<Comment>; SELinux CIL Policy</Comment><br/>
<dsNormal></dsNormal><br/>
<Comment>; Tests</Comment><br/>
<dsNormal></dsNormal><br/>
<Brackets1>(</Brackets1><Policy Config. Statements>policycap</Policy Config. Statements><Normal Text> open_perms</Normal Text><Brackets1>)</Brackets1><Normal Text>  </Normal Text><Comment>; Policy config. statement</Comment><br/>
<Brackets1>(</Brackets1><Policy Config. Statements>mls</Policy Config. Statements><Normal Text> </Normal Text><Booleans>true</Booleans><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Policy Config. Statements>handleunknown</Policy Config. Statements><Normal Text> </Normal Text><Access Keys>allow</Access Keys><Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Brackets1>(</Brackets1><Type Statements>sid</Type Statements><Normal Text> kernel</Normal Text><Brackets1>)</Brackets1><Normal Text>  </Normal Text><Comment>; Declaration type statement</Comment><br/>
<Brackets1>(</Brackets1><Statements>classpermissionset</Statements><Normal Text> char_w </Normal Text><Brackets2>(</Brackets2><Normal Text>char </Normal Text><Brackets3>(</Brackets3><Permissions>write</Permissions><Normal Text> </Normal Text><Permissions>setattr</Permissions><Brackets3>)</Brackets3><Brackets2>)</Brackets2><Brackets1>)</Brackets1><Normal Text>  </Normal Text><Comment>; Other statements</Comment><br/>
<dsNormal></dsNormal><br/>
<Brackets1>(</Brackets1><Type Statements>user</Type Statements><Normal Text> user</Normal Text><Brackets1>)</Brackets1><Normal Text> </Normal Text><Comment>; Declare identifier 'user' of user type</Comment><br/>
<Brackets1>(</Brackets1><Type Statements>role</Type Statements><Normal Text> role</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Type Statements>type</Type Statements><Normal Text> type</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Access Keys>allow</Access Keys><Normal Text> allow</Normal Text><Brackets1>)</Brackets1><Normal Text> </Normal Text><Brackets1>(</Brackets1><Booleans>true</Booleans><Normal Text> </Normal Text><Booleans>true</Booleans><Brackets1>)</Brackets1><Normal Text> </Normal Text><Brackets1>(</Brackets1><Statements>in</Statements><Normal Text> in</Normal Text><Brackets1>)</Brackets1><Normal Text> </Normal Text><Brackets1>(</Brackets1><Expression Keys>xor</Expression Keys><Normal Text> xor</Normal Text><Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Comment>; List of permissions</Comment><br/>
<Brackets1>(</Brackets1><Type Statements>class</Type Statements><Normal Text> security </Normal Text><Brackets2>(</Brackets2><Permissions>compute_av</Permissions><Normal Text> </Normal Text><Permissions>compute_create</Permissions><Normal Text> </Normal Text><Permissions>compute_member</Permissions><Normal Text> </Normal Text><Permissions>check_context</Permissions><Normal Text> </Normal Text><Permissions>load_policy</Permissions><Normal Text> </Normal Text><Permissions>compute_relabel</Permissions><Normal Text> </Normal Text><Permissions>compute_user</Permissions><Normal Text> </Normal Text><Permissions>setenforce</Permissions><Normal Text> </Normal Text><Permissions>setbool</Permissions><Normal Text> </Normal Text><Permissions>setsecparam</Permissions><Normal Text> </Normal Text><Permissions>setcheckreqprot</Permissions><Normal Text> </Normal Text><Permissions>read_policy</Permissions><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Comment>; Highlighting permissions only if there is not a statement keyword</Comment><br/>
<Brackets1>(</Brackets1><Type Statements>class</Type Statements><Normal Text> binder </Normal Text><Brackets2>(</Brackets2><Permissions>impersonate</Permissions><Normal Text> </Normal Text><Permissions>call</Permissions><Normal Text> </Normal Text><Permissions>set_context_mgr</Permissions><Normal Text> </Normal Text><Permissions>transfer</Permissions><Normal Text> </Normal Text><Permissions>receive</Permissions><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Type Statements>class</Type Statements><Normal Text> binder </Normal Text><Brackets2>(</Brackets2><Statements>classcommon</Statements><Normal Text> impersonate call set_context_mgr transfer receive</Normal Text><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Permissions>impersonate</Permissions><Normal Text> </Normal Text><Permissions>call</Permissions><Normal Text> </Normal Text><Permissions>set_context_mgr</Permissions><Normal Text> </Normal Text><Permissions>transfer</Permissions><Normal Text> </Normal Text><Permissions>receive</Permissions><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>tunableif</Statements><Normal Text> impersonate call set_context_mgr transfer receive</Normal Text><Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Comment>; This is allowed by the CIL compiler</Comment><br/>
