# If the GENERATE_MAN tag is set to YES (the default) Doxygen will
# generate man pages
-GENERATE_MAN = $(GENERATE_MAN)
+GENERATE_MAN = YES
# The MAN_OUTPUT tag is used to specify where the man pages will be put.
# If a relative path is entered the value of OUTPUT_DIRECTORY will be
# The MAN_EXTENSION tag determines the extension that is added to
# the generated man pages (default is the subroutine's section .3)
-MAN_EXTENSION = .1
+MAN_EXTENSION = .3
# If the MAN_LINKS tag is set to YES and Doxygen generates man output,
# then it will generate one additional man file for each entity
# only source the real man page, but without them the man command
# would be unable to find the correct page. The default is NO.
-MAN_LINKS = NO
+MAN_LINKS = YES
#---------------------------------------------------------------------------
# configuration options related to the XML output
EXTRA_DIST=Doxyfile
+man_MANS = \
+ smackaccess.1 \
+ chsmack.8 \
+ smackcipso.8 \
+ smackload.8 \
+ smackctl.8
+
if ENABLE_DOXYGEN
docpkg = $(PACKAGE_TARNAME)-$(PACKAGE_VERSION)-doc.tar.gz
clean-local:
rm -rf html
-
+ rm -rf man
+
+man/man3/SMACK_LABEL_LEN.3: doxygen.stamp
+
+man_MANS += \
+ man/man3/SMACK_LABEL_LEN.3 \
+ man/man3/smack.h.3 \
+ man/man3/smack_accesses_add.3 \
+ man/man3/smack_accesses_add_from_file.3 \
+ man/man3/smack_accesses_add_modify.3 \
+ man/man3/smack_accesses_apply.3 \
+ man/man3/smack_accesses_clear.3 \
+ man/man3/smack_accesses_free.3 \
+ man/man3/smack_accesses_new.3 \
+ man/man3/smack_accesses_save.3 \
+ man/man3/smack_cipso_add_from_file.3 \
+ man/man3/smack_cipso_apply.3 \
+ man/man3/smack_cipso_free.3 \
+ man/man3/smack_cipso_new.3 \
+ man/man3/smack_have_access.3 \
+ man/man3/smack_new_label_from_path.3 \
+ man/man3/smack_new_label_from_self.3 \
+ man/man3/smack_new_label_from_socket.3 \
+ man/man3/smack_revoke_subject.3 \
+ man/man3/smack_set_label_for_self.3 \
+ man/man3/smack_smackfs_path.3
endif
-man_MANS = smackaccess.1 \
- smack_accesses_add.3 \
- smack_accesses_add_from_file.3 \
- smack_accesses_add_modify.3 \
- smack_accesses_apply.3 \
- smack_accesses_clear.3 \
- smack_accesses_free.3 \
- smack_accesses_new.3 \
- smack_accesses_save.3 \
- smack_have_access.3 \
- smack_new_label_from_self.3 \
- smack_new_label_from_socket.3 \
- smack_new_label_from_path.3 \
- smack_set_label_for_self.3 \
- smack_revoke_subject.3 \
- chsmack.8 \
- smackcipso.8 \
- smackload.8 \
- smackctl.8
-
EXTRA_DIST += $(man_MANS)
+++ /dev/null
-'\" t
-.\" This file is part of libsmack
-.\" Copyright (C) 2012 Intel Corporation
-.\" Copyright (C) 2012 Samsung Electronics Co.
-.\"
-.\" This library is free software; you can redistribute it and/or
-.\" modify it under the terms of the GNU Lesser General Public License
-.\" version 2.1 as published by the Free Software Foundation.
-.\"
-.\" This library is distributed in the hope that it will be useful, but
-.\" WITHOUT ANY WARRANTY; without even the implied warranty of
-.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-.\" Lesser General Public License for more details.
