cgdisk

package: cgdisk

title: cgdisk(8)

text:
# cgdisk(8)

## NAME
cgdisk - Curses-based GUID partition table (GPT) manipulator

## SYNOPSIS
cgdisk [ -a ] device

## DESCRIPTION
GPT fdisk is a text-mode family of programs for creation and manipulation of partition tables. The cgdisk member of this family employs a curses-based user interface for interaction using a text-mode menuing system. It will automatically convert an old-style Master Boot Record (MBR) partition table or BSD disklabel stored without an MBR carrier partition to the newer Globally Unique Identifier (GUID) Partition Table (GPT) format, or will load a GUID partition table. Other members of this program family are gdisk (the most feature-rich program of the group, with a non-curses-based interactive user interface) and sgdisk (which is driven via command-line options for use by experts or in scripts). FixParts is a related program for fixing a limited set of problems with MBR disks.

For information on MBR vs. GPT, as well as GPT terminology and structure, see the extended GPT fdisk documentation at https://www.rodsbooks.com/gdisk/ or consult Wikipedia.

The cgdisk program employs a user interface similar to that of Linux's cfdisk, but cgdisk modifies GPT partitions. It also has the capability of transforming MBR partitions or BSD disklabels into GPT partitions. Like the original cfdisk program, cgdisk does not modify disk structures until you explicitly write them to disk, so if you make a mistake, you can exit from the program with the Quit option to leave your partitions unmodified.

Ordinarily, cgdisk operates on disk device files, such as /dev/sda or /dev/hda under Linux, /dev/disk0 under Mac OS X, or /dev/ad0 or /dev/da0 under FreeBSD. The program can also operate on disk image files, which can be either copies of whole disks (made with dd, for instance) or raw disk images used by emulators such as QEMU or VMWare. Note that only raw disk images are supported; cgdisk cannot work on compressed or other advanced disk image formats.

Upon start, cgdisk attempts to identify the partition type in use on the disk. If it finds valid GPT data, cgdisk will use it. If cgdisk finds a valid MBR or BSD disklabel but no GPT data, it will attempt to convert the MBR or disklabel into GPT form. (BSD disklabels are likely to have unusable first and/or final partitions because they overlap with the GPT data structures, though.) Upon exiting with the 'w' option, cgdisk replaces the MBR or disklabel with a GPT. This action is potentially dangerous! Your system may become unbootable, and partition type codes may become corrupted if the disk uses unrecognized type codes. Boot problems are particularly likely if you're multi-booting with any GPT-unaware OS. If you mistakenly launch cgdisk on an MBR disk, you can safely exit the program without making any changes by using the Quit option.

When creating a fresh partition table, certain considerations may be in order:

*

For data (non-boot) disks, and for boot disks used on BIOS-based computers with GRUB as the boot loader, partitions may be created in whatever order and in whatever sizes are desired.

*

Boot disks for EFI-based systems require an EFI System Partition (GPT fdisk internal code 0xEF00) formatted as FAT-32. The recommended size of this partition is between 100 and 300 MiB. Boot-related files are stored here. (Note that GNU Parted identifies such partitions as having the "boot flag" set.)

*

The GRUB 2 boot loader for BIOS-based systems makes use of a BIOS Boot Partition (GPT fdisk internal code 0xEF02), in which the secondary boot loader is stored, without the benefit of a filesystem. This partition can typically be quite small (roughly 32 KiB to 1 MiB), but you should consult your boot loader documentation for details.

*

If Windows is to boot from a GPT disk, a partition of type Microsoft Reserved (GPT fdisk internal code 0x0C01) is recommended. This partition should be about 128 MiB in size. It ordinarily follows the EFI System Partition and immediately precedes the Windows data partitions. (Note that old versions of GNU Parted create all FAT partitions as this type, which actually makes the partition unusable for normal file storage in both Windows and Mac OS X.)

*

Some OSes' GPT utilities create some blank space (typically 128 MiB) after each partition. The intent is to enable future disk utilities to use this space. Such free space is not required of GPT disks, but creating it may help in future disk maintenance. You can use GPT fdisk's relative partition positioning option (specifying the starting sector as '+128M', for instance) to simplify creating such gaps.

## OPTIONS
Only one command-line option is accepted, aside from the device filename: -a. This option alters the highlighting of partitions and blocks of free space: Instead of using ncurses, when -a is used cgdisk uses a ">" symbol to the left of the selected partition or free space. This option is intended for use on limited display devices such as teletypes and screen readers.

Interactions with cgdisk occur with its interactive text-mode menus. The display is broken into two interactive parts:

*

The partition display area, in which partitions and gaps between them (marked as "free space") are summarized.

*

The option selection area, in which buttons for the main options appear.

In addition, the top of the display shows the program's name and version number, the device filename associated with the disk, and the disk's size in both sectors and IEEE-1541 units (GiB, TiB, and so on).

You can use the following keys to move among the various options and to select among them:

up arrow

This key moves the partition selection up by one partition.

down arrow

This key moves the partition selection down by one partition.

Page Up

This key moves the partition selection up by one screen.

Page Down

This key moves the partition selection down by one screen.

right arrow

This key moves the option selection to the right by one item.

left arrow

This key moves the option selection to the left by one item.

Enter

This key activates the currently selected option. You can also activate an option by typing the capitalized letter in the option's name on the keyboard, such as a to activate the Align option.

If more partitions exist than can be displayed in one screen, you can scroll between screens using the partition selection keys, much as in a text editor.

Available options are as described below. (Note that cgdisk provides a much more limited set of options than its sibling gdisk. If you need to perform partition table recovery, hybrid MBR modification, or other advanced operations, you should consult the gdisk documentation.)

Align

Change the sector alignment value. Disks with more logical sectors than physical sectors (such as modern Advanced Format drives), some RAID configurations, and many SSD devices, can suffer performance problems if partitions are not aligned properly for their internal data structures. On new disks, GPT fdisk attempts to align partitions on 1 MiB boundaries (2048-sectors on disks with 512-byte sectors) by default, which optimizes performance for all of these disk types. On pre-partitioned disks, GPT fdisk attempts to identify the alignment value used on that disk, but will set 8-sector alignment on disks larger than 300 GB even if lesser alignment values are detected. In either case, it can be changed by using this option. The alignment value also affects the default end sector value when creating a new partition; it will be aligned to one less than a multiple of the alignment value, when possible. This should keep partitions a multiple of the alignment value in size. Some disk encryption tools require partitions to be sized to some value, typically 4096 bytes, so the default alignment of 1 MiB works well for them.

