semanage(8)

💖 semanage(8) — SELinux Policy Management tool 💖

okay bestie, welcome to semanage(8), the manual page for the SELinux Policy Management tool. yes we're doing SELinux today. hydrate first. 🥤

✨ NAME ✨

semanage — the SELinux Policy Management tool. that's it, that's the whole name, iconic behavior honestly 👑

🌸 SYNOPSIS 🌸

semanage
{import,export,login,user,port,interface,module,node,fcontext,boolean,permissive,dontaudit,ibpkey,ibendport}
                ...  positional arguments:

and here's what each of those little guys does, one by one, no skipping, we don't do that here 🫶

• import — Import local customizations
• export — Output local customizations
• login — Manage login mappings between linux users and SELinux confined users
• user — Manage SELinux confined users (Roles and levels for an SELinux user)
• port — Manage network port type definitions
• interface — Manage network interface type definitions
• module — Manage SELinux policy modules
• node — Manage network node type definitions
• fcontext — Manage file context mapping definitions
• boolean — Manage booleans to selectively enable functionality
• permissive — Manage process type enforcement mode
• dontaudit — Disable/Enable dontaudit rules in policy
• ibpkey — Manage infiniband pkey type definitions
• ibendport — Manage infiniband end port type definitions

🦋 DESCRIPTION 🦋

so like, semanage is your girl for configuring certain elements of SELinux policy without needing to modify or recompile from policy sources. no rebuilding the whole policy just to tweak a thing, we love a low-effort queen 💅

what does that actually cover? it includes:

• the mapping from Linux usernames to SELinux user identities — and that mapping is the thing that controls the initial security context assigned to Linux users when they login, plus it bounds their authorized role set
• security context mappings for various kinds of objects, like network ports, interfaces, infiniband pkeys and endports, and nodes (hosts)
• the file context mapping

now here's the part that trips literally everyone, so pay attention bestie 👀

semanage login deals with the mapping from Linux usernames (logins) to SELinux user identities. semanage user deals with the mapping from SELinux user identities to authorized role sets. two different mappings. do not mix them up. i will know. 😭

and in most cases? only the former mapping needs to be adjusted by the administrator. the latter one is principally defined by the base policy and usually does not require modification. so like, hands off the second one unless you know what you're doing, fr fr ✨

🎀 OPTIONS 🎀

• -h, --help — List help information

🌈 SEE ALSO 🌈

go read these next, they're the rest of the family, no cap:

selinux(8), semanage-boolean(8), semanage-dontaudit(8), semanage-export(8), semanage-fcontext(8), semanage-import(8), semanage-interface(8), semanage-login(8), semanage-module(8), semanage-node(8), semanage-permissive(8), semanage-port(8), semanage-user(8) semanage-ibkey(8), semanage-ibendport(8),

👑 AUTHOR 👑

this man page was written by Daniel Walsh <dwalsh@redhat.com> and Russell Coker <rcoker@redhat.com>. Examples by Thomas Bleher <ThomasBleher@gmx.de>.

also, straight from the source, verbatim: usage: semanage [-h] — that's the whole energy. 🙈

and that's the page bestie!! 🎉 this beauty is dated 20100223 and it lives under the manual section semanage(8). go forth and manage your SELinux policy, you absolute icon, i'm obsessed with you 🫶💖🌸