Define entries for labeling files. The compiler will produce these entries in a file called file_contexts
(5)
by default in the cwd
. The compiler option [-f|--filecontext <filename>]
may be used to specify a different path or file name.
Statement definition:
(filecon "path" file_type context_id)
Where:
Examples:
These examples use one named, one anonymous and one empty context definition:
(context runas_exec_context (u object_r exec low_low)) (filecon "/system/bin/run-as" file runas_exec_context) (filecon "/dev/socket/wpa_wlan[0-9]" any u:object_r:wpa.socket:s0-s0) (filecon "/data/local/mine" dir ())
to resolve/build file_contexts
entries of (assuming MLS enabled policy):
/system/bin/run-as -- u:object_r:runas.exec:s0 /dev/socket/wpa_wlan[0-9] u:object_r:wpa.socket:s0 /data/local/mine -d <<none>>
Label filesystems that support SELinux security contexts.
Statement definition:
(fsuse fstype fsname context_id)
Where:
Examples:
The context identifiers are declared in the file
namespace and the fsuse
statements in the global namespace:
(block file (type labeledfs) (roletype object_r labeledfs) (context labeledfs_context (u object_r labeledfs low_low)) (type pipefs) (roletype object_r pipefs) (context pipefs_context (u object_r pipefs low_low)) ... ) (fsuse xattr ex4 file.labeledfs_context) (fsuse xattr btrfs file.labeledfs_context) (fsuse task pipefs file.pipefs_context) (fsuse task sockfs file.sockfs_context) (fsuse trans devpts file.devpts_context) (fsuse trans tmpfs file.tmpfs_context)
Used to allocate a security context to filesystems that cannot support any of the fsuse
file labeling options. Generally a filesystem would have a single default security context assigned by genfscon
from the root (/)
that would then be inherited by all files and directories on that filesystem. The exception to this is the /proc
filesystem, where directories can be labeled with a specific security context (as shown in the examples).
Statement definition:
(genfscon fsname path context_id)
Where:
Examples:
The context identifiers are declared in the file
namespace and the genfscon
statements are then inserted using the in
container statement:
(file (type rootfs) (roletype object_r rootfs) (context rootfs_context (u object_r rootfs low_low)) (type proc) (roletype object_r proc) (context rootfs_context (u object_r proc low_low)) ... ) (in file (genfscon rootfs / rootfs_context) ; proc labeling can be further refined (longest matching prefix). (genfscon proc / proc_context) (genfscon proc /net/xt_qtaguid/ctrl qtaguid_proc_context) (genfscon proc /sysrq-trigger sysrq_proc_context) (genfscon selinuxfs / selinuxfs_context) )