CHECKMODULE(8)

💖 CHECKMODULE(8) 💖

okay bestie, this is checkmodule(8) from the System Manager's Manual, and it's literally the glow-up station for SELinux policy modules. buckle up 🎀

---

✨ NAME ✨

checkmodule — the SELinux policy module compiler 👑

---

🌸 SYNOPSIS 🌸

checkmodule [-h] [-b] [-c policy_version] [-C] [-E] [-m] [-M] [-N] [-L]
[-U handle_unknown] [-V] [-o output_file] [input_file]

---

🦋 DESCRIPTION 🦋

so this page is all about the checkmodule command, and honestly? it's iconic.

checkmodule is the program that checks and compiles a SELinux security policy module into a binary representation. no cap.

it can spit out either:

• a base policy module — that's the default, the main character 🫶
• a non-base policy module — that's the -m option, the side quest 💅

and typically you'd build a non-base policy module to add to an existing module store that already has a base module, provided by the base policy. iykyk.

here's the full pipeline, bestie:

1. use semodule_package(8) to combine this module with its optional file contexts → that creates a policy package
2. then use semodule(8) to install the module package into the module store and load the resulting policy ✨

---

💅 OPTIONS 💅

• -b, --binary — read an existing binary policy module file instead of a source policy module file. ngl this one is a development/debugging aid, not the everyday vibe.
• -C, --cil — write a CIL policy file instead of a binary policy file.
• -E, --werror — treat warnings as errors. harsh but fair 😭
• -h, --help — print usage. the classic.
• -m — generate a non-base policy module.
• -M, --mls — enable the MLS/MCS support when checking and compiling the policy module.
• -N, --disable-neverallow — do not check neverallow rules. 🙈
• -L, --line-marker-for-allow — output line markers for allow rules, in addition to neverallow rules. this option increases the size of the output CIL policy file, but those extra line markers help with debugging, especially for neverallow failure reports. > 👑 heads up: it can only be used when writing a CIL policy file.
• -V, --version — show policy versions created by this program.
• -o, --output filename — write a binary policy module file to the specified filename. otherwise? checkmodule will only check the syntax of the module source file and will not generate a binary module at all. literally just vibes and validation.
• -U, --handle-unknown <action> — specify how the kernel should handle unknown classes or permissions (deny, allow or reject).
• -c policyvers — specify the policy version, defaults to the latest.

---

🌈 EXAMPLE 🌈

# Build a MLS/MCS-enabled non-base policy module.
$ checkmodule -M -m httpd.te -o httpd.mod

---

🎀 SEE ALSO 🎀

semodule(8), semodule_package(8) and the SELinux Reference Policy documentation at https://github.com/SELinuxProject/refpolicy/wiki — go read those, bestie, fr fr 📚

---

💜 AUTHOR 💜

this manual page was copied from the checkpolicy man page written by Árpád Magosányi <mag@bunuel.tii.matav.hu>, and edited by Dan Walsh <dwalsh@redhat.com>. legends only 🫶

---

and that's the whole page, babe — checkmodule(8), straight out of the System Manager's Manual. thanks for coming to my ted talk, go compile something gorgeous ✨💖🌸