<!-- Common Interface Language (CIL) Reference Guide -->
              <!-- class_and_permission_statements.xml -->

   <sect1>
      <title>Class and Permission Statements</title>
      <sect2 id="common">
         <title>common</title>
         <para>Declares a common identifier in the current namespace with a set of common permissions that can be used by one or more <literal><link linkend="class">class</link></literal> identifiers. The <literal><link linkend="classcommon">classcommon</link></literal> statement is used to associate a <literal><link linkend="common">common</link></literal> identifier to a specific <literal><link linkend="class">class</link></literal> identifier.</para>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(common common_id (permission_id ...))]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal><link linkend="common">common</link></literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="common">common</link></literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>common_id</literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="common">common</link></literal> identifier.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>permission_id</literal></para>
                  </entry>
                  <entry>
                     <para>One or more permissions.</para>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>

         <para><emphasis role="bold">Example:</emphasis></para>
         <para>This common statement will associate the <literal><link linkend="common">common</link></literal> identifier '<literal>file</literal>' with the list of permissions:</para>
         <programlisting><![CDATA[
(common file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton))]]>
         </programlisting>
      </sect2>

      <sect2 id="classcommon">
         <title>classcommon</title>
         <para>Associate a <literal><link linkend="class">class</link></literal> identifier to a one or more permissions declared by a <literal><link linkend="common">common</link></literal> identifier.</para>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(classcommon class_id common_id)]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal><link linkend="classcommon">classcommon</link></literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="classcommon">classcommon</link></literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>class_id</literal></para>
                  </entry>
                  <entry>
                     <para>A single previously declared <literal><link linkend="class">class</link></literal> identifier.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>common_id</literal></para>
                  </entry>
                  <entry>
                     <para>A single previously declared <literal><link linkend="common">common</link></literal> identifier that defines the common permissions for that class.</para>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>
         <para><emphasis role="bold">Example:</emphasis></para>
         <para>This associates the <literal>dir</literal> class with the list of permissions declared by the <literal>file common</literal> identifier:</para>
         <programlisting><![CDATA[
(common file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton))

(classcommon dir file)]]>
         </programlisting>
      </sect2>

      <sect2 id="class">
         <title>class</title>
         <para>Declares a class and zero or more permissions in the current namespace.</para>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(class class_id (permission_id ...))]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal><link linkend="class">class</link></literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="class">class</link></literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>class_id</literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="class">class</link></literal> identifier.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>permission_id</literal></para>
                  </entry>
                  <entry>
                     <para>Zero or more permissions declared for the class. Note that if zero permissions, an empty list is required as shown in the example.</para>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>

         <para><emphasis role="bold">Examples:</emphasis></para>
         <para>This example defines a set of permissions for the <literal>binder</literal> class indentifier:</para>
         <programlisting><![CDATA[(class binder (impersonate call set_context_mgr transfer receive))]]>
         </programlisting>

         <para>This example defines a common set of permissions to be used by the <literal>sem</literal> class, the <literal>(class sem ())</literal> does not define any other permissions (i.e. an empty list):</para>
         <programlisting><![CDATA[
(common ipc (create destroy getattr setattr read write associate unix_read unix_write))

(classcommon sem ipc)
(class sem ())]]>
         </programlisting>
         <simpara>and will produce the following set of permissions for the <literal>sem</literal> class identifier of:</simpara>
         <programlisting><![CDATA[(class sem (create destroy getattr setattr read write associate unix_read unix_write))]]>
         </programlisting>

         <para>This example, with the following combination of the <literal><link linkend="common">common</link></literal>, <literal><link linkend="classcommon">classcommon</link></literal> and <literal><link linkend="class">class</link></literal> statements:</para>
         <programlisting><![CDATA[
(common file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton))

(classcommon dir file)
(class dir (add_name remove_name reparent search rmdir open audit_access execmod))]]>
         </programlisting>
         <simpara>will produce a set of permissions for the <literal>dir</literal> class identifier of:</simpara>
         <programlisting><![CDATA[(class dir (add_name remove_name reparent search rmdir open audit_access execmod ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton))]]>
         </programlisting>
      </sect2>
      <sect2 id="classorder">
         <title>classorder</title>
         <para>Defines the order of <link linkend="class">class</link>'s. This is a mandatory statement. Multiple <literal>classorder</literal> statements declared in the policy will form an ordered list.</para>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(classorder (class_id ...))]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal>classorder</literal></para>
                  </entry>
                  <entry>
                     <para>The <literal>classorder</literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>class_id</literal></para>
                  </entry>
                  <entry>
                     <para>One or more <literal><link linkend="class">class</link></literal> identifiers.</para>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>

