man SELinux, semanage, and restorecon

man SELinux, semanage, and restorecon

selinux(8)            SELinux Command Line documentation            selinux(8)

       selinux - NSA Security-Enhanced Linux (SELinux)

       NSA  Security-Enhanced Linux (SELinux) is an implementation of a flexi-
       ble mandatory access control architecture in the Linux  operating  sys-
       tem.   The  SELinux  architecture  provides  general  support  for  the
       enforcement of many kinds of mandatory access control policies, includ-
       ing  those  based  on  the  concepts  of Type Enforcement®, Role- Based
       Access Control, and Multi-Level Security.  Background  information  and
       technical    documentation    about    SELinux    can   be   found   at

       The /etc/selinux/config configuration file controls whether SELinux  is
       enabled  or  disabled, and if enabled, whether SELinux operates in per-
       missive mode or enforcing mode.  The SELINUX variable may be set to any
       one  of  disabled,  permissive,  or  enforcing  to  select one of these
       options.  The disabled option completely disables  the  SELinux  kernel
       and  application  code,  leaving the system running without any SELinux
       protection.  The permissive option enables the SELinux code, but causes
       it  to  operate in a mode where accesses that would be denied by policy
       are permitted but audited.  The enforcing option  enables  the  SELinux
       code  and causes it to enforce access denials as well as auditing them.
       Permissive mode may yield a different set  of  denials  than  enforcing
       mode,  both  because enforcing mode will prevent an operation from pro-
       ceeding past the first denial and because some  application  code  will
       fall back to a less privileged mode of operation if denied access.

       The /etc/selinux/config configuration file also controls what policy is
       active on the system.  SELinux  allows  for  multiple  policies  to  be
       installed on the system, but only one policy may be active at any given
       time.  At present, two kinds of  SELinux  policy  exist:  targeted  and
       strict.   The  targeted  policy is designed as a policy where most pro-
       cesses operate without restrictions, and  only  specific  services  are
       placed  into distinct security domains that are confined by the policy.
       For example, the user would run in a completely unconfined domain while
       the  named  daemon or apache daemon would run in a specific domain tai-
       lored to its operation.  The strict policy  is  designed  as  a  policy
       where  all processes are partitioned into fine-grained security domains
       and confined by policy.  It is anticipated in  the  future  that  other
       policies  will  be created (Multi-Level Security for example).  You can
       define which policy you will run by setting the SELINUXTYPE environment
       variable within /etc/selinux/config.  The corresponding policy configu-
       ration   for   each   such   policy   must   be   installed   in    the
       /etc/selinux/SELINUXTYPE/ directories.

       A given SELinux policy can be customized further based on a set of com-
       pile-time tunable options and a set of runtime policy  booleans.   sys-
       tem-config-securitylevel  allows  customization  of  these booleans and

       Many domains that are protected by SELinux  also  include  selinux  man
       pages explainging how to customize their policy.

       All files, directories, devices ... have a security context/label asso-
       ciated with them.  These context are stored in the extended  attributes
       of  the  file  system.  Problems with SELinux often arise from the file
       system being mislabeled. This can be caused by booting the machine with
       a  non  selinux kernel.  If you see an error message containing file_t,
       that is usually a good indicator that you have a serious  problem  with
       file system labeling.
       The  best  way  to  relabel  the file system is to create the flag file
       /.autorelabel and reboot.  system-config-securitylevel, also  has  this
       capability.   The  restorcon/fixfiles  commands  are also available for
       relabeling files.

       This manual page was written by Dan Walsh <>.

       booleans(8), setsebool(8), selinuxenabled(8), togglesebool(8), restore-
       con(8),       setfiles(8),      ftpd_selinux(8),      named_selinux(8),
       rsync_selinux(8), httpd_selinux(8),  nfs_selinux(8),  samba_selinux(8),
       kerberos_selinux(8), nis_selinux(8), ypbind_selinux(8)

