|
 |
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/include/selinux/selinux.h libselinux-1.19.1/include/selinux/selinux.h
|
|
|
4962db3 |
--- nsalibselinux/include/selinux/selinux.h 2004-10-20 16:31:36.000000000 -0400
|
|
|
6864134 |
+++ libselinux-1.19.1/include/selinux/selinux.h 2004-11-18 15:27:00.994561786 -0500
|
|
|
4962db3 |
@@ -176,7 +176,7 @@
|
|
|
4962db3 |
/* Match the specified media and against the media contexts
|
|
|
4962db3 |
configuration and set *con to refer to the resulting context.
|
|
|
4962db3 |
Caller must free con via freecon. */
|
|
|
4962db3 |
-extern int matchmediacon(const char *path,
|
|
|
4962db3 |
+extern int matchmediacon(const char *media,
|
|
|
4962db3 |
security_context_t *con);
|
|
|
4962db3 |
|
|
|
4962db3 |
/*
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/checkPasswdAccess.3 libselinux-1.19.1/man/man3/checkPasswdAccess.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/checkPasswdAccess.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/checkPasswdAccess.3 2004-11-18 15:27:00.995561673 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/security_compute_av.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/context_free.3 libselinux-1.19.1/man/man3/context_free.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/context_free.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/context_free.3 2004-11-18 15:27:00.996561560 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/context_new.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/context_new.3 libselinux-1.19.1/man/man3/context_new.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/context_new.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/context_new.3 2004-11-18 15:27:00.997561447 -0500
|
|
|
4962db3 |
@@ -0,0 +1,53 @@
|
|
|
4962db3 |
+.TH "context_new" "3" "15 November 2004" "dwalsh@redhat.com" "SELinux API documentation"
|
|
|
4962db3 |
+.SH "NAME"
|
|
|
4962db3 |
+context_new, context_str, context_free, context_type_get, context_type_set, context_range_get, context_range_set,context_role_get, context_role_set, context_user_get, context_user_set \- Routines to manipulate SELinux security contexts
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH "SYNOPSIS"
|
|
|
4962db3 |
+.B #include <selinux/context.h>
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.B "context_t context_new(const char *" context_str );
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.B "const char * context_str(context_t " con );
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.B "void context_free(context_t " con );
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.B "const char * context_type_get(context_t " con );
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.B "const char * context_range_get(context_t " con );
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.B "const char * context_role_get(context_t " con );
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.B "const char * context_user_get(context_t " con );
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.B "const char * context_type_set(context_t " con ", const char* " type);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.B "const char * context_range_set(context_t " con ", const char* " range);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.B "const char * context_role_set(context_t " con ", const char* " role );
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.B "const char * context_user_set(context_t " con ", const char* " user );
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH "DESCRIPTION"
|
|
|
4962db3 |
+ Functions to deal with security contexts in user space.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+context_new
|
|
|
4962db3 |
+ Return a new context initialized to a context string
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+context_str
|
|
|
4962db3 |
+Return a pointer to the string value of the context_t
|
|
|
4962db3 |
+Valid until the next call to context_str or context_free
|
|
|
4962db3 |
+for the same context_t*
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+context_free
|
|
|
4962db3 |
+Free the storage used by a context
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+context_type_get, context_range_get, context_role_get, context_user_get
|
|
|
4962db3 |
+Get a pointer to the string value of a context component
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+context_type_set, context_range_set, context_role_set, context_user_set
|
|
|
4962db3 |
+Set a context component
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH "RETURN VALUE"
|
|
|
4962db3 |
+On success, zero is returned. On failure, -1 is returned and errno is
|
|
|
4962db3 |
+set appropriately.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/context_range_get.3 libselinux-1.19.1/man/man3/context_range_get.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/context_range_get.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/context_range_get.3 2004-11-18 15:27:00.998561335 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/context_new.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/context_range_set.3 libselinux-1.19.1/man/man3/context_range_set.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/context_range_set.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/context_range_set.3 2004-11-18 15:27:00.999561222 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/context_new.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/context_role_get.3 libselinux-1.19.1/man/man3/context_role_get.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/context_role_get.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/context_role_get.3 2004-11-18 15:27:01.035557160 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/context_new.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/context_role_set.3 libselinux-1.19.1/man/man3/context_role_set.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/context_role_set.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/context_role_set.3 2004-11-18 15:27:01.036557048 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/context_new.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/context_type_get.3 libselinux-1.19.1/man/man3/context_type_get.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/context_type_get.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/context_type_get.3 2004-11-18 15:27:01.037556935 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/context_new.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/context_type_set.3 libselinux-1.19.1/man/man3/context_type_set.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/context_type_set.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/context_type_set.3 2004-11-18 15:27:01.038556822 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/context_new.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/context_user_get.3 libselinux-1.19.1/man/man3/context_user_get.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/context_user_get.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/context_user_get.3 2004-11-18 15:27:01.040556596 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/context_new.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/context_user_set.3 libselinux-1.19.1/man/man3/context_user_set.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/context_user_set.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/context_user_set.3 2004-11-18 15:27:01.041556483 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/context_new.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/getcon.3 libselinux-1.19.1/man/man3/getcon.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/getcon.3 2004-10-20 16:31:36.000000000 -0400
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/getcon.3 2004-11-18 15:27:01.042556371 -0500
|
|
|
4962db3 |
@@ -8,7 +8,9 @@
|
|
|
4962db3 |
.br
|
|
|
4962db3 |
.BI "int getprevcon(security_context_t *" context );
|
|
|
4962db3 |
.br
|
|
|
4962db3 |
-.BI "int getpidcon(pid_t pid, security_context_t *" context );
|
|
|
4962db3 |
+.BI "int getpidcon(pid_t " pid ", security_context_t *" context );
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.BI "int getpeercon(int " fd ", security_context_t *" context);
|
|
|
4962db3 |
|
|
|
4962db3 |
.SH "DESCRIPTION"
|
|
|
4962db3 |
.B getcon
|
|
|
4962db3 |
@@ -21,6 +23,9 @@
|
|
|
4962db3 |
.B getpidcon
|
|
|
4962db3 |
returns the process context for the specified PID.
