1security_load_policy(3)    SELinux API documentation   security_load_policy(3)
2
3
4

NAME

6       security_load_policy - load a new SELinux policy
7
8

SYNOPSIS

10       #include <selinux/selinux.h>
11
12       int security_load_policy(void *data, size_t len);
13
14       int selinux_mkload_policy(int preservebools);
15
16       int selinux_init_load_policy(int *enforce);
17
18

DESCRIPTION

20       security_load_policy  loads  a new policy, returns 0 for success and -1
21       for error.
22
23       selinux_mkload_policy makes a policy image and loads it. This  function
24       provides  a  higher  level  interface  for  loading  policy  than secu‐
25       rity_load_policy, internally  determining  the  right  policy  version,
26       locating  and  opening the policy file, mapping it into memory, manipu‐
27       lating it as needed for current boolean settings and/or  local  defini‐
28       tions, and then calling security_load_policy to load it.  preservebools
29       is a boolean flag indicating  whether  current  policy  boolean  values
30       should  be  preserved  into the new policy (if 1) or reset to the saved
31       policy settings (if 0). The former  case  is  the  default  for  policy
32       reloads,  while  the latter case is an option for policy reloads but is
33       primarily used for the initial policy  load.   selinux_init_load_policy
34       performs  the initial policy load. This function determines the desired
35       enforcing mode, sets the enforce argument accordingly for the caller to
36       use,  sets  the  SELinux kernel enforcing status to match it, and loads
37       the policy. It also internally  handles  the  initial  selinuxfs  mount
38       required to perform these actions.
39
40       It should also be noted that after the initial policy load, the SELinux
41       kernel code cannot anymore be disabled  and  the  selinuxfs  cannot  be
42       unmounted  using  a  call to security_disable(3).  Therefore, after the
43       initial policy load, the only operational changes are  those  permitted
44       by  setenforce(3)  (i.e. eventually setting the framework in permissive
45       mode rather than in enforcing one).
46
47

RETURN VALUE

49       returns zero on success or -1 on error.
50
51

AUTHOR

53       This manual page has been written by Guido Trentalancia  <guido@trenta‐
54       lancia.com>
55
56

SEE ALSO

58       selinux(8), security_disable(3), setenforce(1)
59
60
61
62
63guido@trentalancia.com          3 November 2009        security_load_policy(3)
Impressum