TOMOYO-LOADPOLICY(8)

📦 version 2.6.1-20210910, in debian bookworm, ubuntu jammy, ubuntu noble, ubuntu questing

💖 TOMOYO-LOADPOLICY 💖

okay bestie, so this one lives in the System Administration Utilities corner of the tomoyo-loadpolicy(8) manual, and it's literally the girl who feeds TOMOYO Linux policy straight into your kernel. no cap. 🎀

✨ NAME ✨

tomoyo-loadpolicy — load TOMOYO Linux manually

🦋 SYNOPSIS 🦋

tomoyo-loadpolicy [option]

tomoyo-loadpolicy [option] [remote_ip:remote_port]

🌸 DESCRIPTION 🌸

So like. This program reads TOMOYO Linux policy from standard input and loads it into the kernel. That's the whole job. It's giving very "I take your words and I put them where they belong" energy and honestly? obsessed. 💅

👑 OPTIONS 👑

  • -e — Append to /sys/kernel/security/tomoyo/exception_policy. 🫶
  • -ef — Overwrite /sys/kernel/security/tomoyo/exception_policy. (yes bestie, the f is for full send, like, replace it entirely)
  • -d — Append to /sys/kernel/security/tomoyo/domain_policy.
  • -df — Overwrite /sys/kernel/security/tomoyo/domain_policy.
  • -m — Append to /sys/kernel/security/tomoyo/manager.
  • -p — Append to /sys/kernel/security/tomoyo/profile.
  • -s — Append to /sys/kernel/security/tomoyo/stat.
  • remote_ip:remote_port — Write to policy on a remote system via an agent waiting at port remote_port on IP address remote_ip. long-distance relationship core 🌈

🍓 EXAMPLES 🍓

okay so here's where it gets fun, actual receipts:

Append a line to exception policy

echo "acl_group 0 file read proc:/meminfo" | tomoyo-loadpolicy -e

Remove a line from exception policy

echo "delete acl_group 0 file read proc:/meminfo" | tomoyo-loadpolicy -e

Append a line to domain policy

( echo "<kernel>"; echo "file execute /sbin/init" ) | tomoyo-loadpolicy -d

Replace currently loaded domain policy

tomoyo-loadpolicy -df < /etc/tomoyo/domain_policy.conf

Append to policy remotely

tomoyo-loadpolicy -d 192.168.1.1:10000 < /etc/tomoyo/192.168.1.1/domain_policy.conf

Remove a line from "/sys/kernel/security/tomoyo/manager"

echo "delete /usr/sbin/tomoyo-queryd" | tomoyo-loadpolicy -m

💀 BUGS 💀

If you find any bugs, send an email to <tomoyo-users-en@lists.osdn.me>. not me asking you to actually email them though — like, please do, they wanna know 🥺

🧚 AUTHORS 🧚

  • Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    • Main author. main character energy fr fr 👑
  • Jamie Nguyen <jamie@tomoyolinux.co.uk>
    • Documentation and website. the PR girlie of the operation 💖

🌈 SEE ALSO 🌈

tomoyo-savepolicy(8), tomoyo-editpolicy(8), tomoyo-editpolicy-agent(8), tomoyo-init(8)

See <https://tomoyo.osdn.jp> for more information. (go look, iykyk ⭐)

bestie reminder: policy goes in through standard input, kernel gets it, and you look iconic doing it. slay. 💅✨

and that's the tea, babes — this page is from tomoyo-tools 2.6.0, dated 2019-02-05, and it's part of the System Administration Utilities collection. periodt. 🎀🦋💜

📦 where this page comes from