Backup

Save partition data to a backup file. You can back up your current in-memory partition table to a disk file using this option. The resulting file is a binary file consisting of the protective MBR, the main GPT header, the backup GPT header, and one copy of the partition table, in that order. Note that the backup is of the current in-memory data structures, so if you launch the program, make changes, and then use this option, the backup will reflect your changes.

Delete

Delete a partition. This action deletes the entry from the partition table but does not disturb the data within the sectors originally allocated to the partition on the disk. If a corresponding hybrid MBR partition exists, gdisk deletes it, as well, and expands any adjacent 0xEE (EFI GPT) MBR protective partition to fill the new free space.

Help

Print brief descriptions of all the options.

Info

Show detailed partition information. The summary information shown in the partition display area necessarily omits many details, such as the partitions' unique GUIDs and the partitions' sector-exact start and end points. The Info option displays this information for a single partition.

Load

Load partition data from a backup file. This option is the reverse of the Backup option. Note that restoring partition data from anything but the original disk is not recommended.

naMe

Change the GPT name of a partition. This name is encoded as a UTF-16 string, but proper entry and display of anything beyond basic ASCII values requires suitable locale and font support. For the most part, Linux ignores the partition name, but it may be important in some OSes. GPT fdisk sets a default name based on the partition type code. Note that the GPT partition name is different from the filesystem name, which is encoded in the filesystem's data structures. Note also that to activate this item by typing its alphabetic equivalent, you must use M, not the more obvious N, because the latter is used by the next option....

New

Create a new partition. You enter a starting sector, a size, a type code, and a name. The start sector can be specified in absolute terms as a sector number or as a position measured in kibibytes (K), mebibytes (M), gibibytes (G), tebibytes (T), or pebibytes (P); for instance, 40M specifies a position 40MiB from the start of the disk. You can specify locations relative to the start or end of the specified default range by preceding the number by a '+' symbol, as in +2G to specify a point 2GiB after the default start sector. The size value can use the K, M, G, T, and P suffixes, too. Pressing the Enter key with no input specifies the default value, which is the start of the largest available block for the start sector and the full available size for the size.

Quit

Quit from the program without saving your changes. Use this option if you just wanted to view information or if you make a mistake and want to back out of all your changes.

Type

Change a single partition's type code. You enter the type code using a two-byte hexadecimal number. You may also enter a GUID directly, if you have one and cgdisk doesn't know it. If you don't know the type code for your partition, you can type L to see a list of known type codes. The type code list may optionally be filtered by a search string; for instance, entering linux shows only partition type codes with descriptions that include the string Linux. This search is performed case-insensitively.

Verify

Verify disk. This option checks for a variety of problems, such as incorrect CRCs and mismatched main and backup data. This option does not automatically correct most problems, though; for that, you must use gdisk. If no problems are found, this command displays a summary of unallocated disk space.

Write

Write data. Use this command to save your changes.

## BUGS
Known bugs and limitations include:

*

The program compiles correctly only on Linux, FreeBSD, and Mac OS X. In theory, it should compile under Windows if the Ncurses library for Windows is installed, but I have not tested this capability. Linux versions for x86-64 (64-bit), x86 (32-bit), and PowerPC (32-bit) have been tested, with the x86-64 version having seen the most testing. Under FreeBSD, 32-bit (x86) and 64-bit (x86-64) versions have been tested. Only 32-bit versions for Mac OS X has been tested by the author.

*

The FreeBSD version of the program can't write changes to the partition table to a disk when existing partitions on that disk are mounted. (The same problem exists with many other FreeBSD utilities, such as gpt, fdisk, and dd.) This limitation can be overcome by typing sysctl kern.geom.debugflags=16 at a shell prompt.

*

The program can load only up to 128 partitions (4 primary partitions and 124 logical partitions) when converting from MBR format. This limit can be raised by changing the #define MAX_MBR_PARTS line in the basicmbr.h source code file and recompiling; however, such a change will require using a larger-than-normal partition table. (The limit of 128 partitions was chosen because that number equals the 128 partitions supported by the most common partition table size.)

*

Converting from MBR format sometimes fails because of insufficient space at the start or (more commonly) the end of the disk. Resizing the partition table (using the 's' option in the experts' menu in gdisk) can sometimes overcome this problem; however, in extreme cases it may be necessary to resize a partition using GNU Parted or a similar tool prior to conversion with GPT fdisk.

*

MBR conversions work only if the disk has correct LBA partition descriptors. These descriptors should be present on any disk over 8 GiB in size or on smaller disks partitioned with any but very ancient software.

*

BSD disklabel support can create first and/or last partitions that overlap with the GPT data structures. This can sometimes be compensated by adjusting the partition table size, but in extreme cases the affected partition(s) may need to be deleted.

*

Because of the highly variable nature of BSD disklabel structures, conversions from this form may be unreliable -- partitions may be dropped, converted in a way that creates overlaps with other partitions, or converted with incorrect start or end values. Use this feature with caution!

*

Booting after converting an MBR or BSD disklabel disk is likely to be disrupted. Sometimes re-installing a boot loader will fix the problem, but other times you may need to switch boot loaders. Except on EFI-based platforms, Windows through at least Windows 7 doesn't support booting from GPT disks. Creating a hybrid MBR (using the 'h' option on the recovery & transformation menu in gdisk) or abandoning GPT in favor of MBR may be your only options in this case.

*

The cgdisk Verify function and the partition type listing obtainable by typing L in the Type function (or when specifying a partition type while creating a new partition) both currently exit ncurses mode. This limitation is a minor cosmetic blemish that does not affect functionality.

