• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1Multi-Level Security Labeling Statements
2========================================
3
4Because there are many options for MLS labeling, the examples show a limited selection of statements, however there is a simple policy that will build shown in the [`levelrange`](cil_mls_labeling_statements.md#levelrange) section.
5
6sensitivity
7-----------
8
9Declare a sensitivity identifier in the current namespace. Multiple [`sensitivity`](cil_mls_labeling_statements.md#sensitivity) statements in the policy will form an ordered list.
10
11**Statement definition:**
12
13```secil
14    (sensitivity sensitivity_id)
15```
16
17**Where:**
18
19<table>
20<colgroup>
21<col width="25%" />
22<col width="75%" />
23</colgroup>
24<tbody>
25<tr class="odd">
26<td align="left"><p><code>sensitivity</code></p></td>
27<td align="left"><p>The <code>sensitivity</code> keyword.</p></td>
28</tr>
29<tr class="even">
30<td align="left"><p><code>sensitivity_id</code></p></td>
31<td align="left"><p>The <code>sensitivity</code> identifier.</p></td>
32</tr>
33</tbody>
34</table>
35
36**Example:**
37
38This example declares three [`sensitivity`](cil_mls_labeling_statements.md#sensitivity) identifiers:
39
40```secil
41    (sensitivity s0)
42    (sensitivity s1)
43    (sensitivity s2)
44```
45
46sensitivityalias
47----------------
48
49Declares a sensitivity alias identifier in the current namespace. See the [`sensitivityaliasactual`](cil_mls_labeling_statements.md#sensitivityaliasactual) statement for an example that associates the [`sensitivityalias`](cil_mls_labeling_statements.md#sensitivityalias) identifier.
50
51**Statement definition:**
52
53```secil
54    (sensitivityalias sensitivityalias_id)
55```
56
57**Where:**
58
59<table>
60<colgroup>
61<col width="25%" />
62<col width="75%" />
63</colgroup>
64<tbody>
65<tr class="odd">
66<td align="left"><p><code>sensitivityalias</code></p></td>
67<td align="left"><p>The <code>sensitivityalias</code> keyword.</p></td>
68</tr>
69<tr class="even">
70<td align="left"><p><code>sensitivityalias_id</code></p></td>
71<td align="left"><p>The <code>sensitivityalias</code> identifier.</p></td>
72</tr>
73</tbody>
74</table>
75
76**Example:**
77
78See the [`sensitivityaliasactual`](cil_mls_labeling_statements.md#sensitivityaliasactual) statement.
79
80sensitivityaliasactual
81----------------------
82
83Associates a previously declared [`sensitivityalias`](cil_mls_labeling_statements.md#sensitivityalias) identifier to a previously declared [`sensitivity`](cil_mls_labeling_statements.md#sensitivity) identifier.
84
85**Statement definition:**
86
87```secil
88    (sensitivityaliasactual sensitivityalias_id sensitivity_id)
89```
90
91**Where:**
92
93<table>
94<colgroup>
95<col width="29%" />
96<col width="70%" />
97</colgroup>
98<tbody>
99<tr class="odd">
100<td align="left"><p><code>sensitivityaliasactual</code></p></td>
101<td align="left"><p>The <code>sensitivityaliasactual</code> keyword.</p></td>
102</tr>
103<tr class="even">
104<td align="left"><p><code>sensitivityalias_id</code></p></td>
105<td align="left"><p>A single previously declared <code>sensitivityalias</code> identifier.</p></td>
106</tr>
107<tr class="odd">
108<td align="left"><p><code>sensitivity_id</code></p></td>
109<td align="left"><p>A single previously declared <code>sensitivity</code> identifier.</p></td>
110</tr>
111</tbody>
112</table>
113
114**Example:**
115
116This example will associate sensitivity `s0` with two sensitivity alias's:
117
118```secil
119    (sensitivity s0)
120    (sensitivityalias unclassified)
121    (sensitivityalias SystemLow)
122    (sensitivityaliasactual unclassified s0)
123    (sensitivityaliasactual SystemLow s0)
124```
125
126sensitivityorder
127----------------
128
129Define the sensitivity order - lowest to highest. Multiple [`sensitivityorder`](cil_mls_labeling_statements.md#sensitivityorder) statements in the policy will form an ordered list.
