|
|
60d47fe |
diff -up libselinux-2.0.14/src/selinuxswig.i.rhat libselinux-2.0.14/src/selinuxswig.i
|
|
|
60d47fe |
--- libselinux-2.0.14/src/selinuxswig.i.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/src/selinuxswig.i 2007-09-07 09:21:26.000000000 -0400
|
|
|
60d47fe |
@@ -21,6 +21,7 @@
|
|
|
60d47fe |
%module selinux
|
|
|
60d47fe |
%{
|
|
|
60d47fe |
#include "selinux/selinux.h"
|
|
|
60d47fe |
+ #include "selinux/get_context_list.h"
|
|
|
60d47fe |
%}
|
|
|
60d47fe |
%apply int *OUTPUT { int * };
|
|
|
60d47fe |
%apply int *OUTPUT { size_t * };
|
|
|
60d47fe |
@@ -42,8 +43,12 @@
|
|
|
3a940b3 |
|
|
|
60d47fe |
%typedef unsigned mode_t;
|
|
|
3a940b3 |
|
|
|
60d47fe |
+%include "../include/selinux/get_context_list.h"
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
extern int is_selinux_enabled(void);
|
|
|
60d47fe |
extern int is_selinux_mls_enabled(void);
|
|
|
60d47fe |
+extern void freecon(security_context_t con);
|
|
|
60d47fe |
+extern void freeconary(security_context_t * con);
|
|
|
60d47fe |
extern int getcon(security_context_t *con);
|
|
|
60d47fe |
extern int setcon(security_context_t con);
|
|
|
60d47fe |
extern int getpidcon(int pid, security_context_t *con);
|
|
|
60d47fe |
@@ -90,6 +95,11 @@ extern int matchpathcon(const char *path
|
|
|
60d47fe |
mode_t mode,
|
|
|
60d47fe |
security_context_t *con);
|
|
|
60d47fe |
|
|
|
60d47fe |
+extern int matchpathcon_init_prefix(const char *path,
|
|
|
60d47fe |
+ const char *prefix);
|
|
|
60d47fe |
+extern void matchpathcon_fini(void);
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
extern int matchmediacon(const char *media,
|
|
|
60d47fe |
security_context_t *con);
|
|
|
60d47fe |
|
|
|
60d47fe |
@@ -106,6 +116,7 @@ extern const char *selinux_file_context_
|
|
|
60d47fe |
extern const char *selinux_homedir_context_path(void);
|
|
|
60d47fe |
extern const char *selinux_media_context_path(void);
|
|
|
60d47fe |
extern const char *selinux_contexts_path(void);
|
|
|
60d47fe |
+extern const char *selinux_securetty_types_path(void);
|
|
|
60d47fe |
extern const char *selinux_booleans_path(void);
|
|
|
60d47fe |
extern const char *selinux_customizable_types_path(void);
|
|
|
60d47fe |
extern const char *selinux_users_path(void);
|
|
|
60d47fe |
@@ -113,11 +124,15 @@ extern const char *selinux_usersconf_pat
|
|
|
60d47fe |
extern const char *selinux_translations_path(void);
|
|
|
60d47fe |
extern const char *selinux_netfilter_context_path(void);
|
|
|
60d47fe |
extern const char *selinux_path(void);
|
|
|
60d47fe |
-extern int selinux_check_passwd_access(access_vector_t requested);
|
|
|
60d47fe |
-extern int checkPasswdAccess(access_vector_t requested);
|
|
|
60d47fe |
+#extern int selinux_check_passwd_access(access_vector_t requested);
|
|
|
60d47fe |
+#extern int checkPasswdAccess(access_vector_t requested);
|
|
|
32b1322 |
+
|
|
|
60d47fe |
+extern int selinux_check_securetty_context(security_context_t tty_context);
|
|
|
60d47fe |
+void set_selinuxmnt(char *mnt);
|
|
|
32b1322 |
|
|
|
60d47fe |
+#ifdef SWIGpython
|
|
|
60d47fe |
// This tells SWIG to treat char ** as a special case
|
|
|
60d47fe |
-%typemap(python,in) char ** {
|
|
|
60d47fe |
+%typemap(in) char ** {
|
|
|
60d47fe |
/* Check if is a list */
|
|
|
60d47fe |
if (PyList_Check($input)) {
|
|
|
60d47fe |
int size = PyList_Size($input);
|
|
|
32b1322 |
@@ -143,10 +158,48 @@ extern int checkPasswdAccess(access_vect
|
|
|
60d47fe |
return NULL;
|
|
|
60d47fe |
}
|
|
|
60d47fe |
}
|
|
|
60d47fe |
+#endif
|
|
|
60d47fe |
|
|
|
32b1322 |
-extern int rpm_execcon(unsigned int verified,
|
|
|
32b1322 |
- const char *filename,
|
|
|
32b1322 |
- char **, char **);
|
|
|
32b1322 |
+%typemap(in) char * const [] {
|
|
|
32b1322 |
+ int i, size;
|
|
|
32b1322 |
+ PyObject * s;
|
|
|
32b1322 |
+
|
|
|
32b1322 |
+ if (!PySequence_Check($input)) {
|
|
|
32b1322 |
+ PyErr_SetString(PyExc_ValueError, "Expected a sequence");
|
|
|
32b1322 |
+ return NULL;
|
|
|
32b1322 |
+ }
|
|
|
32b1322 |
+
|
|
|
32b1322 |
+ size = PySequence_Size($input);
|
|
|
32b1322 |
+
|
|
|
32b1322 |
+ $1 = (char**) malloc(size + 1);
|
|
|
32b1322 |
+
|
|
|
32b1322 |
+ for(i = 0; i < size; i++) {
|
|
|
32b1322 |
+ if (!PyString_Check(PySequence_GetItem($input, i))) {
|
|
|
32b1322 |
+ PyErr_SetString(PyExc_ValueError, "Sequence must contain only strings");
|
|
|
32b1322 |
+ return NULL;
|
|
|
32b1322 |
+ }
|
|
|
32b1322 |
+ }
|
|
|
32b1322 |
+
|
|
|
32b1322 |
+ for(i = 0; i < size; i++) {
|
|
|
32b1322 |
+ s = PySequence_GetItem($input, i);
|
|
|
32b1322 |
+ $1[i] = (char*) malloc(PyString_Size(s) + 1);
|
|
|
32b1322 |
+ strcpy($1[i], PyString_AsString(s));
|
|
|
32b1322 |
+ }
|
|
|
32b1322 |
+ $1[size] = NULL;
|
|
|
32b1322 |
+}
|
|
|
32b1322 |
+
|
|
|
32b1322 |
+%typemap(freearg,match="in") char * const [] {
|
|
|
32b1322 |
+ int i = 0;
|
|
|
32b1322 |
+ while($1[i]) {
|
|
|
32b1322 |
+ free($1[i]);
|
|
|
32b1322 |
