Signed-off-by: Richard Haines <richard_c_haines@xxxxxxxxxxxxxx> --- src/policy_config_files.md | 442 ++++++++++++++++++------------------- 1 file changed, 220 insertions(+), 222 deletions(-) diff --git a/src/policy_config_files.md b/src/policy_config_files.md index e7fab1e..9ad9b42 100644 --- a/src/policy_config_files.md +++ b/src/policy_config_files.md @@ -1,36 +1,36 @@ # Policy Configuration Files -- [setrans.conf](#setrans.conf) -- [*secolor.conf*](#secolor.conf) -- [*policy/policy.\<ver\>*](#policypolicy.ver) -- [*contexts/customizable_types*](#contextscustomizable_types) -- [*contexts/default_contexts*](#contextsdefault_contexts) -- [*contexts/dbus_contexts*](#contextsdbus_contexts) -- [*contexts/default_type*](#contextsdefault_type) -- [*contexts/failsafe_context*](#contextsfailsafe_context) -- [*contexts/initrc_context*](#contextsinitrc_context) -- [*contexts/lxc_contexts*](#contextslxc_contexts) -- [*contexts/netfilter_contexts* - Obsolete](#contextsnetfilter_contexts---obsolete) -- [*contexts/openrc_contexts*](#contextsopenrc_contexts) -- [*contexts/openssh_contexts*](#contextsopenssh_contexts) -- [*contexts/removable_context*](#contextsremovable_context) -- [*contexts/sepgsql_contexts*](#contextssepgsql_contexts) -- [*contexts/snapperd_contexts*](#contextssnapperd_contexts) -- [*contexts/securetty_types*](#contextssecuretty_types) -- [*contexts/systemd_contexts*](#contextssystemd_contexts) -- [*contexts/userhelper_context*](#contextsuserhelper_context) -- [*contexts/virtual_domain_context*](#contextsvirtual_domain_context) -- [*contexts/virtual_image_context*](#contextsvirtual_image_context) -- [*contexts/x_contexts*](#contextsx_contexts) -- [*contexts/files/file_contexts*](#contextsfilesfile_contexts) -- [*contexts/files/file_contexts.local*](#contextsfilesfile_contexts.local) -- [*contexts/files/file_contexts.homedirs*](#contextsfilesfile_contexts.homedirs) -- [*contexts/files/file_contexts.subs*](#contextsfilesfile_contexts.subs) -- [*contexts/files/file_contexts.subs_dist*](#contextsfilesfile_contexts.subs_dist) -- [*contexts/files/media*](#contextsfilesmedia) -- [*contexts/users/[seuser_id]*](#contextsusersseuser_id) -- [*logins/\<linuxuser_id\>*](#loginslinuxuser_id) -- [*users/local.users*](#userslocal.users) +- [setrans.conf](#setrans.conf) +- [*secolor.conf*](#secolor.conf) +- [*policy/policy.\<ver\>*](#policypolicy.ver) +- [*contexts/customizable_types*](#contextscustomizable_types) +- [*contexts/default_contexts*](#contextsdefault_contexts) +- [*contexts/dbus_contexts*](#contextsdbus_contexts) +- [*contexts/default_type*](#contextsdefault_type) +- [*contexts/failsafe_context*](#contextsfailsafe_context) +- [*contexts/initrc_context*](#contextsinitrc_context) +- [*contexts/lxc_contexts*](#contextslxc_contexts) +- [*contexts/netfilter_contexts* - Obsolete](#contextsnetfilter_contexts---obsolete) +- [*contexts/openrc_contexts*](#contextsopenrc_contexts) +- [*contexts/openssh_contexts*](#contextsopenssh_contexts) +- [*contexts/removable_context*](#contextsremovable_context) +- [*contexts/sepgsql_contexts*](#contextssepgsql_contexts) +- [*contexts/snapperd_contexts*](#contextssnapperd_contexts) +- [*contexts/securetty_types*](#contextssecuretty_types) +- [*contexts/systemd_contexts*](#contextssystemd_contexts) +- [*contexts/userhelper_context*](#contextsuserhelper_context) +- [*contexts/virtual_domain_context*](#contextsvirtual_domain_context) +- [*contexts/virtual_image_context*](#contextsvirtual_image_context) +- [*contexts/x_contexts*](#contextsx_contexts) +- [*contexts/files/file_contexts*](#contextsfilesfile_contexts) +- [*contexts/files/file_contexts.local*](#contextsfilesfile_contexts.local) +- [*contexts/files/file_contexts.homedirs*](#contextsfilesfile_contexts.homedirs) +- [*contexts/files/file_contexts.subs*](#contextsfilesfile_contexts.subs) +- [*contexts/files/file_contexts.subs_dist*](#contextsfilesfile_contexts.subs_dist) +- [*contexts/files/media*](#contextsfilesmedia) +- [*contexts/users/[seuser_id]*](#contextsusersseuser_id) +- [*logins/\<linuxuser_id\>*](#loginslinuxuser_id) +- [*users/local.users*](#userslocal.users) Each file discussed in this section is relative to the policy name as follows: @@ -52,16 +52,16 @@ For example the simple described in the Notebook examples could run at init 3 (i.e. no X-Windows) and only require the following configuration files: -- *seusers* - For login programs. -- *policy/policy.