1security_load_policy(3)    SELinux API documentation   security_load_policy(3)
2
3
4

NAME

6       security_load_policy - load a new SELinux policy
7

SYNOPSIS

9       #include <selinux/selinux.h>
10
11       int security_load_policy(void *data, size_t len);
12
13       int selinux_mkload_policy(int preservebools);
14
15       int selinux_init_load_policy(int *enforce);
16

DESCRIPTION

18       security_load_policy() loads a new policy, returns 0 for success and -1
19       for error.
20
21       selinux_mkload_policy() makes a policy image and loads it.  This  func‐
22       tion  provides  a  higher  level  interface  for  loading  policy  than
23       security_load_policy(), internally determining the  right  policy  ver‐
24       sion,  locating  and  opening  the policy file, mapping it into memory,
25       manipulating it as needed for current  boolean  settings  and/or  local
26       definitions,  and  then  calling security_load_policy to load it.  pre‐
27       servebools is a boolean flag indicating whether current policy  boolean
28       values  should  be preserved into the new policy (if 1) or reset to the
29       saved policy settings (if 0). The former case is the default for policy
30       reloads,  while  the latter case is an option for policy reloads but is
31       primarily used for the initial policy load.  selinux_init_load_policy()
32       performs  the initial policy load. This function determines the desired
33       enforcing mode, sets the enforce argument accordingly for the caller to
34       use,  sets  the  SELinux kernel enforcing status to match it, and loads
35       the policy. It also internally  handles  the  initial  selinuxfs  mount
36       required to perform these actions.
37
38       It should also be noted that after the initial policy load, the SELinux
39       kernel code cannot anymore be disabled  and  the  selinuxfs  cannot  be
40       unmounted  using  a  call to security_disable(3).  Therefore, after the
41       initial policy load, the only operational changes are  those  permitted
42       by  security_setenforce(3)  (i.e.  eventually  setting the framework in
43       permissive mode rather than in enforcing one).
44

RETURN VALUE

46       Returns zero on success or -1 on error.
47

AUTHOR

49       This manual page has been written by Guido Trentalancia  <guido@trenta‐
50       lancia.com>
51

SEE ALSO

53       selinux(8), security_disable(3), setenforce(8)
54
55
56
57guido@trentalancia.com          3 November 2009        security_load_policy(3)
Impressum