Conditional Statements

boolean

Declares a run time boolean as true or false in the current namespace. The booleanif statement contains the CIL code that will be in the binary policy file.

boolean are not allowed in booleanif blocks.

Statement definition:

    (boolean boolean_id true|false)

Where:

Example:

See the booleanif statement for an example.

booleanif

Contains the run time conditional statements that are instantiated in the binary policy according to the computed boolean identifier(s) state.

call statements are allowed within a booleanif, however the contents of the resulting macro must be limited to those of the booleanif statement (i.e. allow, auditallow, dontaudit, typemember, typetransition, typechange and the compile time tunableif statement)).

Statement definition:

    (booleanif boolean_id | expr ...
        (true
            cil_statements
            ...)
        (false
            cil_statements
            ...)
    )

Where:

Examples:

The second example also shows the kernel policy language equivalent:

    (boolean disableAudio false)

    (booleanif disableAudio
        (false
            (allow process mediaserver.audio_device (chr_file_set (rw_file_perms)))
        )
    )

    (boolean disableAudioCapture false)

    ;;; if(!disableAudio && !disableAudioCapture) {
    (booleanif (and (not disableAudio) (not disableAudioCapture))
        (true
            (allow process mediaserver.audio_capture_device (chr_file_set (rw_file_perms)))
        )
    )

tunable

Tunables are similar to booleans, however they are used to manage areas of CIL statements that may or may not be in the final CIL policy that will be compiled (whereas booleans are embedded in the binary policy and can be enabled or disabled during run-time).

Note that tunables can be treated as booleans by the CIL compiler command line parameter -P or --preserve-tunables flags.

Since tunableif statements are resolved first, tunable statements are not allowed in in, macro, optional, and booleanif blocks. To simplify processing, they are also not allowed in tunableif blocks.

Statement definition:

    (tunable tunable_id true|false)

Where:

Example:

See the tunableif statement for an example.

tunableif

Compile time conditional statement that may or may not add CIL statements to be compiled.

If tunables are being treated as booleans (by using the CIL compiler command line parameter -P or --preserve-tunables flag), then only the statements allowed in a booleanif block are allowed in a tunableif block. Otherwise, tunable statements are not allowed in a tunableif block.

Statement definition:

    (tunableif tunable_id | expr ...
        (true
            cil_statements
            ...)
        (false
            cil_statements
            ...)
    )

Where:

Example:

This example will not add the range transition rule to the binary policy:

    (tunable range_trans_rule false)

    (block init
        (class process (process))
        (type process)

        (tunableif range_trans_rule
            (true
                (rangetransition process sshd.exec process low_high)
            )
        ) ; End tunableif
    ) ; End block