RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux/policycoreutils/sandbox/seunshare.8

44 lines
1.5 KiB
Groff
Raw Normal View History

policycoreutils: sandbox: Makefile: new man pages we have man pages which aren't being instelled with make install. We also do not include -Werror -Wall -Wextra in the build like we do with other packages, so include those. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-15 17:56:02 +00:00
.TH SEUNSHARE "8" "May 2010" "seunshare" "User Commands"
.SH NAME
seunshare \- Run cmd with alternate homedir, tmpdir and/or SELinux context
.SH SYNOPSIS
.B seunshare
policycoreutils: sandbox: add level based kill option add kill option to seunshare to kill all processes that are still running with the execcon MCS label. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-07-07 00:22:26 +00:00
[ -v ] [ -c ] [ -C ] [ -k ] [ -t tmpdir ] [ -h homedir ] [ -Z context ] -- executable [args]
policycoreutils: sandbox: Makefile: new man pages we have man pages which aren't being instelled with make install. We also do not include -Werror -Wall -Wextra in the build like we do with other packages, so include those. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-15 17:56:02 +00:00
.br
.SH DESCRIPTION
.PP
Run the
.I executable
within the specified context, using the alternate home directory and /tmp directory. The seunshare command unshares from the default namespace, then mounts the specified homedir and tmpdir over the default homedir and /tmp. Finally it tells the kernel to execute the application under the specified SELinux context.
.TP
\fB\-h homedir\fR
Alternate homedir to be used by the application. Homedir must be owned by the user.
.TP
\fB\-t\ tmpdir
policycoreutils: sandbox: rewrite /tmp handling seunshare now creates a runtime temporary directory owned by root and with the sticky bit set properly. Files from the user-specified directory are copied to the runtime directory and the changes synced back (using rsync) at the end of the seunshare run. This is hoped to address CVE-2011-1011 Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-15 23:58:08 +00:00
Use alternate tempory directory to mount on /tmp. tmpdir must be owned by the user.
policycoreutils: sandbox: Makefile: new man pages we have man pages which aren't being instelled with make install. We also do not include -Werror -Wall -Wextra in the build like we do with other packages, so include those. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-15 17:56:02 +00:00
.TP
\fB\-c --cgroups\fR
Use cgroups to control this copy of seunshare. Specify parameters in /etc/sysconfig/sandbox. Max memory usage and cpu usage are to be specified in percent. You can specify which CPUs to use by numbering them 0,1,2... etc.
.TP
policycoreutils: sandbox: add -C option to not drop all capabilities Some sandbox might want to be able to run a suid app. Add the -C option to allow capabilities to stay in the bounding set, and thus be allowed inside the sandbox. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-06-13 17:24:38 +00:00
\fB\-C --capabilities\fR
Allow apps executed within the namespace to use capabilities. Default is no capabilities.
.TP
policycoreutils: sandbox: add level based kill option add kill option to seunshare to kill all processes that are still running with the execcon MCS label. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-07-07 00:22:26 +00:00
\fB\-k --kill\fR
Kill all processes with matching MCS level.
.TP
policycoreutils: sandbox: Makefile: new man pages we have man pages which aren't being instelled with make install. We also do not include -Werror -Wall -Wextra in the build like we do with other packages, so include those. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-15 17:56:02 +00:00
\fB\-Z\ context
Use alternate SELinux context while runing the executable.
.TP
\fB\-v\fR
Verbose output
.SH "SEE ALSO"
.TP
runcon(1), sandbox(8), selinux(8)
.PP
.SH AUTHOR
This manual page was written by
.I Dan Walsh <dwalsh@redhat.com>
and
.I Thomas Liu <tliu@fedoraproject.org>