semanage-port(8)

✨ semanage-port ✨ (that's the semanage-port(8) page bestie, SELinux Policy Management port mapping tool energy 💅)

---

okay so picture this: you're deep in SELinux policy, you want to tell the system "hey, this port? it belongs to THIS type" and you do not wanna recompile the entire policy from source like some kind of Victorian orphan. that's literally what this tool is for. it's the port mapping queen 👑

🦋 SYNOPSIS 🦋

semanage port [-h] [-n] [-N] [-S STORE] [ --add -t TYPE -p PROTOCOL -r
RANGE port_name | port_range | --delete -p PROTOCOL port_name |
port_range | --deleteall | --extract | --list [-C] | --modify -t TYPE -p
PROTOCOL -r RANGE port_name | port_range ]

💖 DESCRIPTION 💖

<pink>semanage</pink> is the vibe-check tool for configuring certain elements of SELinux policy without needing to modify or recompile anything from the policy sources. no cap, that's the whole point.

and <hotpink>semanage port</hotpink> specifically? it controls the port number to port type definitions. like, which type owns which port. that's its entire job and it does it flawlessly 💅

🎀 OPTIONS 🎀

• -h, --help — shows you this help message and dips out. exit stage left. ✌️
• -n, --noheading — don't print the heading when you're listing the specified object type. minimalism, but make it policy.
• -N, --noreload — do NOT reload policy after commit. it just… doesn't. okay bestie, your call.
• -S STORE, --store STORE — pick an alternate SELinux Policy Store to manage. shopping around? valid.
• -C, --locallist — lists local customizations only. the stuff you did, not the factory settings.
• -a, --add — add a record of the specified object type. new port, who dis 💅
• -d, --delete — delete a record of the specified object type. gone. bye. blocked.
• -m, --modify — modify a record of the specified object type. glow-up, but for policy.
• -l, --list — list records of the specified object type. the full roster, if you will 📋
• -E, --extract — extract customizable commands, for use within a transaction. little to-go box of commands 🍓
• -D, --deleteall — remove ALL local customizations. everything. scorched earth. are you sure bestie 😭
• -t TYPE, --type TYPE — the SELinux type for the object. this is the whole personality of the thing.
• -r RANGE, --range RANGE — MLS/MCS Security Range (MLS/MCS Systems only). SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.
• -p PROTO, --proto PROTO — Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol version for the specified node (ipv4|ipv6). pick your fighter.

---

🌸 EXAMPLE 🌸

List all port definitions — the full tour, no ticket needed:

# semanage port -l

Allow Apache to listen on tcp port 81 — i.e. assign tcp port 81 label http_port_t, which apache is allowed to listen on. icon behavior, honestly:

# semanage port -a -t http_port_t -p tcp 81

Allow sshd to listen on tcp port 8991 — i.e. assign tcp port 8991 label ssh_port_t, which sshd is allowed to listen on. main character sshd, periodt:

# semanage port -a -t ssh_port_t -p tcp 8991

Add a custom port 9999 with MLS range s0:c0.c255 (MLS/MCS systems only). Verify with seinfo. do the thing, then double check the thing — that's the routine 🫶:

# semanage port -a -t http_port_t -p tcp -r s0:c0.c255 9999
# seinfo --portcon -x | grep 9999

---

👑 SEE ALSO 👑

selinux(8), semanage(8)

🧚 AUTHOR 🧚

This man page was written by Daniel Walsh <dwalsh@redhat.com> — thank you for your service, king 🫡

---

and that's the whole page babes!! this gem was dated <purple>20130617</purple> and lives under the <lavender>semanage-port(8)</lavender> banner, both header and footer, same energy, same facts, no notes. go forth and label your ports correctly 💖✨🌈🦋