categoryorder</code> keyword.</p></td>
283</tr>
284<tr class="even">
285<td align="left"><p><code>category_id</code></p></td>
286<td align="left"><p>One or more previously declared <code>category</code> or <code>categoryalias</code> identifiers.</p></td>
287</tr>
288</tbody>
289</table>
290
291**Example:**
292
293This example orders one category alias and nine categories:
294
295    (categoryorder (documents c1 c2 c3 c4 c5 c6 c7 c8 c9)
296
297categoryset
298-----------
299
300Declare an identifier for a set of contiguous or non-contiguous categories in the current namespace.
301
302Notes:
303
304-   Category expressions are allowed in [`categoryset`](cil_mls_labeling_statements.md#categoryset), [`sensitivitycategory`](cil_mls_labeling_statements.md#sensitivitycategory), [`level`](cil_mls_labeling_statements.md#level), and [`levelrange`](cil_mls_labeling_statements.md#levelrange) statements.
305
306-   Category sets are not allowed in [`categoryorder`](cil_mls_labeling_statements.md#categoryorder) statements.
307
308**Statement definition:**
309
310    (categoryset categoryset_id (category_id ... | expr ...))
311
312**Where:**
313
314<table>
315<colgroup>
316<col width="25%" />
317<col width="75%" />
318</colgroup>
319<tbody>
320<tr class="odd">
321<td align="left"><p><code>categoryset</code></p></td>
322<td align="left"><p>The <code>categoryset</code> keyword.</p></td>
323</tr>
324<tr class="even">
325<td align="left"><p><code>categoryset_id</code></p></td>
326<td align="left"><p>The <code>categoryset</code> identifier.</p></td>
327</tr>
328<tr class="odd">
329<td align="left"><p><code>category_id</code></p></td>
330<td align="left"><p>Zero or more previously declared <code>category</code> or <code>categoryalias</code> identifiers.</p>
331<p>Note that there must be at least one <code>category_id</code> identifier or <code>expr</code> parameter declared.</p></td>
332</tr>
333<tr class="even">
334<td align="left"><p><code>expr</code></p></td>
335<td align="left"><p>Zero or more <code>expr</code>'s, the valid operators and syntax are:</p>
336<p><code>    (and (category_id ...) (category_id ...))</code></p>
337<p><code>    (or  (category_id ...) (category_id ...))</code></p>
338<p><code>    (xor (category_id ...) (category_id ...))</code></p>
339<p><code>    (not (category_id ...))</code></p>
340<p><code>    (range category_id category_id)</code></p>
341<p><code>    (all)</code></p></td>
342</tr>
343</tbody>
344</table>
345
346**Examples:**
347
348These examples show a selection of [`categoryset`](cil_mls_labeling_statements.md#categoryset) statements:
349
350    ; Declare categories with two alias's:
351    (category c0)
352    (categoryalias documents)
353    (categoryaliasactual documents c0)
354    (category c1)
355    (category c2)
356    (category c3)
357    (category c4)
358    (categoryalias spreadsheets)
359    (categoryaliasactual spreadsheets c4)
360
361    ; Set the order to determine ranges:
362    (categoryorder (c0 c1 c2 c3 spreadsheets))
363
364    (categoryset catrange_1 (range c2 c3))
365
366    ; Two methods to associate all categories:
367    (categoryset all_cats (range c0 c4))
368    (categoryset all_cats1 (all))
369
370    (categoryset catset_1 (documents c1))
371    (categoryset catset_2 (c2 c3))
372    (categoryset catset_3 (c4))
373
374    (categoryset just_c0 (xor (c1 c2) (documents c1 c2)))
375
376sensitivitycategory
377-------------------
378
379Associate a [`sensitivity`](cil_mls_labeling_statements.md#sensitivity) identifier with one or more [category](#category)'s. Multiple definitions for the same [`sensitivity`](cil_mls_labeling_statements.md#sensitivity) form an ordered list of categories for that sensitivity. This statement is required before a [`level`](cil_mls_labeling_statements.md#level) identifier can be declared.
