hugeadm

package: libhugetlbfs-utils

title: hugeadm(8)

summary: Configure the system huge page pools

text:
# hugeadm(8)

## NAME
hugeadm - Configure the system huge page pools

## SYNOPSIS
hugeadm [options]

## DESCRIPTION
hugeadm displays and configures the systems huge page pools. The size of the pools is set as a minimum and maximum threshold. The minimum value is allocated up front by the kernel and guaranteed to remain as hugepages until the pool is shrunk. If a maximum is set, the system will dynamically allocate pages if applications request more hugepages than the minimum size of the pool. There is no guarantee that more pages than this minimum pool size can be allocated.

The following options create mounts hugetlbfs mount points.

--create-mounts

This creates mount points for each supported huge page size under /var/lib/hugetlbfs. After creation they are mounts and are owned by root:root with permissions set to 770. Each mount point is named pagesize-<size in bytes>.

--create-user-mounts=<user>

This creates mount points for each supported huge page size under /var/lib/hugetlbfs/user/<user>. Mount point naming is the same as --create-mounts. After creation they are mounted and are owned by <user>:root with permissions set to 700.

--create-group-mounts=<group>

This creates mount points for each supported huge page size under /var/lib/hugetlbfs/group/<group>. Mount point naming is the same as --create-mounts. After creation they are mounted and are owned by root:<group> with permissions set to 070.

--create-global-mounts

This creates mount points for each supported huge page size under /var/lib/hugetlbfs/global. Mount point naming is the same as --create-mounts. After creation they are mounted and are owned by root:root with permissions set to 1777.

The following options affect how mount points are created.

--max-size

This option is used in conjunction with --create-*-mounts. It limits the maximum amount of memory used by files within the mount point rounded up to the nearest huge page size. This can be used for example to grant different huge page quotas to individual users or groups.

--max-inodes

This option is used in conjunction with --create-*-mounts. It limits the number of inodes (e.g. files) that can be created on the new mount points. This limits the number of mappings that can be created on a mount point. It could be used for example to limit the number of application instances that used a mount point as long as it was known how many inodes each application instance required.

The following options display information about the pools.

--pool-list

This displays the Minimum, Current and Maximum number of huge pages in the pool for each pagesize supported by the system. The "Minimum" value is the size of the static pool and there will always be at least this number of hugepages in use by the system, either by applications or kept by the kernel in a reserved pool. The "Current" value is the number of hugepages currently in use, either by applications or stored on the kernels free list. The "Maximum" value is the largest number of hugepages that can be in use at any given time.

--set-recommended-min_free_kbytes

Fragmentation avoidance in the kernel depends on avoiding pages of different mobility types being mixed with a pageblock arena - typically the size of the default huge page size. The more mixing that occurs, the less likely the huge page pool will be able to dynamically resize. The easiest means of avoiding mixing is to increase /proc/sys/vm/min_free_kbytes. This parameter sets min_free_kbytes to a recommended value to aid fragmentation avoidance.

--set-recommended-shmmax

The maximum shared memory segment size should be set to at least the size of the largest shared memory segment size you want available for applications using huge pages, via /proc/sys/kernel/shmmax. Optionally, it can be set automatically to match the maximum possible size of all huge page allocations and thus the maximum possible shared memory segment size, using this switch.

--set-shm-group=<gid|groupname>

Users in the group specified in /proc/sys/vm/hugetlb_shm_group are granted full access to huge pages. The sysctl takes a numeric gid, but this hugeadm option can set it for you, using either a gid or group name.

--page-sizes

This displays every page size supported by the system and has a pool configured.

--page-sizes-all

This displays all page sizes supported by the system, even if no pool is available.

--list-all-mounts

This displays all active mount points for hugetlbfs.

The following options configure the pool.

--pool-pages-min=<size|DEFAULT>:[+|-]<pagecount|memsize<G|M|K>>

This option sets or adjusts the Minimum number of hugepages in the pool for pagesize size. size may be specified in bytes or in kilobytes, megabytes, or gigabytes by appending K, M, or G respectively, or as DEFAULT, which uses the system's default huge page size for size. The pool size adjustment can be specified by pagecount pages or by memsize, if postfixed with G, M, or K, for gigabytes, megabytes, or kilobytes, respectively. If the adjustment is specified via memsize, then the pagecount will be calculated for you, based on page size size. The pool is set to pagecount pages if + or - are not specified. If + or - are specified, then the size of the pool will adjust by that amount. Note that there is no guarantee that the system can allocate the hugepages requested for the Minimum pool. The size of the pools should be checked after executing this command to ensure they were successful.

--obey-numa-mempol

This option requests that allocation of huge pages to the static pool with --pool-pages-min obey the NUMA memory policy of the current process. This policy can be explicitly specified using numactl or inherited from a parent process.

--pool-pages-max=<size|DEFAULT>:[+|-]<pagecount|memsize<G|M|K>>

This option sets or adjusts the Maximum number of hugepages. Note that while the Minimum number of pages are guaranteed to be available to applications, there is not guarantee that the system can allocate the pages on demand when the number of huge pages requested by applications is between the Minimum and Maximum pool sizes. See --pool-pages-min for usage syntax.

--enable-zone-movable

This option enables the use of the MOVABLE zone for the allocation of hugepages. This zone is created when kernelcore= or movablecore= are specified on the kernel command line but the zone is not used for the allocation of huge pages by default as the intended use for the zone may be to guarantee that memory can be off-lined and hot-removed. The kernel guarantees that the pages within this zone can be reclaimed unlike some kernel buffers for example. Unless pages are locked with mlock(), the hugepage pool can grow to at least the size of the movable zone once this option is set. Use sysctl to permanently enable the use of the MOVABLE zone for the allocation of huge pages.

--disable-zone-movable

This option disables the use of the MOVABLE zone for the future allocation of huge pages. Note that existing huge pages are not reclaimed from the zone. Use sysctl to permanently disable the use of the MOVABLE zone for the allocation of huge pages.

--hard

This option is specified with --pool-pages-min to retry allocations multiple times on failure to allocate the desired count of pages. It initially tries to resize the pool up to 5 times and continues to try if progress is being made towards the resize.

--add-temp-swap<=count>

This options is specified with --pool-pages-min to initialize a temporary swap file for the duration of the pool resize. When increasing the size of the pool, it can be necessary to reclaim pages so that contiguous memory is freed and this often requires swap to be successful. Swap is only created for a positive resize, and is then removed once the resize operation is completed. The default swap size is 5 huge pages, the optional argument <count> sets the swap size to <count> huge pages.

--add-ramdisk-swap

This option is specified with --pool-pages-min to initialize swap in memory on ram disks. When increasing the size of the pool, it can be necessary to reclaim pages so that contiguous memory is freed and this often requires swap to be successful. If there isn't enough free disk space, swap can be initialized in RAM using this option. If the size of one ramdisk is not greater than the huge page size, then swap is initialized on multiple ramdisks. Swap is only created for a positive resize, and by default is removed once the resize operation is completed.

--persist

This option is specified with the --add-temp-swap or --add-ramdisk-swap to make the swap space persist after the resize operation is completed. The swap spaces can later be removed manually using the swapoff command.

The following options tune the transparent huge page usage

--thp-always

Enable transparent huge pages always

--thp-madvise

Enable transparent huge pages only on madvised regions

--thp-never

Disable transparent huge pages

--thp-khugepaged-pages <pages to scan>

Configure the number of pages that khugepaged should scan on each pass

--thp-khugepaged-scan-sleep <milliseconds>

Configure how many milliseconds khugepaged should wait between passes

--thp-khugepages-alloc-sleep <milliseconds>

Configure how many milliseconds khugepaged should wait after failing to allocate a huge page to throttle the next attempt.

The following options affect the verbosity of libhugetlbfs.

--verbose <level>, -v

The default value for the verbosity level is 1 and the range of the value can be set with --verbose from 0 to 99. The higher the value, the more verbose the library will be. 0 is quiet and 3 will output much debugging information. The verbosity level is increased by one each time -v is specified.

## SEE ALSO
oprofile(1), pagesize(1), libhugetlbfs(7), hugectl(8),

## AUTHORS
libhugetlbfs was written by various people on the libhugetlbfs-devel mailing list.


hugectl

title: hugectl(8)

text:
# hugectl(8)

## NAME
hugectl - Control policy for backing text, data and malloc() with hugepages

## SYNOPSIS
hugectl [options] command {arguments}

## DESCRIPTION
hugectl runs processes with a specific policy for backing memory regions with hugepages. The use of hugepages benefit applications that use large amounts of address space and suffer a performance hit due to TLB misses. Policy is enforced by libhugetlbfs and hugectl configures the environment based on the options provided. Wall-clock time or oprofile can be used to determine if there is a performance benefit from using hugepages or not.

To effectively back text/data, the target process must be relinked to align the ELF segments on a hugepage boundary. The library also supports more options for the control of memory regions than are exposed by the hugectl utility. See the libhugetlbfs manual page for more details.

The following options affect what memory regions are backed by hugepages.

--text[=<size>],--data[=<size>],--bss[=<size>]

Back the text, data or BSS segments with hugepages, optionally with pages of the specified size. To be effective, the process must be relinked as described in the HOWTO to align the ELF segments. It is possible to partially back segments using the HUGETLB_FORCE_ELMAP environment variable as described in the libhugetlbfs manual page.

--heap[=<size>]

Use the glibc morecore hook to back malloc() with hugepages, optionally with pages of the specified size. Note that this does not affect brk() segments and applications that use custom allocators potentially do not use hugepages for their heap even with this option specified.

--shm

This option overrides shmget() to back shared memory regions with hugepages if possible. Segment size requests will be aligned to fit to the default hugepage size region.

--share-text

Request that multiple application instances share text segments that are backed with huge pages. This option sets the environment variable HUGETLB_SHARE to 1.

--thp

Align heap regions to huge page size for promotion by khugepaged. For more information on transparent huge pages see linux-2.6/Documentation/transhuge.txt

The following options affect how hugectl behaves.

--no-preload

Disable any pre-loading of the libhugetlbfs library. This may be necessary if only the heap is being backed by hugepages and the application is already linked against the library. hugectl may pre-load the library by mistake and this option prevents that.

--force-preload

Force pre-loading of the libhugetlbfs library. This option is used when the segments of the binary are aligned to the hugepage boundary of interest but the binary is not linked against libhugetlbfs. This is useful on PPC64 where binaries are aligned to 64K as required by the ABI and the kernel is using a 4K base pagesize.

--no-reserve

By default, huge pages are reserved at mmap() time so future faults will succeed. This avoids unexpected application but some applications depend on memory overcommit to create large sparse mappings. For this type of application, this switch will create huge page backed mappings without a reservation if the kernel is recent enough to make this operation safe. Use this option with extreme care as in the event huge pages are not available when the mapping is faulted, the application will be killed.