130
131**Statement definition:**
132
133```secil
134    (sensitivityorder (sensitivity_id ...))
135```
136
137**Where:**
138
139<table>
140<colgroup>
141<col width="25%" />
142<col width="75%" />
143</colgroup>
144<tbody>
145<tr class="odd">
146<td align="left"><p><code>sensitivityorder</code></p></td>
147<td align="left"><p>The <code>sensitivityorder</code> keyword.</p></td>
148</tr>
149<tr class="even">
150<td align="left"><p><code>sensitivity_id</code></p></td>
151<td align="left"><p>One or more previously declared <code>sensitivity</code> or <code>sensitivityalias</code> identifiers..</p></td>
152</tr>
153</tbody>
154</table>
155
156**Example:**
157
158This example shows two [`sensitivityorder`](cil_mls_labeling_statements.md#sensitivityorder) statements that when compiled will form an ordered list. Note however that the second [`sensitivityorder`](cil_mls_labeling_statements.md#sensitivityorder) statement starts with `s2` so that the ordered list can be built.
159
160```secil
161    (sensitivity s0)
162    (sensitivityalias s0 SystemLow)
163    (sensitivity s1)
164    (sensitivity s2)
165    (sensitivityorder (SystemLow s1 s2))
166
167    (sensitivity s3)
168    (sensitivity s4)
169    (sensitivityalias s4 SystemHigh)
170    (sensitivityorder (s2 s3 SystemHigh))
171```
172
173category
174--------
175
176Declare a category identifier in the current namespace. Multiple category statements declared in the policy will form an ordered list.
177
178**Statement definition:**
179
180```secil
181    (category category_id)
182```
183
184**Where:**
185
186<table>
187<colgroup>
188<col width="25%" />
189<col width="75%" />
190</colgroup>
191<tbody>
192<tr class="odd">
193<td align="left"><p><code>category</code></p></td>
194<td align="left"><p>The <code>category</code> keyword.</p></td>
195</tr>
196<tr class="even">
197<td align="left"><p><code>category_id</code></p></td>
198<td align="left"><p>The <code>category</code> identifier.</p></td>
199</tr>
200</tbody>
201</table>
202
203**Example:**
204
205This example declares a three [`category`](cil_mls_labeling_statements.md#category) identifiers:
206
207```secil
208    (category c0)
209    (category c1)
210    (category c2)
211```
212
213categoryalias
214-------------
215
216Declares a category alias identifier in the current namespace. See the [`categoryaliasactual`](cil_mls_labeling_statements.md#categoryaliasactual) statement for an example that associates the [`categoryalias`](cil_mls_labeling_statements.md#categoryalias) identifier.
217
218**Statement definition:**
219
220```secil
221    (categoryalias categoryalias_id)
222```
223
224**Where:**
225
226<table>
227<colgroup>
228<col width="25%" />
229<col width="75%" />
230</colgroup>
231<tbody>
232<tr class="odd">
233<td align="left"><p><code>categoryalias</code></p></td>
234<td align="left"><p>The <code>categoryalias</code> keyword.</p></td>
235</tr>
236<tr class="even">
237<td align="left"><p><code>categoryalias_id</code></p></td>
238<td align="left"><p>The <code>categoryalias</code> identifier.</p></td>
239</tr>
240</tbody>
241</table>
242
243categoryaliasactual
244-------------------
245
246Associates a previously declared [`categoryalias`](cil_mls_labeling_statements.md#categoryalias) identifier to a previously declared [`category`](cil_mls_labeling_statements.md#category) identifier.
