Selinux grammar

From FedoraProject

(Difference between revisions)
Jump to: navigation, search
Line 45: Line 45:
  
 
te_rbac = ( te_decl | rbac_decl | cond_stmt_def | optional_block | policycap_def | ''';''' )+
 
te_rbac = ( te_decl | rbac_decl | cond_stmt_def | optional_block | policycap_def | ''';''' )+
 +
 +
te_avtab_def = '''ALLOW''' names names ''':''' names names  ''';''' | '''AUDITALLOW''' names names ''':''' names names ''';''' | '''AUDITDENY''' names names ''':''' names names ''';''' | '''DONTAUDIT''' names names ''':''' names names ''';''' | '''NEVERALLOW''' names names ''':''' names names  ''';'''
  
 
----
 
----
Line 82: Line 84:
 
initial_sids = initial_sid_def | initial_sids initial_sid_def
 
initial_sids = initial_sid_def | initial_sids initial_sid_def
  
initial_sid_def = SID identifier
+
initial_sid_def = '''SID''' identifier
  
 
access_vectors = opt_common_perms av_perms
 
access_vectors = opt_common_perms av_perms
Line 90: Line 92:
 
common_perms = common_perms_def | common_perms common_perms_def
 
common_perms = common_perms_def | common_perms common_perms_def
  
common_perms_def = COMMON identifier '''{''' identifier_list '''}'''
+
common_perms_def = '''COMMON''' identifier '''{''' identifier_list '''}'''
  
 
av_perms = av_perms_def | av_perms av_perms_def
 
av_perms = av_perms_def | av_perms av_perms_def
  
av_perms_def = CLASS identifier '''{''' identifier_list '''}''' | CLASS identifier INHERITS identifier  | CLASS identifier INHERITS identifier '''{''' identifier_list '''}'''
+
av_perms_def = '''CLASS''' identifier '''{''' identifier_list '''}''' | '''CLASS''' identifier '''INHERITS''' identifier  | '''CLASS''' identifier '''INHERITS''' identifier '''{''' identifier_list '''}'''
  
 
opt_mls = mls |  /* empty */
 
opt_mls = mls |  /* empty */
Line 102: Line 104:
 
sensitivities = sensitivity_def | sensitivities sensitivity_def
 
sensitivities = sensitivity_def | sensitivities sensitivity_def
  
sensitivity_def = SENSITIVITY identifier alias_def ';' | SENSITIVITY identifier ';'
+
sensitivity_def = '''SENSITIVITY''' identifier alias_def ';' | '''SENSITIVITY''' identifier ';'
  
alias_def = ALIAS names
+
alias_def = '''ALIAS''' names
  
dominance = DOMINANCE identifier | DOMINANCE '''{''' identifier_list '''}'''  
+
dominance = '''DOMINANCE''' identifier | '''DOMINANCE''' '''{''' identifier_list '''}'''  
  
 
opt_categories = categories | /* empty */
 
opt_categories = categories | /* empty */
Line 112: Line 114:
 
categories = category_def | categories category_def
 
categories = category_def | categories category_def
  
category_def = CATEGORY identifier alias_def ';' | CATEGORY identifier ';'
+
category_def = '''CATEGORY''' identifier alias_def ';' | '''CATEGORY''' identifier ';'
  
 
levels = level_def | levels level_def
 
levels = level_def | levels level_def
  
level_def = LEVEL identifier ':' id_comma_list ';' | LEVEL identifier ';'  
+
level_def = '''LEVEL''' identifier ':' id_comma_list ';' | '''LEVEL''' identifier ';'  
  
 
mlspolicy = mlspolicy_decl | mlspolicy mlspolicy_decl
 
mlspolicy = mlspolicy_decl | mlspolicy mlspolicy_decl
Line 122: Line 124:
 
mlspolicy_decl = mlsconstraint_def | mlsvalidatetrans_def
 
mlspolicy_decl = mlsconstraint_def | mlsvalidatetrans_def
  
mlsconstraint_def = MLSCONSTRAIN names names cexpr ';'
+
mlsconstraint_def = '''MLSCONSTRAIN''' names names cexpr ';'
  
mlsvalidatetrans_def = MLSVALIDATETRANS names cexpr ';'
+
mlsvalidatetrans_def = '''MLSVALIDATETRANS''' names cexpr ';'
  
