1security_load_policy(3)    SELinux API documentation   security_load_policy(3)
2
3
4

NAME

6       security_load_policy - load a new SELinux policy
7

SYNOPSIS

9       #include <selinux/selinux.h>
10
11       int security_load_policy(const void *data, size_t len);
12
13       int selinux_mkload_policy(int preservebools);
14
15       int selinux_init_load_policy(int *enforce);
16

DESCRIPTION

18       security_load_policy() loads a new policy, returns 0 for success and -1
19       for error.
20
21       selinux_mkload_policy() makes a policy image and loads it.  This  func‐
22       tion  provides  a  higher  level  interface  for  loading  policy  than
23       security_load_policy(), internally determining the  right  policy  ver‐
24       sion, locating and opening the policy file, mapping it into memory, ma‐
25       nipulating it as needed for current boolean settings and/or local defi‐
26       nitions,  and  then calling security_load_policy to load it.  preserve‐
27       bools is a boolean flag indicating whether current policy boolean  val‐
28       ues  should  be  preserved  into  the new policy (if 1) or reset to the
29       saved policy settings (if 0). The former case is the default for policy
30       reloads,  while  the latter case is an option for policy reloads but is
31       primarily used for the initial policy load.  selinux_init_load_policy()
32       performs  the initial policy load. This function determines the desired
33       enforcing mode, sets the enforce argument accordingly for the caller to
34       use,  sets  the  SELinux kernel enforcing status to match it, and loads
35       the policy. It also internally handles the initial selinuxfs mount  re‐
36       quired to perform these actions.
37
38       It should also be noted that after the initial policy load, the SELinux
39       kernel code cannot anymore be disabled and the selinuxfs cannot be  un‐
40       mounted using a call to security_disable(3).  Therefore, after the ini‐
41       tial policy load, the only operational changes are those  permitted  by
42       security_setenforce(3)  (i.e.  eventually setting the framework in per‐
43       missive mode rather than in enforcing one).
44

RETURN VALUE

46       Returns zero on success or -1 on error.
47

AUTHOR

49       This manual page has been written by Guido Trentalancia  <guido@trenta‐
50       lancia.com>
51

SEE ALSO

53       selinux(8), security_disable(3), setenforce(8)
54
55
56
57guido@trentalancia.com          3 November 2009        security_load_policy(3)