-.\"
-.\" You should have received a copy of the GNU Lesser General Public
-.\" License along with this library; if not, write to the Free Software
-.\" Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
-.\" 02110-1301 USA
-.\"
-.TH "SMACK_ACCESSES_ADD" "3" "14/06/2012" "Libsmack 1\&.0"
-.SH NAME
-smack_accesses_new, smack_accesses_free, smack_accesses_save, smack_accesses_apply, smack_accesses_clear, smack_accesses_add, smack_accesses_add_from_file, smack_revoke_subject \- Manipulate Smack rules
-.SH SYNOPSIS
-.B #include <sys/smack.h>
-.sp
-.BI "int smack_accesses_new(struct smack_accesses **" accesses ");"
-.br
-.BI "void smack_accesses_free(struct smack_accesses *" handle ");"
-.br
-
-.BI "int smack_accesses_add(struct smack_accesses *" handle ", const char *" subject ", const char *" object ", const char *" access_type ");"
-.br
-.BI "int smack_accesses_add_modify(struct smack_accesses *" handle ", const char *" subject ", const char *" object ", const char *" access_add ", const char *" access_del ");"
-.br
-.BI "int smack_accesses_add_from_file(struct smack_accesses *" accesses ", int " fd ");"
-.br
-.BI "int smack_accesses_save(struct smack_accesses *" handle ", int " fd ");"
-.br
-
-.BI "int smack_accesses_apply(struct smack_accesses *" handle ");"
-.br
-.BI "int smack_accesses_clear(struct smack_accesses *" handle ");"
-.br
-
-.BI "int smack_revoke_subject(const char *" subject ");"
-.br
-
-.SH DESCRIPTION
-These methods provide a means to create properly formatted smack rules that can be stored to file or loaded directly into the kernel. For loading and unloading rules directly into the kernel the calling process must have the CAP_MAC_ADMIN capability. Most users will generally store the rules to a file that can be read by
-.BR smackload (8).
-If the rules should be loaded on system reboot then the file should be stored in /etc/smack/accesses.d/<name>.rules.
-
-.BR smack_accesses_new ()
-creates a new empty smack_accesses instance pointed to by
-.IR accesses .
-
-.BR smack_accesses_free ()
-destroys a previously created instance of smack_accesses pointed to by
-.IR handle .
-
-.BR smack_accesses_add ()
-create a rule allowing a
-.I subject
-to access an
-.I object
-with the type of access defined in
-.I access_type
-and store the result in
-.IR handle .
-If a rule for the specified labels already exists it will be overwritten.
-
-.BR smack_accesses_add_modify ()
-create a modification rule for the specified
-.I subject
-and
-.I object
-labels allowing the access specified in
-.I access_add
-and disallowing the access defined by
-.IR access_del .
-The result is stored in
-.IR handle .
-If a rule for the specified labels already exists it will be modified, otherwise a new rule will be created with the permissions specified in access_add added and those specified in access_del removed.
-
-.BR smack_accesses_add_from_file ()
-read a set of rules from a file and store them in
-.IR handle .
-The file must be a series of lines, 1 per rule, in the format "%s %s %s"
-.B "(subject object access_type)"
-
-.BR smack_accesses_save ()
-save the smack_accesses instance pointed to by
-.I handle
-to the file specified by the file-descriptor
-.IR fd .
-
-.BR smack_accesses_apply ()
-apply the rules pointed to by
-.I handle
-directly to the kernel. The calling process must have the CAP_MAC_ADMIN capability.
-.BR smack_accesses_clear ()
-remove the rules pointed to by
-.I handle
-directly from the kernel. The calling process must have the CAP_MAC_ADMIN capability.
-
-.BR smack_revoke_subject ()
-Sets the access to '-' (no access allowed) for all access rules with given
-.I subject
-label directly in the kernel. The calling process must have the CAP_MAC_ADMIN capability.
-.SH RETURN VALUE
-All methods, except
-.IR smack_accesses_free ,
-return 0 on success and a negative value on failure
-.SH EXAMPLES
-.nf
-#include <sys/smack.h>
-
-int apply_rules_file(int fd, int clear)
-{
- struct smack_accesses *rules = NULL;
- int ret = 0;
-
- if (smack_accesses_new(&rules))
- return \-1;
-
- if (smack_accesses_add_from_file(rules, fd)) {
- smack_accesses_free(rules);
- return \-1;
- }
-
- if (!clear)
- ret = smack_accesses_apply(rules);
- else
- ret = smack_accesses_clear(rules);
-
- smack_accesses_free(rules);
-
- return ret;
-}
-.fi
-.SH SEE ALSO
-.BR smack_have_access (3)
+++ /dev/null
-.so man3/smack_access_add.3
+++ /dev/null
-.so man3/smack_accesses_add.3
+++ /dev/null
-.so man3/smack_accesses_add.3
+++ /dev/null
-.so man3/smack_accesses_add.3
+++ /dev/null
-.so man3/smack_accesses_add.3
+++ /dev/null
-.so man3/smack_accesses_add.3
+++ /dev/null
-.so man3/smack_accesses_add.3
+++ /dev/null
-'\" t
-.\" This file is part of libsmack
-.\" Copyright (C) 2012 Intel Corporation
-.\" Copyright (C) 2012 Samsung Electronics Co.