\<ver\>* - The binary policy loaded into the kernel. -- *context/files/file_contexts* - To allow the filesystem to be relabeled. +- *seusers* - For login programs. +- *policy/policy.\<ver\>* - The binary policy loaded into the kernel. +- *context/files/file_contexts* - To allow the filesystem to be relabeled. If the simple policy is to run at init 5, (i.e. with X-Windows) then an additional two files are required: -- *context/dbus_contexts* - To allow the dbus messaging service to run under - SELinux. -- *context/x_contexts* - To allow the X-Windows service to run under SELinux. +- *context/dbus_contexts* - To allow the dbus messaging service to run under + SELinux. +- *context/x_contexts* - To allow the X-Windows service to run under SELinux. ## *seusers* @@ -70,19 +70,16 @@ The ***seusers**(5)* file is used by login programs (normally via the *user* / *passwd* files) to SELinux users (defined in the policy). A typical login sequence would be: -- Using the GNU / Linux *user_id*, lookup the *seuser_id* from this - file. If an entry cannot be found, then use the *__default__* - entry. -- To determine the remaining context to be used as the security - context, read the - [*contexts/users/[seuser_id]*](#contextsusersseuser_id) - file. If this file is not present, then: -- Check for a default context in the - [*contexts/default_contexts*](#contextsdefault_contexts) - file. If no default context is found, then: -- Read the - [*contexts/failsafe_context*](#contextsfailsafe_context) file - to allow a fail safe context to be set. +- Using the GNU / Linux *user_id*, lookup the *seuser_id* from this + file. If an entry cannot be found, then use the *\_\_default\_\_* entry. +- To determine the remaining context to be used as the security + context, read the [*contexts/users/[seuser_id]*](#contextsusersseuser_id) + file. If this file is not present, then: +- Check for a default context in the + [*contexts/default_contexts*](#contextsdefault_contexts) file. If no default + context is found, then: +- Read the [*contexts/failsafe_context*](#contextsfailsafe_context) file + to allow a fail safe context to be set. Note: The *system_u* user is defined in this file, however there must be **no** *system_u* Linux user configured on the system. @@ -104,8 +101,8 @@ __default__:user_u:s0-s0 **Supporting libselinux API functions are:** -- ***getseuser**(3)* -- ***getseuserbyname**(3)* +- ***getseuser**(3)* +- ***getseuserbyname**(3)* ## *booleans* ## *booleans.local* @@ -120,10 +117,10 @@ file section. For systems that do use these files: -- ***security_set_boolean_list**(3)* - Writes a *boolean.local* file if - flag *permanent* = '*1*'. -- ***security_load_booleans**(3)* - Will look for a *booleans* or - *booleans.local* file here unless a specific path is specified. +- ***security_set_boolean_list**(3)* - Writes a *boolean.local* file if + flag *permanent* = '*1*'. +- ***security_load_booleans**(3)* - Will look for a *booleans* or + *booleans.local* file here unless a specific path is specified. Both files have the same format and contain one or more boolean names. @@ -137,12 +134,12 @@ boolean_name value *boolean_name* -- The name of the boolean. +- The name of the boolean. *value* -- The default setting for the boolean that can be one of the following: - - *true* | *false* | *1* | *0* +- The default setting for the boolean that can be one of the following: + - *true* | *false* | *1* | *0* Note that if *SETLOCALDEFS* is set in the SELinux [*/etc/selinux/config*](global_config_files.md#etcselinuxconfig) file, then @@ -172,11 +169,11 @@ policy_bool_name new_name *policy_bool_name* -- The policy boolean name. +- The policy boolean name. *new_name* -- The new boolean name. +- The new boolean name. **Example:** @@ -195,10 +192,10 @@ the name will be looked up and if using the *new_name*, then the Supporting libselinux API functions are: -- ***selinux_booleans_subs_path**(3)* -- ***selinux_booleans_sub**(3)* -- ***security_get_boolean_names**(3)* -- ***security_set_boolean**(3)* +- ***selinux_booleans_subs_path**(3)* +- ***selinux_booleans_sub**(3)* +- ***security_get_boolean_names**(3)* +- ***security_set_boolean**(3)* ## *setrans.conf* @@ -254,9 +251,10 @@ Include=/etc/selinux/mls/setrans.d/constraints.conf ``` Supporting libselinux API functions are: -- ***selinux_translations_path**(3)* -- ***selinux_raw_to_trans_context**(3)* -- ***selinux_trans_to_raw_context**(3)* + +- ***selinux_translations_path**(3)* +- ***selinux_raw_to_trans_context**(3)* +- ***selinux_trans_to_raw_context**(3)* ## *secolor.conf* @@ -278,39 +276,39 @@ context_component string fg_color_name bg_color_name *color* -- The color keyword. +- The color keyword. *color_name* -- A descriptive name for the colour (e.g. *red*). +- A descriptive name for the colour (e.g. *red*). *color_mask* -- A colour mask starting with a hash '*#*' that describes the RGB colours - with black being *#000000* and white being *#ffffff*. +- A colour mask starting with a hash '*#*' that describes the RGB colours + with black being *#000000* and white being *#ffffff*. *context_component* -- The colour translation supports different colours on the context string - components (*user*, *role*, *type* and *range*). Each component is on a - separate line. +- The colour translation supports different colours on the context string + components (*user*, *role*, *type* and *range*). Each component is on a + separate line. *string* -- This is the *context_component* string that will be matched with the - *raw* context component passed by ***selinux_raw_context_to_color**(3)*. - A wildcard '*\**' may be used to match any undefined *string* for the - *user*, *role* and *type* *context_component* entries only. +- This is the *context_component* string that will be matched with the + *raw* context component passed by ***selinux_raw_context_to_color**(3)*. + A wildcard '*\**' may be used to match any undefined *string* for the + *user*, *role* and *type* *context_component* entries only. *fg_color_name* -- The *color_name* string that will be used as the foreground colour. - A *color_mask* may also be used. +- The *color_name* string that will be used as the foreground colour. + A *color_mask* may also be used. *bg_color_name* -- The *color_name* string that will be used as the background colour. - A *color_mask* may also be used.</p></td> +- The *color_name* string that will be used as the background colour. + A *color_mask* may also be used. **Example file contents:** @@ -337,10 +335,10 @@ range s15:c0.c1023 = black yellow **Supporting libselinux API functions are:** -- ***selinux_colors_path**(3)* -- ***selinux_raw_context_to_color**(3)* - this call returns the foreground - and background colours of the context string as the specified RGB 'colour' - hex digits as follows: +- ***selinux_colors_path**(3)* +- ***selinux_raw_context_to_color**(3)* - this call returns the foreground + and background colours of the context string as the specified RGB 'colour' + hex digits as follows: ``` user : role : type : range @@ -380,9 +378,9 @@ type *type* -- The type defined in the policy that needs to excluded from relabeling. - An example is when a file has been purposely relabeled with a different - type to allow an application to work. +- The type defined in the policy that needs to excluded from relabeling. + An example is when a file has been purposely relabeled with a different + type to allow an application to work. **Example file contents:** @@ -397,9 +395,9 @@ sysadm_untrusted_content_tmp_t **Supporting libselinux API functions are:** -- ***is_context_customizable**(3)* -- ***selinux_customizable_types_path**(3)* -- ***selinux_context_path**(3)* +- ***is_context_customizable**(3)* +- ***selinux_customizable_types_path**(3)* +- ***selinux_context_path**(3)* ## *contexts/default_contexts* @@ -407,14 +405,14 @@ The ***default_contexts**(5)* file is used by SELinux-aware applications that need to set a security context for user processes (generally the login applications) where: -1. The GNU / Linux user identity should be known by the application. -2. If a login application, then the SELinux user (seuser), would have - been determined as described in the [*seusers*](#seusers) file - section. -3. The login applications will check the - [*contexts/users/[seuser_id]*](#contextsusersseuser_id) file - first and