247
248**Statement definition:**
249
250```secil
251    (categoryaliasactual categoryalias_id category_id)
252```
253
254**Where:**
255
256<table>
257<colgroup>
258<col width="25%" />
259<col width="75%" />
260</colgroup>
261<tbody>
262<tr class="odd">
263<td align="left"><p><code>categoryaliasactual</code></p></td>
264<td align="left"><p>The <code>categoryaliasactual</code> keyword.</p></td>
265</tr>
266<tr class="even">
267<td align="left"><p><code>categoryalias_id</code></p></td>
268<td align="left"><p>A single previously declared <code>categoryalias</code> identifier.</p></td>
269</tr>
270<tr class="odd">
271<td align="left"><p><code>category_id</code></p></td>
272<td align="left"><p>A single previously declared <code>category</code> identifier.</p></td>
273</tr>
274</tbody>
275</table>
276
277**Example:**
278
279Declares a category `c0`, a category alias of `documents`, and then associates them:
280
281```secil
282    (category c0)
283    (categoryalias documents)
284    (categoryaliasactual documents c0)
285```
286
287categoryorder
288-------------
289
290Define the category order. Multiple [`categoryorder`](cil_mls_labeling_statements.md#categoryorder) statements declared in the policy will form an ordered list. Note that this statement orders the categories to allow validation of category ranges.
291
292**Statement definition:**
293
294```secil
295    (categoryorder (category_id ...))
296```
297
298**Where:**
299
300<table>
301<colgroup>
302<col width="25%" />
303<col width="75%" />
304</colgroup>
305<tbody>
306<tr class="odd">
307<td align="left"><p><code>categoryorder</code></p></td>
308<td align="left"><p>The <code>categoryorder</code> keyword.</p></td>
309</tr>
310<tr class="even">
311<td align="left"><p><code>category_id</code></p></td>
312<td align="left"><p>One or more previously declared <code>category</code> or <code>categoryalias</code> identifiers.</p></td>
313</tr>
314</tbody>
315</table>
316
317**Example:**
318
319This example orders one category alias and nine categories:
320
321```secil
322    (categoryorder (documents c1 c2 c3 c4 c5 c6 c7 c8 c9)
323```
324
325categoryset
326-----------
327
328Declare an identifier for a set of contiguous or non-contiguous categories in the current namespace.
329
330Notes:
331
332-   Category expressions are allowed in [`categoryset`](cil_mls_labeling_statements.md#categoryset), [`sensitivitycategory`](cil_mls_labeling_statements.md#sensitivitycategory), [`level`](cil_mls_labeling_statements.md#level), and [`levelrange`](cil_mls_labeling_statements.md#levelrange) statements.
333
334-   Category sets are not allowed in [`categoryorder`](cil_mls_labeling_statements.md#categoryorder) statements.
335
336**Statement definition:**
337
338```secil
339    (categoryset categoryset_id (category_id ... | expr ...))
340```
341
342**Where:**
343
344<table>
345<colgroup>
346<col width="25%" />
347<col width="75%" />
348</colgroup>
349<tbody>
350<tr class="odd">
351<td align="left"><p><code>categoryset</code></p></td>
352<td align="left"><p>The <code>categoryset</code> keyword.</p></td>
353</tr>
354<tr class="even">
355<td align="left"><p><code>categoryset_id</code></p></td>
356<td align="left"><p>The <code>categoryset</code> identifier.</p></td>
357</tr>
358<tr class="odd">
359<td align="left"><p><code>category_id</code></p></td>
360<td align="left"><p>Zero or more previously declared <code>category</code> or <code>categoryalias</code> identifiers.</p>
361<p>Note that there must be at least one <code>category_id</code> identifier or <code>expr</code> parameter declared.</p></td>
362</tr>
363<tr class="even">
364<td align="left"><p><code>expr</code></p></td>
365<td align="left"><p>Zero or more <code>expr</code>'s, the valid operators and syntax are:</p>
