tripathysagar/man_text huggingface dataset:
# tc-route

## NAME



           route - route traffic control filter
    


## SYNOPSIS



           **tc filter**... **route**[ **from** _REALM_ | **fromif** _TAG_ ] [ **to** _REALM_ ] [
                   **classid** _CLASSID_ ] [ **action** _ACTION_SPEC_ ]
    


## DESCRIPTION



           Match packets based on routing table entries. This filter centers
           around the possibility to assign a **realm** to routing table entries.
           For any packet to be classified by this filter, a routing table
           lookup is performed and the returned **realm** is used to decide on
           whether the packet is a match or not.
    


## OPTIONS



           **action** _ACTION_SPEC_
                  Apply an action from the generic actions framework on
                  matching packets.
    
           **classid** _CLASSID_
                  Push matching packets into the class identified by _CLASSID_.
    
           **from** _REALM_
           **fromif** _TAG_
                  Perform source route lookups.  _TAG_ is the name of an
                  interface which must be present on the system at the time
                  of **tc** invocation.
    
           **to** _REALM_
                  Match if normal (i.e., destination) routing returns the
                  given _REALM_.
    


## EXAMPLES



           Consider the subnet 192.168.2.0/24 being attached to eth0:
    
                  ip route add 192.168.2.0/24 dev eth0 realm 2
    
           The following **route** filter will then match packets from that
           subnet:
    
                  tc filter add ... route from 2 classid 1:2
    
           and pass packets on to class 1:2.
    


## NOTES



           Due to implementation details, **realm** values must be in a range
           from 0 to 255, inclusive. Alternatively, a verbose name defined in
           /etc/iproute2/rt_realms may be given instead.
    


* * *
# rpmgraph

## NAME



           rpmgraph - Display RPM Package Dependency Graph
    


## SYNOPSIS



           **rpmgraph** _PACKAGE_FILE ..._
    


## DESCRIPTION



           **rpmgraph** uses _PACKAGE_FILE_ arguments to generate a package
           dependency graph.  Each _PACKAGE_FILE_ argument is read and added to
           an rpm(8) transaction set.  The elements of the transaction set
           are partially ordered using a topological sort.  The partially
           ordered elements are then printed to standard output.
    
           Nodes in the dependency graph are package names, and edges in the
           directed graph point to the parent of each node.  The parent node
           is defined as the last predecessor of a package when partially
           ordered using the package dependencies as a relation.  That means
           that the parent of a given package is the package's last
           prerequisite.
    
           The output is in **dot**(1) directed graph format, and can be
           displayed or printed using the **dotty** graph editor from the
           **graphviz** package.  There are no **rpmgraph** specific options, only
           common **rpm** options.  See the **rpmgraph** usage message for what is
           currently implemented.
    


* * *
# systemd-time-wait-sync.service

## NAME



           systemd-time-wait-sync.service, systemd-time-wait-sync - Wait
           until kernel time is synchronized
    


## SYNOPSIS



           systemd-time-wait-sync.service
    
           /usr/lib/systemd/systemd-time-wait-sync
    


## DESCRIPTION



           systemd-time-wait-sync is a system service that delays the start
           of units that are ordered after time-sync.target (see
           systemd.special(7) for details) until the system time has been
           synchronized with an accurate remote reference time source by
           systemd-timesyncd.service.
    
           systemd-timesyncd.service notifies systemd-time-wait-sync about
           successful synchronization.  systemd-time-wait-sync also tries to
           detect when the kernel marks the system clock as synchronized, but
           this detection is not reliable and is intended only as a fallback
           for compatibility with alternative NTP services that can be used
           to synchronize time (e.g., ntpd, chronyd).
    


## FILES



           /run/systemd/timesync/synchronized
               The presence of this file indicates to this service that the
               system clock has been synchronized.
    
               Added in version 239.
    


* * *
# faillock

## NAME



           faillock - Tool for displaying and modifying the authentication
           failure record files
    


## SYNOPSIS



    
           **faillock**[--dir _/path/to/tally-directory_] [--user _username_]
                    [--reset]
    


## DESCRIPTION



           The _pam_faillock.so_ module maintains a list of failed
           authentication attempts per user during a specified interval and
           locks the account in case there were more than _deny_ consecutive
           failed authentications. It stores the failure records into
           per-user files in the tally directory.
    
           The **faillock** command is an application which can be used to
           examine and modify the contents of the tally files. It can display
           the recent failed authentication attempts of the _username_ or clear
           the tally files of all or individual _usernames_.
    


## OPTIONS



           **--conf** _/path/to/config-file_
               The file where the configuration is located. The default is
               /etc/security/faillock.conf.
    
           **--dir** _/path/to/tally-directory_
               The directory where the user files with the failure records
               are kept.
    
               The priority to set this option is to use the value provided
               from the command line. If this isn't provided, then the value
               from the configuration file is used. Finally, if neither of
               them has been provided, then /var/run/faillock is used.
    
