From patchwork Tue Aug 4 01:34:08 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paul Moore X-Patchwork-Id: 11699383 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5F764722 for ; Tue, 4 Aug 2020 01:34:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8701320786 for ; Tue, 4 Aug 2020 01:34:11 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=paul-moore-com.20150623.gappssmtp.com header.i=@paul-moore-com.20150623.gappssmtp.com header.b="1a70cOVW" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729300AbgHDBeL (ORCPT ); Mon, 3 Aug 2020 21:34:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51044 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729294AbgHDBeK (ORCPT ); Mon, 3 Aug 2020 21:34:10 -0400 Received: from mail-qk1-x742.google.com (mail-qk1-x742.google.com [IPv6:2607:f8b0:4864:20::742]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A05BBC06174A for ; Mon, 3 Aug 2020 18:34:10 -0700 (PDT) Received: by mail-qk1-x742.google.com with SMTP id 2so32950555qkf.10 for ; Mon, 03 Aug 2020 18:34:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paul-moore-com.20150623.gappssmtp.com; s=20150623; h=subject:from:to:date:message-id:in-reply-to:references:user-agent :mime-version:content-transfer-encoding; bh=/XWmo/lWlCmhtwDZShb3Uw1UiWkXVtk0h6qT7w7htcM=; b=1a70cOVWbFxKyIgUrDhyWMipvrtV8Q5CCjlfzz5JRbuJwxlRX5YTEQwNwhExxa30qn jpuWOSUyyLMXdPkX1NvWO51dFLE12mTWVcsUDEYE8d2h/xUliKeZfse0sxK+kL8sKoEF ApGu+2y+mfoQMykJ7azapk5rLYlhp3X9ahqSTTlPmcJ75XKse7IbYi/+coNu5feMubHd ZqJt46R3BoBllhkmWiMvHZwkGtw/+pPmXeW6jclbMJGBow+enOYODGCMjsz00l9yq5A9 zPAGQxdNqsoIZYoY1LbMV8mrW7hqarzNZgmhviY49nrnwSFOQxP+Dasna1CCZC7EeWKQ p80w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:date:message-id:in-reply-to :references:user-agent:mime-version:content-transfer-encoding; bh=/XWmo/lWlCmhtwDZShb3Uw1UiWkXVtk0h6qT7w7htcM=; b=Yr9+9dUPEfTBHZlYuSXFFINeK9bgkKeWwejejFi6/cCiyi/6uOe8qqtm3ybWjvy/tP Y+/GKIePtJpxrMcfUwq9IpDC/OzxBQ8p/E3584sFEpSl608LdjhL5HmFEcTDIAw7ljJq qZIh+pAiHAjSG5YVK8gXfq0jQ97MG+tE3HIZx2guSyIBgw94JGEkWGEVJso9NyqyqRas 9uhw87LJTUkLJ1LGUqxdZo5fe/4FBA4W+0zHRmYYZ6iyFStjd0nHL9Pm/16BPt3qIQlu swZ9PV2M+tG20AUHZ27WVKapV6vyYGbb7kITqpPt7PhyYQWuH8Oy2efIz2XQjP2PN7Qb 7B3g== X-Gm-Message-State: AOAM532PgLTuW6kN2c3QySod4wrOmFJSMn7gClHSrGYm8Drjip1S13Yj iLfCh/nEWHjWdSz+nkXJq8G6NdBxYNS1 X-Google-Smtp-Source: ABdhPJyvEcjvUUVZ6g05hg2O77fem6pEFo5Avm0Hecdq+U3LN2vSVJuUu89UFpwKf0075OKfRl2O/A== X-Received: by 2002:a37:9f13:: with SMTP id i19mr18131376qke.316.1596504849374; Mon, 03 Aug 2020 18:34:09 -0700 (PDT) Received: from localhost (pool-96-230-24-152.bstnma.fios.verizon.net. [96.230.24.152]) by smtp.gmail.com with ESMTPSA id s33sm24886357qtk.11.2020.08.03.18.34.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 03 Aug 2020 18:34:08 -0700 (PDT) Subject: [RFC,selinux-notebook PATCH 08/18] user_statements: fully convert to markdown From: Paul Moore To: selinux@vger.kernel.org Date: Mon, 03 Aug 2020 21:34:08 -0400 Message-ID: <159650484817.8961.3234655942477723956.stgit@sifl> In-Reply-To: <159650470076.8961.12721446818345626943.stgit@sifl> References: <159650470076.8961.12721446818345626943.stgit@sifl> User-Agent: StGit/0.23 MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Signed-off-by: Paul Moore --- src/user_statements.md | 113 ++++++++++++++++++++---------------------------- 1 file changed, 48 insertions(+), 65 deletions(-) diff --git a/src/user_statements.md b/src/user_statements.md index cac6181..46f2846 100644 --- a/src/user_statements.md +++ b/src/user_statements.md @@ -1,6 +1,6 @@ # User Statements -## `user` +## *user* The user statement declares an SELinux user identifier within the policy and associates it to one or more roles. The statement also allows an @@ -17,73 +17,58 @@ Or for MCS/MLS Policy: `user seuser_id roles role_id level mls_level range mls_range;` - Where: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
userThe user keyword.
seuser_idThe SELinux user identifier.
rolesThe roles keyword.
role_idOne or more previously declared role or attribute_role identifiers. Multiple role identifiers consist of a space separated list enclosed in braces '{}'.
levelIf MLS is configured, the MLS level keyword.
mls_level

The users default MLS security level that has been previously declared with a level statement.

-

Note that the compiler only accepts the sensitivity component of the level (e.g. s0).

rangeIf MLS is configured, the MLS range keyword.
mls_rangeThe range of security levels that the user can run. The format is described in the "MLS range Definition" section.
+*user* + +The *user* keyword. + +*seuser_id* + +The SELinux user identifier. + +*roles* + +The *roles* keyword. + +*role_id* + +One or more previously declared *role* or *attribute_role* identifiers. +Multiple *role* identifiers consist of a space separated list enclosed in +braces '{}'. + +*level* + +If MLS is configured, the MLS *level* keyword. + +*mls_level* + +The users default MLS security level that has been previously declared with a +*level* statement. Note that the compiler only accepts the *sensitivity* +component of the *level* (e.g. s0). + +*range* + +If MLS is configured, the MLS *range* keyword. + +*mls_range* + +The range of security levels that the user can run. The format is described in +the ["MLS *range* Definition"](mls_statements.md#mls-range-definition) section. **The statement is valid in:** - - - - - - - - - - - - - - - - - - - - - - - -
Monolithic PolicyBase PolicyModule Policy
YesYesYes
Conditional Policy if Statementoptional Statementrequire Statement
NoYesYes
+Policy Type + +| Monolithic Policy | Base Policy | Module Policy | +| ----------------------- | ----------------------- | ----------------------- | +| Yes | Yes | Yes | + +Conditional Policy Statements + +| *if* statement | *optional* Statement | *require* Statement | +| ----------------------- | ----------------------- | ----------------------- | +| No | Yes | Yes | **Examples:** @@ -156,8 +141,6 @@ user mque_u prefix user; user mque_u prefix user; ``` -
- ---