<Brackets1>(</Brackets1><Normal Text> </Normal Text><Type Statements>typeattribute</Type Statements><Comment>;comment</Comment><br/>
<Normal Text>	all_fs_type_except_usermodehelper_and_proc_security</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Comment>;comment</Comment><br/>
<Normal Text>	</Normal Text><Type Statements>typeattribute</Type Statements><Normal Text> all_fs_type_except_usermodehelper_and_proc_security</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Normal Text>  </Normal Text><Comment>;comment</Comment><br/>
<Normal Text> </Normal Text><Comment>;more comments</Comment><br/>
<Normal Text>	</Normal Text><Type Statements>typeattribute</Type Statements><Normal Text> all_fs_type_except_usermodehelper_and_proc_security</Normal Text><Brackets1>)</Brackets1><br/>
<Normal Text>	</Normal Text><br/>
<Comment>; Paths</Comment><br/>
<Brackets1>(</Brackets1><Booleans>true</Booleans><Normal Text> </Normal Text><Booleans>true</Booleans><Normal Text> </Normal Text><Path>/true</Path><Normal Text> </Normal Text><Booleans>true</Booleans><Normal Text> </Normal Text><Path>/true/true/</Path><Normal Text> </Normal Text><Booleans>true</Booleans><Normal Text> </Normal Text><Booleans>true</Booleans><Path>/true</Path><Normal Text> </Normal Text><Text Quoted>"true"</Text Quoted><Brackets1>)</Brackets1><br/>
<Comment>; Global namespace</Comment><br/>
<Brackets1>(</Brackets1><Booleans>true</Booleans><Normal Text> </Normal Text><Booleans>true</Booleans><Normal Text> .true </Normal Text><Booleans>true</Booleans><Normal Text> true.true </Normal Text><Booleans>true</Booleans><Normal Text> .true.true true.true.true</Normal Text><br/>
<Normal Text>	.</Normal Text><Booleans>true</Booleans><Normal Text>. </Normal Text><Booleans>true</Booleans><Normal Text>. </Normal Text><Booleans>true</Booleans><Normal Text>.</Normal Text><Booleans>true</Booleans><Normal Text>. </Normal Text><Comment>; invalid</Comment><br/>
<Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Comment>; Keywords in some rules</Comment><br/>
<dsNormal></dsNormal><br/>
<Comment>; filecon</Comment><br/>
<Brackets1>(</Brackets1><Statements>filecon</Statements><Normal Text> </Normal Text><Text Quoted>"/system/bin/run-as"</Text Quoted><Normal Text> </Normal Text><Types>file</Types><Normal Text> runas_exec_context</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>filecon</Statements><Normal Text> </Normal Text><Text Quoted>"/dev/socket/wpa_wlan</Text Quoted><Pattern Brackets>[0</Pattern Brackets><Special Char 2>-</Special Char 2><Pattern Brackets>9]</Pattern Brackets><Text Quoted>"</Text Quoted><Normal Text> </Normal Text><Types>any</Types><Normal Text> </Normal Text><File Contexts>u:object_r:wpa.socket:s0-s0</File Contexts><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>filecon</Statements><Normal Text> </Normal Text><Text Quoted>"/data/local/mine"</Text Quoted><Normal Text> </Normal Text><Types>dir</Types><Normal Text> </Normal Text><Brackets2>()</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>classcommon</Statements><Normal Text> file any dir</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Normal Text>file any dir</Normal Text><Brackets1>)</Brackets1><br/>
<Comment>; portcon</Comment><br/>