           **--user** _username_
               The user whose failure records should be displayed or cleared.
    
           **--reset**
               Instead of displaying the user's failure records, clear them.
    


## FILES



           /var/run/faillock/*
               the files logging the authentication failures for users
    


* * *
# pam_nologin

## NAME



           pam_nologin - Prevent non-root users from login
    


## SYNOPSIS



    
           **pam_nologin.so**[file=_/path/nologin_] [successok]
    


## DESCRIPTION



           pam_nologin is a PAM module that prevents users from logging into
           the system when /var/run/nologin or /etc/nologin exists. The
           contents of the file are displayed to the user. The pam_nologin
           module has no effect on the root user's ability to log in.
    


## OPTIONS



           **file=**_/path/nologin_
               Use this file instead the default /var/run/nologin or
               /etc/nologin.
    
           **successok**
               Return PAM_SUCCESS if no file exists, the default is
               PAM_IGNORE.
    


## MODULE TYPES PROVIDED



           The **auth** and **account** module types are provided.
    


## RETURN VALUES



           PAM_AUTH_ERR
               The user is not root and /etc/nologin exists, so the user is
               not permitted to log in.
    
           PAM_BUF_ERR
               Memory buffer error.
    
           PAM_IGNORE
               This is the default return value.
    
           PAM_SUCCESS
               Success: either the user is root or the nologin file does not
               exist.
    
           PAM_USER_UNKNOWN
               User not known to the underlying authentication module.
    


## EXAMPLES



           The suggested usage for /etc/pam.d/login is:
    
               auth  required  pam_nologin.so
    


## NOTES



           In order to make this module effective, all login methods should
           be secured by it. It should be used as a _required_ method listed
           before any _sufficient_ methods in order to get standard Unix
           nologin semantics. Note, the use of **successok** module argument
           causes the module to return _PAM_SUCCESS_ and as such would break
           such a configuration - failing _sufficient_ modules would lead to a
           successful login because the nologin module _succeeded_.
    


* * *
# tc-connmark

## NAME



           connmark - netfilter connmark retriever action
    


## SYNOPSIS



           **tc**... **action connmark**[ **zone** _u16_zone_index_ ] [ _CONTROL_ ] [ **index**
                   _u32_index_ ]
    
           _CONTROL_ := { _reclassify_ | _pipe_ | _drop_ | _continue_ | _ok_ }
    


## DESCRIPTION



           The connmark action is used to restore the connection's mark value
           into the packet's fwmark.
    


## OPTIONS



           **zone** _u16_zone_index_
                  Specify the conntrack zone when doing conntrack lookups for
                  packets.  _u16_zone_index_ is a 16bit unsigned decimal value.
    
           _CONTROL_
                  How to continue after executing this action.
    
                  **reclassify**
                         Restarts classification by jumping back to the first
                         filter attached to this action's parent.
    
                  **pipe** Continue with the next action, this is the default.
    
                  **drop**
                  **shot** Packet will be dropped without running further
                         actions.
    
                  **continue**
                         Continue classification with next filter in line.
    
                  **pass** Return to calling qdisc for packet processing. This
                         ends the classification process.
    
           **index** _u32_index_
                  Specify an index for this action in order to being able to
                  identify it in later commands.  _u32_index_ is a 32bit
                  unsigned decimal value.
    


* * *
# dcb-dcbx

## NAME



           dcb-dcbx - show / manipulate port DCBX (Data Center Bridging
           eXchange)
    


## SYNOPSIS



           **dcb**[ _OPTIONS_ ] **dcbx**{ _COMMAND_ | _help_ }
    
           **dcb dcbx show dev** DEV
    
           **dcb dcbx set dev** DEV [ **host**] [ **lld-managed**] [ **cee**] [ **ieee**] [
                   **static**]
    


## DESCRIPTION



           Data Center Bridging eXchange (DCBX) is a protocol used by DCB
           devices to exchange configuration information with directly
           connected peers. The Linux DCBX object is a 1-byte bitfield of
           flags that configure whether DCBX is implemented in the device or
           in the host, and which version of the protocol should be used.
           **dcb dcbx** is used to access the per-port Linux DCBX object.
    
           There are two principal modes of operation: in **host** mode, DCBX
           protocol is implemented by the host LLDP agent, and the DCB
           interfaces are used to propagate the negotiate parameters to
           capable devices. In **lld-managed** mode, the configuration is handled
           by the device, and DCB interfaces are used for inspection of
           negotiated parameters, and can also be used to set initial
           parameters.
    


## PARAMETERS



           When used with **dcb dcbx set,** the following keywords enable the
           corresponding configuration. The keywords that are not mentioned
           on the command line are considered disabled. When used with **show,**
           each enabled feature is shown by its corresponding keyword.
    
           **host**
           **lld-managed**
                  The device is in the host mode of operation and,
                  respectively, the lld-managed mode of operation, as
                  described above. In principle these two keywords are
                  mutually exclusive, but **dcb dcbx** allows setting both and
                  lets the driver handle it as appropriate.
    
