From patchwork Thu Jul 30 08:55:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dominick Grift X-Patchwork-Id: 11692523 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 859236C1 for ; Thu, 30 Jul 2020 08:56:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 12506206E6 for ; Thu, 30 Jul 2020 08:56:16 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=defensec.nl header.i=@defensec.nl header.b="j+Yk/lia" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726819AbgG3I4P (ORCPT ); Thu, 30 Jul 2020 04:56:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60266 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726287AbgG3I4P (ORCPT ); Thu, 30 Jul 2020 04:56:15 -0400 Received: from agnus.defensec.nl (agnus.defensec.nl [IPv6:2001:985:d55d::711]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 6A8AAC061794 for ; Thu, 30 Jul 2020 01:56:14 -0700 (PDT) Received: from localhost.localdomain (brutus.lan [IPv6:2001:985:d55d::438]) by agnus.defensec.nl (Postfix) with ESMTPSA id A28D62A0FFC; Thu, 30 Jul 2020 10:56:09 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.11.0 agnus.defensec.nl A28D62A0FFC DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=defensec.nl; s=default; t=1596099369; bh=JlTF8t7ETMrSvBFaGt4wPASJh15rnO6RH0QTCeHGwcQ=; h=From:To:Cc:Subject:Date:From; b=j+Yk/liaLRhfgjHmRSS3ouYr5JHRX1HyxERvWvGFhV01yTQ8SM3nd+z+HeKp9pUaW NULFybAi/du7b6jYst4iIZapCqm75yLe7hfg0MSu8efD9FFqeX9/SB3b9MP3YwrEXG 2Majxmcz5fNvTOSCYwqZQ1jQcT8k8A1jkrLMbYnc= From: Dominick Grift To: selinux@vger.kernel.org Cc: Dominick Grift Subject: [SELinux-notebook PATCH] type_statements: document expandattribute Date: Thu, 30 Jul 2020 10:55:42 +0200 Message-Id: <20200730085542.895297-1-dominick.grift@defensec.nl> X-Mailer: git-send-email 2.28.0.rc1 MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org This functionality was added for Androids Treble in 2017. I was not sure whether this belong here or in conditional_statements.md Signed-off-by: Dominick Grift --- src/type_statements.md | 70 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) diff --git a/src/type_statements.md b/src/type_statements.md index 61c7191..8bea485 100644 --- a/src/type_statements.md +++ b/src/type_statements.md @@ -201,6 +201,76 @@ attribute non_security_file_type;
+## `expandattribute` + +The `expandattribute` statement allows type attribute expansion +compiler defaults to be overriden. + +**The statement definition is:** + +`expandattribute attribute_id default_value;` + +**Where:** + + + + + + + + + + + + + + + + +
expandattributeThe expandattribute keyword.
attribute_idOne or more previously declared attribute. Multiple entries consist of a space separated list enclosed in braces '{}'.
default_valueEither true or false
+ +**The statement is valid in:** + + + + + + + + + + + + + + + + + + + + + + + + +
Monolithic PolicyBase PolicyModule Policy
YesYesYes
Conditional Policy if Statementoptional Statementrequire Statement
NoYesNo
+ +**Example:** + +``` +# Using the expandtypeattribute statement to forcibly expand a +# previously declared domain attribute. + +# The previously declared attribute: +attribute domain; + +# The attribute stripping using the expandtypeattribute statement: +expandattribute domain true; +``` + +
+ ## `typeattribute` The `typeattribute` statement allows the association of previously