--- libselinux-1.19.1/include/selinux/selinux.h.rhat 2004-11-09 09:14:24.000000000 -0500 +++ libselinux-1.19.1/include/selinux/selinux.h 2004-11-19 11:21:37.514236820 -0500 @@ -176,7 +176,7 @@ /* Match the specified media and against the media contexts configuration and set *con to refer to the resulting context. Caller must free con via freecon. */ -extern int matchmediacon(const char *path, +extern int matchmediacon(const char *media, security_context_t *con); /* --- libselinux-1.19.1/utils/setsebool.c.rhat 2004-11-09 09:14:24.000000000 -0500 +++ libselinux-1.19.1/utils/setsebool.c 2004-11-19 11:21:37.560231630 -0500 @@ -35,6 +35,8 @@ if (strcmp(argv[1], "-P") == 0) { permanent = 1; + if (argc < 3) + usage(); start = 2; } else --- libselinux-1.19.1/utils/getsebool.c.rhat 2004-11-09 09:14:24.000000000 -0500 +++ libselinux-1.19.1/utils/getsebool.c 2004-11-19 11:21:37.559231743 -0500 @@ -83,8 +83,14 @@ rc = -1; goto out; } - printf("%s --> active: %d pending: %d\n", names[i], - active, pending); + if (pending != active) { + printf("%s --> %s pending: %s\n", names[i], + ( active ? "active" : "inactive"), + ( pending ? "active" : "inactive")); + } else { + printf("%s --> %s\n", names[i], + ( active ? "active" : "inactive")); + } } out: --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/utils/avcstat.c 2004-11-19 11:21:37.558231856 -0500 @@ -0,0 +1,224 @@ +/* + * avcstat - Display SELinux avc statistics. + * + * Copyright (C) 2004 Red Hat, Inc., James Morris + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2, + * as published by the Free Software Foundation. + * + */ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define DEF_STAT_FILE "/avc/cache_stats" +#define DEF_BUF_SIZE 8192 +#define HEADERS "lookups hits misses allocations reclaims frees" + +struct avc_cache_stats { + unsigned int lookups; + unsigned int hits; + unsigned int misses; + unsigned int allocations; + unsigned int reclaims; + unsigned int frees; +}; + +static int interval; +static int rows; +static char *progname; +static char buf[DEF_BUF_SIZE]; + +/* selinuxfs mount point */ +extern char *selinux_mnt; + + +static void die(const char *msg, ...) +{ + va_list args; + + fputs("ERROR: ", stderr); + + va_start(args, msg); + vfprintf(stderr, msg, args); + va_end(args); + + if (errno) + fprintf(stderr, ": %s", strerror(errno)); + + fputc('\n', stderr); + exit(1); +} + +static void usage(void) +{ + printf("\nUsage: %s [-c] [-f status_file] [interval]\n\n", progname); + printf("Display SELinux AVC statistics. If the interval parameter is specified, the\n"); + printf("program will loop, displaying updated statistics every \'interval\' seconds.\n"); + printf("Relative values are displayed by default. Use the -c option to specify the\n"); + printf("display of cumulative values. The -f option specifies the location of the\n"); + printf("AVC statistics file, defaulting to \'%s\%s\'.\n\n", selinux_mnt, DEF_STAT_FILE); +} + +static void set_window_rows(void) +{ + int ret; + struct winsize ws; + + ret = ioctl(fileno(stdout), TIOCGWINSZ, &ws); + if (ret < 0 || ws.ws_row < 3) + ws.ws_row = 24; + rows = ws.ws_row; +} + +static void sighandler(int num) +{ + if (num == SIGWINCH) + set_window_rows(); +} + +int main(int argc, char **argv) +{ + int fd, i, cumulative = 0; + struct sigaction sa; + char avcstatfile[PATH_MAX]; + snprintf(avcstatfile, sizeof avcstatfile, "%s%s", selinux_mnt, DEF_STAT_FILE); + progname = basename(argv[0]); + + while((i = getopt(argc, argv, "cf:h?-")) != -1) { + switch (i) { + case 'c': + cumulative = 1; + break; + case 'f': + strncpy(avcstatfile, optarg, sizeof avcstatfile); + break; + case 'h': + case '-': + usage(); + exit(0); + default: + usage(); + die("unrecognized parameter", i); + } + } + + if (optind < argc) { + char *arg = argv[optind]; + unsigned int n = strtoul(arg, NULL, 10); + + if (errno == ERANGE) { + usage(); + die("invalid interval \'%s\'", arg); + } + if (n == 0) { + usage(); + exit (0); + } + interval = n; + } + + sa.sa_handler = sighandler; + sa.sa_flags = SA_RESTART; + + i = sigaction(SIGWINCH, &sa, NULL); + if (i < 0) + die("sigaction"); + + set_window_rows(); + fd = open(avcstatfile, O_RDONLY); + if (fd < 0) + die("open: \'%s\'", avcstatfile); + + for (i = 0;; i++) { + char *line; + ssize_t ret, parsed = 0; + struct avc_cache_stats tot, rel, last; + + memset(buf, 0, DEF_BUF_SIZE); + ret = read(fd, buf, DEF_BUF_SIZE); + if (ret < 0) + die("read"); + + if (ret == 0) + die("read: \'%s\': unexpected end of file", avcstatfile); + + line = strtok(buf, "\n"); + if (!line) + die("unable to parse \'%s\': end of line not found", avcstatfile); + + if (strcmp(line, HEADERS)) + die("unable to parse \'%s\': invalid headers", avcstatfile); + + if (!i || !