title: php-fpm8.2.31(8)

summary: PHP FastCGI Process Manager 'PHP-FPM'

text:
# php-fpm8.2.31(8)

## NAME
php7-fpm - PHP FastCGI Process Manager 'PHP-FPM'

## SYNOPSIS
php8.2-fpm [options]

## DESCRIPTION
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. This is a variant of PHP that will run in the background as a daemon, listening for CGI requests. Output is logged to /var/log/php8.2-fpm.log.

Most options are set in the configuration file. The configuration file is /etc/php-fpm.conf. By default, php8.2-fpm will respond to CGI requests listening on localhost http port 9000. Therefore php7-fpm expects your webserver to forward all requests for '.php' files to port 9000 and you should edit your webserver configuration file appropriately.

## OPTIONS
-C

Do not chdir to the script's directory

--php-ini path|file

-c path|file

Look for php.ini file in the directory path or use the specified file

--no-php-ini

-n

No php.ini file will be used

--define foo[=bar]

-d foo[=bar]

Define INI entry foo with value bar

-e

Generate extended information for debugger/profiler

--help

-h

This help

--info

-i

PHP information and configuration

--modules

-m

Show compiled in modules

--version

-v

Version number

--prefix path

-p

Specify alternative prefix path (the default is /usr)

--pid file

-g

Specify the PID file location.

--fpm-config file

-y

Specify alternative path to FastCGI process manager configuration file (the default is /etc/fpm/php8.2-fpm.conf)

--test

-t

Test FPM configuration file and exit If called twice (-tt), the configuration is dumped before exiting.

--daemonize

-D

Force to run in background and ignore daemonize option from configuration file.

--nodaemonize

-F

Force to stay in foreground and ignore daemonize option from configuration file.

--force-stderr

-O

Force output to stderr in nodaemonize even if stderr is not a TTY.

--allow-to-run-as-root

-R

Allow pool to run as root (disabled by default)

## FILES
php8.2-fpm.conf

The configuration file for the php7-fpm daemon.

php.ini

The standard php configuration file.

## EXAMPLES
For any unix systems which use init.d for their main process manager, you should use the init script provided to start and stop the php8.2-fpm daemon.

sudo /etc/init.d/php8.2-fpm start

For any unix systems which use systemd for their main process manager, you should use the unit file provided to start and stop the php8.2-fpm daemon.

sudo systemctl start php8.2-fpm.service

If your installation has no appropriate init script, launch php8.2-fpm with no arguments. It will launch as a daemon (background process) by default. The file /var/run/php8.2-fpm.pid determines whether php8.2-fpm is already up and running. Once started, php8.2-fpm then responds to several POSIX signals:

SIGINT,SIGTERM immediate termination SIGQUIT graceful stop

SIGUSR1 re-open log file

SIGUSR2 graceful reload of all workers + reload of fpm conf/binary

## TIPS
The PHP-FPM CGI daemon will work well with most popular webservers, including Apache2, lighttpd and nginx.

## SEE ALSO
The PHP-FPM website:

http://php-fpm.org

For a more or less complete description of PHP look here:

http://www.php.net/manual/

A nice introduction to PHP by Stig Bakken can be found here:

http://www.zend.com/zend/art/intro.php

## BUGS
You can view the list of known bugs or report any new bug you found at:

https://github.com/php/php-src/issues

## AUTHORS
PHP-FPM SAPI was written by Andrei Nigmatulin. The mailing-lists are highload-php-en (English) and highload-php-ru (Russian).

The PHP Group: Thies C. Arntzen, Stig Bakken, Andi Gutmans, Rasmus Lerdorf, Sam Ruby, Sascha Schumann, Zeev Suraski, Jim Winstead, Andrei Zmievski.

A List of active developers can be found here:

http://www.php.net/credits.php

And last but not least PHP was developed with the help of a huge amount of contributors all around the world.

## VERSION INFORMATION
This manpage describes php8.2-fpm, version @PHP_VERSION@.

## COPYRIGHT
Copyright © The PHP Group

Copyright (c) 2007-2009, Andrei Nigmatulin

This source file is subject to version 3.01 of the PHP license, that is bundled with this package in the file LICENSE, and is available through the world-wide-web at the following url:

https://www.php.net/license/3_01.txt

If you did not receive a copy of the PHP license and are unable to obtain it through the world-wide-web, please send a note to license@php.net so we can mail you a copy immediately.


title: php-fpm8.3.32(8)

summary: PHP FastCGI Process Manager 'PHP-FPM'

text:
# php-fpm8.3.32(8)

## NAME
php7-fpm - PHP FastCGI Process Manager 'PHP-FPM'

## SYNOPSIS
php8.3-fpm [options]

## DESCRIPTION
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. This is a variant of PHP that will run in the background as a daemon, listening for CGI requests. Output is logged to /var/log/php8.3-fpm.log.

Most options are set in the configuration file. The configuration file is /etc/php-fpm.conf. By default, php8.3-fpm will respond to CGI requests listening on localhost http port 9000. Therefore php7-fpm expects your webserver to forward all requests for '.php' files to port 9000 and you should edit your webserver configuration file appropriately.

## OPTIONS
-C

Do not chdir to the script's directory

--php-ini path|file

-c path|file

Look for php.ini file in the directory path or use the specified file

--no-php-ini

-n

No php.ini file will be used

--define foo[=bar]

-d foo[=bar]

Define INI entry foo with value bar

-e

Generate extended information for debugger/profiler

--help

-h

This help

--info

-i

PHP information and configuration

--modules

-m

Show compiled in modules

--version

-v

Version number

--prefix path

-p

Specify alternative prefix path (the default is /usr)

--pid file

-g

Specify the PID file location.

--fpm-config file

-y

Specify alternative path to FastCGI process manager configuration file (the default is /etc/fpm/php8.3-fpm.conf)

--test

-t

Test FPM configuration file and exit If called twice (-tt), the configuration is dumped before exiting.

--daemonize

-D

Force to run in background and ignore daemonize option from configuration file.

--nodaemonize

-F

Force to stay in foreground and ignore daemonize option from configuration file.

--force-stderr

-O

Force output to stderr in nodaemonize even if stderr is not a TTY.

--allow-to-run-as-root

-R

Allow pool to run as root (disabled by default)

## FILES
php8.3-fpm.conf

The configuration file for the php7-fpm daemon.

php.ini

The standard php configuration file.

## EXAMPLES
For any unix systems which use init.d for their main process manager, you should use the init script provided to start and stop the php8.3-fpm daemon.

sudo /etc/init.d/php8.3-fpm start

For any unix systems which use systemd for their main process manager, you should use the unit file provided to start and stop the php8.3-fpm daemon.

sudo systemctl start php8.3-fpm.service

If your installation has no appropriate init script, launch php8.3-fpm with no arguments. It will launch as a daemon (background process) by default. The file /var/run/php8.3-fpm.pid determines whether php8.3-fpm is already up and running. Once started, php8.3-fpm then responds to several POSIX signals:

SIGINT,SIGTERM immediate termination SIGQUIT graceful stop

SIGUSR1 re-open log file

SIGUSR2 graceful reload of all workers + reload of fpm conf/binary

## TIPS
The PHP-FPM CGI daemon will work well with most popular webservers, including Apache2, lighttpd and nginx.

## SEE ALSO
The PHP-FPM website:

http://php-fpm.org

For a more or less complete description of PHP look here:

http://www.php.net/manual/

A nice introduction to PHP by Stig Bakken can be found here:

http://www.zend.com/zend/art/intro.php

## BUGS
You can view the list of known bugs or report any new bug you found at:

https://github.com/php/php-src/issues

## AUTHORS
PHP-FPM SAPI was written by Andrei Nigmatulin. The mailing-lists are highload-php-en (English) and highload-php-ru (Russian).

The PHP Group: Thies C. Arntzen, Stig Bakken, Andi Gutmans, Rasmus Lerdorf, Sam Ruby, Sascha Schumann, Zeev Suraski, Jim Winstead, Andrei Zmievski.

A List of active developers can be found here:

http://www.php.net/credits.php

And last but not least PHP was developed with the help of a huge amount of contributors all around the world.

## VERSION INFORMATION
This manpage describes php8.3-fpm, version @PHP_VERSION@.

## COPYRIGHT
Copyright © The PHP Group

Copyright (c) 2007-2009, Andrei Nigmatulin

This source file is subject to version 3.01 of the PHP license, that is bundled with this package in the file LICENSE, and is available through the world-wide-web at the following url:

https://www.php.net/license/3_01.txt

If you did not receive a copy of the PHP license and are unable to obtain it through the world-wide-web, please send a note to license@php.net so we can mail you a copy immediately.


title: php-fpm8.4.23(8)

summary: PHP FastCGI Process Manager 'PHP-FPM'

text:
# php-fpm8.4.23(8)

## NAME
php7-fpm - PHP FastCGI Process Manager 'PHP-FPM'

## SYNOPSIS
php8.4-fpm [options]

## DESCRIPTION
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. This is a variant of PHP that will run in the background as a daemon, listening for CGI requests. Output is logged to /var/log/php8.4-fpm.log.

Most options are set in the configuration file. The configuration file is /etc/php-fpm.conf. By default, php8.4-fpm will respond to CGI requests listening on localhost http port 9000. Therefore php7-fpm expects your webserver to forward all requests for '.php' files to port 9000 and you should edit your webserver configuration file appropriately.

## OPTIONS
-C

Do not chdir to the script's directory

--php-ini path|file

-c path|file

Look for php.ini file in the directory path or use the specified file

--no-php-ini

-n

No php.ini file will be used

--define foo[=bar]

-d foo[=bar]

Define INI entry foo with value bar

-e

Generate extended information for debugger/profiler

--help

-h

This help

--info

-i

PHP information and configuration

--modules

-m

Show compiled in modules

--version

-v

Version number

--prefix path

-p

Specify alternative prefix path (the default is /usr)

--pid file

-g

Specify the PID file location.

--fpm-config file

-y

Specify alternative path to FastCGI process manager configuration file (the default is /etc/fpm/php8.4-fpm.conf)

--test

-t

Test FPM configuration file and exit If called twice (-tt), the configuration is dumped before exiting.

