---
name: "sepol_genusers"
section: "3"
platform: "linux"
package: "libsepol1-dev"
version: "2.8-1"
release: "Debian 10 (Buster)"
platforms: ["linux"]
url: "https://new.carta.tech/sepol_genusers"
---

# sepol\_genusers(3)

Generate a new binary policy image with a customized user configuration

## NAME

sepol\_genusers - Generate a new binary policy image with a customized user configuration

## SYNOPSIS

**#include \<sepol/sepol.h\>**

**int sepol\_genusers(void \****data***, size\_t** *len***, const char \****usersdir***, void \****newdata***, size\_t \****newlen);*

**void sepol\_set\_delusers(int** *on***);**

## DESCRIPTION

**sepol\_genusers** generates a new binary policy image from  an existing binary policy image stored in the memory region described by the starting address *data* and the length *len* and a pair of user configuration files named  **system.users** and **local.users** from the directory specified by *usersdir.* The resulting binary policy is placed into dynamically allocated memory and the variables *newdata* and *newlen* are set to refer to the new binary image's starting address and length. The original binary policy image is not modified.

By default,  **sepol\_genusers** will preserve user entries that are defined in the original binary policy image but not defined in the user configuration files.  If such user entries should instead by omitted entirely from the new binary policy image, then the **sepol\_set\_delusers** function may be called with  *on* set to 1 prior to calling **sepol\_genusers** in order to enable deletion of such users.

## RETURN VALUE

Returns 0 on success or -1 otherwise, with errno set appropriately. An errno of ENOENT indicates that one or both of the user configuration files did not exist.  An errno of EINVAL indicates that either the original binary policy image or the generated one were invalid.  An errno of ENOMEM indicates that insufficient memory was available to process the original binary policy image or to generate the new policy image.  Invalid entries in the user configuration files are skipped with a warning.