aboutsummaryrefslogtreecommitdiffstats
path: root/libselinux/man/man3
Commit message (Collapse)AuthorAgeFilesLines
* libselinux: Add security_reject_unknown(3) man pagePetr Lautrbach2019-03-112-1/+20
| | | | | | | | Commit c19395d72295 ("libselinux: selinux_set_mapping: fix handling of unknown classes/perms") added a new interface security_reject_unknown() which needs to be documented. Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
* Fix minor typosYuri Chornoivan2018-06-301-1/+1
| | | | Signed-off-by: Yuri Chornoivan <yurchor@ukr.net>
* libselinux: fix the whatis line for the selinux_boolean_sub.3 manpageLaurent Bigonville2018-05-301-1/+1
| | | | Signed-off-by: Laurent Bigonville <bigon@bigon.be>
* libselinux: Fix spelling errors in manpagesLaurent Bigonville2018-05-302-2/+2
| | | | Signed-off-by: Laurent Bigonville <bigon@bigon.be>
* libselinux: add security_get_checkreqprotChristian Göttsche2017-05-081-1/+10
| | | | | Add security_get_checkreqprot() function, returning the current active checkreqprot value
* setfiles: Fix setfiles progress indicatorRichard Haines2017-01-271-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | This fixes the following bug: UX regression: setfiles progress indicator is now misleading and confusing in fixfiles. The outputting of * is replaced by the number of files in 1k increments as the previous versions. If "/" is specified on the pathname, then this will indicate a mass relabel, an example output will be: restorecon -nRp /etc /tmp /boot / /etc 100.0% /tmp 100.0% /boot 100.0% 3.2% Also setfiles(8) and restorecon(8) versions that are implemented using the selinux_restorecon(3) function do not support the [-o filename] option as this was deprecated. This has now been made clear by displaying a message to stderr. The documentation has also been updated to reflect these changes. Reported-by: Alan Jenkins <alan.christopher.jenkins@gmail.com> Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: selinux_restorecon.3 man page typo fixLokesh Mandvekar2017-01-251-1/+1
| | | | Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
* libselinux: fix argument order in get_default_context_with_rolelevel() docNicolas Iooss2017-01-191-1/+1
| | | | | | | | | | | | | | | | | | | | | libselinux/src/get_context_list.c defines get_default_context_with_rolelevel(user, role, level... libselinux/utils/getdefaultcon.c uses get_default_context_with_rolelevel(seuser, role, level... but libselinux/include/selinux/get_context_list.h declares get_default_context_with_rolelevel(user, level, role... and libselinux/man/man3/get_ordered_context_list.3 follows this declaration. Fix the header and the man page. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
* man: standardize spacing with pointers in prototypesMike Frysinger2016-12-1214-46/+46
| | | | | | | | | | | | The majority of prototypes don't put a space between the "*" and the parameter name. i.e. this style is incorrect: char * foo; Instead, we want: char *foo; Fix a bunch of references that use this uncommon style. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libselinux: Add function to find security.restorecon_last entriesRichard Haines2016-09-266-9/+185
| | | | | | | | | | This patch adds a new selinux_restorecon_xattr(3) function to find and/or remove security.restorecon_last entries added by setfiles(8) or restorecon(8). Also review and update the man pages. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: Add setfiles support to selinux_restorecon(3)Richard Haines2016-08-114-26/+100
| | | | | | | | Add additional error handling, flags, xdev handling, alt_rootpath and add/remove non-seclabel fs's to support setfiles(8), restorecon(8) and restorecond(8) functionality. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: Evaluate inodes in selinux_restorecon(3)Richard Haines2016-08-111-2/+5
| | | | | | | | | | This patch adds inode evaluation services from policycoreutiles/setfiles to selinux_restorecon.c The overall objective is to modify restorecon(8) and setfiles(8) to use selinux_restorecon(3) services. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: man: Clarify is_selinux_mls_enabled() descriptionDavid King2016-06-231-1/+3
| | | | | | | | | Improve the description by mentioning that if is_selinux_mls_enabled(), it simply means that the kernel has MLS support and the policy contains MLS features. To check whether MLS support is enabled on the running system, use selinux_getpolicytype(). Signed-off-by: David King <dking@redhat.com>