 
opt_attr_list = ',' id_comma_list | /* empty */
 
opt_attr_list = ',' id_comma_list | /* empty */
  
bool_val = CTRUE | CFALSE
+
bool_val = '''CTRUE''' | '''CFALSE'''
  
 
cond_pol_list = cond_pol_list cond_rule_def  | /* empty */  
 
cond_pol_list = cond_pol_list cond_rule_def  | /* empty */  
Line 134: Line 136:
 
cond_rule_def = cond_transition_def | cond_te_avtab_def | require_block  
 
cond_rule_def = cond_transition_def | cond_te_avtab_def | require_block  
  
cond_transition_def = TYPE_TRANSITION names names ':' names identifier ';' | TYPE_MEMBER names names ':' names identifier ';' | TYPE_CHANGE names names ':' names identifier ';'  
+
cond_transition_def = '''TYPE_TRANSITION''' names names ':' names identifier ';' | '''TYPE_MEMBER''' names names ':' names identifier ';' | '''TYPE_CHANGE''' names names ':' names identifier ';'  
 
+
cond_te_avtab_def = cond_allow_def | cond_auditallow_def | cond_auditdeny_def | cond_dontaudit_def
+
 
+
cond_allow_def = ALLOW names names ':' names names  ';'
+
 
+
cond_auditallow_def = AUDITALLOW names names ':' names names ';'
+
 
+
cond_auditdeny_def = AUDITDENY names names ':' names names ';'
+
 
+
cond_dontaudit_def = DONTAUDIT names names ':' names names ';'
+
 
+
transition_def = TYPE_TRANSITION names names ':' names identifier ';' | TYPE_MEMBER names names ':' names identifier ';' | TYPE_CHANGE names names ':' names identifier ';'
+
 
+
range_trans_def = RANGE_TRANSITION names names mls_range_def ';' | RANGE_TRANSITION names names ':' names mls_range_def ';'
+
 
+
te_avtab_def = allow_def | auditallow_def | auditdeny_def | dontaudit_def | neverallow_def
+
 
+
allow_def = ALLOW names names ':' names names  ';'
+
 
+
auditallow_def = AUDITALLOW names names ':' names names ';'
+
  
auditdeny_def = AUDITDENY names names ':' names names ';'
+
cond_te_avtab_def = '''ALLOW''' names names ''':''' names names  ''';''' | '''AUDITALLOW''' names names ''':''' names names ''';''' | '''AUDITDENY''' names names ''':''' names names ''';''' | '''DONTAUDIT''' names names ''':''' names names ''';'''
  
dontaudit_def = DONTAUDIT names names ':' names names ';'
+
transition_def = '''TYPE_TRANSITION''' names names ''':''' names identifier ''';''' | '''TYPE_MEMBER''' names names ''':''' names identifier ''';''' | '''TYPE_CHANGE''' names names ''':''' names identifier ''';'''
  
neverallow_def = NEVERALLOW names names ':' names names ';'
+
range_trans_def = '''RANGE_TRANSITION''' names names mls_range_def ''';''' | '''RANGE_TRANSITION''' names names ''':''' names mls_range_def ''';'''  
  
role_type_def = ROLE identifier TYPES names ';' | ROLE identifier';'
+
role_type_def = '''ROLE''' identifier '''TYPES''' names ''';''' | '''ROLE''' identifier';'
  
role_dominance = DOMINANCE '''{''' roles '''}'''
+
role_dominance = '''DOMINANCE''' '''{''' roles '''}'''
  
role_trans_def = ROLE_TRANSITION names names identifier ';'
+
role_trans_def = '''ROLE_TRANSITION''' names names identifier ''';'''
  
role_allow_def = ALLOW names names ';'
+
role_allow_def = '''ALLOW''' names names ''';'''
  
 
roles = role_def | roles role_def
 
roles = role_def | roles role_def
  
role_def = ROLE identifier_push ';' | ROLE identifier_push '''{''' roles '''}'''
+
role_def = '''ROLE''' identifier_push ''';''' | '''ROLE''' identifier_push '''{''' roles '''}'''
  
 
opt_constraints = constraints | /* empty */
 
opt_constraints = constraints | /* empty */
Line 180: Line 162:
 
constraint_decl = constraint_def | validatetrans_def
 
constraint_decl = constraint_def | validatetrans_def
  
constraint_def = CONSTRAIN names names cexpr ';'
+
constraint_def = '''CONSTRAIN''' names names cexpr ''';'''
  