+ i++;
|
|
|
32b1322 |
+ }
|
|
|
32b1322 |
+ free($1);
|
|
|
32b1322 |
+}
|
|
|
32b1322 |
+
|
|
|
32b1322 |
+extern int rpm_execcon(unsigned int verified,
|
|
|
32b1322 |
+ const char *filename,
|
|
|
32b1322 |
+ char *const argv[], char *const envp[]);
|
|
|
32b1322 |
|
|
|
32b1322 |
extern int is_context_customizable (security_context_t scontext);
|
|
|
32b1322 |
|
|
|
32b1322 |
@@ -164,3 +217,7 @@ extern int selinux_raw_to_trans_context(
|
|
|
60d47fe |
}
|
|
|
60d47fe |
extern int selinux_getpolicytype(char **enforce);
|
|
|
60d47fe |
extern int getseuserbyname(const char *linuxuser, char **seuser, char **level);
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
+int selinux_file_context_cmp(const security_context_t a, const security_context_t b);
|
|
|
60d47fe |
+int selinux_file_context_verify(const char *path, mode_t mode);
|
|
|
60d47fe |
+int selinux_lsetfilecon_default(const char *path);
|
|
|
60d47fe |
diff -up libselinux-2.0.14/src/selinux.py.rhat libselinux-2.0.14/src/selinux.py
|
|
|
60d47fe |
--- libselinux-2.0.14/src/selinux.py.rhat 2007-04-24 10:36:20.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/src/selinux.py 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -48,8 +48,19 @@ except AttributeError:
|
|
|
60d47fe |
del types
|
|
|
60d47fe |
|
|
|
60d47fe |
|
|
|
60d47fe |
+SELINUX_DEFAULTUSER = _selinux.SELINUX_DEFAULTUSER
|
|
|
60d47fe |
+get_ordered_context_list = _selinux.get_ordered_context_list
|
|
|
60d47fe |
+get_ordered_context_list_with_level = _selinux.get_ordered_context_list_with_level
|
|
|
60d47fe |
+get_default_context = _selinux.get_default_context
|
|
|
60d47fe |
+get_default_context_with_level = _selinux.get_default_context_with_level
|
|
|
60d47fe |
+get_default_context_with_role = _selinux.get_default_context_with_role
|
|
|
60d47fe |
+get_default_context_with_rolelevel = _selinux.get_default_context_with_rolelevel
|
|
|
60d47fe |
+query_user_context = _selinux.query_user_context
|
|
|
60d47fe |
+manual_user_enter_context = _selinux.manual_user_enter_context
|
|
|
60d47fe |
is_selinux_enabled = _selinux.is_selinux_enabled
|
|
|
60d47fe |
is_selinux_mls_enabled = _selinux.is_selinux_mls_enabled
|
|
|
60d47fe |
+freecon = _selinux.freecon
|
|
|
60d47fe |
+freeconary = _selinux.freeconary
|
|
|
60d47fe |
getcon = _selinux.getcon
|
|
|
60d47fe |
setcon = _selinux.setcon
|
|
|
60d47fe |
getpidcon = _selinux.getpidcon
|
|
|
60d47fe |
@@ -88,6 +99,8 @@ MATCHPATHCON_NOTRANS = _selinux.MATCHPAT
|
|
|
60d47fe |
set_matchpathcon_flags = _selinux.set_matchpathcon_flags
|
|
|
60d47fe |
matchpathcon_init = _selinux.matchpathcon_init
|
|
|
60d47fe |
matchpathcon = _selinux.matchpathcon
|
|
|
60d47fe |
+matchpathcon_init_prefix = _selinux.matchpathcon_init_prefix
|
|
|
60d47fe |
+matchpathcon_fini = _selinux.matchpathcon_fini
|
|
|
60d47fe |
matchmediacon = _selinux.matchmediacon
|
|
|
60d47fe |
selinux_getenforcemode = _selinux.selinux_getenforcemode
|
|
|
60d47fe |
selinux_policy_root = _selinux.selinux_policy_root
|
|
|
60d47fe |
@@ -102,6 +115,7 @@ selinux_file_context_local_path = _selin
|
|
|
60d47fe |
selinux_homedir_context_path = _selinux.selinux_homedir_context_path
|
|
|
60d47fe |
selinux_media_context_path = _selinux.selinux_media_context_path
|
|
|
60d47fe |
selinux_contexts_path = _selinux.selinux_contexts_path
|
|
|
60d47fe |
+selinux_securetty_types_path = _selinux.selinux_securetty_types_path
|
|
|
60d47fe |
selinux_booleans_path = _selinux.selinux_booleans_path
|
|
|
60d47fe |
selinux_customizable_types_path = _selinux.selinux_customizable_types_path
|
|
|
60d47fe |
selinux_users_path = _selinux.selinux_users_path
|
|
|
60d47fe |
@@ -109,13 +123,16 @@ selinux_usersconf_path = _selinux.selinu
|
|
|
60d47fe |
selinux_translations_path = _selinux.selinux_translations_path
|
|
|
60d47fe |
selinux_netfilter_context_path = _selinux.selinux_netfilter_context_path
|
|
|
60d47fe |
selinux_path = _selinux.selinux_path
|
|
|
60d47fe |
-selinux_check_passwd_access = _selinux.selinux_check_passwd_access
|
|
|
60d47fe |
-checkPasswdAccess = _selinux.checkPasswdAccess
|
|
|
60d47fe |
+selinux_check_securetty_context = _selinux.selinux_check_securetty_context
|
|
|
60d47fe |
+set_selinuxmnt = _selinux.set_selinuxmnt
|
|
|
60d47fe |
rpm_execcon = _selinux.rpm_execcon
|
|
|
60d47fe |
is_context_customizable = _selinux.is_context_customizable
|
|
|
60d47fe |
selinux_trans_to_raw_context = _selinux.selinux_trans_to_raw_context
|
|
|
60d47fe |
selinux_raw_to_trans_context = _selinux.selinux_raw_to_trans_context
|
|
|
60d47fe |
selinux_getpolicytype = _selinux.selinux_getpolicytype
|
|
|
60d47fe |
getseuserbyname = _selinux.getseuserbyname
|
|
|
60d47fe |
+selinux_file_context_cmp = _selinux.selinux_file_context_cmp
|
|
|
60d47fe |
+selinux_file_context_verify = _selinux.selinux_file_context_verify
|
|
|
60d47fe |
+selinux_lsetfilecon_default = _selinux.selinux_lsetfilecon_default
