.TH "netlabelctl" 8 "31 May 2013" "paul@paul-moore.com" "NetLabel Documentation" .\" ////////////////////////////////////////////////////////////////////////// .SH NAME .\" ////////////////////////////////////////////////////////////////////////// netlabelctl \- NetLabel management utility .\" ////////////////////////////////////////////////////////////////////////// .SH SYNOPSIS .\" ////////////////////////////////////////////////////////////////////////// .B netlabelctl [] [] .\" ////////////////////////////////////////////////////////////////////////// .SH DESCRIPTION .\" ////////////////////////////////////////////////////////////////////////// .P The NetLabel management utility, netlabelctl, is a command line program designed to allow system administrators to configure the NetLabel system in the kernel. The utility is based around different "modules" which correspond to the different types of NetLabel commands supported by the kernel. .\" ////////////////////////////////////////////////////////////////////////// .SH OPTIONS .\" ////////////////////////////////////////////////////////////////////////// .SS Global Flags .TP 5 .B \-h Help message .TP 5 .B \-p Attempt to make the output human readable or "pretty" .TP 5 .B \-t Set a timeout to be used when waiting for the NetLabel subsystem to respond .TP 5 .B \-v Enable extra output .TP 5 .B \-V Display the version information .\" ////////////////////////////////////////////////////////////////////////// .SS Modules and Commands .TP 5 .B mgmt .P The management module is used to perform general queries about the NetLabel subsystem within the kernel. The different commands and their syntax are listed below. .HP .I version .br Display the kernel's NetLabel management protocol version. .HP .I protocols .br Display the kernel's list of supported labeling protocols. .TP 5 .B map .P The domain mapping module is used to map different NetLabel labeling protocols to either individual LSM domains or the default domain mapping. It is up to each LSM to determine what defines a domain. With SELinux, the normal SELinux domain should be used, i.e. "ping_t". In addition to protocol selection based only on the LSM domain, it is also possible to select the labeling protocol based on both the LSM domain and destination address. The network address selectors can specify either single hosts or entire networks and work for both IPv4 and IPv6, although the labeling protocol chosen must support the IP version chosen. When specifying the labeling protocol to use for each mapping there is an optional "extra" field which is used to further identify the specific labeling protocol configuration. When specifying the unlabeled protocol, "unlbl", an extra value of either "4" or "6" may be used. This restricts the mapping to IPv4 or IPv6 addresses. Omitting the extra value will result in a mapping for all address families. When specifying the CIPSO/IPv4 or the CALIPSO/IPv6 protocol, "cipso" or "calipso", the DOI value should be specified; see the EXAMPLES section for details. The different commands and their syntax are listed below. .HP .I add default|domain: [address:[/]] protocol:[,] .br Add a new LSM domain / network address to NetLabel protocol mapping. .HP .I del default|domain: .br Delete an existing LSM domain to NetLabel protocol mapping. .HP .I list .br Display all of the configured LSM domain to NetLabel protocol mappings. .TP 5 .B unlbl .P The unlabeled (unlbl) module controls the unlabeled protocol which is used both when labeling outgoing traffic is not desired as well as when unlabeled traffic is received by the system. This module allows administrators to block all unlabeled packets from the system through the "accept" flag and assign static, or fallback, security labels to unlabeled traffic based on the inbound network interface and source address. .HP .I accept on|off .br Toggle the unlabeled traffic accept flag. .HP .I add default|interface: address:[/] label: