sepolicy-network(8)

💖 sepolicy-network — the manual, but make it make sense 💖

okay bestie, welcome to sepolicy-network(8) — yes, section 8, the sysadmin section, because we are professionals here 💅. This is the page for the sepolicy network command, and by the end of it you're gonna be reading SELinux port types like they're your fave's text messages. no cap. 🦋

---

✨ NAME ✨

sepolicy-network — poke around the SELinux Policy and spit out a network report 🔍🌐

---

🌸 SYNOPSIS 🌸

sepolicy network [-h] (-l | -a application [application ...] | -p PORT
[PORT ...] | -t TYPE [TYPE ...] | -d DOMAIN [DOMAIN ...])

bestie look at those parentheses. you pick exactly one of -l, -a, -p, -t or -d. not two. not zero. one. the options are literally in a group hug and only one of them gets to speak. 🙈

---

🎀 DESCRIPTION 🎀

Use sepolicy network to examine the SELinux Policy and generate network reports. that's it. that's the whole vibe. it's giving "show me the receipts of who's allowed to talk to which ports" 👑✨

---

💅 OPTIONS 💅

• -a, --application — generates a report listing the ports that the init application you named is allowed to connect to and/or bind. feed it an application, get back the tea. 🍵
• -d, --domain — generates a report listing the ports that the domain you named is allowed to connect to and/or bind. same energy as -a, but you're naming a domain. ✨
• -l, --list — lists all Network Port Types defined in the SELinux Policy. the full roster. the whole squad. 📋
• -h, --help — displays the help message. when in doubt, ask for help, it's literally self-care 🫶
• -t, --type — generates a report listing the port numbers associated with the SELinux port type you named. 🧚
• -p, --port — generates a report listing the SELinux port types associated with the port number you named. 🔢

---

🌈 EXAMPLES 🌈

first up, asking about port 22, because of course we start with SSH, it's the main character of ports:

sepolicy network -p 22
22: tcp ssh_port_t 22
22: udp reserved_port_t 1-511
22: tcp reserved_port_t 1-511

see how port 22 shows up three whole times? she contains multitudes 💀 tcp, udp, and the reserved block also claims her. iconic behaviour honestly.

---

next, the big one — asking about the /usr/sbin/sshd application:

sepolicy network -a /usr/sbin/sshd
sshd_t: tcp name_connect
     111 (portmap_port_t)
     53 (dns_port_t)
     88, 750, 4444 (kerberos_port_t)
     9080 (ocsp_port_t)
     9180, 9701, 9443-9447 (pki_ca_port_t)
     32768-61000 (ephemeral_port_t)
     all ports < 1024 (reserved_port_type)
     all ports with out defined types (port_t)
sshd_t: tcp name_bind
     22 (ssh_port_t)
     5900-5983, 5985-5999 (vnc_port_t)
     6000-6020 (xserver_port_t)
     32768-61000 (ephemeral_port_t)
     all ports > 500 and  < 1024 (rpc_port_type)
     all ports with out defined types (port_t)
sshd_t: udp name_bind
     32768-61000 (ephemeral_port_t)
     all ports > 500 and  < 1024 (rpc_port_type)
     all ports with out defined types (port_t)

okay so read it like this: sshd_t is the domain, then the protocol (tcp / udp), then whether it's name_connect or name_bind, and then every port or port range she's allowed to touch, with the port type in parentheses. 🎯 the ranges with all ports are exactly as written — no more, no less. and yes, reserved_port_type and rpc_port_type really do end in _type while the others end in _port_t. that's not a typo, that's just the policy being quirky, we don't question her. 💜

---

🫶 AUTHOR 🫶

This man page was written by Daniel Walsh <dwalsh@redhat.com> — thank you for the lore, king 👑

---

👀 SEE ALSO 👀

sepolicy(8), selinux(8), semanage(8) — go read those next, bestie, they're the extended universe 🌟

---

and that's the whole page!! this one's from 20121005 (yes, a real date, a vintage classic 🍓) and it lives in the sepolicy-network(8) manual page. go forth and sepolicy network responsibly, ily, bye 💖✨🎀