|
|
|
4962db3 |
|
|
|
4962db3 |
+.B getpeercon
|
|
|
4962db3 |
+retrieves context of peer socket, and set *context to refer to it, which must be free'd with freecon.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
.SH "RETURN VALUE"
|
|
|
4962db3 |
On error -1 is returned. On success 0 is returned.
|
|
|
4962db3 |
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/get_default_context_with_role.3 libselinux-1.19.1/man/man3/get_default_context_with_role.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/get_default_context_with_role.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/get_default_context_with_role.3 2004-11-18 15:27:01.043556258 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/get_ordered_context_list.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/getexeccon.3 libselinux-1.19.1/man/man3/getexeccon.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/getexeccon.3 2004-10-20 16:31:36.000000000 -0400
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/getexeccon.3 2004-11-18 15:27:01.044556145 -0500
|
|
|
4962db3 |
@@ -8,6 +8,8 @@
|
|
|
4962db3 |
.BI "int getexeccon(security_context_t *" context );
|
|
|
4962db3 |
.br
|
|
|
4962db3 |
.BI "int setexeccon(security_context_t "context );
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.BI "int rpm_execcon(unsigned int " verified ", const char *" filename ", char *const " argv "[] , char *const " envp "[]);
|
|
|
4962db3 |
|
|
|
4962db3 |
.SH "DESCRIPTION"
|
|
|
4962db3 |
.B getexeccon
|
|
|
4962db3 |
@@ -31,6 +33,11 @@
|
|
|
4962db3 |
|
|
|
4962db3 |
Note: Signal handlers that perform an execve must take care to
|
|
|
4962db3 |
save, reset, and restore the exec context to avoid unexpected behaviors.
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.B rpm_execcon
|
|
|
4962db3 |
+Execute a helper for rpm in an appropriate security context.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
.SH "RETURN VALUE"
|
|
|
4962db3 |
On error -1 is returned.
|
|
|
4962db3 |
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/get_ordered_context_list.3 libselinux-1.19.1/man/man3/get_ordered_context_list.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/get_ordered_context_list.3 2004-10-20 16:31:36.000000000 -0400
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/get_ordered_context_list.3 2004-11-18 15:27:01.045556032 -0500
|
|
|
4962db3 |
@@ -1,6 +1,6 @@
|
|
|
4962db3 |
.TH "get_ordered_context_list" "3" "1 January 2004" "russell@coker.com.au" "SE Linux API documentation"
|
|
|
4962db3 |
.SH "NAME"
|
|
|
4962db3 |
-get_ordered_context_list, get_default_context, query_user_context \- determine context(s) for user login sessions
|
|
|
4962db3 |
+get_ordered_context_list, get_default_context, query_user_context, manual_user_enter_context, get_default_context_with_role, get_default_role \- determine context(s) for user login sessions
|
|
|
4962db3 |
|
|
|
4962db3 |
.SH "SYNOPSIS"
|
|
|
4962db3 |
.B #include <selinux/selinux.h>
|
|
|
4962db3 |
@@ -14,7 +14,10 @@
|
|
|
4962db3 |
.BI "int query_user_context(security_context_t *" list ", security_context_t *" newcon );
|
|
|
4962db3 |
.sp
|
|
|
4962db3 |
.BI "int manual_user_enter_context(const char *" user ", security_context_t *" newcon );
|
|
|
4962db3 |
-
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+.BI "int get_default_type(const char *" role ", char **" type );
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+.BI "int get_default_context_with_role(const char* " user ", const char *" role ", security_context_t " fromcon ", security_context_t *" newcon ");
|
|
|
4962db3 |
|
|
|
4962db3 |
.SH "DESCRIPTION"
|
|
|
4962db3 |
.B get_ordered_context_list
|
|
|
4962db3 |
@@ -40,6 +43,15 @@
|
|
|
4962db3 |
allows the user to manually enter a context as a fallback if a list of
|
|
|
4962db3 |
authorized contexts could not be obtained. Caller must free via freecon.
|
|
|
4962db3 |
|
|
|
4962db3 |
+.B get_default_type
|
|
|
4962db3 |
+Get the default type (domain) for 'role' and set 'type' to refer to it.
|
|
|
4962db3 |
+ Caller must free via free().
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.B get_default_context_with_role
|
|
|
4962db3 |
+Given a list of authorized security contexts for the user,
|
|
|
4962db3 |
+ query the user to select one and set *newcon to refer to it.
|
|
|
4962db3 |
+ Caller must free via freecon.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
.SH "RETURN VALUE"
|
|
|
4962db3 |
0 for success and on error -1 is returned.
|
|
|
4962db3 |
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/getpeercon.3 libselinux-1.19.1/man/man3/getpeercon.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/getpeercon.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/getpeercon.3 2004-11-18 15:27:01.046555919 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/getcon.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/matchmediacon.3 libselinux-1.19.1/man/man3/matchmediacon.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/matchmediacon.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/matchmediacon.3 2004-11-18 15:27:01.047555807 -0500
|
|
|
4962db3 |
@@ -0,0 +1,26 @@
|
|
|
4962db3 |
+.TH "matchmediacon" "3" "15 November 2004" "dwalsh@redhat.com" "SE Linux API documentation"
|
|
|
4962db3 |
+.SH "NAME"
|
|
|
4962db3 |
+matchmediacon \- get the default security context for the specified mediatype from the policy.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH "SYNOPSIS"
|
|
|
4962db3 |
+.B #include <selinux/selinux.h>
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+.BI "int matchmediacon(const char *" media ", security_context_t *" con);"
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH "DESCRIPTION"
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.B matchmediacon
|
|
|
4962db3 |
+matches the specified media type with the file contexts configuration and sets the security context "con" to refer to the resulting context.
