selinux-policy-upgrade(8) [debian man page]

selinux-policy-upgrade(8)				      System Manager's Manual					 selinux-policy-upgrade(8)

NAME

       selinux-policy-upgrade - upgrade the modules in the SE Linux policy database from a policy package

SYNOPSIS

       selinux-policy-upgrade

DESCRIPTION

       selinux-policy-upgrade  this  command  will  upgrade  all  policy  modules  (including the base modules) for to the versions that are under
       /usr/share/selinux/SELINUXTYPE

SEE ALSO

       selinux(8), sestatus(8), selinuxenabled(1), load_policy(8), semodule(8), postfix-nochroot(8),  check-selinux-installation(8),  selinux-con-
       fig-enforcing(8),  http://wiki.debian.org/SELinux - More about SELinux Debian install, http://etbe.coker.com.au/tag/selinux/ - Russell's SE
       Linux blog posts.

AUTHOR

       This program and it's man page was written by Russell Coker <russell@coker.com.au> for the Debian system (but may be used by others).  Per-
       mission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 3.

       On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL-3.

															 selinux-policy-upgrade(8)

POLICYGENTOOL(1)					      Debian GNU/Linux manual						  POLICYGENTOOL(1)

NAME

       policygentool - Interactive SELinux policy generation tool

SYNOPSIS

       policygentool [options] <Module Name> <full path for application binary file>

DESCRIPTION

       This  tool  generate three files for policy development, A Type Enforcement (te) file, a File Context (fc), and a Interface File(if).  Most
       of the policy rules will be written in the te file.  Use the File Context file to associate file paths  with  security  context.   Use  the
       interface rules to allow other protected domains to interact with the newly defined domains.

       The tool prompts for locations of pidfiles, any logfiles, files in /var/lib, and any init scripts, and whether any network access is desir-
       able for the application. The tool then generates the appropriate policy rules for the module.  After these files have been generated,  the
       make files for the appropriate SELinux policy, namely, /usr/share/selinux/refpolicy-targeted/include/Makefile or /usr/share/selinux/refpol-
       icy-strict/include/Makefile can be used to compile the SELinux policy policy package.  The resulting policy package  can  be  loaded  using
       semodule.

	 # /usr/bin/policygentool myapp /usr/bin/myapp
	 # cat >Makefile
	 > HEADERDIR:=/usr/share/selinux/refpolicy-targeted/include
	 > include $(HEADERDIR)/Makefile
	 > ^D
	 # make
	 # semodule -l myapp.pp
	 # restorecon -R -v /usr/bin/myapp "all files defined in myapp.fc"
	 # setenforce 0
	 # /etc/init.d/myapp start
	 # audit2allow -R -i /var/log/audit/audit.log

OPTIONS

       -h, --help
	      Print a short usage message.

FILES

       myapp.te, myapp.if, myapp.fc.

SEE ALSO

       semodule(8), check_policy(8), load_policy(8).

BUGS

       None known.

AUTHOR

       This manual page was written by Manoj Srivastava <srivasta@debian.org>, for the Debian GNU/Linux system.

Debian								    Feb 27 2007 						  POLICYGENTOOL(1)