CL(8)

NAME
cl, integrity - file system label check

SYNOPSIS
/etc/cl [ specfile | dir ] ...

/etc/integrity [ rootdir ]

DESCRIPTION
Cl examines file trees for correctness of labels. Each specfile argument names a file containing a description of the labels expected in a given subtree of a file system. Each line of a specfile has the form

    filename uid,gid mode capabilities licenses label

User and group ids are specified in the style of chown(8). The mode is specified in the style of chmod(2); only the 07777 bits are significant. Capabilities and licenses are in the style of atopriv; see labtoa(3). The label is in the style of atolab, without capabilities or licenses.

The first valid line names the root of the tree in question. Subsequent lines name particular files in the tree. A report is made for each `suspicious' file and for each particular file which does not match its description in specfile.

A suspicious file is a file that is not named in the specfile for which one of the following holds:

    The label has flag L_UNDEF or L_YES.
    The file is a special file the label flag is L_NO.
    The file is not a special file the label flag is not L_NO.
    The lattice value of the label is not dominated by the label in the first line of specfile.
    The capability or license is not dominated by the corresponding value in the first line of specfile.

Each named directory argument dir is treated as if there were a specfile argument consisting of just a single line

        dir bin,bin 666 ----- ----- 0000...
    Integrity surveys the directory tree dependent from rootdir, or if no rootdir is given. It reports non-bottom labels, which are possible signs of loss of integrity - modification without privilege. The search cuts off at directories with non-bottom labels.

SEE ALSO
getflab(2), ftw(3), lcheck(8)

BUGS
Extraneous diagnostics may be produced if this command is applied to active file systems.