RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux/checkpolicy/checkpolicy.8

73 lines
2.2 KiB
Groff
Raw Normal View History

initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.TH CHECKPOLICY 8
.SH NAME
checkpolicy \- SELinux policy compiler
.SH SYNOPSIS
.B checkpolicy
checkpolicy: allow to write policy to stdout If - is given as filename for -o option, checkpolicy writes the policy to standard output. This helps users to read policy.conf and/or CIL policy file with pager like less command: $ checkpolicy -M -F -b /sys/fs/selinux/policy -o - | less The users don't have to make a temporary file. /dev/stdout can be used instead. However, - reduces the number of typing for the purpose. Using - for standard output (and/or standard input) is popular convention. Change(s) in v2: * Check the availability of output stream only when opening a regualar file. Suggested by Stephen Smalley <sds@tycho.nsa.gov>. Signed-off-by: Masatake YAMATO <yamato@redhat.com>
2019-10-19 10:26:56 +00:00
.I "[\-b[F]] [\-C] [\-d] [\-U handle_unknown (allow,deny,reject)] [\-M] [\-c policyvers] [\-o output_file|\-] [\-S] [\-t target_platform (selinux,xen)] [\-V] [input_file]"
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.br
.SH "DESCRIPTION"
This manual page describes the
.BR checkpolicy
command.
.PP
.B checkpolicy
is a program that checks and compiles a SELinux security policy configuration
into a binary representation that can be loaded into the kernel. If no
input file name is specified, checkpolicy will attempt to read from
checkpolicy: Fix cases where hyphen were used as minus sign in manpages
2013-05-10 12:45:18 +00:00
policy.conf or policy, depending on whether the \-b flag is specified.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH OPTIONS
.TP
Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) This patch is proposed to solve Ticket #1 [1672486] (command line binaries should support --version and --help). It adds handling of -h, -V and the long formats --help and --version to all binaries (checkpolicy/checkmodule). It also adds handling of long options for some of the available options. Manual pages have also been updated accordingly (and a few undocumented options have been documented). Guido Trentalancia Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-02 17:14:28 +00:00
.B \-b,\-\-binary
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
Read an existing binary policy file rather than a source policy.conf file.
.TP
checkpolicy: Update manpage - Add description of -S option - Sort the option descriptions based on the synopsis - Add missing options to synopsis Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
2019-02-07 10:25:45 +00:00
.B \-F,\-\-conf
Write policy.conf file rather than binary policy file. Can only be used with binary policy file.
.TP
checkpolicy: Add support for generating CIL Add support to checkpolicy and checkmodule for generating CIL as their output. Add new options "-C" and "--cil" to specify CIL as the output format. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2015-04-01 14:05:04 +00:00
.B \-C,\-\-cil
Write CIL policy file rather than binary policy file.
.TP
Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) This patch is proposed to solve Ticket #1 [1672486] (command line binaries should support --version and --help). It adds handling of -h, -V and the long formats --help and --version to all binaries (checkpolicy/checkmodule). It also adds handling of long options for some of the available options. Manual pages have also been updated accordingly (and a few undocumented options have been documented). Guido Trentalancia Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-02 17:14:28 +00:00
.B \-d,\-\-debug
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
Enter debug mode after loading the policy.
.TP
checkpolicy: Update manpage - Add description of -S option - Sort the option descriptions based on the synopsis - Add missing options to synopsis Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
2019-02-07 10:25:45 +00:00
.B \-U,\-\-handle-unknown <action>
Specify how the kernel should handle unknown classes or permissions (deny, allow or reject).
checkpolicy: Add options to convert binary policy to CIL or a policy.conf Use the same option "-C" used to ouput CIL from a policy.conf, but now generate CIL from a binary policy instead of giving an error.i Use the option "-F" to generate a policy.conf file from a binary policy. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2017-03-21 20:00:30 +00:00
.TP
Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) This patch is proposed to solve Ticket #1 [1672486] (command line binaries should support --version and --help). It adds handling of -h, -V and the long formats --help and --version to all binaries (checkpolicy/checkmodule). It also adds handling of long options for some of the available options. Manual pages have also been updated accordingly (and a few undocumented options have been documented). Guido Trentalancia Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-02 17:14:28 +00:00
.B \-M,\-\-mls
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
Enable the MLS policy when checking and compiling the policy.
.TP
checkpolicy: Update manpage - Add description of -S option - Sort the option descriptions based on the synopsis - Add missing options to synopsis Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
2019-02-07 10:25:45 +00:00
.B \-c policyvers
Specify the policy version, defaults to the latest.