--dry-run

Instead of running the process, the hugectl utility will describe what environment variables it set for libhugetlbfs. This is useful if additional environment variables are to be set and a launcher shell script is being developed.

--library-use-path

By default, hugectl will use the version of libhugetlbfs it was installed with, even if this is not in the LD_LIBRARY_PATH environment. Using this option forces hugectl to use the version of libhugetlbfs installed in the library system path.

--library-path <path>

This option forces hugectl to use the libhugetlbfs libraries within the given prefix.

The following options affect the verbosity of libhugetlbfs.

--verbose <level>, -v

The default value for the verbosity level is 1 and the range of the value can be set with --verbose from 0 to 99. The higher the value, the more verbose the library will be. 0 is quiet and 3 will output much debugging information. The verbosity level is increased by one each time -v is specified.

-q

The -q option will drecease the verbosity level by 1 each time it is specified to a minimum of 0.

## SEE ALSO
oprofile(1), hugeadm(7), libhugetlbfs(7)

## AUTHORS
libhugetlbfs was written by various people on the libhugetlbfs-devel mailing list.


hugeedit

title: hugeedit(8)

text:
# hugeedit(8)

## NAME
hugeedit - Set default policy for backing text and data with hugepages

## SYNOPSIS
hugeedit binary

hugeedit [options] binary

## DESCRIPTION
hugectl runs processes with a specific policy for backing memory regions with hugepages. Ordinarily when processes are relinked with libhugetlbfs using the recommended linking method, either hugectl is required on each execution or environment variables must be set for each execution. hugeedit can be used to set bits in the ELF header that determine if the text or data segments are backed by default without further intervention.

If no arguments are specified, hugeedit will display what the current defaults for each segment in a binary are. The available options are

--text

Back the text segments of the binary by default.

--data

Back the data segments of the binary by default

--disable

Back all segments using small pages by default

## SEE ALSO
oprofile(1), libhugetlbfs(7), hugectl(8)

## AUTHORS
libhugetlbfs was written by various people on the libhugetlbfs-devel mailing list.


in.identtestd

package: libident-tools

title: in.identtestd(8)

text:
# in.identtestd(8)

## NAME
in.identtestd - a small daemon that can be used to test Ident servers

## SYNOPSIS
in.identtestd

## DESCRIPTION
in.identtestd is a small daemon (to be started from inetd) that does an ident lookup on you if you telnet into it. Can be used to verify that your Ident server is working correctly.

The source code can be found in the libident source tarball, as ident-tester.c.

## EXAMPLE
A typical entry in /etc/inetd.conf would be:

```
9999 stream tcp nowait root /usr/sbin/in.identtestd in.identtestd
```

With the above entry in place and active, execute "telnet hostname 9999" from either this system, or another system. It should show something like:

```
Trying hostname...
Connected to hostname.
Escape character is '^]'.
Welcome to the IDENT server tester, version 2.0
(Linked with libident 0.30)
Connecting to Ident server at 192.168.1.1...
Querying for lport 1109, fport 9999....
Reading response data...
Userid response is:

   Lport........ 1109

   Fport........ 9999

   Opsys........ UNIX

   Charset...... <not specified>

   Identifier... paul
Connection closed by foreign host.
```

## AUTHOR
Peter Eriksson <pen@lysator.liu.se>

Manpage written for Debian by Paul Slootman <paul@debian.org>.

## SEE ALSO
ident(3), identd(8), xinetd(8)


sserver

title: sserver(8)

summary: sample Kerberos version 5 server

text:
# sserver(8)

## NAME
sserver - sample Kerberos version 5 server

## SYNOPSIS
sserver [ -p port ] [ -S keytab ] [ server_port ]

## DESCRIPTION
sserver and sclient(1) are a simple demonstration client/server application. When sclient connects to sserver, it performs a Kerberos authentication, and then sserver returns to sclient the Kerberos principal which was used for the Kerberos authentication. It makes a good test that Kerberos has been successfully installed on a machine.

The service name used by sserver and sclient is sample. Hence, sserver will require that there be a keytab entry for the service sample/hostname.domain.name@REALM.NAME. This keytab is generated using the kadmin(1) program. The keytab file is usually installed as FILE:/etc/krb5.keytab.

The -S option allows for a different keytab than the default.

sserver is normally invoked out of inetd(8), using a line in /etc/inetd.conf that looks like this:

```
sample stream tcp nowait root /usr/local/sbin/sserver sserver
```

Since sample is normally not a port defined in /etc/services, you will usually have to add a line to /etc/services which looks like this:

```
sample          13135/tcp
```

When using sclient, you will first have to have an entry in the Kerberos database, by using kadmin(1), and then you have to get Kerberos tickets, by using kinit(1). Also, if you are running the sclient program on a different host than the sserver it will be connecting to, be sure that both hosts have an entry in /etc/services for the sample tcp port, and that the same port number is in both files.

When you run sclient you should see something like this:

```
sendauth succeeded, reply is:
reply len 32, contents:
You are nlgilman@JIMI.MIT.EDU
```

## COMMON ERROR MESSAGES
1.

kinit returns the error:

```
kinit: Client not found in Kerberos database while getting

       initial credentials
```

This means that you didn't create an entry for your username in the Kerberos database.

2.

sclient returns the error:

```
unknown service sample/tcp; check /etc/services
```

This means that you don't have an entry in /etc/services for the sample tcp port.

3.

sclient returns the error:

```
connect: Connection refused
```

This probably means you didn't edit /etc/inetd.conf correctly, or you didn't restart inetd after editing inetd.conf.

4.

sclient returns the error:

```
sclient: Server not found in Kerberos database while using

         sendauth
```

This means that the sample/hostname@LOCAL.REALM service was not defined in the Kerberos database; it should be created using kadmin(1), and a keytab file needs to be generated to make the key for that service principal available for sclient.

5.

sclient returns the error:

```
sendauth rejected, error reply is:

    "No such file or directory"
```

This probably means sserver couldn't find the keytab file. It was probably not installed in the proper directory.

## ENVIRONMENT
See kerberos(7) for a description of Kerberos environment variables.

## SEE ALSO
sclient(1), kerberos(7), services(5), inetd(8)

## AUTHOR
MIT

## COPYRIGHT
1985-2022, MIT


ndptool

package: libndp-utils

title: ndptool(8)

summary: Neighbor Discovery Protocol tool

text:
# ndptool(8)

## NAME
ndptool — Neighbor Discovery Protocol tool

## SYNOPSIS
ndptool -h

ndptool [OPTIONS] COMMAND

## DESCRIPTION
ndptool is a tool which provides wrapper over Neighbor Discovery Protocol messages.

## OPTIONS
-h, --help

Print help text to console and exit.

-v, --verbose

Increase output verbosity.

-t type, --msg-type type

Specified message type. Following are supported: rs - Router Solicitation.

ra - Router Advertisement.

ns - Neighbor Solicitation.

na - Neighbor Advertisement.

-i ifname, --ifname ifname

Specified interface name.

-D dest, --dest dest

Specified dest address in IPv6 header for NS/NA message.

-T target, --target target

Specified target address in ICMPv6 header for NS/NA message.

-U, --unsolicited

Send Unsolicited NA.

## COMMAND
monitor

Monitor incoming NDP messages and print them out.

send

Send NDP message of specified type.

## AUTHOR
Jiri Pirko is the original author and current maintainer of libndp.


genl-ctrl-list

title: genl-ctrl-list(8)

text:
# genl-ctrl-list(8)

## NAME
genl-ctrl-list - List available kernel-side Generic Netlink families

## SYNOPSIS
genl-ctrl-list [-d]

## DESCRIPTION
Queries the Generic Netlink controller in kernel and prints a list of all registered Generic Netlink families including the version of the interface that has been registered.

## OPTIONS
-h or --help

Print help text to console and exit.

-v or --version

Print versioning information to console and exit.

-d or --details

Include additional detailed information for each Generic Netlink family that is printed. The information includes:

hdrsize N

The size of the user specific header.

maxattr N

The maximum Netlink attribute identifier expected by the interface.

op NAME (ID) <FLAGS>

A list of available operations including their name, numeric identifier and the flags indicating the capabilities of the opertion. Available flags:

admin-perm

Requires administrative privileges

has-doit

Command can handle request

has-dump

Command can handle a dump request

has-policy

Command enforces attribute validation policy

grp NAME (ID)

A list of registered multicast groups including name (if available) and identifier.

Example: 0x0010 nlctrl version 2

hdrsize 0 maxattr 7

op GETFAMILY (0x03) <has-doit,has-dump,has-policy>

grp notify (0x10)

## EXAMPLE
$ genl-ctrl-list 0x0010 nlctrl version 2 0x0011 NLBL_MGMT version 3 0x0012 NLBL_CIPSOv4 version 3 0x0013 NLBL_UNLBL version 3 0x0014 acpi_event version 1 0x0015 thermal_event version 1 0x0016 VFS_DQUOT version 1 0x0017 TASKSTATS version 1 0x0018 NET_DM version 2

## AUTHOR
Thomas Graf is the original author and current maintainer of libnl and libnl tools. Many people have contributed to it since.


nl-classid-lookup

title: nl-classid-lookup(8)

summary: classid\-lookup - Lookup classid definitions

text:
# nl-classid-lookup(8)

## NAME
nl-classid-lookup - Lookup classid definitions

## SYNOPSIS
nl-classid-lookup [-hv] [-r] [--raw] name

## DESCRIPTION
nl-classid-lookup searches the classid database for a matching entry. It is used to resolve qdisc/class names to classid values and vice versa.

## OPTIONS
-h or --help

Print help text to console and exit.

-v or --version

Print versioning information to console and exit.

-r or --reverse

Do a reverse lookup. Lookup a classid and print its name.

--raw

Print the raw classid in hexadecimal format, do not pretty print it.

## USAGE
Resolve the qdisc/class name "interactive":

\# nl-classid-lookup interactive

Lookup the name of classid 1:2:

\# nl-classid-lookup -r 1:2

## FILES
/etc/libnl/classid

## AUTHOR
Thomas Graf is the original author and current maintainer of libnl and libnl tools. Many people have contributed to it since.


nl-pktloc-lookup

title: nl-pktloc-lookup(8)

summary: pktloc\-lookup - Lookup packet location definitions

text:
# nl-pktloc-lookup(8)

## NAME
nl-pktloc-lookup - Lookup packet location definitions

## SYNOPSIS
nl-pktloc-lookup name

nl-pktloc-lookup --list

## DESCRIPTION
nl-pktloc-lookup searches the packet location database for a matching entry. It is used to resolve packet location aliases to their definition, i.e. alignment, layer, offset, and mask.