           **cee**
           **ieee** The device supports CEE (Converged Enhanced Ethernet) and,
                  respectively, IEEE version of the DCB specification.
                  Typically only one of these will be set, but **dcb dcbx** does
                  not mandate this.
    
           **static** indicates the engine supports static configuration. No
                  actual negotiation is performed, negotiated parameters are
                  always the initial configuration.
    


## EXAMPLE & USAGE



           Put the DCB engine into the "host" mode of operation, and use
           IEEE-standardized DCB interfaces:
    
           # dcb dcbx set dev eth0 host ieee
    
           Show what was set:
    
           # dcb dcbx show dev eth0
           host ieee
    


## EXIT STATUS



           Exit status is 0 if command was successful or a positive integer
           upon failure.
    


* * *
# tc-fw

## NAME



           fw - fwmark traffic control filter
    


## SYNOPSIS



           **tc filter**... **fw**[ **classid** _CLASSID_ ] [ **action** _ACTION_SPEC_ ]
    


## DESCRIPTION



           the **fw** filter allows one to classify packets based on a previously
           set **fwmark** by **iptables**.  If the masked value of the **fwmark** matches
           the filter's masked **handle** , the filter matches. By default, all 32
           bits of the **handle** and the **fwmark** are masked.  **iptables** allows one
           to mark single packets with the **MARK** target, or whole connections
           using **CONNMARK**.  The benefit of using this filter instead of doing
           the heavy-lifting with **tc** itself is that on one hand it might be
           convenient to keep packet filtering and classification in one
           place, possibly having to match a packet just once, and on the
           other users familiar with **iptables** but not **tc** will have a less
           hard time adding QoS to their setups.
    


## OPTIONS



           **classid** _CLASSID_
                  Push matching packets to the class identified by _CLASSID_.
    
           **action** _ACTION_SPEC_
                  Apply an action from the generic actions framework on
                  matching packets.
    


## EXAMPLES



           Take e.g. the following tc filter statement:
    
                  tc filter add ... handle 6 fw classid 1:1
    
           will match if the packet's **fwmark** value is **6**.  This is a sample
           **iptables** statement marking packets coming in on eth0:
    
                  iptables -t mangle -A PREROUTING -i eth0 -j MARK --set-mark 6
    
           Specific bits of the packet's **fwmark** can be set using the **skbedit**
           action. For example, to only set one bit of the **fwmark** without
           changing any other bit:
    
                  tc filter add ... action skbedit mark 0x8/0x8
    
           The **fw** filter can then be used to match on this bit by masking the
           **handle:**
    
                  tc filter add ... handle 0x8/0x8 fw action drop
    
           This is useful when different bits of the **fwmark** are assigned
           different meanings.
    


* * *
# kmod

## NAME



           kmod - Program to manage Linux Kernel modules
    


## SYNOPSIS



           **kmod**[**OPTIONS...**] [_COMMAND_] [**COMMAND_OPTIONS...**]
    


## DESCRIPTION



           **kmod** is a multi-call binary which implements the programs used to
           control Linux Kernel modules. Most users will only run it using
           its other names.
    


## OPTIONS



           **-V** , **--version**
               Show the program version and exit.
    
           **-h** , **--help**
               Show the help message.
    


## COMMANDS



           **help**
               Show the help message.
    
           **list**
               List the currently loaded modules.
    
           **static-nodes**
               Output the static device nodes information provided by the
               modules of the currently running kernel version.
    


## BUGS



           Please direct any bug reports to kmod's issue tracker at
           https://github.com/kmod-project/kmod/issues/ alongside with
           version used, steps to reproduce the problem and the expected
           outcome.
    


* * *
# ip-netconf

## NAME



           ip-netconf - network configuration monitoring
    


## SYNOPSIS



           **ip**[ ip-OPTIONS ] **netconf show**[ **dev** _NAME_ ]
    


## DESCRIPTION



           The **ip netconf** utility can monitor IPv4 and IPv6 parameters (see
           **/proc/sys/net/ipv[4|6]/conf/[all|DEV]/**) like forwarding,
           rp_filter, proxy_neigh, ignore_routes_with_linkdown or
           mc_forwarding status.
    
           If no interface is specified, the entry **all** is displayed.
    
       **ip netconf show - display network parameters**
           **dev** _NAME_
                  the name of the device to display network parameters for.
    


* * *
# slapdn

## NAME



           slapdn - Check a list of string-represented LDAP DNs based on
           schema syntax
    


## SYNOPSIS



           **SBINDIR/slapdn**[**-d** _debug-level_] [**-f** _slapd.conf_] [**-F** _confdir_]
           [**-N** |**-P**] [**-o** _option_[**=**_value_]] [**-v**] _DN_ [...]
    


## DESCRIPTION



           **Slapdn** is used to check the conformance of a DN based on the
           schema defined in slapd(8) and that loaded via slapd.conf(5).  It
           opens the slapd.conf(5) configuration file or the slapd-config (5)
           backend, reads in the schema definitions, and then parses the _DN_
           list given on the command-line.
    


