chcat

package: policycoreutils

title: chcat(8)

summary: change file SELinux security category

text:
# chcat(8)

## NAME
chcat - change file SELinux security category

## SYNOPSIS
chcat category file...

chcat -l category user...

chcat [[+|-]category...] file...

chcat -l [[+|-]category...] user...

chcat [-d] file...

chcat -l [-d] user...

chcat -L [ -l ] [ user ... ]

## DESCRIPTION
Change/Remove the security category for each file or user.

Use +/- to add/remove categories from a file or user.

Note: When removing a category you must specify '--' on the command line before using the -Category syntax. This tells the command that you have finished entering options and are now specifying a category name instead.

-d

delete the category from each FILE/USER.

-L

list available categories.

-l

Tells chcat to operate on users instead of files.

## SEE ALSO
chcon(1), selinux(8), semanage(8)

When operating on files this script wraps the chcon command.

## FILES
/etc/selinux/{SELINUXTYPE}/setrans.conf

/etc/selinux/{SELINUXTYPE}/seusers


fixfiles

title: fixfiles(8)

summary: fix file SELinux security contexts.

text:
# fixfiles(8)

## NAME
fixfiles - fix file SELinux security contexts.

## SYNOPSIS
fixfiles [-v] [-F] [-M] [-f] relabel

fixfiles [-v] [-F] { check | restore | verify } dir/file ...

fixfiles [-v] [-F] [-B | -N time ] { check | restore | verify }

fixfiles [-v] [-F] -R rpmpackagename[,rpmpackagename...] { check | restore | verify }

fixfiles [-v] [-F] -C PREVIOUS_FILECONTEXT { check | restore | verify }

fixfiles [-F] [-M] [-B] onboot

## DESCRIPTION
This manual page describes the fixfiles script.

This script is primarily used to correct the security context database (extended attributes) on filesystems.

It can also be run at any time to relabel when adding support for new policy, or just check whether the file contexts are all as you expect. By default it will relabel all mounted ext2, ext3, ext4, gfs2, xfs, jfs and btrfs file systems as long as they do not have a security context mount option. You can use the -R flag to use rpmpackages as an alternative. The file /etc/selinux/fixfiles_exclude_dirs can contain a list of directories excluded from relabeling.

fixfiles onboot will setup the machine to relabel on the next reboot.

## OPTIONS
-B

If specified with onboot, this fixfiles will record the current date in the /.autorelabel file, so that it can be used later to speed up labeling. If used with restore, the restore will only affect files that were modified today.

-F

Force reset of context to match file_context for customizable files

-f

Clear /tmp directory with out prompt for removal.

-R rpmpackagename[,rpmpackagename...]

Use the rpm database to discover all files within the specified packages and restore the file contexts.

-C PREVIOUS_FILECONTEXT

Run a diff on the PREVIOUS_FILECONTEXT file to the currently installed one, and restore the context of all affected files.

-N time

Only act on files created after the specified date. Date must be specified in "YYYY-MM-DD HH:MM" format. Date field will be passed to find --newermt command.

-M

Bind mount filesystems before relabeling them, this allows fixing the context of files or directories that have been mounted over.

-v

Modify verbosity from progress to verbose. (Run restorecon with -v instead of -p)

## ARGUMENTS
One of:

check | verify

print any incorrect file context labels, showing old and new context, but do not change them.

restore

change any incorrect file context labels.

relabel

Prompt for removal of contents of /tmp directory and then change any incorrect file context labels to match the install file_contexts file.

[[dir/file] ... ]

List of files or directories trees that you wish to check file context on.

## AUTHOR
This man page was written by Richard Hally <rhally@mindspring.com>. The script was written by Dan Walsh <dwalsh@redhat.com>

## SEE ALSO
setfiles(8), restorecon(8)


genhomedircon

title: genhomedircon(8)

text:
# genhomedircon(8)

## NAME
genhomedircon - generate SELinux file context configuration entries for user home directories

## DESCRIPTION
genhomedircon is a script that executes semodule to rebuild the currently active SELinux policy (without reloading it) and to create the labels for each user home directory based on directory paths returned by calls to getpwent().

The latter functionality depends on the "usepasswd" parameter being set to "true" (default) in /etc/selinux/semanage.conf.

This script is usually executed by semanage although this default behavior can be optionally modified by setting to "true" the "disable-genhomedircon" in /etc/selinux/semanage.conf.

Directories can be excluded from the list of home directories by the setting "ignoredirs" in /etc/selinux/semanage.conf.

## AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>

## SEE ALSO
semanage.conf(5), semodule(8), semanage(8), getpwent(3), getpwent_r(3)


title: load_policy(8)

text:
# load_policy(8)

## NAME
load_policy - load a new SELinux policy into the kernel

## SYNOPSIS
load_policy [-qi]

## DESCRIPTION
load_policy loads the installed policy file into the kernel. The existing policy boolean values are automatically preserved across policy reloads rather than being reset to the default values in the policy file.

## OPTIONS
-q

suppress warning messages.

-i

initial policy load. Only use this if this is the first time policy is being loaded since boot (usually called from initramfs).

## EXIT STATUS
0

Success

1

Invalid option

2

Policy load failed

3

Initial policy load failed and enforcing mode requested

## SEE ALSO
booleans(8)

## AUTHORS

```
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
The program was written by Stephen Smalley <sds@tycho.nsa.gov>.
```


title: open_init_pty(8)

summary: run an program under a pseudo terminal

text:
# open_init_pty(8)

## NAME
open_init_pty - run an program under a pseudo terminal

## SYNOPSIS
open_init_pty SCRIPT [[ARGS]...]

## DESCRIPTION
Run a program under a pseudo terminal. This is used by run_init to run actually run the program after setting up the proper context. This program acquires a new Pseudo terminal, forks a child process that binds to the pseudo terminal, and then sits around and connects the physical terminal it was invoked upon with the pseudo terminal, passing keyboard input into to the child process, and passing the output of the child process to the physical terminal.

It sets up the pseudo terminal properly based on the physical terminal attributes, and then sets the user's terminal to RAW mode, taking care to reset it on exit.

## AUTHOR
This manual page was written by Manoj Srivastava <srivasta@debian.org>, for the Debian GNU/Linux system.


restorecon

title: restorecon(8)

text:
# restorecon(8)

## NAME
restorecon - restore file(s) default SELinux security contexts.

## SYNOPSIS
restorecon [-r|-R] [-m] [-n] [-p] [-v] [-i] [-F] [-W] [-I|-D] [-x] [-e directory] pathname ...

restorecon [-f infilename] [-e directory] [-r|-R] [-m] [-n] [-p] [-v] [-i] [-F] [-W] [-I|-D] [-x]

## DESCRIPTION
This manual page describes the restorecon program.

This program is primarily used to set the security context (extended attributes) on one or more files.

It can also be run at any other time to correct inconsistent labels, to add support for newly-installed policy or, by using the -n option, to passively check whether the file contexts are all set as specified by the active policy (default behavior).

If a file object does not have a context, restorecon will write the default context to the file object's extended attributes. If a file object has a context, restorecon will only modify the type portion of the security context. The -F option will force a replacement of the entire context.

If a file is labeled with customizable SELinux type (for list of customizable types see /etc/selinux/{SELINUXTYPE}/contexts/customizable_types), restorecon won't reset the label unless the -F option is used.

It is the same executable as setfiles but operates in a slightly different manner depending on its argv[0].

## OPTIONS
-e directory

exclude a directory (repeat the option to exclude more than one directory, Requires full path).

-f infilename

infilename contains a list of files to be processed. Use “-” for stdin.

-F

Force reset of context to match file_context for customizable files, and the default file context, changing the user, role, range portion as well as the type.

-h, -?

display usage information and exit.

-i

ignore files that do not exist.

-I

ignore digest to force checking of labels even if the stored SHA1 digest matches the specfiles SHA1 digest. The digest will then be updated provided there are no errors. See the NOTES section for further details.

-D

Set or update any directory SHA1 digests. Use this option to enable usage of the security.sehash extended attribute.

-m

do not read /proc/mounts to obtain a list of non-seclabel mounts to be excluded from relabeling checks. Setting this option is useful where there is a non-seclabel fs mounted with a seclabel fs mounted on a directory below this.

-n

don't change any file labels (passive check). To display the files whose labels would be changed, add -v.

-o outfilename

Deprecated - This option is no longer supported.

-p

show progress by printing the number of files in 1k blocks unless relabeling the entire OS, that will then show the approximate percentage complete. Note that the -p and -v options are mutually exclusive.

-R, -r

change files and directories file labels recursively (descend directories).

-v

show changes in file labels. Multiple -v options increase the verbosity. Note that the -v and -p options are mutually exclusive.

-W

display warnings about entries that had no matching files by outputting the selabel_stats(3) results.

-0

the separator for the input items is assumed to be the null character (instead of the white space). The quotes and the backslash characters are also treated as normal characters that can form valid input. This option finally also disables the end of file string, which is treated like any other argument. Useful when input items might contain white space, quote marks or backslashes. The -print0 option of GNU find produces input suitable for this mode.