## OPTIONS
-h or --help

Print help text to console and exit.

-v or --version

Print versioning information to console and exit.

-l or --list

List all packet location definitions.

--u32=VALUE

Prints the packet location definition in a special format that is understood by iproute2's u32 selector parser. It will output a u32 selector which will compare the provided value with the value specified by the packet location. Please note that due to the limitation of u32, it is not possible to use packet locations based on the link layer. nl-pktloc-lookup will print an error message in this case.

Example:

selector=$(nl-pktloc-lookup --u32 22 tcp.sport)

tc filter add [...] u32 match $(selector) flowid 1:2

## FILES
/etc/libnl/pktloc

## AUTHOR
Thomas Graf is the original author and current maintainer of libnl and libnl tools. Many people have contributed to it since.


nl-qdisc-add

title: nl-qdisc-add(8)

summary: qdisc\-{add|list|delete} - Manage queueing disciplines

text:
# nl-qdisc-add(8)

## NAME
nl-qdisc-{add|list|delete} - Manage queueing disciplines

## SYNOPSIS
nl-qdisc-add --dev dev --parent id [OPTIONS] qdisc-type [QDISC]

nl-qdisc-delete [ --interactive ] [OPTIONS]

nl-qdisc-list [OPTIONS]

## DESCRIPTION
The nl-qdisc tools allow to manage and configure queueing disciplines (qdiscs) in the kernel.

## OPTIONS
-h or --help

Print help text to console and exit.

-v or --version

Print versioning information to console and exit.

-q or --quiet

Do not print informal notifications about actions taken to the console. By default a short description of each qdisc added/update/deleted will be printed to the console. This option disables this behaviour.

-d or --dev=DEV

Network device the qdisc is attached to.

-p or --parent=ID

Identifier of the parent qdisc/class this qdisc is attached to. The identifier can be specified as classid, name or one of the special values "root" or "ingress".

-i or --id=ID

Identifier of qdisc. It can be specified as classid or name.

### nl-qdisc-add Options
--update

Update qdisc if it already exists, otherwise attempting to add a qdisc which already exists will result in an error. This does not include changing the type of the qdisc, use --replace if you wish to do so.

--replace

Replace or update qdisc if it already exists. Same behaviour as --update but will completely replace the qdisc if it exists already.

--update-only

Update an existing qdisc but do not create it if it does not exist.

--replace-only

Update or replace an existing qdisc but do not create it if it does exist.

### nl-qdisc-delete Options
--interactive

The interactive mode requires confirmation by the user for each qdisc deleted. It will print a prompt for each qdisc matching the provided filter and requires the user to answer 'y'es or 'n'o.

--yes

Make the default answer for interactive prompts be 'y'es. This option is also required to delete all qdiscs on all network devices.

-k or --kind=TYPE

Only delete qdiscs of this type.

### nl-qdisc-list Options
--details

Show detailed information for each qdisc listed.

--stats

Show statistics information for each qdisc listed. This option will also turn on detailed information automatically.

-r or --recursive

List all TC objects recurisvely attached to all qdiscs matching the filter.

-k or --kind=TYPE

Only list qdiscs of this type.

## USAGE
Add a HTB root qdisc with id "5:":

nl-qdisc-add --dev eth0 --parent root --id 5: htb

List all qdiscs on eth0 and print statistical data:

nl-qdisc-list --stats --dev eth0

Delete the qdisc "5:":

nl-qdisc-delete --id 5:

## SEE ALSO
nl-classid-lookup(8)

## AUTHOR
Thomas Graf is the original author and current maintainer of libnl and libnl tools. Many people have contributed to it since.


nss-myhostname

package: libnss-myhostname

title: nss-myhostname(8)

text:
# nss-myhostname(8)

## NAME
nss-myhostname, libnss_myhostname.so.2 - Hostname resolution for the locally configured system hostname

## SYNOPSIS
libnss_myhostname.so.2

## DESCRIPTION
nss-myhostname is a plug-in module for the GNU Name Service Switch (NSS) functionality of the GNU C Library (glibc), primarily providing hostname resolution for the locally configured system hostname as returned by gethostname(2). The precise hostnames resolved by this module are:

•The local, configured hostname is resolved to all locally configured IP addresses ordered by their scope, or — if none are configured — the IPv4 address 127.0.0.2 (which is on the local loopback) and the IPv6 address ::1 (which is the local host).

•The hostnames "localhost" and "localhost.localdomain" (as well as any hostname ending in ".localhost" or ".localhost.localdomain") are resolved to the IP addresses 127.0.0.1 and ::1.

•The hostname "_gateway" is resolved to all current default routing gateway addresses, ordered by their metric. This assigns a stable hostname to the current gateway, useful for referencing it independently of the current network configuration state.

•The hostname "_outbound" is resolved to the local IPv4 and IPv6 addresses that are most likely used for communication with other hosts. This is determined by requesting a routing decision to the configured default gateways from the kernel and then using the local IP addresses selected by this decision. This hostname is only available if there is at least one local default gateway configured. This assigns a stable hostname to the local outbound IP addresses, useful for referencing them independently of the current network configuration state.

Various software relies on an always-resolvable local hostname. When using dynamic hostnames, this is traditionally achieved by patching /etc/hosts at the same time as changing the hostname. This is problematic since it requires a writable /etc/ file system and is fragile because the file might be edited by the administrator at the same time. With nss-myhostname enabled, changing /etc/hosts is unnecessary, and on many systems, the file becomes entirely optional.

To activate the NSS modules, add "myhostname" to the line starting with "hosts:" in /etc/nsswitch.conf.

It is recommended to place "myhostname" after "file" and before "dns". This resolves well-known hostnames like "localhost" and the machine hostnames locally. It is consistent with the behaviour of nss-resolve, and still allows overriding via /etc/hosts.

Please keep in mind that nss-myhostname (and nss-resolve) also resolve in the other direction — from locally attached IP adresses to hostnames. If you rely on that lookup being provided by DNS, you might want to order things differently.

## EXAMPLE
Here is an example /etc/nsswitch.conf file that enables nss-myhostname correctly:

```
passwd:         compat systemd
group:          compat [SUCCESS=merge] systemd
shadow:         compat systemd
gshadow:        files systemd
hosts:          mymachines resolve [!UNAVAIL=return] files myhostname dns
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis
```

To test, use glibc's getent tool:

```
$ getent ahosts `hostname`
::1       STREAM omega
::1       DGRAM
::1       RAW
127.0.0.2       STREAM
127.0.0.2       DGRAM
127.0.0.2       RAW
```

In this case, the local hostname is omega.

## SEE ALSO
systemd(1), nss-systemd(8), nss-resolve(8), nss-mymachines(8), nsswitch.conf(5), getent(1)


nss-mymachines

package: libnss-mymachines

title: nss-mymachines(8)

text:
# nss-mymachines(8)

## NAME
nss-mymachines, libnss_mymachines.so.2 - Hostname resolution for local container instances

## SYNOPSIS
libnss_mymachines.so.2

## DESCRIPTION
nss-mymachines is a plug-in module for the GNU Name Service Switch (NSS) functionality of the GNU C Library (glibc), providing hostname resolution for the names of containers running locally that are registered with systemd-machined.service(8). The container names are resolved to the IP addresses of the specific container, ordered by their scope. This functionality only applies to containers using network namespacing (see the description of --private-network in systemd-nspawn(1)). Note that the name that is resolved is the one registered with systemd-machined, which may be different than the hostname configured inside of the container.

Note that this NSS module only makes available names of the containers running immediately below the current system context. It does not provide host name resolution for containers running side-by-side with the invoking system context, or containers further up or down the container hierarchy. Or in other words, on the host system it provides host name resolution for the containers running immediately below the host environment. When used inside a container environment however, it will not be able to provide name resolution for containers running on the host (as those are siblings and not children of the current container environment), but instead only for nested containers running immediately below its own container environment.

To activate the NSS module, add "mymachines" to the line starting with "hosts:" in /etc/nsswitch.conf.

It is recommended to place "mymachines" before the "resolve" or "dns" entry of the "hosts:" line of /etc/nsswitch.conf in order to make sure that its mappings are preferred over other resolvers such as DNS.

## CONFIGURATION IN /ETC/NSSWITCH.CONF
Here is an example /etc/nsswitch.conf file that enables nss-mymachines correctly:

```
passwd:         compat systemd
group:          compat [SUCCESS=merge] systemd
shadow:         compat systemd
gshadow:        files systemd
hosts:          mymachines resolve [!UNAVAIL=return] files myhostname dns
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis
```

## EXAMPLE: MAPPINGS PROVIDED BY NSS-MYMACHINES
The container "rawhide" is spawned using systemd-nspawn(1):

```
# systemd-nspawn -M rawhide --boot --network-veth --private-users=pick
Spawning container rawhide on /var/lib/machines/rawhide.
Selected user namespace base 20119552 and range 65536.
...
$ machinectl --max-addresses=3
MACHINE CLASS     SERVICE        OS     VERSION ADDRESSES
rawhide container systemd-nspawn fedora 30      169.254.40.164 fe80::94aa:3aff:fe7b:d4b9
$ ping -c1 rawhide
PING rawhide(fe80::94aa:3aff:fe7b:d4b9%ve-rawhide (fe80::94aa:3aff:fe7b:d4b9%ve-rawhide)) 56 data bytes
64 bytes from fe80::94aa:3aff:fe7b:d4b9%ve-rawhide (fe80::94aa:3aff:fe7b:d4b9%ve-rawhide): icmp_seq=1 ttl=64 time=0.045 ms
...
$ ping -c1 -4 rawhide
PING rawhide (169.254.40.164) 56(84) bytes of data.
64 bytes from 169.254.40.164 (169.254.40.164): icmp_seq=1 ttl=64 time=0.064 ms
...
# machinectl shell rawhide /sbin/ip a
Connected to machine rawhide. Press ^] three times within 1s to exit session.
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000

    ...
2: host0@if21: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000

    link/ether 96:aa:3a:7b:d4:b9 brd ff:ff:ff:ff:ff:ff link-netnsid 0

    inet 169.254.40.164/16 brd 169.254.255.255 scope link host0

       valid_lft forever preferred_lft forever

    inet6 fe80::94aa:3aff:fe7b:d4b9/64 scope link

       valid_lft forever preferred_lft forever
Connection to machine rawhide terminated.
```

## SEE ALSO
systemd(1), systemd-machined.service(8), machinectl(1), nss-systemd(8), nss-resolve(8), nss-myhostname(8), nsswitch.conf(5), getent(1)


nss-resolve

package: libnss-resolve

title: nss-resolve(8)

summary: Hostname resolution via systemd\-resolved.service

text:
# nss-resolve(8)

## NAME
nss-resolve, libnss_resolve.so.2 - Hostname resolution via systemd-resolved.service

## SYNOPSIS
libnss_resolve.so.2

## DESCRIPTION
nss-resolve is a plug-in module for the GNU Name Service Switch (NSS) functionality of the GNU C Library (glibc) enabling it to resolve hostnames via the systemd-resolved(8) local network name resolution service. It replaces the nss-dns plug-in module that traditionally resolves hostnames via DNS.