validatetrans_def = VALIDATETRANS names cexpr ';'
+
validatetrans_def = '''VALIDATETRANS''' names cexpr ''';'''
  
cexpr = '(' cexpr ')' | NOT cexpr | cexpr AND cexpr | cexpr OR cexpr | cexpr_prim
+
cexpr = '(' cexpr ')' | '''NOT''' cexpr | cexpr '''AND''' cexpr | cexpr '''OR''' cexpr | cexpr_prim
  
cexpr_prim = U1 op U2 | R1 role_mls_op R2 | T1 op T2 | U1 op names_push | U2 op names_push | U3 op names_push | R1 op names_push | R2 op names_push | R3 op names_push | T1 op names_push | T2 op names_push | T3 op names_push | SAMEUSER | SOURCE ROLE names_push | TARGET ROLE names_push | ROLE role_mls_op | SOURCE TYPE names_push | TARGET TYPE names_push | L1 role_mls_op L2 | L1 role_mls_op H2 | H1 role_mls_op L2 | H1 role_mls_op H2 | L1 role_mls_op H1 | L2 role_mls_op H2
+
cexpr_prim = U1 op U2 | R1 role_mls_op R2 | T1 op T2 | U1 op names_push | U2 op names_push | U3 op names_push | R1 op names_push | R2 op names_push | R3 op names_push | T1 op names_push | T2 op names_push | T3 op names_push | '''SAMEUSER''' | '''SOURCE''' '''ROLE''' names_push | '''TARGET''' '''ROLE''' names_push | '''ROLE''' role_mls_op | '''SOURCE''' '''TYPE''' names_push | '''TARGET''' '''TYPE''' names_push | L1 role_mls_op L2 | L1 role_mls_op H2 | H1 role_mls_op L2 | H1 role_mls_op H2 | L1 role_mls_op H1 | L2 role_mls_op H2
  
op = EQUALS | NOTEQUAL
+
op = '''EQUALS''' | '''NOTEQUAL'''
  
role_mls_op = op | DOM | DOMBY | INCOMP  
+
role_mls_op = op | '''DOM''' | '''DOMBY''' | '''INCOMP'''
  
 
users = user_def | users user_def
 
users = user_def | users user_def
  
opt_mls_user = LEVEL mls_level_def RANGE mls_range_def | /* empty */
+
opt_mls_user = '''LEVEL''' mls_level_def '''RANGE''' mls_range_def | /* empty */
  
 
initial_sid_contexts = initial_sid_context_def | initial_sid_contexts initial_sid_context_def
 
initial_sid_contexts = initial_sid_context_def | initial_sid_contexts initial_sid_context_def
  
initial_sid_context_def = SID identifier security_context_def
+
initial_sid_context_def = '''SID''' identifier security_context_def
  
 
opt_fs_contexts = fs_contexts | /* empty */
 
opt_fs_contexts = fs_contexts | /* empty */
Line 204: Line 186:
 
fs_contexts = fs_context_def | fs_contexts fs_context_def
 
fs_contexts = fs_context_def | fs_contexts fs_context_def
  
fs_context_def = FSCON number number security_context_def security_context_def
+
fs_context_def = '''FSCON''' number number security_context_def security_context_def
  
 
net_contexts = opt_port_contexts opt_netif_contexts opt_node_contexts  
 
net_contexts = opt_port_contexts opt_netif_contexts opt_node_contexts  
Line 212: Line 194:
 
port_contexts = port_context_def | port_contexts port_context_def
 
port_contexts = port_context_def | port_contexts port_context_def
  
port_context_def = PORTCON identifier number security_context_def | PORTCON identifier number '-' number security_context_def
+
port_context_def = '''PORTCON''' identifier number security_context_def | '''PORTCON''' identifier number '-' number security_context_def
  
 
opt_netif_contexts = netif_contexts | /* empty */
 
opt_netif_contexts = netif_contexts | /* empty */
Line 218: Line 200:
 
netif_contexts = netif_context_def | netif_contexts netif_context_def
 
netif_contexts = netif_context_def | netif_contexts netif_context_def
  
netif_context_def = NETIFCON identifier security_context_def security_context_def
+
netif_context_def = '''NETIFCON''' identifier security_context_def security_context_def
  
 
opt_node_contexts = node_contexts | /* empty */
 
opt_node_contexts = node_contexts | /* empty */
Line 224: Line 206:
 
