1 <!-- Common Interface Language (CIL) Reference Guide --> 2 <!-- class_and_permission_statements.xml --> 3 4 <sect1> 5 <title>Class and Permission Statements</title> 6 <sect2 id="common"> 7 <title>common</title> 8 <para>Declares a common identifier in the current namespace with a set of common permissions that can be used by one or more <literal><link linkend="class">class</link></literal> identifiers. The <literal><link linkend="classcommon">classcommon</link></literal> statement is used to associate a <literal><link linkend="common">common</link></literal> identifier to a specific <literal><link linkend="class">class</link></literal> identifier.</para> 9 <para><emphasis role="bold">Statement definition:</emphasis></para> 10 <programlisting><![CDATA[(common common_id (permission_id ...))]]></programlisting> 11 <para><emphasis role="bold">Where:</emphasis></para> 12 <informaltable frame="all"> 13 <tgroup cols="2"> 14 <colspec colwidth="2 *"/> 15 <colspec colwidth="6 *"/> 16 <tbody> 17 <row> 18 <entry> 19 <para><literal><link linkend="common">common</link></literal></para> 20 </entry> 21 <entry> 22 <para>The <literal><link linkend="common">common</link></literal> keyword.</para> 23 </entry> 24 </row> 25 <row> 26 <entry> 27 <para><literal>common_id</literal></para> 28 </entry> 29 <entry> 30 <para>The <literal><link linkend="common">common</link></literal> identifier.</para> 31 </entry> 32 </row> 33 <row> 34 <entry> 35 <para><literal>permission_id</literal></para> 36 </entry> 37 <entry> 38 <para>One or more permissions.</para> 39 </entry> 40 </row> 41 </tbody></tgroup> 42 </informaltable> 43 44 <para><emphasis role="bold">Example:</emphasis></para> 45 <para>This common statement will associate the <literal><link linkend="common">common</link></literal> identifier '<literal>file</literal>' with the list of permissions:</para> 46 <programlisting><![CDATA[ 47 (common file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton))]]> 48 </programlisting> 49 </sect2> 50 51 <sect2 id="classcommon"> 52 <title>classcommon</title> 53 <para>Associate a <literal><link linkend="class">class</link></literal> identifier to a one or more permissions declared by a <literal><link linkend="common">common</link></literal> identifier.</para> 54 <para><emphasis role="bold">Statement definition:</emphasis></para> 55 <programlisting><![CDATA[(classcommon class_id common_id)]]></programlisting> 56 <para><emphasis role="bold">Where:</emphasis></para> 57 <informaltable frame="all"> 58 <tgroup cols="2"> 59 <colspec colwidth="2 *"/> 60 <colspec colwidth="6 *"/> 61 <tbody> 62 <row> 63 <entry> 64 <para><literal><link linkend="classcommon">classcommon</link></literal></para> 65 </entry> 66 <entry> 67 <para>The <literal><link linkend="classcommon">classcommon</link></literal> keyword.</para> 68 </entry> 69 </row> 70 <row> 71 <entry> 72 <para><literal>class_id</literal></para> 73 </entry> 74 <entry> 75 <para>A single previously declared <literal><link linkend="class">class</link></literal> identifier.</para> 76 </entry> 77 </row> 78 <row> 79 <entry> 80 <para><literal>common_id</literal></para> 81 </entry> 82 <entry> 83 <para>A single previously declared <literal><link linkend="common">common</link></literal> identifier that defines the common permissions for that class.</para> 84 </entry> 85 </row> 86 </tbody></tgroup> 87 </informaltable> 88 <para><emphasis role="bold">Example:</emphasis></para> 89 <para>This associates the <literal>dir</literal> class with the list of permissions declared by the <literal>file common</literal> identifier:</para> 90 <programlisting><![CDATA[ 91 (common file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton)) 92 93 (classcommon dir file)]]> 94 </programlisting> 95 </sect2> 96 97 <sect2 id="class"> 98 <title>class</title> 99 <para>Declares a class and zero or more permissions in the current namespace.</para> 100 <para><emphasis role="bold">Statement definition:</emphasis></para> 101 <programlisting><![CDATA[(class class_id (permission_id ...))]]></programlisting> 102 <para><emphasis role="bold">Where:</emphasis></para> 103 <informaltable frame="all"> 104 <tgroup cols="2"> 105 <colspec colwidth="2 *"/> 106 <colspec colwidth="6 *"/> 107 <tbody> 108 <row> 109 <entry> 110 <para><literal><link linkend="class">class</link></literal></para> 111 </entry> 112 <entry> 113 <para>The <literal><link linkend="class">class</link></literal> keyword.