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+.B Note:
|
|
|
4962db3 |
+ Caller must free returned security context "con" using freecon.
|
|
|
4962db3 |
+.SH "RETURN VALUE"
|
|
|
4962db3 |
+Returns 0 on success or -1 otherwise.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH Files
|
|
|
4962db3 |
+/etc/selinux/POLICYTYPE/contexts/files/media
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH "SEE ALSO"
|
|
|
4962db3 |
+.BR freecon "(3)
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/matchpathcon.3 libselinux-1.19.1/man/man3/matchpathcon.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/matchpathcon.3 2004-10-20 16:31:36.000000000 -0400
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/matchpathcon.3 2004-11-18 15:27:01.049555581 -0500
|
|
|
4962db3 |
@@ -5,17 +5,22 @@
|
|
|
4962db3 |
.SH "SYNOPSIS"
|
|
|
4962db3 |
.B #include <selinux/selinux.h>
|
|
|
4962db3 |
.sp
|
|
|
4962db3 |
-.BI "int matchpathcon(const char *" path ", mode_t " mode ", security_context_t *" con);"
|
|
|
4962db3 |
+.BI "int matchpathcon(const char *" path ", mode_t " mode ", security_context_t *" con);
|
|
|
4962db3 |
.br
|
|
|
4962db3 |
+.BI "void set_matchpathcon_printf(void (*f)(const char *fmt, ...));"
|
|
|
4962db3 |
|
|
|
4962db3 |
.SH "DESCRIPTION"
|
|
|
4962db3 |
.br
|
|
|
4962db3 |
.B matchpathcon
|
|
|
4962db3 |
matches the specified pathname and mode against the file contexts configuration and sets the security context "con" to refer to the resulting context. "mode" can be 0 to disable mode matching, but should be provided whenever possible, as it may affect the matching.
|
|
|
4962db3 |
-.sp
|
|
|
4962db3 |
-.br
|
|
|
4962db3 |
.B Note:
|
|
|
4962db3 |
Caller must free returned security context "con" using freecon.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.B set_matchpathcon_printf
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+Set the function used by matchpathcon when displaying errors about the file_contexts configuration. If not set, then this defaults to fprintf(stderr, fmt, ...).
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
.SH "RETURN VALUE"
|
|
|
4962db3 |
Returns 0 on success or -1 otherwise.
|
|
|
4962db3 |
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/rpm_execcon.3 libselinux-1.19.1/man/man3/rpm_execcon.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/rpm_execcon.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/rpm_execcon.3 2004-11-18 15:27:01.050555468 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/getexeccon.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/security_commit_booleans.3 libselinux-1.19.1/man/man3/security_commit_booleans.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/security_commit_booleans.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/security_commit_booleans.3 2004-11-18 15:27:01.051555355 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/security_load_booleans.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/security_compute_av.3 libselinux-1.19.1/man/man3/security_compute_av.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/security_compute_av.3 2004-10-20 16:31:36.000000000 -0400
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/security_compute_av.3 2004-11-18 15:27:01.052555242 -0500
|
|
|
4962db3 |
@@ -15,6 +15,8 @@
|
|
|
4962db3 |
.BI "int security_compute_relabel(security_context_t "scon ", security_context_t "tcon ", security_class_t "tclass ", security_context_t *" newcon );
|
|
|
4962db3 |
.sp
|
|
|
4962db3 |
.BI "int security_compute_user(security_context_t "scon ", const char *" username ", security_context_t **" con );
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+.BI "int checkPasswdAccess(access_vector_t " requested );
|
|
|
4962db3 |
|
|
|
4962db3 |
.SH "DESCRIPTION"
|
|
|
4962db3 |
.B security_compute_av
|
|
|
4962db3 |
@@ -42,6 +44,9 @@
|
|
|
4962db3 |
source context. Is mainly used by
|
|
|
4962db3 |
.B get_ordered_context_list.
|
|
|
4962db3 |
|
|
|
4962db3 |
+.B checkPasswdAccess
|
|
|
4962db3 |
+This functions is a helper functions that allows you to check for a permission in the passwd class.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
.SH "RETURN VALUE"
|
|
|
4962db3 |
0 for success and on error -1 is returned.
