huschi.net

security_load_policy(3)    SELinux API documentation   security_load_policy(3)
NAME
       security_load_policy - load a new SELinux policy
SYNOPSIS
       #include <selinux/selinux.h>
       int security_load_policy(void *data, size_t len);
       int selinux_mkload_policy(int preservebools);
       int selinux_init_load_policy(int *enforce);
DESCRIPTION
       security_load_policy() loads a new policy, returns 0 for success and -1
       for error.
       selinux_mkload_policy() makes a policy image and loads it.  This  func-
       tion  provides  a  higher  level  interface  for  loading  policy  than
       security_load_policy(), internally determining the  right  policy  ver-
       sion,  locating  and  opening  the policy file, mapping it into memory,
       manipulating it as needed for current  boolean  settings  and/or  local
       definitions,  and  then  calling security_load_policy to load it.  pre-
       servebools is a boolean flag indicating whether current policy  boolean
       values  should  be preserved into the new policy (if 1) or reset to the
       saved policy settings (if 0). The former case is the default for policy
       reloads,  while  the latter case is an option for policy reloads but is
       primarily used for the initial policy load.  selinux_init_load_policy()
       performs  the initial policy load. This function determines the desired
       enforcing mode, sets the enforce argument accordingly for the caller to
       use,  sets  the  SELinux kernel enforcing status to match it, and loads
       the policy. It also internally  handles  the  initial  selinuxfs  mount
       required to perform these actions.
       It should also be noted that after the initial policy load, the SELinux
       kernel code cannot anymore be disabled  and  the  selinuxfs  cannot  be
       unmounted  using  a  call to security_disable(3).  Therefore, after the
       initial policy load, the only operational changes are  those  permitted
       by  security_setenforce(3)  (i.e.  eventually  setting the framework in
       permissive mode rather than in enforcing one).
RETURN VALUE
       Returns zero on success or -1 on error.
AUTHOR
       This manual page has been written by Guido Trentalancia  <guido@trenta-
       lancia.com>
SEE ALSO
       selinux(8), security_disable(3), setenforce(8)
guido AT trentalancia.com          3 November 2009        security_load_policy(3)