## OPTIONS



           **-d** _debug-level_
                  enable debugging messages as defined by the specified
                  _debug-level_ ; see slapd(8) for details.
    
           **-f** _slapd.conf_
                  specify an alternative slapd.conf(5) file.
    
           **-F** _confdir_
                  specify a config directory.  If both **-f** and **-F** are
                  specified, the config file will be read and converted to
                  config directory format and written to the specified
                  directory.  If neither option is specified, an attempt to
                  read the default config directory will be made before
                  trying to use the default config file. If a valid config
                  directory exists then the default config file is ignored.
    
           **-N** only output a normalized form of the _DN_ , suitable to be
                  used in a normalization tool; incompatible with **-P**.
    
           **-o** _option_[**=**_value_]
                  Specify an _option_ with a(n optional) _value_.  Possible
                  generic options/values are:
    
                         syslog=<subsystems>  (see `-s' in slapd(8))
                         syslog-level=<level> (see `-S' in slapd(8))
                         syslog-user=<user>   (see `-l' in slapd(8))
    
           **-P** only output a prettified form of the _DN_ , suitable to be
                  used in a check and beautification tool; incompatible with
                  **-N**.
    
           **-v** enable verbose mode.
    


## EXAMPLES



           To check a **DN** give the command:
    
                SBINDIR/slapdn -f /ETCDIR/slapd.conf -v DN
    


## ACKNOWLEDGEMENTS



           **OpenLDAP Software** is developed and maintained by The OpenLDAP
           Project <http://www.openldap.org/>.  **OpenLDAP Software** is derived
           from the University of Michigan LDAP 3.3 Release.
    


* * *
# tc-choke

## NAME



           choke - choose and keep scheduler
    


## SYNOPSIS



           **tc qdisc ... choke limit** packets **min** packets **max** packets **avpkt**
           bytes **burst** packets **[ ecn ] [ bandwidth** rate **] probability** chance
    


## DESCRIPTION



           CHOKe (CHOose and Keep for responsive flows, CHOose and Kill for
           unresponsive flows) is a classless qdisc designed to both identify
           and penalize flows that monopolize the queue. CHOKe is a variation
           of RED, and the configuration is similar to RED.
    


## ALGORITHM



           Once the queue hits a certain average length, a random packet is
           drawn from the queue. If both the to-be-queued and the drawn
           packet belong to the same flow, both packets are dropped.
           Otherwise, if the queue length is still below the maximum length,
           the new packet has a configurable chance of being marked (which
           may mean dropped).  If the queue length exceeds **max** , the new
           packet will always be marked (or dropped).  If the queue length
           exceeds **limit** , the new packet is always dropped.
    
           The marking probability computation is the same as used by the RED
           qdisc.
    


## PARAMETERS



           The parameters are the same as for RED, except that RED uses bytes
           whereas choke counts packets. See tc-red(8) for a description.
    


## SOURCE



           o      R. Pan, B. Prabhakar, and K. Psounis, "CHOKe, A Stateless
                  Active Queue Management Scheme for Approximating Fair
                  Bandwidth Allocation", IEEE INFOCOM, 2000.
    
           o      A. Tang, J. Wang, S. Low, "Understanding CHOKe: Throughput
                  and Spatial Characteristics", IEEE/ACM Transactions on
                  Networking, 2004
    


* * *
# findfs

## NAME



           findfs - find a filesystem by label or UUID
    


## SYNOPSIS



           **findfs NAME** =_value_
    


## DESCRIPTION



           **findfs** will search the block devices in the system looking for a
           filesystem or partition with specified tag. The currently
           supported tags are:
    
           **LABEL** =_< label>_
               Specifies filesystem label.
    
           **UUID** =_< uuid>_
               Specifies filesystem UUID.
    
           **PARTUUID** =_< uuid>_
               Specifies partition UUID. This partition identifier is
               supported for example for GUID Partition Table (GPT) partition
               tables.
    
           **PARTLABEL** =_< label>_
               Specifies partition label (name). The partition labels are
               supported for example for GUID Partition Table (GPT) or MAC
               partition tables.
    
           If the filesystem or partition is found, the device name will be
           printed on stdout. If the input is not in the format of
           NAME=value, then the input will be copied to the output without
           any modification.
    
           The complete overview about filesystems and partitions you can get
           for example by
    
              **lsblk --fs**
    
              **partx --show <disk>**
    
              **blkid**
    
           **-h** , **--help**
               Display help text and exit.
    
           **-V** , **--version**
               Display version and exit.
    


## EXIT STATUS



           **0**
               success
    
           **1**
               label or uuid cannot be found
    
           **2**
               usage error, wrong number of arguments or unknown option
    


## ENVIRONMENT



           LIBBLKID_DEBUG=all
               enables libblkid debug output.
    


