SEMODULE_EXPAND(8)

📦
version 3.11 · 2 versions
  • 3.11 · alpine 3.24, centos-stream 10, centos-stream 9, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking (latest)
  • 3.5 · debian bookworm, ubuntu jammy, ubuntu noble
, in alpine 3.24, centos-stream 10, centos-stream 9, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 SEMODULE_EXPAND 💖

okay bestie, welcome to the semodule_expand page from the System Manager's Manual (yes it's section 8, we're in the big-kid system-admin section, slay). this one's a little niche, a little dev-tool, a little "why would I ever need this" — but we're gonna get into it anyway because knowledge is the vibe. 🦋

✨ NAME ✨

semodule_expand — Expand a SELinux policy module package.

🌸 SYNOPSIS 🌸

semodule_expand [-ahV] [ -c [version]] basemodpkg outputfile

🎀 DESCRIPTION 🎀

so here's the tea, bestie: semodule_expand is a developer tool that manually expands a base policy module package into a kernel binary policy file. it's giving "I'm doing this by hand because I have Reasons." 💅

and like… you do not need this for normal SELinux operation, fr fr. under normal circumstances, that expanding is done internally by libsemanage whenever you run semodule commands. so it just happens for you, behind the scenes, no thoughts head empty, the system handles it. 😌

where do base policy module packages even come from, you ask? great question, icon behavior:

  • they can be created directly by semodule_package, or
  • they can be created by semodule_link — that's when you're linking a whole set of packages together into one single package. 🔗

💅 OPTIONS 💅

  • -h — show help. we love a little help moment, no shame in asking. 🫶
  • -V — show version. so you know exactly which one you're dealing with. ✨
  • -c [version] — the policy version to create. pick your version, bestie.
  • -a — Do not check assertions. and okay, real talk, this one's a little spicy 🌶️: it will cause the policy to not check any neverallow rules. neverallow rules are literally there to catch stuff that should never happen, so turning them off is you looking at the safety net and going "nah." dramatic but true. 🙈

🔥 SEE ALSO 🔥

(yes that last one really is written like that, we keep the lore intact 💀)

👑 AUTHORS 👑

this manual page was written by Dan Walsh <dwalsh@redhat.com>.

the program itself was written by Karl MacMillan <kmacmillan@tresys.com> and Joshua Brindle <jbrindle@tresys.com>.

and that's the whole page, babe. 🎀 this one's brought to you by Security Enhanced Linux, dated Nov 2005 — vintage, iconic, still doing the most. mwah, go forth and expand responsibly. 💖🌈⭐

📦 where this page comes from