security_g...lean_names(3)

💅 security_g...lean_names(3) 💅

ok so bestie, we're in section 3 of the SELinux API Documentation and this page is literally the whole booleans situation. it's giving "runtime policy glow-up without reloading anything" and honestly? iconic. 🎀

✨ NAME ✨

security_set_boolean, security_commit_booleans, security_get_boolean_names, security_get_boolean_active, security_get_boolean_pending — the routines for manipulating SELinux boolean values 🦋

like, all five of them, together, in one little group chat. no cap.

🌸 SYNOPSIS 🌸

#include <selinux/selinux.h>

int security_get_boolean_names(char ***names, int *len);

int security_get_boolean_pending(const char *name);

int security_get_boolean_active(const char *name);

int security_set_boolean(const char *name, int value);

int security_set_boolean_list(size_t boolcnt, SELboolean *boollist, int
permanent);

int security_commit_booleans(void);

yes bestie, security_set_boolean_list is here too, even though it wasn't in the NAME list. she's the ✨surprise guest✨ of this function family.

💖 DESCRIPTION 💖

okay so, the SELinux policy can have conditional rules in it — rules that get enabled or disabled depending on what the current values of a set of policy booleans are. and the way that these policy booleans work is they let you modify the security policy at runtime without having to load a whole new policy. no reload, no reboot, no drama. 🧚

the SELinux API gives you a transaction based update, which is so slay of it. so the move is: you set several boolean values, and then you commit them all at once. group project, but everyone actually shows up. 😭

• security_get_boolean_names() — hands you a list of boolean names that are currently supported by the loaded policy. the whole roster. 💅
• security_get_boolean_pending() — returns the pending value for the boolean, or -1 on failure. 🙈
• security_get_boolean_active() — returns the active value for the boolean, or -1 on failure. 🫶
• security_set_boolean() — sets the pending value for the boolean. 🔥
• security_set_boolean_list() — saves a list of booleans in a single transaction. but heads up: that int permanent flag is deprecated and you should set it to zero. not optional, not a vibe, just do it. 💀
• security_commit_booleans() — commits all the pending values for the booleans. the final "post it" button. ⭐

ngl, the transaction thing is the whole point: pending values just chill there until you commit. it's giving staged changes, and committing is the push. 👑

⭐ RETURN VALUE ⭐

where it's not otherwise stated, the functions described on this manual page return zero on success or -1 on error. so 0 = slay, -1 = not slay. simple as that. 🌈

👑 AUTHOR 👑

this manual page was written by Dan Walsh <dwalsh@redhat.com>. king behavior fr fr. 🎀

🦋 SEE ALSO 🦋

• selinux(8)
• getsebool(8)
• booleans(8)
• togglesebool(8)

go read those too bestie, they're the extended universe. ✨

and that's the whole page!! 💖 written by dwalsh@redhat.com, dated 15 November 2004, from the SELinux API Documentation — security_g...lean_names(3), out. periodt. 💅🌸🫶