## AVAILABILITY



           The **findfs** command is part of the util-linux package which can be
           downloaded from Linux Kernel Archive
           <https://www.kernel.org/pub/linux/utils/util-linux/>. This page is
           part of the _util-linux_ (a random collection of Linux utilities)
           project. Information about the project can be found at 
           ⟨https://www.kernel.org/pub/linux/utils/util-linux/⟩. If you have a
           bug report for this manual page, send it to
           util-linux@vger.kernel.org. This page was obtained from the
           project's upstream Git repository
           ⟨git://git.kernel.org/pub/scm/utils/util-linux/util-linux.git⟩ on
           2025-08-11. (At that time, the date of the most recent commit that
           was found in the repository was 2025-08-05.) If you discover any
           rendering problems in this HTML version of the page, or you
           believe there is a better or more up-to-date source for the page,
           or you have corrections or improvements to the information in this
           COLOPHON (which is _not_ part of the original manual page), send a
           mail to man-pages@man7.org
    
    util-linux 2.42-start-521-ec46  2025-08-09                      _FINDFS_(8)
    


* * *
# iptables-save

## NAME



           iptables-save — dump iptables rules
    
           ip6tables-save — dump iptables rules
    


## SYNOPSIS



           **iptables-save**[**-M** _modprobe_] [**-c**] [**-t** _table_] [**-f** _filename_]
    
           **ip6tables-save**[**-M** _modprobe_] [**-c**] [**-t** _table_] [**-f** _filename_]
    


## DESCRIPTION



           **iptables-save** and **ip6tables-save** are used to dump the contents of
           IP or IPv6 Table in easily parseable format either to STDOUT or to
           a specified file.
    
           **-M** , **--modprobe** _modprobe_
                  Specify the path to the modprobe(8) program. By default,
                  iptables-save will inspect _/proc/sys/kernel/modprobe_ to
                  determine the executable's path.
    
           **-f** , **--file** _filename_
                  Specify a filename to log the output to. If not specified,
                  iptables-save will log to STDOUT.
    
           **-c** , **--counters**
                  Include the current values of all packet and byte counters
                  in the output.
    
           **-t** , **--table** _tablename_
                  Restrict output to only one table. If the kernel is
                  configured with automatic module loading, an attempt will
                  be made to load the appropriate module for that table if it
                  is not already there.
                  If not specified, output includes all available tables. No
                  module loading takes place, so in order to include a
                  specific table in the output, the respective module
                  (something like **iptable_mangle** or **ip6table_raw**) must be
                  loaded first.
    


## BUGS



           None known as of iptables-1.2.1 release
    


* * *
# showmount

## NAME



           showmount - show mount information for an NFS server
    


## SYNOPSIS



           **showmount [ -adehv ] [ --all ] [ --directories ] [ --exports ]**
           **[ --help ] [ --version ] [ host ]**
    


## DESCRIPTION



           **showmount** queries the mount daemon on a remote host for
           information about the state of the NFS server on that machine.
           With no options **showmount** lists the set of clients who are
           mounting from that host.  The output from **showmount** is designed to
           appear as though it were processed through ``sort -u''.
    


## OPTIONS



           **-a** or **--all**
                  List both the client hostname or IP address and mounted
                  directory in host:dir format. This info should not be
                  considered reliable. See the notes on rmtab in
                  rpc.mountd(8).
    
           **-d** or **--directories**
                  List only the directories mounted by some client.
    
           **-e** or **--exports**
                  Show the NFS server's export list.
    
           **-h** or **--help**
                  Provide a short help summary.
    
           **-v** or **--version**
                  Report the current version number of the program.
    
           **--no-headers**
                  Suppress the descriptive headings from the output.
    


## BUGS



           The completeness and accuracy of the information that **showmount**
           displays varies according to the NFS server's implementation.
    
           Because **showmount** sorts and uniqs the output, it is impossible to
           determine from the output whether a client is mounting the same
           directory more than once.
    
           **showmount** works by contacting the server's MNT service directly.
           NFSv4-only servers have no need to advertise their exported root
           filehandles via this method, and may not expose their MNT service
           to clients.
    


* * *
# rpmdeps

## NAME



           rpmdeps - Generate RPM Package Dependencies
    


## SYNOPSIS



           **rpmdeps {-P|--provides} {-R|--requires} {--rpmfcdebug}**_FILE ..._
    


## DESCRIPTION



           **rpmdeps** generates package dependencies for the set of _FILE_
           arguments.  Each _FILE_ argument is searched for Elf32/Elf64, script
           interpreter, or per-script dependencies, and the dependencies are
           printed to stdout.
    