|
|
|
4962db3 |
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/security_get_boolean_active.3 libselinux-1.19.1/man/man3/security_get_boolean_active.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/security_get_boolean_active.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/security_get_boolean_active.3 2004-11-18 15:27:01.053555130 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/security_load_booleans.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/security_get_boolean_names.3 libselinux-1.19.1/man/man3/security_get_boolean_names.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/security_get_boolean_names.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/security_get_boolean_names.3 2004-11-18 15:27:01.055554904 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/security_load_booleans.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/security_get_boolean_pending.3 libselinux-1.19.1/man/man3/security_get_boolean_pending.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/security_get_boolean_pending.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/security_get_boolean_pending.3 2004-11-18 15:27:01.056554791 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/security_load_booleans.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/security_load_booleans.3 libselinux-1.19.1/man/man3/security_load_booleans.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/security_load_booleans.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/security_load_booleans.3 2004-11-18 15:27:01.057554678 -0500
|
|
|
4962db3 |
@@ -0,0 +1,69 @@
|
|
|
4962db3 |
+.TH "security_get_boolean_names" "3" "15 November 2004" "dwalsh@redhat.com" "SELinux API Documentation"
|
|
|
4962db3 |
+.SH "NAME"
|
|
|
4962db3 |
+security_load_booleans, security_set_boolean, security_commit_booleans,
|
|
|
4962db3 |
+security_get_boolean_names, security_get_boolean_active, security_get_boolean_pending
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+routines for manipulating SELinux boolean values
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH "SYNOPSIS"
|
|
|
4962db3 |
+.B #include <selinux/selinux.h>
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+extern int security_load_booleans(char *path);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern int security_get_boolean_names(char ***names, int *len);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern int security_get_boolean_pending(const char *name);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern int security_get_boolean_active(const char *name);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern int security_set_boolean(const char *name, int value);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern int security_commit_booleans(void);
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH "DESCRIPTION"
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+The SELinux policy can include conditional rules that are enabled or
|
|
|
4962db3 |
+disabled based on the current values of a set of policy booleans.
|
|
|
4962db3 |
+These policy booleans allow runtime modification of the security
|
|
|
4962db3 |
+policy without having to load a new policy.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+The SELinux API allows for a transaction based update. So you can set several boolean values and the commit them all at once.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+security_load_booleans
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Load policy boolean settings.
|
|
|
4962db3 |
+ Path may be NULL, in which case the booleans are loaded from
|
|
|
4962db3 |
+ the active policy boolean configuration file.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+security_get_boolean_names
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Returns a list of boolean names, currently supported by the loaded policy.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+security_get_boolean_pending
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Return pending value for boolean
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+security_get_boolean_active
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Return active value for boolean
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+security_set_boolean
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Set the pending value for the boolean
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+security_commit_booleans
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Commit all pending values for the booleans.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+security_set_boolean
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+sets the current state of a particular SELinux boolean or a list of booleans
|
|
|
4962db3 |
+to a given value. The value may be 1 or true to enable the boolean, or 0 or
|
|
|
4962db3 |
+false to disable it.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH AUTHOR
|
|
|
4962db3 |
+This manual page was written by Dan Walsh <dwalsh@redhat.com>.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH "SEE ALSO"
|
|
|
4962db3 |
+getsebool(8), booleans(8), togglesebool(8)
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/security_set_boolean.3 libselinux-1.19.1/man/man3/security_set_boolean.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/security_set_boolean.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/security_set_boolean.3 2004-11-18 15:27:01.059554453 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/security_load_booleans.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/selinux_binary_policy_path.3 libselinux-1.19.1/man/man3/selinux_binary_policy_path.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/selinux_binary_policy_path.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/selinux_binary_policy_path.3 2004-11-18 15:27:01.060554340 -0500
|
|
|
4962db3 |
@@ -0,0 +1,75 @@
|
|
|
4962db3 |
+.TH "security_get_boolean_names" "3" "15 November 2004" "dwalsh@redhat.com" "SELinux API Documentation"
|
|
|
4962db3 |
+.SH "NAME"
|
|
|
4962db3 |
+selinux_binary_policy_path,selinux_failsafe_context_path,selinux_removable_context_path,selinux_default_context_path, selinux_user_contexts_path, selinux_file_context_path, selinux_media_context_path, selinux_contexts_path, selinux_booleans_path
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+These functions return the paths to specific files under the
|
|
|
4962db3 |
+ policy root directory.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH "SYNOPSIS"
|
|
|
4962db3 |
+.B #include <selinux/selinux.h>
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern const char *selinux_binary_policy_path(void);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern const char *selinux_failsafe_context_path(void);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern const char *selinux_removable_context_path(void);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern const char *selinux_default_context_path(void);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern const char *selinux_user_contexts_path(void);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern const char *selinux_file_context_path(void);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern const char *selinux_media_context_path(void);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern const char *selinux_contexts_path(void);
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+extern const char *selinux_booleans_path(void);
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH "DESCRIPTION"
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+These functions return the paths to specific files under the
|
|
|
4962db3 |
+ policy root directory.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+selinux_binary_policy_path
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Default Binary Policy
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+selinux_failsafe_context_path
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Default failsafe context file
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+selinux_removable_context_path
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Default removeable context file
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+selinux_default_context_path
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Default context used by login programs and daemons that assume user roles.
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+selinux_user_contexts_path
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Default user context file; used by login programs for default login context
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+selinux_file_context_path
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Default file context file used restorecon
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+selinux_media_context_path
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Default media context file use to set contexts on media devices (cdrom, floppies)
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+selinux_contexts_path
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Parent directory of context files
|
|
|
4962db3 |
+.sp
|
|
|
4962db3 |
+selinux_booleans_path
|
|
|
4962db3 |
+.br
|
|
|
4962db3 |
+Boolean file path, used by boolean manipulation tools
|
|
|
4962db3 |
+
|
|
|
4962db3 |
+.SH AUTHOR
|
|
|
4962db3 |
+This manual page was written by Dan Walsh <dwalsh@redhat.com>.
