sepolicy-generate(8)

💖 sepolicy-generate — the girlies' guide to SELinux policy modules 💖

okay so bestie, you found your way into sepolicy-generate(8) and honestly? iconic. this is the tool that hands you a whole starter SELinux policy module template so you don't have to stare at an empty .te file and cry. let's get into it 🫶

---

✨ NAME ✨

sepolicy-generate — Generate an initial SELinux policy module template.

like. it literally generates the template for you. no cap.

---

🌸 SYNOPSIS 🌸

💅 Common options

sepolicy generate [-h ] [-p PATH]

🎀 Confined Applications

sepolicy generate --application [-n NAME] [-u USER ]command [-w WRITE_PATH ]
sepolicy generate --cgi [-n NAME] command [-w WRITE_PATH ]
sepolicy generate --dbus [-n NAME] command [-w WRITE_PATH ]
sepolicy generate --inetd [-n NAME] command [-w WRITE_PATH ]
sepolicy generate --init [-n NAME] command [-w WRITE_PATH ]

🦋 Confined Users

sepolicy generate --admin_user [-r TRANSITION_ROLE] -n NAME
sepolicy generate --confined_admin -n NAME [-a ADMIN_DOMAIN] [-u USER]
[-n NAME] [-w WRITE_PATH]
sepolicy generate --desktop_user -n NAME [-w WRITE_PATH]
sepolicy generate --term_user -n NAME [-w WRITE_PATH]
sepolicy generate --x_user -n NAME [-w WRITE_PATH]

🌈 Miscellaneous Policy

sepolicy generate --customize -d DOMAIN -n NAME [-a ADMIN_DOMAIN]
sepolicy generate --newtype -t type -n NAME
sepolicy generate --sandbox -n NAME

---

👑 DESCRIPTION 👑

Use sepolicy generate to generate an SELinux policy Module. that's the whole assignment, and it eats every time. 💅

sepolicy generate will create 5 files. five. a whole little family of files, and you're their mother.

When specifying a confined application you must specify a path — no path, no policy, periodt. sepolicy generate will use the rpm payload of the application along with nm -D APPLICATION to help it generate types and policy rules for your policy files. (yes, it's doing detective work with nm -D, let her cook 🔥)

📄 NAME.te

This file can be used to define all the types enforcement rules for a particular domain.

Note: Policy generated by sepolicy generate will automatically add a permissive DOMAIN to your .te file. When you are satisfied that your policy works, you need to remove the permissive line from the .te file to run your domain in enforcing mode.

so lowkey your domain starts out in permissive mode. that's the training-wheels era. once you're confident, you delete that permissive line and boom — enforcing mode, main character energy, no safety net 😭

📄 NAME.if

This file defines the interfaces for the types generated in the .te file, which can be used by other policy domains. sharing is caring, bestie 🫶

📄 NAME.fc

This file defines the default file context for the system, it takes the file types created in the .te file and associates file paths to the types. Tools like restorecon and RPM will use these paths to put down labels. it's giving matchmaker but for file paths and types 💖

📄 NAME_selinux.spec

This file is an RPM SPEC file that can be used to install the SELinux policy on to machines and setup the labeling. The spec file also installs the interface file and a man page describing the policy. You can use sepolicy manpage -d NAME to generate the man page. (manpage-ception, we love to see it ✨)

📄 NAME.sh

This is a helper shell script to compile, install and fix the labeling on your test system. It will also generate a man page based on the installed policy, and compile and build an RPM suitable to be installed on other machines. it's the whole pipeline in one little script, she's doing the most and we respect it 🎀

---

⭐ OPTIONS ⭐

• -h, --help — Display help message
• -d, --domain — Enter domain type(s) which you will be extending
• -n, --name — Specify alternate name of policy. The policy will default to the executable or name specified
• -p, --path — Specify the directory to store the created policy files. (Default to current working directory )
• -r, --role — Enter role(s) to which this admin user will transition
• -t, --type — Enter type(s) for which you will generate new definition and rule(s)
• -u, --user — SELinux user(s) which will transition to this domain
• -w, --writepath — Path(s) which the confined processes need to write to
• -a, --admin — Domain(s) which the confined admin will administrate

🧚 optional arguments:

• --admin_user — Generate Policy for Administrator Login User Role
• --application — Generate Policy for User Application
• --cgi — Generate Policy for Web Application/Script (CGI)
• --confined_admin — Generate Policy for Confined Root Administrator Role
• --customize — Generate Policy for Existing Domain Type
• --dbus — Generate Policy for DBUS System Daemon
• --desktop_user — Generate Policy for Desktop Login User Role
• --inetd — Generate Policy for Internet Services Daemon
• --init — Generate Policy for Standard Init Daemon (Default)
• --newtype — Generate new policy for new types to add to an existing policy
• --sandbox — Generate Policy for Sandbox
• --term_user — Generate Policy for Minimal Terminal Login User Role
• --x_user — Generate Policy for Minimal X Windows Login User Role

---

💜 EXAMPLE 💜

watch her work her magic:

> sepolicy generate --init /usr/sbin/rwhod
Generating Policy for /usr/sbin/rwhod named rwhod
Created the following files:
rwhod.te # Type Enforcement file
rwhod.if # Interface file
rwhod.fc # File Contexts file
rwhod_selinux.spec # Spec file
rwhod.sh # Setup Script

five files, one command, zero tears. ate and left no crumbs 🔥

---

🌟 AUTHOR 🌟

This man page was written by Daniel Walsh <dwalsh@redhat.com> — thank you king, we are obsessed 🙌

---

🦋 SEE ALSO 🦋

sepolicy(8), selinux(8)

iykyk, go read those next bestie, the lore goes deep 🌈

---

and that's the whole page!! this one's from the 20121005 era of sepolicy-generate(8) — vintage, nostalgic, still slaying 💅💖 go forth and generate your policies, you've got this fr fr ✨