node_contexts = node_context_def | node_contexts node_context_def
 
node_contexts = node_context_def | node_contexts node_context_def
  
node_context_def = NODECON ipv4_addr_def ipv4_addr_def security_context_def | NODECON ipv6_addr ipv6_addr security_context_def
+
node_context_def = '''NODECON''' ipv4_addr_def ipv4_addr_def security_context_def | '''NODECON''' ipv6_addr ipv6_addr security_context_def
  
 
opt_fs_uses = fs_uses | /* empty */
 
opt_fs_uses = fs_uses | /* empty */
Line 230: Line 212:
 
fs_uses = fs_use_def | fs_uses fs_use_def
 
fs_uses = fs_use_def | fs_uses fs_use_def
  
fs_use_def = FSUSEXATTR identifier security_context_def ';' | FSUSETASK identifier security_context_def ';' | FSUSETRANS identifier security_context_def ';'
+
fs_use_def = '''FSUSEXATTR''' identifier security_context_def ''';''' | '''FSUSETASK''' identifier security_context_def ''';''' | '''FSUSETRANS''' identifier security_context_def ''';'''
  
 
opt_genfs_contexts = genfs_contexts | /* empty */
 
opt_genfs_contexts = genfs_contexts | /* empty */
Line 236: Line 218:
 
genfs_contexts = genfs_context_def | genfs_contexts genfs_context_def
 
genfs_contexts = genfs_context_def | genfs_contexts genfs_context_def
  
genfs_context_def = GENFSCON identifier path '-' identifier security_context_def | GENFSCON identifier path '-' '-'  security_context_def | GENFSCON identifier path security_context_def
+
genfs_context_def = '''GENFSCON''' identifier path '-' identifier security_context_def | '''GENFSCON''' identifier path '-' '-'  security_context_def | '''GENFSCON''' identifier path security_context_def
  
ipv4_addr_def = IPV4_ADDR
+
ipv4_addr_def = '''IPV4_ADDR'''
  
security_context_def = identifier ':' identifier ':' identifier opt_mls_range_def
+
security_context_def = identifier ''':''' identifier ''':''' identifier opt_mls_range_def
  
opt_mls_range_def = ':' mls_range_def | /* empty */
+
opt_mls_range_def = ''':''' mls_range_def | /* empty */
  
 
mls_range_def = mls_level_def '-' mls_level_def | mls_level_def
 
mls_range_def = mls_level_def '-' mls_level_def | mls_level_def
  
mls_level_def = identifier ':' id_comma_list | identifier
+
mls_level_def = identifier ''':''' id_comma_list | identifier
  
 
id_comma_list = identifier | id_comma_list ',' identifier
 
id_comma_list = identifier | id_comma_list ',' identifier
Line 272: Line 254:
 
ipv6_addr = IPV6_ADDR
 
ipv6_addr = IPV6_ADDR
  
policycap_def = POLICYCAP identifier ';'
+
policycap_def = POLICYCAP identifier ''';'''
  
 
version_identifier = VERSION_IDENTIFIER
 
version_identifier = VERSION_IDENTIFIER

Revision as of 14:02, 7 November 2008

This is my attempt at documenting the policy grammar that is accepted by checkpolicy. The grammar was taken directly from the bison input file and edited to make it more readable for the wiki system.

Comments start with a # character and continue to the end of the line.

Keywords can be in all uppercase or all lowercase.

Convention followed in this document: Plain text is used for non-terminals. Basically it means that there is a defination of the thing else where. When a non-terminal is used on the right hand side of a grammar rule there should be some rule in the file with that non-terminal on the left hand side. Items in bold are literal, they must appear in the policy file exactly as written. Items in italics are used for things that can be replaced by some user specified text. They will also be surrounded with < and > signs to make them clearly different from keywords.

Any item in [ square brackets ] is an optional item. Items with a * after them can be repeated zero or more times. Items with a + after them can be repeated one or more times. Parenthesis are used to group items that can be repeated. Vertical lines | are used to indicate alternatives.