|
|
|
4962db3 |
+
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/selinux_booleans_path.3 libselinux-1.19.1/man/man3/selinux_booleans_path.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/selinux_booleans_path.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/selinux_booleans_path.3 2004-11-18 15:27:01.061554227 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/selinux_binary_policy_path.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/selinux_contexts_path.3 libselinux-1.19.1/man/man3/selinux_contexts_path.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/selinux_contexts_path.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/selinux_contexts_path.3 2004-11-18 15:27:01.062554114 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/selinux_binary_policy_path.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/selinux_default_context_path.3 libselinux-1.19.1/man/man3/selinux_default_context_path.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/selinux_default_context_path.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/selinux_default_context_path.3 2004-11-18 15:27:01.064553889 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/selinux_binary_policy_path.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/selinux_failsafe_context_path.3 libselinux-1.19.1/man/man3/selinux_failsafe_context_path.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/selinux_failsafe_context_path.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/selinux_failsafe_context_path.3 2004-11-18 15:27:01.065553776 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/selinux_binary_policy_path.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/selinux_file_context_path.3 libselinux-1.19.1/man/man3/selinux_file_context_path.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/selinux_file_context_path.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/selinux_file_context_path.3 2004-11-18 15:27:01.066553663 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/selinux_binary_policy_path.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/selinux_media_context_path.3 libselinux-1.19.1/man/man3/selinux_media_context_path.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/selinux_media_context_path.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/selinux_media_context_path.3 2004-11-18 15:27:01.067553550 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/selinux_binary_policy_path.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/selinux_removable_context_path.3 libselinux-1.19.1/man/man3/selinux_removable_context_path.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/selinux_removable_context_path.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/selinux_removable_context_path.3 2004-11-18 15:27:01.072552986 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/selinux_binary_policy_path.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/selinux_user_contexts_path.3 libselinux-1.19.1/man/man3/selinux_user_contexts_path.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/selinux_user_contexts_path.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/selinux_user_contexts_path.3 2004-11-18 15:27:01.073552873 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/selinux_binary_policy_path.3
|
|
|
4962db3 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/set_matchpathcon_printf.3 libselinux-1.19.1/man/man3/set_matchpathcon_printf.3
|
|
|
4962db3 |
--- nsalibselinux/man/man3/set_matchpathcon_printf.3 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man3/set_matchpathcon_printf.3 2004-11-18 15:27:01.075552648 -0500
|
|
|
4962db3 |
@@ -0,0 +1 @@
|
|
|
4962db3 |
+.so man3/matchpathcon.3
|
|
|
6864134 |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man8/avcstat.8 libselinux-1.19.1/man/man8/avcstat.8
|
|
|
6864134 |
--- nsalibselinux/man/man8/avcstat.8 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man8/avcstat.8 2004-11-18 16:28:55.008507362 -0500
|
|
|
6864134 |
@@ -0,0 +1,28 @@
|
|
|
6864134 |
+.TH "avcstat" "8" "18 Nov 2004" "dwalsh@redhat.com" "SELinux Command Line documentation"
|
|
|
6864134 |
+.SH "NAME"
|
|
|
6864134 |
+avcstat \- Display SELinux AVC statistics
|
|
|
6864134 |
+
|
|
|
6864134 |
+.SH "SYNOPSIS"
|
|
|
6864134 |
+.B avcstat
|
|
|
6864134 |
+.I [-c] [-f status_file] [interval]
|
|
|
6864134 |
+
|
|
|
6864134 |
+.SH "DESCRIPTION"
|
|
|
6864134 |
+.B avcstat
|
|
|
6864134 |
+
|
|
|
6864134 |
+Display SELinux AVC statistics. If the interval parameter is specified, the
|
|
|
6864134 |
+program will loop, displaying updated statistics every 'interval' seconds.
|
|
|
6864134 |
+Relative values are displayed by default.
|
|
|
6864134 |
+
|
|
|
6864134 |
+.SH OPTIONS
|
|
|
6864134 |
+.TP
|
|
|
6864134 |
+.B \-c
|
|
|
6864134 |
+Display the cumulative values.
|
|
|
6864134 |
+
|
|
|
6864134 |
+.TP
|
|
|
6864134 |
+.B \-f
|
|
|
6864134 |
+Specifies the location of the AVC statistics file, defaulting to '/selinux/avc/cache_stats'.
|
|
|
6864134 |
+
|
|
|
6864134 |
+.SH AUTHOR
|
|
|
6864134 |
+This manual page was written by Dan Walsh <dwalsh@redhat.com>.
|
|
|
6864134 |
+The program was written by James Morris <jmorris@redhat.com>.
|
|
|
6864134 |
+
|
|
|
437c89f |
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man8/getsebool.8 libselinux-1.19.1/man/man8/getsebool.8
|
|
|
437c89f |
--- nsalibselinux/man/man8/getsebool.8 2004-11-02 14:26:19.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/man/man8/getsebool.8 2004-11-18 15:27:01.076552535 -0500
|
|
|
437c89f |
@@ -8,13 +8,12 @@
|
|
|
437c89f |
|
|
|
437c89f |
.SH "DESCRIPTION"
|
|
|
437c89f |
.B getsebool
|
|
|
437c89f |
-reports the current state of either a particular SELinux boolean or
|
|
|
437c89f |
-all SELinux booleans. The state consists of two values, the active
|
|
|
437c89f |
-value and the pending value. The active value indicates the value
|
|
|
437c89f |
-that is presently applied to the policy. The pending value indicates
|
|
|
437c89f |
+reports where a particular SELinux boolean or
|
|
|
437c89f |
+all SELinux booleans are active or inactive.
|
|
|
437c89f |
+In certain situations a boolean can be in one state with a pending
|
|
|
437c89f |
+change to the other state. getsebool will report this as a pending change.