if no valid entry, will then look in the *[seuser_id]* - file for a default context to use. +1. The GNU / Linux user identity should be known by the application. +2. If a login application, then the SELinux user (seuser), would have + been determined as described in the [*seusers*](#seusers) file + section. +3. The login applications will check the + [*contexts/users/[seuser_id]*](#contextsusersseuser_id) file + first and if no valid entry, will then look in the *[seuser_id]* + file for a default context to use. **The file format is as follows:** @@ -426,12 +424,12 @@ role:type[:range] role:type[:range] ... *role:type[:range]* -- The file contains one or more lines that consist of *role:type[:range]* - pairs (including the MLS / MCS *level* or *range* if applicable). - - The entry at the start of a new line corresponds to the partial - *role:type[:range]* context of (generally) the login application. - - The other *role:type[:range]* entries on that line represent an ordered - list of valid contexts that may be used to set the users context. +- The file contains one or more lines that consist of *role:type[:range]* + pairs (including the MLS / MCS *level* or *range* if applicable). +- The entry at the start of a new line corresponds to the partial + *role:type[:range]* context of (generally) the login application. +- The other *role:type[:range]* entries on that line represent an ordered + list of valid contexts that may be used to set the users context. **Example file contents:** @@ -449,16 +447,16 @@ system_r:xdm_t:s0 user_r:user_t:s0 Note that the *contexts/users/[seuser_id]* file is also read by some of these functions. -- ***selinux_contexts_path**(3)* -- ***selinux_default_context_path**(3)* -- ***get_default_context**(3)* -- ***get_ordered_context_list**(3)* -- ***get_ordered_context_list_with_level**(3)* -- ***get_default_context_with_level**(3)* -- ***get_default_context_with_role**(3)* -- ***get_default_context_with_rolelevel**(3)* -- ***query_user_context**(3)* -- ***manual_user_enter_context**(3)* +- ***selinux_contexts_path**(3)* +- ***selinux_default_context_path**(3)* +- ***get_default_context**(3)* +- ***get_ordered_context_list**(3)* +- ***get_ordered_context_list_with_level**(3)* +- ***get_default_context_with_level**(3)* +- ***get_default_context_with_role**(3)* +- ***get_default_context_with_rolelevel**(3)* +- ***query_user_context**(3)* +- ***manual_user_enter_context**(3)* An example use in this Notebook (to get over a small feature) is that when the initial **basic policy** was built, no default_contexts file @@ -511,7 +509,7 @@ information at: **Supporting libselinux API function is:** -- ***selinux_context_path**(3)* +- ***selinux_context_path**(3)* ## *contexts/default_type* @@ -528,8 +526,8 @@ role:type *role:type* -- The file contains one or more lines that consist of *role:type* entries. - There should be one line for each role defined within the policy. +- The file contains one or more lines that consist of *role:type* entries. + There should be one line for each role defined within the policy. **Example file contents:** @@ -544,8 +542,8 @@ user_r:user_t **Supporting libselinux API functions are:** -- ***selinux_default_type_path**(3)* -- ***get_default_type**(3)* +- ***selinux_default_type_path**(3)* +- ***get_default_type**(3)* ## *contexts/failsafe_context* @@ -563,8 +561,8 @@ role:type[:range] *role:type[:range]* -- A single line that has a valid context to allow an administrator access - to the system, including the MLS / MCS *level* or *range* if applicable. +- A single line that has a valid context to allow an administrator access + to the system, including the MLS / MCS *level* or *range* if applicable. **Example file contents:** @@ -576,14 +574,14 @@ sysadm_r:sysadm_t:s0 **Supporting libselinux API functions are:** -- ***selinux_context_path**(3)* -- ***selinux_failsafe_context_path**(3)* -- ***get_default_context**(3)* -- ***get_default_context_with_role**(3)* -- ***get_default_context_with_level**(3)* -- ***get_default_context_with_rolelevel**(3)* -- ***get_ordered_context_list**(3)* -- ***get_ordered_context_list_with_level**(3)* +- ***selinux_context_path**(3)* +- ***selinux_failsafe_context_path**(3)* +- ***get_default_context**(3)* +- ***get_default_context_with_role**(3)* +- ***get_default_context_with_level**(3)* +- ***get_default_context_with_rolelevel**(3)* +- ***get_ordered_context_list**(3)* +- ***get_ordered_context_list_with_level**(3)* ## *contexts/initrc_context* @@ -601,8 +599,8 @@ user:role:type[:range] *user:role:type[:range]* -- The file contains one line that consists of a security context, - including the MLS / MCS *level* or *range* if applicable. +- The file contains one line that consists of a security context, + including the MLS / MCS *level* or *range* if applicable. **Example file contents:** @@ -615,7 +613,7 @@ system_u:system_r:initrc_t:s0-s15:c0.c255 **Supporting libselinux API functions are:** -- ***selinux_context_path**(3)* +- ***selinux_context_path**(3)* ## *contexts/lxc_contexts* @@ -634,24 +632,24 @@ content = "security_context" *process* -- A single *process* entry that contains the lxc domain security context, - including the MLS / MCS *level* or *range* if applicable. +- A single *process* entry that contains the lxc domain security context, + including the MLS / MCS *level* or *range* if applicable. *file* -- A single *file* entry that contains the lxc file security context, - including the MLS / MCS *level* or *range* if applicable.</td> +- A single *file* entry that contains the lxc file security context, + including the MLS / MCS *level* or *range* if applicable. *content* -- A single *content* entry that contains the lxc content security context, - including the MLS / MCS *level* or *range* if applicable.</td> +- A single *content* entry that contains the lxc content security context, + including the MLS / MCS *level* or *range* if applicable. *sandbox_kvm_process* *sandbox_lxc_process* -- These entries may be present and contain the security context. +- These entries may be present and contain the security context. **Example file contents:** @@ -667,8 +665,8 @@ sandbox_lxc_process = "system_u:system_r:container_t:s0" **Supporting libselinux API functions are:** -- ***selinux_context_path**(3)* -- ***selinux_lxc_context_path**(3)* +- ***selinux_context_path**(3)* +- ***selinux_lxc_context_path**(3)* ## *contexts/netfilter_contexts* - Obsolete @@ -677,8 +675,8 @@ matching of network packets - Never been used. **Supporting libselinux API functions are:** -- ***selinux_context_path**(3)* -- ***selinux_netfilter_context_path**(3)* +- ***selinux_context_path**(3)* +- ***selinux_netfilter_context_path**(3)* ## *contexts/openrc_contexts* @@ -690,8 +688,8 @@ matching of network packets - Never been used. **Supporting libselinux API functions are:** -- ***selinux_context_path**(3)* -- ***selinux_openrc_contexts_path**(3)* +- ***selinux_context_path**(3)* +- ***selinux_openrc_contexts_path**(3)* ## *contexts/openssh_contexts* @@ -707,8 +705,8 @@ privsep_preauth=sshd_net_t **Supporting libselinux API functions are:** -- ***selinux_context_path**(3)* -- ***selinux_openssh_contexts_path**(3)* +- ***selinux_context_path**(3)* +- ***selinux_openssh_contexts_path**(3)* ## *contexts/removable_context* @@ -726,8 +724,8 @@ user:role:type[:range] *user:role:type[:range]* -- The file contains one line that consists of a security context, - including the MLS / MCS *level* or *range* if applicable. +- The file contains one line that consists of a security context, + including the MLS / MCS *level* or *range* if applicable. **Example file contents:** @@ -737,7 +735,7 @@ system_u:object_r:removable_t:s0 **Supporting libselinux API functions are:** -- ***selinux_removable_context_path**(3)* +- ***selinux_removable_context_path**(3)* ## *contexts/sepgsql_contexts* @@ -754,20 +752,20 @@ object_type object_name context *object_type* -- This is the string representation of the object type. +- This is the string representation of the object type. *object_name* -- These are the object names of the specific database objects. - The entry can contain '*\**' for wildcard matching or '*?*' for - substitution. Note that if the '*\**' is used, then be aware that the order - of entries in the file is important. The '*\**' on its own is used to ensure - a default fallback context is assigned and should be the last entry in the - *object_type* block. +- These are the object names of the specific database objects. + The entry can contain '*\**' for wildcard matching or '*?