-x

prevent restorecon from crossing file system boundaries.

## ARGUMENTS
pathname ... The pathname for the file(s) to be relabeled.

## NOTES
1.

restorecon by default does not operate recursively on directories. Paths leading up the final component of the file(s) are canonicalized using realpath(3) before labeling.

2.

If the pathname specifies the root directory and the -vR or -vr options are set and the audit system is running, then an audit event is automatically logged stating that a "mass relabel" took place using the message label FS_RELABEL.

3.

To improve performance when relabeling file systems recursively (i.e. the -R or -r option is set), the -D option to restorecon will cause it to store a SHA1 digest of the default specfiles set in an extended attribute named security.sehash on each directory specified in pathname ... once the relabeling has been completed successfully. These digests will be checked should restorecon -D be rerun with the same pathname parameters. See selinux_restorecon(3) for further details. The -I option will ignore the SHA1 digest from each directory specified in pathname ... and provided the -n option is NOT set and recursive mode is set, files will be relabeled as required with the digests then being updated provided there are no errors.

## AUTHOR
This man page was written by Dan Walsh <dwalsh@redhat.com>. Some of the content of this man page was taken from the setfiles man page written by Russell Coker <russell@coker.com.au>. The program was written by Dan Walsh <dwalsh@redhat.com>.

## SEE ALSO
setfiles(8), fixfiles(8), load_policy(8), checkpolicy(8), customizable_types(5)


title: restorecon_xattr(8)

summary: manage

text:
# restorecon_xattr(8)

## NAME
restorecon_xattr - manage security.sehash extended attribute entries added by setfiles(8) or restorecon(8).

## SYNOPSIS
restorecon_xattr [-d] [-D] [-m] [-n] [-r] [-v] [-e directory] [-f specfile] pathname

## DESCRIPTION
restorecon_xattr will display the SHA1 digests added to extended attributes security.sehash or delete the attribute completely. These attributes are set by restorecon(8) or setfiles(8) to specified directories when relabeling recursively.

restorecon_xattr is useful for managing the extended attribute entries particularly when users forget what directories they ran restorecon(8) or setfiles(8) from.

RAMFS and TMPFS filesystems do not support the security.sehash extended attribute and are automatically excluded from searches.

By default restorecon_xattr will display the SHA1 digests with "Match" appended if they match the default specfile set or the specfile set used with the -f option. Non-matching SHA1 digests will be displayed with "No Match" appended. This feature can be disabled by the -n option.

## OPTIONS
-d

delete all non-matching security.sehash directory digest entries.

-D

delete all security.sehash directory digest entries.

-m

do not read /proc/mounts to obtain a list of non-seclabel mounts to be excluded from relabeling checks.

Setting -m is useful where there is a non-seclabel fs mounted with a seclabel fs mounted on a directory below this.

-n

Do not append "Match" or "No Match" to displayed digests.

-r

recursively descend directories.

-v

display SHA1 digest generated by specfile set (Note that this digest is not used to match the security.sehash directory digest entries, and is shown for reference only).

-e

directory

directory to exclude (repeat option for more than one directory).

-f

specfile

an optional specfile containing file context entries as described in file_contexts(5). If the option is not specified, then the default file_contexts will be used.

## ARGUMENTS
pathname

the pathname of the directory tree to be searched.

## SEE ALSO
restorecon(8), setfiles(8)


title: run_init(8)

text:
# run_init(8)

## NAME
run_init - run an init script in the proper SELinux context

## SYNOPSIS
run_init SCRIPT [[ARGS]...]

## DESCRIPTION
Run a init script under the proper context, which is specified in /etc/selinux/POLICYTYPE/contexts/initrc_context. It is generally used interactively as it requires either shadow or PAM user authentication (depending on compile-time options). It should be possible to configure PAM such that interactive input is not required. Check your PAM documentation.

## FILES
/etc/passwd - user account information

/etc/shadow - encrypted passwords and age information

/etc/selinux/POLICYTYPE/contexts/initrc_context - contains the context to run init scripts under

## SEE ALSO
newrole(1), runcon(1)

## AUTHORS

```
Wayne Salamon (wsalamon@tislabs.com)
Dan Walsh (dwalsh@redhat.com)
```


semanage

title: semanage(8)

summary: SELinux Policy Management tool

text:
# semanage(8)

## NAME
semanage - SELinux Policy Management tool

## SYNOPSIS
semanage {import,export,login,user,port,interface,module,node,fcontext,boolean,permissive,dontaudit,ibpkey,ibendport}

... positional arguments:

import Import local customizations

export Output local customizations

login Manage login mappings between linux users and SELinux confined users

user Manage SELinux confined users (Roles and levels for an SELinux user)

port Manage network port type definitions

interface Manage network interface type definitions

module Manage SELinux policy modules

node Manage network node type definitions

fcontext Manage file context mapping definitions

boolean Manage booleans to selectively enable functionality

permissive Manage process type enforcement mode

dontaudit Disable/Enable dontaudit rules in policy

ibpkey Manage infiniband pkey type definitions

ibendport Manage infiniband end port type definitions

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. This includes the mapping from Linux usernames to SELinux user identities (which controls the initial security context assigned to Linux users when they login and bounds their authorized role set) as well as security context mappings for various kinds of objects, such as network ports, interfaces, infiniband pkeys and endports, and nodes (hosts) as well as the file context mapping. Note that the semanage login command deals with the mapping from Linux usernames (logins) to SELinux user identities, while the semanage user command deals with the mapping from SELinux user identities to authorized role sets. In most cases, only the former mapping needs to be adjusted by the administrator; the latter is principally defined by the base policy and usually does not require modification.

## OPTIONS
-h, --help

List help information

## SEE ALSO
selinux(8), semanage-boolean(8), semanage-dontaudit(8), semanage-export(8), semanage-fcontext(8), semanage-import(8), semanage-interface(8), semanage-login(8), semanage-module(8), semanage-node(8), semanage-permissive(8), semanage-port(8), semanage-user(8) semanage-ibkey(8), semanage-ibendport(8),

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>

and Russell Coker <rcoker@redhat.com>.

Examples by Thomas Bleher <ThomasBleher@gmx.de>. usage: semanage [-h]


semanage-boolean

title: semanage-boolean(8)

summary: SELinux Policy Management boolean tool

text:
# semanage-boolean(8)

## NAME
semanage-boolean - SELinux Policy Management boolean tool

## SYNOPSIS
semanage boolean [-h] [-n] [-N] [-S STORE] [ --extract | --deleteall | --list [-C] | --modify ( --on | --off ) boolean ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage boolean command controls the settings of booleans in SELinux policy. booleans are if-then-else rules written in SELinux Policy. They can be used to customize the way that SELinux Policy rules effect a confined domain.

## OPTIONS
-h, --help

show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-C, --locallist

List local customizations

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-1, --on

Enable the boolean

-0, --off

Disable the boolean

## EXAMPLE

```
Turn on the apache can send mail boolean
# semanage boolean -m --on httpd_can_sendmail
List customized booleans
# semanage boolean -l -C
```

## SEE ALSO
selinux(8), semanage(8), setsebool(8), getsebool(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-dontaudit

title: semanage-dontaudit(8)

text:
# semanage-dontaudit(8)

## NAME
semanage-dontaudit - SELinux Policy Management dontaudit tool

## SYNOPSIS
semanage dontaudit [-h] [-S STORE] [-N] {on,off}

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage dontaudit toggles whether or not dontaudit rules will be in the policy. Policy writers use dontaudit rules to cause confined applications to use alternative paths. Dontaudit rules are denied but not reported in the logs. Some times dontaudit rules can cause bugs in applications but policy writers will not realize it since the AVC is not audited. Turning off dontaudit rules with this command to see if the kernel is blocking an access.

## OPTIONS
-h, --help

show this help message and exit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-N, --noreload

Do not reload the policy after commit

## EXAMPLE

```
Turn off dontaudit rules
# semanage dontaudit off
```

## SEE ALSO
selinux(8), semanage(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-export

title: semanage-export(8)

text:
# semanage-export(8)

## NAME
semanage-export - SELinux Policy Management import tool

## SYNOPSIS
semanage export [-h] [-S STORE] [-f OUTPUT_FILE]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage import and export can be used to extract the SELinux modifications from one machine and apply them to another. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction.

## OPTIONS
-h, --help

show this help message and exit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-f OUTPUT_FILE, --output_file OUTPUT_FILE

Output file

## EXAMPLE

```
Import semanage modifications from another machine
# semanage export -f semanage.mods
# scp semanage.mod remotemachine:
# ssh remotemachine
# semanage import -f semanage.mods
```

## SEE ALSO
selinux(8), semanage(8), semanage-import(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-fcontext

title: semanage-fcontext(8)

text:
# semanage-fcontext(8)

## NAME
semanage-fcontext - SELinux Policy Management file context tool

## SYNOPSIS
semanage fcontext [-h] [-n] [-N] [-S STORE] [ --add ( -t TYPE -f FTYPE -r RANGE -s SEUSER | -e EQUAL ) FILE_SPEC ) | --delete ( -t TYPE -f FTYPE | -e EQUAL ) FILE_SPEC ) | --deleteall | --extract | --list [-C] | --modify ( -t TYPE -f FTYPE -r RANGE -s SEUSER | -e EQUAL ) FILE_SPEC ) ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage fcontext is used to manage the default file system labeling on an SELinux system. This command maps file paths using regular expressions to SELinux labels.