--daemonize

-D

Force to run in background and ignore daemonize option from configuration file.

--nodaemonize

-F

Force to stay in foreground and ignore daemonize option from configuration file.

--force-stderr

-O

Force output to stderr in nodaemonize even if stderr is not a TTY.

--allow-to-run-as-root

-R

Allow pool to run as root (disabled by default)

## FILES
php8.4-fpm.conf

The configuration file for the php7-fpm daemon.

php.ini

The standard php configuration file.

## EXAMPLES
For any unix systems which use init.d for their main process manager, you should use the init script provided to start and stop the php8.4-fpm daemon.

sudo /etc/init.d/php8.4-fpm start

For any unix systems which use systemd for their main process manager, you should use the unit file provided to start and stop the php8.4-fpm daemon.

sudo systemctl start php8.4-fpm.service

If your installation has no appropriate init script, launch php8.4-fpm with no arguments. It will launch as a daemon (background process) by default. The file /var/run/php8.4-fpm.pid determines whether php8.4-fpm is already up and running. Once started, php8.4-fpm then responds to several POSIX signals:

SIGINT,SIGTERM immediate termination SIGQUIT graceful stop

SIGUSR1 re-open log file

SIGUSR2 graceful reload of all workers + reload of fpm conf/binary

## TIPS
The PHP-FPM CGI daemon will work well with most popular webservers, including Apache2, lighttpd and nginx.

## SEE ALSO
For a more or less complete description of PHP-FPM look here:

https://www.php.net/fpm

## BUGS
You can view the list of known bugs or report any new bug you found at:

https://github.com/php/php-src/issues

## AUTHORS
PHP-FPM SAPI was written by Andrei Nigmatulin. The mailing-lists are highload-php-en (English) and highload-php-ru (Russian).

The PHP Group: Thies C. Arntzen, Stig Bakken, Andi Gutmans, Rasmus Lerdorf, Sam Ruby, Sascha Schumann, Zeev Suraski, Jim Winstead, Andrei Zmievski.

A List of active developers can be found here:

https://www.php.net/credits.php

And last but not least PHP was developed with the help of a huge amount of contributors all around the world.

## VERSION INFORMATION
This manpage describes php8.4-fpm, version @PHP_VERSION@.

## COPYRIGHT
Copyright © The PHP Group

Copyright (c) 2007-2009, Andrei Nigmatulin

This source file is subject to version 3.01 of the PHP license, that is bundled with this package in the file LICENSE, and is available through the world-wide-web at the following url:

https://www.php.net/license/3_01.txt

If you did not receive a copy of the PHP license and are unable to obtain it through the world-wide-web, please send a note to license@php.net so we can mail you a copy immediately.


title: php-fpm8.5.8(8)

summary: PHP FastCGI Process Manager 'PHP-FPM'

text:
# php-fpm8.5.8(8)

## NAME
php7-fpm - PHP FastCGI Process Manager 'PHP-FPM'

## SYNOPSIS
php8.5-fpm [options]

## DESCRIPTION
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. This is a variant of PHP that will run in the background as a daemon, listening for CGI requests. Output is logged to /var/log/php8.5-fpm.log.

Most options are set in the configuration file. The configuration file is /etc/php-fpm.conf. By default, php8.5-fpm will respond to CGI requests listening on localhost http port 9000. Therefore php7-fpm expects your webserver to forward all requests for '.php' files to port 9000 and you should edit your webserver configuration file appropriately.

## OPTIONS
-C

Do not chdir to the script's directory

--php-ini path|file

-c path|file

Look for php.ini file in the directory path or use the specified file

--no-php-ini

-n

No php.ini file will be used

--define foo[=bar]

-d foo[=bar]

Define INI entry foo with value bar

-e

Generate extended information for debugger/profiler

--help

-h

This help

--info

-i

PHP information and configuration

--modules

-m

Show compiled in modules

--version

-v

Version number

--prefix path

-p

Specify alternative prefix path (the default is /usr)

--pid file

-g

Specify the PID file location.

--fpm-config file

-y

Specify alternative path to FastCGI process manager configuration file (the default is /etc/fpm/php8.5-fpm.conf)

--test

-t

Test FPM configuration file and exit If called twice (-tt), the configuration is dumped before exiting.

--daemonize

-D

Force to run in background and ignore daemonize option from configuration file.

--nodaemonize

-F

Force to stay in foreground and ignore daemonize option from configuration file.

--force-stderr

-O

Force output to stderr in nodaemonize even if stderr is not a TTY.

--allow-to-run-as-root

-R

Allow pool to run as root (disabled by default)

## FILES
php8.5-fpm.conf

The configuration file for the php7-fpm daemon.

php.ini

The standard php configuration file.

## EXAMPLES
For any unix systems which use init.d for their main process manager, you should use the init script provided to start and stop the php8.5-fpm daemon.

sudo /etc/init.d/php8.5-fpm start

For any unix systems which use systemd for their main process manager, you should use the unit file provided to start and stop the php8.5-fpm daemon.

sudo systemctl start php8.5-fpm.service

If your installation has no appropriate init script, launch php8.5-fpm with no arguments. It will launch as a daemon (background process) by default. The file /var/run/php8.5-fpm.pid determines whether php8.5-fpm is already up and running. Once started, php8.5-fpm then responds to several POSIX signals:

SIGINT,SIGTERM immediate termination SIGQUIT graceful stop

SIGUSR1 re-open log file

SIGUSR2 graceful reload of all workers + reload of fpm conf/binary

## TIPS
The PHP-FPM CGI daemon will work well with most popular webservers, including Apache2, lighttpd and nginx.

## SEE ALSO
For a more or less complete description of PHP-FPM look here:

https://www.php.net/fpm

## BUGS
You can view the list of known bugs or report any new bug you found at:

https://github.com/php/php-src/issues

## AUTHORS
PHP-FPM SAPI was written by Andrei Nigmatulin. The mailing-lists are highload-php-en (English) and highload-php-ru (Russian).

The PHP Group: Thies C. Arntzen, Stig Bakken, Andi Gutmans, Rasmus Lerdorf, Sam Ruby, Sascha Schumann, Zeev Suraski, Jim Winstead, Andrei Zmievski.

A List of active developers can be found here:

https://www.php.net/credits.php

And last but not least PHP was developed with the help of a huge amount of contributors all around the world.

## VERSION INFORMATION
This manpage describes php8.5-fpm, version @PHP_VERSION@.

## COPYRIGHT
Copyright © The PHP Group

Copyright (c) 2007-2009, Andrei Nigmatulin

This source file is subject to version 3.01 of the PHP license, that is bundled with this package in the file LICENSE, and is available through the world-wide-web at the following url:

https://www.php.net/license/3_01.txt

If you did not receive a copy of the PHP license and are unable to obtain it through the world-wide-web, please send a note to license@php.net so we can mail you a copy immediately.


identd

package: pidentd

title: identd(8)

summary: TCP/IP IDENT protocol server

text:
# identd(8)

## NAME
identd, in.identd - TCP/IP IDENT protocol server

## SYNOPSIS
[in.]identd [options]

## DESCRIPTION
Identd is a server which implements the TCP/IP proposed standard IDENT user identification protocol as specified in the RFC 1413 document.

identd operates by looking up specific TCP/IP connections and returning the user name of the process owning the connection. It can optionally return other information instead of a user name.

## OPTIONS
-h

Display the available command line options.

-V

Displays the version and OS version it was compiled for, and then exit.

-d

Enables extra debugging messages.

-C<file>

Directs identd to parse additional configuration options from the file specified.

-i

May be used when starting the daemon by inetd with the "nowait" option (see below).

-w

May be used when starting the daemon by inetd with the "wait" option (see below).

-I

May be used when the daemon is started by init (see below).

-b

flag may be used to make the daemon run in standalone mode (see below).

-u<user>

Used to specify a user number or name to which the server should switch to after binding itself to the TCP/IP port and opening the kernel devices.

-g<group>

Used to specify a group number or name which the server should switch to after binding itself to the TCP/IP port and opening the kernel devices.

-p<port>

Used to specify an alternative TCP port to bind to, if running as a standalone daemon or started by init Can be specified by name or by number. Defaults to the IDENT port (113).

-t<limit>

Used to specify the request timeout limit. This is the maximum number of seconds a server will allow a client connection to be active before terminating it. It defaults to 120 seconds.

-P<pidfile>

Specify the location of a file to store the process number of the Identd daemon.

-K<nthreads>

Control the number of threads to use for kernel lookups

-L<facility>

Set the syslog facility to use instead of 'daemon'.

-o

Directs identd to return OTHER instead of UNIX as the "operating system".

-E

Enables DES encryption of the returned data (see below for more information).

-n

Directs identd to always return user numbers instead of user names (for example if you wish to keep the user names a secret).

-N

Directs identd to check for a file ".noident" in each home directory for the user which the daemon is about to return the user name for. It that file exists then the daemon will give the error HIDDEN-USER instead of the normal USERID response.

-e

Enables certain non-standard protocol extensions. Currently defined extensions include the requests VERSION to return the Ident daemon version and QUIT to terminate a session (useful in conjunction with the -m option).

-m

Enables identd to use a mode of operation that will allow multiple requests to be processed per session. Each request is specified one per line and the responses will be returned one per line. The connection will not be closed until the connecting part closes it's end of the line.

## INSTALLATION
The prefered way to start identd depends on how it was built.

If it was built with support for multithreading then it should be started either from init , as a standalone daemon or from inetd using the "wait" mode (if your inetd supports it!)

If it was built without support for multithreading then it should be started from inetd using the normal "nowait" mode for "stream tcp" services. (The main reason being that it will be single-threaded, so it will only serve one client connection at a time).

identd normally will autodetect how it was invoked so there normally is no need to use the four command line switches (-i, -w, -I, -b).

## ENCRYPTION
DES encryption is only available if the daemon was built with support for it enabled.

An encryption key (1024 bytes long) should be stored in the key file ( /etc/identd.key ) and it should be generated using a cryptographically safe random generator in order to be really safe. It should not contain any NUL (0x00) characters since this is used as a string to generate the real binary DES key.