         <para><emphasis role="bold">Example:</emphasis></para>
         <para>This will produce an ordered list of "<literal>file dir process</literal>"</para>
         <programlisting><![CDATA[
(class process)
(class file)
(class dir)
(classorder (file dir))
(classorder (dir process))]]>
      </programlisting>
      </sect2>
     <sect2 id="classpermission">
         <title>classpermission</title>
         <para>Declares a class permission set identifier in the current namespace that can be used by one or more <literal><link linkend="classpermissionset">classpermissionset</link></literal>s to associate one or more classes and permissions to form a named set.</para>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(classpermission classpermissionset_id)]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal><link linkend="classpermission">classpermission</link></literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="classpermission">classpermission</link></literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>classpermissionset_id</literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="classpermissionset">classpermissionset</link></literal> identifier.</para>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>
         <para><emphasis role="bold">Example:</emphasis></para>
         <para>See the <literal><link linkend="classpermissionset">classpermissionset</link></literal> statement for examples.</para>
      </sect2>

      <sect2 id="classpermissionset">
         <title>classpermissionset</title>
         <para>Defines a class permission set identifier in the current namespace that associates a class and one or more permissions to form a named set. Nested expressions may be used to determine the required permissions as shown in the examples. Anonymous <literal>classpermissionset</literal>s may be used in av rules and constraints.</para>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(classpermissionset classpermissionset_id (class_id (permission_id | expr ...)))]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2.25 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal><link linkend="classpermissionset">classpermissionset</link></literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="classpermissionset">classpermissionset</link></literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>classpermissionset_id</literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="classpermissionset">classpermissionset</link></literal> identifier.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>class_id</literal></para>
                  </entry>
                  <entry>
                     <para>A single previously declared <literal><link linkend="class">class</link></literal> identifier.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>permission_id</literal></para>
                  </entry>
                  <entry>
                     <para>Zero or more permissions required by the class.</para>
                     <para>Note that there must be at least one <literal>permission</literal> identifier or <literal>expr</literal> declared).</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>expr</literal></para>
                  </entry>
                  <entry>
                     <para>Zero or more <literal>expr</literal>'s, the valid operators and syntax are:</para>
                     <simpara><literal>    (and (permission_id ...) (permission_id ...))</literal></simpara>
                     <simpara><literal>    (or  (permission_id ...) (permission_id ...))</literal></simpara>
                     <simpara><literal>    (xor (permission_id ...) (permission_id ...))</literal></simpara>
                     <simpara><literal>    (not (permission_id ...))</literal></simpara>
                     <simpara><literal>    (all)</literal></simpara>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>

         <para><emphasis role="bold">Examples:</emphasis></para>
         <para>These class permission set statements will resolve to the permission sets shown in the kernel policy language <literal><link linkend="allow">allow</link></literal> rules:</para>
         <programlisting><![CDATA[
(class zygote (specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo))

(type test_1)
(type test_2)
(type test_3)
(type test_4)
(type test_5)

; NOT
(classpermission zygote_1)
(classpermissionset zygote_1 (zygote
    (not
        (specifyinvokewith specifyseinfo)
    )
))
(allow unconfined.process test_1 zygote_1)
;; allow unconfined.process test_1 : zygote { specifyids specifyrlimits specifycapabilities } ;

; AND - ALL - NOT - Equiv to test_1
(classpermission zygote_2)
(classpermissionset zygote_2 (zygote
    (and
        (all)
        (not (specifyinvokewith specifyseinfo))
    )
))
(allow unconfined.process test_2 zygote_2)
;; allow unconfined.process test_2 : zygote { specifyids specifyrlimits specifycapabilities  } ;

; OR
(classpermission zygote_3)
(classpermissionset zygote_3 (zygote ((or (specifyinvokewith) (specifyseinfo)))))
(allow unconfined.process test_3 zygote_3)
;; allow unconfined.process test_3 : zygote { specifyinvokewith specifyseinfo } ;

; XOR - This will not produce an allow rule as the XOR will remove all the permissions:
(classpermission zygote_4)
(classpermissionset zygote_4 (zygote (xor (specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo) (specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo))))

; ALL
(classpermission zygote_all_perms)
(classpermissionset zygote_all_perms (zygote (all)))
(allow unconfined.process test_5 zygote_all_perms)
;; allow unconfined.process test_5 : zygote { specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo } ;]]>
         </programlisting>
      </sect2>