|
|
|
60d47fe |
|
|
|
60d47fe |
|
|
|
60d47fe |
diff -up libselinux-2.0.14/include/selinux/flask.h.rhat libselinux-2.0.14/include/selinux/flask.h
|
|
|
32b1322 |
--- libselinux-2.0.14/include/selinux/flask.h.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/include/selinux/flask.h 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -64,6 +64,8 @@
|
|
|
60d47fe |
#define SECCLASS_PACKET 57
|
|
|
60d47fe |
#define SECCLASS_KEY 58
|
|
|
60d47fe |
#define SECCLASS_CONTEXT 59
|
|
|
60d47fe |
+#define SECCLASS_DCCP_SOCKET 60
|
|
|
60d47fe |
+#define SECCLASS_MEMPROTECT 61
|
|
|
60d47fe |
|
|
|
60d47fe |
/*
|
|
|
60d47fe |
* Security identifier indices for initial entities
|
|
|
60d47fe |
diff -up libselinux-2.0.14/include/selinux/av_permissions.h.rhat libselinux-2.0.14/include/selinux/av_permissions.h
|
|
|
32b1322 |
--- libselinux-2.0.14/include/selinux/av_permissions.h.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/include/selinux/av_permissions.h 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -290,12 +290,16 @@
|
|
|
60d47fe |
#define NODE__RAWIP_RECV 0x00000010UL
|
|
|
60d47fe |
#define NODE__RAWIP_SEND 0x00000020UL
|
|
|
60d47fe |
#define NODE__ENFORCE_DEST 0x00000040UL
|
|
|
60d47fe |
+#define NODE__DCCP_RECV 0x00000080UL
|
|
|
60d47fe |
+#define NODE__DCCP_SEND 0x00000100UL
|
|
|
60d47fe |
#define NETIF__TCP_RECV 0x00000001UL
|
|
|
60d47fe |
#define NETIF__TCP_SEND 0x00000002UL
|
|
|
60d47fe |
#define NETIF__UDP_RECV 0x00000004UL
|
|
|
60d47fe |
#define NETIF__UDP_SEND 0x00000008UL
|
|
|
60d47fe |
#define NETIF__RAWIP_RECV 0x00000010UL
|
|
|
60d47fe |
#define NETIF__RAWIP_SEND 0x00000020UL
|
|
|
60d47fe |
+#define NETIF__DCCP_RECV 0x00000040UL
|
|
|
60d47fe |
+#define NETIF__DCCP_SEND 0x00000080UL
|
|
|
60d47fe |
#define NETLINK_SOCKET__IOCTL 0x00000001UL
|
|
|
60d47fe |
#define NETLINK_SOCKET__READ 0x00000002UL
|
|
|
60d47fe |
#define NETLINK_SOCKET__WRITE 0x00000004UL
|
|
|
60d47fe |
@@ -837,6 +841,8 @@
|
|
|
60d47fe |
#define NSCD__SHMEMPWD 0x00000020UL
|
|
|
60d47fe |
#define NSCD__SHMEMGRP 0x00000040UL
|
|
|
60d47fe |
#define NSCD__SHMEMHOST 0x00000080UL
|
|
|
60d47fe |
+#define NSCD__GETSERV 0x00000100UL
|
|
|
60d47fe |
+#define NSCD__SHMEMSERV 0x00000200UL
|
|
|
60d47fe |
#define ASSOCIATION__SENDTO 0x00000001UL
|
|
|
60d47fe |
#define ASSOCIATION__RECVFROM 0x00000002UL
|
|
|
60d47fe |
#define ASSOCIATION__SETCONTEXT 0x00000004UL
|
|
|
60d47fe |
@@ -897,3 +903,28 @@
|
|
|
60d47fe |
#define KEY__CREATE 0x00000040UL
|
|
|
60d47fe |
#define CONTEXT__TRANSLATE 0x00000001UL
|
|
|
60d47fe |
#define CONTEXT__CONTAINS 0x00000002UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__IOCTL 0x00000001UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__READ 0x00000002UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__WRITE 0x00000004UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__CREATE 0x00000008UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__GETATTR 0x00000010UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__SETATTR 0x00000020UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__LOCK 0x00000040UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__RELABELFROM 0x00000080UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__RELABELTO 0x00000100UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__APPEND 0x00000200UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__BIND 0x00000400UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__CONNECT 0x00000800UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__LISTEN 0x00001000UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__ACCEPT 0x00002000UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__GETOPT 0x00004000UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__SETOPT 0x00008000UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__SHUTDOWN 0x00010000UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__RECVFROM 0x00020000UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__SENDTO 0x00040000UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__RECV_MSG 0x00080000UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__SEND_MSG 0x00100000UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__NAME_BIND 0x00200000UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__NODE_BIND 0x00400000UL
|
|
|
60d47fe |
+#define DCCP_SOCKET__NAME_CONNECT 0x00800000UL
|
|
|
60d47fe |
+#define MEMPROTECT__MMAP_ZERO 0x00000001UL
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man8/selinux.8.rhat libselinux-2.0.14/man/man8/selinux.8
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man8/selinux.8.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man8/selinux.8 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -62,14 +62,13 @@ compile-time tunable options and a set o
|
|
|
60d47fe |
.B system-config-securitylevel
|
|
|
60d47fe |
allows customization of these booleans and tunables.