*' for + substitution. Note that if the '*\**' is used, then be aware that the order + of entries in the file is important. The '*\**' on its own is used to ensure + a default fallback context is assigned and should be the last entry in the + *object_type* block. *context* -- The security *context* that will be applied to the object. +- The security *context* that will be applied to the object. **Example file contents:** @@ -792,8 +790,8 @@ snapperd_data = system_u:object_r:snapperd_data_t:s0 **Supporting libselinux API functions are:** -- ***selinux_context_path**(3)* -- ***selinux_snapperd_contexts_path**(3)* +- ***selinux_context_path**(3)* +- ***selinux_snapperd_contexts_path**(3)* ## *contexts/securetty_types* @@ -810,7 +808,7 @@ type *type* -- Zero or more type entries that are defined in the policy for tty devices. +- Zero or more type entries that are defined in the policy for tty devices. **Example file contents:** @@ -822,7 +820,7 @@ staff_tty_device_t **Supporting libselinux API functions are:** -- ***selinux_securetty_types_path**(3)* +- ***selinux_securetty_types_path**(3)* ## *contexts/systemd_contexts* @@ -838,13 +836,13 @@ service_class = security_context *service_class* -- One or more entries that relate to the ***systemd**(1)* service (e.g. - runtime, transient). +- One or more entries that relate to the ***systemd**(1)* service (e.g. + runtime, transient). *security_context* -- The security context, including the MLS / MCS *level* or *range* if - applicable of the service to be run. +- The security context, including the MLS / MCS *level* or *range* if + applicable of the service to be run. **Example file contents:** @@ -854,8 +852,8 @@ runtime=system_u:object_r:systemd_runtime_unit_file_t:s0 **Supporting libselinux API functions are:** -- ***selinux_context_path**(3)* -- ***selinux_systemd_contexts_path**(3)* +- ***selinux_context_path**(3)* +- ***selinux_systemd_contexts_path**(3)* ## *contexts/userhelper_context* @@ -872,8 +870,8 @@ security_context *security_context* -- The file contains one line that consists of a full security context, - including the MLS / MCS *level* or *range* if applicable. +- The file contains one line that consists of a full security context, + including the MLS / MCS *level* or *range* if applicable. **Example file contents:** @@ -883,7 +881,7 @@ system_u:sysadm_r:sysadm_t:s0 **Supporting libselinux API functions are:** -- ***selinux_context_path**(3)* +- ***selinux_context_path**(3)* ## *contexts/virtual_domain_context* @@ -902,7 +900,7 @@ system_u:system_r:svirt_tcg_t:s0 **Supporting libselinux API functions are:** -- ***selinux_virtual_domain_context_path**(3)* +- ***selinux_virtual_domain_context_path**(3)* ## *contexts/virtual_image_context* @@ -921,7 +919,7 @@ system_u:object_r:virt_content_t:s0 **Supporting libselinux API functions are:** -- ***selinux_virtual_image_context_path**(3)* +- ***selinux_virtual_image_context_path**(3)* ## *contexts/x_contexts* @@ -943,32 +941,32 @@ selection PRIMARY system_u:object_r:clipboard_xselection_t:s0 *object_type* -- These are types of object supported and valid entries are: *client*, - *property*, *poly_property*, *extension*, *selection*, *poly_selection* - and *events*. +- These are types of object supported and valid entries are: *client*, + *property*, *poly_property*, *extension*, *selection*, *poly_selection* + and *events*. *object_name* -- These are the object names of the specific X-server resource such as - *PRIMARY*, *CUT_BUFFER0* etc. They are generally defined in the X-server - source code (*protocol.txt* and *BuiltInAtoms* in the *dix* directory of - the *xorg-server* source package). This can contain '*\**' for 'any' - or '*?*' for 'substitute' (see the *CUT_BUFFER?* entry where the '*?*' - would be substituted for a number between 0 and 7 that represents the - number of these buffers). +- These are the object names of the specific X-server resource such as + *PRIMARY*, *CUT_BUFFER0* etc. They are generally defined in the X-server + source code (*protocol.txt* and *BuiltInAtoms* in the *dix* directory of + the *xorg-server* source package). This can contain '*\**' for 'any' + or '*?*' for 'substitute' (see the *CUT_BUFFER?