To activate the NSS module, add "resolve [!UNAVAIL=return]" to the line starting with "hosts:" in /etc/nsswitch.conf. Specifically, it is recommended to place "resolve" early in /etc/nsswitch.conf's "hosts:" line. It should be before the "files" entry, since systemd-resolved supports /etc/hosts internally, but with caching. To the contrary, it should be after "mymachines", to give hostnames given to local VMs and containers precedence over names received over DNS. Finally, we recommend placing "dns" somewhere after "resolve", to fall back to nss-dns if systemd-resolved.service is not available.

Note that systemd-resolved will synthesize DNS resource records in a few cases, for example for "localhost" and the current local hostname, see systemd-resolved(8) for the full list. This duplicates the functionality of nss-myhostname(8), but it is still recommended (see examples below) to keep nss-myhostname configured in /etc/nsswitch.conf, to keep those names resolveable if systemd-resolved is not running.

Please keep in mind that nss-myhostname (and nss-resolve) also resolve in the other direction — from locally attached IP adresses to hostnames. If you rely on that lookup being provided by DNS, you might want to order things differently.

Communication between nss-resolve and systemd-resolved.service takes place via the /run/systemd/resolve/io.systemd.Resolve AF_UNIX socket.

## ENVIRONMENT VARIABLES
$SYSTEMD_NSS_RESOLVE_VALIDATE

Takes a boolean argument. When false, cryptographic validation of resource records via DNSSEC will be disabled. This may be useful for testing, or when system time is known to be unreliable.

## EXAMPLE
Here is an example /etc/nsswitch.conf file that enables nss-resolve correctly:

```
passwd:         compat systemd
group:          compat [SUCCESS=merge] systemd
shadow:         compat systemd
gshadow:        files systemd
hosts:          mymachines resolve [!UNAVAIL=return] files myhostname dns
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis
```

## SEE ALSO
systemd(1), systemd-resolved(8), nss-systemd(8), nss-myhostname(8), nss-mymachines(8), nsswitch.conf(5), systemd.syntax(5)


roleadd

package: libnss-role

title: roleadd(8)

text:
# roleadd(8)

## NAME
roleadd - Add new roles and add privileges for role

## SYNOPSIS
roleadd [-m] [-s] ROLE [GROUP*]

## DESCRIPTION
roleadd is utility allows to add privilege groups to role groups. This mean that all users at role group includes to all privileges groups which added to modified role.

## OPTIONS
-h [ --help ]

produce help message

-s [ --set ]

set role with privileges

-m [ --skip-missing-groups ]

skipping for missed privilegies instead error

-v [ --version ]

print the version of roleadd being used

## SEE ALSO
roledel(8), rolelst(8),


roledel

title: roledel(8)

text:
# roledel(8)

## NAME
roledel - Delete roles and remove priviledges from role

## SYNOPSIS
roledel [-m] ROLE [GROUP*]

roledel [-r] ROLE

## DESCRIPTION
roledel is utility allows to remove priviledges groups from role groups. This mean that all users at role group excludes from all privileges groups which removed from modified role.

## OPTIONS
-h [ --help ]

produce help message

-r [ --remove ]

remove role with all privilegies

-m [ --skip-missing-groups ]

skipping for missed privilegies instead error

-v [ --version ]

print the version of roledel being used

## SEE ALSO
roleadd(8), rolelst(8),


rolelst

title: rolelst(8)

summary: Print list of roles and priviledge

text:
# rolelst(8)

## NAME
rolelst - Print list of roles and priviledge

## SYNOPSIS
rolelst [ROLES*]

## DESCRIPTION
rolelst is utility prints current list of roles and privileges. The data is read from /etc/role file and starting from 0.5.0 version it is also /etc/role.d directory supported to allow installing separate role configurations.

## OPTIONS
-h [ --help ]

produce help message

-v [ --version ]

print the version of rolelst being used

-V [ --verbose ]

print data read from only /etc/role and after merge with /etc/role.d separately.

## SEE ALSO
roleadd(8), roledel(8),


nss-systemd

package: libnss-systemd

title: nss-systemd(8)

text:
# nss-systemd(8)

## NAME
nss-systemd, libnss_systemd.so.2 - UNIX user and group name resolution for user/group lookup via Varlink

## SYNOPSIS
libnss_systemd.so.2

## DESCRIPTION
nss-systemd is a plug-in module for the GNU Name Service Switch (NSS) functionality of the GNU C Library (glibc), providing UNIX user and group name resolution for services implementing the User/Group Record Lookup API via Varlink[1], such as the system and service manager systemd(1) (for its DynamicUser= feature, see systemd.exec(5) for details), systemd-homed.service(8), or systemd-machined.service(8).

This module also ensures that the root and nobody users and groups (i.e. the users/groups with the UIDs/GIDs 0 and 65534) remain resolvable at all times, even if they aren't listed in /etc/passwd or /etc/group, or if these files are missing.

This module preferably utilizes systemd-userdbd.service(8) for resolving users and groups, but also works without the service running.

To activate the NSS module, add "systemd" to the lines starting with "passwd:", "group:", "shadow:" and "gshadow:" in /etc/nsswitch.conf.

It is recommended to place "systemd" after the "files" or "compat" entry of the /etc/nsswitch.conf lines so that /etc/passwd, /etc/group, /etc/shadow and /etc/gshadow based mappings take precedence.

## STATIC DROP-IN JSON USER/GROUP RECORDS
Besides user/group records acquired via the aforementioned Varlink IPC interfaces and the synthesized root and nobody accounts, this module also makes user and group accounts available to the system that are defined in static drop-in files in the /etc/userdb/, /run/userdb/, /run/host/userdb/ and /usr/lib/userdb/ directories.

This is a simple mechanism to provide static user and group records via JSON drop-in files. Such user records should be defined in the format described by the JSON User Records[2] specification and be placed in one of the aforementioned directories under a file name composed of the user name suffixed with .user, with a world-readable access mode. A symlink named after the user record's UID formatted in decimal and suffixed with .user pointing to the primary record file should be created as well, in order to allow both lookups by username and by UID. Privileged user record data (e.g. hashed UNIX passwords) may optionally be provided as well, in a pair of separate companion files with the .user-privileged suffix. The data should be stored in a regular file named after the user name, suffixed with .user-privileged, and a symlink pointing to it, named after the used numeric UID formatted in decimal with the same suffix. These companion files should not be readable to anyone but root. Example:

```
-rw-r--r--. 1 root root  723 May 10 foobar.user
-rw-------. 1 root root  123 May 10 foobar.user-privileged
lrwxrwxrwx. 1 root root   19 May 10 4711.user -> foobar.user
lrwxrwxrwx. 1 root root   19 May 10 4711.user-privileged -> foobar.user-privileged
```

Similarly, group records following the format described in JSON Group Record[3] may be defined, using the file suffixes .group and .group-privileged.

The primary user/group record files (i.e. those with the .user and .group suffixes) should not contain the "privileged" section as described in the specifications. The privileged user/group record files (i.e. those with the .user-privileged and .group-privileged suffixes) should contain this section, exclusively.

Note that static user/group records generally do not override conflicting records in /etc/passwd or /etc/group or other account databases. In fact, before dropping in these files a reasonable level of care should be taken to avoid user/group name and UID/GID conflicts.

## CONFIGURATION IN /ETC/NSSWITCH.CONF
Here is an example /etc/nsswitch.conf file that enables nss-systemd correctly:

```
passwd:         compat systemd
group:          compat [SUCCESS=merge] systemd
shadow:         compat systemd
gshadow:        files systemd
hosts:          mymachines resolve [!UNAVAIL=return] files myhostname dns
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis
```

## EXAMPLE: MAPPINGS PROVIDED BY SYSTEMD-MACHINED.SERVICE
The container "rawhide" is spawned using systemd-nspawn(1):

```
# systemd-nspawn -M rawhide --boot --network-veth --private-users=pick
Spawning container rawhide on /var/lib/machines/rawhide.
Selected user namespace base 20119552 and range 65536.
...
$ machinectl --max-addresses=3
MACHINE CLASS     SERVICE        OS     VERSION ADDRESSES
rawhide container systemd-nspawn fedora 30      169.254.40.164 fe80::94aa:3aff:fe7b:d4b9
$ getent passwd vu-rawhide-0 vu-rawhide-81
vu-rawhide-0:*:20119552:65534:vu-rawhide-0:/:/usr/sbin/nologin
vu-rawhide-81:*:20119633:65534:vu-rawhide-81:/:/usr/sbin/nologin
$ getent group vg-rawhide-0 vg-rawhide-81
vg-rawhide-0:*:20119552:
vg-rawhide-81:*:20119633:
$ ps -o user:15,pid,tty,command -e|grep '^vu-rawhide'
vu-rawhide-0      692 ?        /usr/lib/systemd/systemd
vu-rawhide-0      731 ?        /usr/lib/systemd/systemd-journald
vu-rawhide-192    734 ?        /usr/lib/systemd/systemd-networkd
vu-rawhide-193    738 ?        /usr/lib/systemd/systemd-resolved
vu-rawhide-0      742 ?        /usr/lib/systemd/systemd-logind
vu-rawhide-81     744 ?        /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
vu-rawhide-0      746 ?        /usr/sbin/sshd -D ...
vu-rawhide-0      752 ?        /usr/lib/systemd/systemd --user
vu-rawhide-0      753 ?        (sd-pam)
vu-rawhide-0     1628 ?        login -- zbyszek
vu-rawhide-1000  1630 ?        /usr/lib/systemd/systemd --user
vu-rawhide-1000  1631 ?        (sd-pam)
vu-rawhide-1000  1637 pts/8    -zsh
```

## SEE ALSO
systemd(1), systemd.exec(5), nss-resolve(8), nss-myhostname(8), nss-mymachines(8), systemd-userdbd.service(8), systemd-homed.service(8), systemd-machined.service(8), nsswitch.conf(5), getent(1)

## NOTES
1.

User/Group Record Lookup API via Varlink

https://systemd.io/USER_GROUP_API

2.

JSON User Records

https://systemd.io/USER_RECORD

3.