This file may contain multiple 1024 byte long keys, and the server will use the last key stored in that file.

The returned token will contain the local and remote IP addresses and TCP port numbers, the local user's uid number, a timestamp, a random number, and a checksum - all encrypted using DES. The encrypted binary information is then encoded in a BASE64 string (32 characters long) and enclosed in square brackets to produce a token that is transmitted to the remote client.

The encrypted token can later be decrypted by the idecrypt command. This program will attempt to decrypt a token with all the keys stored in the key file until it succeeds (or have tried all the keys).

## CONFIGURATION FILE
The configuration file contains a list of option=value pairs.

syslog:facility = FACILITY

Set which facility to use when sending syslog messages.

server:user = USER

Set what user (and group, from the passwd database) the daemon should run as after it has opened all the kernel handles. (Default: nobody)

server:group = GROUP

Override the group id (as set by the server:user option).

server:port = PORT

Set what TCP/IP port the daemon should listen to. (Default: 113)

server:backlog = LIMIT

Set the size of the server listen() backlog limit.

server:pid-file = PATH

Set the path to the file where the server will store it's process id.

server:max-request = LIMIT

Max number of concurrent requests allowed. Default is 0 (zero) which means "no limit".

protocol:extensions = ON/OFF

Enable/disable the nonstandard protocol extensions ( VERSION and QUIT currently). Default: off

protocol:multiquery = ON/OFF

Enable/disable the multiple queries per connection feature. Default: off

protocol:timeout = SECONDS

Max number of seconds since connection or last request. If set to 0 (zero), no timeout will be used. Default: 120 seconds.

kernel:threads = LIMIT

Max number of threads doing kernel lookups concurrently. Default: 8

kernel:buffers = LIMIT

Max number of queued kernel lookup requests. Default: 32

kernel:attempts = LIMIT

Max number of times to retry a kernel lookup in case of failure. Default: 5

result:uid-only = YES/NO

Disable uid->username lookups (only return uid numbers). Default: no

result:noident = ON/OFF

Enable/disable checking for the ".noident" file in users home directories.

result:charset = CHARSET

Define the character set returned in replies. Default: "US-ASCII"

result:opsys = OPSYS

Define the operating system returned in replies. Default: "UNIX"

result:syslog-level = LEVEL

If set to anything other than "none", all request replies till be sent to the syslog service with the specificed severity level. Default: none

result:encrypt = YES/NO

Enable encryption of replies. Only available if Identd was built with a DES encryption library.

encrypt:key-file = PATH

Path to the file containing the encryption keys.

include = PATH

Include (and parse) the contents of another configuration file.

## NOTES
The username (or UID) returned ought to be the login name. However it (probably, for most architecture implementations) is the "real user ID" as stored with the process. Thus the UID returned may be different from the login name for setuid programs (or those running as root) which has done a setuid(3) call and their children. For example, it may (should?) be wrong for an incoming ftpd ; and we are probably interested in the running shell, not the telnetd for an incoming telnet session. (But of course identd returns info for outgoing connections, not incoming ones.)

## FILES
/etc/identd.conf

Contains the default configuration options for identd.

/etc/identd.pid

Contains (if enabled) the process number of the identd daemon.

/etc/identd.key

If compiled with DES encryption enabled, the 1024 first bytes of this file is used to specify the secret key for encrypting replies.

## AVAILABILITY
The daemon is free software. You can redistribute it and/or modify it as you wish - as long as you don't claim that you wrote it.

The source code for the latest version of the daemon can always be FTP'd from one of the following addresses:

Main site:

ftp://ftp.lysator.liu.se/pub/ident/servers/

Mirror:

ftp://ftp.uu.net/networking/ident/servers/

The author can be contacted at:

Email:

Peter Eriksson <pen@lysator.liu.se>

## SEE ALSO
idecrypt(8) , ikeygen(8) , authuser(3) , inetd.conf(5) ,


pks-intro

package: pks

title: pks-intro(8)

summary: OpenPGP Public Key Server Introduction

text:
# pks-intro(8)

## NAME
pks-intro - OpenPGP Public Key Server Introduction

## DESCRIPTION
The OpenPGP Public Key Server system is a set of programs which manages and provides general access to a database of OpenPGP public keys.

The database itself is not a standard OpenPGP keyring. Instead, the keys which are managed by the server are stored in a set of Berkeley DB 2.x format database files. Most operations only take a fraction of a second, and even large operations involving tens of thousands of keys usually take only a few minutes.

### Programs
pksclient(8)

This is a command-line program for managing the database. It supports All the operations of the daemon, and a few more.

pksd(8)

This is the public key server daemon. It processes HTTP requests and mail requests to add keys to the database and query the database contents.

pksdctl(8)

This is a helper program used by pksd-mail.sh and pksd-queue-run.sh.

pks-mail.sh

This script is run for each mail message received to queue the message.

pks-queue-run.sh

This script is used to process the queue of incoming mail messages.

### Configuration files and data files
pksd.conf(5)

This file contains all the configuration data needed to run the system.

<db_dir>/keydbXXX

These files contain the actual database. The first files contain the OpenPGP key information, indexed by the key ID. The XXX is 000, 001, 002, up to the number of key database files minus 1.

<db_dir>/num_keydb

This file contains the number of key database files. In order to handle very large databases on operating systems with limited file sizes, the key database can be split into up to 1000 separate files.

<db_dir>/timedb

This file indexes the key ID's by the time they were added to the database.

<db_dir>/worddb

This file indexes the key ID's by the words in the key's user ID's.

## SEARCHING
The search engine is not the same as that used by the gpg(1) or pgp(1) programs. It will return information for all keys which contain all the words in the search string. A ``word'' in this context is a string of consecutive alphabetic characters. For example, in the string user@example.com, the words are user, example, and com.

## DATABASE ADMINISTRATION
pksd uses the locking, logging, and transaction facilities of Berkeley DB. This provides for added safety in the event of a server crash, and also allows for multiple pksd and/or pksclient processes to access the database at the same time.

This does make management of a key server a little more complicated. The Berkeley DB reference section on Berkeley DB Transactional Access Methods Applications

```
<http://www.sleepycat.com/docs/ref/toc.html#transapp>
```

describes the procedures and commands which are used for checkpointing, archive (backup), and recovery. You should familiarize yourself with this information before running a key server.

## DESIGN
The key server was Marc Horowitz's Advanced Undergraduate Project (which is really a thesis, but with a different name) for his Bachelor's degree in Computer Science and Engineering at the Massachusetts Institute of Technology. You can read detailed discussion of the internals of this key server, you can read the his AUP at

```
<http://www.mit.edu/people/marc/pks/thesis.html>.
```

## FILES
pksd.conf, <db_dir>/keydbXXX, <db_dir>/num_keydb, <db_dir>/timedb, <db_dir>/worddb

## AUTHOR
Marc Horowitz, Massachusetts Institute of Technology

## BUGS
Visit the bug tracking system linked from http://sourceforge.net/projects/pks to view or report bugs.

## COPYRIGHT
Copyright (c) 1996, 1997, 1998, 1999, Marc Horowitz. All rights reserved.

This software doesn't have a warranty, express or implied. See the LICENSE file in the source distribution for full conditions.

## SEE ALSO
gpg(1), pgp(1), pksclient(8), pksd(8), pksd.conf(5), pksdctl(8),pks-mail.sh(8), pks-queue-run(8)


pksclient

title: pksclient(8)

summary: Public Key Server Client

text:
# pksclient(8)

## NAME
pksclient - Public Key Server Client

## SYNOPSIS
pksclient /db/path cmd [args ...]

## DESCRIPTION
pksclient is a command line interface which allows the administrator to perform key server operations directly instead of through the daemon. The software will use locking and transaction semantics unless you specify otherwise. Never do this if another process has the database open. Once the command is completed, pksclient will attempt to checkpoint the database and remove any excess log files.

Each command takes the path to the directory which contains the database files, a command name, and possibly a list of arguments to the command. Some commands take an optional flags argument. Flags are single letters as described for each command, concatenated into a single argument.

pksclient /db/path create [num_files]

Create an empty database. If a database exists in the directory, it is destroyed. If num_files is specified, then the key database will be split into that many files. If it is not specified, then three key database files will be created.

pksclient /db/path recover

Recover an inconsistent database. This is equivalent to the db_recover(8) command, but it uses a larger cache for better performance.

pksclient /db/path add filename [flags]

Add a keyring to the database. The filename may refer to a keyring file (.pgp format), or an ASCII-armored keyring (.asc format). If the 'n' flag is specified, then an incremental for the new keyring relative to the database is generated to stdout. If the 'd' flag is specified, then the disabled flag will not be stripped from the input file. This is useful if you are initializing the database for the first time with a keyring from another key server which includes disabled keys. If the 't' flag is specified, the operation will take place without logging and transactions. This is faster, but less safe.

pksclient /db/path get userid [flags]

An ASCII-armored keyring containing all the keys matching the userid is printed to stdout. If the 'e' flag is specified, then the key's user id must be an exact case-insensitive substring of the userid argument. If the 'a' flag is specified, then the userid argument is ignored, and all keys in the database are returned. If the 'b' flag is specified, then the output keyring will be in binary format instead of ASCII-armor format. If the 'i' flag is specified, then errors will be ignored. This is used when recovering from a corrupt database. If the 'd' flag is specified, then disabled keys will be returned. If the 's' flag is specified, the selected keys will be output unsorted to stdout. This flag implies the 'b' flag. If the 't' flag is specified, the operation will take place without logging and transactions. This is faster, but less safe.

pksclient /db/path index userid [flags]

An index listing for all the keys matching the userid is printed to stdout. If the 'v' flag is specified, then signatures are included in the output. If the 'f' flag is specified, then the key fingerprint is included in the output. If the 'e' flag is specified, then the key's user id must be an exact case-insensitive substring of the userid argument. If the 'a' flag is specified, then the userid argument is ignored, and all keys in the database are indexed. If the 'i' flag is specified, then errors will be ignored. This is used when recovering from a corrupt database. If the 'd' flag is specified, then disabled keys will be returned. If the 's' flag is specified, the index will be output unsorted to stdout. If the 't' flag is specified, the operation will take place without logging and transactions. This is faster, but less safe.

pksclient /db/path since time [flags]

An ASCII-armored keyring containing all the keys added to the database or changed since the unix timestamp since is printed to stdout. The timestamp that the database was last modified is printed to stderr. If the 'b' flag is specified, then the output keyring will be in binary format instead of ASCII-armor format. If the 'r' flag is specified, then the time given is taken as the number of seconds the in the past the dump should start ( since 86400 r is thus equivalent to the LAST 1 mail command). If the 't' flag is specified, the operation will take place without logging and transactions. This is faster, but less safe.

pksclient /db/path delete userid [flags]

All keys matching the userid are deleted from the database. If the 't' flag is specified, the operation will take place without logging and transactions. This is faster, but less safe.

pksclient /db/path disable userid [flags]

All keys matching the userid have the disabled flag set. If the 'c' flag is specified, then the flag is cleared instead of set. If the 't' flag is specified, the operation will take place without logging and transactions. This is faster, but less safe.

## SEE ALSO
pks-intro(8), pksd(8)

## AUTHOR
Marc Horowitz, Massachusetts Institute of Technology


pksd

title: pksd(8)

summary: OpenPGP Public Key Server Daemon

text:
# pksd(8)

## NAME
pksd - OpenPGP Public Key Server Daemon

## SYNOPSIS
pksd FILE

## DESCRIPTION
pksd is a daemon which implements the functions of an OpenPGP public key server. It supports key searches, requests, additions, and modifications via web and e-mail interfaces.

The server takes a single argument, which is the name of the configuration file. The format of this file is documented in pksd.conf(5).

The server supports queries via a modified version of HTTP known as HKP (which allows for queries via web browsers), MRHKP (the machine-readable HKP format), and an e-mail interface. HKP is implemented by a few form URI's which are described in the accompanying design document. MRHKP has its own design document. The e-mail interface is described in the pks_help documents.

In order to control the running daemon, the pksdctl(8) program is used to send messages to the running server via a unix domain socket. The type and syntax of these messages is documented in the pksdctl(8) man page.

## INCREMENTAL MESSAGES
The mail server is also used for incremental distribution of modifications between peer key servers. When a key server receives an update (meaning new keys, signatures, revocations, etc.), this update is forwarded to the servers listed as peers (with the syncsite keyword) in the pksd.conf(5) file. In order to avoid updates looping forever, the servers which have processed the update are listed in the message.

To improve performance, when an incremental or add is received, only the part(s) of that request which are not already part of the key server database are included. If an incremental or add contains no new data, no incremental is generated at all.

## DISABLED KEYS
It is not useful to remove a key from the key server database. Keys in use will likely be sent to a key server again. Keys not in use are best left on the key server for archival purposes. In the future, someone might need to verify a signature from such a key, for example. In order to remove a key from circulation for whatever reason, the key can be made "disabled". This server uses the disabled flag in the OpenPGP file format. To prevent this flag from being misused, the disabled flag is treated as a special case. When a keyring is merged into the database, the disabled flags are ignored. Disabled keys in the database cannot be retrieved from the database, but they are returned by searches.

## FILES
pksd.conf

## AUTHOR
Marc Horowitz, Massachusetts Institute of Technology

## BUGS
Visit the bug tracking system linked from http://sourceforge.net/projects/pks to view or report bugs.

## COPYRIGHT
Copyright (c) 1996, 1997, 1998, 1999, Marc Horowitz. All rights reserved.

This software doesn't have a warranty, express or implied. See the LICENSE file in the source distribution for full conditions.

## SEE ALSO
pksclient(8), pksd.conf(5), pksdctl(8), pks-intro(8)


pksdctl

title: pksdctl(8)

summary: Public Key Server Control program

text:
# pksdctl(8)

## NAME
pksdctl - Public Key Server Control program

## SYNOPSIS
pksdctl socket string

## DESCRIPTION
pksdctl sends strings to a running pksd via a UNIX domain socket. The strings (which must be a single argument in the shell) are interpreted by the running pksd process as commands. Three string forms are supported:

backup

The backup command from previous versions is no longer supported. The procedures referred to in pks-intro(8) should be followed to make a backup.

disable userid

All keys matching the userid will have the disabled flag set.

mail msg

The file msg will be parsed as a mail server request. If the file is a valid request, the request succeeds, and the response can be enqueued, then the file is removed.

shutdown

The key server shuts down cleanly and exits.

## AUTHOR
Marc Horowitz, Massachusetts Institute of Technology

## BUGS
Visit the bug tracking system linked from http://sourceforge.net/projects/pks to view or report bugs.

## COPYRIGHT
Copyright (c) 1996, 1997, 1998, 1999, Marc Horowitz. All rights reserved.

This software doesn't have a warranty, express or implied. See the LICENSE file in the source distribution for full conditions.

## SEE ALSO
pksd(8), pks-intro(8)


plymouth

package: plymouth

title: plymouth(8)

summary: A graphical boot system and logger

text:
# plymouth(8)

## NAME
plymouth - A graphical boot system and logger

## DESCRIPTION
plymouth is a graphical boot system for Linux which takes advantage of the kernel-based mode setting (KMS) available for modern graphic cards to provide a seamless, flickerfree and attractive boot screen. It allows to choose between various, static or animated graphical themes to spruce up the startup and avoid the noise generated by the vast amount of kernel messages while the machine boots into X. On systems where kernel-based mode setting is not available, plymouth falls back to a text mode boot screen which provides a simple progress bar to pro‐ vide feedback during boot.

In order for the configured default plymouth theme to be loaded during boot, the option `splash' (or `rhgb' for backward compatibility with the RHGB boot splash) must be provided at the kernel command line. Without this command line option, plymouth will default to showing detailed boot output.

During the boot process, the user can switch between the graphical theme and the detailed boot output using the Escape key.

## SEE ALSO
grub(8), plymouth-set-default-theme(1), plymouthd(8), plymouth(1), http://www.freedesktop.org/wiki/Software/Plymouth

## AUTHORS
plymouth was originally prototyped and named by Kristian Høgsberg, originally written by Ray Strode and has had significant contributions from Charlie Brej. It has also had contributions from Peter Jones, Adam Jackson, Frederic Crozat and others.


plymouthd

title: plymouthd(8)

summary: The plymouth daemon

text:
# plymouthd(8)

## NAME
plymouthd - The plymouth daemon

## SYNOPSIS
plymouthd [OPTION...]

## DESCRIPTION
The plymouthd daemon is usually run out of the initrd. It does the heavy lifting of the plymouth system, logging the session and showing the splash screen.

The plymouth is used to send commands to plymouthd that control its behaviour.

## OPTIONS
The following options are understood:

--help

Show summary of options.

--attach-to-session

Redirect console messages from screen to log.

--no-daemon

Do not daemonize.

--debug

Output debugging information.

--debug-file=STRING

File to write debugging information to.

--mode=MODE

Set mode to either boot or shutdown.

--pid-file=STRING

Write the PID of the daemon to a file.

--kernel-command-line=STRING

Fake kernel commandline to use.

--tty=STRING

TTY to use instead of default.

## SEE ALSO
grub(8), plymouth(8), plymouth(1), http://www.freedesktop.org/wiki/Software/Plymouth


pm-action

package: pm-utils

title: pm-action(8)

summary: Suspend or Hibernate your computer

text:
# pm-action(8)

## NAME
pm-action - Suspend or Hibernate your computer

## SYNOPSIS
pm-hibernate [--help]

pm-suspend [--quirk-*] [--help]

pm-suspend-hybrid [--quirk-*] [--help]

## DESCRIPTION
This manual page documents briefly the pm-action, pm-hibernate, pm-suspend and pm-suspend-hybrid commands. This manual page was originally written for the Debian(TM) distribution and has been adopted by the pm-utils project.

These commands can be used to put the machine in a sleep state. The precise way how this is done can be influenced by installing executables and configuration snippets. For some options external programs are needed.

These commands will usually be called by UPower or hald when triggered to do so by a program in a desktop session such as gnome-power-manager. Calling them from the command line is also possible, but it is not guaranteed that all programs in your desktop session keep working as expected.

pm-suspend

During suspend most devices are shutdown, and system state is saved in RAM. The system still requires power in this state. Most modern systems require 3 to 5 seconds to enter and leave suspend, and most laptops can stay in suspend mode for 1 to 3 days before exhausting their battery.

pm-hibernate

During hibernate the system is fully powered off, and system state is saved to disk. The system does not require power, and can stay in hibernate mode indefinitely. Most modern systems require 15 to 45 seconds to enter and leave hibernate, and entering and leaving hibernate takes longer when you have more memory.

pm-suspend-hybrid

Hybrid-suspend is the process where the system does everything it needs to hibernate, but suspends instead of shutting down. This means that your computer can wake up quicker than for normal hibernation if you do not run out of power, and you can resume even if you run out of power. s2both(8) is an hybrid-suspend implementation.

## OPTIONS
On some hardware putting the video card in the suspend state and recovering from it needs some special quirk handling. With the --quirk-* options of the pm-suspend and pm-suspend-hybrid commands you can select which quirks should be used.

If pm-suspend, pm-hibernate, or pm-suspend-hybrid are invoked without any commandline parameters, they will try to grab the correct quirks from the internal quirk database.

--quirk-dpms-on

This option forces the video hardware to turn on the screen during resume. Most video adapters turn on the screen themselves, but if you get a blank screen on resume that can be turned back on by moving the mouse or typing then this option may be useful.

--quirk-dpms-suspend

This option forces the video hardware to turn off the screen when suspending. Most video adapters seem to do this correctly, but some do not, which wastes lots of power. If your screen is still on after successfully suspending you may need to use this option.

--quirk-radeon-off

This option forces Radeon hardware to turn off the display during suspend and turn it back on during resume. You only need to do this on some old ThinkPads of the '30 series (T30, X31, R32,... ) with Radeon video hardware.

