RepoMirrors/setools
1
0
Fork 0
mirror of https://github.com/SELinuxProject/setools synced 2025-01-31 04:01:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

sechecker.1: Minor revisions to TE rule assertion.

Browse Source 
Add text for expected rules and note that setting expect is optional.

Signed-off-by: Chris PeBenito <pebenito@ieee.org>
This commit is contained in:
Chris PeBenito 2020-08-23 11:19:29 -04:00
parent 83f91adb2c
commit c852d5b6cb
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
man/sechecker.1
View File

@ -62,8 +62,9 @@ was not ran.
.SH "TYPE ENFORCEMENT ALLOW RULE ASSERTION"
This checks for the nonexistence of type enforcement allow rules. The check_type
is \fBassert_te\fR. It will run the query and any results from the query,
is \fBassert_te\fR. It will run the query and any unexpected results from the query,
removing any exempted sources or targets, will be listed as failures.
Any expected results that are not seen will also be listed as failures.
If a rule has an empty attribute, rendering it useless, it will
be ignored. If a rule has an attribute, it will be considered
a failure unless all of the member types are exempted.
@ -89,12 +90,12 @@ Additional Options:
A space-separated list of types and type attributes. Each of these
types must be seen as the source of a rule that matches the criteria.
At the end of the query, each unseen type in this list will be reported
as a failure.
as a failure. This is optional.
.IP "expect_target = <type or type attribute>[ ....]"
A space-separated list of types and type attributes. Each of these
types must be seen as the target of a rule that matches the criteria.
At the end of the query, each unseen type in this list will be reported
as a failure.
as a failure. This is optional.
.IP "exempt_source = <type or type attribute>[ ....]"
A space-separated list of types and type attributes. Rules with these
as the source will be ignored. This is optional.