## OPTIONS



           **-P, --provides**
                  Print the provides
    
           **-R, --requires**
                  Print the requires
    
           **--recommends**
                  Print the recommends
    
           **--suggests**
                  Print the suggests
    
           **--supplements**
                  Print the supplements
    
           **--enhances**
                  Print the enhances
    
           **--conflicts**
                  Print the conflicts
    
           **--obsoletes**
                  Print the obsoletes
    
           **--alldeps**
                  Print all the dependencies
    


* * *
# sepolicy

## NAME



           sepolicy - SELinux Policy Inspection tool
    


## SYNOPSIS



           **sepolicy [-h] [-P policy_path ]**
           **{booleans,communicate,generate,interface,manpage,network,transition}**
           **OPTIONS**
    
           Arguments:
    
           **booleans**
           Query SELinux policy to see description of booleans
           **sepolicy-boolean**(8)
    
           **communicate**
           Query SELinux policy to see if domains can communicate with each
           other sepolicy-communicate(8)
    
           **generate**
           Generate SELinux Policy module template sepolicy-generate(8)
    
           **gui**
           Launch Graphical User Interface for SELinux Policy, requires
           policycoreutils-gui package.  sepolicy-gui(8)
    
           **interface**
           Print SELinux Policy interface information sepolicy-interface(8)
    
           **manpage**
           Generate SELinux man pages sepolicy-manpage(8)
    
           **network**
           Query SELinux policy network information sepolicy-network(8)
    
           **transition**
           Query SELinux Policy to see how a source process domain can
           transition to the target process domain sepolicy-transition(8)
    


## DESCRIPTION



           sepolicy is a tools set that will query the installed SELinux
           policy and generate useful reports, man pages, or even new policy
           modules.  See the argument specific man pages for options and
           descriptions.
    


## OPTIONS



           _-P, --policy_
                  Alternate policy to analyze. (Defaults to currently
                  installed policy /sys/fs/selinux/policy)
    
           _-h, --help_
                  Display help message
    


* * *
# systemd-update-utmp.service

## NAME



           systemd-update-utmp.service, systemd-update-utmp - Write audit and
           utmp updates at bootup and shutdown
    


## SYNOPSIS



           systemd-update-utmp.service
    
           /usr/lib/systemd/systemd-update-utmp
    


## DESCRIPTION



           systemd-update-utmp.service is a service that writes system
           reboots and shutdown requests to utmp and wtmp, as well as the
           audit logs.
    


* * *
# captree

## NAME



           captree - display tree of process capabilities
    


## SYNOPSIS



           **captree**[OPTIONS] [(_pid_ |_glob-name_) ...]
    


## DESCRIPTION



           **captree** displays the capabilities on the mentioned processes
           indicated by _pid_ or _glob-name_ value(s) given on the command line.
           If no _pid_ etc values are supplied, _pid_ =1 is implied. A _pid_ value
           of 0 displays all the processes known to the kernel.
    
           The POSIX.1e capabilities are displayed in double quotes in the
           cap_from_text(3) format. The IAB tuple of capabilities is
           displayed between square brackets in the text format described in
           cap_iab(3).  Both of these text formats are described in
           cap_text_formats(7).  Note, the IAB tuple text is omitted if it
           contains empty A and B components. This is because the regular
           POSIX.1e text contains information about the Inheritable flag
           already. This behavior can be overridden with the **--verbose**
           command line argument.
    
           Optional arguments (which must precede the list of pid|glob-name
           values):
    
           **--help** Displays usage information and exits. Note, modern Go
                  runtimes exit with status 0 in this case, but older
                  runtimes exit with status 2.
    
           **--verbose**
                  Displays capability sets and IAB tuples even when they are
                  empty, or redundant.
    
           **--depth** _=n_
                  Displays the process tree to a depth of _n_.  Note, the
                  default value for this parameter is 0, which implies
                  infinite depth.
    
           **--colo[u]r** _=false_
                  Colo[u]rs the targeted PIDs, if stdout is a TTY, in red.
                  This option defaults to true when running via a TTY. The
                  **--color** _=false_ argument will suppress this color. Piping the
                  output into some other program will also suppress the use
                  of colo[u]r.
    


## EXIT STATUS



           If the supplied target cannot be found the exit status is 1.
           Should an unrecognized option be provided, the exit status is 2.
           Otherwise, **captree** exits with status 0.
    


* * *
# quotastats

## NAME



           **quotastats** - Program to query quota statistics
    


## SYNOPSIS



           _/usr/sbin/quotastats_
    


## DESCRIPTION



           **quotastats** queries the kernel for quota statistics.  It displays:
    
               •      Supported kernel quota version
               •      Number of dquot lookups
               •      Number of dquot drops
               •      Number of dquot reads
               •      Number of dquot writes
               •      Number of quotafile syncs
               •      Number of dquot cache hits
               •      Number of allocated dquots
               •      Number of free dquots
               •      Number of in use dquot entries (user/group)
    


## OPTIONS



           None.
    


* * *
# systemd-binfmt.service

## NAME



           systemd-binfmt.service, systemd-binfmt - Configure additional
           binary formats for executables at boot
    


## SYNOPSIS



           systemd-binfmt.service
    
           /usr/lib/systemd/systemd-binfmt
    


## DESCRIPTION



           systemd-binfmt.service is an early boot service that registers
           additional binary formats for executables in the kernel.
    
           See binfmt.d(5) for information about the configuration of this
           service.
    


