1Conditional Statements 2====================== 3 4boolean 5------- 6 7Declares a run time boolean as true or false in the current namespace. The [`booleanif`](cil_conditional_statements.md#booleanif) statement contains the CIL code that will be in the binary policy file. 8 9[`boolean`](cil_conditional_statements.md#boolean) are not allowed in [`booleanif`](cil_conditional_statements.md#booleanif) blocks. 10 11**Statement definition:** 12 13```secil 14 (boolean boolean_id true|false) 15``` 16 17**Where:** 18 19<table> 20<colgroup> 21<col width="25%" /> 22<col width="75%" /> 23</colgroup> 24<tbody> 25<tr class="odd"> 26<td align="left"><p><code>boolean</code></p></td> 27<td align="left"><p>The <code>boolean</code> keyword.</p></td> 28</tr> 29<tr class="even"> 30<td align="left"><p><code>boolean_id</code></p></td> 31<td align="left"><p>The <code>boolean</code> identifier.</p></td> 32</tr> 33<tr class="odd"> 34<td align="left"><p><code>true | false</code></p></td> 35<td align="left"><p>The initial state of the boolean. This can be changed at run time using <strong><code>setsebool</code></strong><code>(8)</code> and its status queried using <strong><code>getsebool</code></strong><code>(8)</code>.</p></td> 36</tr> 37</tbody> 38</table> 39 40**Example:** 41 42See the [`booleanif`](cil_conditional_statements.md#booleanif) statement for an example. 43 44booleanif 45--------- 46 47Contains the run time conditional statements that are instantiated in the binary policy according to the computed boolean identifier(s) state. 48 49[`call`](cil_call_macro_statements.md#call) statements are allowed within a [`booleanif`](cil_conditional_statements.md#booleanif), however the contents of the resulting macro must be limited to those of the [`booleanif`](cil_conditional_statements.md#booleanif) statement (i.e. [`allow`](cil_access_vector_rules.md#allow), [`auditallow`](cil_access_vector_rules.md#auditallow), [`dontaudit`](cil_access_vector_rules.md#dontaudit), [`typemember`](cil_type_statements.md#typemember), [`typetransition`](cil_type_statements.md#typetransition), [`typechange`](cil_type_statements.md#typechange) and the compile time [`tunableif`](cil_conditional_statements.md#tunableif) statement)). 50 51**Statement definition:** 52 53```secil 54 (booleanif boolean_id | expr ... 55 (true 56 cil_statements 57 ...) 58 (false 59 cil_statements 60 ...) 61 ) 62``` 63 64**Where:** 65 66<table> 67<colgroup> 68<col width="25%" /> 69<col width="75%" /> 70</colgroup> 71<tbody> 72<tr class="odd"> 73<td align="left"><p><code>booleanif</code></p></td> 74<td align="left"><p>The <code>booleanif</code> keyword.</p></td> 75</tr> 76<tr class="even"> 77<td align="left"><p><code>boolean_id</code></p></td> 78<td align="left"><p>Either a single <code>boolean</code> identifier or one or more <code>expr</code>'s.</p></td> 79</tr> 80<tr class="odd"> 81<td align="left"><p><code>expr</code></p></td> 82<td align="left"><p>Zero or more <code>expr</code>'s, the valid operators and syntax are:</p> 83<p><code> (and boolean_id boolean_id)</code></p> 84<p><code> (or boolean_id boolean_id)</code></p> 85<p><code> (xor boolean_id boolean_id)</code></p> 86<p><code> (eq boolean_id boolean_id)</code></p> 87<p><code> (neq boolean_id boolean_id)</code></p> 88<p><code> (not boolean_id)</code></p></td> 89</tr> 90<tr class="even"> 91<td align="left"><p><code>true</code></p></td> 92<td align="left"><p>An optional set of CIL statements that will be instantiated when the <code>boolean</code> is evaluated as <code>true</code>.</p></td> 93</tr> 94<tr class="odd"> 95<td align="left"><p><code>false</code></p></td> 96<td align="left"><p>An optional set of CIL statements that will be instantiated when the <code>boolean</code> is evaluated as <code>false</code>.</p></td> 97</tr> 98</tbody> 99</table> 100 101**Examples:** 102 103The second example also shows the kernel policy language equivalent: 104 105```secil 106 (boolean disableAudio false) 107 108 (booleanif disableAudio 109 (false 110 (allow process mediaserver.audio_device (chr_file_set (rw_file_perms))) 111 ) 112 ) 113 114 (boolean disableAudioCapture false) 115 116 ;;; if(!disableAudio && !disableAudioCapture) { 117 (booleanif (and (not disableAudio) (not disableAudioCapture)) 118 (true 119 (allow process mediaserver.audio_capture_device (chr_file_set (rw_file_perms))) 120 ) 121 ) 122``` 123 124tunable 125------- 126 127Tunables are similar to booleans, however they are used to manage areas of CIL statements that may or may not be in the final CIL policy that will be compiled (whereas booleans are embedded in the binary policy and can be enabled or disabled during run-time). 128 129Note that tunables can be treated as booleans by the CIL compiler command line parameter `-P` or `--preserve-tunables` flags. 130 131Since [`tunableif`](cil_conditional_statements.md#tunableif) statements are resolved first, [`tunable`](cil_conditional_statements.md#tunable) statements are not allowed in [`in`](cil_container_statements.md#in), [`macro`](cil_call_macro_statements.md#macro), [`optional`](cil_container_statements.md#optional), and [`booleanif`](cil_conditional_statements.md#booleanif) blocks. To simplify processing, they are also not allowed in [`tunableif`](cil_conditional_statements.md#tunableif) blocks. 132 133**Statement definition:** 134 135```secil 136 (tunable tunable_id true|false) 137``` 138 139**Where:** 140 141<table> 142<colgroup> 143<col width="25%" /> 144<col width="75%" /> 145</colgroup> 146<tbody> 147<tr class="odd"> 148<td align="left"><p><code>tunable</code></p></td> 149<td align="left"><p>The <code>tunable</code> keyword.</p></td> 150</tr> 151<tr class="even"> 152<td align="left"><p><code>tunable_id</code></p></td> 153<td align="left"><p>The <code>tunable</code> identifier.</p></td> 154</tr> 155<tr class="odd"> 156<td align="left"><p><code>true | false</code></p></td> 157<td align="left"><p>The initial state of the <code>tunable</code>.</p></td> 158</tr> 159</tbody> 160</table> 161 162**Example:** 163 164See the [`tunableif`](cil_conditional_statements.md#tunableif) statement for an example. 165 166tunableif 167--------- 168 169Compile time conditional statement that may or may not add CIL statements to be compiled. 170 171If tunables are being treated as booleans (by using the CIL compiler command line parameter `-P` or `--preserve-tunables` flag), then only the statements allowed in a [`booleanif`](cil_conditional_statements.md#booleanif) block are allowed in a [`tunableif`](cil_conditional_statements.md#tunableif) block. Otherwise, [`tunable`](cil_conditional_statements.md#tunable) statements are not allowed in a [`tunableif`](cil_conditional_statements.md#tunableif) block. 172 173**Statement definition:** 174 175```secil 176 (tunableif tunable_id | expr ... 177 (true 178 cil_statements 179 ...) 180 (false 181 cil_statements 182 ...) 183 ) 184``` 185 186**Where:** 187 188<table> 189<colgroup> 190<col width="25%" /> 191<col width="75%" /> 192</colgroup> 193<tbody> 194<tr class="odd"> 195<td align="left"><p><code>tunableif</code></p></td> 196<td align="left"><p>The <code>tunableif</code> keyword.</p></td> 197</tr> 198<tr class="even"> 199<td align="left"><p><code>tunable_id</code></p></td> 200<td align="left"><p>Either a single <code>tunable</code> identifier or one or more <code>expr</code>'s.</p></td> 201</tr> 202<tr class="odd"> 203<td align="left"><p><code>expr</code></p></td> 204<td align="left"><p>Zero or more <code>expr</code>'s, the valid operators and syntax are:</p> 205<p><code> (and tunable_id tunable_id)</code></p> 206<p><code> (or tunable_id tunable_id)</code></p> 207<p><code> (xor tunable_id tunable_id)</code></p> 208<p><code> (eq tunable_id tunable_id)</code></p> 209<p><code> (neq tunable_id tunable_id)</code></p> 210<p><code> (not tunable_id)</code></p></td> 211</tr> 212<tr class="even"> 213<td align="left"><p><code>true</code></p></td> 214<td align="left"><p>An optional set of CIL statements that will be instantiated when the <code>tunable</code> is evaluated as <code>true</code>.</p></td> 215</tr> 216<tr class="odd"> 217<td align="left"><p><code>false</code></p></td> 218<td align="left"><p>An optional set of CIL statements that will be instantiated when the <code>tunable</code> is evaluated as <code>false</code>.</p></td> 219</tr> 220</tbody> 221</table> 222 223**Example:** 224 225This example will not add the range transition rule to the binary policy: 226 227```secil 228 (tunable range_trans_rule false) 229 230 (block init 231 (class process (process)) 232 (type process) 233 234 (tunableif range_trans_rule 235 (true 236 (rangetransition process sshd.exec process low_high) 237 ) 238 ) ; End tunableif 239 ) ; End block 240``` 241