JSON Group Record

https://systemd.io/GROUP_RECORD


title: r2test(8)

summary: MFC/R2 call setup test program

text:
# r2test(8)

## NAME
r2test - MFC/R2 call setup test program

## SYNOPSIS
r2test -c <file>

r2test -l

r2test -v

## DESCRIPTION
This tool can be used to test the OpenR2 library with MFC/R2 lines

## SEE ALSO
r2test.conf(5)

## AUTHOR
This manual page was written by Alexandre Cavalcante Alencar <alexandre.alencar@gmail.com>

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 any later version published by the Free Software Foundation.


package: libpam-google-authenticator

title: pam_google_authenticator(8)

summary: PAM module for Google two\-factor

text:
# pam_google_authenticator(8)

## NAME
pam_google_authenticator - PAM module for Google two-factor authentication

## SYNOPSIS
pam_google_authenticator.so [secret=file] [authtok_prompt=prompt] [user=username] [no_strict_owner] [allowed_perm=0nnn] [debug] [try_first_pass|use_first_pass|forward_pass] [noskewadj] [no_increment_hotp] [nullok] [echo_verification_code]

## DESCRIPTION
The pam_google_authenticator module is designed to protect user authentication with a second factor, either time-based (TOTP) or counter-based (HOTP). Prior logging in, the user will be asked for both its password and a one-time code. Such one-time codes can be generated with the Google Authenticator application, installed on the user's Android device. To respectively generate and verify those one-time codes, a secret key (randomly generated) must be shared between the device on which one-time codes are generated and the system on which this PAM module is enabled.

Depending on its configuration (see options section), this module requires that a secret file is manually set up for each account on the system. This secret file holds the secret key and user-specific options (see google-authenticator(1)). Unless the nullok option is used, authentication tries will be rejected if such secret file doesn't exist. Alternatively, a system administrator may create those secret files on behalf of the users and then communicates to them the secret keys.

## OPTIONS
secret=file

Specify a non-standard file location for the secret file.

By default, the PAM module looks for the secret file in the .google_authenticator file within the home of the user logging in. This option overrides this location.

The provided location may include the following short-hands:

•

${USER} that will be interpreted as the username.

•

${HOME} and ~ that will be interpreted as the user's home directory.

authtok_prompt=prompt

Override default token prompt.

Note that if spaces are present in the provided prompt, the whole argument must be wrapped in square brackets.

user=username

Switch to a hard-coded user prior to doing any file operation.

no_strict_owner

Disable the check against the secret file's owner.

By default, the secret file must be owned by the user logging in. This option disables this check.

allowed_perm=0nnn

Override checked permissions of the secret file.

By default, the secret file must be readable only by its owner (ie. mode 0600). This option allows a different mode to be specified for this file.

debug

Enable more verbose log messages in syslog.

try_first_pass|use_first_pass|forward_pass

Stacking options for this PAM module.

Because some PAM clients cannot prompt the user for more than just the password, the following stacking options may be used:

•

try_first_pass: before prompting the user for the one-time code, this module first tries the previous stacked module's password in case that satisfies this module as well.

•

use_first_pass: force this module to use a previous stacked modules password. With this option, this module will never prompt the user for the one-time code. Thus, if no valid one-time code is available, the user will be denied access.

•

forward_pass: query the user for both the system password and the verification code in a single prompt. The system password is then forwarded to the next PAM module, which will have to be configured with either the use_first_pass option, or the try_first_pass option.

noskewadj

Don't adjust time skew automatically.

By default, the PAM module makes an attempt to compensate for time skew between the server and the device on which one-time passcodes are generated. This option disable this behavior.

Note that this option is only relevant for time-based (TOTP) mode.

no_increment_hotp

Don't increment the counter for failed attempts.

In some circonstance, failed passwords still get an OTP prompt. This option disables counter incrementation is such situations.

Note that this option is only relevant for counter-based (HOTP) mode.

nullok

Allow users to log in without OTP, if they haven't set up OTP yet.

During the initial roll-out process, all users may not have created a secret key yet. This option allows them to log in, even if the secret file doesn't exist.

echo_verification_code

Echo the verification code when it is entered by the user.

## MODULE TYPE PROVIDED
Only the auth module type is provided.

## RETURN VALUES
PAM_SUCCESS

Either the provided one-time code is correct or is a valid emergency code.

PAM_IGNORE

This module is ignored.

PAM_AUTH_ERR

The provided one-time code isn't correct and isn't a valid emergency code, or an error was encountered.

## EXAMPLES
The following lines may be used to enable this PAM module:

•

auth required pam_google_authenticator.so no_increment_hotp # Make sure the counter (for HOTP mode) isn't incremented for failed attempts.

•

auth required pam_google_authenticator.so nullok # Allow users to log in if their secret files don't exist

•

auth required pam_google_authenticator.so secret=/var/unencrypted-home/${USER}/.google_authenticator # Store secret files in a specific location

•

auth required pam_google_authenticator.so [authtok_prompt=Your secret token: ] # Use a specific prompt

•

auth required pam_google_authenticator.so noskewadj # Don't compensate time skew automatically

## SECURITY NOTES
For highest security, make sure that both password and one-time code are being requested even if password and/or one-time code are incorrect. This means that at least the first of pam_unix.so (or whatever other module is used to verify passwords) and pam_google_authenticator.so should be set as required, not requisite.

## SEE ALSO
google-authenticator(1).

The Google Authenticator source code and all documentation may be downloaded from <https://github.com/google/google-authenticator-libpam>.


paperconfig

package: libpaper

title: paperconfig(8)

summary: configure the system default paper size

text:
# paperconfig(8)

## NAME
paperconfig - configure the system default paper size

## SYNOPSIS
paperconfig [ -v,--version ] [ -h,--help ] [ -p, --paper papername | --force ]

## DESCRIPTION
paperconfig sets the system (or default) paper to be used by tools using the papersize file. It can either ask interactively for the paper to use or be called non-interactively by scripts.

When the paper size has been changed, paperconfig notifies other packages of the change by running the scripts in the /etc/libpaper.d directory.

## OPTIONS
-v,--version

Print the version of paperconfig and exit.

-h,--help

Print help about usage and exit.

-p, --paper papername

Use papername if possible. If papername is not a valid paper, print an error message and exit.

--force

Force interactive selection of the system paper even if the actual paper is a valid one.

## ENVIRONMENT
PAPERCONF Full path to a file containing the paper size to use; this file will be rewritten with the system paper size.

## FILES
/etc/papersize

Contains the name of the system-wide default paper size to be used if the PAPERSIZE variable is not set.

/etc/libpaper.d

Directory of scripts to run after the paper size has been changed. This package puts no scripts here, but other packages may. run-parts is used to run the scripts, therefore their names must comply with run-part's naming requirements.

## AUTHOR
Yves Arrouye <arrouye@debian.org>

## SEE ALSO
paperconf(1)

papersize(5)


title: pkcs11-helper-1(8)

summary: Simplified PKCS#11 library.

text:
# pkcs11-helper-1(8)

## NAME
pkcs11-helper — Simplified PKCS#11 library.

## DESCRIPTION
pkcs11-helper is a simplified API for accessing PKCS#11 tokens for user applications.

## SEE ALSO
pkcs11-helper Home Page, https://github.com/OpenSC/pkcs11-helper/.

## AUTHORS AND COPYRIGHT
Copyright (c) 2006-2018 Alon Bar-Lev <alon.barlev@gmail.com>

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.


puzzle-diff

package: libpuzzle

title: puzzle-diff(8)

text:
# puzzle-diff(8)

## NAME
puzzle-diff - Compare pictures with libpuzzle

## SYNOPSIS
[-b <contrast barrier for cropping] [-c] [-C <max cropping ratio>] [-e] [-E <similarity threshold>] [-h] [-H <max height>] [-l <lambdas>] [-n <noise cutoff>] [-p <p ratio>] [-t] [-W <max width>] <file 1> <file 2>

## DESCRIPTION
puzzle-diff compares two pictures and outputs the normalized distance.

Try puzzle-diff -h for more info.

## EXAMPLES
Output distance between two images: $ puzzle-diff pic-a-0.jpg pics-a-1.jpg 0.102286

Compare two images, exit with 10 if they look the same, exit with 20 if they don't (may be useful for scripts): $ puzzle-diff -e pic-a-0.jpg pics-a-1.jpg $ echo $? 10

Compute distance, without cropping and with computing the average intensity of the whole blocks: $ puzzle-diff -p 1.0 -c pic-a-0.jpg pic-a-1.jpg 0.0523151

## SEE ALSO
libpuzzle(3) puzzle_set(3)


package: libpwquality

title: pam_pwquality(8)

text:
# pam_pwquality(8)

## NAME
pam_pwquality - PAM module to perform password quality checking

## SYNOPSIS
pam_pwquality.so [...]

## DESCRIPTION
This module can be plugged into the password stack of a given service to provide some plug-in strength-checking for passwords. The code was originally based on pam_cracklib module and the module is backwards compatible with its options.

The action of this module is to prompt the user for a password and check its strength against a system dictionary and a set of rules for identifying poor choices.

The first action is to prompt for a single password, check its strength and then, if it is considered strong, prompt for the password a second time (to verify that it was typed correctly on the first occasion). All being well, the password is passed on to subsequent modules to be installed as the new authentication token.

The checks for strength are:

Palindrome

Is the new password a palindrome?

Case Change Only

Is the new password the the old one with only a change of case?

Similar

Is the new password too much like the old one? This is primarily controlled by one argument, difok which is a number of character changes (inserts, removals, or replacements) between the old and new password that are enough to accept the new password.

Simple

Is the new password too small? This is controlled by 6 arguments minlen, maxclassrepeat, dcredit, ucredit, lcredit, and ocredit. See the section on the arguments for the details of how these work and there defaults.

Rotated

Is the new password a rotated version of the old password?

Same consecutive characters

Optional check for same consecutive characters.

Too long monotonic character sequence

Optional check for too long monotonic character sequence.

Contains user name

Check whether the password contains the user's name in some form.

Dictionary check

The Cracklib routine is called to check if the password is part of a dictionary.

These checks are configurable either by use of the module arguments or by modifying the /etc/security/pwquality.conf configuration file. The module arguments override the settings in the configuration file.