366<p><code>    (and (category_id ...) (category_id ...))</code></p>
367<p><code>    (or  (category_id ...) (category_id ...))</code></p>
368<p><code>    (xor (category_id ...) (category_id ...))</code></p>
369<p><code>    (not (category_id ...))</code></p>
370<p><code>    (range category_id category_id)</code></p>
371<p><code>    (all)</code></p></td>
372</tr>
373</tbody>
374</table>
375
376**Examples:**
377
378These examples show a selection of [`categoryset`](cil_mls_labeling_statements.md#categoryset) statements:
379
380```secil
381    ; Declare categories with two alias's:
382    (category c0)
383    (categoryalias documents)
384    (categoryaliasactual documents c0)
385    (category c1)
386    (category c2)
387    (category c3)
388    (category c4)
389    (categoryalias spreadsheets)
390    (categoryaliasactual spreadsheets c4)
391
392    ; Set the order to determine ranges:
393    (categoryorder (c0 c1 c2 c3 spreadsheets))
394
395    (categoryset catrange_1 (range c2 c3))
396
397    ; Two methods to associate all categories:
398    (categoryset all_cats (range c0 c4))
399    (categoryset all_cats1 (all))
400
401    (categoryset catset_1 (documents c1))
402    (categoryset catset_2 (c2 c3))
403    (categoryset catset_3 (c4))
404
405    (categoryset just_c0 (xor (c1 c2) (documents c1 c2)))
406```
407
408sensitivitycategory
409-------------------
410
411Associate a [`sensitivity`](cil_mls_labeling_statements.md#sensitivity) identifier with one or more [category](#category)'s. Multiple definitions for the same [`sensitivity`](cil_mls_labeling_statements.md#sensitivity) form an ordered list of categories for that sensitivity. This statement is required before a [`level`](cil_mls_labeling_statements.md#level) identifier can be declared.
412
413**Statement definition:**
414
415```secil
416    (sensitivitycategory sensitivity_id categoryset_id)
417```
418
419**Where:**
420
421<table>
422<colgroup>
423<col width="25%" />
424<col width="75%" />
425</colgroup>
426<tbody>
427<tr class="odd">
428<td align="left"><p><code>sensitivitycategory</code></p></td>
429<td align="left"><p>The <code>sensitivitycategory</code> keyword.</p></td>
430</tr>
431<tr class="even">
432<td align="left"><p><code>sensitivity_id</code></p></td>
433<td align="left"><p>A single previously declared <code>sensitivity</code> or <code>sensitivityalias</code> identifier.</p></td>
434</tr>
435<tr class="odd">
436<td align="left"><p><code>categoryset_id</code></p></td>
437<td align="left"><p>A single previously declared <code>categoryset</code> (named or anonymous), or a list of <code>category</code> and/or <code>categoryalias</code> identifiers. The examples show each variation.</p></td>
438</tr>
439</tbody>
440</table>
441
442**Examples:**
443
444These [`sensitivitycategory`](cil_mls_labeling_statements.md#sensitivitycategory) examples use a selection of [`category`](cil_mls_labeling_statements.md#category), [`categoryalias`](cil_mls_labeling_statements.md#categoryalias) and [`categoryset`](cil_mls_labeling_statements.md#categoryset)'s:
445
446```secil
447    (sensitivitycategory s0 catrange_1)
448    (sensitivitycategory s0 catset_1)
449    (sensitivitycategory s0 catset_3)
450    (sensitivitycategory s0 (all))
451    (sensitivitycategory unclassified (range documents c2))
452```
453
454level
455-----
456
457Declare a [`level`](cil_mls_labeling_statements.md#level) identifier in the current namespace and associate it to a previously declared [`sensitivity`](cil_mls_labeling_statements.md#sensitivity) and zero or more categories. Note that if categories are required, then before this statement can be resolved the [`sensitivitycategory`](cil_mls_labeling_statements.md#sensitivitycategory) statement must be used to associate categories with the sensitivity.
