The entity statement (<entity-entry>)

The entity statement is intended for performing the following actions:

• Sending a message about an existing entity to a Kaspersky Security System subsystem
• Defining rules for how events involving an entity are bound to policies
• Specifying an audit profile applied for defining binding rules

Syntax

<entity-entry>

::= "entity" <entity-name> "{" <entity-body> "}"

| "entity" <entity-name> ";"

<entity-body> ::= [<active-audit-entry>]

{<rule>}

<rule> ::= <policy-binding>

| <match-for-entity>

<policy-binding> ::= <execute-policy-binding>

| <instance-policy-binding>

| <iface-method-policy-binding>

| <security-policy-binding>

<match-for-entity>

::= <match-operation> <entity-side> [<match-attrs>] "{"

<match-body>

"}"

<entity-side> ::= <call-side> "=" <entity-self>

Elements

<entity-name>	Unique identifier of the entity (EID). This must match the name of the entity in the EDL file.
<entity-body>	Body of the statement containing entity configuration rules.
<policy-binding>	Statement for binding an event involving an entity to security policies.
<execute-policy-binding>	The execute call statement is intended for binding policies to an entity start variant.
<instance-policy-binding>	The call statement is for configuring invocation of the method instance. The call statement lets you configure the request-message delivery and response-message forwarding events when the specified server-entity method instance is called.
<iface-method-policy-binding>	The send and receive statements are for configuring method call events for the specified interface. The send statement lets you configure message forwarding events when all method instances for the specified interface are called. The receive statement lets you configure events for delivery of these messages.
<security-policy-binding>	The security statement is for configuring the event when an entity queries Kaspersky Security System via the security interface.

Example

entity core {

execute call main = grant;

execute call foo = deny;

// Security-interface call event handlers.

security call a_restart = fl0_restart, fl1_restart;

security call a_enter_process0 = fl0_enter_process;

security call a_base =

choice ( fl0_state ) {

"init" : grant;

"process": deny;

_ : deny;

};

receive in core.xchange.x1 = grant

}

In this section The execute call statement (<execute-policy-binding>) The call statement (<instance-policy-binding>) The send and receive statements (<iface-method-policy-binding>) The security statement (<security-policy-binding>)

Page top