</para> 114 </entry> 115 </row> 116 <row> 117 <entry> 118 <para><literal>class_id</literal></para> 119 </entry> 120 <entry> 121 <para>The <literal><link linkend="class">class</link></literal> identifier.</para> 122 </entry> 123 </row> 124 <row> 125 <entry> 126 <para><literal>permission_id</literal></para> 127 </entry> 128 <entry> 129 <para>Zero or more permissions declared for the class. Note that if zero permissions, an empty list is required as shown in the example.</para> 130 </entry> 131 </row> 132 </tbody></tgroup> 133 </informaltable> 134 135 <para><emphasis role="bold">Examples:</emphasis></para> 136 <para>This example defines a set of permissions for the <literal>binder</literal> class indentifier:</para> 137 <programlisting><![CDATA[(class binder (impersonate call set_context_mgr transfer receive))]]> 138 </programlisting> 139 140 <para>This example defines a common set of permissions to be used by the <literal>sem</literal> class, the <literal>(class sem ())</literal> does not define any other permissions (i.e. an empty list):</para> 141 <programlisting><![CDATA[ 142 (common ipc (create destroy getattr setattr read write associate unix_read unix_write)) 143 144 (classcommon sem ipc) 145 (class sem ())]]> 146 </programlisting> 147 <simpara>and will produce the following set of permissions for the <literal>sem</literal> class identifier of:</simpara> 148 <programlisting><![CDATA[(class sem (create destroy getattr setattr read write associate unix_read unix_write))]]> 149 </programlisting> 150 151 <para>This example, with the following combination of the <literal><link linkend="common">common</link></literal>, <literal><link linkend="classcommon">classcommon</link></literal> and <literal><link linkend="class">class</link></literal> statements:</para> 152 <programlisting><![CDATA[ 153 (common file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton)) 154 155 (classcommon dir file) 156 (class dir (add_name remove_name reparent search rmdir open audit_access execmod))]]> 157 </programlisting> 158 <simpara>will produce a set of permissions for the <literal>dir</literal> class identifier of:</simpara> 159 <programlisting><![CDATA[(class dir (add_name remove_name reparent search rmdir open audit_access execmod ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton))]]> 160 </programlisting> 161 </sect2> 162 <sect2 id="classorder"> 163 <title>classorder</title> 164 <para>Defines the order of <link linkend="class">class</link>'s. This is a mandatory statement. Multiple <literal>classorder</literal> statements declared in the policy will form an ordered list.</para> 165 <para><emphasis role="bold">Statement definition:</emphasis></para> 166 <programlisting><![CDATA[(classorder (class_id ...))]]></programlisting> 167 <para><emphasis role="bold">Where:</emphasis></para> 168 <informaltable frame="all"> 169 <tgroup cols="2"> 170 <colspec colwidth="2 *"/> 171 <colspec colwidth="6 *"/> 172 <tbody> 173 <row> 174 <entry> 175 <para><literal>classorder</literal></para> 176 </entry> 177 <entry> 178 <para>The <literal>classorder</literal> keyword.</para> 179 </entry> 180 </row> 181 <row> 182 <entry> 183 <para><literal>class_id</literal></para> 184 </entry> 185 <entry> 186 <para>One or more <literal><link linkend="class">class</link></literal> identifiers.</para> 187 </entry> 188 </row> 189 </tbody></tgroup> 190 </informaltable> 191 192 <para><emphasis role="bold">Example:</emphasis></para> 193 <para>This will produce an ordered list of "<literal>file dir process</literal>"</para> 194 <programlisting><![CDATA[ 195 (class process) 196 (class file) 197 (class dir) 198 (classorder (file dir)) 199 (classorder (dir process))]]> 200 </programlisting> 201 </sect2> 202 <sect2 id="classpermission"> 203 <title>classpermission</title> 204 <para>Declares a class permission set identifier in the current namespace that can be used by one or more <literal><link linkend="classpermissionset">classpermissionset</link></literal>s to associate one or more classes and permissions to form a named set.