## OPTIONS



           **--unregister**
               If passed, instead of registering configured binary formats in
               the kernel, the reverse operation is executed: all currently
               registered binary formats are unregistered from the kernel.
    
               Added in version 246.
    
           **--cat-config**
               Copy the contents of config files to standard output. Before
               each file, the filename is printed as a comment.
    
           **--tldr**
               Copy the contents of config files to standard output. Only the
               "interesting" parts of the configuration files are printed,
               comments and empty lines are skipped. Before each file, the
               filename is printed as a comment.
    
           **--no-pager**
               Do not pipe output into a pager.
    
           **-h** , **--help**
               Print a short help text and exit.
    
           **--version**
               Print a short version string and exit.
    


* * *
# sendmail

## NAME



           **sendmail** — a mail enqueuer for _smtpd_(8)
    


## SYNOPSIS



           **sendmail**[**-tv**] [**-F** _name_] [**-f** _from_] _to ..._
    


## DESCRIPTION



           The **sendmail** utility is a local enqueuer for the _smtpd_(8) daemon,
           compatible with _mailwrapper_(8).  The message is read on standard
           input (stdin) until **sendmail** encounters an end-of-file.  The
           **sendmail** enqueuer is not intended to be used directly to send
           mail, but rather via a frontend known as a mail user agent.
    
           Unless the optional **-t** flag is specified, one or more recipients
           must be specified on the command line.
    
           The options are as follows:
    
           **-F** _name_
                   Set the sender's full name.
    
           **-f** _from_
                   Set the sender's address.
    
           **-t** Read the message's To:, Cc:, and Bcc: fields for
                   recipients.  The Bcc: field will be deleted before
                   sending.
    
           **-v** Enable verbose output.
    
           To maintain compatibility with Sendmail, Inc.'s implementation of
           **sendmail** , various other flags are accepted, but have no effect.
    


## EXIT STATUS



           The utility exits 0 on success, and >0 if an error occurs.
    


* * *
# seunshare

## NAME



           seunshare - Run cmd with alternate homedir, tmpdir and/or SELinux
           context
    


## SYNOPSIS



           **seunshare**[ -v ] [ -C ] [ -k ] [ -t tmpdir ] [ -h homedir ] [ -Z
           context ] -- executable [args]
    


## DESCRIPTION



           Run the _executable_ within the specified context, using custom home
           directory and /tmp directory. The seunshare command unshares from
           the default namespace, then mounts the specified homedir and
           tmpdir over the default homedir and /tmp. Finally it tells the
           kernel to execute the application under the specified SELinux
           context.
    
           **-h homedir**
                  Alternate homedir to be used by the application. Homedir
                  must be owned by the user
    
           **-t tmpdir**
                  Use alternate temporary directory to mount on /tmp. tmpdir
                  must be owned by the user
    
           **-r runuserdir**
                  Use alternate temporary directory to mount on
                  XDG_RUNTIME_DIR (/run/user/$UID). runuserdir must be owned
                  by the user
    
           **-C --capabilities**
                  Allow apps executed within the namespace to use
                  capabilities. Default is no capabilities
    
           **-k --kill**
                  Kill all processes with matching MCS level
    
           **-Z context**
                  Use alternate SELinux context while running the executable
    
           **-v** Verbose output
    


## EXAMPLE



           Run bash with temporary /home and /tmp directory
           # USERHOMEDIR=`mktemp -d /tmp/home.XXXXXX`; USERTEMPDIR=`mktemp -d /tmp/temp.XXXXXX`
           # seunshare -v -h ${USERHOMEDIR} -t ${USERTEMPDIR} -- /bin/bash
    


* * *
# semanage-module

## NAME



           **semanage-module - SELinux Policy Management module mapping tool**
    


## SYNOPSIS



           **semanage module [-h] [-n] [-N] [-S STORE] (-a | -r | -e | -d |**
           **--extract | --list [-C] | --deleteall) [module_name]**
    


## DESCRIPTION



           semanage is used to configure certain elements of SELinux policy
           without requiring modification to or recompilation from policy
           sources.  **semanage module** installs, removes, disables, or enables
           SELinux Policy modules.
    


## OPTIONS



           _-h, --help_
                  Show this help message and exit
    
           _-n, --noheading_
                  Do not print heading when listing the specified object type
    
           _-N, --noreload_
                  Do not reload policy after commit
    
           _-S STORE, --store STORE_
                  Select an alternate SELinux Policy Store to manage
    
           _-a, --add_
                  Install specified module. Accepts both binary policy files
                  (.pp) and CIL source files
    
           _-r, --remove_
                  Remove specified module
    
           _-D, --deleteall_
                  Remove all local customizations related to modules
    
           _-d --disable_
                  Disable specified module
    
           _-e --enable_
                  Enable specified module
    
           _-E, --extract_
                  Extract customizable commands, for use within a transaction
    
           _-l, --list_
                  List records of the specified object type
    
           _-C, --locallist_
                  List local customizations
    


## EXAMPLE



           List all modules
           # semanage module -l
           Disable unconfined module
           # semanage module --disable unconfined
           Install custom apache policy module (same as #semodule -i myapache.pp)
           # semanage module -a myapache.pp
    


* * *
# ibstatus

## NAME



           ibstatus - query basic status of InfiniBand device(s)
    


## SYNOPSIS



           ibstatus [-h] [devname[:port]]...
    