458
459**Statement definition:**
460
461```secil
462    (level level_id (sensitivity_id [categoryset_id]))
463```
464
465**Where:**
466
467<table>
468<colgroup>
469<col width="25%" />
470<col width="75%" />
471</colgroup>
472<tbody>
473<tr class="odd">
474<td align="left"><p><code>level</code></p></td>
475<td align="left"><p>The <code>level</code> keyword.</p></td>
476</tr>
477<tr class="even">
478<td align="left"><p><code>level_id</code></p></td>
479<td align="left"><p>The <code>level</code> identifier.</p></td>
480</tr>
481<tr class="odd">
482<td align="left"><p><code>sensitivity_id</code></p></td>
483<td align="left"><p>A single previously declared <code>sensitivity</code> or <code>sensitivityalias</code> identifier.</p></td>
484</tr>
485<tr class="even">
486<td align="left"><p><code>categoryset_id</code></p></td>
487<td align="left"><p>A single previously declared <code>categoryset</code> (named or anonymous), or a list of <code>category</code> and/or <code>categoryalias</code> identifiers. The examples show each variation.</p></td>
488</tr>
489</tbody>
490</table>
491
492**Examples:**
493
494These [`level`](cil_mls_labeling_statements.md#level) examples use a selection of [`category`](cil_mls_labeling_statements.md#category), [`categoryalias`](cil_mls_labeling_statements.md#categoryalias) and [`categoryset`](cil_mls_labeling_statements.md#categoryset)'s:
495
496```secil
497    (level systemLow (s0))
498    (level level_1 (s0))
499    (level level_2 (s0 (catrange_1)))
500    (level level_3 (s0 (all_cats)))
501    (level level_4 (unclassified (c2 c3 c4)))
502```
503
504levelrange
505----------
506
507Declare a level range identifier in the current namespace and associate a current and clearance level.
508
509**Statement definition:**
510
511```secil
512    (levelrange levelrange_id (low_level_id high_level_id))
513```
514
515**Where:**
516
517<table>
518<colgroup>
519<col width="25%" />
520<col width="75%" />
521</colgroup>
522<tbody>
523<tr class="odd">
524<td align="left"><p><code>levelrange</code></p></td>
525<td align="left"><p>The <code>levelrange</code> keyword.</p></td>
526</tr>
527<tr class="even">
528<td align="left"><p><code>levelrange_id</code></p></td>
529<td align="left"><p>The <code>levelrange</code> identifier.</p></td>
530</tr>
531<tr class="odd">
532<td align="left"><p><code>low_level_id</code></p></td>
533<td align="left"><p>The current level specified by a previously declared <code>level</code> identifier. This may be formed by named or anonymous components as discussed in the <code>level</code> section and shown in the examples.</p></td>
534</tr>
535<tr class="even">
536<td align="left"><p><code>high_level_id</code></p></td>
537<td align="left"><p>The clearance or high level specified by a previously declared <code>level</code> identifier. This may be formed by named or anonymous components as discussed in the <code>level</code> section and shown in the examples.</p></td>
538</tr>
539</tbody>
540</table>
541
542**Examples:**
543
544This example policy shows [`levelrange`](cil_mls_labeling_statements.md#levelrange) statement and all the other MLS labeling statements discussed in this section and will compile as a standalone policy:
545
546```secil
547    (handleunknown allow)
548    (mls true)
549
550    ; There must be least one set of SID statements in a policy:
551    (sid kernel)
552    (sidorder (kernel))
553    (sidcontext kernel unconfined.context_1)
554
555    (sensitivitycategory s0 (c4 c2 c3 c1 c0 c3))
556
557    (category c0)
558    (categoryalias documents)
559    (categoryaliasactual documents c0)
560    (category c1)
561    (category c2)
562    (category c3)
563    (category c4)
564    (categoryalias spreadsheets)
565    (categoryaliasactual spreadsheets c4)
566
567    (categoryorder (c0 c1 c2 c3 spreadsheets))
568
569    (categoryset catrange_1 (range c2 c3))
570    (categoryset all_cats (range c0 c4))
571    (categoryset all_cats1 (all))
572
573    (categoryset catset_1 (documents c1))