* libselinux: man: Explain how to free policy type from selinux_getpolicytype()David King2016-06-231-1/+4
| | | | | | Additionally, fix a typo. Signed-off-by: David King <dking@redhat.com>
* Fix multiple spelling errorsLaurent Bigonville2016-05-023-4/+4
| | | | Thanks to the lintian utility from Debian
* Fix location of selinuxfs mount pointDan Walsh2016-03-252-3/+3
|
* libselinux: selinux_restorecon.3 man page corrections.Richard Haines2016-02-221-12/+20
| | | | | | | Fix typo's and clarify usage. Reported-by: Nicolas Iooss <nicolas.iooss@m4x.org> Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: Add selinux_restorecon functionRichard Haines2016-02-174-0/+325
| | | | | | | | | | | | The selinux_restorecon(3) man page details this function. It has been built using the work from Android where an SHA1 hash of the specfiles is held in an extended attribute to enhance performance. Also contains components from policycoreutils/setfiles. The utils/selinux_restorecon.c utility demonstrates the functionality. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux/man: Add information about thread specific on setfscreateconDan Walsh2015-12-173-0/+14
| | | | Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
* libselinux, policycoreutils: Man page warning fixesVille Skyttä2015-11-242-2/+2
| | | | Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>
* libselinux: Add selabel_digest functionRichard Haines2015-10-132-0/+66
| | | | | | | | | | | | | | selabel_digest(3) if enabled by the SELABEL_OPT_DIGEST option during selabel_open(3) will return an SHA1 digest of the spec files, plus a list of the specfiles used to calculate the digest. There is a test utility supplied that will demonstrate the functionality. The use case for selabel_digest(3) is to implement an selinux_restorecon function based on the Android version that writes a hash of the file_contexts files to an extended attribute to enhance performance (see external/libselinux/src/android.c selinux_android_restorecon()). Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: Add const to selinux_opt for label backends.Richard Haines2015-07-101-1/+1
| | | | | | | | Change selabel_open and label backends to take a 'const struct selinux_opt' argument. This work has already been done for the Android version components. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: Expunge remaining references to flask.h and av_permissions.h.Stephen Smalley2015-05-272-4/+0
| | | | | | | Missed a few references to these header files when they were deprecated in 76913d8adb61b5afe28fd3b4ce91feab29e284dd. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: matchpathcon/selabel_file: Fix man pages.Stephen Smalley2015-05-111-5/+40
| | | | | | | | | | | | As discussed in https://bugzilla.redhat.com/show_bug.cgi?id=1219718, there are several inconsistencies between the matchpathcon man page and the implementation. The same is true of the SELABEL_OPT_SUBSET option for the selabel_file backend. Fix the man pages for both. Also note in the man pages that the entire matchpathcon family of functions is deprecated and recommend use of the corresponding selabel interfaces for new code. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: Add selabel partial and best match APIsRichard Haines2015-05-063-0/+135
| | | | | | | | | | | | Add support for new API functions selabel_partial_match and selabel_lookup_best_match ported from the Android libselinux fork. Add supporting man(3) pages and test utilities: selabel_lookup, selabel_lookup_best_match and selabel_partial_match. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: getcon.3: Fix setcon description.Stephen Smalley2015-02-231-3/+11
| | | | | | | The man page description for setcon() was never updated for the introduction of bounded transitions in Linux 2.6.28. Update it. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: man: Add missing manpage links to security_load_policy.3Laurent Bigonville2014-09-022-0/+2
| | | | | | | | | Add the missing manpage link for selinux_init_load_policy(3) and selinux_mkload_policy(3) to security_load_policy(3) https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=753803 Acked-by: Steve Lawrence <slawrence@tresys.com>
* Get rid of security_context_t and fix const declarations.Stephen Smalley2014-02-1919-80/+80