## AUTHORS
Primary author: Roderick W. Smith (rodsmith@rodsbooks.com)

Contributors:

* Yves Blusseau (1otnwmz02@sneakemail.com)

* David Hubbard (david.c.hubbard@gmail.com)

* Justin Maggard (justin.maggard@netgear.com)

* Dwight Schauer (das@teegra.net)

* Florian Zumbiehl (florz@florz.de)

## SEE ALSO
cfdisk(8), fdisk(8), gdisk(8), mkfs(8), parted(8), sfdisk(8), sgdisk(8), fixparts(8).

https://en.wikipedia.org/wiki/GUID_Partition_Table

https://developer.apple.com/technotes/tn2006/tn2166.html

https://www.rodsbooks.com/gdisk/

## AVAILABILITY
The cgdisk command is part of the GPT fdisk package and is available from Rod Smith.


cgconfigparser

package: cgroup

title: cgconfigparser(8)

summary: setup control group file system

text:
# cgconfigparser(8)

## NAME
cgconfigparser - setup control group file system

## SYNOPSIS
cgconfigparser [-h] [-l <filename>] [-L <directory>] [...]

## OPTIONS
-h, --help

Displays help.

-l, --load=FILE

Parses the control groups configuration file Sets up the control group file system defined by the configuration file and mounts mount points defined by the configuration file. The format of the file is described in cgconfig.conf. This option can be used multiple times and can be mixed with -L option.

-L, --load-directory=DIR

Finds all files in given directory and parses them in alphabetical order like they were specified by -l option. This option can be used multiple times and can be mixed with -l option.

-a <agid>:<auid>

defines the default owner of the rest of the defined control group’s files. These users are allowed to set subsystem parameters and create subgroups. The default value is the same as has the parent cgroup.

-d, --dperm=mode

sets the default permissions of a control groups directory. The permissions needs to be specified as octal numbers e.g. -d 775.

-f, --fperm=mode

sets the default permissions of the control group files. The permissions needs to be specified as octal numbers e.g. -f 775. The value is not used as given because the current owner's permissions are used as an umask (so 777 will set group and others permissions to the owners permissions).

-s, --tperm=mode

sets the default permissions of the control group tasks files. The permissions needs to be specified as octal numbers e.g. -f 775. The value is not used as given because the current owner's permissions are used as an umask (so 777 will set group and others permissions to the owners permissions).

-t <tuid>:<tgid>

defines the default owner of tasks file of the defined control group. I.e. this user and members of this group have write access to the file.

## ENVIRONMENT VARIABLES
CGROUP_LOGLEVEL

controls verbosity of the tool. Allowed values are DEBUG, INFO, WARNING or ERROR.

## FILES
/etc/cgconfig.conf

default libcgroup configuration file

/etc/cgconfig.d/

default libcgroup configuration files directory

## EXAMPLES
cgconfigparser -l /etc/cgconfig.conf

setup control group file system based on /etc/cgconfig.conf configuration file

## SEE ALSO
cgconfig.conf (5)

branch: sisyphus


cgrulesengd

title: cgrulesengd(8)

summary: control group rules daemon

text:
# cgrulesengd(8)

## NAME
cgrulesengd - control group rules daemon

## SYNOPSIS
cgrulesengd [options]

## DESCRIPTION
cgrulesengd is a daemon, which distributes processes to control groups. When any process changes its effective UID or GID, cgrulesengd inspects the list of rules loaded from the cgrules.conf file and files in cgrules.d (see cgrules.d (5) for potential conflicts) directory and moves the process to the appropriate control group.

The list of rules is read during the daemon startup and cached in the daemon's memory. The daemon reloads the list of rules when it receives SIGUSR2 signal. The daemon reloads the list of templates when it receives SIGUSR1 signal.

The daemon opens a standard unix socket to receive 'sticky' requests from cgexec.

## OPTIONS
-h|--help

Display help.

-f <path>|--logfile=<path>

Write log messages to the given log file. When '-' is used as <path>, log messages are written to the standard output. If '-f' and '-s' are used together, the logs are sent to both destinations.

-s[facility]|--syslog=[facility]

Write log messages to syslog. The default facility is DAEMON. If '-f' and '-s' are used together, the logs are sent to both destinations.

-n|--nodaemon

Don't fork the daemon, stay in the foreground.

-v|--verbose

Display more log messages. This option can be used three times to enable more verbose log messages.

-q|--quiet

Display less log messages.

-Q|--nolog

Disable logging.

-d|--debug

Equivalent to '-nvvvf -', i.e. don't fork the daemon, display all log messages and write them to the standard output.

-u <user>|--socket-user=<user>

-g <group>|--socket-group=<group> Set the owner of cgrulesengd socket. Assumes that cgexec runs with proper suid permissions so it can write to the socket when cgexec --sticky is used.

## ENVIRONMENT VARIABLES
CGROUP_LOGLEVEL

controls verbosity of the tool. Allowed values are DEBUG, INFO, WARNING or ERROR.

## FILES
/etc/cgrules.conf

default libcgroup configuration file

/etc/cgrules.d

default libcgroup configuration files directory

/etc/cgconfig.conf

default templates file

/etc/cgconfig.d

default templates directory

## SEE ALSO
cgrules.conf (5), cgrules.d (5)


checkpassword-pam

package: checkpassword-pam

title: checkpassword-pam(8)

text:
# checkpassword-pam(8)

## NAME
checkpassword-pam - PAM-based checkpassword compatible authentication

## SYNOPSIS
checkpassword-pam [-s PAM-SERVICE] [-e|--noenv] -- prog args...

checkpassword-pam --help

checkpassword-pam --version

Additional debugging options (see below):

[--debug] [--stdout]

Additional rarely used options (see below):

[-H|--no-chdir-home]

## DESCRIPTION
checkpassword-pam uses PAM to authenticate the remote user with checkpassword protocol.

checkpassword-style programs are usually run by network server programs that wish to authenticate remote user.

checkpassword-pam uses PAM service name specified by PAM_SERVICE environment variable, or by the -s or --service command-line option.

After successful authentication, if --noenv option is not specified, checkpassword-pam sets up supplementary groups of authenticated user, its gid, its uid, and its working directory (those values are taken from the system user database).

Normally, checkpassword-pam switches to user home directory. If --no-chdir-home or -H option is specified, this step is skipped. This option is useful when you have automounted home directories, but mail is delivered to a central location.

Finally, checkpassword-pam executes prog with args as its arguments.

-- is used as usual to separate the checkpassword-pam own options from prog options.

checkpassword-pam logs authentication failures (or all actions, if --debug option is used) to syslog (or to stdout, if --stdout option is used).

