Instantiate a macro within the current namespace. There may be zero or more parameters passed to the macro (with zero parameters this is similar to the blockinherit (call) / blockabstract (macro) statements).
Each parameter passed contains an argument to be resolved by the macro, these can be named or anonymous but must conform to the parameter types defined in the macro statement.
Statement definition:
(call macro_id [(param ...)])
Where:
Example:
See the macro statement for an example.
Declare a macro in the current namespace with its associated parameters. The macro identifier is used by the call statement to instantiate the macro and resolve any parameters. The call statement may be within the body of a macro.
Note that when resolving macros the callers namespace is not checked, only the following places:
Items defined inside the macro
Items passed into the macro as arguments
Items defined in the same namespace of the macro
Items defined in the global namespace
Statement definition:
(macro macro_id ([(param_type param_id) ...])
cil_statements
...
)
Where:
Examples:
This example will instantiate the binder_call macro in the calling namespace (my_domain) and replace ARG1 with appdomain and ARG2 with binderservicedomain:
(block my_domain
(call binder_call (appdomain binderservicedomain))
)
(macro binder_call ((type ARG1) (type ARG2))
(allow ARG1 ARG2 (binder (call transfer)))
(allow ARG2 ARG1 (binder (transfer)))
(allow ARG1 ARG2 (fd (use)))
)
This example does not pass any parameters to the macro but adds a type identifier to the current namespace:
(block unconfined
(call add_type)
....
(macro add_type ()
(type exec)
)
)
This example passes an anonymous and named IP address to the macro:
(ipaddr netmask_1 255.255.255.0)
(context netlabel_1 (system.user object_r unconfined.object low_low)
(call build_nodecon ((192.168.1.64) netmask_1))
(macro build_nodecon ((ipaddr ARG1) (ipaddr ARG2))
(nodecon ARG1 ARG2 netlabel_1)
)