(i % (rows - 2))) + printf("%10s %10s %10s %10s %10s %10s\n", "lookups", + "hits", "misses", "allocs", "reclaims", "frees"); + + memset(&tot, 0, sizeof(tot)); + + while ((line = strtok(NULL, "\n"))) { + struct avc_cache_stats tmp; + + ret = sscanf(line, "%u %u %u %u %u %u", + &tmp.lookups, + &tmp.hits, + &tmp.misses, + &tmp.allocations, + &tmp.reclaims, + &tmp.frees); + if (ret != 6) + die("unable to parse \'%s\': scan error", avcstatfile); + + tot.lookups += tmp.lookups; + tot.hits += tmp.hits; + tot.misses += tmp.misses; + tot.allocations += tmp.allocations; + tot.reclaims += tmp.reclaims; + tot.frees += tmp.frees; + parsed = 1; + } + + if (!parsed) + die("unable to parse \'%s\': no data", avcstatfile); + + if (cumulative || (!cumulative && !i)) + printf("%10u %10u %10u %10u %10u %10u\n", + tot.lookups, tot.hits, tot.misses, + tot.allocations, tot.reclaims, tot.frees); + else { + rel.lookups = tot.lookups - last.lookups; + rel.hits = tot.hits - last.hits; + rel.misses = tot.misses - last.misses; + rel.allocations = tot.allocations - last.allocations; + rel.reclaims = tot.reclaims - last.reclaims; + rel.frees = tot.frees - last.frees; + printf("%10u %10u %10u %10u %10u %10u\n", + rel.lookups, rel.hits, rel.misses, + rel.allocations, rel.reclaims, rel.frees); + } + + if (!interval) + break; + + memcpy(&last, &tot, sizeof(last)); + sleep(interval); + + ret = lseek(fd, 0, 0); + if (ret < 0) + die("lseek"); + } + + close(fd); + return 0; +} --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/rpm_execcon.3 2004-11-19 11:21:37.534234563 -0500 @@ -0,0 +1 @@ +.so man3/getexeccon.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/selinux_media_context_path.3 2004-11-19 11:21:37.551232645 -0500 @@ -0,0 +1 @@ +.so man3/selinux_binary_policy_path.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/context_user_get.3 2004-11-19 11:21:37.524235691 -0500 @@ -0,0 +1 @@ +.so man3/context_new.3 --- libselinux-1.19.1/man/man3/getcon.3.rhat 2004-11-09 09:14:24.000000000 -0500 +++ libselinux-1.19.1/man/man3/getcon.3 2004-11-19 11:21:37.526235466 -0500 @@ -8,7 +8,9 @@ .br .BI "int getprevcon(security_context_t *" context ); .br -.BI "int getpidcon(pid_t pid, security_context_t *" context ); +.BI "int getpidcon(pid_t " pid ", security_context_t *" context ); +.br +.BI "int getpeercon(int " fd ", security_context_t *" context); .SH "DESCRIPTION" .B getcon @@ -21,6 +23,9 @@ .B getpidcon returns the process context for the specified PID. +.B getpeercon +retrieves context of peer socket, and set *context to refer to it, which must be free'd with freecon. + .SH "RETURN VALUE" On error -1 is returned. On success 0 is returned. --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/context_user_set.3 2004-11-19 11:21:37.525235579 -0500 @@ -0,0 +1 @@ +.so man3/context_new.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/getpeercon.3 2004-11-19 11:21:37.530235014 -0500 @@ -0,0 +1 @@ +.so man3/getcon.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/context_type_set.3 2004-11-19 11:21:37.523235804 -0500 @@ -0,0 +1 @@ +.so man3/context_new.3 --- libselinux-1.19.1/man/man3/get_ordered_context_list.3.rhat 2004-11-09 09:14:24.000000000 -0500 +++ libselinux-1.19.1/man/man3/get_ordered_context_list.3 2004-11-19 11:29:45.211209677 -0500 @@ -1,6 +1,6 @@ .TH "get_ordered_context_list" "3" "1 January 2004" "russell@coker.com.au" "SE Linux API documentation" .SH "NAME" -get_ordered_context_list, get_default_context, query_user_context \- determine context(s) for user login sessions +get_ordered_context_list, get_default_context, get_default_context_with_role, query_user_context, manual_user_enter_context, get_default_role \- determine context(s) for user login sessions .SH "SYNOPSIS" .B #include @@ -11,10 +11,13 @@ .sp .BI "int get_default_context(const char *" user ", security_context_t "fromcon ", security_context_t *" newcon ); .sp +.BI "int get_default_context_with_role(const char* " user ", const char *" role ", security_context_t " fromcon ", security_context_t *" newcon "); +.sp .BI "int query_user_context(security_context_t *" list ", security_context_t *" newcon ); .sp .BI "int manual_user_enter_context(const char *" user ", security_context_t *" newcon ); - +.sp +.BI "int get_default_type(const char *" role ", char **" type ); .SH "DESCRIPTION" .B get_ordered_context_list @@ -31,14 +34,26 @@ is the same as get_ordered_context_list but only returns a single context which has to be freed with freecon. +.B get_default_context_with_role +Given a list of authorized security contexts for the user, query the user to select one and set *newcon to refer to it, which has to be freed with freecon. + +NOTE get_default_context_with_role is the same as get_default_context +except that it only returns a context with the specified role, returning +-1 if no such context is reachable for that user. + .B query_user_context takes a list of contexts, queries the user via stdin/stdout as to which context they want, and returns a new context as selected by the user (which has to be freed with freecon). .B manual_user_enter_context -allows the user to manually enter a context as a fallback if a list of -authorized contexts could not be obtained. Caller must free via freecon. +allows the user to manually enter a context as a fallback if a list of authorized contexts could not be obtained. Caller must free via freecon. + +.B get_default_type +Get the default type (domain) for 'role' and set 'type' to refer to it, which has to be freed with free. + +.B get_default_context_with_role +Given a list of authorized security contexts for the user, query the user to select one and set *newcon to refer to it, which has to be freed with freecon. .SH "RETURN VALUE" 0 for success and on error -1 is returned. --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/context_free.3 2004-11-19 11:21:37.515236707 -0500 @@ -0,0 +1 @@ +.so man3/context_new.3 --- libselinux-1.19.1/man/man3/getexeccon.3.rhat 2004-11-09 09:14:24.000000000 -0500 +++ libselinux-1.19.1/man/man3/getexeccon.3 2004-11-19 11:21:37.528235240 -0500 @@ -8,6 +8,8 @@ .BI "int getexeccon(security_context_t *" context ); .br .BI "int setexeccon(security_context_t "context ); +.br +.BI "int rpm_execcon(unsigned int " verified ", const char *" filename ", char *const " argv "[] , char *const " envp "[]); .SH "DESCRIPTION" .B getexeccon @@ -31,6 +33,11 @@ Note: Signal handlers that perform an execve must take care to save, reset, and restore the exec context to avoid unexpected behaviors. +.br + +.B rpm_execcon +Execute a helper for rpm in an appropriate security context. + .SH "RETURN VALUE" On error -1 is returned. --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/context_range_set.3 2004-11-19 11:21:37.519236255 -0500 @@ -0,0 +1 @@ +.so man3/context_new.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/security_commit_booleans.3 2004-11-19 11:21:37.535234450 -0500 @@ -0,0 +1 @@ +.so man3/security_load_booleans.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/security_set_boolean.3 2004-11-19 11:21:37.542233661 -0500 @@ -0,0 +1 @@ +.so man3/security_load_booleans.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/selinux_failsafe_context_path.3 2004-11-19 11:21:37.549232871 -0500 @@ -0,0 +1 @@ +.so man3/selinux_binary_policy_path.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/security_get_boolean_pending.3 2004-11-19 11:21:37.540233886 -0500 @@ -0,0 +1 @@ +.so man3/security_load_booleans.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/context_role_set.3 2004-11-19 11:21:37.521236030 -0500 @@ -0,0 +1 @@ +.so man3/context_new.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/context_range_get.3 2004-11-19 11:21:37.518236368 -0500 @@ -0,0 +1 @@ +.so man3/context_new.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/context_role_get.3 2004-11-19 11:21:37.520236143 -0500 @@ -0,0 +1 @@ +.so man3/context_new.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/security_get_boolean_active.3 2004-11-19 11:21:37.537234225 -0500 @@ -0,0 +1 @@ +.so man3/security_load_booleans.