| | | | | | | | | | | | | | | | | | | | In attempting to enable building various part of Android with -Wall -Werror, we found that the const security_context_t declarations in libselinux are incorrect; const char * was intended, but const security_context_t translates to char * const and triggers warnings on passing const char * from the caller. Easiest fix is to replace them all with const char *. And while we are at it, just get rid of all usage of security_context_t itself as it adds no value - there is no true encapsulation of the security context strings and callers already directly use string functions on them. typedef left to permit building legacy users until such a time as all are updated. This is a port of Change-Id I2f9df7bb9f575f76024c3e5f5b660345da2931a7 from Android, augmented to deal with all of the other code in upstream libselinux and updating the man pages too. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: Eric Paris <eparis@redhat.com>
* libselinux: Refactor rpm_execcon() into a new setexecfilecon()Guillem Jover2014-01-061-3/+20
| | | | | | | | | | | This new function allows a process to invoke helper programs with a new execution context based on the filename, this is initially intended for package managers so that they can easily execute package scriptlets or maintainer scripts. Base rpm_execcon() off this new function. Signed-off-by: Guillem Jover <guillem@debian.org>
* Add selinux_current_policy_path, which returns the a pointer to the loaded ↵Dan Walsh2013-10-242-1/+7
| | | | | | | policy Also change audit2why to look at the loaded policy rather then searching on disk for the policy file. It is more likely that you are examining the running policy.
* Add selinux_set_policy_root sets an alternate policy root directory pathDan Walsh2013-10-241-0/+1
| | | | | | This allows us to specify under which the compiled policy file and context configuration files exist. We can use this with matchpathcon to check the labels under alternate policies, and we can use it for sepolicy manpage to build manpages during policy build.
* Laurent Bigonville patch to fix various minor manpage issues and correct ↵Dan Walsh2013-10-244-8/+21
| | | | section numbering.
* libselinux: man: context_new(3): fix the return value descriptionPádraig Brady2013-02-051-1/+7
| | | | | Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
* libselinux: man: Add references and man page links to _raw function variantsGuillem Jover2013-02-0538-0/+149
| | | | | | Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
* libselinux: man: Fix typo in man pageGuillem Jover2013-02-051-1/+1
| | | | | | Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
* libselinux: man: Fix man pages formattingGuillem Jover2013-02-0550-855/+1048
| | | | | | | | | | | | | | | | | | | | | | | | | | | - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
* libselinux: man: Fix program synopsis and function prototypes in man pagesGuillem Jover2013-02-056-24/+24
| | | | | | | | Fix typos, or wrong function prototypes. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
* libselinux: mode_to_security_class: interface to translate a mode_t in to a ↵rhatdan2013-02-052-1/+10
| | | | | | | | | | | security class coreutils needs to be able to take a statbuf and ask permissions questions. This gives us the interface to translate that statbuf mode_t into a security class which can be used. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
* libselinux: Add man page for new selinux_boolean_sub function.Dan Walsh2012-09-121-0/+25
| | | | Signed-off-by: Eric Paris <eparis@redhat.com>
* libselinux: security_compute_create_name(3)Kohei KaiGai2012-03-282-1/+17
| | | | | | | | | I'd like to use this interface to implement special case handling for the default labeling behavior on temporary database objects. Allow userspace to use the filename_trans rules added to policy. Signed-off-by: KaiGai Kohei <kohei.kaigai@emea.nec.com> Signed-off-by: Eric Paris <eparis@redhat.com>
* libselinux: merge freecon with getcon man pageEric Paris2011-12-213-28/+20
| | | | | | | The getcon man page already includes setcon() and other non-"get" entries. Why send people somewhere else just for freecon? Put it here. Signed-off-by: Eric Paris <eparis@redhat.com>
* libselinux: Cleanup Man pagesDan Walsh2011-12-212-19/+19
| | | | | | Typos, indenting, nothing fancy. Signed-off-by: Eric Paris <eparis@redhat.com>
* libselinux: simple interface for access checksDan Walsh2011-11-022-0/+6