574    (categoryset catset_2 (c2 c3))
575    (categoryset catset_3 (c4))
576
577    (categoryset just_c0 (xor (c1 c2) (documents c1 c2)))
578
579    (sensitivity s0)
580    (sensitivityalias unclassified)
581    (sensitivityaliasactual unclassified s0)
582
583    (sensitivityorder (s0))
584    (sensitivitycategory s0 (c0))
585
586    (sensitivitycategory s0 catrange_1)
587    (sensitivitycategory s0 catset_1)
588    (sensitivitycategory s0 catset_3)
589    (sensitivitycategory s0 (all))
590    (sensitivitycategory s0 (range documents c2))
591
592    (level systemLow (s0))
593    (level level_1 (s0))
594    (level level_2 (s0 (catrange_1)))
595    (level level_3 (s0 (all_cats)))
596    (level level_4 (unclassified (c2 c3 c4)))
597
598    (levelrange levelrange_2 (level_2 level_2))
599    (levelrange levelrange_1 ((s0) level_2))
600    (levelrange low_low (systemLow systemLow))
601
602    (context context_2 (unconfined.user object_r unconfined.object (level_1 level_3)))
603
604    ; Define object_r role. This must be assigned in CIL.
605    (role object_r)
606
607    (block unconfined
608        (user user)
609        (role role)
610        (type process)
611        (type object)
612        (userrange user (systemLow systemLow))
613        (userlevel user systemLow)
614        (userrole user role)
615        (userrole user object_r)
616        (roletype role process)
617        (roletype role object)
618        (roletype object_r object)
619
620        (class file (open execute read write))
621
622        ; There must be least one allow rule in a policy:
623        (allow process self (file (read)))
624
625        (context context_1 (user object_r object low_low))
626    ) ; End unconfined namespace
627```
628
629rangetransition
630---------------
631
632Allows an objects level to transition to a different level. Generally used to ensure processes run with their correct MLS range, for example `init` would run at `SystemHigh` and needs to initialise / run other processes at their correct MLS range.
633
634**Statement definition:**
635
636```secil
637    (rangetransition source_id target_id class_id new_range_id)
638```
639
640**Where:**
641
642<table>
643<colgroup>
644<col width="25%" />
645<col width="75%" />
646</colgroup>
647<tbody>
648<tr class="odd">
649<td align="left"><p><code>rangetransition</code></p></td>
650<td align="left"><p>The <code>rangetransition</code> keyword.</p></td>
651</tr>
652<tr class="even">
653<td align="left"><p><code>source_type_id</code></p></td>
654<td align="left"><p>A single previously declared <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td>
655</tr>
656<tr class="odd">
657<td align="left"><p><code>target_type_id</code></p></td>
658<td align="left"><p>A single previously declared <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td>
659</tr>
660<tr class="even">
661<td align="left"><p><code>class_id</code></p></td>
662<td align="left"><p>A single previously declared <code>class</code> or <code>classmap</code> identifier.</p></td>
663</tr>
664<tr class="odd">
665<td align="left"><p><code>new_range_id</code></p></td>
666<td align="left"><p>The new MLS range for the object class that is a previously declared <code>levelrange</code> identifier. This entry may also be defined as an anonymous or named <code>level</code>, <code>sensitivity</code>, <code>sensitivityalias</code>, <code>category</code>, <code>categoryalias</code> or <code>categoryset</code> identifier.</p></td>
667</tr>
668</tbody>
669</table>
670
671**Examples:**
672
673This rule will transition the range of `sshd.exec` to `s0 - s1:c0.c3` on execution from the `init.process`:
674
675```secil
676    (sensitivity s0)
677    (sensitivity s1)
678    (sensitivityorder s0 s1)
679    (category c0)
680    ...
681    (level systemlow (s0))
682    (level systemhigh (s1 (c0 c1 c2)))
683    (levelrange low_high (systemlow systemhigh))
684
685    (rangetransition init.process sshd.exec process low_high)
686```
687