|
|
|
60d47fe |
|
|
|
02e2f5f |
-.br
|
|
|
60d47fe |
Many domains that are protected by SELinux also include selinux man pages explainging how to customize their policy.
|
|
|
60d47fe |
|
|
|
60d47fe |
.SH FILE LABELING
|
|
|
60d47fe |
|
|
|
60d47fe |
All files, directories, devices ... have a security context/label associated with them. These context are stored in the extended attributes of the file system.
|
|
|
60d47fe |
Problems with SELinux often arise from the file system being mislabeled. This can be caused by booting the machine with a non selinux kernel. If you see an error message containing file_t, that is usually a good indicator that you have a serious problem with file system labeling.
|
|
|
60d47fe |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
The best way to relabel the file system is to create the flag file /.autorelabel and reboot. system-config-securitylevel, also has this capability. The restorcon/fixfiles commands are also available for relabeling files.
|
|
|
60d47fe |
|
|
|
60d47fe |
.SH AUTHOR
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man8/matchpathcon.8.rhat libselinux-2.0.14/man/man8/matchpathcon.8
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man8/matchpathcon.8.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man8/matchpathcon.8 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -10,16 +10,16 @@ Prints the file path and the default sec
|
|
|
60d47fe |
.SH OPTIONS
|
|
|
60d47fe |
.B \-n
|
|
|
60d47fe |
Do not display path.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B \-N
|
|
|
60d47fe |
Do not use translations.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B \-f file_context_file
|
|
|
60d47fe |
Use alternate file_context file
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B \-p prefix
|
|
|
60d47fe |
Use prefix to speed translations
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B \-V
|
|
|
60d47fe |
Verify file context on disk matches defaults
|
|
|
02e2f5f |
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/avc_compute_create.3.rhat libselinux-2.0.14/man/man3/avc_compute_create.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/avc_compute_create.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/avc_compute_create.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -6,7 +6,7 @@
|
|
|
60d47fe |
avc_compute_create \- obtain SELinux label for new object.
|
|
|
02e2f5f |
.SH "SYNOPSIS"
|
|
|
02e2f5f |
.B #include <selinux/selinux.h>
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B #include <selinux/avc.h>
|
|
|
02e2f5f |
.sp
|
|
|
60d47fe |
.BI "int avc_compute_create(security_id_t " ssid ", security_id_t " tsid ,
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/getexeccon.3.rhat libselinux-2.0.14/man/man3/getexeccon.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/getexeccon.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/getexeccon.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
02e2f5f |
@@ -1,16 +1,16 @@
|
|
|
60d47fe |
.TH "getexeccon" "3" "1 January 2004" "russell@coker.com.au" "SE Linux API documentation"
|
|
|
02e2f5f |
.SH "NAME"
|
|
|
02e2f5f |
getexeccon, setexeccon \- get or set the SELinux security context used for executing a new process.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
rpm_execcon \- run a helper for rpm in an appropriate security context
|
|
|
02e2f5f |
|
|
|
02e2f5f |
.SH "SYNOPSIS"
|
|
|
02e2f5f |
.B #include <selinux/selinux.h>
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
.BI "int getexeccon(security_context_t *" context );
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.BI "int setexeccon(security_context_t "context );
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.BI "int rpm_execcon(unsigned int " verified ", const char *" filename ", char *const " argv "[] , char *const " envp "[]);
|
|
|
02e2f5f |
|
|
|
02e2f5f |
.SH "DESCRIPTION"
|
|
|
60d47fe |
@@ -26,16 +26,16 @@ NULL can be passed to
|
|
|
02e2f5f |
setexeccon to reset to the default policy behavior.
|
|
|
02e2f5f |
The exec context is automatically reset after the next execve, so a
|
|
|
02e2f5f |
program doesn't need to explicitly sanitize it upon startup.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
|
|
|
02e2f5f |
setexeccon can be applied prior to library
|
|
|
02e2f5f |
functions that internally perform an execve, e.g. execl*, execv*, popen,
|
|
|
02e2f5f |
in order to set an exec context for that operation.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
|
|
|
02e2f5f |
Note: Signal handlers that perform an execve must take care to
|
|
|
02e2f5f |
save, reset, and restore the exec context to avoid unexpected behaviors.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
|
|
|
02e2f5f |
.B rpm_execcon
|
|
|
02e2f5f |
runs a helper for rpm in an appropriate security context. The
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/getfilecon.3.rhat libselinux-2.0.14/man/man3/getfilecon.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/getfilecon.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/getfilecon.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -5,9 +5,9 @@ getfilecon, fgetfilecon, lgetfilecon \-
|
|
|
02e2f5f |
.B #include <selinux/selinux.h>
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
.BI "int getfilecon(const char *" path ", security_context_t *" con );
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.BI "int lgetfilecon(const char *" path ", security_context_t *" con );
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.BI "int fgetfilecon(int "fd ", security_context_t *" con );
|
|
|
02e2f5f |
.SH "DESCRIPTION"
|
|
|
02e2f5f |
.B getfilecon
|
|
|
60d47fe |
@@ -22,7 +22,6 @@ link itself is interrogated, not the fil
|
|
|
02e2f5f |
is identical to getfilecon, only the open file pointed to by filedes (as
|
|
|
02e2f5f |
returned by open(2)) is interrogated in place of path.
