2004-12-01 01:31:34 +00:00
--- libselinux-1.19.1/include/selinux/selinux.h.rhat 2004-11-09 09:14:24.000000000 -0500
+++ libselinux-1.19.1/include/selinux/selinux.h 2004-11-19 11:21:37.514236820 -0500
2004-11-15 20:05:55 +00:00
@@ -176,7 +176,7 @@
/* Match the specified media and against the media contexts
configuration and set *con to refer to the resulting context.
Caller must free con via freecon. */
-extern int matchmediacon(const char *path,
+extern int matchmediacon(const char *media,
security_context_t *con);
/*
2004-12-01 01:31:34 +00:00
--- libselinux-1.19.1/utils/setsebool.c.rhat 2004-11-09 09:14:24.000000000 -0500
+++ libselinux-1.19.1/utils/setsebool.c 2004-11-19 11:21:37.560231630 -0500
@@ -35,6 +35,8 @@
if (strcmp(argv[1], "-P") == 0) {
permanent = 1;
+ if (argc < 3)
+ usage();
start = 2;
}
else
--- libselinux-1.19.1/utils/getsebool.c.rhat 2004-11-09 09:14:24.000000000 -0500
+++ libselinux-1.19.1/utils/getsebool.c 2004-11-19 11:21:37.559231743 -0500
@@ -83,8 +83,14 @@
rc = -1;
goto out;
}
- printf("%s --> active: %d pending: %d\n", names[i],
- active, pending);
+ if (pending != active) {
+ printf("%s --> %s pending: %s\n", names[i],
+ ( active ? "active" : "inactive"),
+ ( pending ? "active" : "inactive"));
+ } else {
+ printf("%s --> %s\n", names[i],
+ ( active ? "active" : "inactive"));
+ }
}
out:
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/utils/avcstat.c 2004-11-19 11:21:37.558231856 -0500
@@ -0,0 +1,224 @@
+/*
+ * avcstat - Display SELinux avc statistics.
+ *
+ * Copyright (C) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2,
+ * as published by the Free Software Foundation.
+ *
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <libgen.h>
+#include <stdarg.h>
+#include <errno.h>
+#include <string.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <signal.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/ioctl.h>
+#include <linux/limits.h>
2004-11-15 20:05:55 +00:00
+
2004-12-01 01:31:34 +00:00
+#define DEF_STAT_FILE "/avc/cache_stats"
+#define DEF_BUF_SIZE 8192
+#define HEADERS "lookups hits misses allocations reclaims frees"
2004-11-15 20:05:55 +00:00
+
2004-12-01 01:31:34 +00:00
+struct avc_cache_stats {
+ unsigned int lookups;
+ unsigned int hits;
+ unsigned int misses;
+ unsigned int allocations;
+ unsigned int reclaims;
+ unsigned int frees;
+};
2004-11-15 20:05:55 +00:00
+
2004-12-01 01:31:34 +00:00
+static int interval;
+static int rows;
+static char *progname;
+static char buf[DEF_BUF_SIZE];
2004-11-15 20:05:55 +00:00
+
2004-12-01 01:31:34 +00:00
+/* selinuxfs mount point */
+extern char *selinux_mnt;
2004-11-15 20:05:55 +00:00
+
+
2004-12-01 01:31:34 +00:00
+static void die(const char *msg, ...)
