SECILC(8)

📦
version 3.11 · 10 versions
, in ubuntu stonking

🎀 NAME 🎀

okay so bestie, meet secilc. short for SELinux Common Intermediate Language Compiler — yes that's a mouthful, and yes she's secilc(8), the SELinux CIL Compiler section of the manual. she's the one who invokes the CIL compiler. that's literally her whole thing. periodt. 💖

📜 SYNOPSIS 📜

secilc [OPTION...] file

💅 DESCRIPTION 💅

so here's the tea: secilc invokes the CIL compiler with all the arguments you gave her, and out comes a kernel binary policy. that's the goal. that's the assignment and she ate. 🔥

and NOT just that — a file_contexts file gets built too, and the way that works is fully described in the FILE FORMAT section of file_contexts(5). go read it, iykyk. 📖

✨ OPTIONS ✨

  • -o, --output=<file> — write the binary policy to file. default is policy.version. 🫶
  • -f, --filecontext=<file> — write the file contexts to file. default is file_contexts.
  • -t, --target=<type> — pick your target architecture. it may be selinux or xen (default: selinux). choose wisely bestie. 🌈
  • -M, --mls true|false — build an mls policy. it must be true or false, no in-between, no maybe. this one overrides the (mls boolean) statement if that statement is present in the policy. lowkey powerful. 👑
  • -c, --policyvers=<version> — build a binary policy with a given version. default depends on the system's SELinux policy version — peep sestatus(8) for that.
  • -U, --handle-unknown=<action> — how to handle unknown classes or permissions. may be deny, allow, or reject (default: deny). this overrides the (handleunknown action) statement if it's present in the policy.
  • -D, --disable-dontaudit — do NOT add dontaudit rules to the binary policy. not today. 💀
  • -P, --preserve-tunables — treat tunables as booleans.
  • -Q, --qualified-names — allow names containing dots (qualified names). heads up tho: Blocks, blockinherits, blockabstracts, and in-statements will not be allowed. so it's giving trade-offs. 🙈
  • -m, --multiple-decls — allow some statements to be re-declared.
  • -N, --disable-neverallow — do not check neverallow rules. (the name says never, but you said never mind 💀)
  • -G, --expand-generated — expand and remove auto-generated attributes.
  • -X, --expand-size <size> — expand type attributes with fewer than <SIZE> members.
  • -O, --optimize — optimize the final policy (remove redundant rules). declutter queen ✨
  • -v, --verbose — increment the verbosity level. say more, bestie 🗣️
  • -h, --help — display usage information. the classic. 🌸

👀 SEE ALSO 👀

HTML documentation describing the CIL language statements is available starting with docs/html/index.html. ✨

PDF documentation describing the CIL language statements is available at: docs/pdf/CIL_Reference_Guide.pdf. 📄

There is a CIL Design Wiki at: http://github.com/SELinuxProject/cil/wiki that describes the goals and features of the CIL language. go get educated bestie 🦋

💜 AUTHOR 💜

Richard Haines

and that's the whole page, fr fr. this was secilc from 07/07/2026 — source and version, right there — under SECILC(8). slay, stay compiled, mwah 💅💖

📦 where this page comes from