|
|
|
437c89f |
+The pending value indicates
|
|
|
437c89f |
the value that will be applied upon the next boolean commit.
|
|
|
437c89f |
-Typically, these values will be the same; they only differ when in the
|
|
|
437c89f |
-middle of a boolean change transaction.
|
|
|
437c89f |
|
|
|
437c89f |
The setting of boolean values occurs in two stages; first the pending
|
|
|
437c89f |
value is changed, then the booleans are committed, causing their
|
|
|
6864134 |
diff --exclude-from=exclude -N -u -r nsalibselinux/utils/avcstat.c libselinux-1.19.1/utils/avcstat.c
|
|
|
6864134 |
--- nsalibselinux/utils/avcstat.c 1969-12-31 19:00:00.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/utils/avcstat.c 2004-11-18 16:19:13.230149764 -0500
|
|
|
6864134 |
@@ -0,0 +1,224 @@
|
|
|
6864134 |
+/*
|
|
|
6864134 |
+ * avcstat - Display SELinux avc statistics.
|
|
|
6864134 |
+ *
|
|
|
6864134 |
+ * Copyright (C) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
|
|
|
6864134 |
+ *
|
|
|
6864134 |
+ * This program is free software; you can redistribute it and/or modify
|
|
|
6864134 |
+ * it under the terms of the GNU General Public License version 2,
|
|
|
6864134 |
+ * as published by the Free Software Foundation.
|
|
|
6864134 |
+ *
|
|
|
6864134 |
+ */
|
|
|
6864134 |
+#include <stdio.h>
|
|
|
6864134 |
+#include <stdlib.h>
|
|
|
6864134 |
+#include <libgen.h>
|
|
|
6864134 |
+#include <stdarg.h>
|
|
|
6864134 |
+#include <errno.h>
|
|
|
6864134 |
+#include <string.h>
|
|
|
6864134 |
+#include <fcntl.h>
|
|
|
6864134 |
+#include <unistd.h>
|
|
|
6864134 |
+#include <signal.h>
|
|
|
6864134 |
+#include <sys/types.h>
|
|
|
6864134 |
+#include <sys/stat.h>
|
|
|
6864134 |
+#include <sys/ioctl.h>
|
|
|
6864134 |
+#include <linux/limits.h>
|
|
|
6864134 |
+
|
|
|
6864134 |
+#define DEF_STAT_FILE "/avc/cache_stats"
|
|
|
6864134 |
+#define DEF_BUF_SIZE 8192
|
|
|
6864134 |
+#define HEADERS "lookups hits misses allocations reclaims frees"
|
|
|
6864134 |
+
|
|
|
6864134 |
+struct avc_cache_stats {
|
|
|
6864134 |
+ unsigned int lookups;
|
|
|
6864134 |
+ unsigned int hits;
|
|
|
6864134 |
+ unsigned int misses;
|
|
|
6864134 |
+ unsigned int allocations;
|
|
|
6864134 |
+ unsigned int reclaims;
|
|
|
6864134 |
+ unsigned int frees;
|
|
|
6864134 |
+};
|
|
|
6864134 |
+
|
|
|
6864134 |
+static int interval;
|
|
|
6864134 |
+static int rows;
|
|
|
6864134 |
+static char *progname;
|
|
|
6864134 |
+static char buf[DEF_BUF_SIZE];
|
|
|
6864134 |
+
|
|
|
6864134 |
+/* selinuxfs mount point */
|
|
|
6864134 |
+extern char *selinux_mnt;
|
|
|
6864134 |
+
|
|
|
6864134 |
+
|
|
|
6864134 |
+static void die(const char *msg, ...)
|
|
|
6864134 |
+{
|
|
|
6864134 |
+ va_list args;
|
|
|
6864134 |
+
|
|
|
6864134 |
+ fputs("ERROR: ", stderr);
|
|
|
6864134 |
+
|
|
|
6864134 |
+ va_start(args, msg);
|
|
|
6864134 |
+ vfprintf(stderr, msg, args);
|
|
|
6864134 |
+ va_end(args);
|
|
|
6864134 |
+
|
|
|
6864134 |
+ if (errno)
|
|
|
6864134 |
+ fprintf(stderr, ": %s", strerror(errno));
|
|
|
6864134 |
+
|
|
|
6864134 |
+ fputc('\n', stderr);
|
|
|
6864134 |
+ exit(1);
|
|
|
6864134 |
+}
|
|
|
6864134 |
+
|
|
|
6864134 |
+static void usage(void)
|
|
|
6864134 |
+{
|
|
|
6864134 |
+ printf("\nUsage: %s [-c] [-f status_file] [interval]\n\n", progname);
|
|
|
6864134 |
+ printf("Display SELinux AVC statistics. If the interval parameter is specified, the\n");
|
|
|
6864134 |
+ printf("program will loop, displaying updated statistics every \'interval\' seconds.\n");
|
|
|
6864134 |
+ printf("Relative values are displayed by default. Use the -c option to specify the\n");
|
|
|
6864134 |
+ printf("display of cumulative values. The -f option specifies the location of the\n");
