RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux/checkpolicy/checkpolicy.8

89 lines
2.8 KiB
Groff
Raw Permalink Normal View History

initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.TH CHECKPOLICY 8
.SH NAME
checkpolicy \- SELinux policy compiler
.SH SYNOPSIS
.B checkpolicy
checkpolicy: add option to skip checking neverallow rules Add the command line argument `-N/--disable-neverallow`, similar to secilc(8), to checkpolicy(8) and checkmodule(8) to skip the check of neverallow rule violations. This is mainly useful in development, e.g. to quickly add rules to a policy without fulfilling all neverallow rules or build policies with known violations. Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Acked-by: James Carter <jwcart2@gmail.com>
2023-05-12 09:57:49 +00:00
.I "[\-b[F]] [\-C] [\-d] [\-U handle_unknown (allow,deny,reject)] [\-M] [\-N] [\-c policyvers] [\-o output_file|\-] [\-S] [\-t target_platform (selinux,xen)] [\-O] [\-E] [\-V] [input_file]"
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.br
.SH "DESCRIPTION"
This manual page describes the
.BR checkpolicy
command.
.PP
.B checkpolicy
is a program that checks and compiles a SELinux security policy configuration
checkpolicy: Add examples to man pages Signed-off-by: Vit Mojzis <vmojzis@redhat.com> Acked-by: Petr Lautrbach <lautrbach@redhat.com>
2023-06-01 14:39:14 +00:00
into a binary representation that can be loaded into the kernel.
If no input file name is specified,
checkpolicy: update documentation Add missing command-line arguments to synopsis and highlight mentions of other tools in man pages. Add missing space between arguments in help message. Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2021-09-28 15:46:18 +00:00
.B checkpolicy
will attempt to read from policy.conf or policy, depending on whether the \-b
flag is specified.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH OPTIONS
.TP
Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) This patch is proposed to solve Ticket #1 [1672486] (command line binaries should support --version and --help). It adds handling of -h, -V and the long formats --help and --version to all binaries (checkpolicy/checkmodule). It also adds handling of long options for some of the available options. Manual pages have also been updated accordingly (and a few undocumented options have been documented). Guido Trentalancia Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-02 17:14:28 +00:00
.B \-b,\-\-binary
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
Read an existing binary policy file rather than a source policy.conf file.
.TP
checkpolicy: Update manpage - Add description of -S option - Sort the option descriptions based on the synopsis - Add missing options to synopsis Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
2019-02-07 10:25:45 +00:00
.B \-F,\-\-conf
Write policy.conf file rather than binary policy file. Can only be used with binary policy file.
.TP
checkpolicy: Add support for generating CIL Add support to checkpolicy and checkmodule for generating CIL as their output. Add new options "-C" and "--cil" to specify CIL as the output format. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2015-04-01 14:05:04 +00:00
.B \-C,\-\-cil
Write CIL policy file rather than binary policy file.
.TP
Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) This patch is proposed to solve Ticket #1 [1672486] (command line binaries should support --version and --help). It adds handling of -h, -V and the long formats --help and --version to all binaries (checkpolicy/checkmodule). It also adds handling of long options for some of the available options. Manual pages have also been updated accordingly (and a few undocumented options have been documented). Guido Trentalancia Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-02 17:14:28 +00:00
.B \-d,\-\-debug
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
Enter debug mode after loading the policy.
.TP
checkpolicy: Update manpage - Add description of -S option - Sort the option descriptions based on the synopsis - Add missing options to synopsis Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
2019-02-07 10:25:45 +00:00
.B \-U,\-\-handle-unknown <action>
Specify how the kernel should handle unknown classes or permissions (deny, allow or reject).
checkpolicy: Add options to convert binary policy to CIL or a policy.conf Use the same option "-C" used to ouput CIL from a policy.conf, but now generate CIL from a binary policy instead of giving an error.i Use the option "-F" to generate a policy.conf file from a binary policy. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2017-03-21 20:00:30 +00:00
.TP
Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) This patch is proposed to solve Ticket #1 [1672486] (command line binaries should support --version and --help). It adds handling of -h, -V and the long formats --help and --version to all binaries (checkpolicy/checkmodule). It also adds handling of long options for some of the available options. Manual pages have also been updated accordingly (and a few undocumented options have been documented). Guido Trentalancia Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-02 17:14:28 +00:00
.B \-M,\-\-mls
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
Enable the MLS policy when checking and compiling the policy.
.TP
checkpolicy: add option to skip checking neverallow rules Add the command line argument `-N/--disable-neverallow`, similar to secilc(8), to checkpolicy(8) and checkmodule(8) to skip the check of neverallow rule violations. This is mainly useful in development, e.g. to quickly add rules to a policy without fulfilling all neverallow rules or build policies with known violations. Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Acked-by: James Carter <jwcart2@gmail.com>
2023-05-12 09:57:49 +00:00
.B \-N,\-\-disable-neverallow
Do not check neverallow rules.
.TP
checkpolicy: Update manpage - Add description of -S option - Sort the option descriptions based on the synopsis - Add missing options to synopsis Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
2019-02-07 10:25:45 +00:00
.B \-c policyvers
Specify the policy version, defaults to the latest.