## ENVIRONMENT VARIABLES
PAM_SERVICE

checkpassword-pam uses contents of PAM_SERVICE environment variable to specify the PAM service name. This could be overriden by -s option, see above.

Before invoking prog, checkpassword-pam sets environment variables USER, HOME, and SHELL to appropriate values. If --noenv option is specified, this step is skipped and the variables are left alone. This is needed when you have virtual users which are not listed in your /etc/passwd, and you need to only do authentication. Setting up process environment is handled by some other application like setuidgid.

## DEBUGGING
You can turn on debugging using the --debug option. checkpassword-pam starts to log all of its actions and the results of those actions to syslog (or to stdout, based on the state of --stdout option, see above).

There is a way to manually trace how the checkpassword-pam authenticates: use the shell redirection and the --stdout option. In this case checkpassword-pam reads checkpassword protocol data from stdin, and logs actions to stdout. You can trace the authentication for the given user and password with the following command-line (usually as root):

\# echo -e "username\0password\0timestamp\0" \

| checkpassword-pam -s SERVICE \

--debug --stdout -- /usr/bin/id 3<&0

It will trace the PAM authentication process for the user username with password password, and run the id program, which will report the user and groups checkpassword-pam switched to.

The idea of this method is courtesy of Mark Delany <markd-at-mira.net>.

## BUGS
If you've found a bug in checkpasswd-pam, please report it to checkpasswd-pam-devel@lists.sourceforge.net

## SEE ALSO
http://checkpasswd-pam.sourceforge.net/

http://cr.yp.to/checkpwd.html

"PAM Administrator's Guide" for your operating system.

## LEGACY
There are alternate older checkpassword-pam packages available. They are derived from original DJB's checkpassword code, and usually are less administrator-friendly than this version. You can tell those packages apart by looking at their version number: it is less than 0.95.

## AUTHOR
This version of checkpassword-pam was written from scratch by Alexey Mahotkin <alexm@hsys.msk.ru>

checkpassword interface was designed by Daniel J. Bernstein.


checkmodule

package: checkpolicy

title: checkmodule(8)

summary: SELinux policy module compiler

text:
# checkmodule(8)

## NAME
checkmodule - SELinux policy module compiler

## SYNOPSIS
checkmodule [-h] [-b] [-c policy_version] [-C] [-E] [-m] [-M] [-N] [-L] [-U handle_unknown] [-V] [-o output_file] [input_file]

## DESCRIPTION
This manual page describes the checkmodule command.

checkmodule is a program that checks and compiles a SELinux security policy module into a binary representation. It can generate either a base policy module (default) or a non-base policy module (-m option); typically, you would build a non-base policy module to add to an existing module store that already has a base module provided by the base policy. Use semodule_package(8) to combine this module with its optional file contexts to create a policy package, and then use semodule(8) to install the module package into the module store and load the resulting policy.

## OPTIONS
-b,--binary

Read an existing binary policy module file rather than a source policy module file. This option is a development/debugging aid.

-C,--cil

Write CIL policy file rather than binary policy file.

-E,--werror

Treat warnings as errors

-h,--help

Print usage.

-m

Generate a non-base policy module.

-M,--mls

Enable the MLS/MCS support when checking and compiling the policy module.

-N,--disable-neverallow

Do not check neverallow rules.

-L,--line-marker-for-allow

Output line markers for allow rules, in addition to neverallow rules. This option increases the size of the output CIL policy file, but the additional line markers helps debugging, especially neverallow failure reports. Can only be used when writing a CIL policy file.

-V,--version

Show policy versions created by this program.

-o,--output filename

Write a binary policy module file to the specified filename. Otherwise, checkmodule will only check the syntax of the module source file and will not generate a binary module at all.

-U,--handle-unknown <action>

Specify how the kernel should handle unknown classes or permissions (deny, allow or reject).

-c policyvers

Specify the policy version, defaults to the latest.

## EXAMPLE

```
# Build a MLS/MCS-enabled non-base policy module.
$ checkmodule -M -m httpd.te -o httpd.mod
```

## SEE ALSO
semodule(8), semodule_package(8) SELinux Reference Policy documentation at https://github.com/SELinuxProject/refpolicy/wiki

## AUTHOR
This manual page was copied from the checkpolicy man page written by Árpád Magosányi <mag@bunuel.tii.matav.hu>, and edited by Dan Walsh <dwalsh@redhat.com>.


checkpolicy

title: checkpolicy(8)

summary: SELinux policy compiler

text:
# checkpolicy(8)

## NAME
checkpolicy - SELinux policy compiler

## SYNOPSIS
checkpolicy [-b[F]] [-C] [-d] [-U handle_unknown (allow,deny,reject)] [-M] [-N] [-L] [-c policyvers] [-o output_file|-] [-S] [-t target_platform (selinux,xen)] [-O] [-E] [-V] [input_file]

## DESCRIPTION
This manual page describes the checkpolicy command.

checkpolicy is a program that checks and compiles a SELinux security policy configuration into a binary representation that can be loaded into the kernel. If no input file name is specified, checkpolicy will attempt to read from policy.conf or policy, depending on whether the -b flag is specified.

## OPTIONS
-b,--binary

Read an existing binary policy file rather than a source policy.conf file.

-F,--conf

Write policy.conf file rather than binary policy file. Can only be used with binary policy file.

-C,--cil

Write CIL policy file rather than binary policy file.

-d,--debug

Enter debug mode after loading the policy.

-U,--handle-unknown <action>

Specify how the kernel should handle unknown classes or permissions (deny, allow or reject).

-M,--mls

Enable the MLS policy when checking and compiling the policy.

-N,--disable-neverallow

Do not check neverallow rules.

-L,--line-marker-for-allow

Output line markers for allow rules, in addition to neverallow rules. This option increases the size of the output CIL policy file, but the additional line markers helps debugging, especially neverallow failure reports. Can only be used when writing a CIL policy file.

-c policyvers

Specify the policy version, defaults to the latest.

-o,--output filename

Write a policy file (binary, policy.conf, or CIL policy) to the specified filename. If - is given as filename, write it to standard output.

-S,--sort

Sort ocontexts before writing out the binary policy. This option makes output of checkpolicy consistent with binary policies created by semanage and secilc.