FILE_SPEC may contain either a fully qualified path, or a Perl compatible regular expression (PCRE), describing fully qualified path(s). The only PCRE flag in use is PCRE2_DOTALL, which causes a wildcard '.' to match anything, including a new line. Strings representing paths are processed as bytes (as opposed to Unicode), meaning that non-ASCII characters are not matched by a single wildcard.

Note, that file context definitions specified using 'semanage fcontext' (i.e. local file context modifications stored in file_contexts.local) have higher priority than those specified in policy modules. This means that whenever a match for given file path is found in file_contexts.local, no other file context definitions are considered. Entries in file_contexts.local are processed from most recent one to the oldest, with first match being used (as opposed to the most specific match, which is used when matching other file context definitions). All regular expressions should therefore be as specific as possible, to avoid unintentionally impacting other parts of the filesystem.

## OPTIONS
-h, --help

show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-C, --locallist

List local customizations

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-e EQUAL, --equal EQUAL

Substitute target path with sourcepath when generating default label. This is used with fcontext. Requires source and target path arguments. The context labeling for the target subtree is made equivalent to that defined for the source.

-f [{a,f,d,c,b,s,l,p}], --ftype [{a,f,d,c,b,s,l,p}]

File Type. This is used with fcontext. Requires a file type as shown in the mode field by ls, e.g. use 'd' to match only directories or 'f' to match only regular files. The following file type options can be passed: f (regular file),d (directory),c (character device), b (block device),s (socket),l (symbolic link),p (named pipe). If you do not specify a file type, the file type will default to "all files".

-s SEUSER, --seuser SEUSER

SELinux user name

-t TYPE, --type TYPE

SELinux Type for the object

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

## EXAMPLE

```
remember to run restorecon after you set the file context
Add file-context for everything under /web
# semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
# restorecon -R -v /web
Substitute /home1 with /home when setting file context
# semanage fcontext -a -e /home /home1
# restorecon -R -v /home1
For home directories under top level directory, for example /disk6/home,
execute the following commands.
# semanage fcontext -a -t home_root_t "/disk6"
# semanage fcontext -a -e /home /disk6/home
# restorecon -R -v /disk6
```

## SEE ALSO
selinux(8), semanage(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-ibendport

title: semanage-ibendport(8)

text:
# semanage-ibendport(8)

## NAME
semanage-ibendport - SELinux Policy Management ibendport mapping tool

## SYNOPSIS
semanage ibendport [-h] [-n] [-N] [-S STORE] [ --add -t TYPE -z IBDEV_NAME -r RANGE port | --delete -z IBDEV_NAME port | --deleteall | --extract | --list [-C] | --modify -t TYPE -z IBDEV_NAME -r RANGE port ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage ibendport controls the ibendport number to ibendport type definitions.

## OPTIONS
-h, --help

show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-C, --locallist

List local customizations

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-t TYPE, --type TYPE

SELinux type for the object

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

-z IBDEV_NAME, --ibdev_name IBDEV_NAME

The name of the infiniband device for the port to be labeled. (ex. mlx5_0)

## EXAMPLE

```
List all ibendport definitions
# semanage ibendport -l
Label mlx4_0 port 2.
# semanage ibendport -a -t allowed_ibendport_t -z mlx4_0 2
```

## SEE ALSO
selinux(8), semanage(8)

## AUTHOR
This man page was written by Daniel Jurgens <danielj@mellanox.com>


semanage-ibpkey

title: semanage-ibpkey(8)

text:
# semanage-ibpkey(8)

## NAME
semanage-ibpkey - SELinux Policy Management ibpkey mapping tool

## SYNOPSIS
semanage ibpkey [-h] [-n] [-N] [-S STORE] [ --add -t TYPE -x SUBNET_PREFIX -r RANGE ibpkey_name | ibpkey_range | --delete -x SUBNET_PREFIX ibpkey_name | ibpkey_range | --deleteall | --extract | --list [-C] | --modify -t TYPE -x SUBNET_PREFIX -r RANGE ibpkey_name | ibpkey_range ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage ibpkey controls the ibpkey number to ibpkey type definitions.

## OPTIONS
-h, --help

show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-C, --locallist

List local customizations

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-t TYPE, --type TYPE

SELinux type for the object

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

-x SUBNET_PREFIX, --subnet_prefix SUBNET_PREFIX

Subnet prefix for the specified pkey or range of pkeys.

## EXAMPLE

```
List all ibpkey definitions
# semanage ibpkey -l
Label pkey 0x8FFF (limited membership default pkey) as a default pkey type
# semanage ibpkey -a -t default_ibpkey_t -x fe80:: 0x8FFF
```

## SEE ALSO
selinux(8), semanage(8)

## AUTHOR
This man page was written by Daniel Jurgens <danielj@mellanox.com>


semanage-import

title: semanage-import(8)

text:
# semanage-import(8)

## NAME
semanage-import - SELinux Policy Management import tool

## SYNOPSIS
semanage import [-h] [-N] [-S STORE] [-f INPUT_FILE]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage import and export can be used to extract the SELinux modifications from one machine and apply them to another. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction.

## OPTIONS
-h, --help

show this help message and exit

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-f INPUT_FILE, --input_file INPUT_FILE

Input file

## EXAMPLE

```
Import semanage modifications from another machine
# semanage import -f semanage.mods
```

## SEE ALSO
selinux (8), semanage (8), semanage-export (8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-interface

title: semanage-interface(8)

text:
# semanage-interface(8)

## NAME
semanage-interface - SELinux Policy Management network interface tool

## SYNOPSIS
semanage interface [-h] [-n] [-N] [-S STORE] [ --add -t TYPE -r RANGE interface | --delete interface | --deleteall | --extract | --list [-C] | --modify -t TYPE -r RANGE interface ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage interface controls the labels assigned to network interfaces.

## OPTIONS
-h, --help

show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-C, --locallist

List local customizations

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-t TYPE, --type TYPE

SELinux type for the object

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

## EXAMPLE

```
list all interface definitions
# semanage interface -l
```

## SEE ALSO
selinux(8), semanage(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-login

title: semanage-login(8)

text:
# semanage-login(8)

## NAME
semanage-login - SELinux Policy Management linux user to SELinux User mapping tool

## SYNOPSIS
semanage login [-h] [-n] [-N] [-S STORE] [ --add -s SEUSER -r RANGE LOGIN | --delete LOGIN | --deleteall | --extract | --list [-C] | --modify -s SEUSER -r RANGE LOGIN ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage login controls the mapping between a Linux User and the SELinux User. It can be used to turn on confined users. For example you could define that a particular user or group of users will login to a system as the user_u user. Prefix the group name with a '%' sign to indicate a group name.

## OPTIONS
-h, --help

show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-C, --locallist

List local customizations

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-s SEUSER, --seuser SEUSER

SELinux user name

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

## EXAMPLE

```
Modify the default user on the system to the guest_u user
# semanage login -m -s guest_u __default__
Assign gijoe user on an MLS machine  a range and to the staff_u user
# semanage login -a -s staff_u -rSystemLow-Secret gijoe
Assign all users in the engineering group to the staff_u user
# semanage login -a -s staff_u %engineering
```

## SEE ALSO
selinux(8), semanage(8), semanage-user(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-module

title: semanage-module(8)

text:
# semanage-module(8)

## NAME
semanage-module - SELinux Policy Management module mapping tool

## SYNOPSIS
semanage module [-h] [-n] [-N] [-S STORE] (-a | -r | -e | -d | --extract | --list [-C] | --deleteall) [module_name]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage module installs, removes, disables SELinux Policy modules.

## OPTIONS
-h, --help

show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-a, --add

Install specified module

-r, --remove

Remove specified module

-d --disable

Disable specified module

-e --enable

Enable specified module

-E, --extract

Extract customizable commands, for use within a transaction

-l, --list

List records of the specified object type

-C, --locallist

List local customizations

## EXAMPLE

```
List all modules
# semanage module -l
Disable unconfined module
# semanage module --disable unconfined
Install custom apache policy module
# semanage module -a myapache
```

## SEE ALSO
selinux(8), semanage(8), semodule(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-node

title: semanage-node(8)

text:
# semanage-node(8)

## NAME
semanage-node - SELinux Policy Management node mapping tool

## SYNOPSIS
semanage node [-h] [-n] [-N] [-S STORE] [ --add -M NETMASK -p PROTOCOL -t TYPE -r RANGE node | --delete -M NETMASK -p PROTOCOL node | --deleteall | --extract | --list [-C] | --modify -M NETMASK -p PROTOCOL -t TYPE -r RANGE node ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage controls the ipaddress to node type definitions.