--quirk-s3-bios

This option calls the video BIOS during S3 resume. Unfortunately, it is not always allowed to call the video BIOS at this point, so sometimes adding this option can actually break resume on some systems.

--quirk-s3-mode

This option initializes the video card into a VGA text mode, and then uses the BIOS to set the video mode. On some systems S3 BIOS only initializes the video BIOS to text mode, and so both S3 BIOS and S3 MODE are needed.

--quirk-vbe-post

This option will attempt to reinitialize the video card when resuming from suspend, using the same code the system BIOS uses at boot in order to initialize the video hardware. Not all video cards need this, and using this option on systems where it is not needed can cause a system to lock up when resuming.

--quirk-vbemode-restore

This option will save and restore the current VESA mode which may be necessary to avoid X screen corruption. Using this feature on Intel graphics hardware is probably a bad idea.

--quirk-vbestate-restore

This option saves and restores some low level hardware state which may be invalid after suspend.

--quirk-vga-mode-3

This option will try to force the video card into a standard text mode on resume.

--quirk-save-pci

Save the PCI config space for the VGA card.

--store-quirks-as-lkw

Save the quirks the video adaptor required by pm-suspend or pm-suspend-hybrid as an .quirkdb file that is specific to this system. The file will be saved in /etc/pm/last_known_working.quirkdb. This parameter will only save the actual quirks that were used to successfully suspend/resume a system, and will be specific to the exact configuration of that system, including the video hardware, video driver, and whether or not kernel modesetting was used.

## FILES
/etc/pm/config.d

The files in this directory are evaluated in C sort order. These files can be provided by individual packages outside of pm-utils. If a global configuration variable is set, the value set to will be appended to the previous value. If any other variable is set, it will be ignored. The syntax is simply: VAR_NAME=value. See the CONFIGURATION VARIABLES section for valid variables defined by pm-utils. External packages can define others, see their respective documentation for more information.

/etc/pm/sleep.d, /usr/lib/pm-utils/sleep.d

Programs in these directories (called hooks) are combined and executed in C sort order before suspend and hibernate with as argument 'suspend' or 'hibernate'. Afterwards they are called in reverse order with argument 'resume' and 'thaw' respectively. If both directories contain a similar named file, the one in /etc/pm/sleep.d will get preference. It is possible to disable a hook in the distribution directory by putting a non-executable file in /etc/pm/sleep.d, or by adding it to the HOOK_BLACKLIST configuration variable.

/var/log/pm-suspend.log

The log file shows what was done on the last suspend/hibernate and resume/thaw.

## SLEEP HOOK ORDERING CONVENTION
00 - 49

User and most package supplied hooks. If a hook assumes that all of the usual services and userspace infrastructure is still running, it should be here.

50 - 74

Service handling hooks. Hooks that start or stop a service belong in this range. At or before 50, hooks can assume that all services are still enabled.

75 - 89

Module and non-core hardware handling. If a hook needs to load/unload a module, or if it needs to place non-video hardware that would otherwise break suspend or hibernate into a safe state, it belongs in this range. At or before 75, hooks can assume all modules are still loaded.

90 - 99

Reserved for critical suspend hooks.

## CONFIGURATION VARIABLES
Configuration variables defined by pm-utils. These can be set in any file in /etc/pm/config.d/.

SLEEP_MODULE [=kernel]

The default suspend backend to use. Valid values are: kernel

The built-in kernel suspend/resume support. Use this if nothing else is supported on your system. The kernel backend is always used if nothing else is available.

uswsusp

If your system has support for the userspace suspend programs (s2ram/s2disk/s2both), then use this.

tuxonice

If your system has support for tuxonice/suspend2, use this.

HIBERNATE_RESUME_POST_VIDEO [=no]

If video should be posted after hibernate, just like after suspend. You should not normally need to set this.

SUSPEND_MODULES

Space separated list of modules to unload before suspend.

HOOK_BLACKLIST

Space separated list of hooks that should be disabled.

HIBERNATE_MODE

Default method to power down the system when hibernating. If not set, the system will use the kernel default as a default value. Check /sys/power/disk for valid values. The default value will be surrounded by [square brackets].

NEED_CLOCK_SYNC

If your system clock drifts across a suspend/resume or hibernate/thaw cycle, you should set this to true. This will cause pm-utils to synchronize the system clock whenever going through a sleep/wake cycle at the expense of making suspend/resume take longer.

PM_HIBERNATE_DELAY [=900]

If you are using kernel suspend/resume and invoke pm-suspend-hybrid, this environment variable controls how many seconds the system will wait after going into suspend before waking back up and hibernating. By default, this is set to 900 seconds (15 minutes).

## RETURN VALUES
Return values less than 128 mean that pm-action failed before trying to put the system in the requested power saving state. A return value of 128 means that pm-action tried to put the machine in the requested power state but failed. A return value greater than 128 means pm-action encountered an error and also failed to enter the requested power saving state.

## DEBUGGING
Debugging suspend/resume can be a tricky process, and is covered in more detail in /usr/share/doc/pm-utils/README.debugging.

## BUGS
The upstream BTS can be found at https://bugs.freedesktop.org/. Select 'pm-utils' as product.

## SEE ALSO
s2ram(8), s2disk(8), s2both(8), pm-is-supported(1), pm-powersave(8), vbetool(8), radeontool(8)

## AUTHOR
Tim Dijkstra <tim@famdijkstra.org>

Manpage author.

## COPYRIGHT
Copyright © 2007 Tim Dijkstra

This manual page was originally written for the Debian(TM) system, and has been adopted by the pm-utils project.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or (at your option) any later version published by the Free Software Foundation.


pm-pmu

title: pm-pmu(8)

summary: suspend the computer on machines using a Macintosh\-style PMU

text:
# pm-pmu(8)

## NAME
pm-pmu - suspend the computer on machines using a Macintosh-style PMU

## SYNOPSIS
pm-pmu

## DESCRIPTION
This manual page documents briefly the pm-pmu command.

pm-pmu is a command line program to suspend a computer on machines using a Macintosh-style PMU

## EXIT CODES
The command succeeds (status 0) if the machine uses a Macintosh-style PMU, and suspended successfully. The command fails (status other than 0) otherwise. It is designed to be easy to use in shell scripts.

0 (true)

System was suspended using PMU.

1 (false)

System could not be suspended using PMU.

## OPTIONS
This program follows the usual GNU command line syntax, with long options starting with two dashes (`-'). A summary of options is included below.

--suspend

Suspend the computer.

--help

Show help message.

## SEE ALSO
pm-suspend(8)

## AUTHOR
This manual page was written by Richard Hughes <richard@hughsie.com>.

## AUTHOR
Richard Hughes

Author.

## COPYRIGHT
Copyright © 2006 Richard Hughes


pm-powersave

title: pm-powersave(8)

summary: Put your computer into low power mode

text:
# pm-powersave(8)

## NAME
pm-powersave - Put your computer into low power mode

## SYNOPSIS
pm-powersave [{true | false}]

## DESCRIPTION
This manual page documents briefly the pm-powersave command.

pm-powersave can be used to set your system into low power mode.

## OPTIONS
true

Put the computer into low power mode to reduce energy consumption and extend your laptop's battery life.

false

Turn off low power mode.

## FILES
/etc/pm/power.d/, /usr/lib/pm-utils/power.d/

When you run pm-powersave it combines the scripts in these two directories and executes them in sorted order. If both directories contain a script with the same name, the one in /etc/pm/power.d/ has a higher precedence and only this one will be executed. Therefore to disable a script from /usr/lib/pm-utils/power.d/ simply create an empty file in /etc/pm/power.d/ with the same name and without the executable bit set.

## SEE ALSO
pm-suspend(8), pm-hibernate(8)

## AUTHOR
Michael Biebl <biebl@debian.org>

Manpage author.

## COPYRIGHT
Copyright © 2007 Michael Biebl

This manual page was originally written for the Debian(TM) system, and has been adopted by the pm-utils project.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or (at your option) any later version published by the Free Software Foundation.


chcat

package: policycoreutils

title: chcat(8)

text:
# chcat(8)

## NAME
chcat - change SELinux security categories of files/users

## SYNOPSIS
chcat category file...

chcat -l category user...

chcat [[+|-]category...] file...

chcat -l [[+|-]category...] user...

chcat [-d] file...

chcat -l [-d] user...

chcat -L [ -l ] [ user ... ]

## DESCRIPTION
Use +/- to add/remove categories from a file or user (only a single category can be specified at a time). Or specify the desired list/range of categories to be applied (replacing the existing categories).

Note: When removing a category you must specify '--' on the command line before using the -Category syntax. This tells the command that you have finished entering options and are now specifying a category name instead.

-d

delete all categories from given FILE/USER.

-L

list available categories.

-l

Tells chcat to operate on users instead of files.

## EXAMPLE

```
Replace categories of user "test" with c0.c6
# chcat -l c0.c6 test
Add category c1023 to user "test"
# chcat -l +c1023 test
Remove category c5 from file "file"
# chcat -- -c5 file
Remove all categories from file "file"
# chcat -d file
```

## SEE ALSO
chcon(1), selinux(8), semanage(8)

When operating on files this script wraps the chcon command.

## FILES
/etc/selinux/{SELINUXTYPE}/setrans.conf

/etc/selinux/{SELINUXTYPE}/seusers


fixfiles

title: fixfiles(8)

summary: fix file SELinux security contexts.

text:
# fixfiles(8)

## NAME
fixfiles - fix file SELinux security contexts.

## SYNOPSIS
fixfiles [-v] [-F] [-M] [-f] [-T nthreads] relabel

fixfiles [-v] [-F] [-T nthreads] { check | restore | verify } dir/file ...

fixfiles [-v] [-F] [-B | -N time ] [-T nthreads] { check | restore | verify }

fixfiles [-v] [-F] [-T nthreads] -R rpmpackagename[,rpmpackagename...] { check | restore | verify }

fixfiles [-v] [-F] [-T nthreads] -C PREVIOUS_FILECONTEXT { check | restore | verify }

fixfiles [-F] [-M] [-B] [-T nthreads] onboot

## DESCRIPTION
This manual page describes the fixfiles script.

This script is primarily used to correct the security context database (extended attributes) on filesystems.