A file must contain either a base_policy or a module_policy.


base_policy = class_def+ initial_sids access_vectors opt_mls te_rbac users opt_constraints initial_sid_contexts opt_fs_contexts opt_fs_uses opt_genfs_contexts net_contexts


module_policy = MODULE <identifier> <version_identifier> ; avrules_block

avrules_block = avrule_decl+ user_def*

avrule_decl = rbac_decl | te_decl | cond_stmt_def | require_block | optional_block | ;

user_def = USER <identifier> ROLES names opt_mls_user ;


rbac_decl = role_type_def | role_dominance | role_trans_def | role_allow_def

te_decl = ATTRIBUTE <identifier> ; | type_def | TYPEALIAS <identifier> alias_def ; | TYPEATTRIBUTE <identifier> id_comma_list ; | BOOL <identifier> bool_val ; | transition_def | range_trans_def | te_avtab_def | PERMISSIVE <identifier> ;

te_rbac = ( te_decl | rbac_decl | cond_stmt_def | optional_block | policycap_def | ; )+

te_avtab_def = ALLOW names names : names names ; | AUDITALLOW names names : names names ; | AUDITDENY names names : names names ; | DONTAUDIT names names : names names ; | NEVERALLOW names names : names names ;


require_block = REQUIRE { require_decl+ }

require_decl = require_class ; | require_decl_def require_id_list ;


optional_block = OPTIONAL { avrules_block } [ ELSE { avrules_block } ]


cond_stmt_def = IF cond_expr { cond_pol_list } [ ELSE { cond_pol_list } ]

cond_expr = '(' cond_expr ')' | NOT cond_expr | cond_expr AND cond_expr | cond_expr OR cond_expr | cond_expr XOR cond_expr | cond_expr EQUALS cond_expr | cond_expr NOTEQUAL cond_expr | <identifier>


type_def = TYPE <identifier> alias_def opt_attr_list ; | TYPE <identifier> opt_attr_list ;


Some token definations:

version_identifier = xxx


names = <identifier> | nested_id_set | * | ~ <identifier> | ~ nested_id_set | <identifier> - <identifier>


class_def = CLASS <identifier>

initial_sids = initial_sid_def | initial_sids initial_sid_def

initial_sid_def = SID identifier

access_vectors = opt_common_perms av_perms

opt_common_perms = common_perms | /* empty */

common_perms = common_perms_def | common_perms common_perms_def

common_perms_def = COMMON identifier { identifier_list }

av_perms = av_perms_def | av_perms av_perms_def

av_perms_def = CLASS identifier { identifier_list } | CLASS identifier INHERITS identifier | CLASS identifier INHERITS identifier { identifier_list }

opt_mls = mls | /* empty */

mls = sensitivities dominance opt_categories levels mlspolicy

sensitivities = sensitivity_def | sensitivities sensitivity_def

sensitivity_def = SENSITIVITY identifier alias_def ';' | SENSITIVITY identifier ';'

alias_def = ALIAS names

dominance = DOMINANCE identifier | DOMINANCE { identifier_list }

opt_categories = categories | /* empty */

categories = category_def | categories category_def

category_def = CATEGORY identifier alias_def ';' | CATEGORY identifier ';'

levels = level_def | levels level_def

level_def = LEVEL identifier ':' id_comma_list ';' | LEVEL identifier ';'

mlspolicy = mlspolicy_decl | mlspolicy mlspolicy_decl

mlspolicy_decl = mlsconstraint_def | mlsvalidatetrans_def

mlsconstraint_def = MLSCONSTRAIN names names cexpr ';'

mlsvalidatetrans_def = MLSVALIDATETRANS names cexpr ';'

opt_attr_list = ',' id_comma_list | /* empty */

bool_val = CTRUE | CFALSE

cond_pol_list = cond_pol_list cond_rule_def | /* empty */

cond_rule_def = cond_transition_def | cond_te_avtab_def | require_block

cond_transition_def = TYPE_TRANSITION names names ':' names identifier ';' | TYPE_MEMBER names names ':' names identifier ';' | TYPE_CHANGE names names ':' names identifier ';'

cond_te_avtab_def = ALLOW names names : names names ; | AUDITALLOW names names : names names ; | AUDITDENY names names : names names ; | DONTAUDIT names names : names names ;

transition_def = TYPE_TRANSITION names names : names identifier ; | TYPE_MEMBER names names : names identifier ; | TYPE_CHANGE names names : names identifier ;

range_trans_def = RANGE_TRANSITION names names mls_range_def ; | RANGE_TRANSITION names names : names mls_range_def ;

role_type_def = ROLE identifier TYPES names ; | ROLE identifier';'

