security_load_policy(3)

💖 security_load_policy — SELinux API documentation, section 3 💖

okay bestie, sit down, hydrate, and let me tell you about the three little functions that swap out your SELinux policy like it's a whole new wardrobe ✨

---

🌸 NAME 🌸

security_load_policy — load a new SELinux policy. that's it, that's the whole vibe. a fresh policy, served hot 🔥

---

🎀 SYNOPSIS 🎀

#include <selinux/selinux.h>

int security_load_policy(const void *data, size_t len);

int selinux_mkload_policy(int preservebools);

int selinux_init_load_policy(int *enforce);

three functions, one header, zero drama (okay maybe a little drama, it's SELinux) 💅

---

👑 DESCRIPTION 👑

✨ security_load_policy ✨

security_load_policy() loads a new policy. that's the whole job. it returns 0 when everything's slay and -1 when it's a flop 😭

🦋 selinux_mkload_policy 🦋

selinux_mkload_policy() makes a policy image and loads it. this one is the high-level bestie — a way comfier interface for loading policy than security_load_policy(). it's out here doing the most, internally:

• determining the right policy version
• locating and opening the policy file
• mapping it into memory
• manipulating it as needed for current boolean settings and/or local definitions
• and then calling security_load_policy to actually load it

preservebools is a boolean flag, and it's basically asking "are we keeping the current policy boolean values?" — so if it's 1, yes, the current policy boolean values get preserved into the new policy. if it's 0, nope, they get reset to the saved policy settings instead. and listen, the 1 case is the default for policy reloads, while the 0 case is an option for policy reloads too, but it's primarily used for the initial policy load. two moods, both valid 🫶

🌈 selinux_init_load_policy 🌈

selinux_init_load_policy() performs the initial policy load. main character energy fr fr. this function:

• determines the desired enforcing mode
• sets the enforce argument accordingly so the caller can use it
• sets the SELinux kernel enforcing status to match it
• and loads the policy

it also internally handles the initial selinuxfs mount that's required to do all of the above. lowkey doing a lot of work behind the scenes, respect 💜

⚠️ okay this part matters so pay attention bestie. it should also be noted that after the initial policy load, the SELinux kernel code cannot anymore be disabled, and the selinuxfs cannot be unmounted using a call to security_disable(3). so like… that door closes. therefore, after the initial policy load, the only operational changes are those permitted by security_setenforce(3) — i.e. eventually setting the framework in permissive mode rather than in enforcing one. that's the whole menu after that point. no take-backs, no cap 💀

---

💅 RETURN VALUE 💅

returns zero on success, or -1 on error. simple as that, periodt ✨

---

🌟 AUTHOR 🌟

this manual page has been written by Guido Trentalancia <guido@trentalancia.com>. king behaviour, we love a credited author 👑

---

⭐ SEE ALSO ⭐

• selinux(8)
• security_disable(3)
• setenforce(8)

---

and that's the page!! 🎀 this was written by guido@trentalancia.com, dated 3 November 2009, and it lives in section 3 as security_load_policy(3) — go forth and load policies responsibly, bestie 💖🦋🌸