</para> 205 <para><emphasis role="bold">Statement definition:</emphasis></para> 206 <programlisting><![CDATA[(classpermission classpermissionset_id)]]></programlisting> 207 <para><emphasis role="bold">Where:</emphasis></para> 208 <informaltable frame="all"> 209 <tgroup cols="2"> 210 <colspec colwidth="2 *"/> 211 <colspec colwidth="6 *"/> 212 <tbody> 213 <row> 214 <entry> 215 <para><literal><link linkend="classpermission">classpermission</link></literal></para> 216 </entry> 217 <entry> 218 <para>The <literal><link linkend="classpermission">classpermission</link></literal> keyword.</para> 219 </entry> 220 </row> 221 <row> 222 <entry> 223 <para><literal>classpermissionset_id</literal></para> 224 </entry> 225 <entry> 226 <para>The <literal><link linkend="classpermissionset">classpermissionset</link></literal> identifier.</para> 227 </entry> 228 </row> 229 </tbody></tgroup> 230 </informaltable> 231 <para><emphasis role="bold">Example:</emphasis></para> 232 <para>See the <literal><link linkend="classpermissionset">classpermissionset</link></literal> statement for examples.</para> 233 </sect2> 234 235 <sect2 id="classpermissionset"> 236 <title>classpermissionset</title> 237 <para>Defines a class permission set identifier in the current namespace that associates a class and one or more permissions to form a named set. Nested expressions may be used to determine the required permissions as shown in the examples. Anonymous <literal>classpermissionset</literal>s may be used in av rules and constraints.</para> 238 <para><emphasis role="bold">Statement definition:</emphasis></para> 239 <programlisting><![CDATA[(classpermissionset classpermissionset_id (class_id (permission_id | expr ...)))]]></programlisting> 240 <para><emphasis role="bold">Where:</emphasis></para> 241 <informaltable frame="all"> 242 <tgroup cols="2"> 243 <colspec colwidth="2.25 *"/> 244 <colspec colwidth="6 *"/> 245 <tbody> 246 <row> 247 <entry> 248 <para><literal><link linkend="classpermissionset">classpermissionset</link></literal></para> 249 </entry> 250 <entry> 251 <para>The <literal><link linkend="classpermissionset">classpermissionset</link></literal> keyword.</para> 252 </entry> 253 </row> 254 <row> 255 <entry> 256 <para><literal>classpermissionset_id</literal></para> 257 </entry> 258 <entry> 259 <para>The <literal><link linkend="classpermissionset">classpermissionset</link></literal> identifier.</para> 260 </entry> 261 </row> 262 <row> 263 <entry> 264 <para><literal>class_id</literal></para> 265 </entry> 266 <entry> 267 <para>A single previously declared <literal><link linkend="class">class</link></literal> identifier.</para> 268 </entry> 269 </row> 270 <row> 271 <entry> 272 <para><literal>permission_id</literal></para> 273 </entry> 274 <entry> 275 <para>Zero or more permissions required by the class.</para> 276 <para>Note that there must be at least one <literal>permission</literal> identifier or <literal>expr</literal> declared).</para> 277 </entry> 278 </row> 279 <row> 280 <entry> 281 <para><literal>expr</literal></para> 282 </entry> 283 <entry> 284 <para>Zero or more <literal>expr</literal>'s, the valid operators and syntax are:</para> 285 <simpara><literal> (and (permission_id ...) (permission_id ...))</literal></simpara> 286 <simpara><literal> (or (permission_id ...) (permission_id ...))</literal></simpara> 287 <simpara><literal> (xor (permission_id ...) (permission_id ...))</literal></simpara> 288 <simpara><literal> (not (permission_id ...))</literal></simpara> 289 <simpara><literal> (all)</literal></simpara> 290 </entry> 291 </row> 292 </tbody></tgroup> 293 </informaltable> 294 295 <para><emphasis role="bold">Examples:</emphasis></para> 296 <para>These class permission set statements will resolve to the permission sets shown in the kernel policy language <literal><link linkend="allow">allow</link></literal> rules:</para> 297 <programlisting><![CDATA[ 298 (class zygote (specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo)) 299 300 (type test_1) 301 (type test_2) 302 (type test_3) 303 (type test_4) 304 (type test_5) 305 306 ; NOT 307 (classpermission zygote_1) 308 (classpermissionset zygote_1 (zygote 309 (not 310 (specifyinvokewith specifyseinfo) 311 ) 312 )) 313 (allow unconfined.process test_1 zygote_1) 314 ;; allow unconfined.process test_1 : zygote { specifyids specifyrlimits specifycapabilities } ; 315 316 ; AND - ALL - NOT - Equiv to test_1 317 (classpermission zygote_2) 318 (classpermissionset zygote_2 (zygote 319 (and 320 (all) 321 (not (specifyinvokewith specifyseinfo)) 322 ) 323 )) 324 (allow unconfined.process test_2 zygote_2) 325 ;; allow unconfined.process test_2 : zygote { specifyids specifyrlimits specifycapabilities } ; 326 327 ; OR 328 (classpermission zygote_3) 329 (classpermissionset zygote_3 (zygote ((or (specifyinvokewith) (specifyseinfo))))) 330 (allow unconfined.process test_3 zygote_3) 331 ;; allow unconfined.process test_3 : zygote { specifyinvokewith specifyseinfo } ; 332 333 ; XOR - This will not produce an allow rule as the XOR will remove all the permissions: 334 (classpermission zygote_4) 335 (classpermissionset zygote_4 (zygote (xor (specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo) (specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo)))) 336 337 ; ALL 338 (classpermission zygote_all_perms) 339 (classpermissionset zygote_all_perms (zygote (all))) 340 (allow unconfined.process test_5 zygote_all_perms) 341 ;; allow unconfined.process test_5 : zygote { specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo } ;]]> 342 </programlisting> 343 </sect2> 344 345 <sect2 id="classmap"> 346 <title>classmap</title> 347 <para>Declares a class map identifier in the current namespace and one or more class mapping identifiers. This will allow:</para> 348 <orderedlist> 349 <listitem><para>Multiple <literal><link linkend="classpermissionset">classpermissionset</link></literal>s to be linked to a pair of <literal><link linkend="classmap">classmap</link></literal> / <literal><link linkend="classmapping">classmapping</link></literal> identifiers.</para></listitem> 350 <listitem><para>Multiple <literal><link linkend="class">class</link></literal>s to be associated to statements and rules that support a list of classes:</para> 351 <simplelist type="inline"> 352 <member><literal><link linkend="typetransition">typetransition</link></literal></member> 353 <member><literal><link linkend="typechange">typechange</link></literal></member> 354 <member><literal><link linkend="typemember">typemember</link></literal></member> 355 <member><literal><link linkend="rangetransition">rangetransition</link></literal></member> 356 <member><literal><link linkend="roletransition">roletransition</link></literal></member> 357 <member><literal><link linkend="defaultuser">defaultuser</link></literal></member> 358 <member><literal><link linkend="defaultrole">defaultrole</link></literal></member> 359 <member><literal><link linkend="defaulttype">defaulttype</link></literal></member> 360 <member><literal><link linkend="defaultrange">defaultrange</link></literal></member> 361 <member><literal><link linkend="validatetrans">validatetrans</link></literal></member> 362 <member><literal><link linkend="mlsvalidatetrans">mlsvalidatetrans</link></literal></member> 363 </simplelist></listitem> 364 </orderedlist> 365 <para><emphasis role="bold">Statement definition:</emphasis></para> 366 <programlisting><![CDATA[(classmap classmap_id (classmapping_id ...))]]></programlisting> 367 <para><emphasis role="bold">Where:</emphasis></para> 368 <informaltable frame="all"> 369 <tgroup cols="2"> 370 <colspec colwidth="2 *"/> 371 <colspec colwidth="6 *"/> 372 <tbody> 373 <row> 374 <entry> 375 <para><literal><link linkend="classmap">classmap</link></literal></para> 376 </entry> 377 <entry> 378 <para>The <literal><link linkend="classmap">classmap</link></literal> keyword.</para> 379 </entry> 380 </row> 381 <row> 382 <entry> 383 <para><literal>classmap_id</literal></para> 384 </entry> 385 <entry> 386 <para>The <literal><link linkend="classmap">classmap</link></literal> identifier.</para> 387 </entry> 388 </row> 389 <row> 390 <entry> 391 <para><literal>classmapping_id</literal></para> 392 </entry> 393 <entry> 394 <para>One or more <literal><link linkend="classmapping">classmapping</link></literal> identifiers.</para> 395 </entry> 396 </row> 397 </tbody></tgroup> 398 </informaltable> 399 <para><emphasis role="bold">Example:</emphasis></para> 400 <para>See the <literal><link linkend="classmapping">classmapping</link></literal> statement for examples.</para> 401 </sect2> 402 403 <sect2 id="classmapping"> 404 <title>classmapping</title> 405 <para>Define sets of <literal><link linkend="classpermissionset">classpermissionset</link></literal>s (named or anonymous) to form a consolidated <literal><link linkend="classmapping">classmapping</link></literal> set. Generally there are multiple <literal><link linkend="classmapping">classmapping</link></literal> statements with the same <literal><link linkend="classmap">classmap</link></literal> and <literal><link linkend="classmapping">classmapping</link></literal> identifiers that form a set of different <literal><link linkend="classpermissionset">classpermissionset</link></literal>'s. This is useful when multiple class / permissions are required in rules such as the <literal><link linkend="allow">allow</link></literal> rules (as shown in the examples).