-t,--target

Specify the target platform (selinux or xen).

-O,--optimize

Optimize the final kernel policy (remove redundant rules).

-E,--werror

Treat warnings as errors

-V,--version

Show version information.

-h,--help

Show usage information.

## EXAMPLE

```
Generate policy.conf based on the system policy
# checkpolicy -b -M -F /etc/selinux/targeted/policy/policy.33 -o policy.conf
Recompile system policy so that unknown permissions are denied (uses policy.conf from ^^).
Note that binary policy extension represents its version, which is subject to change
# checkpolicy -M -U deny -o /etc/selinux/targeted/policy/policy.33 policy.conf
# load_policy
Generate CIL representation of current system policy
# checkpolicy -b -M -C /etc/selinux/targeted/policy/policy.33 -o policy.out
```

## SEE ALSO
SELinux Reference Policy documentation at https://github.com/SELinuxProject/refpolicy/wiki

## AUTHOR
This manual page was written by Árpád Magosányi <mag@bunuel.tii.matav.hu>, and edited by Stephen Smalley <stephen.smalley.work@gmail.com>. The program was written by Stephen Smalley <stephen.smalley.work@gmail.com>.


chkconfig

package: chkconfig

title: chkconfig(8)

text:
# chkconfig(8)

## NAME
chkconfig - updates and queries runlevel information for system services

## SYNOPSIS
chkconfig [--list] [--type type] [name]

chkconfig --add name

chkconfig --del name

chkconfig --override name

chkconfig [--level levels] [--type type] [--no-redirect] name <on|off|reset|resetpriorities>

chkconfig [--level levels] [--type type] [--no-redirect] name

## DESCRIPTION
chkconfig provides a simple command-line tool for maintaining the /etc/rc[0-6].d directory hierarchy by relieving system administrators of the task of directly manipulating the numerous symbolic links in those directories.

This implementation of chkconfig was inspired by the chkconfig command present in the IRIX operating system. Rather than maintaining configuration information outside of the /etc/rc[0-6].d hierarchy, however, this version directly manages the symlinks in /etc/rc[0-6].d. This leaves all of the configuration information regarding what services init starts in a single location.

chkconfig has five distinct functions: adding new services for management, removing services from management, listing the current startup information for services, changing the startup information for services, and checking the startup state of a particular service.

When chkconfig is run with only a service name, it checks to see if the service is configured to be started in the current runlevel. If it is, chkconfig returns true; otherwise it returns false. The --level option may be used to have chkconfig query an alternative runlevel rather than the current one.

When chkconfig is run with the --list argument, or no arguments at all, a listing is displayed of all services and their current configuration.

If one of on, off, reset, or resetpriorities is specified after the service name, chkconfig changes the startup information for the specified service. The on and off flags cause the service to be started or stopped, respectively, in the runlevels being changed. The reset flag resets the on/off state for all runlevels for the service to whatever is specified in the init script in question, while the resetpriorities flag resets the start/stop priorities for the service to whatever is specified in the init script.

By default, the on and off options affect only runlevels 2, 3, 4, and 5, while reset and resetpriorities affects all of the runlevels. The --level option may be used to specify which runlevels are affected.

Note that for every service, each runlevel has either a start script or a stop script. When switching runlevels, init will not re-start an already-started service, and will not re-stop a service that is not running.

chkconfig also can manage xinetd scripts via the means of xinetd.d configuration files. Note that only the on, off, and --list commands are supported for xinetd.d services.

chkconfig supports a --type argument to limit actions to only a specific type of services, in the case where services of either type may share a name. Possible values for type are sysv and xinetd.

## OPTIONS
--level levels

Specifies the run levels an operation should pertain to. It is given as a string of numbers from 0 to 6. For example, --level 35 specifies runlevels 3 and 5.

--no-redirect

When chkconfig is run on a system that uses systemd as its init system, chkconfig will forward commands to systemd if a systemd service file exists for it. This switch turns off the redirection to systemd and only operates on the symlinks in /etc/rc[0-6].d. This option is only valid when on, off, or no command (to check enablement) is passed to a service.

--add name

This option adds a new service for management by chkconfig. When a new service is added, chkconfig ensures that the service has either a start or a kill entry in every runlevel. If any runlevel is missing such an entry, chkconfig creates the appropriate entry as specified by the default values in the init script. Note that default entries in LSB-delimited 'INIT INFO' sections take precedence over the default runlevels in the initscript; if any Required-Start or Required-Stop entries are present, the start and stop priorities of the script will be adjusted to account for these dependencies.

--del name

The service is removed from chkconfig management, and any symbolic links in /etc/rc[0-6].d which pertain to it are removed. Note that future package installs for this service may run chkconfig --add, which will re-add such links. To disable a service, run chkconfig name off.

--override name

If service name is configured exactly as it would be if the --add option had been specified with no override file in /etc/chkconfig.d/name, and if /etc/chkconfig.d/name now exists and is specified differently from the base initscript, change the configuration for service name to follow the overrides instead of the base configuration.

--list name

This option lists all of the services which chkconfig knows about, and whether they are stopped or started in each runlevel. If name is specified, information in only display about service name.

## RUNLEVEL FILES
Each service which should be manageable by chkconfig needs two or more commented lines added to its init.d script. The first line tells chkconfig what runlevels the service should be started in by default, as well as the start and stop priority levels. If the service should not, by default, be started in any runlevels, a - should be used in place of the runlevels list. The second line contains a description for the service, and may be extended across multiple lines with backslash continuation.

For example, random.init has these three lines:

```
# chkconfig: 2345 20 80
# description: Saves and restores system entropy pool for \
#              higher quality random number generation.
```

This says that the random script should be started in levels 2, 3, 4, and 5, that its start priority should be 20, and that its stop priority should be 80. You should be able to figure out what the description says; the \ causes the line to be continued. The extra space in front of the line is ignored. chkconfig also supports LSB-style init stanzas, and will apply them in preference to "chkconfig:" lines where available. A LSB stanza looks like:

```
### BEGIN INIT INFO
# Provides: foo
# Required-Start: bar
# Defalt-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Description: Foo init script
### END INIT INFO
```

In this case, the start priority of "foo" would be changed such that it is higher than the "bar" start priority, if "bar" is enabled. Care must be taken when adding dependencies, as they can cause vast shifts in the start and stop priorities of many scripts.