<Brackets1>(</Brackets1><Statements>portcon</Statements><Normal Text> </Normal Text><Types>tcp</Types><Normal Text> </Normal Text><Number>3333</Number><Normal Text> </Normal Text><Brackets2>(</Brackets2><Normal Text>unconfined.user </Normal Text><Other Keywords>object_r</Other Keywords><Normal Text> unconfined.object levelrange_1</Normal Text><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>portcon</Statements><Normal Text> </Normal Text><Types>udp</Types><Normal Text> </Normal Text><Number>4444</Number><Normal Text> </Normal Text><Brackets2>(</Brackets2><Normal Text>unconfined.user </Normal Text><Other Keywords>object_r</Other Keywords><Normal Text> unconfined.object </Normal Text><Brackets3>(</Brackets3><Brackets4>(</Brackets4><Normal Text>s0</Normal Text><Brackets4>)</Brackets4><Normal Text> level_2</Normal Text><Brackets3>)</Brackets3><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>defaultrole</Statements><Normal Text> tcp udp</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Normal Text>tcp udp</Normal Text><Brackets1>)</Brackets1><br/>
<Comment>; fsuse</Comment><br/>
<Brackets1>(</Brackets1><Statements>fsuse</Statements><Normal Text> </Normal Text><Types>xattr</Types><Normal Text> </Normal Text><Other Keywords>ext4</Other Keywords><Normal Text> file.labeledfs_context</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>fsuse</Statements><Normal Text> </Normal Text><Types>task</Types><Normal Text> </Normal Text><Other Keywords>pipefs</Other Keywords><Normal Text> file.pipefs_context</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>fsuse</Statements><Normal Text> </Normal Text><Types>trans</Types><Normal Text> </Normal Text><Other Keywords>tmpfs</Other Keywords><Normal Text> file.tmpfs_context</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>typemember</Statements><Normal Text> xattr task trans</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Normal Text>xattr task trans</Normal Text><Brackets1>)</Brackets1><br/>
<Normal Text>	</Normal Text><br/>
<Brackets1>(</Brackets1><Access Keys>allow</Access Keys><Normal Text> unconfined.process </Normal Text><Special Keys>self</Special Keys><Normal Text> </Normal Text><Brackets2>(</Brackets2><Normal Text>file </Normal Text><Brackets3>(</Brackets3><Permissions>read</Permissions><Normal Text> </Normal Text><Permissions>write</Permissions><Brackets3>)</Brackets3><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Access Keys>allow</Access Keys><Normal Text> process httpd.object </Normal Text><Brackets2>(</Brackets2><Normal Text>file </Normal Text><Brackets3>(</Brackets3><Permissions>read</Permissions><Normal Text> </Normal Text><Permissions>write</Permissions><Brackets3>)</Brackets3><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Comment>; Paths</Comment><br/>
<Text Quoted>"/system/</Text Quoted><Pattern Brackets>(foo</Pattern Brackets><Special Char 2>|</Special Char 2><Pattern Brackets>bar)</Pattern Brackets><Text Quoted>/</Text Quoted><Pattern Brackets>[</Pattern Brackets><Special Char 2>^</Special Char 2><Pattern Brackets>/]</Pattern Brackets><Special Char>*</Special Char><Text Quoted>/</Text Quoted><Pattern Brackets>(hi){2,6}(</Pattern Brackets><Special Char>.*</Special Char><Pattern Brackets>)</Pattern Brackets><Special Char>?</Special Char><Text Quoted>"</Text Quoted><br/>
<Text Quoted>"/pa</Text Quoted><Escape Expression>\12</Escape Expression><Text Quoted>th</Text Quoted><Special Char>.*</Special Char><Text Quoted>a</Text Quoted><Special Char>+</Special Char><Text Quoted>b</Text Quoted><Special Char>?</Special Char><Text Quoted>"</Text Quoted><br/>
<Path>/usr/hi</Path><Escape Expression>\"</Escape Expression><Path>esc</Path><Escape Expression>\032</Escape Expression><Path>esc</Path><Escape Expression>\*</Escape Expression><Path>3es</Path><Pattern Brackets>{2,2}</Pattern Brackets><Path>ds</Path><br/>
<Text Quoted>"/data/</Text Quoted><Pattern Brackets>(ope</Pattern Brackets><Open Pattern Brackets>n</Open Pattern Brackets><Text Quoted> "</Text Quoted><br/>
<Text Quoted>"/data/</Text Quoted><Pattern Brackets>[ope</Pattern Brackets><Open Pattern Brackets>n</Open Pattern Brackets><Text Quoted> "</Text Quoted><br/>
<dsNormal></dsNormal><br/>
<dsNormal></dsNormal><br/>
<Comment>; Some rules</Comment><br/>
<dsNormal></dsNormal><br/>