It can also be run at any time to relabel when adding support for new policy, or just check whether the file contexts are all as you expect. By default it will relabel all mounted ext2, ext3, ext4, gfs2, xfs, jfs and btrfs file systems as long as they do not have a security context mount option. You can use the -R flag to use rpmpackages as an alternative. The file /etc/selinux/fixfiles_exclude_dirs can contain a list of directories excluded from relabeling.

fixfiles onboot will setup the machine to relabel on the next reboot.

## OPTIONS
-B

If specified with onboot, this fixfiles will record the current date in the /.autorelabel file, so that it can be used later to speed up labeling. If used with restore, the restore will only affect files that were modified today.

-F

Force reset of context to match file_context for customizable files

-f

Clear /tmp directory with out prompt for removal.

-R rpmpackagename[,rpmpackagename...]

Use the rpm database to discover all files within the specified packages and restore the file contexts.

-C PREVIOUS_FILECONTEXT

Run a diff on the PREVIOUS_FILECONTEXT file to the currently installed one, and restore the context of all affected files.

-N time

Only act on files created after the specified date. Date must be specified in "YYYY-MM-DD HH:MM" format. Date field will be passed to find --newermt command.

-M

Bind mount filesystems before relabeling them, this allows fixing the context of files or directories that have been mounted over.

-v

Modify verbosity from progress to verbose. (Run restorecon with -v instead of -p)

-T nthreads

Use parallel relabeling, see setfiles(8)

## ARGUMENTS
One of:

check | verify

print any incorrect file context labels, showing old and new context, but do not change them.

restore

change any incorrect file context labels.

relabel

Prompt for removal of contents of /tmp directory and then change any incorrect file context labels to match the install file_contexts file.

[[dir/file] ... ]

List of files or directories trees that you wish to check file context on.

## EXAMPLE

```
Relabel the whole filesystem, except paths listed in /etc/selinux/fixfiles_exclude_dirs
# fixfiles relabel
Schedule the machine to relabel on the next boot and force relabeling of customizable types
# fixfiles -F onboot
Check labeling of all files from the samba package (while not changing any labels)
# fixfiles -R samba check
```

## AUTHOR
This man page was written by Richard Hally <rhally@mindspring.com>. The script was written by Dan Walsh <dwalsh@redhat.com>

## SEE ALSO
setfiles(8), restorecon(8)


genhomedircon

title: genhomedircon(8)

text:
# genhomedircon(8)

## NAME
genhomedircon - generate SELinux file context configuration entries for user home directories

## DESCRIPTION
genhomedircon is a script that executes semodule to rebuild the currently active SELinux policy (without reloading it) and to create the labels for each user home directory based on directory paths returned by calls to getpwent().

The latter functionality depends on the "usepasswd" parameter being set to "true" (default) in /etc/selinux/semanage.conf.

This script is usually executed by semanage although this default behavior can be optionally modified by setting to "true" the "disable-genhomedircon" in /etc/selinux/semanage.conf.

Directories can be excluded from the list of home directories by the setting "ignoredirs" in /etc/selinux/semanage.conf.

## AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>

## SEE ALSO
semanage.conf(5), semodule(8), semanage(8), getpwent(3), getpwent_r(3)


title: load_policy(8)

text:
# load_policy(8)

## NAME
load_policy - load a new SELinux policy into the kernel

## SYNOPSIS
load_policy [-qi]

## DESCRIPTION
load_policy loads the installed policy file into the kernel. The existing policy boolean values are automatically preserved across policy reloads rather than being reset to the default values in the policy file.

## OPTIONS
-q

suppress warning messages.

-i

initial policy load. Only use this if this is the first time policy is being loaded since boot (usually called from initramfs).

## EXIT STATUS
0

Success

1

Invalid option

2

Policy load failed

3

Initial policy load failed and enforcing mode requested

## SEE ALSO
booleans(8)

## AUTHORS

```
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
The program was written by Stephen Smalley <stephen.smalley.work@gmail.com>.
```


title: open_init_pty(8)

summary: run an program under a pseudo terminal

text:
# open_init_pty(8)

## NAME
open_init_pty - run an program under a pseudo terminal

## SYNOPSIS
open_init_pty SCRIPT [[ARGS]...]

## DESCRIPTION
Run a program under a pseudo terminal. This is used by run_init to run actually run the program after setting up the proper context. This program acquires a new Pseudo terminal, forks a child process that binds to the pseudo terminal, and then sits around and connects the physical terminal it was invoked upon with the pseudo terminal, passing keyboard input into to the child process, and passing the output of the child process to the physical terminal.

It sets up the pseudo terminal properly based on the physical terminal attributes, and then sets the user's terminal to RAW mode, taking care to reset it on exit.

## AUTHOR
This manual page was written by Manoj Srivastava <srivasta@debian.org>, for the Debian GNU/Linux system.


restorecon

title: restorecon(8)

text:
# restorecon(8)

## NAME
restorecon - restore file(s) default SELinux security contexts.

## SYNOPSIS
restorecon [-r|-R] [-m] [-n] [-p] [-v] [-i] [-F] [-W] [-I|-D] [-x] [-e directory] pathname ...

restorecon [-f infilename] [-e directory] [-r|-R] [-m] [-n] [-p] [-v] [-i] [-F] [-W] [-I|-D] [-x] [-T nthreads]

## DESCRIPTION
This manual page describes the restorecon program.

This program is primarily used to set the security context (extended attributes) on one or more files.

It can also be run at any other time to correct inconsistent labels, to add support for newly-installed policy or, by using the -n option, to passively check whether the file contexts are all set as specified by the active policy (default behavior).

If a file object does not have a context, restorecon will write the default context to the file object's extended attributes. If a file object has a context, restorecon will only modify the type portion of the security context. The -F option will force a replacement of the entire context.

If a file is labeled with customizable SELinux type (for list of customizable types see /etc/selinux/{SELINUXTYPE}/contexts/customizable_types), restorecon won't reset the label unless the -F option is used.

It is the same executable as setfiles but operates in a slightly different manner depending on its argv[0].

## OPTIONS
-e directory

exclude a directory (repeat the option to exclude more than one directory, Requires full path).

-f infilename

infilename contains a list of files to be processed. Use “-” for stdin.

-F

Force reset of context to match file_context for customizable files, and the default file context, changing the user, role, range portion as well as the type.

-h, -?

display usage information and exit.

-i

ignore files that do not exist.

-I

ignore digest to force checking of labels even if the stored SHA1 digest matches the specfiles SHA1 digest. The digest will then be updated provided there are no errors. See the NOTES section for further details.

-D

Set or update any directory SHA1 digests. Use this option to enable usage of the security.sehash extended attribute.

-m

do not read /proc/mounts to obtain a list of non-seclabel mounts to be excluded from relabeling checks. Setting this option is useful where there is a non-seclabel fs mounted with a seclabel fs mounted on a directory below this.

-n

don't change any file labels (passive check). To display the files whose labels would be changed, add -v.

-o outfilename

Deprecated - This option is no longer supported.

-p

show progress by printing the number of files in 1k blocks unless relabeling the entire OS, that will then show the approximate percentage complete. Note that the -p and -v options are mutually exclusive.

-R, -r

change files and directories file labels recursively (descend directories).

-v

show changes in file labels. Multiple -v options increase the verbosity. Note that the -v and -p options are mutually exclusive.

-W

display warnings about entries that had no matching files by outputting the selabel_stats(3) results.

-0

the separator for the input items is assumed to be the null character (instead of the white space). The quotes and the backslash characters are also treated as normal characters that can form valid input. This option finally also disables the end of file string, which is treated like any other argument. Useful when input items might contain white space, quote marks or backslashes. The -print0 option of GNU find produces input suitable for this mode.

-x

prevent restorecon from crossing file system boundaries.

-T nthreads

use up to nthreads threads. Specify 0 to create as many threads as there are available CPU cores; 1 to use only a single thread (default); or any positive number to use the given number of threads (if possible).

## ARGUMENTS
pathname ... The pathname for the file(s) to be relabeled.

## NOTES
1.

restorecon by default does not operate recursively on directories. Paths leading up the final component of the file(s) are canonicalized using realpath(3) before labeling.

2.

If the pathname specifies the root directory and the -vR or -vr options are set and the audit system is running, then an audit event is automatically logged stating that a "mass relabel" took place using the message label FS_RELABEL.

3.

To improve performance when relabeling file systems recursively (i.e. the -R or -r option is set), the -D option to restorecon will cause it to store a SHA1 digest of the default specfiles set in an extended attribute named security.sehash on each directory specified in pathname ... once the relabeling has been completed successfully. These digests will be checked should restorecon -D be rerun with the same pathname parameters. See selinux_restorecon(3) for further details. The -I option will ignore the SHA1 digest from each directory specified in pathname ... and provided the -n option is NOT set and recursive mode is set, files will be relabeled as required with the digests then being updated provided there are no errors.

## EXAMPLE

```
Fix labeling of /var/www/ including all sub-directories and list all context changes
# restorecon -rv /var/www/
List mislabeled files in user home directory and what the correct label should be
# restorecon -nvr ~
Fix labeling of files listed in file_list file, ignoring any that do not exist
# restorecon -vif file_list
```

## AUTHOR
This man page was written by Dan Walsh <dwalsh@redhat.com>. Some of the content of this man page was taken from the setfiles man page written by Russell Coker <russell@coker.com.au>. The program was written by Dan Walsh <dwalsh@redhat.com>.

## SEE ALSO
setfiles(8), fixfiles(8), load_policy(8), checkpolicy(8), customizable_types(5)


title: restorecon_xattr(8)

summary: manage

text:
# restorecon_xattr(8)

## NAME
restorecon_xattr - manage security.sehash extended attribute entries added by setfiles(8) or restorecon(8).

## SYNOPSIS
restorecon_xattr [-d] [-D] [-m] [-n] [-r] [-v] [-e directory] [-f specfile] pathname

## DESCRIPTION
restorecon_xattr will display the SHA1 digests added to extended attributes security.sehash or delete the attribute completely. These attributes are set by restorecon(8) or setfiles(8) to specified directories when relabeling recursively.

restorecon_xattr is useful for managing the extended attribute entries particularly when users forget what directories they ran restorecon(8) or setfiles(8) from.

