92 lines
3.2 KiB
Diff
92 lines
3.2 KiB
Diff
From 9e9b8103400badc09ba98c66044e5ca57cc80446 Mon Sep 17 00:00:00 2001
|
|
From: Dominick Grift <dominick.grift@defensec.nl>
|
|
Date: Wed, 5 Aug 2020 21:48:23 +0200
|
|
Subject: [PATCH] secilc/docs: document expandtypeattribute
|
|
|
|
This was added for Androids Treble in 2017.
|
|
|
|
Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
|
|
Acked-by: James Carter <jwcart2@gmail.com>
|
|
---
|
|
secilc/docs/README.md | 1 +
|
|
secilc/docs/cil_type_statements.md | 51 ++++++++++++++++++++++++++++++
|
|
2 files changed, 52 insertions(+)
|
|
|
|
diff --git a/secilc/docs/README.md b/secilc/docs/README.md
|
|
index 3f1838e63be1..efab2a71bbf3 100644
|
|
--- a/secilc/docs/README.md
|
|
+++ b/secilc/docs/README.md
|
|
@@ -126,6 +126,7 @@ CIL (Common Intermediate Language)
|
|
* [typealiasactual](cil_type_statements.md#typealiasactual)
|
|
* [typeattribute](cil_type_statements.md#typeattribute)
|
|
* [typeattributeset](cil_type_statements.md#typeattributeset)
|
|
+ * [expandtypeattribute](cil_type_statements.md#expandtypeattribute)
|
|
* [typebounds](cil_type_statements.md#typebounds)
|
|
* [typechange](cil_type_statements.md#typechange)
|
|
* [typemember](cil_type_statements.md#typemember)
|
|
diff --git a/secilc/docs/cil_type_statements.md b/secilc/docs/cil_type_statements.md
|
|
index f9dd3a7697ae..432cede5df53 100644
|
|
--- a/secilc/docs/cil_type_statements.md
|
|
+++ b/secilc/docs/cil_type_statements.md
|
|
@@ -213,6 +213,57 @@ This example is equivalent to `{ domain -kernel.process -ueventd.process -init.p
|
|
)
|
|
)
|
|
|
|
+expandtypeattribute
|
|
+-------------------
|
|
+
|
|
+Overrides the compiler defaults for the expansion of one or more
|
|
+previously declared [`typeattribute`](cil_type_statements.md#typeattribute)
|
|
+identifiers.
|
|
+
|
|
+This rule gives more control over type attribute expansion and
|
|
+removal. When the value is true, all rules involving the type
|
|
+attribute will be expanded and the type attribute will be removed from
|
|
+the policy. When the value is false, the type attribute will not be
|
|
+removed from the policy, even if the default expand rules or "-X"
|
|
+option cause the rules involving the type attribute to be expanded.
|
|
+
|
|
+**Statement definition:**
|
|
+
|
|
+ (expandtypeattribute typeattribute_id expand_value)
|
|
+
|
|
+**Where:**
|
|
+
|
|
+<table>
|
|
+<colgroup>
|
|
+<col width="25%" />
|
|
+<col width="75%" />
|
|
+</colgroup>
|
|
+<tbody>
|
|
+<tr class="odd">
|
|
+<td align="left"><p><code>expandtypeattribute</code></p></td>
|
|
+<td align="left"><p>The <code>expandtypeattribute</code> keyword.</p></td>
|
|
+</tr>
|
|
+<tr class="even">
|
|
+<td align="left"><p><code>typeattribute_id</code></p></td>
|
|
+<td align="left"><p>One or more previously declared <code>typeattribute</code> identifiers. Multiple entries consist of a space separated list enclosed in parentheses '()'.</p></td>
|
|
+</tr>
|
|
+<tr class="odd">
|
|
+<td align="left"><p><code>expand_value</code></p></td>
|
|
+<td align="left"><p>Either true or false.</p></td>
|
|
+</tr>
|
|
+</tbody>
|
|
+</table>
|
|
+
|
|
+**Examples:**
|
|
+
|
|
+This example uses the expandtypeattribute statement to forcibly expand a previously declared `domain` type attribute.
|
|
+
|
|
+ (expandtypeattribute domain true)
|
|
+
|
|
+This example uses the expandtypeattribute statement to not expand previously declared `file_type` and `port_type` type attributes regardless of compiler defaults.
|
|
+
|
|
+ (expandtypeattribute (file_type port_type) false)
|
|
+
|
|
typebounds
|
|
----------
|
|
|
|
--
|
|
2.29.2
|
|
|