380
381**Statement definition:**
382
383    (sensitivitycategory sensitivity_id categoryset_id)
384
385**Where:**
386
387<table>
388<colgroup>
389<col width="25%" />
390<col width="75%" />
391</colgroup>
392<tbody>
393<tr class="odd">
394<td align="left"><p><code>sensitivitycategory</code></p></td>
395<td align="left"><p>The <code>sensitivitycategory</code> keyword.</p></td>
396</tr>
397<tr class="even">
398<td align="left"><p><code>sensitivity_id</code></p></td>
399<td align="left"><p>A single previously declared <code>sensitivity</code> or <code>sensitivityalias</code> identifier.</p></td>
400</tr>
401<tr class="odd">
402<td align="left"><p><code>categoryset_id</code></p></td>
403<td align="left"><p>A single previously declared <code>categoryset</code> (named or anonymous), or a list of <code>category</code> and/or <code>categoryalias</code> identifiers. The examples show each variation.</p></td>
404</tr>
405</tbody>
406</table>
407
408**Examples:**
409
410These [`sensitivitycategory`](cil_mls_labeling_statements.md#sensitivitycategory) examples use a selection of [`category`](cil_mls_labeling_statements.md#category), [`categoryalias`](cil_mls_labeling_statements.md#categoryalias) and [`categoryset`](cil_mls_labeling_statements.md#categoryset)'s:
411
412    (sensitivitycategory s0 catrange_1)
413    (sensitivitycategory s0 catset_1)
414    (sensitivitycategory s0 catset_3)
415    (sensitivitycategory s0 (all))
416    (sensitivitycategory unclassified (range documents c2))
417
418level
419-----
420
421Declare a [`level`](cil_mls_labeling_statements.md#level) identifier in the current namespace and associate it to a previously declared [`sensitivity`](cil_mls_labeling_statements.md#sensitivity) and zero or more categories. Note that if categories are required, then before this statement can be resolved the [`sensitivitycategory`](cil_mls_labeling_statements.md#sensitivitycategory) statement must be used to associate categories with the sensitivity.
422
423**Statement definition:**
424
425    level level_id (sensitivity_id [categoryset_id])
426
427**Where:**
428
429<table>
430<colgroup>
431<col width="25%" />
432<col width="75%" />
433</colgroup>
434<tbody>
435<tr class="odd">
436<td align="left"><p><code>level</code></p></td>
437<td align="left"><p>The <code>level</code> keyword.</p></td>
438</tr>
439<tr class="even">
440<td align="left"><p><code>level_id</code></p></td>
441<td align="left"><p>The <code>level</code> identifier.</p></td>
442</tr>
443<tr class="odd">
444<td align="left"><p><code>sensitivity_id</code></p></td>
445<td align="left"><p>A single previously declared <code>sensitivity</code> or <code>sensitivityalias</code> identifier.</p></td>
446</tr>
447<tr class="even">
448<td align="left"><p><code>categoryset_id</code></p></td>
449<td align="left"><p>A single previously declared <code>categoryset</code> (named or anonymous), or a list of <code>category</code> and/or <code>categoryalias</code> identifiers. The examples show each variation.</p></td>
450</tr>
451</tbody>
452</table>
453
454**Examples:**
455
456These [`level`](cil_mls_labeling_statements.md#level) examples use a selection of [`category`](cil_mls_labeling_statements.md#category), [`categoryalias`](cil_mls_labeling_statements.md#categoryalias) and [`categoryset`](cil_mls_labeling_statements.md#categoryset)'s:
457
458    (level systemLow (s0))
459    (level level_1 (s0))
460    (level level_2 (s0 (catrange_1)))
461    (level level_3 (s0 (all_cats)))
462    (level level_4 (unclassified (c2 c3 c4)))
463
464levelrange
465----------
466
467Declare a level range identifier in the current namespace and associate a current and clearance level.
468
469**Statement definition:**
470
471    (levelrange levelrange_id (low_level_id high_level_id))
472
473**Where:**
474
475<table>
476<colgroup>
477<col width="25%" />
478<col width="75%" />
479</colgroup>
480<tbody>
481<tr class="odd">
482<td align="left"><p><code>levelrange</code></p></td>
483<td align="left"><p>The <code>levelrange</code> keyword.</p></td>
484</tr>
485<tr class="even">
486<td align="left"><p><code>levelrange_id</code></p></td>
487<td align="left"><p>The <code>levelrange</code> identifier.</p></td>
488</tr>
489<tr class="odd">
490<td align="left"><p><code>low_level_id</code></p></td>
491<td align="left"><p>The current level specified by a previously declared <code>level</code> identifier. This may be formed by named or anonymous components as discussed in the <code>level</code> section and shown in the examples.</p></td>
492</tr>
493<tr class="even">
494<td align="left"><p><code>high_level_id</code></p></td>
495<td align="left"><p>The clearance or high level specified by a previously declared <code>level</code> identifier. This may be formed by named or anonymous components as discussed in the <code>level</code> section and shown in the examples.</p></td>
496</tr>
497</tbody>
498</table>
499
500**Examples:**