|
|
|
02e2f5f |
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
|
|
|
02e2f5f |
The returned context should be freed with freecon if non-NULL.
|
|
|
02e2f5f |
.SH "RETURN VALUE"
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/selinux_binary_policy_path.3.rhat libselinux-2.0.14/man/man3/selinux_binary_policy_path.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/selinux_binary_policy_path.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/selinux_binary_policy_path.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -10,27 +10,27 @@ directories and files.
|
|
|
60d47fe |
.SH "SYNOPSIS"
|
|
|
60d47fe |
.B #include <selinux/selinux.h>
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
extern const char *selinux_policy_root(void);
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
extern const char *selinux_binary_policy_path(void);
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
extern const char *selinux_failsafe_context_path(void);
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
extern const char *selinux_removable_context_path(void);
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
extern const char *selinux_default_context_path(void);
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
extern const char *selinux_user_contexts_path(void);
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
extern const char *selinux_file_context_path(void);
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
extern const char *selinux_media_context_path(void);
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
extern const char *selinux_securetty_types_path(void);
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
extern const char *selinux_contexts_path(void);
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
extern const char *selinux_booleans_path(void);
|
|
|
60d47fe |
|
|
|
60d47fe |
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/security_class_to_string.3.rhat libselinux-2.0.14/man/man3/security_class_to_string.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/security_class_to_string.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/security_class_to_string.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -8,7 +8,7 @@ between SELinux class and permission val
|
|
|
60d47fe |
|
|
|
60d47fe |
.SH "SYNOPSIS"
|
|
|
60d47fe |
.B #include <selinux/selinux.h>
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.B #include <selinux/flask.h>
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
.BI "const char * security_class_to_string(security_class_t " tclass ");"
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/getfscreatecon.3.rhat libselinux-2.0.14/man/man3/getfscreatecon.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/getfscreatecon.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/getfscreatecon.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -6,7 +6,7 @@ getfscreatecon, setfscreatecon \- get or
|
|
|
02e2f5f |
.B #include <selinux/selinux.h>
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
.BI "int getfscreatecon(security_context_t *" con );
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.BI "int setfscreatecon(security_context_t "context );
|
|
|
02e2f5f |
|
|
|
02e2f5f |
.SH "DESCRIPTION"
|
|
|
60d47fe |
@@ -22,11 +22,11 @@ NULL can be passed to
|
|
|
02e2f5f |
setfscreatecon to reset to the default policy behavior.
|
|
|
02e2f5f |
The fscreate context is automatically reset after the next execve, so a
|
|
|
02e2f5f |
program doesn't need to explicitly sanitize it upon startup.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
setfscreatecon can be applied prior to library
|
|
|
02e2f5f |
functions that internally perform an file creation,
|
|
|
02e2f5f |
in order to set an file context on the objects.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
|
|
|
02e2f5f |
Note: Signal handlers that perform an setfscreate must take care to
|
|
|
02e2f5f |
save, reset, and restore the fscreate context to avoid unexpected behaviors.
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/freecon.3.rhat libselinux-2.0.14/man/man3/freecon.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/freecon.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/freecon.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -5,7 +5,7 @@ freecon, freeconary \- free memory assoc
|
|
|
60d47fe |
.B #include <selinux/selinux.h>
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
.BI "void freecon(security_context_t "con );
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.BI "void freeconary(security_context_t *" con );
|
|
|
02e2f5f |
|
|
|
60d47fe |
.SH "DESCRIPTION"
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/security_getenforce.3.rhat libselinux-2.0.14/man/man3/security_getenforce.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/security_getenforce.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/security_getenforce.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -5,7 +5,7 @@ security_getenforce, security_setenforce
|
|
|
02e2f5f |
.B #include <selinux/selinux.h>
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
.B int security_getenforce();
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.BI "int security_setenforce(int "value );
|
|
|
02e2f5f |
|
|
|
60d47fe |
.SH "DESCRIPTION"
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/selinux_getenforcemode.3.rhat libselinux-2.0.14/man/man3/selinux_getenforcemode.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/selinux_getenforcemode.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/selinux_getenforcemode.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -5,13 +5,13 @@ selinux_getenforcemode \- get the enforc
|
|
|
60d47fe |
.B #include <selinux/selinux.h>
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
.B int selinux_getenforcemode(int *enforce);
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
|
|
|
02e2f5f |
.SH "DESCRIPTION"
|
|
|
60d47fe |
.B selinux_getenforcemode
|
|
|
60d47fe |
Reads the contents of the /etc/selinux/config file to determine how the
|
|
|
60d47fe |
system was setup to run SELinux.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
Sets the value of enforce to 1 if SELinux should be run in enforcing mode.
|
|
|
60d47fe |
Sets the value of enforce to 0 if SELinux should be run in permissive mode.
|
|
|
60d47fe |
Sets the value of enforce to -1 if SELinux should be disabled.
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/matchmediacon.3.rhat libselinux-2.0.14/man/man3/matchmediacon.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/matchmediacon.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/matchmediacon.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -6,14 +6,14 @@ matchmediacon \- get the default SELinux
|
|
|
02e2f5f |
.B #include <selinux/selinux.h>
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
.BI "int matchmediacon(const char *" media ", security_context_t *" con);"
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
|
|
|
02e2f5f |
.SH "DESCRIPTION"
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.B matchmediacon
|
|
|
02e2f5f |
matches the specified media type with the media contexts configuration and sets the security context "con" to refer to the resulting context.