* entry where the '*?*' + would be substituted for a number between 0 and 7 that represents the + number of these buffers). *context* -- This is the security context that will be applied to the object. - For MLS/MCS systems there would be the additional MLS label. +- This is the security context that will be applied to the object. + For MLS/MCS systems there would be the additional MLS label. **Supporting libselinux API functions are:** -- ***selinux_x_context_path**(3)* -- ***selabel_open**(3)* -- ***selabel_close**(3)* -- ***selabel_lookup**(3)* -- ***selabel_stats**(3)* +- ***selinux_x_context_path**(3)* +- ***selabel_open**(3)* +- ***selabel_close**(3)* +- ***selabel_lookup**(3)* +- ***selabel_stats**(3)* ## *contexts/files/file_contexts* @@ -996,11 +994,11 @@ compatible regular expression (PCRE) internal format. **Supporting libselinux API functions are:** -- ***selinux_file_context_path**(3)* -- ***selabel_open**(3)* -- ***selabel_close**(3)* -- ***selabel_lookup**(3)* -- ***selabel_stats**(3)* +- ***selinux_file_context_path**(3)* +- ***selabel_open**(3)* +- ***selabel_close**(3)* +- ***selabel_lookup**(3)* +- ***selabel_stats**(3)* ## *contexts/files/file_contexts.local* @@ -1011,7 +1009,7 @@ file section to allow locally defined files to be labeled correctly. The **Supporting libselinux API functions are:** -- ***selinux_file_context_local_path**(3)* +- ***selinux_file_context_local_path**(3)* ## *contexts/files/file_contexts.homedirs* @@ -1034,8 +1032,8 @@ Perl compatible regular expression (PCRE) internal format. **Supporting libselinux API functions are:** -- ***selinux_file_context_homedir_path**(3)* -- ***selinux_homedir_context_path**(3)* +- ***selinux_file_context_homedir_path**(3)* +- ***selinux_homedir_context_path**(3)* ## *contexts/files/file_contexts.subs* ## *contexts/files/file_contexts.subs_dist* @@ -1062,11 +1060,11 @@ with */var/www*, with the final result being: **Supporting libselinux API functions are:** -- ***selinux_file_context_subs_path**(3)* -- ***selinux_file_context_subs_dist_path**(3)* -- ***selabel_lookup**(3)* -- ***matchpathcon**(3)* (deprecated) -- ***matchpathcon_index**(3)* (deprecated) +- ***selinux_file_context_subs_path**(3)* +- ***selinux_file_context_subs_dist_path**(3)* +- ***selabel_lookup**(3)* +- ***matchpathcon**(3)* (deprecated) +- ***matchpathcon_index**(3)* (deprecated) ## *contexts/files/media* @@ -1085,12 +1083,12 @@ media_id file_context *media_id* -- The media identifier (those known are: cdrom, floppy, disk and usb). +- The media identifier (those known are: cdrom, floppy, disk and usb). *file_context* -- The context to be used for the device. Note that it does not have the - MLS / MCS level). +- The context to be used for the device. Note that it does not have the + MLS / MCS level). **Example file contents:** @@ -1102,7 +1100,7 @@ disk system_u:object_r:fixed_disk_device_t:s0 **Supporting libselinux API functions are:** -- ***selinux_media_context_path**(3)* +- ***selinux_media_context_path**(3)* ## *contexts/users/[seuser_id]* @@ -1131,15 +1129,15 @@ system_r:init_t:s0 unconfined_r:unconfined_t:s0 **Supporting libselinux API functions are:** -- ***selinux_user_contexts_path**(3)* -- ***selinux_users_path**(3)* -- ***selinux_usersconf_path**(3)* -- ***get_default_context**(3)* -- ***get_default_context_with_role**(3)* -- ***get_default_context_with_level**(3)* -- ***get_default_context_with_rolelevel**(3)* -- ***get_ordered_context_list**(3)* -- ***get_ordered_context_list_with_level**(3)* +- ***selinux_user_contexts_path**(3)* +- ***selinux_users_path**(3)* +- ***selinux_usersconf_path**(3)* +- ***get_default_context**(3)* +- ***get_default_context_with_role**(3)* +- ***get_default_context_with_level**(3)* +- ***get_default_context_with_rolelevel**(3)* +- ***get_ordered_context_list**(3)* +- ***get_ordered_context_list_with_level**(3)* ## *logins/\<linuxuser_id\>* @@ -1168,11 +1166,11 @@ service_name:seuser_id:level *service_name* -- The name of the service. +- The name of the service. *seuser_id* -- The SELinux user name. +- The SELinux user name. *level* @@ -1188,7 +1186,7 @@ another_service:unconfined_u:s0 **Supporting libselinux API functions are:** -- ***getseuser**(3)* +- ***getseuser**(3)* ## *users/local.users* -- 2.26.2
