secilc/docs/cil_xen_statements.xml

<!-- Common Interface Language (CIL) Reference Guide -->
           <!-- xen_statements.xml -->

   <sect1>
      <title>Xen Statements</title>
      <para>Policy version 30 introduced the <literal><link linkend="devicetreecon">devicetreecon</link></literal> statement and also expanded the existing I/O memory range to 64 bits in order to support hardware with more than 44 bits of physical address space (32-bit count of 4K pages).</para>
      <para>See the <ulink url="http://xenbits.xen.org/docs/4.2-testing/misc/xsm-flask.txt">"XSM/FLASK Configuration"</ulink> document for further information (<ulink url="http://xenbits.xen.org/docs/4.2-testing/misc/xsm-flask.txt"></ulink>)</para>
      <sect2 id="iomemcon">
         <title>iomemcon</title>
         <para>Label i/o memory. This may be a single memory location or a range.</para>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(iomemcon mem_addr|(mem_low mem_high) context_id)]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal>iomemcon</literal></para>
                  </entry>
                  <entry>
                     <para>The <literal>iomemcon</literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>mem_addr |</literal></para>
                     <para><literal>(mem_low mem_high)</literal></para>
                  </entry>
                  <entry>
                     <para>A single memory address to apply the context, or a range of addresses.</para>
                     <para>The entries must consist of numerics <literal>[0-9]</literal>.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>context_id</literal></para>
                  </entry>
                  <entry>
                     <para>A previously declared <literal><link linkend="context">context</link></literal> identifier or an anonymous security context (<literal><link linkend="user">user</link> <link linkend="role">role</link> <link linkend="type">type</link> <link linkend="levelrange">levelrange</link></literal>), the range MUST be defined whether the policy is MLS/MCS enabled or not.</para>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>

         <para><emphasis role="bold">Example:</emphasis></para>
         <para>An anonymous context for a memory address range of <literal>0xfebe0-0xfebff</literal>:</para>
         <programlisting><![CDATA[(iomemcon (1043424 1043455) (unconfined.user object_r unconfined.object low_low))]]></programlisting>
      </sect2>

      <sect2 id="ioportcon">
         <title>ioportcon</title>
         <para>Label i/o ports. This may be a single port or a range.</para>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(ioportcon port|(port_low port_high) context_id)]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2.25 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal>ioportcon</literal></para>
                  </entry>
                  <entry>
                     <para>The <literal>ioportcon</literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>port |</literal></para>
                     <para><literal>(port_low port_high)</literal></para>
                  </entry>
                  <entry>
                     <para>A single port to apply the context, or a range of ports.</para>
                     <para>The entries must consist of numerics <literal>[0-9]</literal>.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>context_id</literal></para>
                  </entry>
                  <entry>
                     <para>A previously declared <literal><link linkend="context">context</link></literal> identifier or an anonymous security context (<literal><link linkend="user">user</link> <link linkend="role">role</link> <link linkend="type">type</link> <link linkend="levelrange">levelrange</link></literal>), the range MUST be defined whether the policy is MLS/MCS enabled or not.</para>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>

         <para><emphasis role="bold">Example:</emphasis></para>
         <para>An anonymous context for a single port of :<literal>0xecc0</literal>:</para>
         <programlisting><![CDATA[(ioportcon 60608 (unconfined.user object_r unconfined.object low_low))]]></programlisting>
      </sect2>

      <sect2 id="pcidevicecon">
         <title>pcidevicecon</title>
         <para>Label a PCI device.</para>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(pcidevicecon device context_id)]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal>pcidevicecon</literal></para>
                  </entry>
                  <entry>
                     <para>The <literal>pcidevicecon</literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>device</literal></para>
                  </entry>
                  <entry>
                     <para>The device number.The entries must consist of numerics <literal>[0-9]</literal>.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>context_id</literal></para>
                  </entry>
                  <entry>
                     <para>A previously declared <literal><link linkend="context">context</link></literal> identifier or an anonymous security context (<literal><link linkend="user">user</link> <link linkend="role">role</link> <link linkend="type">type</link> <link linkend="levelrange">levelrange</link></literal>), the range MUST be defined whether the policy is MLS/MCS enabled or not.</para>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>

         <para><emphasis role="bold">Example:</emphasis></para>
         <para>An anonymous context for a pci device address of <literal>0xc800</literal>:</para>
         <programlisting><![CDATA[(pcidevicecon 51200 (unconfined.user object_r unconfined.object low_low))]]></programlisting>
      </sect2>

      <sect2 id="pirqcon">
         <title>pirqcon</title>
         <para>Label an interrupt level.</para>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(pirqcon irq_level context_id)]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal>pirqcon</literal></para>
                  </entry>
                  <entry>
                     <para>The <literal>pirqcon</literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>irq_level</literal></para>
                  </entry>
                  <entry>
                     <para>The interrupt request number. The entries must consist of numerics <literal>[0-9]</literal>.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>context_id</literal></para>
                  </entry>
                  <entry>
                     <para>A previously declared <literal><link linkend="context">context</link></literal> identifier or an anonymous security context (<literal><link linkend="user">user</link> <link linkend="role">role</link> <link linkend="type">type</link> <link linkend="levelrange">levelrange</link></literal>), the range MUST be defined whether the policy is MLS/MCS enabled or not.</para>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>

         <para><emphasis role="bold">Example:</emphasis></para>
         <para>An anonymous context for IRQ 33:</para>
         <programlisting><![CDATA[(pirqcon 33 (unconfined.user object_r unconfined.object low_low))]]></programlisting>
      </sect2>

      <sect2 id="devicetreecon">
         <title>devicetreecon</title>
         <para>Label device tree nodes.</para>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(devicetreecon path context_id)]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal>devicetreecon</literal></para>
                  </entry>
                  <entry>
                     <para>The <literal>devicetreecon</literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>path</literal></para>
                  </entry>
                  <entry>
                     <para>The device tree path. If this contains spaces enclose within <literal>""</literal>.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>context_id</literal></para>
                  </entry>
                  <entry>
                     <para>A previously declared <literal><link linkend="context">context</link></literal> identifier or an anonymous security context (<literal><link linkend="user">user</link> <link linkend="role">role</link> <link linkend="type">type</link> <link linkend="levelrange">levelrange</link></literal>), the range MUST be defined whether the policy is MLS/MCS enabled or not.</para>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>

         <para><emphasis role="bold">Example:</emphasis></para>
         <para>An anonymous context for the specified path:</para>
         <programlisting><![CDATA[(devicetreecon "/this is/a/path" (unconfined.user object_r unconfined.object low_low))]]></programlisting>
      </sect2>

   </sect1>