+{
+ va_list args;
+
+ fputs("ERROR: ", stderr);
+
+ va_start(args, msg);
+ vfprintf(stderr, msg, args);
+ va_end(args);
+
+ if (errno)
+ fprintf(stderr, ": %s", strerror(errno));
+
+ fputc('\n', stderr);
+ exit(1);
+}
2004-11-15 20:05:55 +00:00
+
2004-12-01 01:31:34 +00:00
+static void usage(void)
+{
+ printf("\nUsage: %s [-c] [-f status_file] [interval]\n\n", progname);
+ printf("Display SELinux AVC statistics. If the interval parameter is specified, the\n");
+ printf("program will loop, displaying updated statistics every \'interval\' seconds.\n");
+ printf("Relative values are displayed by default. Use the -c option to specify the\n");
+ printf("display of cumulative values. The -f option specifies the location of the\n");
+ printf("AVC statistics file, defaulting to \'%s\%s\'.\n\n", selinux_mnt, DEF_STAT_FILE);
+}
2004-11-15 20:05:55 +00:00
+
2004-12-01 01:31:34 +00:00
+static void set_window_rows(void)
+{
+ int ret;
+ struct winsize ws;
+
+ ret = ioctl(fileno(stdout), TIOCGWINSZ, &ws);
+ if (ret < 0 || ws.ws_row < 3)
+ ws.ws_row = 24;
+ rows = ws.ws_row;
+}
2004-11-15 20:05:55 +00:00
+
2004-12-01 01:31:34 +00:00
+static void sighandler(int num)
+{
+ if (num == SIGWINCH)
+ set_window_rows();
+}
+
+int main(int argc, char **argv)
+{
+ int fd, i, cumulative = 0;
+ struct sigaction sa;
+ char avcstatfile[PATH_MAX];
+ snprintf(avcstatfile, sizeof avcstatfile, "%s%s", selinux_mnt, DEF_STAT_FILE);
+ progname = basename(argv[0]);
+
+ while((i = getopt(argc, argv, "cf:h?-")) != -1) {
+ switch (i) {
+ case 'c':
+ cumulative = 1;
+ break;
+ case 'f':
+ strncpy(avcstatfile, optarg, sizeof avcstatfile);
+ break;
+ case 'h':
+ case '-':
+ usage();
+ exit(0);
+ default:
+ usage();
+ die("unrecognized parameter", i);
+ }
+ }
+
+ if (optind < argc) {
+ char *arg = argv[optind];
+ unsigned int n = strtoul(arg, NULL, 10);
+
+ if (errno == ERANGE) {
+ usage();
+ die("invalid interval \'%s\'", arg);
+ }
+ if (n == 0) {
+ usage();
+ exit (0);
+ }
+ interval = n;
+ }
+
+ sa.sa_handler = sighandler;
+ sa.sa_flags = SA_RESTART;
+
+ i = sigaction(SIGWINCH, &sa, NULL);
+ if (i < 0)
+ die("sigaction");
+
+ set_window_rows();
+ fd = open(avcstatfile, O_RDONLY);
+ if (fd < 0)
+ die("open: \'%s\'", avcstatfile);
+
+ for (i = 0;; i++) {
+ char *line;
+ ssize_t ret, parsed = 0;
+ struct avc_cache_stats tot, rel, last;
+
+ memset(buf, 0, DEF_BUF_SIZE);
+ ret = read(fd, buf, DEF_BUF_SIZE);
+ if (ret < 0)
+ die("read");
+
+ if (ret == 0)
+ die("read: \'%s\': unexpected end of file", avcstatfile);
+
+ line = strtok(buf, "\n");
+ if (!line)
+ die("unable to parse \'%s\': end of line not found", avcstatfile);
+
+ if (strcmp(line, HEADERS))
+ die("unable to parse \'%s\': invalid headers", avcstatfile);
+
+ if (!i || !(i % (rows - 2)))
+ printf("%10s %10s %10s %10s %10s %10s\n", "lookups",
+ "hits", "misses", "allocs", "reclaims", "frees");
+
+ memset(&tot, 0, sizeof(tot));
+
+ while ((line = strtok(NULL, "\n"))) {
+ struct avc_cache_stats tmp;
+
+ ret = sscanf(line, "%u %u %u %u %u %u",
+ &tmp.lookups,
+ &tmp.hits,
+ &tmp.misses,
+ &tmp.allocations,
+ &tmp.reclaims,
+ &tmp.frees);
+ if (ret != 6)
+ die("unable to parse \'%s\': scan error", avcstatfile);
+
+ tot.lookups += tmp.lookups;
+ tot.hits += tmp.hits;
+ tot.misses += tmp.misses;
+ tot.allocations += tmp.allocations;
+ tot.reclaims += tmp.reclaims;
+ tot.frees += tmp.frees;
+ parsed = 1;
+ }
+
+ if (!parsed)
+ die("unable to parse \'%s\': no data", avcstatfile);
+
+ if (cumulative || (!cumulative && !i))
+ printf("%10u %10u %10u %10u %10u %10u\n",
+ tot.lookups, tot.hits, tot.misses,
+ tot.allocations, tot.reclaims, tot.frees);
+ else {
+ rel.lookups = tot.lookups - last.lookups;
+ rel.hits = tot.hits - last.hits;
+ rel.misses = tot.misses - last.misses;
+ rel.allocations = tot.allocations - last.allocations;
