CHECKPOLICY(8)

💖 CHECKPOLICY(8) — the checkpolicy era 💖

okay bestie, gather round, because this one is literally the SELinux policy compiler and she is iconic. this is the page for checkpolicy(8) from the System Manager's Manual, and yes we are gonna get through every single flag together, no skipping, no skimming, periodt. 🫶

---

✨ NAME ✨

checkpolicy — SELinux policy compiler 👑

---

🌸 SYNOPSIS 🌸

checkpolicy [-b[F]] [-C] [-d] [-U handle_unknown (allow,deny,reject)]
[-M] [-N] [-L] [-c policyvers] [-o output_file|-] [-S] [-t
target_platform (selinux,xen)] [-O] [-E] [-V] [input_file]

---

🦋 DESCRIPTION 🦋

so like, this manual page describes the checkpolicy command. that's the vibe. 💅

checkpolicy is that girl: she checks and compiles a SELinux security policy configuration into a binary representation that can be loaded into the kernel. main character energy fr fr.

and here's the part where you gotta pay attention: if you don't specify an input file name, checkpolicy will try to read from policy.conf or policy, and which one it picks depends on whether the -b flag is specified. it's giving ✨conditional✨. iykyk.

---

💜 OPTIONS 💜

• -b, --binary — read an existing binary policy file instead of a source policy.conf file. flip the script, bestie 🔄
• -F, --conf — write a policy.conf file instead of a binary policy file. heads up: this can only be used with a binary policy file, so don't try it anywhere else 🙈
• -C, --cil — write a CIL policy file instead of a binary policy file. we love a format change 💖
• -d, --debug — enter debug mode after loading the policy. goblin mode but for debugging 🐛
• -U, --handle-unknown <action> — specify how the kernel should handle unknown classes or permissions. the options are deny, allow or reject. you get to decide their fate 😌
• -M, --mls — enable the MLS policy when checking and compiling the policy. multi-level security said hello 🌈
• -N, --disable-neverallow — do not check neverallow rules. bold move, no cap 💀
• -L, --line-marker-for-allow — output line markers for allow rules, in addition to neverallow rules. this option increases the size of the output CIL policy file, but those extra line markers help with debugging, especially for neverallow failure reports. can only be used when writing a CIL policy file. bigger file, better vibes, worth it 🎀
• -c policyvers — specify the policy version. defaults to the latest, because obviously ✨
• -o, --output filename — write a policy file (binary, policy.conf, or CIL policy) to the specified filename. and if you give - as the filename, it writes to standard output. cute AND flexible 💅
• -S, --sort — sort ocontexts before writing out the binary policy. this makes the output of checkpolicy consistent with binary policies created by semanage and secilc. matching fits, we love to see it 👯
• -t, --target — specify the target platform (selinux or xen). pick your fighter ⚔️
• -O, --optimize — optimize the final kernel policy (removes redundant rules). spring cleaning energy 🧹✨
• -E, --werror — treat warnings as errors. no chill mode, activated 😤
• -V, --version — show version information. say hi to the version number 🫶
• -h, --help — show usage information. when in doubt, -h it out 🦋

---

🍓 EXAMPLE 🍓

Generate policy.conf based on the system policy

# checkpolicy -b -M -F /etc/selinux/targeted/policy/policy.33 -o policy.conf

Recompile system policy so that unknown permissions are denied (uses policy.conf from ^^).

note that binary policy extension represents its version, which is subject to change 👀

# checkpolicy -M -U deny -o /etc/selinux/targeted/policy/policy.33 policy.conf
# load_policy

Generate CIL representation of current system policy

# checkpolicy -b -M -C /etc/selinux/targeted/policy/policy.33 -o policy.out

---

🌟 SEE ALSO 🌟

SELinux Reference Policy documentation at https://github.com/SELinuxProject/refpolicy/wiki

go read it, bestie, it's giving educational 📚✨

---

💐 AUTHOR 💐

this manual page was written by Árpád Magosányi <mag@bunuel.tii.matav.hu>, and edited by Stephen Smalley <stephen.smalley.work@gmail.com>. the program itself was written by Stephen Smalley <stephen.smalley.work@gmail.com>. shoutout to the icons who made this possible 🫡💖

---

and that's the whole page, bestie!! 🎀 this was checkpolicy(8) from the System Manager's Manual — no date on this one so don't come for me, the page simply didn't say 🙈 — stay compiled, stay iconic, mwah 💋✨