.TP
Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) This patch is proposed to solve Ticket #1 [1672486] (command line binaries should support --version and --help). It adds handling of -h, -V and the long formats --help and --version to all binaries (checkpolicy/checkmodule). It also adds handling of long options for some of the available options. Manual pages have also been updated accordingly (and a few undocumented options have been documented). Guido Trentalancia Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-02 17:14:28 +00:00
.B \-o,\-\-output filename
checkpolicy: update the description for -o option in the man page Write about policy.conf and CIL files. Signed-off-by: Masatake YAMATO <yamato@redhat.com>
2019-10-19 10:26:55 +00:00
Write a policy file (binary, policy.conf, or CIL policy)
checkpolicy: allow to write policy to stdout If - is given as filename for -o option, checkpolicy writes the policy to standard output. This helps users to read policy.conf and/or CIL policy file with pager like less command: $ checkpolicy -M -F -b /sys/fs/selinux/policy -o - | less The users don't have to make a temporary file. /dev/stdout can be used instead. However, - reduces the number of typing for the purpose. Using - for standard output (and/or standard input) is popular convention. Change(s) in v2: * Check the availability of output stream only when opening a regualar file. Suggested by Stephen Smalley <sds@tycho.nsa.gov>. Signed-off-by: Masatake YAMATO <yamato@redhat.com>
2019-10-19 10:26:56 +00:00
to the specified filename. If - is given as filename,
write it to standard output.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.TP
checkpolicy: Update manpage - Add description of -S option - Sort the option descriptions based on the synopsis - Add missing options to synopsis Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
2019-02-07 10:25:45 +00:00
.B \-S,\-\-sort
Sort ocontexts before writing out the binary policy. This option makes output of checkpolicy consistent with binary policies created by semanage and secilc.
Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) This patch is proposed to solve Ticket #1 [1672486] (command line binaries should support --version and --help). It adds handling of -h, -V and the long formats --help and --version to all binaries (checkpolicy/checkmodule). It also adds handling of long options for some of the available options. Manual pages have also been updated accordingly (and a few undocumented options have been documented). Guido Trentalancia Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-02 17:14:28 +00:00
.TP
.B \-t,\-\-target
Specify the target platform (selinux or xen).
.TP
checkpolicy: add flag to enable policy optimization Add the command-line option 'O' to checkpolicy to cause kernel policies to be optimized by calling policydb_optimize() before being written out. This option can be used on conf files and binary kernel policies, but not when converting a conf file to CIL. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov> [omosnace: make commit desc more consistent with the other patches] [omosnace: fix a typo in the commit message] [omosnace: directly use policydb_optimize() as also the rest of code already uses other policydb_*() functions...] [omosnace: update man page] Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
2019-06-13 11:45:58 +00:00
.B \-O,\-\-optimize
Optimize the final kernel policy (remove redundant rules).
.TP
checkpolicy: Add --werror flag to checkmodule and checkpolicy to treat warnings as errors. When the lexer encounters an unexpected character in a policy source file, it prints a warning, discards the character and moves on. In some build environments, these characters could be a symptom of an earlier problem, such as unintended results of expansion of preprocessor macros, and the ability to have the compiler halt on such issues would be helpful for diagnosis. Signed-off-by: Daniel Burgener <Daniel.Burgener@microsoft.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
2020-03-05 18:40:34 +00:00
.B \-E,\-\-werror
Treat warnings as errors
.TP
Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) This patch is proposed to solve Ticket #1 [1672486] (command line binaries should support --version and --help). It adds handling of -h, -V and the long formats --help and --version to all binaries (checkpolicy/checkmodule). It also adds handling of long options for some of the available options. Manual pages have also been updated accordingly (and a few undocumented options have been documented). Guido Trentalancia Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-02 17:14:28 +00:00
.B \-V,\-\-version
Show version information.
.TP
.B \-h,\-\-help
Show usage information.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
checkpolicy: Add examples to man pages Signed-off-by: Vit Mojzis <vmojzis@redhat.com> Acked-by: Petr Lautrbach <lautrbach@redhat.com>
2023-06-01 14:39:14 +00:00
.SH EXAMPLE
.nf
Generate policy.conf based on the system policy
# checkpolicy -b -M -F /etc/selinux/targeted/policy/policy.33 -o policy.conf
Recompile system policy so that unknown permissions are denied (uses policy.conf from ^^).
Note that binary policy extension represents its version, which is subject to change
# checkpolicy -M -U deny -o /etc/selinux/targeted/policy/policy.33 policy.conf
# load_policy
Generate CIL representation of current system policy
# checkpolicy -b -M -C /etc/selinux/targeted/policy/policy.33 -o policy.out
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH "SEE ALSO"
Replace www.nsa.gov references by github.com/SELinuxProject The original page doesn't exist anymore. Fixes: https://github.com/SELinuxProject/selinux/issues/170 Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-11-06 16:30:43 +00:00
SELinux Reference Policy documentation at https://github.com/SELinuxProject/refpolicy/wiki
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH AUTHOR
checkpolicy: Minor tweaks to the names of the contributors to the manpages Spell Árpád’s name with the correct diacritics, put Olesya’s first name in front of her last name. Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-05-25 13:14:55 +00:00
This manual page was written by Árpád Magosányi <mag@bunuel.tii.matav.hu>,
checkpolicy,libselinux,libsepol,policycoreutils,semodule-utils: update my email Update my email address. Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com> Acked-by: James Carter <jwcart2@gmail.com>
2023-07-19 17:36:36 +00:00
and edited by Stephen Smalley <stephen.smalley.work@gmail.com>.
The program was written by Stephen Smalley <stephen.smalley.work@gmail.com>.