setrans.conf - translation configuration file for MCS/MLS SELinux systems
configuration file specifies
the way that SELinux MCS/MLS labels are translated into human readable form by
the mcstransd daemon. The default policies support 16 sensitivity levels (s0
through s15) and 1024 categories (c0 through c1023). Multiple categories can
be separated with commas (c0,c1,c3,c5) and a range of categories can be
shortened using dot notation (c0.c3,c5).
- once a base is declared, subsequent sensitivity label
definitions will have all modifiers applied to them during translation.
Sensitivity labels defined before the base declaration are immediately
cached and no modifiers will be applied these are used as direct
- defines the category bit range that will be used for
- creates a new domain with the supplied name.
- read and process the contents of the specified
- defines a character used to separate members of a modifier
group when more than one is specified (ex. USA/AUS).
- a means of grouping category bit definitions by how they
modify the sensitivity label.
- word(s) that may proceed member(s) of a modifier group (ex.
- word(s) that may follow member(s) of a modifier group (ex.
USA EYES ONLY).
- defines the set of acceptable white space characters that
may be used in label being translated.
- defines a translation of s0 (the lowest sensitivity level)
with no categories to SystemLow.
- defines a translation of s15:c0.c1023 to SystemHigh.
c0.c1023 is shorthand for all categories. A colon separates the
sensitivity level and categories.
- defines a range translation of of s0-s15:c0.c1023 to
SystemLow-SystemHigh. The two range components are separated by a dash.
- defines a translation of sensitivity s0 with category c0 to
- defines a translation of sensitivity s0 with category c1 to
- both define a translation of sensitivity s2 with categories
c1, c2 and c3 to Confidential3Categories.
- defines a translation of sensitivity s5 with no categories
- if category bits 0 and 1 are both set, the constraint will
fail and the original context will be returned.
- if category bits 5 through 9 are set, bit 1 must also be
set or the constraint will fail and the original context will be returned.
- if category bits 5 and 9 are set and the sensitivity level
is s1, the constraint will fail and the original context will be returned.
Written by Joe Nall <firstname.lastname@example.org>.
Updated by Ted X. Toth <email@example.com>.
selinux(8), mcs(8), mls(8), chcon(1)