.TP
Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) This patch is proposed to solve Ticket #1 [1672486] (command line binaries should support --version and --help). It adds handling of -h, -V and the long formats --help and --version to all binaries (checkpolicy/checkmodule). It also adds handling of long options for some of the available options. Manual pages have also been updated accordingly (and a few undocumented options have been documented). Guido Trentalancia Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-02 17:14:28 +00:00
.B \-o,\-\-output filename
checkpolicy: update the description for -o option in the man page Write about policy.conf and CIL files. Signed-off-by: Masatake YAMATO <yamato@redhat.com>
2019-10-19 10:26:55 +00:00
Write a policy file (binary, policy.conf, or CIL policy)
checkpolicy: allow to write policy to stdout If - is given as filename for -o option, checkpolicy writes the policy to standard output. This helps users to read policy.conf and/or CIL policy file with pager like less command: $ checkpolicy -M -F -b /sys/fs/selinux/policy -o - | less The users don't have to make a temporary file. /dev/stdout can be used instead. However, - reduces the number of typing for the purpose. Using - for standard output (and/or standard input) is popular convention. Change(s) in v2: * Check the availability of output stream only when opening a regualar file. Suggested by Stephen Smalley <sds@tycho.nsa.gov>. Signed-off-by: Masatake YAMATO <yamato@redhat.com>
2019-10-19 10:26:56 +00:00
to the specified filename. If - is given as filename,
write it to standard output.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.TP
checkpolicy: Update manpage - Add description of -S option - Sort the option descriptions based on the synopsis - Add missing options to synopsis Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
2019-02-07 10:25:45 +00:00
.B \-S,\-\-sort
Sort ocontexts before writing out the binary policy. This option makes output of checkpolicy consistent with binary policies created by semanage and secilc.
Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) This patch is proposed to solve Ticket #1 [1672486] (command line binaries should support --version and --help). It adds handling of -h, -V and the long formats --help and --version to all binaries (checkpolicy/checkmodule). It also adds handling of long options for some of the available options. Manual pages have also been updated accordingly (and a few undocumented options have been documented). Guido Trentalancia Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-02 17:14:28 +00:00
.TP
.B \-t,\-\-target
Specify the target platform (selinux or xen).
.TP
checkpolicy: add flag to enable policy optimization Add the command-line option 'O' to checkpolicy to cause kernel policies to be optimized by calling policydb_optimize() before being written out. This option can be used on conf files and binary kernel policies, but not when converting a conf file to CIL. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov> [omosnace: make commit desc more consistent with the other patches] [omosnace: fix a typo in the commit message] [omosnace: directly use policydb_optimize() as also the rest of code already uses other policydb_*() functions...] [omosnace: update man page] Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
2019-06-13 11:45:58 +00:00
.B \-O,\-\-optimize
Optimize the final kernel policy (remove redundant rules).
.TP
checkpolicy: Add --werror flag to checkmodule and checkpolicy to treat warnings as errors. When the lexer encounters an unexpected character in a policy source file, it prints a warning, discards the character and moves on. In some build environments, these characters could be a symptom of an earlier problem, such as unintended results of expansion of preprocessor macros, and the ability to have the compiler halt on such issues would be helpful for diagnosis. Signed-off-by: Daniel Burgener <Daniel.Burgener@microsoft.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
2020-03-05 18:40:34 +00:00
.B \-E,\-\-werror
Treat warnings as errors
.TP
Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) This patch is proposed to solve Ticket #1 [1672486] (command line binaries should support --version and --help). It adds handling of -h, -V and the long formats --help and --version to all binaries (checkpolicy/checkmodule). It also adds handling of long options for some of the available options. Manual pages have also been updated accordingly (and a few undocumented options have been documented). Guido Trentalancia Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-02 17:14:28 +00:00
.B \-V,\-\-version
Show version information.
.TP
.B \-h,\-\-help
Show usage information.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH "SEE ALSO"
Replace www.nsa.gov references by github.com/SELinuxProject The original page doesn't exist anymore. Fixes: https://github.com/SELinuxProject/selinux/issues/170 Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-11-06 16:30:43 +00:00
SELinux Reference Policy documentation at https://github.com/SELinuxProject/refpolicy/wiki
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH AUTHOR
This manual page was written by Arpad Magosanyi <mag@bunuel.tii.matav.hu>,
checkpolicy,libselinux,libsepol,policycoreutils: Update my email address Update my email address since epoch.ncsc.mil no longer exists. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2017-08-17 18:16:06 +00:00
and edited by Stephen Smalley <sds@tycho.nsa.gov>.
The program was written by Stephen Smalley <sds@tycho.nsa.gov>.