+ rel.reclaims = tot.reclaims - last.reclaims;
+ rel.frees = tot.frees - last.frees;
+ printf("%10u %10u %10u %10u %10u %10u\n",
+ rel.lookups, rel.hits, rel.misses,
+ rel.allocations, rel.reclaims, rel.frees);
+ }
+
+ if (!interval)
+ break;
+
+ memcpy(&last, &tot, sizeof(last));
+ sleep(interval);
+
+ ret = lseek(fd, 0, 0);
+ if (ret < 0)
+ die("lseek");
+ }
+
+ close(fd);
+ return 0;
+}
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/rpm_execcon.3 2004-11-19 11:21:37.534234563 -0500
2004-11-15 20:05:55 +00:00
@@ -0,0 +1 @@
2004-12-01 01:31:34 +00:00
+.so man3/getexeccon.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/selinux_media_context_path.3 2004-11-19 11:21:37.551232645 -0500
2004-11-15 20:05:55 +00:00
@@ -0,0 +1 @@
2004-12-01 01:31:34 +00:00
+.so man3/selinux_binary_policy_path.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/context_user_get.3 2004-11-19 11:21:37.524235691 -0500
2004-11-15 20:05:55 +00:00
@@ -0,0 +1 @@
+.so man3/context_new.3
2004-12-01 01:31:34 +00:00
--- libselinux-1.19.1/man/man3/getcon.3.rhat 2004-11-09 09:14:24.000000000 -0500
+++ libselinux-1.19.1/man/man3/getcon.3 2004-11-19 11:21:37.526235466 -0500
2004-11-15 20:05:55 +00:00
@@ -8,7 +8,9 @@
.br
.BI "int getprevcon(security_context_t *" context );
.br
-.BI "int getpidcon(pid_t pid, security_context_t *" context );
+.BI "int getpidcon(pid_t " pid ", security_context_t *" context );
+.br
+.BI "int getpeercon(int " fd ", security_context_t *" context);
.SH "DESCRIPTION"
.B getcon
@@ -21,6 +23,9 @@
.B getpidcon
returns the process context for the specified PID.
+.B getpeercon
+retrieves context of peer socket, and set *context to refer to it, which must be free'd with freecon.
+
.SH "RETURN VALUE"
On error -1 is returned. On success 0 is returned.
2004-12-01 01:31:34 +00:00
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/context_user_set.3 2004-11-19 11:21:37.525235579 -0500
2004-11-15 20:05:55 +00:00
@@ -0,0 +1 @@
2004-12-01 01:31:34 +00:00
+.so man3/context_new.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/getpeercon.3 2004-11-19 11:21:37.530235014 -0500
@@ -0,0 +1 @@
+.so man3/getcon.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/context_type_set.3 2004-11-19 11:21:37.523235804 -0500
@@ -0,0 +1 @@
+.so man3/context_new.3
--- libselinux-1.19.1/man/man3/get_ordered_context_list.3.rhat 2004-11-09 09:14:24.000000000 -0500
+++ libselinux-1.19.1/man/man3/get_ordered_context_list.3 2004-11-19 11:29:45.211209677 -0500
2004-11-15 20:05:55 +00:00
@@ -1,6 +1,6 @@
.TH "get_ordered_context_list" "3" "1 January 2004" "russell@coker.com.au" "SE Linux API documentation"
.SH "NAME"
-get_ordered_context_list, get_default_context, query_user_context \- determine context(s) for user login sessions
2004-12-01 01:31:34 +00:00
+get_ordered_context_list, get_default_context, get_default_context_with_role, query_user_context, manual_user_enter_context, get_default_role \- determine context(s) for user login sessions
2004-11-15 20:05:55 +00:00
.SH "SYNOPSIS"
.B #include <selinux/selinux.h>
2004-12-01 01:31:34 +00:00
@@ -11,10 +11,13 @@
.sp
.BI "int get_default_context(const char *" user ", security_context_t "fromcon ", security_context_t *" newcon );
.sp
+.BI "int get_default_context_with_role(const char* " user ", const char *" role ", security_context_t " fromcon ", security_context_t *" newcon ");
+.sp
2004-11-15 20:05:55 +00:00
.BI "int query_user_context(security_context_t *" list ", security_context_t *" newcon );
.sp
.BI "int manual_user_enter_context(const char *" user ", security_context_t *" newcon );
-
+.sp
+.BI "int get_default_type(const char *" role ", char **" type );
.SH "DESCRIPTION"
.B get_ordered_context_list
2004-12-01 01:31:34 +00:00
@@ -31,14 +34,26 @@
is the same as get_ordered_context_list but only returns a single context
which has to be freed with freecon.