</para> 406 <para><emphasis role="bold">Statement definition:</emphasis></para> 407 <programlisting><![CDATA[(classmapping classmap_id classmapping_id classpermissionset_id)]]></programlisting> 408 <para><emphasis role="bold">Where:</emphasis></para> 409 <informaltable frame="all"> 410 <tgroup cols="2"> 411 <colspec colwidth="2.25 *"/> 412 <colspec colwidth="6 *"/> 413 <tbody> 414 <row> 415 <entry> 416 <para><literal><link linkend="classmapping">classmapping</link></literal></para> 417 </entry> 418 <entry> 419 <para>The <literal><link linkend="classmapping">classmapping</link></literal> keyword.</para> 420 </entry> 421 </row> 422 <row> 423 <entry> 424 <para><literal>classmap_id</literal></para> 425 </entry> 426 <entry> 427 <para>A single previously declared <literal><link linkend="classmap">classmap</link></literal> identifier.</para> 428 </entry> 429 </row> 430 <row> 431 <entry> 432 <para><literal>classmapping_id</literal></para> 433 </entry> 434 <entry> 435 <para>The <literal><link linkend="classmapping">classmapping</link></literal> identifier.</para> 436 </entry> 437 </row> 438 <row> 439 <entry> 440 <para><literal>classpermissionset_id</literal></para> 441 </entry> 442 <entry> 443 <para>A single named <literal><link linkend="classpermissionset">classpermissionset</link></literal> identifier or a single anonymous <literal><link linkend="classpermissionset">classpermissionset</link></literal> using <literal>expr</literal>'s as required (see the <literal><link linkend="classpermissionset">classpermissionset</link></literal> statement).</para> 444 </entry> 445 </row> 446 </tbody></tgroup> 447 </informaltable> 448 <para><emphasis role="bold">Examples:</emphasis></para> 449 <para>These class mapping statements will resolve to the permission sets shown in the kernel policy language <literal><link linkend="allow">allow</link></literal> rules:</para> 450 <programlisting><![CDATA[ 451 (class binder (impersonate call set_context_mgr transfer receive)) 452 (class property_service (set)) 453 (class zygote (specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo)) 454 455 (classpermission cps_zygote) 456 (classpermissionset cps_zygote (zygote (not (specifyids)))) 457 458 (classmap android_classes (set_1 set_2 set_3)) 459 460 (classmapping android_classes set_1 (binder (all))) 461 (classmapping android_classes set_1 (property_service (set))) 462 (classmapping android_classes set_1 (zygote (not (specifycapabilities)))) 463 464 (classmapping android_classes set_2 (binder (impersonate call set_context_mgr transfer))) 465 (classmapping android_classes set_2 (zygote (specifyids specifyrlimits specifycapabilities specifyinvokewith))) 466 467 (classmapping android_classes set_3 cps_zygote) 468 (classmapping android_classes set_3 (binder (impersonate call set_context_mgr))) 469 470 (block map_example 471 (type type_1) 472 (type type_2) 473 (type type_3) 474 475 (allow type_1 self (android_classes (set_1))) 476 (allow type_2 self (android_classes (set_2))) 477 (allow type_3 self (android_classes (set_3))) 478 ) 479 480 ; The above will resolve to the following AV rules: 481 ;; allow map_example.type_1 map_example.type_1 : binder { impersonate call set_context_mgr transfer receive } ; 482 ;; allow map_example.type_1 map_example.type_1 : property_service set ; 483 ;; allow map_example.type_1 map_example.type_1 : zygote { specifyids specifyrlimits specifyinvokewith specifyseinfo } ; 484 485 ;; allow map_example.type_2 map_example.type_2 : binder { impersonate call set_context_mgr transfer } ; 486 ;; allow map_example.type_2 map_example.type_2 : zygote { specifyids specifyrlimits specifycapabilities specifyinvokewith } ; 487 488 ;; allow map_example.type_3 map_example.type_3 : binder { impersonate call set_context_mgr } ; 489 ;; allow map_example.type_3 map_example.type_3 : zygote { specifyrlimits specifycapabilities specifyinvokewith specifyseinfo } ;]]> 490 </programlisting> 491 </sect2> 492 493 </sect1> 494