501
502This example policy shows [`levelrange`](cil_mls_labeling_statements.md#levelrange) statement and all the other MLS labeling statements discussed in this section and will compile as a standalone policy:
503
504    (handleunknown allow)
505    (mls true)
506
507    ; There must be least one set of SID statements in a policy:
508    (sid kernel)
509    (sidorder (kernel))
510    (sidcontext kernel unconfined.context_1)
511
512    (sensitivitycategory s0 (c4 c2 c3 c1 c0 c3))
513
514    (category c0)
515    (categoryalias documents)
516    (categoryaliasactual documents c0)
517    (category c1)
518    (category c2)
519    (category c3)
520    (category c4)
521    (categoryalias spreadsheets)
522    (categoryaliasactual spreadsheets c4)
523
524    (categoryorder (c0 c1 c2 c3 spreadsheets))
525
526    (categoryset catrange_1 (range c2 c3))
527    (categoryset all_cats (range c0 c4))
528    (categoryset all_cats1 (all))
529
530    (categoryset catset_1 (documents c1))
531    (categoryset catset_2 (c2 c3))
532    (categoryset catset_3 (c4))
533
534    (categoryset just_c0 (xor (c1 c2) (documents c1 c2)))
535
536    (sensitivity s0)
537    (sensitivityalias unclassified)
538    (sensitivityaliasactual unclassified s0)
539
540    (sensitivityorder (s0))
541    (sensitivitycategory s0 (c0))
542
543    (sensitivitycategory s0 catrange_1)
544    (sensitivitycategory s0 catset_1)
545    (sensitivitycategory s0 catset_3)
546    (sensitivitycategory s0 (all))
547    (sensitivitycategory s0 (range documents c2))
548
549    (level systemLow (s0))
550    (level level_1 (s0))
551    (level level_2 (s0 (catrange_1)))
552    (level level_3 (s0 (all_cats)))
553    (level level_4 (unclassified (c2 c3 c4)))
554
555    (levelrange levelrange_2 (level_2 level_2))
556    (levelrange levelrange_1 ((s0) level_2))
557    (levelrange low_low (systemLow systemLow))
558
559    (context context_2 (unconfined.user object_r unconfined.object (level_1 level_3)))
560
561    ; Define object_r role. This must be assigned in CIL.
562    (role object_r)
563
564    (block unconfined
565        (user user)
566        (role role)
567        (type process)
568        (type object)
569        (userrange user (systemLow systemLow))
570        (userlevel user systemLow)
571        (userrole user role)
572        (userrole user object_r)
573        (roletype role process)
574        (roletype role object)
575        (roletype object_r object)
576
577        (class file (open execute read write))
578
579        ; There must be least one allow rule in a policy:
580        (allow process self (file (read)))
581
582        (context context_1 (user object_r object low_low))
583    ) ; End unconfined namespace
584
585rangetransition
586---------------
587
588Allows an objects level to transition to a different level. Generally used to ensure processes run with their correct MLS range, for example `init` would run at `SystemHigh` and needs to initialise / run other processes at their correct MLS range.
589
590**Statement definition:**
591
592    (rangetransition source_id target_id class_id new_range_id)
593
594**Where:**
595
596<table>
597<colgroup>
598<col width="25%" />
599<col width="75%" />
600</colgroup>
601<tbody>
602<tr class="odd">
603<td align="left"><p><code>rangetransition</code></p></td>
604<td align="left"><p>The <code>rangetransition</code> keyword.</p></td>
605</tr>
606<tr class="even">
607<td align="left"><p><code>source_type_id</code></p></td>
608<td align="left"><p>A single previously declared <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td>
609</tr>
610<tr class="odd">
611<td align="left"><p><code>target_type_id</code></p></td>
612<td align="left"><p>A single previously declared <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td>
613</tr>
614<tr class="even">
615<td align="left"><p><code>class_id</code></p></td>
616<td align="left"><p>A single previously declared <code>class</code> or <code>classmap</code> identifier.</p></td>
617</tr>
618<tr class="odd">
619<td align="left"><p><code>new_range_id</code></p></td>
620<td align="left"><p>The new MLS range for the object class that is a previously declared <code>levelrange</code> identifier. This entry may also be defined as an anonymous or named <code>level</code>, <code>sensitivity</code>, <code>sensitivityalias</code>, <code>category</code>, <code>categoryalias</code> or <code>categoryset</code> identifier.</p></td>
621</tr>
622</tbody>
623</table>
624
625**Examples:**
626
627This rule will transition the range of `sshd.exec` to `s0 - s1:c0.c3` on execution from the `init.process`:
628
629    (sensitivity s0)
630    (sensitivity s1)
631    (sensitivityorder s0 s1)
632    (category c0)
633    ...
634    (level systemlow (s0)
635    (level systemhigh (s1 (c0 c1 c2)))
636    (levelrange low_high (systemlow systemhigh))
637
638    (rangetransition init.process sshd.exec process low_high)
639