+.B get_default_context_with_role
+Given a list of authorized security contexts for the user, query the user to select one and set *newcon to refer to it, which has to be freed with freecon.
+
+NOTE get_default_context_with_role is the same as get_default_context
+except that it only returns a context with the specified role, returning
+-1 if no such context is reachable for that user.
+
.B query_user_context
takes a list of contexts, queries the user via stdin/stdout as to which context
they want, and returns a new context as selected by the user (which has to be
freed with freecon).
2004-11-15 20:05:55 +00:00
2004-12-01 01:31:34 +00:00
.B manual_user_enter_context
-allows the user to manually enter a context as a fallback if a list of
-authorized contexts could not be obtained. Caller must free via freecon.
+allows the user to manually enter a context as a fallback if a list of authorized contexts could not be obtained. Caller must free via freecon.
+
2004-11-15 20:05:55 +00:00
+.B get_default_type
2004-12-01 01:31:34 +00:00
+Get the default type (domain) for 'role' and set 'type' to refer to it, which has to be freed with free.
2004-11-15 20:05:55 +00:00
+
+.B get_default_context_with_role
2004-12-01 01:31:34 +00:00
+Given a list of authorized security contexts for the user, query the user to select one and set *newcon to refer to it, which has to be freed with freecon.
2004-11-15 20:05:55 +00:00
.SH "RETURN VALUE"
0 for success and on error -1 is returned.
2004-12-01 01:31:34 +00:00
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/context_free.3 2004-11-19 11:21:37.515236707 -0500
@@ -0,0 +1 @@
+.so man3/context_new.3
--- libselinux-1.19.1/man/man3/getexeccon.3.rhat 2004-11-09 09:14:24.000000000 -0500
+++ libselinux-1.19.1/man/man3/getexeccon.3 2004-11-19 11:21:37.528235240 -0500
@@ -8,6 +8,8 @@
.BI "int getexeccon(security_context_t *" context );
.br
.BI "int setexeccon(security_context_t "context );
+.br
+.BI "int rpm_execcon(unsigned int " verified ", const char *" filename ", char *const " argv "[] , char *const " envp "[]);
.SH "DESCRIPTION"
.B getexeccon
@@ -31,6 +33,11 @@
2004-11-15 20:05:55 +00:00
2004-12-01 01:31:34 +00:00
Note: Signal handlers that perform an execve must take care to
save, reset, and restore the exec context to avoid unexpected behaviors.
+.br
+
+.B rpm_execcon
+Execute a helper for rpm in an appropriate security context.
+
.SH "RETURN VALUE"
On error -1 is returned.