|
|
|
6864134 |
+ printf("AVC statistics file, defaulting to \'%s\%s\'.\n\n", selinux_mnt, DEF_STAT_FILE);
|
|
|
6864134 |
+}
|
|
|
6864134 |
+
|
|
|
6864134 |
+static void set_window_rows(void)
|
|
|
6864134 |
+{
|
|
|
6864134 |
+ int ret;
|
|
|
6864134 |
+ struct winsize ws;
|
|
|
6864134 |
+
|
|
|
6864134 |
+ ret = ioctl(fileno(stdout), TIOCGWINSZ, &ws);
|
|
|
6864134 |
+ if (ret < 0 || ws.ws_row < 3)
|
|
|
6864134 |
+ ws.ws_row = 24;
|
|
|
6864134 |
+ rows = ws.ws_row;
|
|
|
6864134 |
+}
|
|
|
6864134 |
+
|
|
|
6864134 |
+static void sighandler(int num)
|
|
|
6864134 |
+{
|
|
|
6864134 |
+ if (num == SIGWINCH)
|
|
|
6864134 |
+ set_window_rows();
|
|
|
6864134 |
+}
|
|
|
6864134 |
+
|
|
|
6864134 |
+int main(int argc, char **argv)
|
|
|
6864134 |
+{
|
|
|
6864134 |
+ int fd, i, cumulative = 0;
|
|
|
6864134 |
+ struct sigaction sa;
|
|
|
6864134 |
+ char avcstatfile[PATH_MAX];
|
|
|
6864134 |
+ snprintf(avcstatfile, sizeof avcstatfile, "%s%s", selinux_mnt, DEF_STAT_FILE);
|
|
|
6864134 |
+ progname = basename(argv[0]);
|
|
|
6864134 |
+
|
|
|
6864134 |
+ while((i = getopt(argc, argv, "cf:h?-")) != -1) {
|
|
|
6864134 |
+ switch (i) {
|
|
|
6864134 |
+ case 'c':
|
|
|
6864134 |
+ cumulative = 1;
|
|
|
6864134 |
+ break;
|
|
|
6864134 |
+ case 'f':
|
|
|
6864134 |
+ strncpy(avcstatfile, optarg, sizeof avcstatfile);
|
|
|
6864134 |
+ break;
|
|
|
6864134 |
+ case 'h':
|
|
|
6864134 |
+ case '-':
|
|
|
6864134 |
+ usage();
|
|
|
6864134 |
+ exit(0);
|
|
|
6864134 |
+ default:
|
|
|
6864134 |
+ usage();
|
|
|
6864134 |
+ die("unrecognized parameter", i);
|
|
|
6864134 |
+ }
|
|
|
6864134 |
+ }
|
|
|
6864134 |
+
|
|
|
6864134 |
+ if (optind < argc) {
|
|
|
6864134 |
+ char *arg = argv[optind];
|
|
|
6864134 |
+ unsigned int n = strtoul(arg, NULL, 10);
|
|
|
6864134 |
+
|
|
|
6864134 |
+ if (errno == ERANGE) {
|
|
|
6864134 |
+ usage();
|
|
|
6864134 |
+ die("invalid interval \'%s\'", arg);
|
|
|
6864134 |
+ }
|
|
|
6864134 |
+ if (n == 0) {
|
|
|
6864134 |
+ usage();
|
|
|
6864134 |
+ exit (0);
|
|
|
6864134 |
+ }
|
|
|
6864134 |
+ interval = n;
|
|
|
6864134 |
+ }
|
|
|
6864134 |
+
|
|
|
6864134 |
+ sa.sa_handler = sighandler;
|
|
|
6864134 |
+ sa.sa_flags = SA_RESTART;
|
|
|
6864134 |
+
|
|
|
6864134 |
+ i = sigaction(SIGWINCH, &sa, NULL);
|
|
|
6864134 |
+ if (i < 0)
|
|
|
6864134 |
+ die("sigaction");
|
|
|
6864134 |
+
|
|
|
6864134 |
+ set_window_rows();
|
|
|
6864134 |
+ fd = open(avcstatfile, O_RDONLY);
|
|
|
6864134 |
+ if (fd < 0)
|
|
|
6864134 |
+ die("open: \'%s\'", avcstatfile);
|
|
|
6864134 |
+
|
|
|
6864134 |
+ for (i = 0;; i++) {
|
|
|
6864134 |
+ char *line;
|
|
|
6864134 |
+ ssize_t ret, parsed = 0;
|
|
|
6864134 |
+ struct avc_cache_stats tot, rel, last;
|
|
|
6864134 |
+
|
|
|
6864134 |
+ memset(buf, 0, DEF_BUF_SIZE);
|
|
|
6864134 |
+ ret = read(fd, buf, DEF_BUF_SIZE);
|
|
|
6864134 |
+ if (ret < 0)
|
|
|
6864134 |
+ die("read");
|
|
|
6864134 |
+
|
|
|
6864134 |
+ if (ret == 0)
|
|
|
6864134 |
+ die("read: \'%s\': unexpected end of file", avcstatfile);
|
|
|
6864134 |
+
|
|
|
6864134 |
+ line = strtok(buf, "\n");
|
|
|
6864134 |
+ if (!line)
|
|
|
6864134 |
+ die("unable to parse \'%s\': end of line not found", avcstatfile);
|
|
|
6864134 |
+
|
|
|
6864134 |
+ if (strcmp(line, HEADERS))
|
|
|
6864134 |
+ die("unable to parse \'%s\': invalid headers", avcstatfile);
|
|
|
6864134 |
+
|
|
|
6864134 |
+ if (!i || !(i % (rows - 2)))
|
|
|
6864134 |
+ printf("%10s %10s %10s %10s %10s %10s\n", "lookups",
|
|
|
6864134 |
+ "hits", "misses", "allocs", "reclaims", "frees");
|
|
|
6864134 |
+
|
|
|
6864134 |
+ memset(&tot, 0, sizeof(tot));
|
|
|
6864134 |
+