## OPTIONS
debug

This option makes the module write information to syslog(3) indicating the behavior of the module (this option does not write password information to the log file).

authtok_type=XXX

The default action is for the module to use the following prompts when requesting passwords: "New UNIX password: " and "Retype UNIX password: ". The example word UNIX can be replaced with this option, by default it is empty.

retry=N

Prompt user at most N times before returning with error. The default is 1.

difok=N

This argument will change the default of 1 for the number of changes in the new password from the old password. The special value of 0 disables all checks of similarity of the new password with the old password except the new password being exactly the same as the old one.

minlen=N

The minimum acceptable size for the new password (plus one if credits are not disabled which is the default). In addition to the number of characters in the new password, credit (of +1 in length) is given for each different kind of character (other, upper, lower and digit). The default for this parameter is 8. Note that there is a pair of length limits also in Cracklib, which is used for dictionary checking, a "way too short" limit of 4 which is hard coded in and a build time defined limit (6) that will be checked without reference to minlen.

dcredit=N

(N >= 0) This is the maximum credit for having digits in the new password. If you have less than or N digits, each digit will count +1 towards meeting the current minlen value. The default for dcredit is 0 which means there is no bonus for digits in password. (N < 0) This is the minimum number of digits that must be met for a new password.

ucredit=N

(N >= 0) This is the maximum credit for having upper case letters in the new password. If you have less than or N upper case letters, each upper case letter will count +1 towards meeting the current minlen value. The default for ucredit is 0 which means there is no bonus for upper case letters in password. (N < 0) This is the minimum number of upper case letters that must be met for a new password.

lcredit=N

(N >= 0) This is the maximum credit for having lower case letters in the new password. If you have less than or N lower case letters, each lower case letter will count +1 towards meeting the current minlen value. The default for lcredit is 0 which means there is no bonus for lower case letters in password. (N < 0) This is the minimum number of lower case letters that must be met for a new password.

ocredit=N

(N >= 0) This is the maximum credit for having other characters in the new password. If you have less than or N other characters, each other character will count +1 towards meeting the current minlen value. The default for ocredit is 0 which means there is no bonus for other characters in password. (N < 0) This is the minimum number of other characters that must be met for a new password.

minclass=N

The minimum number of required classes of characters for the new password. The four classes are digits, upper and lower letters and other characters. The difference to the credit check is that a specific class if of characters is not required. Instead N out of four of the classes are required. By default the check is disabled.

maxrepeat=N

Reject passwords which contain more than N same consecutive characters. The default is 0 which means that this check is disabled.

maxsequence=N

Reject passwords which contain monotonic character sequences longer than N. The default is 0 which means that this check is disabled. Examples of such sequence are '12345' or 'fedcb'. Note that most such passwords will not pass the simplicity check unless the sequence is only a minor part of the password.

maxclassrepeat=N

Reject passwords which contain more than N consecutive characters of the same class. The default is 0 which means that this check is disabled.

gecoscheck=N

If nonzero, check whether the individual words longer than 3 characters from the passwd(5) GECOS field of the user are contained in the new password. The default is 0 which means that this check is disabled.

dictcheck=N

If nonzero, check whether the password (with possible modifications) matches a word in a dictionary. Currently the dictionary check is performed using the cracklib library. The default is 1 which means that this check is enabled.

usercheck=N

If nonzero, check whether the password (with possible modifications) contains the user name in some form. The default is 1 which means that this check is enabled. It is not performed for user names shorter than 3 characters.

usersubstr=N

If greater than 3 (due to the minimum length in usercheck), check whether the password contains a substring of at least N length in some form. The default is 0, which means this check is disabled.

enforcing=N

If nonzero, reject the password if it fails the checks, otherwise only print the warning. The default is 1 which means that the weak password is rejected (for non-root users).

badwords=<list of words>

The words more than 3 characters long from this space separated list are individually searched for and forbidden in the new password. By default the list is empty which means that this check is disabled.

dictpath=/path/to/dict

This options allows for specification of non-default path to the cracklib dictionaries.

enforce_for_root

The module will return error on failed check even if the user changing the password is root. This option is off by default which means that just the message about the failed check is printed but root can change the password anyway. Note that root is not asked for an old password so the checks that compare the old and new password are not performed.

local_users_only

The module will not test the password quality for users that are not present in the /etc/passwd file. The module still asks for the password so the following modules in the stack can use the use_authtok option. This option is off by default.

use_authtok

This argument is used to force the module to not prompt the user for a new password but use the one provided by the previously stacked password module.

## MODULE TYPES PROVIDED
Only the password module type is provided.

## RETURN VALUES
PAM_SUCCESS

The new password passes all checks.

PAM_AUTHTOK_ERR

No new password was entered, the username could not be determined or the new password fails the strength checks.

PAM_AUTHTOK_RECOVERY_ERR

The old password was not supplied by a previous stacked module or got not requested from the user. The first error can happen if use_authtok is specified.

PAM_SERVICE_ERR

A internal error occurred.

## EXAMPLES
For an example of the use of this module, we show how it may be stacked with the password component of pam_unix(8).

```
 #
 # These lines stack two password type modules. In this example the
 # user is given 3 opportunities to enter a strong password. The
 # "use_authtok" argument ensures that the pam_unix module does not
 # prompt for a password, but instead uses the one provided by
 # pam_pwquality.
 #
 password required pam_pwquality.so retry=3
 password required pam_unix.so use_authtok
```

Another example is for the case that you want to use sha256 password encryption:

```
 #
 # These lines allow modern systems to support passwords of at least 14
 # bytes with extra credit of 2 for digits and 2 for others the new
 # password must have at least three bytes that are not present in the
 # old password
 #
 password required pam_pwquality.so \
               difok=3 minlen=15 dcredit=2 ocredit=2
 password required pam_unix.so use_authtok nullok sha256
```

And here is another example in case you don't want to use credits:

```
 #
 # These lines require the user to select a password with a minimum
 # length of 8 and with at least 1 digit number, 1 upper case letter,
 # and 1 other character
 #
 password required pam_pwquality.so \
               dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8
 password required pam_unix.so use_authtok nullok sha256
```

## SEE ALSO
pwscore(1), pwquality.conf(5), pam_pwquality(8), pam.conf(5), PAM(8)

## AUTHORS
Tomas Mraz <tmraz@redhat.com>

Original author of pam_cracklib module Cristian Gafton <gafton@redhat.com>


qb-blackbox

package: libqb

title: qb-blackbox(8)

summary: Display flight data from the blackbox.

text:
# qb-blackbox(8)

## NAME
qb-blackbox - Display "flight data" from the "blackbox".

## SYNOPSIS
qb-blackbox [blackbox-file...]

## DESCRIPTION
qb-blackbox prints out the logs (including debug logs) that were recorded using libqb's blackbox mechanism.

### Portability notes
Due to variations amongst platforms, some of which directly impact the libqb's blackbox format handling (e.g. page size), there's currently only the commitment that qb-blackbox shall decode the blackbox files recorded at the same platform (plus the same page size) while using libqb compiled with the same relevant compile-time options (e.g. USE_CACHE_LINE_ALIGNMENT) as linked to this decoder. Otherwise, your mileage may vary.

## EXAMPLES
Get info to help developers diagnose a crash.

$ qb-blackbox /var/lib/corosync/fdata

Dumping the contents of /var/lib/corosync/fdata

Mar 23 20:58:57 message_handler_orf_token():3677 install seq 0 aru 0 high seq received 0

Mar 23 20:58:57 message_handler_orf_token():3696 retrans flag count 4 token aru 0 install seq 0 aru 0 0

Mar 23 20:58:57 old_ring_state_reset():1487 Resetting old ring state

Mar 23 20:58:57 deliver_messages_from_recovery_to_regular():1693 recovery to regular 1-0

Mar 23 20:58:57 memb_state_operational_enter():1779 Delivering to app 1 to 0

Mar 23 20:58:57 sync_abort():594 ENTERING sync_abort()

Mar 23 20:58:57 sync_save_transitional():586 ENTERING sync_save_transitional()

Mar 23 20:58:57 member_object_joined():301 Member joined: r(0) ip(192.168.122.1)

Mar 23 20:58:57 sync_abort():594 ENTERING sync_abort()

## SEE ALSO
qblog.h(3)

## AUTHOR
Angus Salkeld


librados-config

package: librados-devel

title: librados-config(8)

summary: display information about librados

text:
# librados-config(8)

## NAME
librados-config - display information about librados

## SYNOPSIS

```
librados-config [ --version ] [ --vernum ]
```

## DESCRIPTION
librados-config is a utility that displays information about the

installed librados.

## OPTIONS
--version

Display librados version

--vernum

Display the librados version code

## AVAILABILITY
librados-config is part of Ceph, a massively scalable, open-source, distributed storage system. Please refer to the Ceph documentation at https://docs.ceph.com for more information.

## SEE ALSO
ceph(8), rados(8)

## COPYRIGHT
2010-2024, Inktank Storage, Inc. and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0)


rpmgraph

package: librpm-devel

title: rpmgraph(8)

summary: Display RPM Package Dependency Graph

text:
# rpmgraph(8)

## NAME
rpmgraph - Display RPM Package Dependency Graph

## SYNOPSIS
rpmgraph PACKAGE_FILE ...

## DESCRIPTION
rpmgraph uses PACKAGE_FILE arguments to generate a package dependency graph. Each PACKAGE_FILE argument is read and added to an rpm transaction set. The elements of the transaction set are partially ordered using a topological sort. The partially ordered elements are then printed to standard output.

Nodes in the dependency graph are package names, and edges in the directed graph point to the parent of each node. The parent node is defined as the last predecessor of a package when partially ordered using the package dependencies as a relation. That means that the parent of a given package is the package's last prerequisite.

The output is in dot(1) directed graph format, and can be displayed or printed using the dotty graph editor from the graphviz package. There are no rpmgraph specific options, only common rpm options. See the rpmgraph usage message for what is currently implemented.

## SEE ALSO
dot(1),

dotty(1),

http://www.graphviz.org/ <URL:http://www.graphviz.org/>

## AUTHORS
Jeff Johnson <jbj@redhat.com>


booleans

package: libselinux

title: booleans(8)

text:
# booleans(8)

## NAME
booleans - Policy booleans enable runtime customization of SELinux policy

## DESCRIPTION
This manual page describes SELinux policy booleans. The SELinux policy can include conditional rules that are enabled or disabled based on the current values of a set of policy booleans. These policy booleans allow runtime modification of the security policy without having to load a new policy.

For example, the boolean httpd_enable_cgi allows the httpd daemon to run cgi scripts if it is enabled. If the administrator does not want to allow execution of cgi scripts, he can simply disable this boolean value.

The policy defines a default value for each boolean, typically false. These default values can be overridden via local settings created via the setsebool(8) utility, using -P to make the setting persistent across reboots. The system-config-securitylevel tool provides a graphical interface for altering the settings. The load_policy(8) program will preserve current boolean settings upon a policy reload by default, or can optionally reset booleans to the boot-time defaults via the -b option.

Boolean values can be listed by using the getsebool(8) utility and passing it the -a option.

Boolean values can also be changed at runtime via the setsebool(8) utility or the togglesebool(8) utility. By default, these utilities only change the current boolean value and do not affect the persistent settings, unless the -P option is used to setsebool.

## AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>. The SELinux conditional policy support was developed by Tresys Technology.

## SEE ALSO
getsebool(8), setsebool(8), selinux(8), togglesebool(8)


selinux

title: selinux(8)

summary: NSA Security-Enhanced Linux (SELinux)

text:
# selinux(8)

## NAME
SELinux - NSA Security-Enhanced Linux (SELinux)

## DESCRIPTION
NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system. The SELinux architecture provides general support for the enforcement of many kinds of mandatory access control policies, including those based on the concepts of Type Enforcement®, Role- Based Access Control, and Multi-Level Security. Background information and technical documentation about SELinux can be found at https://github.com/SELinuxProject.

The /etc/selinux/config configuration file controls whether SELinux is enabled or disabled, and if enabled, whether SELinux operates in permissive mode or enforcing mode. The SELINUX variable may be set to any one of disabled, permissive, or enforcing to select one of these options. The disabled disables most of the SELinux kernel and application code, leaving the system running without any SELinux protection. The permissive option enables the SELinux code, but causes it to operate in a mode where accesses that would be denied by policy are permitted but audited. The enforcing option enables the SELinux code and causes it to enforce access denials as well as auditing them. permissive mode may yield a different set of denials than enforcing mode, both because enforcing mode will prevent an operation from proceeding past the first denial and because some application code will fall back to a less privileged mode of operation if denied access.

NOTE: Disabling SELinux by setting SELINUX=disabled in /etc/selinux/config is deprecated and depending on kernel version and configuration it might not lead to SELinux being completely disabled. Specifically, the SELinux hooks will still be executed internally, but the SELinux policy will not be loaded and no operation will be denied. In such state, the system will act as if SELinux was disabled, although some operations might behave slightly differently. To properly disable SELinux, it is recommended to use the selinux=0 kernel boot option instead. In that case SELinux will be disabled regardless of what is set in the /etc/selinux/config file.

The /etc/selinux/config configuration file also controls what policy is active on the system. SELinux allows for multiple policies to be installed on the system, but only one policy may be active at any given time. At present, multiple kinds of SELinux policy exist: targeted, mls for example. The targeted policy is designed as a policy where most user processes operate without restrictions, and only specific services are placed into distinct security domains that are confined by the policy. For example, the user would run in a completely unconfined domain while the named daemon or apache daemon would run in a specific domain tailored to its operation. The MLS (Multi-Level Security) policy is designed as a policy where all processes are partitioned into fine-grained security domains and confined by policy. MLS also supports the Bell And LaPadula model, where processes are not only confined by the type but also the level of the data.

You can define which policy you will run by setting the SELINUXTYPE environment variable within /etc/selinux/config. You must reboot and possibly relabel if you change the policy type to have it take effect on the system. The corresponding policy configuration for each such policy must be installed in the /etc/selinux/{SELINUXTYPE}/ directories.

A given SELinux policy can be customized further based on a set of compile-time tunable options and a set of runtime policy booleans. system-config-selinux allows customization of these booleans and tunables.

Many domains that are protected by SELinux also include SELinux man pages explaining how to customize their policy.

## FILE LABELING
All files, directories, devices ... have a security context/label associated with them. These context are stored in the extended attributes of the file system. Problems with SELinux often arise from the file system being mislabeled. This can be caused by booting the machine with a non SELinux kernel. If you see an error message containing file_t, that is usually a good indicator that you have a serious problem with file system labeling.

The best way to relabel the file system is to create the flag file /.autorelabel and reboot. system-config-selinux, also has this capability. The restorecon/fixfiles commands are also available for relabeling files.

## AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>.

## FILES
/etc/selinux/config

## SEE ALSO
booleans(8), setsebool(8), sepolicy(8), system-config-selinux(8), togglesebool(8), restorecon(8), fixfiles(8), setfiles(8), semanage(8), sepolicy(8)

Every confined service on the system has a man page in the following format:

<servicename>_selinux(8)

For example, httpd has the httpd_selinux(8) man page.

man -k selinux

Will list all SELinux man pages.


avcstat

package: libselinux-utils

title: avcstat(8)

summary: Display SELinux AVC statistics

text:
# avcstat(8)

## NAME
avcstat - Display SELinux AVC statistics

## SYNOPSIS
avcstat [-c] [-f status_file] [interval]

## DESCRIPTION
Display SELinux AVC statistics. If the interval parameter is specified, the program will loop, displaying updated statistics every interval seconds. Relative values are displayed by default.

## OPTIONS
-c

Display the cumulative values.

-f

Specifies the location of the AVC statistics file, defaulting to /sys/fs/selinux/avc/cache_stats.

## AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>. The program was written by James Morris <jmorris@redhat.com>.

## SEE ALSO
selinux(8)


getenforce

title: getenforce(8)

summary: get the current mode of SELinux

text:
# getenforce(8)

## NAME
getenforce - get the current mode of SELinux

## SYNOPSIS
getenforce

## DESCRIPTION
getenforce reports whether SELinux is enforcing, permissive, or disabled.

## AUTHOR
Dan Walsh, <dwalsh@redhat.com>

## SEE ALSO
selinux(8), setenforce(8), selinuxenabled(8)


getsebool

title: getsebool(8)

summary: get SELinux boolean value(s)

text:
# getsebool(8)

## NAME
getsebool - get SELinux boolean value(s)

## SYNOPSIS
getsebool [-a] [boolean]

## DESCRIPTION
getsebool reports where a particular SELinux boolean or all SELinux booleans are on or off In certain situations a boolean can be in one state with a pending change to the other state. getsebool will report this as a pending change. The pending value indicates the value that will be applied upon the next boolean commit.

The setting of boolean values occurs in two stages; first the pending value is changed, then the booleans are committed, causing their active values to become their pending values. This allows a group of booleans to be changed in a single transaction, by setting all of their pending values as desired and then committing once.

## OPTIONS
-a

Show all SELinux booleans.

## AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>. The program was written by Tresys Technology.

## SEE ALSO
selinux(8), setsebool(8), booleans(8)


matchpathcon

title: matchpathcon(8)

text:
# matchpathcon(8)

## NAME
matchpathcon - get the default SELinux security context for the specified path from the file contexts configuration

## SYNOPSIS
matchpathcon [-V] [-N] [-n] [-m type] [-f file_contexts_file] [-p prefix] [-P policy_root_path] filepath...

## DESCRIPTION
matchpathcon queries the system policy and outputs the default security context associated with the filepath.

Note: Identical paths can have different security contexts, depending on the file type (regular file, directory, link file, char file ...).

matchpathcon will also take the file type into consideration in determining the default security context if the file exists. If the file does not exist, no file type matching will occur.

## OPTIONS
-m type

Force file type for the lookup. Valid types are file, dir, pipe, chr_file, blk_file, lnk_file, sock_file.

-n

Do not display path.

-N

Do not use translations.

-f file_context_file

Use alternate file_context file

-p prefix

Use prefix to speed translations

-P policy_root_path

Use alternate policy root path

-V

Verify file context on disk matches defaults

## AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>.

## SEE ALSO
selinux(8), matchpathcon(3)


title: sefcontext_compile(8)

text:
# sefcontext_compile(8)

## NAME
sefcontext_compile - compile file context regular expression files

## SYNOPSIS
sefcontext_compile [-o outputfile] [-p policyfile] inputfile

## DESCRIPTION
sefcontext_compile is used to compile file context regular expressions into pcre(3) format.

The compiled file is used by libselinux file labeling functions.

By default sefcontext_compile writes the compiled pcre file with the .bin suffix appended (e.g. inputfile.bin).

## OPTIONS
-o

Specify an outputfile that must be a fully qualified file name as the .bin suffix is not automatically added.

-p

Specify a binary policyfile that will be used to validate the context entries in the inputfile

If an invalid context is found the pcre formatted file will not be written and an error will be returned.

## RETURN VALUE
On error -1 is returned. On success 0 is returned.

## EXAMPLES
Example 1:

sefcontext_compile /etc/selinux/targeted/contexts/files/file_contexts

Results in the following file being generated:

/etc/selinux/targeted/contexts/files/file_contexts.bin

Example 2:

sefcontext_compile -o new_fc.bin /etc/selinux/targeted/contexts/files/file_contexts

Results in the following file being generated in the cwd:

new_fc.bin

## AUTHOR
Dan Walsh, <dwalsh@redhat.com>

## SEE ALSO
selinux(8), semanage(8),


selinuxconlist

title: selinuxconlist(8)

text:
# selinuxconlist(8)

## NAME
selinuxconlist - list all SELinux context reachable for user

## SYNOPSIS
selinuxconlist [-l level] user [context]

## DESCRIPTION
selinuxconlist reports the list of context reachable for user from the current context or specified context

-l level mcs/mls level

## AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>.

## SEE ALSO
secon(8), selinuxdefcon(8)


selinuxdefcon

title: selinuxdefcon(8)

summary: report default SELinux context for user

text:
# selinuxdefcon(8)

## NAME
selinuxdefcon - report default SELinux context for user

## SYNOPSIS
selinuxdefcon [-l level] user fromcon

## DESCRIPTION
selinuxdefcon reports the default context for the specified user from the specified context

-l level mcs/mls level

## EXAMPLE
\# selinuxdefcon jsmith system_u:system_r:sshd_t:s0

unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

## AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>.

## SEE ALSO
secon(8), selinuxconlist(8)


selinuxenabled

title: selinuxenabled(8)

text:
# selinuxenabled(8)

## NAME
selinuxenabled - tool to be used within shell scripts to determine if selinux is enabled

## SYNOPSIS
selinuxenabled

## DESCRIPTION
Indicates whether SELinux is enabled or disabled.

## EXIT STATUS
It exits with status 0 if SELinux is enabled and 1 if it is not enabled.

## AUTHOR
Dan Walsh, <dwalsh@redhat.com>

## SEE ALSO
selinux(8), setenforce(8), getenforce(8)


selinuxexeccon

title: selinuxexeccon(8)

text:
# selinuxexeccon(8)

## NAME
selinuxexeccon - report SELinux context used for this executable

## SYNOPSIS
selinuxexeccon command [fromcon]

## DESCRIPTION
selinuxexeccon reports the SELinux process context for the specified command from the specified context or the current context.

## EXAMPLE

```
# selinuxexeccon /usr/bin/passwd
staff_u:staff_r:passwd_t:s0-s0:c0.c1023
# selinuxexeccon /usr/sbin/sendmail system_u:system_r:httpd_t:s0
system_u:system_r:system_mail_t:s0
```

## AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>.

## SEE ALSO
secon(8)


setenforce

title: setenforce(8)

summary: modify the mode SELinux is running in

text:
# setenforce(8)

## NAME
setenforce - modify the mode SELinux is running in

## SYNOPSIS
setenforce [Enforcing|Permissive|1|0]

## DESCRIPTION
Use Enforcing or 1 to put SELinux in enforcing mode.

Use Permissive or 0 to put SELinux in permissive mode.

