Commit c19395d7 added a new interface security_reject_unknown() which needs to be documented. Signed-off-by: Petr Lautrbach <plautrba@xxxxxxxxxx> --- libselinux/man/man3/security_getenforce.3 | 15 ++++++++++++++- libselinux/man/man3/security_reject_unknown.3 | 1 + 2 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 libselinux/man/man3/security_reject_unknown.3 diff --git a/libselinux/man/man3/security_getenforce.3 b/libselinux/man/man3/security_getenforce.3 index 29cf3de7..7b0a069f 100644 --- a/libselinux/man/man3/security_getenforce.3 +++ b/libselinux/man/man3/security_getenforce.3 @@ -1,6 +1,7 @@ .TH "security_getenforce" "3" "1 January 2004" "russell@xxxxxxxxxxxx" "SELinux API documentation" .SH "NAME" -security_getenforce, security_setenforce, security_deny_unknown, security_get_checkreqprot\- get or set the enforcing state of SELinux +security_getenforce, security_setenforce, security_deny_unknown, security_reject_unknown, +security_get_checkreqprot \- get or set the enforcing state of SELinux . .SH "SYNOPSIS" .B #include <selinux/selinux.h> @@ -11,6 +12,8 @@ security_getenforce, security_setenforce, security_deny_unknown, security_get_ch .sp .B int security_deny_unknown(void); .sp +.B int security_reject_unknown(void); +.sp .B int security_get_checkreqprot(void); . .SH "DESCRIPTION" @@ -27,6 +30,16 @@ returned. returns 0 if SELinux treats policy queries on undefined object classes or permissions as being allowed, 1 if such queries are denied, and \-1 on error. +.BR security_reject_unknown () +returns 1 if SELinux rejects loading a policy which doesn't define all kernel +object classes and permissions. In this state SELinux treats policy queries on +undefined object classes or permissions as being denied. + +It returns 0 if SELinux allows to load such policy and policy queries are +treated according to +.BR security_deny_unknown(), +\-1 is returned on error. + .BR security_get_checkreqprot () can be used to determine whether SELinux is configured to check the protection requested by the application or the actual protection that will diff --git a/libselinux/man/man3/security_reject_unknown.3 b/libselinux/man/man3/security_reject_unknown.3 new file mode 100644 index 00000000..d59e5c2c --- /dev/null +++ b/libselinux/man/man3/security_reject_unknown.3 @@ -0,0 +1 @@ +.so man3/security_getenforce.3 -- 2.20.1