RAMFS and TMPFS filesystems do not support the security.sehash extended attribute and are automatically excluded from searches.

By default restorecon_xattr will display the SHA1 digests with "Match" appended if they match the default specfile set or the specfile set used with the -f option. Non-matching SHA1 digests will be displayed with "No Match" appended. This feature can be disabled by the -n option.

## OPTIONS
-d

delete all non-matching security.sehash directory digest entries.

-D

delete all security.sehash directory digest entries.

-m

do not read /proc/mounts to obtain a list of non-seclabel mounts to be excluded from relabeling checks.

Setting -m is useful where there is a non-seclabel fs mounted with a seclabel fs mounted on a directory below this.

-n

Do not append "Match" or "No Match" to displayed digests.

-r

recursively descend directories.

-v

display SHA1 digest generated by specfile set (Note that this digest is not used to match the security.sehash directory digest entries, and is shown for reference only).

-e

directory

directory to exclude (repeat option for more than one directory).

-f

specfile

an optional specfile containing file context entries as described in file_contexts(5). If the option is not specified, then the default file_contexts will be used.

## ARGUMENTS
pathname

the pathname of the directory tree to be searched.

## EXAMPLE

```
List all paths that where assigned a checksum by "restorecon/setfiles -D"
# restorecon_xattr -r /
Remove all non-matching checksums
# restorecon_xattr -rd /
```

## SEE ALSO
restorecon(8), setfiles(8)


title: run_init(8)

text:
# run_init(8)

## NAME
run_init - run an init script in the proper SELinux context

## SYNOPSIS
run_init SCRIPT [[ARGS]...]

## DESCRIPTION
Run a init script under the proper context, which is specified in /etc/selinux/POLICYTYPE/contexts/initrc_context. It is generally used interactively as it requires either shadow or PAM user authentication (depending on compile-time options). It should be possible to configure PAM such that interactive input is not required. Check your PAM documentation.

## FILES
/etc/passwd - user account information

/etc/shadow - encrypted passwords and age information

/etc/selinux/POLICYTYPE/contexts/initrc_context - contains the context to run init scripts under

## SEE ALSO
newrole(1), runcon(1)

## AUTHORS

```
Wayne Salamon (wsalamon@tislabs.com)
Dan Walsh (dwalsh@redhat.com)
```


semanage

title: semanage(8)

summary: SELinux Policy Management tool

text:
# semanage(8)

## NAME
semanage - SELinux Policy Management tool

## SYNOPSIS
semanage {import,export,login,user,port,interface,module,node,fcontext,boolean,permissive,dontaudit,ibpkey,ibendport}

... positional arguments:

import Import local customizations

export Output local customizations

login Manage login mappings between linux users and SELinux confined users

user Manage SELinux confined users (Roles and levels for an SELinux user)

port Manage network port type definitions

interface Manage network interface type definitions

module Manage SELinux policy modules

node Manage network node type definitions

fcontext Manage file context mapping definitions

boolean Manage booleans to selectively enable functionality

permissive Manage process type enforcement mode

dontaudit Disable/Enable dontaudit rules in policy

ibpkey Manage infiniband pkey type definitions

ibendport Manage infiniband end port type definitions

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. This includes the mapping from Linux usernames to SELinux user identities (which controls the initial security context assigned to Linux users when they login and bounds their authorized role set) as well as security context mappings for various kinds of objects, such as network ports, interfaces, infiniband pkeys and endports, and nodes (hosts) as well as the file context mapping. Note that the semanage login command deals with the mapping from Linux usernames (logins) to SELinux user identities, while the semanage user command deals with the mapping from SELinux user identities to authorized role sets. In most cases, only the former mapping needs to be adjusted by the administrator; the latter is principally defined by the base policy and usually does not require modification.

## OPTIONS
-h, --help

List help information

## SEE ALSO
selinux(8), semanage-boolean(8), semanage-dontaudit(8), semanage-export(8), semanage-fcontext(8), semanage-import(8), semanage-interface(8), semanage-login(8), semanage-module(8), semanage-node(8), semanage-permissive(8), semanage-port(8), semanage-user(8) semanage-ibkey(8), semanage-ibendport(8),

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>

and Russell Coker <rcoker@redhat.com>.

Examples by Thomas Bleher <ThomasBleher@gmx.de>. usage: semanage [-h]


semanage-boolean

title: semanage-boolean(8)

summary: SELinux Policy Management boolean tool

text:
# semanage-boolean(8)

## NAME
semanage-boolean - SELinux Policy Management boolean tool

## SYNOPSIS
semanage boolean [-h] [-n] [-N] [-S STORE] [ --extract | --deleteall | --list [-C] | --modify ( --on | --off ) boolean ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage boolean command controls the settings of booleans in SELinux policy. Booleans are if-then-else rules written in SELinux Policy. They can be used to customize the way that SELinux Policy rules effect a confined domain.

## OPTIONS
-h, --help

Show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-C, --locallist

List local customizations

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-1, --on

Enable the boolean

-0, --off

Disable the boolean

## EXAMPLE

```
Turn on the "apache can send mail" boolean (persistent version of #setsebool httpd_can_sendmail on)
# semanage boolean -m --on httpd_can_sendmail
List customized booleans
# semanage boolean -l -C
```

## SEE ALSO
selinux(8), semanage(8), setsebool(8), getsebool(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-dontaudit

title: semanage-dontaudit(8)

text:
# semanage-dontaudit(8)

## NAME
semanage-dontaudit - SELinux Policy Management dontaudit tool

## SYNOPSIS
semanage dontaudit [-h] [-S STORE] [-N] {on,off}

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage dontaudit toggles whether or not dontaudit rules will be in the policy. Policy writers use dontaudit rules to cause confined applications to use alternative paths. Dontaudit rules are denied but not reported in the logs. Sometimes dontaudit rules can cause bugs in applications but policy writers will not realize it since the AVC is not audited. Turn off dontaudit rules with this command to see if the kernel is blocking an access.

## OPTIONS
-h, --help

Show this help message and exit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-N, --noreload

Do not reload the policy after commit

## EXAMPLE

```
Turn off dontaudit rules
# semanage dontaudit off
```

## SEE ALSO
selinux(8), semanage(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-export

title: semanage-export(8)

text:
# semanage-export(8)

## NAME
semanage-export - SELinux Policy Management import tool

## SYNOPSIS
semanage export [-h] [-S STORE] [-f OUTPUT_FILE]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage import and export can be used to extract the SELinux modifications from one machine and apply them to another. Please note that this will remove all current semanage customizations on the second machine as the command list generated using semanage export start with <command> -D for all semanage sub-commands. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction.

## OPTIONS
-h, --help

show this help message and exit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-f OUTPUT_FILE, --output_file OUTPUT_FILE

Output file

## EXAMPLE

```
Import semanage modifications from another machine
# semanage export -f semanage.mods
# scp semanage.mod remotemachine:
# ssh remotemachine
# semanage import -f semanage.mods
```

## SEE ALSO
selinux(8), semanage(8), semanage-import(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-fcontext

title: semanage-fcontext(8)

text:
# semanage-fcontext(8)

## NAME
semanage-fcontext - SELinux Policy Management file context tool

## SYNOPSIS
semanage fcontext [-h] [-n] [-N] [-S STORE] [ --add ( -t TYPE -f FTYPE -r RANGE -s SEUSER | -e EQUAL ) FILE_SPEC | --delete ( -t TYPE -f FTYPE | -e EQUAL ) FILE_SPEC | --deleteall | --extract | --list [-C] | --modify ( -t TYPE -f FTYPE -r RANGE -s SEUSER | -e EQUAL ) FILE_SPEC ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage fcontext is used to manage the default file system labeling on an SELinux system. This command maps file paths using regular expressions to SELinux labels.

FILE_SPEC may contain either a fully qualified path, or a Perl compatible regular expression (PCRE), describing fully qualified path(s). The only PCRE flag in use is PCRE2_DOTALL, which causes a wildcard '.' to match anything, including a new line. Strings representing paths are processed as bytes (as opposed to Unicode), meaning that non-ASCII characters are not matched by a single wildcard.

Note, that file context definitions specified using 'semanage fcontext' (i.e. local file context modifications stored in file_contexts.local) have higher priority than those specified in policy modules. This means that whenever a match for given file path is found in file_contexts.local, no other file context definitions are considered. Entries in file_contexts.local are processed from most recent one to the oldest, with first match being used (as opposed to the most specific match, which is used when matching other file context definitions). All regular expressions should therefore be as specific as possible, to avoid unintentionally impacting other parts of the filesystem.

## OPTIONS
-h, --help

Show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-C, --locallist

List local customizations

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-e EQUAL, --equal EQUAL

Substitute target path with sourcepath when generating default label. This is used with fcontext. Requires source and target path arguments. The context labeling for the target subtree is made equivalent to that defined for the source.

-f [{a,f,d,c,b,s,l,p}], --ftype [{a,f,d,c,b,s,l,p}]

File Type. This is used with fcontext. Requires a file type as shown in the mode field by ls, e.g. use 'd' to match only directories or 'f' to match only regular files. The following file type options can be passed: f (regular file),d (directory),c (character device), b (block device),s (socket),l (symbolic link),p (named pipe). If you do not specify a file type, the file type will default to "all files".