## OVERRIDE FILES
File in /etc/chkconfig.d/servicename are parsed using the same comments that chkconfig notices in init service scripts, and override values in the init service scripts themselves.

## SEE ALSO
init(8)

## AUTHOR

```
Erik Troan <ewt@redhat.com>
```


chkfontpath

package: chkfontpath

title: chkfontpath(8)

text:
# chkfontpath(8)

## NAME
chkfontpath - simple interface for adding, removing, and listing directories in the X font server's path

## SYNOPSIS
chkfontpath [-lqfh] [-a name of directory to add] [-r name of directory to remove]

## DESCRIPTION
chkfontpath provides a simple method of configuring the directories contained in the X font server's path. As of Red Hat 6.0, all fonts in X are served via this separate font server process, not through the main X server process. This speeds up font rendering, and also allows use of font servers which are not running on the local host.

chkfontpath is mainly used by rpm in its %post and %postun sections to add and remove new directories to the server's config file at installation and de-installation time of packages containing fonts.

-a, --add=name of directory to add

Add a directory to the font path.

-r, --remove=name of directory to remove

Remove a directory from the font path.

-l, --list

List all directories in the font path.

-q, --quiet

Quiet operation; don't display any output to the screen, even when there is an error during operation.

-f, --first

Requires usage of the add command; puts the specified directory first in the font path, rather than last.

-h, --help

Show detailed help on the command line.

When directories are added to the path, some sanity checking is performed to make sure you are not adding a directory without the file fonts.dir contained in it, which the server needs to be able to render fonts properly. When a path is succesfully added or removed, the xfs process is restarted if it is currently running.

## RETURN CODES
chkfontpath returns 0 on success, or 1 on error.

## FILES
/etc/X11/fs/config

Configuration file for the X font server (xfs).

## SEE ALSO
xfs(1),fslsfonts(1)

## AUTHOR

```
Written by Preston Brown <pbrown@redhat.com>
Rewritten by Dmitry V. Levin <ldv@alt-linux.org>
```

## REPORTING BUGS
Report bugs to http://bugs.altlinux.ru/.

## COPYRIGHT
Copyright © 1999-2001 Red Hat, Inc. Copyright © 2002 Dmitry V. Levin <ldv@alt-linux.org> All rights reserved.

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTIBILITY or FITNESS FOR A PARTICULAR PURPOSE.


chronyd

package: chrony

title: chronyd(8)

summary: chrony daemon

text:
# chronyd(8)

## NAME
chronyd - chrony daemon

## SYNOPSIS
chronyd [OPTION]... [DIRECTIVE]...

## DESCRIPTION
chronyd is a daemon for synchronisation of the system clock. It can synchronise the clock with NTP servers, reference clocks (e.g. a GPS receiver), and manual input using wristwatch and keyboard via chronyc. It can also operate as an NTPv4 (RFC 5905) server and peer to provide a time service to other computers in the network.

If no configuration directives are specified on the command line, chronyd will read them from a configuration file. The compiled-in default location of the file is /etc/chrony.conf.

Informational messages, warnings, and errors will be logged to syslog.

## OPTIONS
-4

With this option hostnames will be resolved only to IPv4 addresses and only IPv4 sockets will be created.

-6

With this option hostnames will be resolved only to IPv6 addresses and only IPv6 sockets will be created.

-f file

This option can be used to specify an alternate location for the configuration file. The compiled-in default value is /etc/chrony.conf.

-n

When run in this mode, the program will not detach itself from the terminal.

-d

When run in this mode, the program will not detach itself from the terminal, and all messages will be written to the terminal instead of syslog. If chronyd was compiled with enabled support for debugging, this option can be used twice to enable debug messages.

-l file

This option enables writing of log messages to a file instead of syslog or the terminal.

-L level

This option specifies the minimum severity level of messages to be written to the log file, syslog, or terminal. The following levels can be specified: -1 (debug, if compiled with enabled support for debugging), 0 (informational), 1 (warning), 2 (non-fatal error), and 3 (fatal error). The default value is 0.

-p

When run in this mode, chronyd will print the configuration and exit. It will not detach from the terminal. This option can be used to verify the syntax of the configuration and get the whole configuration, even if it is split into multiple files and read by the include or confdir directive.

-q

When run in this mode, chronyd will set the system clock once and exit. It will not detach from the terminal.

-Q

This option is similar to the -q option, except it only prints the offset without making any corrections of the clock and disables server ports to allow chronyd to be started without root privileges, assuming the configuration does not have any directives which would require them (e.g. refclock, hwtimestamp, rtcfile, etc).

-r

This option will try to reload and then delete files containing sample histories for each of the servers and reference clocks being used. The files are expected to be in the directory specified by the dumpdir directive in the configuration file. This option is useful if you want to stop and restart chronyd briefly for any reason, e.g. to install a new version. However, it should be used only on systems where the kernel can maintain clock compensation whilst not under chronyd's control (i.e. Linux, FreeBSD, NetBSD, illumos, and macOS 10.13 or later).

-R

When this option is used, the initstepslew directive and the makestep directive used with a positive limit will be ignored. This option is useful when restarting chronyd and can be used in conjunction with the -r option.

-s

This option will set the system clock from the computer’s real-time clock (RTC) or to the last modification time of the file specified by the driftfile directive. Real-time clocks are supported only on Linux. If used in conjunction with the -r flag, chronyd will attempt to preserve the old samples after setting the system clock from the RTC. This can be used to allow chronyd to perform long term averaging of the gain or loss rate across system reboots, and is useful for systems with intermittent access to network that are shut down when not in use. For this to work well, it relies on chronyd having been able to determine accurate statistics for the difference between the RTC and system clock last time the computer was on.

If the last modification time of the drift file is later than both the current time and the RTC time, the system time will be set to it to restore the time when chronyd was previously stopped. This is useful on computers that have no RTC or the RTC is broken (e.g. it has no battery).

-t timeout

This option sets a timeout (in seconds) after which chronyd will exit. If the clock is not synchronised, it will exit with a non-zero status. This is useful with the -q or -Q option to shorten the maximum time waiting for measurements, or with the -r option to limit the time when chronyd is running, but still allow it to adjust the frequency of the system clock.

