setrans.conf(5)

🌸 setrans.conf — the translation glow-up file 💅

okay bestie, pull up a chair, because this is setrans.conf(5) and it's literally the vibe-translator for your SELinux labels ✨

💖 NAME 💖

setrans.conf — the translation configuration file for MCS/MLS SELinux systems 🎀

🌈 DESCRIPTION 🌈

So the tea is this: the /etc/selinux/{SELINUXTYPE}/setrans.conf config file is the one that decides how SELinux MCS/MLS labels get translated into human readable form by the mcstransd daemon. Like, it takes the crunchy machine speak and turns it into something a real human can read. main character behavior fr fr 👑

And the default policies? They come pre-loaded with:

• 16 sensitivity levels — that's s0 through s15
• 1024 categories — that's c0 through c1023

Multiple categories can be separated with commas — c0,c1,c3,c5 — and a range of categories can be shortened using dot notation, like c0.c3,c5. no cap, that's the shortcut of the century 🦋

✨ Keywords ✨

• Base — once a base is declared, every sensitivity label definition that comes after it gets all the modifiers applied to them during translation. But the sensitivity labels defined before the base declaration are immediately cached and no modifiers will be applied — those are used as direct translations. so like, order matters, bestie 😭
• Default — defines the category bit range that will be used for inverse bits.
• Domain — creates a new domain with the supplied name.
• Include — read and process the contents of the specified configuration file.
• Join — defines a character used to separate members of a modifier group when more than one is specified (ex. USA/AUS).
• ModifierGroup — a means of grouping category bit definitions by how they modify the sensitivity label.
• Prefix — word(s) that may proceed member(s) of a modifier group (ex. REL USA).
• Suffix — word(s) that may follow member(s) of a modifier group (ex. USA EYES ONLY).
• Whitespace — defines the set of acceptable white space characters that may be used in label being translated.

🎀 Sensitivity Level Definition Examples 🎀

• s0=SystemLow — defines a translation of s0 (the lowest sensitivity level) with no categories to SystemLow.
• s15:c0.c1023=SystemHigh — defines a translation of s15:c0.c1023 to SystemHigh. c0.c1023 is shorthand for all categories. A colon separates the sensitivity level and categories.
• s0-s15:c0.c1023=SystemLow-SystemHigh — defines a range translation of s0-s15:c0.c1023 to SystemLow-SystemHigh. The two range components are separated by a dash.
• s0:c0=PatientRecord — defines a translation of sensitivity s0 with category c0 to PatientRecord.
• s0:c1=Accounting — defines a translation of sensitivity s0 with category c1 to Accounting.
• s2:c1,c2,c3=Confidential3Categories
• s2:c1.c3=Confidential3Categories

both define a translation of sensitivity s2 with categories c1, c2 and c3 to Confidential3Categories. same energy, two spellings 💜

• s5=TopSecret — defines a translation of sensitivity s5 with no categories to TopSecret.

🧚 Constraint Examples 🧚

• c0!c1 — if category bits 0 and 1 are both set, the constraint will fail and the original context will be returned.
• c5.c9>c1 — if category bits 5 through 9 are set, bit 1 must also be set or the constraint will fail and the original context will be returned.
• s1!c5,c9 — if category bits 5 and 9 are set and the sensitivity level is s1, the constraint will fail and the original context will be returned.

fr fr, when a constraint fails, you get the original context back. no translation for you, bestie 🙈

👑 AUTHOR 👑

• Written by Joe Nall <joe@nall.com>.
• Updated by Ted X. Toth <txtoth@gmail.com>.

🔥 SEE ALSO 🔥

selinux(8), mcs(8), mls(8), chcon(1)

🍓 FILES 🍓

/etc/selinux/{SELINUXTYPE}/setrans.conf
/usr/share/mcstrans/examples

and that's the whole page, periodt 💅 this lil doc came from txtoth@gmail.com and it's dated 13 July 2010 — yeah it's old but it's iconic, and it's living under the setrans.conf(5) manual name. mwah 🫶💖