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/context_range_set.3 2004-11-19 11:21:37.519236255 -0500
2004-11-15 20:05:55 +00:00
@@ -0,0 +1 @@
2004-12-01 01:31:34 +00:00
+.so man3/context_new.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/security_commit_booleans.3 2004-11-19 11:21:37.535234450 -0500
@@ -0,0 +1 @@
+.so man3/security_load_booleans.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/security_set_boolean.3 2004-11-19 11:21:37.542233661 -0500
@@ -0,0 +1 @@
+.so man3/security_load_booleans.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/selinux_failsafe_context_path.3 2004-11-19 11:21:37.549232871 -0500
@@ -0,0 +1 @@
+.so man3/selinux_binary_policy_path.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/security_get_boolean_pending.3 2004-11-19 11:21:37.540233886 -0500
@@ -0,0 +1 @@
+.so man3/security_load_booleans.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/context_role_set.3 2004-11-19 11:21:37.521236030 -0500
@@ -0,0 +1 @@
+.so man3/context_new.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/context_range_get.3 2004-11-19 11:21:37.518236368 -0500
@@ -0,0 +1 @@
+.so man3/context_new.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/context_role_get.3 2004-11-19 11:21:37.520236143 -0500
@@ -0,0 +1 @@
+.so man3/context_new.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/security_get_boolean_active.3 2004-11-19 11:21:37.537234225 -0500
@@ -0,0 +1 @@
+.so man3/security_load_booleans.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/selinux_removable_context_path.3 2004-11-19 11:21:37.552232532 -0500
@@ -0,0 +1 @@
+.so man3/selinux_binary_policy_path.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/set_matchpathcon_printf.3 2004-11-19 11:21:37.555232194 -0500
@@ -0,0 +1 @@
+.so man3/matchpathcon.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/context_new.3 2004-11-19 11:23:54.697758320 -0500
@@ -0,0 +1,56 @@
+.TH "context_new" "3" "15 November 2004" "dwalsh@redhat.com" "SELinux API documentation"
2004-11-15 20:05:55 +00:00
+.SH "NAME"
2004-12-01 01:31:34 +00:00
+context_new, context_str, context_free, context_type_get, context_type_set, context_range_get, context_range_set,context_role_get, context_role_set, context_user_get, context_user_set \- Routines to manipulate SELinux security contexts
2004-11-15 20:05:55 +00:00
+
+.SH "SYNOPSIS"
2004-12-01 01:31:34 +00:00
+.B #include <selinux/context.h>
+.br
+.B "context_t context_new(const char *" context_str );
2004-11-15 20:05:55 +00:00
+.br
2004-12-01 01:31:34 +00:00
+.B "const char * context_str(context_t " con );
+.br
+.B "void context_free(context_t " con );
+.br
+.B "const char * context_type_get(context_t " con );
+.br
+.B "const char * context_range_get(context_t " con );
+.br
+.B "const char * context_role_get(context_t " con );
+.br
+.B "const char * context_user_get(context_t " con );
+.br
+.B "const char * context_type_set(context_t " con ", const char* " type);
+.br
+.B "const char * context_range_set(context_t " con ", const char* " range);
+.br
+.B "const char * context_role_set(context_t " con ", const char* " role );
+.br
+.B "const char * context_user_set(context_t " con ", const char* " user );
2004-11-15 20:05:55 +00:00
+
+.SH "DESCRIPTION"
2004-12-01 01:31:34 +00:00
+ Functions to deal with security contexts in user space.
2004-11-15 20:05:55 +00:00
+
2004-12-01 01:31:34 +00:00
+context_new
+ Return a new context initialized to a context string
2004-11-15 20:05:55 +00:00
+
2004-12-01 01:31:34 +00:00
+context_str
+Return a pointer to the string value of the context_t
+Valid until the next call to context_str or context_free
+for the same context_t*
+
+context_free
+Free the storage used by a context
+
+context_type_get, context_range_get, context_role_get, context_user_get
+Get a pointer to the string value of a context component
+
+NOTE: Values returned by the get functions are only valid until the next call
+to a set function or context_free() for the same context_t structure.
+
+context_type_set, context_range_set, context_role_set, context_user_set
+Set a context component
2004-11-15 20:05:55 +00:00
+
2004-12-01 01:31:34 +00:00
+.SH "RETURN VALUE"
+On success, zero is returned. On failure, -1 is returned and errno is
+set appropriately.
2004-11-15 20:05:55 +00:00
+
2004-12-01 01:31:34 +00:00
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/context_type_get.3 2004-11-19 11:21:37.522235917 -0500
2004-11-15 20:05:55 +00:00
@@ -0,0 +1 @@
2004-12-01 01:31:34 +00:00
+.so man3/context_new.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/security_get_boolean_names.3 2004-11-19 11:21:37.539233999 -0500
2004-11-15 20:05:55 +00:00
@@ -0,0 +1 @@
+.so man3/security_load_booleans.3
2004-12-01 01:31:34 +00:00
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/selinux_booleans_path.3 2004-11-19 11:21:37.545233322 -0500
@@ -0,0 +1 @@
+.so man3/selinux_binary_policy_path.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/checkPasswdAccess.3 2004-11-19 11:21:37.514236820 -0500
@@ -0,0 +1 @@
+.so man3/security_compute_av.3
--- libselinux-1.19.1/man/man3/security_compute_av.3.rhat 2004-11-09 09:14:24.000000000 -0500
+++ libselinux-1.19.1/man/man3/security_compute_av.3 2004-11-19 11:32:59.943237946 -0500
2004-11-15 20:05:55 +00:00
@@ -15,6 +15,8 @@
.BI "int security_compute_relabel(security_context_t "scon ", security_context_t "tcon ", security_class_t "tclass ", security_context_t *" newcon );
.sp
.BI "int security_compute_user(security_context_t "scon ", const char *" username ", security_context_t **" con );
+.sp
+.BI "int checkPasswdAccess(access_vector_t " requested );
.SH "DESCRIPTION"
.B security_compute_av
@@ -42,6 +44,9 @@
source context. Is mainly used by
.B get_ordered_context_list.
+.B checkPasswdAccess
2004-12-01 01:31:34 +00:00
+This functions is a helper functions that allows you to check for a permission in the passwd class. checkPasswdAccess uses getprevcon() for the source and target security contexts.
2004-11-15 20:05:55 +00:00
+
.SH "RETURN VALUE"
0 for success and on error -1 is returned.
2004-12-01 01:31:34 +00:00
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/selinux_binary_policy_path.3 2004-11-19 11:21:37.544233435 -0500
2004-11-15 20:05:55 +00:00
@@ -0,0 +1,75 @@
+.TH "security_get_boolean_names" "3" "15 November 2004" "dwalsh@redhat.com" "SELinux API Documentation"
+.SH "NAME"
+selinux_binary_policy_path,selinux_failsafe_context_path,selinux_removable_context_path,selinux_default_context_path, selinux_user_contexts_path, selinux_file_context_path, selinux_media_context_path, selinux_contexts_path, selinux_booleans_path
+.sp
+These functions return the paths to specific files under the
+ policy root directory.
+
+.SH "SYNOPSIS"
+.B #include <selinux/selinux.h>
+.sp
+.br
+extern const char *selinux_binary_policy_path(void);
+.br
+extern const char *selinux_failsafe_context_path(void);
+.br
+extern const char *selinux_removable_context_path(void);
+.br
+extern const char *selinux_default_context_path(void);
+.br
+extern const char *selinux_user_contexts_path(void);
+.br
+extern const char *selinux_file_context_path(void);
+.br
+extern const char *selinux_media_context_path(void);
+.br
+extern const char *selinux_contexts_path(void);
+.br
+extern const char *selinux_booleans_path(void);
+
+
+.SH "DESCRIPTION"
+
+These functions return the paths to specific files under the
+ policy root directory.
+
+.br
+selinux_binary_policy_path
+.br
+Default Binary Policy
+.sp
+selinux_failsafe_context_path
+.br
+Default failsafe context file
+.sp
+selinux_removable_context_path
+.br
+Default removeable context file
+.sp
+selinux_default_context_path
+.br
+Default context used by login programs and daemons that assume user roles.
+.sp
+selinux_user_contexts_path
+.br
+Default user context file; used by login programs for default login context
+.sp
+selinux_file_context_path
+.br
+Default file context file used restorecon
+.sp
+selinux_media_context_path
+.br
+Default media context file use to set contexts on media devices (cdrom, floppies)
+.sp
+selinux_contexts_path
+.br
+Parent directory of context files
+.sp
+selinux_booleans_path
+.br
+Boolean file path, used by boolean manipulation tools
+
+.SH AUTHOR
+This manual page was written by Dan Walsh <dwalsh@redhat.com>.