-u user

This option sets the name of the system user to which chronyd will switch after start in order to drop root privileges. It overrides the user directive. The compiled-in default value is _chrony. On Linux, chronyd needs to be compiled with support for the libcap library. On macOS, FreeBSD, NetBSD, and illumos chronyd forks into two processes. The child process retains root privileges, but can only perform a very limited range of privileged system calls on behalf of the parent.

-U

This option disables a check for root privileges to allow chronyd to be started under a non-root user, assuming the process will have all capabilities (e.g. provided by the service manager) and access to all files, directories, and devices, needed to operate correctly in the specified configuration. Note that different capabilities might be needed with different configurations and different Linux kernel versions. Starting chronyd under a non-root user is not recommended when the configuration is not known, or at least limited to specific directives.

-F level

This option configures system call filters loaded by chronyd processes if it was compiled with support for the Linux secure computing (seccomp) facility. Three levels are defined: 0, 1, 2. The filters are disabled at level 0. At levels 1 and 2, chronyd will be killed if it makes a system call which is blocked by the filters. The level can be specified as a negative number to trigger the SIGSYS signal instead of SIGKILL, which can be useful for debugging. The default value is 0. At level 1, the filters allow only selected system calls that are normally expected to be made by chronyd. Other system calls are blocked. This level is recommended only if it is known to work on the version of the system where chrony is installed. The filters need to allow also system calls made by libraries that chronyd is using (e.g. libc), but different versions or implementations of the libraries might make different system calls. If the filters are missing a system call, chronyd could be killed even in normal operation.

At level 2, the filters block only a small number of specific system calls (e.g. fork and exec). This approach should avoid false positives, but the protection of the system against a compromised chronyd process is much more limited.

The filters cannot be enabled with the mailonchange directive.

-P priority

On Linux, FreeBSD, NetBSD, and illumos this option will select the SCHED_FIFO real-time scheduler at the specified priority (which must be between 0 and 100). On macOS, this option must have either a value of 0 to disable the thread time constraint policy or 1 for the policy to be enabled. Other systems do not support this option. The default value is 0.

-m

This option will lock chronyd into RAM so that it will never be paged out. This mode is only supported on Linux, FreeBSD, NetBSD, and illumos.

-x

This option disables the control of the system clock. chronyd will not try to make any adjustments of the clock. It will assume the clock is free running and still track its offset and frequency relative to the estimated true time. This option allows chronyd to be started without the capability to adjust or set the system clock (e.g. in some containers) to operate as an NTP server.

-v, --version

With this option chronyd will print version number to the terminal and exit.

-h, --help

With this option chronyd will print a help message to the terminal and exit.

## ENVIRONMENT VARIABLES
LISTEN_FDS

On Linux systems, the systemd service manager may pass file descriptors for pre-initialised sockets to chronyd. The service manager allocates and binds the file descriptors, and passes a copy to each spawned instance of the service. This allows for zero-downtime service restarts as the sockets buffer client requests until the service is able to handle them. The service manager sets the LISTEN_FDS environment variable to the number of passed file descriptors.

NOTIFY_SOCKET

The systemd service manager sets this variable for services of the notify type. chronyd sends a message to this socket when it it is fully initialised and ready to accept commands (e.g. from chronyc), with the clock already set if using the -s option or initstepslew directive. It is an alternative to the forking service type, which does not need the PID file. chronyd needs to be started with the -n or -d option to not fork.

## FILES
/etc/chrony.conf

## SEE ALSO
chronyc(1), chrony.conf(5)

## BUGS
For instructions on how to report bugs, please visit <https://chrony-project.org/>.

## AUTHORS
chrony was written by Richard Curnow, Miroslav Lichvar, and others.


package: chrooted

title: update_chrooted(8)

summary: updates chrooted environments

text:
# update_chrooted(8)

## NAME
update_chrooted - updates chrooted environments

## SYNOPSIS
update_chrooted [options] <type>...

## DESCRIPTION
update_chrooted - updates chrooted environments according to specified types.

### Valid options are:
-l, --list

list registered types;

-f, --force

force update;

-v, --verbose

try to be more verbose;

-V, --version

print program version and exit;

-h, --help

show this text and exit.

## AUTHOR
Written by Dmitry V. Levin <ldv@altlinux.org>

## REPORTING BUGS
Report bugs to http://bugs.altlinux.ru/

## COPYRIGHT
Copyright © 2001-2005 Dmitry V. Levin <ldv@altlinux.org>

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.


cifs.idmap

package: cifs-utils

title: cifs.idmap(8)

text:
# cifs.idmap(8)

## NAME
cifs.idmap - Userspace helper for mapping ids for Common Internet File System (CIFS)

## SYNOPSIS
cifs.idmap [--help|-h] [--timeout|-t] [--version|-v] {keyid}

## DESCRIPTION
This tool is part of the cifs-utils suite.

cifs.idmap is a userspace helper program for the linux CIFS client filesystem. There are a number of activities that the kernel cannot easily do itself. This program is a callout program that does these things for the kernel and then returns the result.

cifs.idmap is generally intended to be run when the kernel calls request-key(8) for a particular key type. While it can be run directly from the command-line, it is not generally intended to be run that way.

This program is only called if a share is mounted with the cifsacl mount option. The kernel will only upcall to do this conversion if that mount option is specified.

cifs.idmap relies on a plugin to handle the ID mapping. If it can't find the plugin then it will not work properly. The plugin (or a symlink to it) must be at /usr/lib64/cifs-utils/idmap-plugin.

In the case where cifs.idmap or the plugin are unavailable, file objects in a mounted share are assigned uid and gid of the credentials of the process that mounted the share. It is strongly recomemended to use mount options of uid and gid to specify a default uid and gid to map owner SIDs and group SIDs in this situation.

## OPTIONS
--help|-h

Print the usage message and exit.

--timeout|-t

Set the expiration timer, in seconds on the key. The default is 600 seconds (10 minutes). Setting this to 0 will cause the key to never expire.

--version|-v

Print version number and exit.

