POLICYGENTOOL(1)

✨ POLICYGENTOOL(1) ✨

okay bestie, so this is policygentool from the Debian GNU/Linux manual — buckle up, we're writing SELinux policy together 💅

🌸 NAME 🌸

policygentool — the interactive SELinux policy generation tool 🧚 no cap, it literally walks you through it.

🎀 SYNOPSIS 🎀

policygentool [options] <Module Name> <full path for application binary file>

🦋 DESCRIPTION 🦋

so like, this tool generates three files for policy development, and they each have a job okay:

• a Type Enforcement (te) file
• a File Context (fc) file
• an Interface File (if)

Most of the policy rules are gonna live in the te file. Use the File Context file to associate file paths with security context. And use the interface rules to let other protected domains interact with the newly defined domains. periodt. 👑

The tool prompts you for locations of pidfiles, any logfiles, files in /var/lib, and any init scripts — plus whether any network access is desirable for the application. Then it generates the appropriate policy rules for the module. ✨

After these files have been generated, the make files for the appropriate SELinux policy — namely, /usr/share/selinux/refpolicy-targeted/include/Makefile or /usr/share/selinux/refpolicy-strict/include/Makefile — can be used to compile the SELinux policy package. And the resulting policy package can be loaded using semodule. it's giving workflow, fr fr:

# /usr/bin/policygentool myapp /usr/bin/myapp
# cat >Makefile
> HEADERDIR:=/usr/share/selinux/refpolicy-targeted/include
> include $(HEADERDIR)/Makefile
> ^D
# make
# semodule -l myapp.pp
# restorecon -R -v /usr/bin/myapp "all files defined in myapp.fc"
# setenforce 0
# /etc/init.d/myapp start
# audit2allow -R -i /var/log/audit/audit.log

💖 OPTIONS 💖

• -h, --help — prints a short usage message. that's it, that's the whole list bestie 🙈

🍓 FILES 🍓

myapp.te, myapp.if, myapp.fc. the trio. the icons. the moment. 🫶

🌈 SEE ALSO 🌈

semodule(8), check_policy(8), load_policy(8) — go read these next, iykyk 💜

💀 BUGS 💀

None known. not me being shocked 😭 clean sheet, slay.

👑 AUTHOR 👑

This manual page was written by Manoj Srivastava <srivasta@debian.org>, for the Debian GNU/Linux system. thank you for your service 🎀

and that's the whole page, bestie! this one's from the Debian crew, dated Feb 27 2007 — vintage but make it iconic ✨🦋 go forth and write some policies 💅