+
2004-12-01 01:31:34 +00:00
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/selinux_contexts_path.3 2004-11-19 11:21:37.546233209 -0500
2004-11-15 20:05:55 +00:00
@@ -0,0 +1 @@
+.so man3/selinux_binary_policy_path.3
2004-12-01 01:31:34 +00:00
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/selinux_file_context_path.3 2004-11-19 11:21:37.550232758 -0500
2004-11-15 20:05:55 +00:00
@@ -0,0 +1 @@
+.so man3/selinux_binary_policy_path.3
2004-12-01 01:31:34 +00:00
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/matchmediacon.3 2004-11-19 11:32:02.685698348 -0500
@@ -0,0 +1,26 @@
+.TH "matchmediacon" "3" "15 November 2004" "dwalsh@redhat.com" "SE Linux API documentation"
2004-11-18 21:29:18 +00:00
+.SH "NAME"
2004-12-01 01:31:34 +00:00
+matchmediacon \- get the default security context for the specified mediatype from the policy.
2004-11-18 21:29:18 +00:00
+
+.SH "SYNOPSIS"
2004-12-01 01:31:34 +00:00
+.B #include <selinux/selinux.h>
+.sp
+.BI "int matchmediacon(const char *" media ", security_context_t *" con);"
+.br
2004-11-18 21:29:18 +00:00
+
+.SH "DESCRIPTION"
2004-12-01 01:31:34 +00:00
+.br
+.B matchmediacon
+matches the specified media type with the media contexts configuration and sets the security context "con" to refer to the resulting context.
+.sp
+.br
+.B Note:
+ Caller must free returned security context "con" using freecon.
+.SH "RETURN VALUE"
+Returns 0 on success or -1 otherwise.
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+.SH Files
+/etc/selinux/POLICYTYPE/contexts/files/media
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+.SH "SEE ALSO"
+.BR freecon "(3)
--- libselinux-1.19.1/man/man3/matchpathcon.3.rhat 2004-11-09 09:14:24.000000000 -0500
+++ libselinux-1.19.1/man/man3/matchpathcon.3 2004-11-19 11:21:37.533234676 -0500
@@ -5,17 +5,22 @@
.SH "SYNOPSIS"
.B #include <selinux/selinux.h>
.sp
-.BI "int matchpathcon(const char *" path ", mode_t " mode ", security_context_t *" con);"
+.BI "int matchpathcon(const char *" path ", mode_t " mode ", security_context_t *" con);
.br
+.BI "void set_matchpathcon_printf(void (*f)(const char *fmt, ...));"
2004-11-12 13:03:50 +00:00
.SH "DESCRIPTION"
2004-12-01 01:31:34 +00:00
.br
.B matchpathcon
matches the specified pathname and mode against the file contexts configuration and sets the security context "con" to refer to the resulting context. "mode" can be 0 to disable mode matching, but should be provided whenever possible, as it may affect the matching.
-.sp
-.br
.B Note:
Caller must free returned security context "con" using freecon.
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+.B set_matchpathcon_printf
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+Set the function used by matchpathcon when displaying errors about the file_contexts configuration. If not set, then this defaults to fprintf(stderr, fmt, ...).
+.sp
+.br
.SH "RETURN VALUE"
Returns 0 on success or -1 otherwise.
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/security_load_booleans.3 2004-11-19 11:35:47.204365772 -0500
@@ -0,0 +1,61 @@
+.TH "security_get_boolean_names" "3" "15 November 2004" "dwalsh@redhat.com" "SELinux API Documentation"
+.SH "NAME"
+security_load_booleans, security_set_boolean, security_commit_booleans,
+security_get_boolean_names, security_get_boolean_active, security_get_boolean_pending
+.sp
+routines for manipulating SELinux boolean values
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+.SH "SYNOPSIS"
+.B #include <selinux/selinux.h>
+.sp
+extern int security_load_booleans(char *path);
+.br
+extern int security_get_boolean_names(char ***names, int *len);
+.br
+extern int security_get_boolean_pending(const char *name);
+.br
+extern int security_get_boolean_active(const char *name);
+.br
+extern int security_set_boolean(const char *name, int value);
+.br
+extern int security_commit_booleans(void);
2004-11-18 21:29:18 +00:00
+
+
2004-12-01 01:31:34 +00:00
+.SH "DESCRIPTION"
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+The SELinux policy can include conditional rules that are enabled or
+disabled based on the current values of a set of policy booleans.
