The policy statement (<alias-policy-entry>)

The policy statement lets you define a new alias for a policy with a defined configuration. You can define aliases for the same policy with different configurations. Aliases are top-level declarations; they are visible within the entire configuration file.

You can redefine the configuration of an alias in the following ways:

• When describing rules for applying security policies during entity configuration.
• When creating a new alias based on a previously declared alias.

The new configuration is based on the configuration of the parent alias according to the following rules:

• Dictionaries (JSON objects) are merged. If two keys match, the values are processed recursively, and a key: value pair is added for each new key.
• Other configuration elements (such as arrays) are overwritten.

Examples of redefining a configuration are shown below.

Syntax

<alias-policy-entry> ::= "policy" <alias-policy-name> "="

<related-policy> [<configuration>] ";"

<related-policy> ::= <alias-policy-name>

| <family-instance-name> "." <policy-name>

Elements

<alias-policy-name>	Alias of the configured instance of the security policy.
<related-policy>	Link to a policy or to another alias for which a new alias is declared.
<family-instance-name>	Name of the family instance.
<policy-name>	Name of the policy.
<configuration>	JSON configuration of the policy instance. The configuration is processed by the parser specified in the parser statement when the policy family is declared. To make the JSON expression more compact, quotation marks can be omitted wherever this will not lead to ambiguity.

Example

policy tl_action = tl_instance.control [action];

/* tl_stop is equivalent to tl_stop_ because the configuration

of a policy consists of an array that will be overwritten. */

policy tl_stop = tl_instance.control [stop];

policy tl_stop_ = tl_action [stop];

/* The alias "initApp" is used to define the type

of app by default. The aliases "initReadOnly" and

"initRW" additionally define access rights. */

policy initApp = ocap_instance.initR {type: Application};

policy initReadOnly = initApp {rights: [Read]};

policy initRW = initApp {rights: [Read,Write]};

/* Create an alias for the file system by redefining

the type of capability in the "initRW" alias configuration. */

policy initFS = initRW {type: FS};

Page top