;; SELinux CIL Policy Example ;; NOTE: This file is not functional, but ;; is designed to test syntax highlighting. ; Brackets colors ((((((((((((( ))))))))))))) )) ; Statements (policycap open_perms) ; Policy config. statement (mls true) (handleunknown allow) (sid kernel) ; Declaration type statement (classpermissionset char_w (char (write setattr))) ; Other statements (user user) ; Declare identifier 'user' of user type (role role) (type type) (allow allow) (true true) (in in) (xor xor) ; List of permissions (class security (compute_av compute_create compute_member check_context load_policy compute_relabel compute_user setenforce setbool setsecparam setcheckreqprot read_policy)) ; Highlighting permissions only if there is not a statement keyword (class binder (impersonate call set_context_mgr transfer receive)) (class binder (classcommon impersonate call set_context_mgr transfer receive)) (impersonate call set_context_mgr transfer receive) (tunableif impersonate call set_context_mgr transfer receive) ; This is allowed by the CIL compiler ( typeattribute;comment all_fs_type_except_usermodehelper_and_proc_security) (;comment typeattribute all_fs_type_except_usermodehelper_and_proc_security) ( ;comment ;more comments typeattribute all_fs_type_except_usermodehelper_and_proc_security) ; Paths (true true /true true /true/true/ true true/true "true") ; Global namespace (true true .true true true.true true .true.true true.true.true .true. true. true.true. ; invalid ) ; Keywords in some rules ; filecon (filecon "/system/bin/run-as" file runas_exec_context) (filecon "/dev/socket/wpa_wlan[0-9]" any u:object_r:wpa.socket:s0-s0) (filecon "/data/local/mine" dir ()) (classcommon file any dir) (file any dir) ; portcon (portcon sctp 3333 (unconfined.user object_r unconfined.object levelrange_1)) (portcon udp 4444 (unconfined.user object_r unconfined.object ((s0) level_2))) (defaultrole tcp udp) (tcp udp) ; fsuse (fsuse xattr ext4 file.labeledfs_context) (fsuse task pipefs file.pipefs_context) (fsuse trans tmpfs file.tmpfs_context) (typemember xattr task trans) (xattr task trans) (allow unconfined.process self (file (read write))) (allow process httpd.object (file (read write))) (defaultrange db_table glblub) ; Paths "/system/(foo|bar)/[^/]*/(hi){2,6}(.*)?" "/pa\12th.*a+b?" /usr/hi\"esc\032esc\*3es{2,2}ds "/data/(open " "/data/[open " ; Some rules (call macro1("__kmsg__")) (macro macro1 ((string ARG1)) (typetransition audit.process device.device chr_file ARG1 device.klog_device) ) (allow unconfined.process self (file (read write))) (auditallow release_app.process secmark_demo.browser_packet (packet (send recv))) (allowx type_1 type_2 (ioctl tcp_socket (range 0x2000 0x20FF))) (permissionx ioctl_nodebug (ioctl udp_socket (not (range 0x4000 0x4010)))) (allowx type_3 type_4 ioctl_nodebug) (dontauditx type_1 type_2 (ioctl tcp_socket (range 0x3000 0x30FF))) (class property_service (set)) (block av_rules (type type_1) (type type_2) (typeattribute all_types) (typeattributeset all_types ((all))) (neverallow type_2 all_types (property_service (set))) ) (macro binder_call ((type ARG1) (type ARG2)) (allow ARG1 ARG2 (binder (transfer call))) ) (ipaddr netmask_1 255.255.255.0) (class dir) (class foo) (class bar) (class baz) (classorder (dir foo)) (classorder (unordered bar foo baz)) (classpermission zygote_2) (classpermissionset zygote_2 (zygote (and (all) (not (specifyinvokewith specifyseinfo)) ) )) (permissionx ioctl_3 (ioctl tcp_socket (and (range 0x8000 0x90FF) (not (range 0x8100 0x82FF))))) (boolean disableAudioCapture false) (booleanif (and (not disableAudio) (not disableAudioCapture)) (true (allow process mediaserver.audio_capture_device (chr_file_set (rw_file_perms))) ) ) (tunable range_trans_rule false) (block init (class process (process)) (type process) (tunableif range_trans_rule (true (rangetransition process sshd.exec process low_high)))) (validatetrans file (eq t1 unconfined.process)) (block ext_gateway (optional move_file (typetransition process msg_filter.move_file.in_queue file msg_filter.move_file.in_file) (allow process msg_filter.move_file.in_queue (dir (read getattr write search add_name))))) (context runas_exec_context (u object_r exec low_low)) (filecon "/system/bin/run-as" file runas_exec_context) (in file (genfscon rootfs / rootfs_context) (genfscon selinuxfs / selinuxfs_context) ) ; ioctl & call: due to the way in which the highlighter treats the parenthesis blocks ; (each level of different color), it is not possible to differentiate between statement and permission. (allowx x bin_t (ioctl policy.file (range 0x1000 0x11FF))) ; ioctl kind (ioctl read find connectto) ; kind or permission? (ioctl read find connectto) ; ioctl permission (ioctl read ) (call ioctl read find connectto) ; statement or permission? ( call ) ; call permission