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.B Note:
|
|
|
02e2f5f |
Caller must free returned security context "con" using freecon.
|
|
|
02e2f5f |
.SH "RETURN VALUE"
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/getseuserbyname.3.rhat libselinux-2.0.14/man/man3/getseuserbyname.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/getseuserbyname.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/getseuserbyname.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -12,7 +12,7 @@ a given Linux username. The SELinux use
|
|
|
60d47fe |
then be passed to other libselinux functions such as
|
|
|
60d47fe |
get_ordered_context_list_with_level and get_default_context_with_level.
|
|
|
60d47fe |
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
|
|
|
60d47fe |
The returned SELinux username and level should be freed by the caller
|
|
|
60d47fe |
using free.
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/is_context_customizable.3.rhat libselinux-2.0.14/man/man3/is_context_customizable.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/is_context_customizable.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/is_context_customizable.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -8,7 +8,7 @@ is_context_customizable \- check whether
|
|
|
60d47fe |
|
|
|
60d47fe |
.SH "DESCRIPTION"
|
|
|
60d47fe |
.B is_context_customizable
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
This function checks whether the type of scon is in the /etc/selinux/SELINUXTYPE/context/customizable_types file. A customizable type is a file context type that
|
|
|
60d47fe |
administrators set on files, usually to allow certain domains to share the file content. restorecon and setfiles, by default, leave these context in place.
|
|
|
60d47fe |
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/security_compute_av.3.rhat libselinux-2.0.14/man/man3/security_compute_av.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/security_compute_av.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/security_compute_av.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -6,7 +6,7 @@ the SELinux policy database in the kerne
|
|
|
60d47fe |
|
|
|
60d47fe |
.SH "SYNOPSIS"
|
|
|
60d47fe |
.B #include <selinux/selinux.h>
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.B #include <selinux/flask.h>
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
.BI "int security_compute_av(security_context_t "scon ", security_context_t "tcon ", security_class_t "tclass ", access_vector_t "requested ", struct av_decision *" avd );
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/setfilecon.3.rhat libselinux-2.0.14/man/man3/setfilecon.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/setfilecon.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/setfilecon.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -6,9 +6,9 @@ setfilecon, fsetfilecon, lsetfilecon \-
|
|
|
60d47fe |
.B #include <selinux/selinux.h>
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
.BI "int setfilecon(const char *" path ", security_context_t "con );
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.BI "int lsetfilecon(const char *" path ", security_context_t "con );
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.BI "int fsetfilecon(int "fd ", security_context_t "con );
|
|
|
60d47fe |
|
|
|
60d47fe |
.SH "DESCRIPTION"
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/matchpathcon.3.rhat libselinux-2.0.14/man/man3/matchpathcon.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/matchpathcon.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/matchpathcon.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -6,18 +6,18 @@ matchpathcon \- get the default SELinux
|
|
|
02e2f5f |
.B #include <selinux/selinux.h>
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
.BI "int matchpathcon_init(const char *" path ");"
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.BI "int matchpathcon_fini(void);"
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.BI "int matchpathcon(const char *" path ", mode_t " mode ", security_context_t *" con);
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.BI "void set_matchpathcon_printf(void (*" f ")(const char *" fmt ", ...));"
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.BI "void set_matchpathcon_invalidcon(int (*" f ")(const char *"path ", unsigned " lineno ", char * " context "));"
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.BI "void set_matchpathcon_flags(unsigned int " flags ");"
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.SH "DESCRIPTION"
|
|
|
02e2f5f |
.B matchpathcon_init
|
|
|
02e2f5f |
loads the file contexts configuration specified by
|
|
|
60d47fe |
@@ -40,7 +40,7 @@ and
|
|
|
02e2f5f |
suffix are also looked up and loaded if present. These files provide
|
|
|
02e2f5f |
dynamically generated entries for user home directories and for local
|
|
|
02e2f5f |
customizations.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
.B matchpathcon_fini
|
|
|
02e2f5f |
frees the memory allocated by a prior call to
|
|
|
60d47fe |
@@ -49,7 +49,7 @@ This function can be used to free and re
|
|
|
02e2f5f |
.B matchpathcon_init
|
|
|
02e2f5f |
calls, or to free memory when finished using
|
|
|
02e2f5f |
.B matchpathcon.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
.B matchpathcon
|
|
|
02e2f5f |
matches the specified pathname and mode against the file contexts
|
|
|
60d47fe |
@@ -72,14 +72,14 @@ its first invocation with a NULL
|
|
|
02e2f5f |
.I path,
|
|
|
02e2f5f |
defaulting to the active file contexts configuration.
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.B set_matchpathcon_printf
|
|
|
02e2f5f |
sets the function used by
|
|
|
02e2f5f |
.B matchpathcon_init
|
|
|
02e2f5f |
when displaying errors about the file contexts configuration. If not set,
|
|
|
02e2f5f |
then this defaults to fprintf(stderr, fmt, ...). This can be set to redirect
|
|
|
02e2f5f |
error reporting to a different destination.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
.B set_matchpathcon_invalidcon
|
|
|
02e2f5f |
sets the function used by
|
|
|
60d47fe |
@@ -100,7 +100,7 @@ may include the
|
|
|
02e2f5f |
and
|
|
|
02e2f5f |
.I lineno
|
|
|
02e2f5f |
in such error messages.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
.B set_matchpathcon_flags
|
|
|
02e2f5f |
sets flags controlling the operation of
|
|
|
60d47fe |
@@ -111,7 +111,7 @@ If the
|
|
|
02e2f5f |
.B MATCHPATHCON_BASEONLY
|
|
|
02e2f5f |
flag is set, then only the base file contexts configuration file
|
|
|
02e2f5f |
will be processed, not any dynamically generated entries or local customizations.
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
.SH "RETURN VALUE"
|
|
|
02e2f5f |
Returns 0 on success or -1 otherwise.
