checkmodule: add support for specifying module policy version
Currently checkpolicy can produce binary policies for earlier policy versions
to provide support for building policies on one machine and loading/analyzing
them on another machine with an earlier version of the kernel or libsepol,
respectively. However, checkmodule was lacking this capability.
This commit adds an identical `-c` flag that can be passed to checkmodule that
will build a modular policy file of the specified version.
Signed-off-by: Gary Tierney <gary.tierney@fastmail.com>
diff --git a/checkpolicy/checkmodule.8 b/checkpolicy/checkmodule.8
index cf76591..e55582f 100644
--- a/checkpolicy/checkmodule.8
+++ b/checkpolicy/checkmodule.8
@@ -38,7 +38,7 @@
Enable the MLS/MCS support when checking and compiling the policy module.
.TP
.B \-V,\-\-version
- Show policy versions created by this program. Note that you cannot currently build older versions.
+Show policy versions created by this program.
.TP
.B \-o,\-\-output filename
Write a binary policy module file to the specified filename.
@@ -47,6 +47,9 @@
.TP
.B \-U,\-\-handle-unknown <action>
Specify how the kernel should handle unknown classes or permissions (deny, allow or reject).
+.TP
+.B \-c policyvers
+Specify the policy version, defaults to the latest.
.SH EXAMPLE
.nf