NAME

       security_load_policy - load a new SELinux policy

SYNOPSIS

       #include <selinux/selinux.h>

       int security_load_policy(const void *data, size_t len);

       int selinux_mkload_policy(int preservebools);

       int selinux_init_load_policy(int *enforce);

DESCRIPTION

       security_load_policy() loads a new policy, returns 0 for success and -1 for error.

       selinux_mkload_policy() makes a policy image and loads it. This function provides a higher
       level interface for loading policy than security_load_policy(), internally determining the
       right  policy  version,  locating  and  opening  the  policy file, mapping it into memory,
       manipulating it as needed for current boolean settings and/or local definitions, and  then
       calling  security_load_policy  to  load  it.   preservebools  is a boolean flag indicating
       whether current policy boolean values should be preserved into the new policy  (if  1)  or
       reset  to  the  saved  policy  settings  (if 0). The former case is the default for policy
       reloads, while the latter case is an option for policy reloads but is primarily  used  for
       the  initial  policy  load.   selinux_init_load_policy() performs the initial policy load.
       This function determines the desired enforcing mode, sets the enforce argument accordingly
       for the caller to use, sets the SELinux kernel enforcing status to match it, and loads the
       policy. It also internally handles the initial selinuxfs mount required to  perform  these
       actions.

       It should also be noted that after the initial policy load, the SELinux kernel code cannot
       anymore  be  disabled  and  the  selinuxfs  cannot  be   unmounted   using   a   call   to
       security_disable(3).   Therefore,  after  the  initial  policy  load, the only operational
       changes are  those  permitted  by  security_setenforce(3)  (i.e.  eventually  setting  the
       framework in permissive mode rather than in enforcing one).

RETURN VALUE

       Returns zero on success or -1 on error.

AUTHOR

       This manual page has been written by Guido Trentalancia <guido@trentalancia.com>

SEE ALSO

       selinux(8), security_disable(3), setenforce(8)