If SELinux is disabled and you want to enable it, or SELinux is enabled and you want to disable it, please see selinux(8).

## AUTHOR
Dan Walsh, <dwalsh@redhat.com>

## SEE ALSO
selinux(8), getenforce(8), selinuxenabled(8)


togglesebool

title: togglesebool(8)

text:
# togglesebool(8)

## NAME
togglesebool - flip the current value of a SELinux boolean

## SYNOPSIS
togglesebool boolean...

## DESCRIPTION
togglesebool flips the current value of a list of booleans. If the value is currently a 1, then it will be changed to a 0 and vice versa. Only the "in memory" values are changed; the boot-time settings are unaffected.

## AUTHOR
This man page was written by Steve Grubb <sgrubb@redhat.com>

## SEE ALSO
selinux(8), booleans(8), getsebool(8), setsebool(8)


chkcon

package: libsepol-utils

title: chkcon(8)

text:
# chkcon(8)

## NAME
chkcon - determine if a security context is valid for a given binary policy

## SYNOPSIS
chkcon policy_file context

## DESCRIPTION
This utility validates (the string representation of) a security context specified by the argument context against configuration data read in from a policy database binary representation file specified by the argument policy_file.

## FILES
policy file

## AUTHOR
This manual page (and just the manual page) was written by Manoj Srivastava <srivasta@debian.org>.


teamnl

package: libteam-utils

title: teamnl(8)

text:
# teamnl(8)

## NAME
teamnl — team network device Netlink interface tool

## SYNOPSIS
teamnl [-p port_name] [-a array_index] team_device command [command_args...]

teamnl -h

## DESCRIPTION
teamnl is a tool enabling interaction with a team device via the team driver Netlink interface. This tools serves mainly for debugging purposes. Note that it makes no sense to use this tool to change options on team device controlled by a teamd instance.

## OPTIONS
-h, --help

Print help text to console and exit.

-p ifname, --port_name ifname

Select per-port option of provided interface name.

-a index, --array_index index

Select array option of provided array index.

## COMMAND
ports

Dumps team ports.

option

Dumps team options.

getoption opt_name

Gets option by selected name.

setoption opt_name opt_value

Sets option by selected name.

monitor opt_style

Monitors changes made to options, ports and interface information. Style can be either "changed" (default) or "all".

## SEE ALSO
teamd(8), teamdctl(8), teamd.conf(5)

## AUTHOR
Jiri Pirko is the original author and current maintainer of libteam.


package: libtelepathy-mission-control

title: mission-control-5(8)

text:
# mission-control-5(8)

## NAME
mission-control-5 - Telepathy account manager/chanel dispatcher

## SYNOPSIS
/usr/libexec/mission-control-5

## DESCRIPTION
Mission Control 5 implements the AccountManager and ChannelDispatcher services described in the Telepathy D-Bus specification, allowing clients like empathy(1) to store account details, connect to accounts, request communication channels, and have channels dispatched to them.

It is a D-Bus service which runs on the session bus, and should usually be started automatically by D-Bus activation. However, it might be useful to start it manually for debugging.

## OPTIONS
There are no command-line options.

## ENVIRONMENT
MC_DEBUG=all or MC_DEBUG=category[,category...]

May be set to "all" for full debug output from Mission Control and telepathy-glib, or various undocumented category names (which may change from release to release) to filter the output. See Mission Control and telepathy-glib source code for the available categories.

MC_DEBUG=level

Set a numeric debug level for Mission Control itself (but not telepathy-glib). Level 0 logs nothing, level 1 logs most messages, and level 2 logs all messages.

MC_TP_DEBUG=type

May be set to "all" for full debug output from telepathy-glib, or various undocumented options (which may change from telepathy-glib release to release) to filter the output. See telepathy-glib source code for the available options.

## SEE ALSO
http://telepathy.freedesktop.org/


unbound-anchor

package: libunbound

title: unbound-anchor(8)

summary: Unbound 1.25.1 anchor utility.

text:
# unbound-anchor(8)

## NAME
unbound-anchor - Unbound 1.25.1 anchor utility.

## SYNOPSIS
unbound-anchor [opts]

## DESCRIPTION
unbound-anchor performs setup or update of the root trust anchor for DNSSEC validation. The program fetches the trust anchor with the method from RFC 7958 when regular RFC 5011 update fails to bring it up to date. It can be run from the commandline, or run as part of startup scripts before you start the unbound(8) DNS server.

Note that if you want to use RFC 5011 with Unbound (i.e., the auto-trust-anchor-file option) so that trust anchor information is automatically tracked by Unbound during operation, the user that Unbound runs under (by default 'unbound') must have write permissions to the file and the directory the file lives in (for creating temporary files). In this case you would probably want to run this program as the designated Unbound user.

Suggested usage:

```
# in the init scripts.
# provide or update the root anchor (if necessary)
unbound-anchor -a "/var/lib/unbound/root.key"
# Please note usage of this root anchor is at your own risk
# and under the terms of our LICENSE (see source).
#
# start validating resolver
# the unbound.conf contains:
# auto-trust-anchor-file: "/var/lib/unbound/root.key"
unbound -c unbound.conf
```

This tool provides builtin default contents for the root anchor and root update certificate files.

It tests if the root anchor file works, and if not, and an update is possible, attempts to update the root anchor using the root update certificate. It performs a https fetch of root-anchors.xml and checks the results (RFC 7958); if all checks are successful, it updates the root anchor file. Otherwise the root anchor file is unchanged. It performs RFC 5011 tracking if the DNSSEC information available via the DNS makes that possible.

It does not perform an update if the certificate is expired, if the network is down or other errors occur.

The available options are:

-a <file>

The root anchor key file, that is read in and written out. Default is /var/lib/unbound/root.key. If the file does not exist, or is empty, a builtin root key is written to it.

-c <file>

The root update certificate file, that is read in. Default is /var/lib/unbound/icannbundle.pem. If the file does not exist, or is empty, a builtin certificate is used.

-l

List the builtin root key and builtin root update certificate on stdout.

-u <name>

The server name, it connects to https://name. Specify without https:// prefix. The default is "data.iana.org". It connects to the port specified with -P. You can pass an IPv4 address or IPv6 address (no brackets) if you want.

-S

Do not use SNI for the HTTPS connection. Default is to use SNI.

-b <address>

The source address to bind to for domain resolution and contacting the server on https. May be either an IPv4 address or IPv6 address (no brackets).

-x <path>

The pathname to the root-anchors.xml file on the server. (forms URL with -u). The default is /root-anchors/root-anchors.xml.

-s <path>

The pathname to the root-anchors.p7s file on the server. (forms URL with -u). The default is /root-anchors/root-anchors.p7s. This file has to be a PKCS7 signature over the xml file, using the pem file (-c) as trust anchor.

-n <name>

The emailAddress for the Subject of the signer's certificate from the p7s signature file. Only signatures from this name are allowed. The default is dnssec@iana.org. If you pass "" then the emailAddress is not checked.

-4

Use IPv4 for domain resolution and contacting the server on https. Default is to use IPv4 and IPv6 where appropriate.

-6

Use IPv6 for domain resolution and contacting the server on https. Default is to use IPv4 and IPv6 where appropriate.

-f <resolv.conf>

Use the given resolv.conf file. Not enabled by default, but you could try to pass /etc/resolv.conf on some systems. It contains the IP addresses of the recursive nameservers to use. However, since this tool could be used to bootstrap that very recursive nameserver, it would not be useful (since that server is not up yet, since we are bootstrapping it). It could be useful in a situation where you know an upstream cache is deployed (and running) and in captive portal situations.

-r <root.hints>

Use the given root.hints file (same syntax as the BIND and Unbound root hints file) to bootstrap domain resolution. By default a list of builtin root hints is used. unbound-anchor goes to the network itself for these roots, to resolve the server (-u option) and to check the root DNSKEY records. It does so, because the tool when used for bootstrapping the recursive resolver, cannot use that recursive resolver itself because it is bootstrapping that server.

-R

Allow fallback from -f <resolv.conf> file to direct root servers query. It allows you to prefer local resolvers, but fallback automatically to direct root query if they do not respond or do not support DNSSEC.

-v

More verbose. Once prints informational messages, multiple times may enable large debug amounts (such as full certificates or byte-dumps of downloaded files). By default it prints almost nothing. It also prints nothing on errors by default; in that case the original root anchor file is simply left undisturbed, so that a recursive server can start right after it.

-C <unbound.conf>

Debug option to read <unbound.conf> into the resolver process used.

-P <port>

Set the port number to use for the https connection. The default is 443.

-F

Debug option to force update of the root anchor through downloading the xml file and verifying it with the certificate. By default it first tries to update by contacting the DNS, which uses much less bandwidth, is much faster (200 msec not 2 sec), and is nicer to the deployed infrastructure. With this option, it still attempts to do so (and may verbosely tell you), but then ignores the result and goes on to use the xml fallback method.

-h

Show the version and commandline option help.

## EXIT CODE
This tool exits with value 1 if the root anchor was updated using the certificate or if the builtin root-anchor was used. It exits with code 0 if no update was necessary, if the update was possible with RFC 5011 tracking, or if an error occurred.

You can check the exit value in this manner:

```
unbound-anchor -a "root.key" || logger "Please check root.key"
```

Or something more suitable for your operational environment.

## TRUST
The root keys and update certificate included in this tool are provided for convenience and under the terms of our license (see the LICENSE file in the source distribution or https://github.com/NLnetLabs/unbound/blob/master/LICENSE and might be stale or not suitable to your purpose.

By running unbound-anchor -l the keys and certificate that are configured in the code are printed for your convenience.

The built-in configuration can be overridden by providing a root-cert file and a rootkey file.

## FILES
/var/lib/unbound/root.key

The root anchor file, updated with 5011 tracking, and read and written to. The file is created if it does not exist.

/var/lib/unbound/icannbundle.pem

The trusted self-signed certificate that is used to verify the downloaded DNSSEC root trust anchor. You can update it by fetching it from https://data.iana.org/root-anchors/icannbundle.pem (and validate it). If the file does not exist or is empty, a builtin version is used.

https://data.iana.org/root-anchors/root-anchors.xml

Source for the root key information.

https://data.iana.org/root-anchors/root-anchors.p7s

Signature on the root key information.

## SEE ALSO
unbound.conf(5), unbound(8).

## AUTHOR
Unbound developers are mentioned in the CREDITS file in the distribution.

## COPYRIGHT
1999-2026, NLnet Labs