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/avc_init.3.rhat libselinux-2.0.14/man/man3/avc_init.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/avc_init.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/avc_init.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -6,17 +6,17 @@
|
|
|
60d47fe |
avc_init, avc_destroy, avc_reset, avc_cleanup \- userspace SELinux AVC setup and teardown.
|
|
|
02e2f5f |
.SH "SYNOPSIS"
|
|
|
02e2f5f |
.B #include <selinux/selinux.h>
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B #include <selinux/avc.h>
|
|
|
02e2f5f |
.sp
|
|
|
60d47fe |
.BI "int avc_init(const char *" msgprefix ,
|
|
|
60d47fe |
.in +\w'int avc_init('u
|
|
|
60d47fe |
.BI "const struct avc_memory_callback *" mem_callbacks ,
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.BI "const struct avc_log_callback *" log_callbacks ,
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.BI "const struct avc_thread_callback *" thread_callbacks ,
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.BI "const struct avc_lock_callback *" lock_callbacks ");"
|
|
|
60d47fe |
.in
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/security_load_booleans.3.rhat libselinux-2.0.14/man/man3/security_load_booleans.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/security_load_booleans.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/security_load_booleans.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -7,15 +7,15 @@ security_get_boolean_pending \- routines
|
|
|
02e2f5f |
.B #include <selinux/selinux.h>
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
extern int security_load_booleans(char *path);
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
extern int security_get_boolean_names(char ***names, int *len);
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
extern int security_get_boolean_pending(const char *name);
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
extern int security_get_boolean_active(const char *name);
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
extern int security_set_boolean(const char *name, int value);
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
extern int security_commit_booleans(void);
|
|
|
02e2f5f |
|
|
|
02e2f5f |
|
|
|
60d47fe |
@@ -29,27 +29,27 @@ policy without having to load a new poli
|
|
|
02e2f5f |
The SELinux API allows for a transaction based update. So you can set several boolean values and the commit them all at once.
|
|
|
02e2f5f |
|
|
|
02e2f5f |
security_load_booleans
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
Load policy boolean settings. Path may be NULL, in which case the booleans are loaded from the active policy boolean configuration file.
|
|
|
02e2f5f |
|
|
|
02e2f5f |
security_get_boolean_names
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
Returns a list of boolean names, currently supported by the loaded policy.
|
|
|
02e2f5f |
|
|
|
02e2f5f |
security_set_boolean
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
Sets the pending value for boolean
|
|
|
02e2f5f |
|
|
|
02e2f5f |
security_get_boolean_pending
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
Return pending value for boolean
|
|
|
02e2f5f |
|
|
|
02e2f5f |
security_get_boolean_active
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
Return active value for boolean
|
|
|
02e2f5f |
|
|
|
02e2f5f |
security_commit_booleans
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
Commit all pending values for the booleans.
|
|
|
02e2f5f |
|
|
|
02e2f5f |
.SH AUTHOR
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/avc_add_callback.3.rhat libselinux-2.0.14/man/man3/avc_add_callback.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/avc_add_callback.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/avc_add_callback.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -6,26 +6,26 @@
|
|
|
60d47fe |
avc_add_callback \- additional event notification for SELinux userspace object managers.
|
|
|
02e2f5f |
.SH "SYNOPSIS"
|
|
|
02e2f5f |
.B #include <selinux/selinux.h>
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B #include <selinux/avc.h>
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
.BI "int avc_add_callback(int (*" callback ")(uint32_t " event ,
|
|
|
60d47fe |
.in +\w'int avc_add_callback(int (*callback)('u
|
|
|
60d47fe |
.BI "security_id_t " ssid ,
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.BI "security_id_t " tsid ,
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.BI "security_class_t " tclass ,
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.BI "access_vector_t " perms ,
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.BI "access_vector_t *" out_retained "),"
|
|
|
60d47fe |
.in
|
|
|
60d47fe |
.in +\w'int avc_add_callback('u
|
|
|
60d47fe |
.BI "uint32_t " events ", security_id_t " ssid ,
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.BI "security_id_t " tsid ", security_class_t " tclass ,
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.BI "access_vector_t " perms ");"
|
|
|
60d47fe |
.in
|
|
|
60d47fe |
.SH "DESCRIPTION"
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/avc_has_perm.3.rhat libselinux-2.0.14/man/man3/avc_has_perm.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/avc_has_perm.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/avc_has_perm.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -6,7 +6,7 @@
|
|
|
60d47fe |
avc_has_perm, avc_has_perm_noaudit, avc_audit, avc_entry_ref_init \- obtain and audit SELinux access decisions.
|
|
|
60d47fe |
.SH "SYNOPSIS"
|
|
|
60d47fe |
.B #include <selinux/selinux.h>
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B #include <selinux/avc.h>
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
.BI "void avc_entry_ref_init(struct avc_entry_ref *" aeref ");"
|
|
|
60d47fe |
@@ -14,21 +14,21 @@ avc_has_perm, avc_has_perm_noaudit, avc_
|
|
|
60d47fe |
.BI "int avc_has_perm(security_id_t " ssid ", security_id_t " tsid ,
|
|
|
60d47fe |
.in +\w'int avc_has_perm('u
|
|
|
60d47fe |
.BI "security_class_t " tclass ", access_vector_t " requested ,
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.BI "struct avc_entry_ref *" aeref ", void *" auditdata ");"
|
|
|
60d47fe |
.in
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
.BI "int avc_has_perm_noaudit(security_id_t " ssid ", security_id_t " tsid ,
|
|
|
60d47fe |
.in +\w'int avc_has_perm('u
|
|
|
60d47fe |
.BI "security_class_t " tclass ", access_vector_t " requested ,
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.BI "struct avc_entry_ref *" aeref ", struct av_decision *" avd ");"
|
|
|
60d47fe |
.in
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
.BI "void avc_audit(security_id_t " ssid ", security_id_t " tsid ,
|
|
|
60d47fe |
.in +\w'void avc_audit('u
|
|
|
60d47fe |
.BI "security_class_t " tclass ", access_vector_t " requested ,
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.BI "struct av_decision *" avd ", int " result ", void *" auditdata ");"
|
|
|
60d47fe |
.in
|
|
|
60d47fe |
.SH "DESCRIPTION"
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/get_ordered_context_list.3.rhat libselinux-2.0.14/man/man3/get_ordered_context_list.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/get_ordered_context_list.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/get_ordered_context_list.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -4,7 +4,7 @@ get_ordered_context_list, get_ordered_co
|
|
|
02e2f5f |
|
|
|
60d47fe |
.SH "SYNOPSIS"
|
|
|
02e2f5f |
.B #include <selinux/selinux.h>
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.B #include <selinux/get_context_list.h>
|
|
|
02e2f5f |
.sp
|
|
|
60d47fe |
.BI "int get_ordered_context_list(const char *" user ", security_context_t "fromcon ", security_context_t **" list );
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/getcon.3.rhat libselinux-2.0.14/man/man3/getcon.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/getcon.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/getcon.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -1,21 +1,21 @@
|
|
|
60d47fe |
.TH "getcon" "3" "1 January 2004" "russell@coker.com.au" "SE Linux API documentation"
|
|
|
60d47fe |
.SH "NAME"
|
|
|
60d47fe |
getcon, getprevcon, getpidcon \- get SELinux security context of a process.