<Brackets1>(</Brackets1><Statements>call</Statements><Normal Text> macro1</Normal Text><Brackets2>(</Brackets2><Text Quoted>"__kmsg__"</Text Quoted><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Type Statements>macro</Type Statements><Normal Text> macro1 </Normal Text><Brackets2>(</Brackets2><Brackets3>(</Brackets3><Type Name>string</Type Name><Normal Text> ARG1</Normal Text><Brackets3>)</Brackets3><Brackets2>)</Brackets2><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Statements>typetransition</Statements><Normal Text> audit.process device.device chr_file ARG1 device.klog_device</Normal Text><Brackets2>)</Brackets2><br/>
<Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Brackets1>(</Brackets1><Access Keys>allow</Access Keys><Normal Text> unconfined.process </Normal Text><Special Keys>self</Special Keys><Normal Text> </Normal Text><Brackets2>(</Brackets2><Normal Text>file </Normal Text><Brackets3>(</Brackets3><Permissions>read</Permissions><Normal Text> </Normal Text><Permissions>write</Permissions><Brackets3>)</Brackets3><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Access Keys>auditallow</Access Keys><Normal Text> release_app.process secmark_demo.browser_packet </Normal Text><Brackets2>(</Brackets2><Normal Text>packet </Normal Text><Brackets3>(</Brackets3><Permissions>send</Permissions><Normal Text> </Normal Text><Permissions>recv</Permissions><Brackets3>)</Brackets3><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Access Keys>allowx</Access Keys><Normal Text> type_1 type_2 </Normal Text><Brackets2>(</Brackets2><Type Name>ioctl</Type Name><Normal Text> tcp_socket </Normal Text><Brackets3>(</Brackets3><Expression Keys>range</Expression Keys><Normal Text> </Normal Text><Hex>0x2000</Hex><Normal Text> </Normal Text><Hex>0x20FF</Hex><Brackets3>)</Brackets3><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>permissionx</Statements><Normal Text> ioctl_nodebug </Normal Text><Brackets2>(</Brackets2><Type Name>ioctl</Type Name><Normal Text> udp_socket </Normal Text><Brackets3>(</Brackets3><Expression Keys>not</Expression Keys><Normal Text> </Normal Text><Brackets4>(</Brackets4><Expression Keys>range</Expression Keys><Normal Text> </Normal Text><Hex>0x4000</Hex><Normal Text> </Normal Text><Hex>0x4010</Hex><Brackets4>)</Brackets4><Brackets3>)</Brackets3><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Access Keys>allowx</Access Keys><Normal Text> type_3 type_4 ioctl_nodebug</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Access Keys>dontauditx</Access Keys><Normal Text> type_1 type_2 </Normal Text><Brackets2>(</Brackets2><Type Name>ioctl</Type Name><Normal Text> tcp_socket </Normal Text><Brackets3>(</Brackets3><Expression Keys>range</Expression Keys><Normal Text> </Normal Text><Hex>0x3000</Hex><Normal Text> </Normal Text><Hex>0x30FF</Hex><Brackets3>)</Brackets3><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Brackets1>(</Brackets1><Type Statements>class</Type Statements><Normal Text> property_service </Normal Text><Brackets2>(</Brackets2><Normal Text>set</Normal Text><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Type Statements>block</Type Statements><Normal Text> av_rules</Normal Text><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Type Statements>type</Type Statements><Normal Text> type_1</Normal Text><Brackets2>)</Brackets2><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Type Statements>type</Type Statements><Normal Text> type_2</Normal Text><Brackets2>)</Brackets2><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Type Statements>typeattribute</Type Statements><Normal Text> all_types</Normal Text><Brackets2>)</Brackets2><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Statements>typeattributeset</Statements><Normal Text> all_types </Normal Text><Brackets3>(</Brackets3><Brackets4>(</Brackets4><Expression Keys>all</Expression Keys><Brackets4>)</Brackets4><Brackets3>)</Brackets3><Brackets2>)</Brackets2><br/>
<dsNormal></dsNormal><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Access Keys>neverallow</Access Keys><Normal Text> type_2 all_types </Normal Text><Brackets3>(</Brackets3><Normal Text>property_service </Normal Text><Brackets4>(</Brackets4><Normal Text>set</Normal Text><Brackets4>)</Brackets4><Brackets3>)</Brackets3><Brackets2>)</Brackets2><br/>
<Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Type Statements>macro</Type Statements><Normal Text> binder_call </Normal Text><Brackets2>(</Brackets2><Brackets3>(</Brackets3><Type Statements>type</Type Statements><Normal Text> ARG1</Normal Text><Brackets3>)</Brackets3><Normal Text> </Normal Text><Brackets3>(</Brackets3><Type Statements>type</Type Statements><Normal Text> ARG2</Normal Text><Brackets3>)</Brackets3><Brackets2>)</Brackets2><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Access Keys>allow</Access Keys><Normal Text> ARG1 ARG2 </Normal Text><Brackets3>(</Brackets3><Normal Text>binder </Normal Text><Brackets4>(</Brackets4><Permissions>transfer</Permissions><Normal Text> </Normal Text><Permissions>call</Permissions><Brackets4>)</Brackets4><Brackets3>)</Brackets3><Brackets2>)</Brackets2><br/>
<Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Type Statements>ipaddr</Type Statements><Normal Text> netmask_1 </Normal Text><IP Address>255.255.255.0</IP Address><Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Brackets1>(</Brackets1><Type Statements>class</Type Statements><Normal Text> dir</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Type Statements>class</Type Statements><Normal Text> foo</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Type Statements>class</Type Statements><Normal Text> bar</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Type Statements>class</Type Statements><Normal Text> baz</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>classorder</Statements><Normal Text> </Normal Text><Brackets2>(</Brackets2><Normal Text>dir foo</Normal Text><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>classorder</Statements><Normal Text> </Normal Text><Brackets2>(</Brackets2><Type Name>unordered</Type Name><Normal Text> bar foo baz</Normal Text><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Brackets1>(</Brackets1><Type Statements>classpermission</Type Statements><Normal Text> zygote_2</Normal Text><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>classpermissionset</Statements><Normal Text> zygote_2 </Normal Text><Brackets2>(</Brackets2><Normal Text>zygote</Normal Text><br/>
<Normal Text>    </Normal Text><Brackets3>(</Brackets3><Expression Keys>and</Expression Keys><br/>
<Normal Text>        </Normal Text><Brackets4>(</Brackets4><Expression Keys>all</Expression Keys><Brackets4>)</Brackets4><br/>
<Normal Text>        </Normal Text><Brackets4>(</Brackets4><Expression Keys>not</Expression Keys><Normal Text> </Normal Text><Brackets5>(</Brackets5><Normal Text>specifyinvokewith specifyseinfo</Normal Text><Brackets5>)</Brackets5><Brackets4>)</Brackets4><br/>
<Normal Text>    </Normal Text><Brackets3>)</Brackets3><br/>
<Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Brackets1>(</Brackets1><Statements>permissionx</Statements><Normal Text> ioctl_3 </Normal Text><Brackets2>(</Brackets2><Type Name>ioctl</Type Name><Normal Text> tcp_socket </Normal Text><Brackets3>(</Brackets3><Expression Keys>and</Expression Keys><Normal Text> </Normal Text><Brackets4>(</Brackets4><Expression Keys>range</Expression Keys><Normal Text> </Normal Text><Hex>0x8000</Hex><Normal Text> </Normal Text><Hex>0x90FF</Hex><Brackets4>)</Brackets4><Normal Text> </Normal Text><Brackets4>(</Brackets4><Expression Keys>not</Expression Keys><Normal Text> </Normal Text><Brackets5>(</Brackets5><Expression Keys>range</Expression Keys><Normal Text> </Normal Text><Hex>0x8100</Hex><Normal Text> </Normal Text><Hex>0x82FF</Hex><Brackets5>)</Brackets5><Brackets4>)</Brackets4><Brackets3>)</Brackets3><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Type Statements>boolean</Type Statements><Normal Text> disableAudioCapture </Normal Text><Booleans>false</Booleans><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>booleanif</Statements><Normal Text> </Normal Text><Brackets2>(</Brackets2><Expression Keys>and</Expression Keys><Normal Text> </Normal Text><Brackets3>(</Brackets3><Expression Keys>not</Expression Keys><Normal Text> disableAudio</Normal Text><Brackets3>)</Brackets3><Normal Text> </Normal Text><Brackets3>(</Brackets3><Expression Keys>not</Expression Keys><Normal Text> disableAudioCapture</Normal Text><Brackets3>)</Brackets3><Brackets2>)</Brackets2><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Booleans>true</Booleans><br/>
