Nick Kralevich | 4be3190 | 2014-07-01 13:59:50 -0700 | [diff] [blame] | 1 | # Input selectors: |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 2 | # isSystemServer (boolean) |
| 3 | # user (string) |
| 4 | # seinfo (string) |
| 5 | # name (string) |
Stephen Smalley | 6139de5 | 2014-02-19 10:54:41 -0500 | [diff] [blame] | 6 | # path (string) |
Stephen Smalley | dd31ddf | 2012-07-27 17:08:21 -0400 | [diff] [blame] | 7 | # sebool (string) |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 8 | # isSystemServer=true can only be used once. |
Stephen Smalley | dd31ddf | 2012-07-27 17:08:21 -0400 | [diff] [blame] | 9 | # An unspecified isSystemServer defaults to false. |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 10 | # An unspecified string selector will match any value. |
| 11 | # A user string selector that ends in * will perform a prefix match. |
Stephen Smalley | 3ac1d26 | 2012-09-24 10:16:03 -0400 | [diff] [blame] | 12 | # user=_app will match any regular app UID. |
| 13 | # user=_isolated will match any isolated service UID. |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 14 | # All specified input selectors in an entry must match (i.e. logical AND). |
| 15 | # Matching is case-insensitive. |
Nick Kralevich | 4be3190 | 2014-07-01 13:59:50 -0700 | [diff] [blame] | 16 | # |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 17 | # Precedence rules: |
| 18 | # (1) isSystemServer=true before isSystemServer=false. |
| 19 | # (2) Specified user= string before unspecified user= string. |
| 20 | # (3) Fixed user= string before user= prefix (i.e. ending in *). |
Nick Kralevich | 4be3190 | 2014-07-01 13:59:50 -0700 | [diff] [blame] | 21 | # (4) Longer user= prefix before shorter user= prefix. |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 22 | # (5) Specified seinfo= string before unspecified seinfo= string. |
| 23 | # (6) Specified name= string before unspecified name= string. |
Stephen Smalley | 6139de5 | 2014-02-19 10:54:41 -0500 | [diff] [blame] | 24 | # (7) Specified path= string before unspecified path= string. |
| 25 | # (8) Specified sebool= string before unspecified sebool= string. |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 26 | # |
| 27 | # Outputs: |
| 28 | # domain (string) |
| 29 | # type (string) |
Stephen Smalley | 3808414 | 2012-11-28 10:46:18 -0500 | [diff] [blame] | 30 | # levelFrom (string; one of none, all, app, or user) |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 31 | # level (string) |
| 32 | # Only entries that specify domain= will be used for app process labeling. |
| 33 | # Only entries that specify type= will be used for app directory labeling. |
Stephen Smalley | 3808414 | 2012-11-28 10:46:18 -0500 | [diff] [blame] | 34 | # levelFrom=user is only supported for _app or _isolated UIDs. |
| 35 | # levelFrom=app or levelFrom=all is only supported for _app UIDs. |
Nick Kralevich | 4be3190 | 2014-07-01 13:59:50 -0700 | [diff] [blame] | 36 | # level may be used to specify a fixed level for any UID. |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 37 | # |
Alex Klyubin | 1fdee11 | 2013-09-13 15:59:04 -0700 | [diff] [blame] | 38 | isSystemServer=true domain=system_server |
Stephen Smalley | 91a4f8d | 2014-05-07 13:10:02 -0400 | [diff] [blame] | 39 | user=system domain=system_app type=system_app_data_file |
Stephen Smalley | 61c80d5 | 2012-11-16 09:06:47 -0500 | [diff] [blame] | 40 | user=bluetooth domain=bluetooth type=bluetooth_data_file |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 41 | user=nfc domain=nfc type=nfc_data_file |
| 42 | user=radio domain=radio type=radio_data_file |
Torne (Richard Coles) | 9786af2 | 2014-05-23 11:01:58 +0100 | [diff] [blame] | 43 | user=shared_relro domain=shared_relro |
Stephen Smalley | 6d8fa69 | 2014-03-27 11:48:32 -0400 | [diff] [blame] | 44 | user=shell domain=shell type=shell_data_file |
Joshua Brindle | f26d813 | 2012-09-25 18:52:54 -0400 | [diff] [blame] | 45 | user=_isolated domain=isolated_app |
Stephen Smalley | 9ba844f | 2014-04-04 09:09:25 -0400 | [diff] [blame] | 46 | user=_app seinfo=platform domain=platform_app type=app_data_file |
| 47 | user=_app domain=untrusted_app type=app_data_file |