From patchwork Thu Jul 30 09:31:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dominick Grift X-Patchwork-Id: 11692589 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 828C7913 for ; Thu, 30 Jul 2020 09:31:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6AC292082E for ; Thu, 30 Jul 2020 09:31:41 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=defensec.nl header.i=@defensec.nl header.b="lT5NhXXm" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728528AbgG3Jbl (ORCPT ); Thu, 30 Jul 2020 05:31:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37466 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726774AbgG3Jbk (ORCPT ); Thu, 30 Jul 2020 05:31:40 -0400 Received: from agnus.defensec.nl (agnus.defensec.nl [IPv6:2001:985:d55d::711]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 9EB1AC061794 for ; Thu, 30 Jul 2020 02:31:40 -0700 (PDT) Received: from localhost.localdomain (brutus.lan [IPv6:2001:985:d55d::438]) by agnus.defensec.nl (Postfix) with ESMTPSA id F0DA02A1010; Thu, 30 Jul 2020 11:31:38 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.11.0 agnus.defensec.nl F0DA02A1010 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=defensec.nl; s=default; t=1596101499; bh=F/VD5C7d9i4lYDcd8TxazOFAgtLqKDTOaoAERK3J2nI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lT5NhXXm3MPbtGK1sBsK0cqK/ZIfVij4DywBv5gcCrSh7yOwhOehWKrLJYA9mkA+t 9Z82wqPPsCnJSO3QhYIoJHq/W2gsymUCh7DfGZ7KhF0Pi5HSBwpuEn0n8FM0gRlCXo 5OQuRRdAXU40BdpX3rL2V5RtiWuVtZcX4Y3j9V1Y= From: Dominick Grift To: selinux@vger.kernel.org Cc: Dominick Grift Subject: [SELinux-notebook PATCH v2] type_statements: document expandattribute Date: Thu, 30 Jul 2020 11:31:25 +0200 Message-Id: <20200730093125.896974-1-dominick.grift@defensec.nl> X-Mailer: git-send-email 2.28.0.rc1 In-Reply-To: <20200730085542.895297-1-dominick.grift@defensec.nl> References: <20200730085542.895297-1-dominick.grift@defensec.nl> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org This functionality was added for Androids Treble in 2017. I was not sure whether this belong here or in conditional_statements.md Signed-off-by: Dominick Grift --- v2: change expandtypeattribute to expandattribute src/type_statements.md | 70 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) diff --git a/src/type_statements.md b/src/type_statements.md index 61c7191..1ca655d 100644 --- a/src/type_statements.md +++ b/src/type_statements.md @@ -201,6 +201,76 @@ attribute non_security_file_type;
+## `expandattribute` + +The `expandattribute` statement allows type attribute expansion +compiler defaults to be overriden. + +**The statement definition is:** + +`expandattribute attribute_id default_value;` + +**Where:** + + + + + + + + + + + + + + + + +
expandattributeThe expandattribute keyword.
attribute_idOne or more previously declared attribute. Multiple entries consist of a space separated list enclosed in braces '{}'.
default_valueEither true or false
+ +**The statement is valid in:** + + + + + + + + + + + + + + + + + + + + + + + + +
Monolithic PolicyBase PolicyModule Policy
YesYesYes
Conditional Policy if Statementoptional Statementrequire Statement
NoYesNo
+ +**Example:** + +``` +# Using the expandattribute statement to forcibly expand a +# previously declared domain attribute. + +# The previously declared attribute: +attribute domain; + +# The attribute stripping using the expandattribute statement: +expandattribute domain true; +``` + +
+ ## `typeattribute` The `typeattribute` statement allows the association of previously