+These policy booleans allow runtime modification of the security
+policy without having to load a new policy.
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+The SELinux API allows for a transaction based update. So you can set several boolean values and the commit them all at once.
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+security_load_booleans
+.br
+Load policy boolean settings. Path may be NULL, in which case the booleans are loaded from the active policy boolean configuration file.
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+security_get_boolean_names
+.br
+Returns a list of boolean names, currently supported by the loaded policy.
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+security_set_boolean
+.br
+Sets the pending value for boolean
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+security_get_boolean_pending
+.br
+Return pending value for boolean
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+security_get_boolean_active
+.br
+Return active value for boolean
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+security_commit_booleans
+.br
+Commit all pending values for the booleans.
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+.SH AUTHOR
+This manual page was written by Dan Walsh <dwalsh@redhat.com>.
2004-11-18 21:29:18 +00:00
+
2004-12-01 01:31:34 +00:00
+.SH "SEE ALSO"
+getsebool(8), booleans(8), togglesebool(8)
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/selinux_default_context_path.3 2004-11-19 11:21:37.547233097 -0500
@@ -0,0 +1 @@
+.so man3/selinux_binary_policy_path.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/get_default_context_with_role.3 2004-11-19 11:21:37.527235353 -0500
@@ -0,0 +1 @@
+.so man3/get_ordered_context_list.3
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man3/selinux_user_contexts_path.3 2004-11-19 11:21:37.554232307 -0500
@@ -0,0 +1 @@
+.so man3/selinux_binary_policy_path.3
--- libselinux-1.19.1/man/man8/getsebool.8.rhat 2004-11-09 09:14:24.000000000 -0500
+++ libselinux-1.19.1/man/man8/getsebool.8 2004-11-19 11:21:37.557231968 -0500
@@ -8,13 +8,12 @@
2004-11-12 13:03:50 +00:00
2004-12-01 01:31:34 +00:00
.SH "DESCRIPTION"
.B getsebool
-reports the current state of either a particular SELinux boolean or
-all SELinux booleans. The state consists of two values, the active
-value and the pending value. The active value indicates the value
-that is presently applied to the policy. The pending value indicates
+reports where a particular SELinux boolean or
+all SELinux booleans are active or inactive.
+In certain situations a boolean can be in one state with a pending
+change to the other state. getsebool will report this as a pending change.
+The pending value indicates
the value that will be applied upon the next boolean commit.
-Typically, these values will be the same; they only differ when in the
-middle of a boolean change transaction.
2004-11-09 14:24:39 +00:00
2004-12-01 01:31:34 +00:00
The setting of boolean values occurs in two stages; first the pending
value is changed, then the booleans are committed, causing their
--- /dev/null 2004-11-19 04:10:22.696886456 -0500
+++ libselinux-1.19.1/man/man8/avcstat.8 2004-11-19 11:21:37.556232081 -0500
@@ -0,0 +1,28 @@
+.TH "avcstat" "8" "18 Nov 2004" "dwalsh@redhat.com" "SELinux Command Line documentation"
+.SH "NAME"
+avcstat \- Display SELinux AVC statistics
+
+.SH "SYNOPSIS"
+.B avcstat
+.I [-c] [-f status_file] [interval]
+
+.SH "DESCRIPTION"
+.B avcstat
+
+Display SELinux AVC statistics. If the interval parameter is specified, the
+program will loop, displaying updated statistics every 'interval' seconds.
+Relative values are displayed by default.
+
+.SH OPTIONS
+.TP
+.B \-c
+Display the cumulative values.
+
+.TP
+.B \-f
+Specifies the location of the AVC statistics file, defaulting to '/selinux/avc/cache_stats'.
+
+.SH AUTHOR
+This manual page was written by Dan Walsh <dwalsh@redhat.com>.
+The program was written by James Morris <jmorris@redhat.com>.
+