-s SEUSER, --seuser SEUSER

SELinux user name

-t TYPE, --type TYPE

SELinux Type for the object

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

## EXAMPLE

```
Remember to run restorecon after you set the file context
Add file-context httpd_sys_content_t for everything under /web
# semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
# restorecon -R -v /web
Substitute /home1 with /home when setting file context
i.e. label everything under /home1 the same way /home is labeled
# semanage fcontext -a -e /home /home1
# restorecon -R -v /home1
For home directories under top level directory, for example /disk6/home,
execute the following commands.
# semanage fcontext -a -t home_root_t "/disk6"
# semanage fcontext -a -e /home /disk6/home
# restorecon -R -v /disk6
```

## SEE ALSO
selinux(8), semanage(8), restorecon(8), selabel_file(5)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-ibendport

title: semanage-ibendport(8)

text:
# semanage-ibendport(8)

## NAME
semanage-ibendport - SELinux Policy Management ibendport mapping tool

## SYNOPSIS
semanage ibendport [-h] [-n] [-N] [-S STORE] [ --add -t TYPE -z IBDEV_NAME -r RANGE port | --delete -z IBDEV_NAME port | --deleteall | --extract | --list [-C] | --modify -t TYPE -z IBDEV_NAME -r RANGE port ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage ibendport controls the ibendport number to ibendport type definitions.

## OPTIONS
-h, --help

Show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-C, --locallist

List local customizations

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-t TYPE, --type TYPE

SELinux type for the object

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

-z IBDEV_NAME, --ibdev_name IBDEV_NAME

The name of the infiniband device for the port to be labeled. (ex. mlx5_0)

## EXAMPLE

```
List all ibendport definitions
# semanage ibendport -l
Label mlx4_0 port 2.
# semanage ibendport -a -t allowed_ibendport_t -z mlx4_0 2
```

## SEE ALSO
selinux(8), semanage(8)

## AUTHOR
This man page was written by Daniel Jurgens <danielj@mellanox.com>


semanage-ibpkey

title: semanage-ibpkey(8)

text:
# semanage-ibpkey(8)

## NAME
semanage-ibpkey - SELinux Policy Management ibpkey mapping tool

## SYNOPSIS
semanage ibpkey [-h] [-n] [-N] [-S STORE] [ --add -t TYPE -x SUBNET_PREFIX -r RANGE ibpkey_name | ibpkey_range | --delete -x SUBNET_PREFIX ibpkey_name | ibpkey_range | --deleteall | --extract | --list [-C] | --modify -t TYPE -x SUBNET_PREFIX -r RANGE ibpkey_name | ibpkey_range ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage ibpkey controls the ibpkey number to ibpkey type definitions.

## OPTIONS
-h, --help

Show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-C, --locallist

List local customizations

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-t TYPE, --type TYPE

SELinux type for the object

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

-x SUBNET_PREFIX, --subnet_prefix SUBNET_PREFIX

Subnet prefix for the specified pkey or range of pkeys.

## EXAMPLE

```
List all ibpkey definitions
# semanage ibpkey -l
Label pkey 0x8FFF (limited membership default pkey) as a default pkey type
# semanage ibpkey -a -t default_ibpkey_t -x fe80:: 0x8FFF
```

## SEE ALSO
selinux(8), semanage(8)

## AUTHOR
This man page was written by Daniel Jurgens <danielj@mellanox.com>


semanage-import

title: semanage-import(8)

text:
# semanage-import(8)

## NAME
semanage-import - SELinux Policy Management import tool

## SYNOPSIS
semanage import [-h] [-N] [-S STORE] [-f INPUT_FILE]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage import and export can be used to extract the SELinux modifications from one machine and apply them to another. Please note that this will remove all current semanage customizations on the second machine as the command list generated using semanage export start with <command> -D for all semanage sub-commands. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction.

## OPTIONS
-h, --help

show this help message and exit

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-f INPUT_FILE, --input_file INPUT_FILE

Input file

## EXAMPLE

```
Import semanage modifications from another machine
# semanage import -f semanage.mods
```

## SEE ALSO
selinux (8), semanage (8), semanage-export (8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-interface

title: semanage-interface(8)

text:
# semanage-interface(8)

## NAME
semanage-interface - SELinux Policy Management network interface tool

## SYNOPSIS
semanage interface [-h] [-n] [-N] [-S STORE] [ --add -t TYPE -r RANGE interface | --delete interface | --deleteall | --extract | --list [-C] | --modify -t TYPE -r RANGE interface ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage interface controls the labels assigned to network interfaces.

## OPTIONS
-h, --help

Show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-C, --locallist

List local customizations

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-t TYPE, --type TYPE

SELinux type for the object

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

## EXAMPLE

```
list all interface definitions
# semanage interface -l
Assign type netif_t and MLS/MCS range s0:c0.c1023 to interface eth0
# semanage interface -a -t netif_t -r s0:c0.c1023 eth0
```

## SEE ALSO
selinux(8), semanage(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-login

title: semanage-login(8)

text:
# semanage-login(8)

## NAME
semanage-login - SELinux Policy Management linux user to SELinux User mapping tool

## SYNOPSIS
semanage login [-h] [-n] [-N] [-S STORE] [ --add -s SEUSER -r RANGE LOGIN | --delete LOGIN | --deleteall | --extract | --list [-C] | --modify -s SEUSER -r RANGE LOGIN ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage login controls the mapping between a Linux User and the SELinux User. It can be used to turn on confined users. For example you could define that a particular user or group of users will login to a system as the user_u user. Prefix the group name with a '%' sign to indicate a group name.

## OPTIONS
-h, --help

Show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-C, --locallist

List local customizations

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-s SEUSER, --seuser SEUSER

SELinux user name

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

## EXAMPLE

```
Set the default SELinux user on the system to guest_u
# semanage login -m -s guest_u __default__
Map user gijoe to SELinux user staff_u and assign MLS range SystemLow-Secret
# semanage login -a -s staff_u -rSystemLow-Secret gijoe
Map all users in the engineering group to SELinux user staff_u
# semanage login -a -s staff_u %engineering
```

## SEE ALSO
selinux(8), semanage(8), semanage-user(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-module

title: semanage-module(8)

text:
# semanage-module(8)

## NAME
semanage-module - SELinux Policy Management module mapping tool

## SYNOPSIS
semanage module [-h] [-n] [-N] [-S STORE] (-a | -r | -e | -d | --extract | --list [-C] | --deleteall) [module_name]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage module installs, removes, disables, or enables SELinux Policy modules.

## OPTIONS
-h, --help

Show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-a, --add

Install specified module. Accepts both binary policy files (.pp) and CIL source files

-r, --remove

Remove specified module

-D, --deleteall

Remove all local customizations related to modules

-d --disable

Disable specified module

-e --enable

Enable specified module

-E, --extract

Extract customizable commands, for use within a transaction

-l, --list

List records of the specified object type

-C, --locallist

List local customizations

## EXAMPLE

```
List all modules
# semanage module -l
Disable unconfined module
# semanage module --disable unconfined
Install custom apache policy module (same as #semodule -i myapache.pp)
# semanage module -a myapache.pp
```

## SEE ALSO
selinux(8), semanage(8), semodule(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-node

title: semanage-node(8)

text:
# semanage-node(8)

## NAME
semanage-node - SELinux Policy Management node mapping tool

## SYNOPSIS
semanage node [-h] [-n] [-N] [-S STORE] [ --add -M NETMASK -p PROTOCOL -t TYPE -r RANGE node | --delete -M NETMASK -p PROTOCOL node | --deleteall | --extract | --list [-C] | --modify -M NETMASK -p PROTOCOL -t TYPE -r RANGE node ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage node controls the IP address to node type definitions.

## OPTIONS
-h, --help

Show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-C, --locallist

List local customizations

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-M NETMASK, --netmask NETMASK

Network Mask, either in CIDR (/16) or address mask notation (255.255.0.0, ffff::)

-t TYPE, --type TYPE

SELinux type for the object

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

-p PROTO, --proto PROTO

Protocol for the specified port (tcp|udp) or internet protocol version for the specified node (ipv4|ipv6).

## EXAMPLE

```
Apply type node_t to ipv4 node 127.0.0.2
# semanage node -a -t node_t -p ipv4 -M 255.255.255.255 127.0.0.2
```

## SEE ALSO
selinux(8), semanage(8)


semanage-permissive

title: semanage-permissive(8)

text:
# semanage-permissive(8)

## NAME
semanage-permissive - SELinux Policy Management permissive mapping tool

## SYNOPSIS
semanage permissive [-h] [-n] [-N] [-S STORE] (--add TYPE | --delete TYPE | --deleteall | --extract | --list)

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage permissive adds or removes a SELinux Policy permissive module. Please note that this command can make any domain permissive, but can only remove the permissive property from domains where it was added by semanage permissive ("semanage permissive -d" can only be used on types listed as "Customized Permissive Types" by "semanage permissive -l").

## OPTIONS
-h, --help

Show this help message and exit

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-D, --deleteall

Remove all local customizations of permissive domains

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload the policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

## EXAMPLE

```
List all permissive domains ("Builtin Permissive Types" where set by the system policy, or a custom policy module)
# semanage permissive -l
Make httpd_t (Web Server) a permissive domain
# semanage permissive -a httpd_t
```

## SEE ALSO
selinux(8), semanage(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-port

title: semanage-port(8)

text:
# semanage-port(8)

## NAME
semanage-port - SELinux Policy Management port mapping tool

## SYNOPSIS
semanage port [-h] [-n] [-N] [-S STORE] [ --add -t TYPE -p PROTOCOL -r RANGE port_name | port_range | --delete -p PROTOCOL port_name | port_range | --deleteall | --extract | --list [-C] | --modify -t TYPE -p PROTOCOL -r RANGE port_name | port_range ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage port controls the port number to port type definitions.

## OPTIONS
-h, --help

Show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-C, --locallist

List local customizations

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-t TYPE, --type TYPE

SELinux type for the object

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

-p PROTO, --proto PROTO

Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol version for the specified node (ipv4|ipv6).

## EXAMPLE

```
List all port definitions
# semanage port -l
Allow Apache to listen on tcp port 81 (i.e. assign tcp port 81 label http_port_t, which apache is allowed to listen on)
# semanage port -a -t http_port_t -p tcp 81
Allow sshd to listen on tcp port 8991 (i.e. assign tcp port 8991 label ssh_port_t, which sshd is allowed to listen on)
# semanage port -a -t ssh_port_t -p tcp 8991
```

## SEE ALSO
selinux(8), semanage(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>