|
|
|
6864134 |
+ while ((line = strtok(NULL, "\n"))) {
|
|
|
6864134 |
+ struct avc_cache_stats tmp;
|
|
|
6864134 |
+
|
|
|
6864134 |
+ ret = sscanf(line, "%u %u %u %u %u %u",
|
|
|
6864134 |
+ &tmp.lookups,
|
|
|
6864134 |
+ &tmp.hits,
|
|
|
6864134 |
+ &tmp.misses,
|
|
|
6864134 |
+ &tmp.allocations,
|
|
|
6864134 |
+ &tmp.reclaims,
|
|
|
6864134 |
+ &tmp.frees);
|
|
|
6864134 |
+ if (ret != 6)
|
|
|
6864134 |
+ die("unable to parse \'%s\': scan error", avcstatfile);
|
|
|
6864134 |
+
|
|
|
6864134 |
+ tot.lookups += tmp.lookups;
|
|
|
6864134 |
+ tot.hits += tmp.hits;
|
|
|
6864134 |
+ tot.misses += tmp.misses;
|
|
|
6864134 |
+ tot.allocations += tmp.allocations;
|
|
|
6864134 |
+ tot.reclaims += tmp.reclaims;
|
|
|
6864134 |
+ tot.frees += tmp.frees;
|
|
|
6864134 |
+ parsed = 1;
|
|
|
6864134 |
+ }
|
|
|
6864134 |
+
|
|
|
6864134 |
+ if (!parsed)
|
|
|
6864134 |
+ die("unable to parse \'%s\': no data", avcstatfile);
|
|
|
6864134 |
+
|
|
|
6864134 |
+ if (cumulative || (!cumulative && !i))
|
|
|
6864134 |
+ printf("%10u %10u %10u %10u %10u %10u\n",
|
|
|
6864134 |
+ tot.lookups, tot.hits, tot.misses,
|
|
|
6864134 |
+ tot.allocations, tot.reclaims, tot.frees);
|
|
|
6864134 |
+ else {
|
|
|
6864134 |
+ rel.lookups = tot.lookups - last.lookups;
|
|
|
6864134 |
+ rel.hits = tot.hits - last.hits;
|
|
|
6864134 |
+ rel.misses = tot.misses - last.misses;
|
|
|
6864134 |
+ rel.allocations = tot.allocations - last.allocations;
|
|
|
6864134 |
+ rel.reclaims = tot.reclaims - last.reclaims;
|
|
|
6864134 |
+ rel.frees = tot.frees - last.frees;
|
|
|
6864134 |
+ printf("%10u %10u %10u %10u %10u %10u\n",
|
|
|
6864134 |
+ rel.lookups, rel.hits, rel.misses,
|
|
|
6864134 |
+ rel.allocations, rel.reclaims, rel.frees);
|
|
|
6864134 |
+ }
|
|
|
6864134 |
+
|
|
|
6864134 |
+ if (!interval)
|
|
|
6864134 |
+ break;
|
|
|
6864134 |
+
|
|
|
6864134 |
+ memcpy(&last, &tot, sizeof(last));
|
|
|
6864134 |
+ sleep(interval);
|
|
|
6864134 |
+
|
|
|
6864134 |
+ ret = lseek(fd, 0, 0);
|
|
|
6864134 |
+ if (ret < 0)
|
|
|
6864134 |
+ die("lseek");
|
|
|
6864134 |
+ }
|
|
|
6864134 |
+
|
|
|
6864134 |
+ close(fd);
|
|
|
6864134 |
+ return 0;
|
|
|
6864134 |
+}
|
|
|
437c89f |
diff --exclude-from=exclude -N -u -r nsalibselinux/utils/getsebool.c libselinux-1.19.1/utils/getsebool.c
|
|
|
437c89f |
--- nsalibselinux/utils/getsebool.c 2004-11-09 09:13:54.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/utils/getsebool.c 2004-11-18 15:27:01.077552422 -0500
|
|
|
437c89f |
@@ -83,8 +83,14 @@
|
|
|
437c89f |
rc = -1;
|
|
|
437c89f |
goto out;
|
|
|
437c89f |
}
|
|
|
437c89f |
- printf("%s --> active: %d pending: %d\n", names[i],
|
|
|
437c89f |
- active, pending);
|
|
|
437c89f |
+ if (pending != active) {
|
|
|
437c89f |
+ printf("%s --> %s pending: %s\n", names[i],
|
|
|
437c89f |
+ ( active ? "active" : "inactive"),
|
|
|
437c89f |
+ ( pending ? "active" : "inactive"));
|
|
|
437c89f |
+ } else {
|
|
|
437c89f |
+ printf("%s --> %s\n", names[i],
|
|
|
437c89f |
+ ( active ? "active" : "inactive"));
|
|
|
437c89f |
+ }
|
|
|
437c89f |
}
|
|
|
437c89f |
|
|
|
437c89f |
out:
|
|
|
437c89f |
diff --exclude-from=exclude -N -u -r nsalibselinux/utils/setsebool.c libselinux-1.19.1/utils/setsebool.c
|
|
|
437c89f |
--- nsalibselinux/utils/setsebool.c 2004-11-09 09:13:54.000000000 -0500
|
|
|
6864134 |
+++ libselinux-1.19.1/utils/setsebool.c 2004-11-18 15:27:01.078552309 -0500
|
|
|
38be80f |
@@ -35,6 +35,8 @@
|
|
|
38be80f |
|
|
|
38be80f |
if (strcmp(argv[1], "-P") == 0) {
|
|
|
38be80f |
permanent = 1;
|
|
|
38be80f |
+ if (argc < 3)
|
|
|
38be80f |
+ usage();
|
|
|
38be80f |
start = 2;
|
|
|
828726c |
}
|
|
|
38be80f |
else
|