## OPTIONS
-h, --help

show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-C, --locallist

List local customizations

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-M NETMASK, --netmask NETMASK

Network Mask, either in CIDR (/16) or address mask notation (255.255.0.0, ffff::)

-t TYPE, --type TYPE

SELinux type for the object

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

-p PROTO, --proto PROTO

Protocol for the specified port (tcp|udp) or internet protocol version for the specified node (ipv4|ipv6).


semanage-permissive

title: semanage-permissive(8)

text:
# semanage-permissive(8)

## NAME
semanage-permissive - SELinux Policy Management permissive mapping tool

## SYNOPSIS
semanage permissive [-h] [-n] [-N] [-S STORE] (--add TYPE | --delete TYPE | --deleteall | --extract | --list)

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage permissive adds or removes a SELinux Policy permissive module.

## OPTIONS
-h, --help

show this help message and exit

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-D, --deleteall

Remove all local customizations of permissive domains

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload the policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

## EXAMPLE

```
List all permissive modules
# semanage permissive -l
Make httpd_t (Web Server) a permissive domain
# semanage permissive -a httpd_t
```

## SEE ALSO
selinux(8), semanage(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-port

title: semanage-port(8)

text:
# semanage-port(8)

## NAME
semanage-port - SELinux Policy Management port mapping tool

## SYNOPSIS
semanage port [-h] [-n] [-N] [-S STORE] [ --add -t TYPE -p PROTOCOL -r RANGE port_name | port_range | --delete -p PROTOCOL port_name | port_range | --deleteall | --extract | --list [-C] | --modify -t TYPE -p PROTOCOL -r RANGE port_name | port_range ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage port controls the port number to port type definitions.

## OPTIONS
-h, --help

show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-C, --locallist

List local customizations

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-t TYPE, --type TYPE

SELinux type for the object

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

-p PROTO, --proto PROTO

Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol version for the specified node (ipv4|ipv6).

## EXAMPLE

```
List all port definitions
# semanage port -l
Allow Apache to listen on tcp port 81
# semanage port -a -t http_port_t -p tcp 81
Allow sshd to listen on tcp port 8991
# semanage port -a -t ssh_port_t -p tcp 8991
```

## SEE ALSO
selinux(8), semanage(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semanage-user

title: semanage-user(8)

text:
# semanage-user(8)

## NAME
semanage-user - SELinux Policy Management SELinux User mapping tool

## SYNOPSIS
semanage user [-h] [-n] [-N] [-S STORE] [ --add ( -L LEVEL -R ROLES -r RANGE SEUSER) | --delete SEUSER | --deleteall | --extract | --list [-C] | --modify ( -L LEVEL -R ROLES -r RANGE SEUSER ) ]

## DESCRIPTION
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage user controls the mapping between an SELinux User and the roles and MLS/MCS levels.

## OPTIONS
-h, --help

show this help message and exit

-n, --noheading

Do not print heading when listing the specified object type

-N, --noreload

Do not reload policy after commit

-S STORE, --store STORE

Select an alternate SELinux Policy Store to manage

-C, --locallist

List local customizations

-a, --add

Add a record of the specified object type

-d, --delete

Delete a record of the specified object type

-m, --modify

Modify a record of the specified object type

-l, --list

List records of the specified object type

-E, --extract

Extract customizable commands, for use within a transaction

-D, --deleteall

Remove all local customizations

-L LEVEL, --level LEVEL

Default SELinux Level for SELinux user, s0 Default. (MLS/MCS Systems only)

-r RANGE, --range RANGE

MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.

-R [ROLES], --roles [ROLES]

SELinux Roles. You must enclose multiple roles within quotes, separate by spaces. Or specify -R multiple times.

## EXAMPLE

```
List SELinux users
# semanage user -l
Modify groups for staff_u user
# semanage user -m -R "system_r unconfined_r staff_r" staff_u
Add level for TopSecret Users
# semanage user -a -R "staff_r" -rs0-TopSecret topsecret_u
```

## SEE ALSO
selinux(8), semanage(8), semanage-login(8)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>


semodule

title: semodule(8)

summary: Manage SELinux policy modules.

text:
# semodule(8)

## NAME
semodule - Manage SELinux policy modules.

## SYNOPSIS
semodule [option]... MODE...

## DESCRIPTION
semodule is the tool used to manage SELinux policy modules, including installing, upgrading, listing and removing modules. semodule may also be used to force a rebuild of policy from the module store and/or to force a reload of policy without performing any other transaction. semodule acts on module packages created by semodule_package. Conventionally, these files have a .pp suffix (policy package), although this is not mandated in any way.

## MODES
-R, --reload

force a reload of policy

-B, --build

force a rebuild of policy (also reloads unless -n is used)

-D, --disable_dontaudit

Temporarily remove dontaudits from policy. Reverts whenever policy is rebuilt

-i,--install=MODULE_PKG

install/replace a module package

-u,--upgrade=MODULE_PKG

deprecated, alias for --install

-b,--base=MODULE_PKG

deprecated, alias for --install

-r,--remove=MODULE_NAME

remove existing module at desired priority (defaults to -X 400)

-l[KIND],--list-modules[=KIND]

display list of installed modules (other than base)

KIND:

standard

list highest priority, enabled, non-base modules

full

list all modules

-X,--priority=PRIORITY

set priority for following operations (1-999)

-e,--enable=MODULE_NAME

enable module

-d,--disable=MODULE_NAME

disable module

-E,--extract=MODULE_PKG

Extract a module from the store as an HLL or CIL file to the current directory. A module is extracted as HLL by default. The name of the module written is <module-name>.<lang_ext>

## OPTIONS
-s,--store

name of the store to operate on

-n,--noreload,-N

do not reload policy after commit

-h,--help

prints help message and quit

-P,--preserve_tunables

Preserve tunables in policy

-C,--ignore-module-cache

Recompile CIL modules built from HLL files

-p,--path

Use an alternate path for the policy root

-S,--store-path

Use an alternate path for the policy store root

-v,--verbose

be verbose

-c,--cil

Extract module as a CIL file. This only affects the --extract option and only modules listed in --extract after this option.

-H,--hll

Extract module as an HLL file. This only affects the --extract option and only modules listed in --extract after this option.

## EXAMPLE

```
# Install or replace a base policy package.
$ semodule -b base.pp
# Install or replace a non-base policy package.
$ semodule -i httpd.pp
# Install or replace all non-base modules in the current directory.
# This syntax can be used with -i/u/r/E, but no other option can be entered after the module names
$ semodule -i *.pp
# Install or replace all modules in the current directory.
$ ls *.pp | grep -Ev "base.pp|enableaudit.pp" | xargs /usr/sbin/semodule -b base.pp -i
# List non-base modules.
$ semodule -l
# List all modules including priorities
$ semodule -lfull
# Remove a module at priority 100
$ semodule -X 100 -r wireshark
# Turn on all AVC Messages for which SELinux currently is "dontaudit"ing.
$ semodule -DB
# Turn "dontaudit" rules back on.
$ semodule -B
# Disable a module (all instances of given module across priorities will be disabled).
$ semodule -d alsa
# Install a module at a specific priority.
$ semodule -X 100 -i alsa.pp
# List all modules.
$ semodule --list=full
# Set an alternate path for the policy root
$ semodule -B -p "/tmp"
# Set an alternate path for the policy store root
$ semodule -B -S "/tmp/var/lib/selinux"
# Write the HLL version of puppet and the CIL version of wireshark
# modules at priority 400 to the current working directory
$ semodule -X 400 --hll -E puppet --cil -E wireshark
```

## SEE ALSO
checkmodule(8), semodule_package(8)

## AUTHORS

```
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
The program was written by Karl MacMillan <kmacmillan@tresys.com>, Joshua Brindle <jbrindle@tresys.com>, Jason Tang <jtang@tresys.com>
```


title: semodule_package(8)

summary: Create a SELinux policy module package.

text:
# semodule_package(8)

## NAME
semodule_package - Create a SELinux policy module package.

## SYNOPSIS
semodule_package -o <output file> -m <module> [-f <file contexts>]

## DESCRIPTION
semodule_package is the tool used to create a SELinux policy module package from a binary policy module and optionally other data such as file contexts. semodule_package packages binary policy modules created by checkmodule. The policy package created by semodule_package can then be installed via semodule.

## EXAMPLE

```
# Build a policy package for a base module.
$ semodule_package -o base.pp -m base.mod -f file_contexts
# Build a policy package for a httpd module.
$ semodule_package -o httpd.pp -m httpd.mod -f httpd.fc
# Build a policy package for local TE rules and no file contexts.
$ semodule_package -o local.pp -m local.mod
```

## OPTIONS
-o --outfile <output file>

Policy module package file generated by this tool.

-s --seuser <seuser file>

seuser file to be included in the package.

-u --user_extra <user extra file>

user_extra file to be included in the package.

-m --module <Module file>

Policy module file to be included in the package.

-f --fc <File context file>

File contexts file for the module (optional).

-n --nc <netfilter context file>

netfilter context file to be included in the package.