| | | | | | | | | | | | Some programs, like passwd, need to do simeple one time access checks. Rather than set up a full avc cache and use that infrastructure they were directly using security_compute_av. A problem with this approach is the lack of audit on denials. This patch creates a new interface that is simple to use and which will still listen to things like permissive and output audit messages on denials. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
* libselinux: selinux_file_context_verify function returns wrong value.Richard Haines2011-08-262-13/+160
| | | | | | | | | | | | | | | | selinux_file_context_verify(3) should now return the correct codes and matchpathcon(8) has been modified to handle them. The selinux_file_context_verify(3)and selinux_file_context_cmp(3) man pages have also been updated (re-written really) to correct return codes. I found that selabel_open left errno set to ENOENT because a file_contexts.subs file did not exist on my system, but left selabel_open alone and set errno = 0 before calling selinux_filecontext_cmp. [fix uninitialize init variable in matchpathcon.c::main - eparis] Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
* Fix plural secolor.conf in the man page and black/white mixupSteve Lawrence2011-04-111-3/+3
| | | | Signed-off-by: Steve Lawrence <slawrence@tresys.com>
* Add libselinux man pages for colour functionsRichard Haines2011-04-112-0/+160
| | | | | | | Add man pages for selinux_raw_context_to_color(5), selinux_colors_path(3) and secolors.conf(5). Signed-off-by: Richard Haines <richard_c_haines@btinternet.com> Signed-off-by: Steve Lawrence <slawrence@tresys.com>
* libselinux: add selinux_status_* interfaces for /selinux/statusKaiGai Kohei2011-03-016-0/+101
| | | | | | | | | | | | | | | | | | The attached patch adds several interfaces to reference /selinux/status according to sequential-lock logic. selinux_status_open() open the kernel status page and mmap it with read-only mode, or open netlink socket as a fallback in older kernels. Then, we can obtain status information from the mmap'ed page using selinux_status_updated(), selinux_status_getenfoce(), selinux_status_policyload() or selinux_status_deny_unknown(). It enables to help to implement userspace avc with heavy access control decision; that we cannot ignore the cost to communicate with kernel for validation of userspace caches. Signed-off-by: Steve Lawrence <slawrence@tresys.com>
* Merge branch 'master' of oss.tresys.com:/home/git/selinuxJoshua Brindle2010-03-182-3/+11
|\
| * This patch allows selabel_*() interfaces to provide an expected security contextEamon Walsh2010-03-152-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | for the given database object identified by its name and object class. It is necessary to implement a feature something like the restorecon on databases. The specfile shall be described as follows: ------------------------ # # The specfile for database objects # (for SE-PostgreSQL) # # <object class> <object name> <security context> # db_database * system_u:object_r:sepgsql_db_t:s0 db_schema *.pg_catalog system_u:obejct_r:sepgsql_sys_schema_t:s0 db_schema *.* system_u:object_r:sepgsql_schema_t:s0 db_table *.pg_catalog.* system_u:object_r:sepgsql_sysobj_t:s0 db_table *.*.* system_u:object_r:sepgsql_table_t:s0 ------------------------ - All the characters after the '#' are ignored. - Wildcards ('*' and '?') are available. - It returns the first match security context. Note that hierarchy of the namespace of database objects depends on RDBMS. So, author of the specfile needs to write correct patterns which are suitable for the target RDBMS. The patched selabel_*() interfaces don't have any heuristics for the namespace hierarchy to be suitable for widespread RDBMSs. In the case of SE-PgSQL, when we lookup an expected security context for the 'my_table' table in the 'public' schema and 'postgres' database, the caller shall provide 'postgres.public.my_table' as a key. In the default, it tries to read a specfile which maps database objects and security context from the /etc/selinux/$POLICYTYPE/contexts/sepgsql_contexts. Note that when another RDBMS uses this interface, it needs to give an explicit SELABEL_OPT_PATH option on the selabel_open(). Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com> Acked-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
* | Author: Daniel J WalshDaniel J Walsh2010-03-181-1/+2
|/ | | | | | | Email: dwalsh@redhat.com Subject: Small patch to fix is_selinux_enabled man page. Date: Tue, 16 Mar 2010 12:35:22 -0400 Signed-off-by: Joshua Brindle <method@manicmethod.com>
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-13 07:29:59 +0000