<Normal Text>        </Normal Text><Brackets3>(</Brackets3><Access Keys>allow</Access Keys><Normal Text> process mediaserver.audio_capture_device </Normal Text><Brackets4>(</Brackets4><Normal Text>chr_file_set </Normal Text><Brackets5>(</Brackets5><Normal Text>rw_file_perms</Normal Text><Brackets5>)</Brackets5><Brackets4>)</Brackets4><Brackets3>)</Brackets3><br/>
<Normal Text>    </Normal Text><Brackets2>)</Brackets2><br/>
<Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Type Statements>tunable</Type Statements><Normal Text> range_trans_rule </Normal Text><Booleans>false</Booleans><Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Brackets1>(</Brackets1><Type Statements>block</Type Statements><Normal Text> init</Normal Text><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Type Statements>class</Type Statements><Normal Text> process </Normal Text><Brackets3>(</Brackets3><Normal Text>process</Normal Text><Brackets3>)</Brackets3><Brackets2>)</Brackets2><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Type Statements>type</Type Statements><Normal Text> process</Normal Text><Brackets2>)</Brackets2><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Statements>tunableif</Statements><Normal Text> range_trans_rule</Normal Text><br/>
<Normal Text>        </Normal Text><Brackets3>(</Brackets3><Booleans>true</Booleans><br/>
<Normal Text>            </Normal Text><Brackets4>(</Brackets4><Statements>rangetransition</Statements><Normal Text> process sshd.exec process low_high</Normal Text><Brackets4>)</Brackets4><Brackets3>)</Brackets3><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Brackets1>(</Brackets1><Statements>validatetrans</Statements><Normal Text> file </Normal Text><Brackets2>(</Brackets2><Expression Keys>eq</Expression Keys><Normal Text> </Normal Text><Other Keywords>t1</Other Keywords><Normal Text> unconfined.process</Normal Text><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Type Statements>block</Type Statements><Normal Text> ext_gateway</Normal Text><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Type Statements>optional</Type Statements><Normal Text> move_file</Normal Text><br/>
<Normal Text>        </Normal Text><Brackets3>(</Brackets3><Statements>typetransition</Statements><Normal Text> process msg_filter.move_file.in_queue file msg_filter.move_file.in_file</Normal Text><Brackets3>)</Brackets3><br/>
<Normal Text>        </Normal Text><Brackets3>(</Brackets3><Access Keys>allow</Access Keys><Normal Text> process msg_filter.move_file.in_queue </Normal Text><Brackets4>(</Brackets4><Normal Text>dir </Normal Text><Brackets5>(</Brackets5><Permissions>read</Permissions><Normal Text> </Normal Text><Permissions>getattr</Permissions><Normal Text> </Normal Text><Permissions>write</Permissions><Normal Text> </Normal Text><Permissions>search</Permissions><Normal Text> </Normal Text><Permissions>add_name</Permissions><Brackets5>)</Brackets5><Brackets4>)</Brackets4><Brackets3>)</Brackets3><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Brackets1>(</Brackets1><Type Statements>context</Type Statements><Normal Text> runas_exec_context </Normal Text><Brackets2>(</Brackets2><Normal Text>u </Normal Text><Other Keywords>object_r</Other Keywords><Normal Text> exec low_low</Normal Text><Brackets2>)</Brackets2><Brackets1>)</Brackets1><br/>
<Brackets1>(</Brackets1><Statements>filecon</Statements><Normal Text> </Normal Text><Text Quoted>"/system/bin/run-as"</Text Quoted><Normal Text> </Normal Text><Types>file</Types><Normal Text> runas_exec_context</Normal Text><Brackets1>)</Brackets1><br/>
<dsNormal></dsNormal><br/>
<Brackets1>(</Brackets1><Statements>in</Statements><Normal Text> file</Normal Text><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Statements>genfscon</Statements><Normal Text> </Normal Text><Other Keywords>rootfs</Other Keywords><Normal Text> </Normal Text><Path>/</Path><Normal Text> rootfs_context</Normal Text><Brackets2>)</Brackets2><br/>
<Normal Text>    </Normal Text><Brackets2>(</Brackets2><Statements>genfscon</Statements><Normal Text> </Normal Text><Other Keywords>selinuxfs</Other Keywords><Normal Text> </Normal Text><Path>/</Path><Normal Text> selinuxfs_context</Normal Text><Brackets2>)</Brackets2><br/>
<Brackets1>)</Brackets1><br/>