      <sect2 id="classmap">
         <title>classmap</title>
         <para>Declares a class map identifier in the current namespace and one or more class mapping identifiers. This will allow:</para>
         <orderedlist>
            <listitem><para>Multiple <literal><link linkend="classpermissionset">classpermissionset</link></literal>s to be linked to a pair of <literal><link linkend="classmap">classmap</link></literal> / <literal><link linkend="classmapping">classmapping</link></literal> identifiers.</para></listitem>
            <listitem><para>Multiple <literal><link linkend="class">class</link></literal>s to be associated to statements and rules that support a list of classes:</para>
            <simplelist type="inline">
               <member><literal><link linkend="typetransition">typetransition</link></literal></member>
               <member><literal><link linkend="typechange">typechange</link></literal></member>
               <member><literal><link linkend="typemember">typemember</link></literal></member>
               <member><literal><link linkend="rangetransition">rangetransition</link></literal></member>
               <member><literal><link linkend="roletransition">roletransition</link></literal></member>
               <member><literal><link linkend="defaultuser">defaultuser</link></literal></member>
               <member><literal><link linkend="defaultrole">defaultrole</link></literal></member>
               <member><literal><link linkend="defaulttype">defaulttype</link></literal></member>
               <member><literal><link linkend="defaultrange">defaultrange</link></literal></member>
               <member><literal><link linkend="validatetrans">validatetrans</link></literal></member>
               <member><literal><link linkend="mlsvalidatetrans">mlsvalidatetrans</link></literal></member>
            </simplelist></listitem>
         </orderedlist>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(classmap classmap_id (classmapping_id ...))]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal><link linkend="classmap">classmap</link></literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="classmap">classmap</link></literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>classmap_id</literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="classmap">classmap</link></literal> identifier.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>classmapping_id</literal></para>
                  </entry>
                  <entry>
                     <para>One or more <literal><link linkend="classmapping">classmapping</link></literal> identifiers.</para>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>
         <para><emphasis role="bold">Example:</emphasis></para>
         <para>See the <literal><link linkend="classmapping">classmapping</link></literal> statement for examples.</para>
      </sect2>

      <sect2 id="classmapping">
         <title>classmapping</title>
         <para>Define sets of <literal><link linkend="classpermissionset">classpermissionset</link></literal>s (named or anonymous) to form a consolidated <literal><link linkend="classmapping">classmapping</link></literal> set. Generally there are multiple <literal><link linkend="classmapping">classmapping</link></literal> statements with the same <literal><link linkend="classmap">classmap</link></literal> and <literal><link linkend="classmapping">classmapping</link></literal> identifiers that form a set of different <literal><link linkend="classpermissionset">classpermissionset</link></literal>'s. This is useful when multiple class / permissions are required in rules such as the <literal><link linkend="allow">allow</link></literal> rules (as shown in the examples).</para>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(classmapping classmap_id classmapping_id classpermissionset_id)]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2.25 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal><link linkend="classmapping">classmapping</link></literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="classmapping">classmapping</link></literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>classmap_id</literal></para>
                  </entry>
                  <entry>
                     <para>A single previously declared <literal><link linkend="classmap">classmap</link></literal> identifier.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>classmapping_id</literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="classmapping">classmapping</link></literal> identifier.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>classpermissionset_id</literal></para>
                  </entry>
                  <entry>
                     <para>A single named <literal><link linkend="classpermissionset">classpermissionset</link></literal> identifier or a single anonymous <literal><link linkend="classpermissionset">classpermissionset</link></literal> using <literal>expr</literal>'s as required (see the <literal><link linkend="classpermissionset">classpermissionset</link></literal> statement).</para>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>
         <para><emphasis role="bold">Examples:</emphasis></para>
         <para>These class mapping statements will resolve to the permission sets shown in the kernel policy language <literal><link linkend="allow">allow</link></literal> rules:</para>
         <programlisting><![CDATA[
(class binder (impersonate call set_context_mgr transfer receive))
(class property_service (set))
(class zygote (specifyids specifyrlimits specifycapabilities specifyinvokewith specifyseinfo))

(classpermission cps_zygote)
(classpermissionset cps_zygote (zygote (not (specifyids))))

(classmap android_classes (set_1 set_2 set_3))

(classmapping android_classes set_1 (binder (all)))
(classmapping android_classes set_1 (property_service (set)))
(classmapping android_classes set_1 (zygote (not (specifycapabilities))))

(classmapping android_classes set_2 (binder (impersonate call set_context_mgr transfer)))
(classmapping android_classes set_2 (zygote (specifyids specifyrlimits specifycapabilities specifyinvokewith)))

(classmapping android_classes set_3 cps_zygote)
(classmapping android_classes set_3 (binder (impersonate call set_context_mgr)))

(block map_example
    (type type_1)
    (type type_2)
    (type type_3)