## CONFIGURATION FOR KEYCTL
cifs.idmap is designed to be called from the kernel via the request-key callout program. This requires that request-key be told where and how to call this program. Currently cifs.idmap handles a key type of:

```
cifs.idmap
```

This keytype is for mapping a SID to either an uid or a gid.

To make this program useful for CIFS, you will need to set up entry for it in request-key.conf(5). Here is an example of an entry for this key type:

```
#OPERATION  TYPE           D C PROGRAM ARG1 ARG2...
#=========  =============  = = ================================
create      cifs.idmap     * * /usr/sbin/cifs.idmap %k
```

See request-key.conf(5) for more info on each field.

## NOTES
Support for upcalls to cifs.idmap was initially introduced in the 3.0 kernel.

## SEE ALSO
request-key.conf(5), mount.cifs(8)

## AUTHOR
Shirish Pargaonkar wrote the cifs.idmap program.

The Linux CIFS Mailing list is the preferred place to ask questions regarding these programs.


cifs.upcall

title: cifs.upcall(8)

text:
# cifs.upcall(8)

## NAME
cifs.upcall - Userspace upcall helper for Common Internet File System (CIFS)

## SYNOPSIS
cifs.upcall [--trust-dns|-t] [--version|-v] [--legacy-uid|-l]

[--krb5conf=/path/to/krb5.conf|-k /path/to/krb5.conf] [--keytab=/path/to/keytab|-K /path/to/keytab] [--expire|-e nsecs] {keyid}

## DESCRIPTION
This tool is part of the cifs-utils suite.

cifs.upcall is a userspace helper program for the linux CIFS client filesystem. There are a number of activities that the kernel cannot easily do itself. This program is a callout program that does these things for the kernel and then returns the result.

cifs.upcall is generally intended to be run when the kernel calls request-key(8) for a particular key type. While it can be run directly from the command-line, it's not generally intended to be run that way.

## OPTIONS
-c

This option is deprecated and is currently ignored.

--no-env-probe|-E

Normally, cifs.upcall will probe the environment variable space of the process that initiated the upcall in order to fetch the value of $KRB5CCNAME. This can assist the program with finding credential caches in non-default locations. If this option is set, then the program won't do this and will rely on finding credcaches in the default locations specified in krb5.conf. Note that this is never performed when the uid is 0. The default credcache location is always used when the uid is 0, regardless of the environment variable setting in the process.

--krb5conf|-k=/path/to/krb5.conf

This option allows administrators to set an alternate location for the krb5.conf file that cifs.upcall will use.

--keytab=|-K=/path/to/keytab

This option allows administrators to specify a keytab file to be used. When a user has no credential cache already established, cifs.upcall will attempt to use this keytab to acquire them. The default is the system-wide keytab /etc/krb5.keytab.

--trust-dns|-t

With krb5 upcalls, the name used as the host portion of the service principal defaults to the hostname portion of the UNC. This option allows the upcall program to reverse resolve the network address of the server in order to get the hostname. This is less secure than not trusting DNS. When using this option, it's possible that an attacker could get control of DNS and trick the client into mounting a different server altogether. It's preferable to instead add server principals to the KDC for every possible hostname, but this option exists for cases where that isn't possible. The default is to not trust reverse hostname lookups in this fashion.

--legacy-uid|-l

Traditionally, the kernel has sent only a single uid= parameter to the upcall for the SPNEGO upcall that's used to determine what user's credential cache to use. This parameter is affected by the uid= mount option, which also governs the ownership of files on the mount. Newer kernels send a creduid= option as well, which contains what uid it thinks actually owns the credentials that it's looking for. At mount time, this is generally set to the real uid of the user doing the mount. For multisession mounts, it's set to the fsuid of the mount user. Set this option if you want cifs.upcall to use the older uid= parameter instead of the creduid= parameter.

--expire|-e

Override default timeout value (600 seconds) for dns_resolver key.

--version|-v

Print version number and exit.

## ENVIRONMENT VARIABLES
GSS_USE_PROXY="yes"

Enable usage of gssproxy for credential retrieval. This includes keytab based client initiation as well as (Resource Based) Constrained Delegation. See gssproxy-mech(8).

## CONFIGURATION FOR KEYCTL
cifs.upcall is designed to be called from the kernel via the request-key callout program. This requires that request-key be told where and how to call this program. The current cifs.upcall program handles two different key types:

cifs.spnego

This keytype is for retrieving kerberos session keys

dns_resolver

This key type is for resolving hostnames into IP addresses. Support for this key type may eventually be deprecated (see below). To make this program useful for CIFS, you'll need to set up entries for them in request-key.conf(5). Here's an example of an entry for each key type:

```
#OPERATION  TYPE           D C PROGRAM ARG1 ARG2...
#=========  =============  = = ================================
create      cifs.spnego    * * /usr/sbin/cifs.upcall %k
create      dns_resolver   * * /usr/sbin/cifs.upcall %k
```

See request-key.conf(5) for more info on each field.

The keyutils package has also started including a dns_resolver handling program as well that is preferred over the one in cifs.upcall. If you are using a keyutils version equal to or greater than 1.5, you should use key.dns_resolver to handle the dns_resolver keytype instead of cifs.upcall. See key.dns_resolver(8) for more info.

## SEE ALSO
request-key.conf(5), mount.cifs(8), key.dns_resolver(8)

## AUTHOR
Igor Mammedov wrote the cifs.upcall program.

Jeff Layton authored this manpage.

The maintainer of the Linux CIFS VFS is Steve French.

The Linux CIFS Mailing list is the preferred place to ask questions regarding these programs.


idmapwb

title: idmapwb(8)

text:
# idmapwb(8)

## NAME
idmapwb.so - winbind ID mapping plugin for cifs-utils

## DESCRIPTION
This plugin allows the utilities in cifs-utils to work in conjuction with the winbind facility of Samba suite. It handles several functions including mapping UID and GID to SIDs and vice versa.

Utilities are usually configured to use the correct plugin by creating a symlink at /usr/lib64/cifs-utils/idmap-plugin that points to the correct plugin that you wish to use.

This plugin requires that winbindd(8) be properly configured and running.

## SEE ALSO
getcifsacl(1), setcifsacl(1), cifs.idmap(8), samba(7), smb.conf(5), winbindd(8)

## AUTHOR
idmapwb.so was written by Jeff Layton <jlayton@samba.org>