query {sid : <Sid>}
It is intended to be used as an expression that verifies fulfillment of the conditions in the choice construct (for details on the choice construct, see "Binding methods of security models to security events"). It checks the state of the finite-state machine associated with the sid resource. Depending on the results of this check, various options for security event handling can be performed.
It runs incorrectly in the following cases:
sid resource is not associated with a finite-state machine of the Flow security model object being used.sid value is outside of the permissible range.When the expression runs incorrectly, the Kaspersky Security Module returns the "denied" decision.
Example:
/* Any client in the solution is allowed to query
* a server of the ResourceDriver class if the finite-state machine
* associated with this server is in the
* "started" or "stopped" state. Otherwise any client in the solution
* is prohibited from querying a server of the ResourceDriver class. */
request dst=ResourceDriver {
choice (service_flow.query {sid : dst_sid}) {
"started" : grant ()
"stopped" : grant ()
_ : deny ()
}
}
Page top