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/selinux_removable_context_path.3 2004-11-19 11:21:37.552232532 -0500 @@ -0,0 +1 @@ +.so man3/selinux_binary_policy_path.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/set_matchpathcon_printf.3 2004-11-19 11:21:37.555232194 -0500 @@ -0,0 +1 @@ +.so man3/matchpathcon.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/context_new.3 2004-11-19 11:23:54.697758320 -0500 @@ -0,0 +1,56 @@ +.TH "context_new" "3" "15 November 2004" "dwalsh@redhat.com" "SELinux API documentation" +.SH "NAME" +context_new, context_str, context_free, context_type_get, context_type_set, context_range_get, context_range_set,context_role_get, context_role_set, context_user_get, context_user_set \- Routines to manipulate SELinux security contexts + +.SH "SYNOPSIS" +.B #include +.br +.B "context_t context_new(const char *" context_str ); +.br +.B "const char * context_str(context_t " con ); +.br +.B "void context_free(context_t " con ); +.br +.B "const char * context_type_get(context_t " con ); +.br +.B "const char * context_range_get(context_t " con ); +.br +.B "const char * context_role_get(context_t " con ); +.br +.B "const char * context_user_get(context_t " con ); +.br +.B "const char * context_type_set(context_t " con ", const char* " type); +.br +.B "const char * context_range_set(context_t " con ", const char* " range); +.br +.B "const char * context_role_set(context_t " con ", const char* " role ); +.br +.B "const char * context_user_set(context_t " con ", const char* " user ); + +.SH "DESCRIPTION" + Functions to deal with security contexts in user space. + +context_new + Return a new context initialized to a context string + +context_str +Return a pointer to the string value of the context_t +Valid until the next call to context_str or context_free +for the same context_t* + +context_free +Free the storage used by a context + +context_type_get, context_range_get, context_role_get, context_user_get +Get a pointer to the string value of a context component + +NOTE: Values returned by the get functions are only valid until the next call +to a set function or context_free() for the same context_t structure. + +context_type_set, context_range_set, context_role_set, context_user_set +Set a context component + +.SH "RETURN VALUE" +On success, zero is returned. On failure, -1 is returned and errno is +set appropriately. + --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/context_type_get.3 2004-11-19 11:21:37.522235917 -0500 @@ -0,0 +1 @@ +.so man3/context_new.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/security_get_boolean_names.3 2004-11-19 11:21:37.539233999 -0500 @@ -0,0 +1 @@ +.so man3/security_load_booleans.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/selinux_booleans_path.3 2004-11-19 11:21:37.545233322 -0500 @@ -0,0 +1 @@ +.so man3/selinux_binary_policy_path.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/checkPasswdAccess.3 2004-11-19 11:21:37.514236820 -0500 @@ -0,0 +1 @@ +.so man3/security_compute_av.3 --- libselinux-1.19.1/man/man3/security_compute_av.3.rhat 2004-11-09 09:14:24.000000000 -0500 +++ libselinux-1.19.1/man/man3/security_compute_av.3 2004-11-19 11:32:59.943237946 -0500 @@ -15,6 +15,8 @@ .BI "int security_compute_relabel(security_context_t "scon ", security_context_t "tcon ", security_class_t "tclass ", security_context_t *" newcon ); .sp .BI "int security_compute_user(security_context_t "scon ", const char *" username ", security_context_t **" con ); +.sp +.BI "int checkPasswdAccess(access_vector_t " requested ); .SH "DESCRIPTION" .B security_compute_av @@ -42,6 +44,9 @@ source context. Is mainly used by .B get_ordered_context_list. +.B checkPasswdAccess +This functions is a helper functions that allows you to check for a permission in the passwd class. checkPasswdAccess uses getprevcon() for the source and target security contexts. + .SH "RETURN VALUE" 0 for success and on error -1 is returned. --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/selinux_binary_policy_path.3 2004-11-19 11:21:37.544233435 -0500 @@ -0,0 +1,75 @@ +.TH "security_get_boolean_names" "3" "15 November 2004" "dwalsh@redhat.com" "SELinux API Documentation" +.SH "NAME" +selinux_binary_policy_path,selinux_failsafe_context_path,selinux_removable_context_path,selinux_default_context_path, selinux_user_contexts_path, selinux_file_context_path, selinux_media_context_path, selinux_contexts_path, selinux_booleans_path +.sp +These functions return the paths to specific files under the + policy root directory. + +.SH "SYNOPSIS" +.B #include +.sp +.br +extern const char *selinux_binary_policy_path(void); +.br +extern const char *selinux_failsafe_context_path(void); +.br +extern const char *selinux_removable_context_path(void); +.br +extern const char *selinux_default_context_path(void); +.br +extern const char *selinux_user_contexts_path(void); +.br +extern const char *selinux_file_context_path(void); +.br +extern const char *selinux_media_context_path(void); +.br +extern const char *selinux_contexts_path(void); +.br +extern const char *selinux_booleans_path(void); + + +.SH "DESCRIPTION" + +These functions return the paths to specific files under the + policy root directory. + +.br +selinux_binary_policy_path +.br +Default Binary Policy +.sp +selinux_failsafe_context_path +.br +Default failsafe context file +.sp +selinux_removable_context_path +.br +Default removeable context file +.sp +selinux_default_context_path +.br +Default context used by login programs and daemons that assume user roles. +.sp +selinux_user_contexts_path +.br +Default user context file; used by login programs for default login context +.sp +selinux_file_context_path +.br +Default file context file used restorecon +.sp +selinux_media_context_path +.br +Default media context file use to set contexts on media devices (cdrom, floppies) +.sp +selinux_contexts_path +.br +Parent directory of context files +.sp +selinux_booleans_path +.br +Boolean file path, used by boolean manipulation tools + +.SH AUTHOR +This manual page was written by Dan Walsh . + --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/selinux_contexts_path.3 2004-11-19 11:21:37.546233209 -0500 @@ -0,0 +1 @@ +.so man3/selinux_binary_policy_path.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/selinux_file_context_path.3 2004-11-19 11:21:37.550232758 -0500 @@ -0,0 +1 @@ +.so man3/selinux_binary_policy_path.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/matchmediacon.3 2004-11-19 11:32:02.685698348 -0500 @@ -0,0 +1,26 @@ +.TH "matchmediacon" "3" "15 November 2004" "dwalsh@redhat.com" "SE Linux API documentation" +.SH "NAME" +matchmediacon \- get the default security context for the specified mediatype from the policy. + +.SH "SYNOPSIS" +.B #include +.sp +.BI "int matchmediacon(const char *" media ", security_context_t *" con);" +.br + +.SH "DESCRIPTION" +.br +.B matchmediacon +matches the specified media type with the media contexts configuration and sets the security context "con" to refer to the resulting context. +.sp +.br +.B Note: + Caller must free returned security context "con" using freecon. +.SH "RETURN VALUE" +Returns 0 on success or -1 otherwise. + +.SH Files +/etc/selinux/POLICYTYPE/contexts/files/media + +.SH "SEE ALSO" +.BR freecon "(3) --- libselinux-1.19.1/man/man3/matchpathcon.3.rhat 2004-11-09 09:14:24.000000000 -0500 +++ libselinux-1.19.1/man/man3/matchpathcon.3 2004-11-19 11:21:37.533234676 -0500 @@ -5,17 +5,22 @@ .SH "SYNOPSIS" .B #include .sp -.BI "int matchpathcon(const char *" path ", mode_t " mode ", security_context_t *" con);" +.BI "int matchpathcon(const char *" path ", mode_t " mode ", security_context_t *" con); .br +.BI "void set_matchpathcon_printf(void (*f)(const char *fmt, ...));" .SH "DESCRIPTION" .br .B matchpathcon matches the specified pathname and mode against the file contexts configuration and sets the security context "con" to refer to the resulting context. "mode" can be 0 to disable mode matching, but should be provided whenever possible, as it may affect the matching. -.sp -.br .B Note: Caller must free returned security context "con" using freecon. + +.B set_matchpathcon_printf + +Set the function used by matchpathcon when displaying errors about the file_contexts configuration. If not set, then this defaults to fprintf(stderr, fmt, ...). +.sp +.br .SH "RETURN VALUE" Returns 0 on success or -1 otherwise. --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/security_load_booleans.3 2004-11-19 11:35:47.204365772 -0500 @@ -0,0 +1,61 @@ +.TH "security_get_boolean_names" "3" "15 November 2004" "dwalsh@redhat.com" "SELinux API Documentation" +.SH "NAME" +security_load_booleans, security_set_boolean, security_commit_booleans, +security_get_boolean_names, security_get_boolean_active, security_get_boolean_pending +.sp +routines for manipulating SELinux boolean values + +.SH "SYNOPSIS" +.B #include +.sp +extern int security_load_booleans(char *path); +.br +extern int security_get_boolean_names(char ***names, int *len); +.br +extern int security_get_boolean_pending(const char *name); +.br +extern int security_get_boolean_active(const char *name); +.br +extern int security_set_boolean(const char *name, int value); +.br +extern int security_commit_booleans(void); + + +.SH "DESCRIPTION" + +The SELinux policy can include conditional rules that are enabled or +disabled based on the current values of a set of policy booleans. +These policy booleans allow runtime modification of the security +policy without having to load a new policy. + +The SELinux API allows for a transaction based update. So you can set several boolean values and the commit them all at once. + +security_load_booleans +.br +Load policy boolean settings. Path may be NULL, in which case the booleans are loaded from the active policy boolean configuration file. + +security_get_boolean_names +.br +Returns a list of boolean names, currently supported by the loaded policy. + +security_set_boolean +.br +Sets the pending value for boolean + +security_get_boolean_pending +.br +Return pending value for boolean + +security_get_boolean_active +.br +Return active value for boolean + +security_commit_booleans +.br +Commit all pending values for the booleans. + +.SH AUTHOR +This manual page was written by Dan Walsh . + +.SH "SEE ALSO" +getsebool(8), booleans(8), togglesebool(8) --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/selinux_default_context_path.3 2004-11-19 11:21:37.547233097 -0500 @@ -0,0 +1 @@ +.so man3/selinux_binary_policy_path.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/get_default_context_with_role.3 2004-11-19 11:21:37.527235353 -0500 @@ -0,0 +1 @@ +.so man3/get_ordered_context_list.3 --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man3/selinux_user_contexts_path.3 2004-11-19 11:21:37.554232307 -0500 @@ -0,0 +1 @@ +.so man3/selinux_binary_policy_path.3 --- libselinux-1.19.1/man/man8/getsebool.8.rhat 2004-11-09 09:14:24.000000000 -0500 +++ libselinux-1.19.1/man/man8/getsebool.8 2004-11-19 11:21:37.557231968 -0500 @@ -8,13 +8,12 @@ .SH "DESCRIPTION" .B getsebool -reports the current state of either a particular SELinux boolean or -all SELinux booleans. The state consists of two values, the active -value and the pending value. The active value indicates the value -that is presently applied to the policy. The pending value indicates +reports where a particular SELinux boolean or +all SELinux booleans are active or inactive. +In certain situations a boolean can be in one state with a pending +change to the other state. getsebool will report this as a pending change. +The pending value indicates the value that will be applied upon the next boolean commit. -Typically, these values will be the same; they only differ when in the -middle of a boolean change transaction. The setting of boolean values occurs in two stages; first the pending value is changed, then the booleans are committed, causing their --- /dev/null 2004-11-19 04:10:22.696886456 -0500 +++ libselinux-1.19.1/man/man8/avcstat.8 2004-11-19 11:21:37.556232081 -0500 @@ -0,0 +1,28 @@ +.TH "avcstat" "8" "18 Nov 2004" "dwalsh@redhat.com" "SELinux Command Line documentation" +.SH "NAME" +avcstat \- Display SELinux AVC statistics + +.SH "SYNOPSIS" +.B avcstat +.I [-c] [-f status_file] [interval] + +.SH "DESCRIPTION" +.B avcstat + +Display SELinux AVC statistics. If the interval parameter is specified, the +program will loop, displaying updated statistics every 'interval' seconds. +Relative values are displayed by default. + +.SH OPTIONS +.TP +.B \-c +Display the cumulative values. + +.TP +.B \-f +Specifies the location of the AVC statistics file, defaulting to '/selinux/avc/cache_stats'. + +.SH AUTHOR +This manual page was written by Dan Walsh . +The program was written by James Morris . +