       /etc/selinux/config                 29 Apr 2005                       selinux(8)
semanage(8)                                                        semanage(8)

       semanage - SELinux Policy Management tool

       semanage {login|user|port|interface|fcontext|translation} -l [-n]
       semanage login -{a|d|m} [-sr] login_name
       semanage user -{a|d|m} [-LrRP] selinux_name
       semanage port -{a|d|m} [-tr] [-p protocol] port | port_range
       semanage interface -{a|d|m} [-tr] interface_spec
       semanage fcontext -{a|d|m} [-frst] file_spec
       semanage translation -{a|d|m} [-T] level

       semanage  is used to configure certain elements of SELinux policy with-
       out requiring modification to or  recompilation  from  policy  sources.
       This  includes the mapping from Linux usernames to SELinux user identi-
       ties (which controls the initial security  context  assigned  to  Linux
       users  when they login and bounds their authorized role set) as well as
       security context mappings for various kinds of objects, such as network
       ports,  interfaces,  and nodes (hosts) as well as the file context map-
       ping. See the EXAMPLES section below for some examples of common usage.
       Note  that the semanage login command deals with the mapping from Linux
       usernames (logins) to SELinux user identities, while the semanage  user
       command  deals  with the mapping from SELinux user identities to autho-
       rized role sets.  In most cases, only the former mapping  needs  to  be
       adjusted by the administrator; the latter is principally defined by the
       base policy and usually does not require modification.

       -a, --add
              Add a OBJECT record NAME

       -d, --delete
              Delete a OBJECT record NAME

       -f, --ftype
              File Type.   This is used with fcontext.  Requires a  file  type
              as  shown  in  the  mode  field by ls, e.g. use -d to match only
              directories or -- to match only regular files.

       -h, --help
              display this message

       -l, --list
              List the OBJECTS

       -L, --level
              Default SELinux Level for SELinux use, s0 Default. (MLS/MCS Sys-
              tems only)

       -m, --modify
              Modify a OBJECT record NAME

       -n, --noheading
              Do not print heading when listing OBJECTS.

       -p, --proto
              Protocol for the specified port (tcp|udp).

       -r, --range
              MLS/MCS Security Range (MLS/MCS Systems only)

       -R, --role
              SELinux  Roles.   You must enclose multiple roles within quotes,
              separate by spaces. Or specify -R multiple times.

       -P, --prefix
              SELinux Prefix.  Prefix  added  to  home_dir_t  and  home_t  for
              labeling users home directories.

       -s, --seuser
              SELinux user name

       -t, --type
              SELinux Type for the object

       -T, --trans
              SELinux Translation

       # View SELinux user mappings
       $ semanage user -l
       # Allow joe to login as staff_u
       $ semanage login -a -s staff_u joe
       # Add file-context for everything under /web (used by restorecon)
       $ semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
       # Allow Apache to listen on port 81
       $ semanage port -a -t http_port_t -p tcp 81

       This  man page was written by Daniel Walsh <> and Rus-
       sell Coker <>.  Examples by Thomas Bleher  <ThomasBle->.

                                  2005111103                       semanage(8)
restorecon(8)                                                    restorecon(8)

       restorecon - restore file(s) default SELinux security contexts.

       restorecon [-o outfilename ] [-R] [-n] [-v] [-e directory ] pathname...

       restorecon -f infilename [-o outfilename ] [-e directory  ]  [-R]  [-n]
       [-v] [-F]

       This manual page describes the restorecon program.

       This  program  is  primarily used to set the security context (extended
       attributes) on one or more files.

       It can be run at any time to correct errors, to  add  support  for  new
       policy,  or  with the -n option it can just check whether the file con-
       texts are all as you expect.

       -i     ignore files that do not exist

       -f infilename
              infilename contains a list of files to be processed by  applica-
              tion. Use - for stdin.

       -e directory
              directory  to  exclude  (repeat  option for more than one direc-

       -R -r  change files and directories file labels recursively

       -n     don’t change any file labels.

       -o outfilename
              save list of files with incorrect context in outfilename.

       -v     show changes in file labels.

       -vv    show changes in file labels, if type, role, or user  are  chang-

       -F     Force  reset  of  context to match file_context for customizable
              files, or the user section, if it has changed.

              pathname...  The pathname for the file(s) to be relabeled.

       restorecon does not follow symbolic links.

       This man page was written by Dan Walsh  <>.   Some  of
       the content of this man page was taken from the setfiles man page writ-
       ten by Russell Coker <>.  The program  was  written
       by Dan Walsh <>.

       load_policy(8), checkpolicy(8) setfiles(8)

                                  2002031409                     restorecon(8)

No comments: