semanage8
Selinux policy management tool
Usage
semanage import,export,login,user,port,interface,module,node,fcontext,boolean,permissive,dontaudit,ibpkey,ibendport
import Import
local
customizations
export Output
local
customizations
login Manage
login
mappings
between
linux
users
and
SELinux
confined
users
user Manage
SELinux
confined
users
(Roles
and
levels
for
an
SELinux
user)
port Manage
network
port
type
definitions
interface Manage
network
interface
type
definitions
module Manage
SELinux
policy
modules
node Manage
network
node
type
definitions
fcontext Manage
file
context
mapping
definitions
boolean Manage
booleans
to
selectively
enable
functionality
permissive Manage
process
type
enforcement
mode
dontaudit Disable/Enable
dontaudit
rules
in
policy
ibpkey Manage
infiniband
pkey
type
definitions
ibendport Manage
infiniband
end
port
type
definitions
Overview
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. This includes the mapping from Linux usernames to SELinux user identities (which controls the initial security context assigned to Linux users when they login and bounds their authorized role set) as well as security context mappings for various kinds of objects, such as network ports, interfaces, infiniband pkeys and endports, and nodes (hosts) as well as the file context mapping. Note that the semanage login command deals with the mapping from Linux usernames (logins) to SELinux user identities, while the semanage user command deals with the mapping from SELinux user identities to authorized role sets. In most cases, only the former mapping needs to be adjusted by the administrator; the latter is principally defined by the base policy and usually does not require modification.
Options
-
-h, --help -
List help information
Releases
10 releases since Debian 4.0 (Etch); the text changed 7 times.
--add until Debian 7 (Wheezy);
--delete until Debian 7 (Wheezy);
--deleteall until Debian 7 (Wheezy);
--disable until Debian 7 (Wheezy);
--enable until Debian 7 (Wheezy);
--equal until Debian 7 (Wheezy);
--file until Debian 7 (Wheezy);
--ftype until Debian 7 (Wheezy);
--input until Debian 7 (Wheezy);
--level until Debian 7 (Wheezy);
--list until Debian 7 (Wheezy);
--locallist until Debian 7 (Wheezy);
--mask until Debian 7 (Wheezy);
--modify until Debian 7 (Wheezy);
--noheading until Debian 7 (Wheezy);
--output until Debian 7 (Wheezy);
--prefix until Debian 7 (Wheezy);
--proto until Debian 7 (Wheezy);
--range until Debian 7 (Wheezy);
--role until Debian 7 (Wheezy);
--seuser until Debian 7 (Wheezy);
--store until Debian 7 (Wheezy);
--trans until Debian 5.0 (Lenny);
--type until Debian 7 (Wheezy);
--verbose until Debian 4.0 (Etch);
-C until Debian 7 (Wheezy);
-D until Debian 7 (Wheezy);
-F until Debian 7 (Wheezy);
-L until Debian 7 (Wheezy);
-M until Debian 7 (Wheezy);
-P until Debian 7 (Wheezy);
-R until Debian 7 (Wheezy);
-S until Debian 7 (Wheezy);
-T until Debian 5.0 (Lenny);
-a until Debian 7 (Wheezy);
-d until Debian 7 (Wheezy);
-e until Debian 7 (Wheezy);
-f until Debian 7 (Wheezy);
-i until Debian 7 (Wheezy);
-l until Debian 7 (Wheezy);
-m until Debian 7 (Wheezy);
-n until Debian 7 (Wheezy);
-o until Debian 7 (Wheezy);
-p until Debian 7 (Wheezy);
-r until Debian 7 (Wheezy);
-s until Debian 7 (Wheezy);
-t until Debian 7 (Wheezy);
-v until Debian 4.0 (Etch).