diff --git a/README.txt b/README.txt index 1cb7f0adc..cf1a1d594 100644 --- a/README.txt +++ b/README.txt @@ -1,5 +1,6 @@ Injects allow rules into binary SELinux kernel policies +Injecting a rule: $ ./sepolicy-inject -s shell -t system -c file -p read -P sepolicy -o sepolicy2 libsepol.policydb_index_others: security: 1 users, 2 roles, 518 types, 14 bools libsepol.policydb_index_others: security: 1 sens, 1024 cats @@ -14,11 +15,19 @@ Found 2 semantic av rules: allow shell system : file read ; allow appdomain domain : file { ioctl read getattr lock open } ; +Injecting a permissive domain: +$ ./sepolicy-inject -Z shell -P sepolicy -o sepolicy2 + +$ seinfo sepolicy | grep Permissive + Permissives: 0 Polcap: 2 + +$ seinfo sepolicy2 | grep Permissive + Permissives: 1 Polcap: 2 + TODO: Insert multiple rules at the same time Remove rules Use attributes -Add permissive domains