## SEE ALSO
checkmodule(8), semodule(8), semodule_unpackage(8)

## AUTHORS

```
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
The program was written by Karl MacMillan <kmacmillan@tresys.com>
```


sestatus

title: sestatus(8)

summary: SELinux status tool

text:
# sestatus(8)

## NAME
sestatus - SELinux status tool

## SYNOPSIS
sestatus [-v] [-b]

This tool is used to get the status of a system running SELinux.

## DESCRIPTION
This manual page describes the sestatus program.

This tool is used to get the status of a system running SELinux. It displays data about whether SELinux is enabled or disabled, location of key directories, and the loaded policy with its status as shown in the example:

> sestatus

SELinux status: enabled

SELinuxfs mount: /selinux

SELinux root directory: /etc/selinux

Loaded policy name: targeted

Current mode: permissive

Mode from config file: enforcing

Policy MLS status: enabled

Policy deny_unknown status: allow

Memory protection checking: actual (secure)

Max kernel policy version: 26

sestatus can also be used to display:

-

The security context of files and processes listed in the /etc/sestatus.conf file. The format of this file is described in sestatus.conf(5).

-

The status of booleans.

## OPTIONS
-v

Displays the contexts of files and processes listed in the /etc/sestatus.conf file. It also checks whether the file is a symbolic link, if so then the context of the target file is also shown. The following contexts will always be displayed:

The current process context

The init process context

The controlling terminal file context

-b

Display the current state of booleans.

## FILES
/etc/sestatus.conf

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>.

The program was written by Chris PeBenito <pebenito@gentoo.org>

## SEE ALSO
selinux(8), sestatus.conf(5)


setfiles

title: setfiles(8)

summary: set SELinux file security contexts.

text:
# setfiles(8)

## NAME
setfiles - set SELinux file security contexts.

## SYNOPSIS
setfiles [-c policy] [-d] [-l] [-m] [-n] [-e directory] [-E] [-p] [-s] [-v] [-W] [-F] [-I|-D] spec_file pathname ...

## DESCRIPTION
This manual page describes the setfiles program.

This program is primarily used to initialize the security context fields (extended attributes) on one or more filesystems (or parts of them). Usually it is initially run as part of the SELinux installation process (a step commonly known as labeling).

It can also be run at any other time to correct inconsistent labels, to add support for newly-installed policy or, by using the -n option, to passively check whether the file contexts are all set as specified by the active policy (default behavior) or by some other policy (see the -c option).

If a file object does not have a context, setfiles will write the default context to the file object's extended attributes. If a file object has a context, setfiles will only modify the type portion of the security context. The -F option will force a replacement of the entire context.

## OPTIONS
-c

check the validity of the contexts against the specified binary policy.

-d

show what specification matched each file.

-e directory

directory to exclude (repeat option for more than one directory).

-E

treat conflicting specifications as errors, such as where two hardlinks for the same inode have different contexts.

-f infilename

infilename contains a list of files to be processed. Use “-” for stdin.

-F

Force reset of context to match file_context for customizable files, and the default file context, changing the user, role, range portion as well as the type.

-h, -?

display usage information and exit.

-i

ignore files that do not exist.

-I

ignore digest to force checking of labels even if the stored SHA1 digest matches the specfiles SHA1 digest. The digest will then be updated provided there are no errors. See the NOTES section for further details.

-D

Set or update any directory SHA1 digests. Use this option to enable usage of the security.sehash extended attribute.

-l

log changes in file labels to syslog.

-m

do not read /proc/mounts to obtain a list of non-seclabel mounts to be excluded from relabeling checks. Setting this option is useful where there is a non-seclabel fs mounted with a seclabel fs mounted on a directory below this.

-n

don't change any file labels (passive check).

-o outfilename

Deprecated - This option is no longer supported.

-p

show progress by printing the number of files in 1k blocks unless relabeling the entire OS, that will then show the approximate percentage complete. Note that the -p and -v options are mutually exclusive.

-q

Deprecated, was only used to stop printing inode association parameters.

-r rootpath

use an alternate root path. Used in meta-selinux for OpenEmbedded/Yocto builds to label files under rootpath as if they were at /

-s

take a list of files from standard input instead of using a pathname from the command line (equivalent to “-f -” ).

-v

show changes in file labels and output any inode association parameters. Note that the -v and -p options are mutually exclusive.

-W

display warnings about entries that had no matching files by outputting the selabel_stats(3) results.

-0

the separator for the input items is assumed to be the null character (instead of the white space). The quotes and the backslash characters are also treated as normal characters that can form valid input. This option finally also disables the end of file string, which is treated like any other argument. Useful when input items might contain white space, quote marks or backslashes. The -print0 option of GNU find produces input suitable for this mode.

## ARGUMENTS
spec_file

The specification file which contains lines of the following form:

regexp [type] context | <<none>> The regular expression is anchored at both ends. The optional type field specifies the file type as shown in the mode field by the ls(1) program, e.g. -- to match only regular files or -d to match only directories. The context can be an ordinary security context or the string <<none>> to specify that the file is not to have its context changed.

The last matching specification is used. If there are multiple hard links to a file that match different specifications and those specifications indicate different security contexts, then a warning is displayed but the file is still labeled based on the last matching specification other than <<none>>.

pathname ...

The pathname for the root directory of each file system to be relabeled or a specific directory within a filesystem that should be recursively descended and relabeled or the pathname of a file that should be relabeled. Not used if the -f or the -s option is used.

## NOTES
1.

setfiles operates recursively on directories. Paths leading up the final component of the file(s) are not canonicalized before labeling.

2.

If the pathname specifies the root directory and the -v option is set and the audit system is running, then an audit event is automatically logged stating that a "mass relabel" took place using the message label FS_RELABEL.

3.

To improve performance when relabeling file systems recursively the -D option to setfiles will cause it to store a SHA1 digest of the spec_file set in an extended attribute named security.sehash on each directory specified in pathname ... once the relabeling has been completed successfully. These digests will be checked should setfiles -D be rerun with the same spec_file and pathname parameters. See selinux_restorecon(3) for further details. The -I option will ignore the SHA1 digest from each directory specified in pathname ... and provided the -n option is NOT set, files will be relabeled as required with the digests then being updated provided there are no errors.

## AUTHOR
This man page was written by Russell Coker <russell@coker.com.au>. The program was written by Stephen Smalley <sds@tycho.nsa.gov>

## SEE ALSO
restorecon(8), load_policy(8), checkpolicy(8)


setsebool

title: setsebool(8)

summary: set SELinux boolean value

text:
# setsebool(8)

## NAME
setsebool - set SELinux boolean value

## SYNOPSIS
setsebool [ -PNV ] boolean value | bool1=val1 bool2=val2 ...

## DESCRIPTION
setsebool sets the current state of a particular SELinux boolean or a list of booleans to a given value. The value may be 1 or true or on to enable the boolean, or 0 or false or off to disable it.

Without the -P option, only the current boolean value is affected; the boot-time default settings are not changed.

If the -P option is given, all pending values are written to the policy file on disk. So they will be persistent across reboots.

If the -N option is given, the policy on disk is not reloaded into the kernel.

If the -V option is given, verbose error messages will be printed from semanage libraries.

## AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>. The program was written by Tresys Technology.

## SEE ALSO
getsebool(8), booleans(8), togglesebool(8), semanage(8)


package: policycoreutils-devel

title: semodule_expand(8)

summary: Expand a SELinux policy module package.

text:
# semodule_expand(8)

## NAME
semodule_expand - Expand a SELinux policy module package.

## SYNOPSIS
semodule_expand [-V ] [ -a ] [ -c [version]] basemodpkg outputfile

## DESCRIPTION
semodule_expand is a developer tool for manually expanding a base policy module package into a kernel binary policy file. This tool is not necessary for normal operation of SELinux. In normal operation, such expanding is performed internally by libsemanage in response to semodule commands. Base policy module packages can be created directly by semodule_package or by semodule_link (when linking together a set of packages into a single package).

## OPTIONS
-V

show version

-c [version]

policy version to create

-a

Do not check assertions. This will cause the policy to not check any neverallow rules.

## SEE ALSO
checkmodule(8), semodule_package(8), semodule(8), semodule_link(8) (8),

## AUTHORS

```
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
The program was written by Karl MacMillan <kmacmillan@tresys.com>, Joshua Brindle <jbrindle@tresys.com>
```


title: semodule_link(8)

text:
# semodule_link(8)

## NAME
semodule_link - Link SELinux policy module packages together

## SYNOPSIS
semodule_link [-Vv] [-o outfile] basemodpkg modpkg1 [modpkg2]...

## DESCRIPTION
semodule_link is a developer tool for manually linking together a set of SELinux policy module packages into a single policy module package. This tool is not necessary for normal operation of SELinux. In normal operation, such linking is performed internally by libsemanage in response to semodule commands. Module packages are created by semodule_package.

## OPTIONS
-V

show version

-v

verbose mode

-o <output file>

Linked policy module package generated by this tool.