    (allow type_1 self (android_classes (set_1)))
    (allow type_2 self (android_classes (set_2)))
    (allow type_3 self (android_classes (set_3)))
)

; The above will resolve to the following AV rules:
;; allow map_example.type_1 map_example.type_1 : binder { impersonate call set_context_mgr transfer receive } ;
;; allow map_example.type_1 map_example.type_1 : property_service set ;
;; allow map_example.type_1 map_example.type_1 : zygote { specifyids specifyrlimits specifyinvokewith specifyseinfo } ;

;; allow map_example.type_2 map_example.type_2 : binder { impersonate call set_context_mgr transfer } ;
;; allow map_example.type_2 map_example.type_2 : zygote { specifyids specifyrlimits specifycapabilities specifyinvokewith } ;

;; allow map_example.type_3 map_example.type_3 : binder { impersonate call set_context_mgr } ;
;; allow map_example.type_3 map_example.type_3 : zygote { specifyrlimits specifycapabilities specifyinvokewith specifyseinfo } ;]]>
         </programlisting>
      </sect2>

      <sect2 id="permissionx">
         <title>permissionx</title>
         <para>Defines a named extended permission, which can be used in the <literal><link linkend="allowx">allowx</link></literal>, <literal><link linkend="auditallowx">auditallowx</link></literal>, and <literal><link linkend="dontauditx">dontauditx</link></literal> statements.</para>
         <para><emphasis role="bold">Statement definition:</emphasis></para>
         <programlisting><![CDATA[(permissionx permissionx_id (kind class_id (permission ... | expr ...)))]]></programlisting>
         <para><emphasis role="bold">Where:</emphasis></para>
         <informaltable frame="all">
            <tgroup cols="2">
            <colspec colwidth="2.25 *"/>
            <colspec colwidth="6 *"/>
               <tbody>
               <row>
                  <entry>
                     <para><literal><link linkend="permissionx">permissionx</link></literal></para>
                  </entry>
                  <entry>
                     <para>The <literal><link linkend="permissionx">permissionx</link></literal> keyword.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>kind</literal></para>
                  </entry>
                  <entry>
                     <para>A keyword specifying how to interpret the extended permission values. Must be one of:</para>
                     <para>
                        <informaltable frame="all">
                           <tgroup cols="2">
                              <colspec colwidth=".5 in"/>
                              <colspec colwidth="*"/>
                              <thead>
                              <row>
                                 <entry align="center">
                                    <para><emphasis role="bold">kind</emphasis></para>
                                 </entry>
                                 <entry align="center">
                                    <para><emphasis role="bold">description</emphasis></para>
                                 </entry>
                              </row>
                              </thead>
                              <tbody>
                              <row>
                                 <entry>
                                    <para>ioctl</para>
                                 </entry>
                                 <entry>
                                    <para>Permissions define a whitelist of ioctl values. Permission values must range from <literal>0x0000</literal> to <literal>0xFFFF</literal>, inclusive.</para>
                                 </entry>
                              </row>
                           </tbody></tgroup>
                        </informaltable>
                     </para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>class_id</literal></para>
                  </entry>
                  <entry>
                     <para>A single previously declared <literal><link linkend="class">class</link></literal> identifier.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>permission</literal></para>
                  </entry>
                  <entry>
                     <para>One or more numeric values, specified in decimal, or hexadecimal if prefixed with 0x, or octal if prefixed with 0. Values are interpreted based on the value of <literal>kind</literal>.</para>
                  </entry>
               </row>
               <row>
                  <entry>
                     <para><literal>expr</literal></para>
                  </entry>
                  <entry>
                     <para>An expression, with valid operators and syntax:</para>
                     <simpara><literal>    (range (permission ...) (permission ...))</literal></simpara>
                     <simpara><literal>    (and (permission ...) (permission ...))</literal></simpara>
                     <simpara><literal>    (or  (permission ...) (permission ...))</literal></simpara>
                     <simpara><literal>    (xor (permission ...) (permission ...))</literal></simpara>
                     <simpara><literal>    (not (permission ...))</literal></simpara>
                     <simpara><literal>    (all)</literal></simpara>
                  </entry>
               </row>
            </tbody></tgroup>
         </informaltable>
         <para><emphasis role="bold">Examples:</emphasis></para>
         <programlisting><![CDATA[
(permissionx ioctl_1 (ioctl tcp_socket (0x2000 0x3000 0x4000)))
(permissionx ioctl_2 (ioctl tcp_socket (range 0x6000 0x60FF)))
(permissionx ioctl_3 (ioctl tcp_socket (and (range 0x8000 0x90FF) (not (range 0x8100 0x82FF)))))
]]>
         </programlisting>
      </sect2>

   </sect1>