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
getpeercon - get security context of a peer socket.
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
setcon - set current security context of a process.
|
|
|
60d47fe |
.SH "SYNOPSIS"
|
|
|
60d47fe |
.B #include <selinux/selinux.h>
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
.BI "int getcon(security_context_t *" context );
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.BI "int getprevcon(security_context_t *" context );
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.BI "int getpidcon(pid_t " pid ", security_context_t *" context );
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.BI "int getpeercon(int " fd ", security_context_t *" context);
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.BI "int setcon(security_context_t " context);
|
|
|
02e2f5f |
|
|
|
02e2f5f |
.SH "DESCRIPTION"
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/avc_cache_stats.3.rhat libselinux-2.0.14/man/man3/avc_cache_stats.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/avc_cache_stats.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/avc_cache_stats.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -6,7 +6,7 @@
|
|
|
60d47fe |
avc_cache_stats, avc_av_stats, avc_sid_stats \- obtain userspace SELinux AVC statistics.
|
|
|
60d47fe |
.SH "SYNOPSIS"
|
|
|
60d47fe |
.B #include <selinux/selinux.h>
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B #include <selinux/avc.h>
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
.BI "void avc_av_stats(void);"
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/avc_context_to_sid.3.rhat libselinux-2.0.14/man/man3/avc_context_to_sid.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/avc_context_to_sid.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/avc_context_to_sid.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -6,7 +6,7 @@
|
|
|
60d47fe |
avc_context_to_sid, avc_sid_to_context, sidput, sidget, avc_get_initial_sid \- obtain and manipulate SELinux security ID's.
|
|
|
60d47fe |
.SH "SYNOPSIS"
|
|
|
60d47fe |
.B #include <selinux/selinux.h>
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.B #include <selinux/avc.h>
|
|
|
60d47fe |
.sp
|
|
|
60d47fe |
.BI "int avc_context_to_sid(security_context_t " ctx ", security_id_t *" sid ");"
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/selinux_policy_root.3.rhat libselinux-2.0.14/man/man3/selinux_policy_root.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/selinux_policy_root.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/selinux_policy_root.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -5,7 +5,7 @@ selinux_policy_root \- return the path o
|
|
|
02e2f5f |
.B #include <selinux/selinux.h>
|
|
|
02e2f5f |
.sp
|
|
|
02e2f5f |
.B char *selinux_policy_root();
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
02e2f5f |
|
|
|
02e2f5f |
.SH "DESCRIPTION"
|
|
|
02e2f5f |
.B selinux_policy_root
|
|
|
60d47fe |
diff -up libselinux-2.0.14/man/man3/context_new.3.rhat libselinux-2.0.14/man/man3/context_new.3
|
|
|
60d47fe |
--- libselinux-2.0.14/man/man3/context_new.3.rhat 2007-04-24 10:36:21.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/man/man3/context_new.3 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -4,27 +4,27 @@ context_new, context_str, context_free,
|
|
|
60d47fe |
|
|
|
60d47fe |
.SH "SYNOPSIS"
|
|
|
60d47fe |
.B #include <selinux/context.h>
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B "context_t context_new(const char *" context_str );
|
|
|
02e2f5f |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B "const char * context_str(context_t " con );
|
|
|
60d47fe |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B "void context_free(context_t " con );
|
|
|
60d47fe |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B "const char * context_type_get(context_t " con );
|
|
|
60d47fe |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B "const char * context_range_get(context_t " con );
|
|
|
60d47fe |
-.br
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
.B "const char * context_role_get(context_t " con );
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.B "const char * context_user_get(context_t " con );
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.B "const char * context_type_set(context_t " con ", const char* " type);
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.B "const char * context_range_set(context_t " con ", const char* " range);
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.B "const char * context_role_set(context_t " con ", const char* " role );
|
|
|
60d47fe |
-.br
|
|
|
60d47fe |
+
|
|
|
60d47fe |
.B "const char * context_user_set(context_t " con ", const char* " user );
|
|
|
02e2f5f |
|
|
|
60d47fe |
.SH "DESCRIPTION"
|
|
|
60d47fe |
diff -up libselinux-2.0.14/Makefile.rhat libselinux-2.0.14/Makefile
|
|
|
60d47fe |
--- libselinux-2.0.14/Makefile.rhat 2007-04-24 10:36:19.000000000 -0400
|
|
|
32b1322 |
+++ libselinux-2.0.14/Makefile 2007-09-07 09:17:52.000000000 -0400
|
|
|
60d47fe |
@@ -2,6 +2,9 @@ all:
|
|
|
60d47fe |
$(MAKE) -C src
|
|
|
60d47fe |
$(MAKE) -C utils
|
|
|
02e2f5f |
|
|
|
60d47fe |
+swigify:
|
|
|
60d47fe |
+ $(MAKE) -C src swigify
|
|
|
02e2f5f |
+
|
|
|
60d47fe |
pywrap:
|
|
|
60d47fe |
$(MAKE) -C src pywrap
|
|
|
60d47fe |
|