-.\"
-.\" This library is free software; you can redistribute it and/or
-.\" modify it under the terms of the GNU Lesser General Public License
-.\" version 2.1 as published by the Free Software Foundation.
-.\"
-.\" This library is distributed in the hope that it will be useful, but
-.\" WITHOUT ANY WARRANTY; without even the implied warranty of
-.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-.\" Lesser General Public License for more details.
-.\"
-.\" You should have received a copy of the GNU Lesser General Public
-.\" License along with this library; if not, write to the Free Software
-.\" Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
-.\" 02110-1301 USA
-.\"
-.TH "SMACK_HAVE_ACCESS" "3" "06/20/2012" "Libsmack 1\&.0"
-.SH NAME
-smack_have_access, smack_new_label_from_self, smack_new_label_from_socket \- Userspace interaction with Smack
-.SH SYNOPSIS
-.B #include <sys/smack.h>
-.sp
-.BI "int smack_have_access(const char *" subject ", const char *" object ", const char *" access ");"
-.br
-.BI "int smack_new_label_from_self(char **" label ");"
-.br
-.BI "int smack_set_label_for_self(char **" label ");"
-.br
-.BI "int smack_new_label_from_socket(int " fd ", char **" label ");"
-.sp
-.SH DESCRIPTION
-Smack is a Mandatory Access Control (MAC) based security mechanism for the Linux kernel. It works on the basis of context, which is stored as a label in the extended attributes (xattr) of a file. When a process is started the kernel ensures that this context is assigned to the running process. By default a process can only interact with processes and filesystem objects that have the same context as itself and is denied access to all other contexts. Rules can be created to grant access to other contexts, these are generally created on package installation and can only be modified by a process that has the CAP_MAC_ADMIN capability.
-.PP
-As with most actor based models the entity that initiates the interaction is called the
-.I subject
-and the item that is being accessed is called the
-.IR "object" .
-The type of interaction that is being performed is known as the
-.I access
-and is based on the standard filesystem access types "R","W","X" etc. The functions presented here provide a way for a process to determine the Smack context of the the system in which it is running and that of a process that is connected to it over a socket connection.
-.PP
-The function
-.BR smack_have_access ()
-takes a
-.I subject
-context, and the context of the item that it is interacting with, the
-.IR "object" ,
-along with the type of
-.I access
-that is requested. The kernel is queried about the access rules and informs the the caller it that access request is allowed. This method is generally used to allow more fine grained access control to be enforced in userspace processes.
-.PP
-.BR smack_new_label_from_self ()
-determines the context of the current process and creates a new storage for this which it assigns to
-.I label
-to this upon return. It is the responsibility of the caller to free
-.I label
-when it is no longer required.
-.PP
-.BR smack_set_label_for_self ()
-sets the context of the current process to
-.IR label .
-The calling process must have the CAP_MAC_ADMIN capability.
-.PP
-.BR smack_new_label_from_socket ()
-takes the file descriptor,
-.IR "fd" ,
-of the socket and determines it's context and creates a new storage for this which it assigns to
-.I label
-on return. It is the callers responsibility to free
-.I label
-when it is no longer required.
-.SH RETURN VALUE
-.BR smack_new_label_from_self ()
-and
-.BR smack_new_label_from_socket ()
-return 0 on success or \-1 on error
-
-.BR smack_have_access ()
-returns 1 if allowed, 0 if no access and \-1 on error
-
-.BR smack_label_length ()
-returns length of
-.I label
-if it is valid and negative value if it's not.
+++ /dev/null
-.so man3/smack_accesses_add.3
+++ /dev/null
-.so man3/smack_have_access.3
+++ /dev/null
-.so man3/smack_have_access.3
+++ /dev/null
-.so man3/smack_accesses_add.3
+++ /dev/null
-.so man3/smack_have_access.3
projects / platform / upstream / smack.git / commitdiff