## DESCRIPTION



           ibstatus is a script which displays basic information obtained
           from the local IB driver. Output includes LID, SMLID, port state,
           link width active, and port physical state.
    


## OPTIONS



           **-h, --help** show the usage message
    
           **devname**
                  InfiniBand device name
    
           **portnum**
                  port number of InfiniBand device
    


## EXAMPLES



              ibstatus                    # display status of all IB ports
              ibstatus mthca1             # status of mthca1 ports
              ibstatus mthca1:1 mthca0:2  # show status of specified ports
    


* * *
# semanage-node

## NAME



           **semanage-node - SELinux Policy Management node mapping tool**
    


## SYNOPSIS



           **semanage node [-h] [-n] [-N] [-S STORE] [ --add -M NETMASK -p**
           **PROTOCOL -t TYPE -r RANGE node | --delete -M NETMASK -p PROTOCOL**
           **node | --deleteall | --extract | --list [-C] | --modify -M NETMASK**
           **-p PROTOCOL -t TYPE -r RANGE node ]**
    


## DESCRIPTION



           semanage is used to configure certain elements of SELinux policy
           without requiring modification to or recompilation from policy
           sources.  **semanage node** controls the IP address to node type
           definitions.
    


## OPTIONS



           _-h, --help_
                  Show this help message and exit
    
           _-n, --noheading_
                  Do not print heading when listing the specified object type
    
           _-N, --noreload_
                  Do not reload policy after commit
    
           _-S STORE, --store STORE_
                  Select an alternate SELinux Policy Store to manage
    
           _-C, --locallist_
                  List local customizations
    
           _-a, --add_
                  Add a record of the specified object type
    
           _-d, --delete_
                  Delete a record of the specified object type
    
           _-m, --modify_
                  Modify a record of the specified object type
    
           _-l, --list_
                  List records of the specified object type
    
           _-E, --extract_
                  Extract customizable commands, for use within a transaction
    
           _-D, --deleteall_
                  Remove all local customizations
    
           _-M NETMASK, --netmask NETMASK_
                  Network Mask, either in CIDR (/16) or address mask notation
                  (255.255.0.0, ffff::)
    
           _-t TYPE, --type TYPE_
                  SELinux type for the object
    
           _-r RANGE, --range RANGE_
                  MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range
                  for SELinux login mapping defaults to the SELinux user
                  record range. SELinux Range for SELinux user defaults to
                  s0.
    
           _-p PROTO, --proto PROTO_
                  Protocol for the specified port (tcp|udp) or internet
                  protocol version for the specified node (ipv4|ipv6).
    


## EXAMPLE



           Apply type node_t to ipv4 node 127.0.0.2
           # semanage node -a -t node_t -p ipv4 -M 255.255.255.255 127.0.0.2
    


* * *
# memhog

## NAME



           memhog - Allocates memory with policy for testing
    


## SYNOPSIS



           **memhog**[ **-r <NUM> **] [ **size kmg**] [ **policy nodeset**] [ **-f <filename>**
           ]
    


## DESCRIPTION



           **memhog** mmaps a memory region for a given size and sets the numa
           policy (if specified).  It then updates the memory region for the
           given number of iterations using memset.
           -r<num>    Repeat memset NUM times
           -f<file>   Open file for mmap backing
           -H         Disable transparent hugepages
           -size      Allocation size in bytes, may have case-insensitive order
                      suffix (G=gigabyte, M=megabyte, K=kilobyte)
    
           Supported numa-policies:
    
           **interleave**
                  Memory will be allocated using round robin on nodes. When
                  memory cannot be allocated on the current interleave,
                  target fall back to other nodes.  Multiple nodes may be
                  specified.
    
           **membind**
                  Only  allocate  memory  from  nodes. Allocation will fail
                  when there is not enough memory available on these nodes.
                  Multiple nodes  may be specified.
    
           **preferred**
                  Preferably allocate memory on node, but if memory cannot be
                  allocated  there  fall  back  to other nodes.  This option
                  takes only a single node number.
    
           **default**
                  Memory will be allocated on the local node (the node the
                  thread is running on)
    


## EXAMPLES



           # Allocate a 1G region, mmap backed by memhog.mmap file, membind
           to node 0, repeat test 6 times
                  memhog -r6 1G --membind 0 -fmemhog.mmap
    
           # Allocate a 1G region, interleave across nodes 0,1,2,3, repeat
           test 4 times
                  memhog -r4 1G --interleave 0-3
    
           # Allocate a 1G region, (implicit) default policy, repeat test 8
           times
                  memhog -r8 1G
    


## LICENSE



           GPL v2
    


* * *