## SEE ALSO
checkmodule(8), semodule_package(8), semodule(8), semodule_expand(8) (8),

## AUTHORS

```
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
The program was written by Karl MacMillan <kmacmillan@tresys.com>
```


title: semodule_unpackage(8)

text:
# semodule_unpackage(8)

## NAME
semodule_unpackage - Extract policy module and file context file from an SELinux policy module package.

## SYNOPSIS
semodule_unpackage ppfile modfile [fcfile]

## DESCRIPTION
semodule_unpackage is a tool used to extract SELinux policy module file and file context file from an SELinux Policy Package.

## EXAMPLE

```
# Extract the httpd module file from httpd policy package.
$ semodule_unpackage httpd.pp httpd.mod httpd.fc
```

## SEE ALSO
semodule_package(8)

## AUTHORS

```
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
The program was written by Stephen Smalley <sds@tycho.nsa.gov>
```


sepolicy

title: sepolicy(8)

summary: SELinux Policy Inspection tool

text:
# sepolicy(8)

## NAME
sepolicy - SELinux Policy Inspection tool

## SYNOPSIS
sepolicy [-h] [-P policy_path ] {booleans,communicate,generate,interface,manpage,network,transition} OPTIONS

Arguments:

booleans

Query SELinux policy to see description of booleans sepolicy-boolean(8)

communicate

Query SELinux policy to see if domains can communicate with each other sepolicy-communicate(8)

generate

Generate SELinux Policy module template sepolicy-generate(8)

gui

Launch Graphical User Interface for SELinux Policy, requires policycoreutils-gui package. sepolicy-gui(8)

interface

Print SELinux Policy interface information sepolicy-interface(8)

manpage

Generate SELinux man pages sepolicy-manpage(8)

network

Query SELinux policy network information sepolicy-network(8)

transition

Query SELinux Policy to see how a source process domain can transition to the target process domain sepolicy-transition(8)

## DESCRIPTION
sepolicy is a tools set that will query the installed SELinux policy and generate useful reports, man pages, or even new policy modules. See the argument specific man pages for options and descriptions.

## OPTIONS
-P, --policy

Alternate policy to analyze. (Defaults to currently installed policy /sys/fs/selinux/policy)

-h, --help

Display help message

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>

## SEE ALSO
selinux(8), sepolicy-booleans(8), sepolicy-communicate(8), sepolicy-generate(8),sepolicy-gui(8), sepolicy-interface(8), sepolicy-network(8), sepolicy-manpage(8), sepolicy-transition(8)


sepolicy-booleans

title: sepolicy-booleans(8)

text:
# sepolicy-booleans(8)

## NAME
sepolicy-booleans - Query SELinux Policy to see description of booleans

## SYNOPSIS
sepolicy booleans [-h] [ -a | -b booleanname ... ]

## DESCRIPTION
sepolicy booleans will show all booleans and their descriptions, or you can choose individual booleans to display

## OPTIONS
-h, --help

Display help message

-a, --all

Display all boolean descriptions

-b, --boolean

boolean to get description

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>

## SEE ALSO
sepolicy(8), selinux(8), getsebool(8), setsebool(8)


sepolicy-communicate

title: sepolicy-communicate(8)

text:
# sepolicy-communicate(8)

## NAME
sepolicy-communicate - Generate a report showing if two SELinux Policy Domains can communicate

## SYNOPSIS
sepolicy communicate [-h] -s SOURCE -t TARGET [-c TCLASS] [-S SOURCEACCESS] [-T TARGETACCESS]

## DESCRIPTION
Use sepolicy communicate to examine SELinux Policy to if a source SELinux Domain can communicate with a target SELinux Domain. The default command looks to see if there are any file types that the source domain can write, which the target domain can read.

## OPTIONS
-c, --class

Specify the SELinux class which the source domain will attempt to communicate with the target domain. (Default file)

-h, --help

Display help message

-s, --source

Specify the source SELinux domain type.

-S, --sourceaccess

Specify the list of accesses used by the source SELinux domain type to communicate with the target domain. Default Open, Write.

-t, --target

Specify the target SELinux domain type.

-T, --targetaccess

Specify the list of accesses used by the target SELinux domain type to receive communications from the source domain. Default Open, Read.

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>

## SEE ALSO
sepolicy(8), selinux(8)


sepolicy-generate

title: sepolicy-generate(8)

text:
# sepolicy-generate(8)

## NAME
sepolicy-generate - Generate an initial SELinux policy module template.

## SYNOPSIS
Common options

sepolicy generate [-h ] [-p PATH]

Confined Applications

sepolicy generate --application [-n NAME] [-u USER ]command [-w WRITE_PATH ]

sepolicy generate --cgi [-n NAME] command [-w WRITE_PATH ]

sepolicy generate --dbus [-n NAME] command [-w WRITE_PATH ]

sepolicy generate --inetd [-n NAME] command [-w WRITE_PATH ]

sepolicy generate --init [-n NAME] command [-w WRITE_PATH ]

Confined Users

sepolicy generate --admin_user [-r TRANSITION_ROLE] -n NAME

sepolicy generate --confined_admin -n NAME [-a ADMIN_DOMAIN] [-u USER] [-n NAME] [-w WRITE_PATH]

sepolicy generate --desktop_user -n NAME [-w WRITE_PATH]

sepolicy generate --term_user -n NAME [-w WRITE_PATH]

sepolicy generate --x_user -n NAME [-w WRITE_PATH]

Miscellaneous Policy

sepolicy generate --customize -d DOMAIN -n NAME [-a ADMIN_DOMAIN]

sepolicy generate --newtype -t type -n NAME

sepolicy generate --sandbox -n NAME

## DESCRIPTION
Use sepolicy generate to generate an SELinux policy Module.

sepolicy generate will create 5 files.

When specifying a confined application you must specify a path. sepolicy generate will use the rpm payload of the application along with nm -D APPLICATION to help it generate types and policy rules for your policy files.

Type Enforcing File NAME.te

This file can be used to define all the types rules for a particular domain.

Note: Policy generated by sepolicy generate will automatically add a permissive DOMAIN to your te file. When you are satisfied that your policy works, you need to remove the permissive line from the te file to run your domain in enforcing mode.

Interface File NAME.if

This file defines the interfaces for the types generated in the te file, which can be used by other policy domains.

File Context NAME.fc

This file defines the default file context for the system, it takes the file types created in the te file and associates file paths to the types. Tools like restorecon and RPM will use these paths to put down labels.

RPM Spec File NAME_selinux.spec

This file is an RPM SPEC file that can be used to install the SELinux policy on to machines and setup the labeling. The spec file also installs the interface file and a man page describing the policy. You can use sepolicy manpage -d NAME to generate the man page.

Shell File NAME.sh

This is a helper shell script to compile, install and fix the labeling on your test system. It will also generate a man page based on the installed policy, and compile and build an RPM suitable to be installed on other machines

If a generate is possible, this tool will print out all generate paths from the source domain to the target domain

## OPTIONS
-h, --help

Display help message

-d, --domain

Enter domain type(s) which you will be extending

-n, --name

Specify alternate name of policy. The policy will default to the executable or name specified

-p, --path

Specify the directory to store the created policy files. (Default to current working directory ) optional arguments:

-r, --role

Enter role(s) to which this admin user will transition.

-t, --type

Enter type(s) for which you will generate new definition and rule(s)

-u, --user

SELinux user(s) which will transition to this domain

-w, --writepath

Path(s) which the confined processes need to write

-a, --admin

Domain(s) which the confined admin will administrate

--admin_user

Generate Policy for Administrator Login User Role

--application

Generate Policy for User Application

--cgi

Generate Policy for Web Application/Script (CGI)

--confined_admin

Generate Policy for Confined Root Administrator Role

--customize

Generate Policy for Existing Domain Type

--dbus

Generate Policy for DBUS System Daemon

--desktop_user

Generate Policy for Desktop Login User Role

--inetd

Generate Policy for Internet Services Daemon

--init

Generate Policy for Standard Init Daemon (Default)

--newtype

Generate new policy for new types to add to an existing policy.

--sandbox

Generate Policy for Sandbox

--term_user

Generate Policy for Minimal Terminal Login User Role

--x_user

Generate Policy for Minimal X Windows Login User Role

## EXAMPLE
> sepolicy generate --init /usr/sbin/rwhod

Generating Policy for /usr/sbin/rwhod named rwhod

Created the following files:

rwhod.te # Type Enforcement file

rwhod.if # Interface file

rwhod.fc # File Contexts file

rwhod_selinux.spec # Spec file

rwhod.sh # Setup Script

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>

## SEE ALSO
sepolicy(8), selinux(8)


sepolicy-interface

title: sepolicy-interface(8)

text:
# sepolicy-interface(8)

## NAME
sepolicy-interface - Print interface information based on the installed SELinux Policy

## SYNOPSIS
sepolicy interface [-h] [-c] [-v] [-a | -u | -l | -i INTERFACE [INTERFACE ... ]]

## DESCRIPTION
Use sepolicy interface to print interfaces information based on SELinux Policy.

## OPTIONS
-a, --list_admin

List all domains with admin interface

-c, --compile

Test compile of interfaces

-h, --help

Display help message

-i, --interface

Interface(s) to be displayed

-l, --list

List all interfaces

-u, --list_user

List all domains with SELinux user role interface

-v, --verbose

Display extended information about the interface including parameters and description if available.

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>

## SEE ALSO
sepolicy(8), selinux(8)


sepolicy-manpage

title: sepolicy-manpage(8)

text:
# sepolicy-manpage(8)

## NAME
sepolicy-manpage - Generate a man page based on the installed SELinux Policy

## SYNOPSIS
sepolicy manpage [-w] [-h] [-p PATH ] [-r ROOTDIR ] [-a | -d ]

## DESCRIPTION
Use sepolicy manpage to generate manpages based on SELinux Policy.

## OPTIONS
-a, --all

Generate Man Pages for All Domains

-d, --domain

Generate a Man Page for the specified domain. (Supports multiple commands)

-h, --help

Display help message

-p, --path

Specify the directory to store the created man pages. (Default to /tmp)

-r, --root

Specify alternate root directory to generate man pages from. (Default to /)

-w, --web

Generate an additional HTML man pages for the specified domain(s).

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>

## SEE ALSO
sepolicy(8), selinux(8)


sepolicy-network

title: sepolicy-network(8)

text:
# sepolicy-network(8)

## NAME
sepolicy-network - Examine the SELinux Policy and generate a network report

## SYNOPSIS
sepolicy network [-h] (-l | -a application [application ...] | -p PORT [PORT ...] | -t TYPE [TYPE ...] | -d DOMAIN [DOMAIN ...])

## DESCRIPTION
Use sepolicy network to examine SELinux Policy and generate network reports.

## OPTIONS
-a, --application

Generate a report listing the ports to which the specified init application is allowed to connect and or bind.

-d, --domain

Generate a report listing the ports to which the specified domain is allowed to connect and or bind.

-l, --list

List all Network Port Types defined in SELinux Policy

-h, --help

Display help message

-t, --type

Generate a report listing the port numbers associate with the specified SELinux port type.

-p, --port

Generate a report listing the SELinux port types associate with the specified port number.

## EXAMPLES
sepolicy network -p 22

22: tcp ssh_port_t 22

22: udp reserved_port_t 1-511

22: tcp reserved_port_t 1-511

sepolicy network -a /usr/sbin/sshd

sshd_t: tcp name_connect

111 (portmap_port_t)

53 (dns_port_t)

88, 750, 4444 (kerberos_port_t)

9080 (ocsp_port_t)

9180, 9701, 9443-9447 (pki_ca_port_t)

32768-61000 (ephemeral_port_t)

all ports < 1024 (reserved_port_type)

all ports with out defined types (port_t)

sshd_t: tcp name_bind

22 (ssh_port_t)

5900-5983, 5985-5999 (vnc_port_t)

6000-6020 (xserver_port_t)

32768-61000 (ephemeral_port_t)

all ports > 500 and < 1024 (rpc_port_type)

all ports with out defined types (port_t)

sshd_t: udp name_bind

32768-61000 (ephemeral_port_t)

all ports > 500 and < 1024 (rpc_port_type)

all ports with out defined types (port_t)

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>

## SEE ALSO
sepolicy(8), selinux(8), semanage(8)


sepolicy-transition

title: sepolicy-transition(8)

text:
# sepolicy-transition(8)

## NAME
sepolicy-transition - Examine the SELinux Policy and generate a process transition report

## SYNOPSIS
sepolicy transition [-h] -s SOURCE

sepolicy transition [-h] -s SOURCE -t TARGET

## DESCRIPTION
sepolicy transition will show all domains that a give SELinux source domain can transition to, including the entrypoint.

If a target domain is given, sepolicy transition will examine policy for all transition paths from the source domain to the target domain, and will list the paths. If a transition is possible, this tool will print out all transition paths from the source domain to the target domain

## OPTIONS
-h, --help

Display help message

-s, --source

Specify the source SELinux domain type.

-t, --target

Specify the target SELinux domain type.

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>

## SEE ALSO
sepolicy(8), selinux(8)


selinux-polgengui

package: policycoreutils-gui

title: selinux-polgengui(8)

summary: SELinux Policy Generation Tool

text:
# selinux-polgengui(8)

## NAME
selinux-polgengui - SELinux Policy Generation Tool

## SYNOPSIS
selinux-polgengui

## DESCRIPTION
selinux-polgengui is a graphical tool, which can be used to create a framework for building SELinux Policy.

## OPTIONS
None

## FILES
/usr/bin/selinux-polgengui

## Examples
To run the program type:

selinux-polgengui

## SEE ALSO
selinux(1), sepolicy(8), sepolicy-generate(8)

## REPORTING BUGS
Report bugs to <http://bugzilla.redhat.com>.

## LICENSE AND AUTHORS
selinux-polgengui is licensed under the GNU General Public License and is copyrighted by Red Hat, Inc.

This man page was written by Daniel Walsh <dwalsh@redhat.com>


sepolicy-gui

title: sepolicy-gui(8)

text:
# sepolicy-gui(8)

## NAME
sepolicy-gui - Graphical User Interface for SELinux policy.

## SYNOPSIS
Common options

sepolicy gui [-h ] [ -d DOMAIN ]

## DESCRIPTION
Use sepolicy gui to run a the graphical user interface, which allows you to explore how SELinux confines different process domains.

## OPTIONS
-h, --help

Display help message

-d, --domain

Initialize gui to the selected domain.

## AUTHOR
This man page was written by Daniel Walsh <dwalsh@redhat.com>

## SEE ALSO
sepolicy(8), selinux(8)


system-config-selinux

title: system-config-selinux(8)

summary: SELinux Management tool

text:
# system-config-selinux(8)

## NAME
system-config-selinux - SELinux Management tool

## SYNOPSIS
system-config-selinux

## DESCRIPTION
system-config-selinux provides a graphical interface for managing the SELinux configuration.

## OPTIONS
None

## FILES
/usr/bin/system-config-selinux

## Examples
To run the program type:

system-config-selinux

## SEE ALSO
selinux(1), semanage(8)

## REPORTING BUGS
Report bugs to <http://bugzilla.redhat.com>.

## LICENSE AND AUTHORS
system-config-selinux is licensed under the GNU General Public License and is copyrighted by Red Hat, Inc.

This man page was written by Daniel Walsh <dwalsh@redhat.com>


mcs

package: policycoreutils-mcstransd

title: mcs(8)

summary: Multi-Category System

text:
# mcs(8)

## NAME
mcs - Multi-Category System

## DESCRIPTION
MCS (Multiple Category System) allows users to label files on their system within administrator defined categories. It then uses SELinux Mandatory Access Control to protect those files. MCS is a discretionary model to allow users to mark their data with additional tags that further restrict access. The only mandatory aspect is authorizing users for categories by defining their clearance in policy. However, MCS is similar to MLS and exercises the same code paths and share the same support infrastructure. They just differ in their specific configuration.

The /etc/selinux/{SELINUXTYPE}/setrans.conf configuration file translates the labels on disk to human readable form. Administrators can define any labels they want in this file. Certain applications like printing and auditing will use these labels to identify the files. By setting a category on a file you will prevent other applications/services from having access to the files.

Examples of file labels would be PatientRecord, CompanyConfidential etc.

## SEE ALSO
selinux(8), chcon(1)

## FILES
/etc/selinux/{SELINUXTYPE}/setrans.conf


mcstransd

title: mcstransd(8)

text:
# mcstransd(8)

## NAME
mcstransd - MCS (Multiple Category System) daemon. Translates SELinux MCS/MLS labels to human readable form.

## SYNOPSIS
mcstransd [-f] [-h]

## DESCRIPTION
This manual page describes the mcstransd program.

This daemon reads /etc/selinux/{SELINUXTYPE}/setrans.conf configuration file, and communicates with libselinux via a socket in /var/run/setrans.

## OPTIONS
-f

Run mcstransd in the foreground. Do not run as a daemon.

-h

Output a short summary of available command line options.

## AUTHOR
This man page was written by Dan Walsh <dwalsh@redhat.com>. The program was originally written by Dan Walsh <dwalsh@redhat.com>. The program was enhanced/rewritten by Joe Nall <joe@nall.com>.

## FILES
/etc/selinux/{SELINUXTYPE}/setrans.conf

## SEE ALSO
setrans.conf(5),mcs(8)


restorecond

package: policycoreutils-restorecond

title: restorecond(8)

text:
# restorecond(8)

## NAME
restorecond - daemon that watches for file creation and then sets the default SELinux file context

## SYNOPSIS
restorecond [-d] [-h] [-f restorecond_file ] [-u] [-v]

## DESCRIPTION
This manual page describes the restorecond program.

This daemon uses inotify to watch files listed in the /etc/selinux/restorecond.conf, when they are created, this daemon will make sure they have the correct file context associated with the policy.

## OPTIONS
-d

Turns on debugging mode. Application will stay in the foreground and lots of debugs messages start printing.

-h

Print usage statement.

-f restorecond_file

Use alternative restorecond.conf file.

-u

Turns on user mode. Runs restorecond in the user session and reads /etc/selinux/restorecond_user.conf. Uses dbus to make sure only one restorecond is running per user session.

-v

Turns on verbose debugging. (Report missing files)

## AUTHOR
This man page and program was written by Dan Walsh <dwalsh@redhat.com>.

## FILES
/etc/selinux/restorecond.conf /etc/selinux/restorecond_user.conf

## SEE ALSO
restorecon(8),


sandbox

package: policycoreutils-sandbox

title: sandbox(8)

summary: Run cmd under an SELinux sandbox

text:
# sandbox(8)

## NAME
sandbox - Run cmd under an SELinux sandbox

## SYNOPSIS
sandbox [-C] [-s] [ -d DPI ] [-l level ] [[-M | -X] -H homedir -T tempdir ] [-I includefile ] [ -W windowmanager ] [ -w windowsize ] [[-i file ]...] [ -t type ] cmd

sandbox [-C] [-s] [ -d DPI ] [-l level ] [[-M | -X] -H homedir -T tempdir ] [-I includefile ] [ -W windowmanager ] [ -w windowsize ] [[-i file ]...] [ -t type ] -S

## DESCRIPTION
Run the cmd application within a tightly confined SELinux domain. The default sandbox domain only allows applications the ability to read and write stdin, stdout and any other file descriptors handed to it. It is not allowed to open any other files. The -M option will mount an alternate homedir and tmpdir to be used by the sandbox.

If you have the policycoreutils-sandbox package installed, you can use the -X option and the -M option. sandbox -X allows you to run X applications within a sandbox. These applications will start up their own X Server and create a temporary home directory and /tmp. The default SELinux policy does not allow any capabilities or network access. It also prevents all access to the users other processes and files. Files specified on the command that are in the home directory or /tmp will be copied into the sandbox directories.

If directories are specified with -H or -T the directory will have its context modified with chcon(1) unless a level is specified with -l. If the MLS/MCS security level is specified, the user is responsible to set the correct labels.

-h --help

display usage message

-H --homedir

Use alternate homedir to mount over your home directory. Defaults to temporary. Requires -X or -M.

-i --include

Copy this file into the appropriate temporary sandbox directory. Command can be repeated.

-I --includefile

Copy all files listed in inputfile into the appropriate temporary sandbox directories.

-l --level

Specify the MLS/MCS Security Level to run the sandbox with. Defaults to random.

-M --mount

Create a Sandbox with temporary files for $HOME and /tmp.

-s --shred

Shred temporary files created in $HOME and /tmp, before deleting.

-t --type

Use alternate sandbox type, defaults to sandbox_t or sandbox_x_t for -X. Examples:

sandbox_t - No X, No Network Access, No Open, read/write on passed in file descriptors.

sandbox_min_t - No Network Access

sandbox_x_t - Ports for X applications to run locally

sandbox_web_t - Ports required for web browsing

sandbox_net_t - Network ports (for server software)

sandbox_net_client_t - All network ports

-T --tmpdir

Use alternate temporary directory to mount on /tmp. Defaults to tmpfs. Requires -X or -M.

-S --session

Run a full desktop session, Requires level, and home and tmpdir.

-w --windowsize

Specifies the windowsize when creating an X based Sandbox. The default windowsize is 1000x700.

-W --windowmanager

Select alternative window manager to run within sandbox -X. Default to /usr/bin/openbox.

-X

Create an X based Sandbox for gui apps, temporary files for $HOME and /tmp, secondary Xserver, defaults to sandbox_x_t

-d --dpi

Set the DPI value for the sandbox X Server. Defaults to the current X Sever DPI.

-C --capabilities Use capabilities within the

sandbox. By default applications executed within the sandbox will not be allowed to use capabilities (setuid apps), with the -C flag, you can use programs requiring capabilities.

## SEE ALSO
runcon(1), seunshare(8), selinux(8)

## AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com> and Thomas Liu <tliu@fedoraproject.org>


seunshare

title: seunshare(8)

text:
# seunshare(8)

## NAME
seunshare - Run cmd with alternate homedir, tmpdir and/or SELinux context

## SYNOPSIS
seunshare [ -v ] [ -C ] [ -k ] [ -t tmpdir ] [ -h homedir ] [ -Z context ] -- executable [args]

## DESCRIPTION
Run the executable within the specified context, using the alternate home directory and /tmp directory. The seunshare command unshares from the default namespace, then mounts the specified homedir and tmpdir over the default homedir and /tmp. Finally it tells the kernel to execute the application under the specified SELinux context.

-h homedir

Alternate homedir to be used by the application. Homedir must be owned by the user.

-t tmpdir

Use alternate temporary directory to mount on /tmp. tmpdir must be owned by the user.

-C --capabilities

Allow apps executed within the namespace to use capabilities. Default is no capabilities.

-k --kill

Kill all processes with matching MCS level.

-Z context

Use alternate SELinux context while running the executable.

-v

Verbose output

## SEE ALSO
runcon(1), sandbox(8), selinux(8)

## AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com> and Thomas Liu <tliu@fedoraproject.org>


policyd-weight

package: policyd-weight

title: policyd-weight(8)

summary: weighted SMTP policy daemon

text:
# policyd-weight(8)

## NAME
policyd-weight - weighted SMTP policy daemon

## STATUS
Beta, Documentation incomplete

## SYNOPSIS

```

```

policyd-weight [-option] [-option2 <arg>] command

## DESCRIPTION

policyd-weight(8) is a SMTP policy daemon written in perl(1) for postfix(1). It evaluates based on RBL/RHSBL results, HELO and MAIL FROM domain and subdomain arguments and the client IP address the possibility of forgery or SPAM. It is designed to be called before the SMTP DATA command at the RCPT TO stage. This way it is a) possible to reject a mail attempt before the body has been received and b) to keep multirecipient mail intact, i.e. provide the functionality of selective usage based on recipients.

To make policyd-weight(8) work with postfix(1), it is required to add a system account for $USER (default: polw)

Policyd-weight can operate in master.cf or daemon mode. In master.cf mode it uses postfix' spawn(8), which results in number of simultanous requests perl instances. In daemon mode it uses shared memory and forks on load, and only if all childs are busy.

At the time of writing the man-pages for policyd-weight assume a postfix installation. It has been reported that policyd-weight works with other MTAs like Exim, too.

## master.cf mode:
master.cf:

policy unix - n n - - spawn user=polw

argv=/usr/bin/perl /usr/local/bin/policyd-weight

main.cf:

smtpd_recipient_restrictions =

permit_mynetworks,

... authenticated permits ...

reject_unauth_destination,

... whitelists, role accounts, clients ...

check_policy_service unix:private/policy

## daemon mode:
start the daemon with policyd-weight start. Poliyd-weight then listens on $TCP_PORT (default: 12525) for policy requests. To make postfix talk to that port do following changes to main.cf:

main.cf:

smtpd_recipient_restrictions =

permit_mynetworks,

... authenticated permits ...

reject_unauth_destination,

... whitelists, role accounts, clients ...

check_policy_service inet:127.0.0.1:12525

It is possible to have more than one postfix server talk to the daemonized policyd-weight by configuring each postfix machine to query the policy server with check_policy_service inet:IP:12525 where IP is the host on which policyd-weight runs.

Please note that check_policy_service should come at last, or at least after reject_unauth_destination, or else you may become an open relay.

## COMMANDS

Following commands exist and are reserved for daemon mode only:

start start the policy server

stop stop the policy server

restart restart the policy server

reload tells the policy server to reload its configuration

defaults prints the default settings to STDOUT and exits

## OPTIONS

-d operate in debug mode

Not for use in master.cf. In debug mode everything is reported on STDOUT instead of syslog(3). Also an own debug cache daemon will be spawned. The socket-file is named after the value of $SPATH with ".debug" as suffix.

-f /path/to/file

Pass a configuration file to policyd-weight

-h show help

-k kill cache daemon

Not for use in master.cf. Together with -d this kills the debug cache daemon. Without -d it kills the global running cache daemon.

-s show cache entries

Not for use in master.cf.

-v show version

## LOGGING

Logging is done via syslog(3) with facility "mail" and priority "info". For a complete list of log entries and their correspondending configuration parameters refer to policyd-weight.conf(5).

## BUGS

```
Please report bugs to r.felber@ek-muc.de
```

## HISTORY

March 2005

Ralf Hildebrandt (Author of the Book of Postfix) is the spiritual father of policyd-weight. It was his idea to have a scored RBL evaluation, I've added the weighted MAIL FROM/HELO DNS-evaluation. For that purpose I used Meng Wong's spf.pl which was shipped with the postfix source as example.

## FILES

```
/etc/policyd-weight.conf, Policyd-weight configuration file
/etc/postfix/main.cf, Postfix configuration parameters
/etc/postfix/master.cf, Postfix daemon processes
```

## SEE ALSO

```
policyd-weight.conf(5), Policyd-weight configuration file
master(5), Postfix master.cf file syntax
postconf(5), Postfix main.cf file syntax
access(5), Postfix SMTP access control table
```

## LICENSE

```
GNU General Public License
```

## AUTHOR

```
Robert Felber <r.felber@ek-muc.de>
Autohaus Erich Kuttendreier
81827 Munich, Germany
```