TOMOYO-LOADPOLICY(8)

NAME
tomoyo-loadpolicy - load TOMOYO Linux policy manually

SYNOPSIS
tomoyo-loadpolicy [options]

tomoyo-loadpolicy [options] <remote_ip:remote_port>

DESCRIPTION
This program reads TOMOYO Linux policy from standard input and loads it into the kernel.

OPTIONS
e
    Load exception policy. ( policy_dir/exception_policy.conf => /sys/kernel/security/tomoyo/exception_policy )

d
    Load domain policy. ( policy_dir/domain_policy.conf => /sys/kernel/security/tomoyo/domain_policy )

a
    Load exception policy and domain policy.

p
    Load profile. ( policy_dir/profile.conf => /sys/kernel/security/tomoyo/profile )

m
    Load manager. ( policy_dir/manager.conf => /sys/kernel/security/tomoyo/manager )

u
    Load meminfo. ( policy_dir/meminfo.conf => /sys/kernel/security/tomoyo/meminfo )

f
    Erase on-memory policy before loading on-disk policy. If not specified, on-disk policy is appended to on-memory policy. This option is valid for "eda" options.

-
    Read policy from stdin. Specify only one of "edpmu" option when you use this option.

<remote_ip:remote_port>
    Instead of writing to local kernel memory, write to an agent waiting at port <remote_port> on IP address <remote_ip>.

EXAMPLES
Add allow_read /proc/meminfo to exception policy:
echo "allow_read /proc/meminfo" | tomoyo-loadpolicy -e

Remove allow_read /proc/meminfo from exception policy:
echo "delete allow_read /proc/meminfo" | tomoyo-loadpolicy -e

Add allow_execute /sbin/init to <kernel> domain:
( echo "<kernel>"; echo "allow_execute /sbin/init" ) | tomoyo-loadpolicy -d

Replace currently loaded domain policy with policy_dir/domain_policy.conf:
tomoyo-loadpolicy df

Append policy_dir/domain_policy.conf into currently loaded domain policy:
tomoyo-loadpolicy d

Append /etc/tomoyo

tomoyo-loadpolicy d /etc/tomoyo/192.168.1.1/ 192.168.1.1:10000

    Append "/etc/tomoyo/192.168.1.1/domain_policy.conf to 192.168.1.1:10000:
    tomoyo-loadpolicy -d 192.168.1.1:10000 < /etc/tomoyo/192.168.1.1/domain_policy.conf

NOTES
Before this program can be invoked, it must be registered in /sys/kernel/security/tomoyo/manager.

BUGS
If there are any bugs, send an email with as much detail as possible to tomoyo-users-en@lists.sourceforge.jp

AUTHORS

Main authors:

    • Tetsuo Handa <penguin-kernel AT I-love.SAKURA.ne.jp>

Other contributers:

    • Jamie Nguyen <jamie AT tomoyolinux.co.uk>

    Man pages, documentation and website.

SEE ALSO

tomoyo-savepolicy(8), tomoyo-editpolicy(8), tomoyo-editpolicy-agent(8), tomoyo-init(8)

See http://tomoyo.sourceforge.jp/ for more information.