role_dominance = DOMINANCE { roles }

role_trans_def = ROLE_TRANSITION names names identifier ;

role_allow_def = ALLOW names names ;

roles = role_def | roles role_def

role_def = ROLE identifier_push ; | ROLE identifier_push { roles }

opt_constraints = constraints | /* empty */

constraints = constraint_decl | constraints constraint_decl

constraint_decl = constraint_def | validatetrans_def

constraint_def = CONSTRAIN names names cexpr ;

validatetrans_def = VALIDATETRANS names cexpr ;

cexpr = '(' cexpr ')' | NOT cexpr | cexpr AND cexpr | cexpr OR cexpr | cexpr_prim

cexpr_prim = U1 op U2 | R1 role_mls_op R2 | T1 op T2 | U1 op names_push | U2 op names_push | U3 op names_push | R1 op names_push | R2 op names_push | R3 op names_push | T1 op names_push | T2 op names_push | T3 op names_push | SAMEUSER | SOURCE ROLE names_push | TARGET ROLE names_push | ROLE role_mls_op | SOURCE TYPE names_push | TARGET TYPE names_push | L1 role_mls_op L2 | L1 role_mls_op H2 | H1 role_mls_op L2 | H1 role_mls_op H2 | L1 role_mls_op H1 | L2 role_mls_op H2

op = EQUALS | NOTEQUAL

role_mls_op = op | DOM | DOMBY | INCOMP

users = user_def | users user_def

opt_mls_user = LEVEL mls_level_def RANGE mls_range_def | /* empty */

initial_sid_contexts = initial_sid_context_def | initial_sid_contexts initial_sid_context_def

initial_sid_context_def = SID identifier security_context_def

opt_fs_contexts = fs_contexts | /* empty */

fs_contexts = fs_context_def | fs_contexts fs_context_def

fs_context_def = FSCON number number security_context_def security_context_def

net_contexts = opt_port_contexts opt_netif_contexts opt_node_contexts

opt_port_contexts = port_contexts | /* empty */

port_contexts = port_context_def | port_contexts port_context_def

port_context_def = PORTCON identifier number security_context_def | PORTCON identifier number '-' number security_context_def

opt_netif_contexts = netif_contexts | /* empty */

netif_contexts = netif_context_def | netif_contexts netif_context_def

netif_context_def = NETIFCON identifier security_context_def security_context_def

opt_node_contexts = node_contexts | /* empty */

node_contexts = node_context_def | node_contexts node_context_def

node_context_def = NODECON ipv4_addr_def ipv4_addr_def security_context_def | NODECON ipv6_addr ipv6_addr security_context_def

opt_fs_uses = fs_uses | /* empty */

fs_uses = fs_use_def | fs_uses fs_use_def

fs_use_def = FSUSEXATTR identifier security_context_def ; | FSUSETASK identifier security_context_def ; | FSUSETRANS identifier security_context_def ;

opt_genfs_contexts = genfs_contexts | /* empty */

genfs_contexts = genfs_context_def | genfs_contexts genfs_context_def

genfs_context_def = GENFSCON identifier path '-' identifier security_context_def | GENFSCON identifier path '-' '-' security_context_def | GENFSCON identifier path security_context_def

ipv4_addr_def = IPV4_ADDR

security_context_def = identifier : identifier : identifier opt_mls_range_def

opt_mls_range_def = : mls_range_def | /* empty */

mls_range_def = mls_level_def '-' mls_level_def | mls_level_def

mls_level_def = identifier : id_comma_list | identifier

id_comma_list = identifier | id_comma_list ',' identifier

names_push = identifier_push | { identifier_list_push } | * | ~ identifier_push | ~ { identifier_list_push }

identifier_list_push = identifier_push | identifier_list_push identifier_push

identifier_push = IDENTIFIER

identifier_list = identifier | identifier_list identifier

nested_id_set = { nested_id_list }

nested_id_list = nested_id_element | nested_id_list nested_id_element

nested_id_element = identifier | '-' identifier | nested_id_set

identifier = IDENTIFIER

path = PATH

number = NUMBER

ipv6_addr = IPV6_ADDR

policycap_def = POLICYCAP identifier ;

version_identifier = VERSION_IDENTIFIER

require_class = CLASS identifier names

require_decl_def = ROLE | TYPE | ATTRIBUTE | USER | BOOL | SENSITIVITY | CATEGORY

require_id_list = identifier | require_id_list ',' identifier