What it does
semanage writes permanent changes to the local policy. The parts you use most:
semanage fcontext— which label files in a path should get (then apply with restorecon),semanage port— which ports a service type may use,semanage boolean— list and set booleans with descriptions,semanage permissive— make one process type permissive.
Install it with dnf install policycoreutils-python-utils (dnf provides '*/semanage').
How to write it
semanage fcontext -a|-d|-m -t TYPE [-f FTYPE] "PATH-REGEX"
semanage port -a|-d|-m -t TYPE -p tcp|udp PORT[-PORT]
semanage boolean -l | -m --on|--off BOOLEAN
semanage permissive -a|-d|-l TYPE
semanage SUBCOMMAND -l [-C] | -E | -DMain parts
fcontext- File context rules (paths → types).
port- Port types.
boolean- Booleans (with descriptions).
permissive- Permissive process types.
login- Linux users → SELinux users.
user- SELinux users (roles, levels).
module- Policy modules (list, enable, disable, remove).
interface,node,ibpkey,ibendport- Network interface, node and InfiniBand types.
dontaudit- Turn dontaudit rules off or on (to see hidden denials).
import,export- Save / load all local changes (copy to other servers).
Options 18
Most used
Actions
Values
General
Nothing matches this filter.
Examples 11
$ run as a normal user# run as root (or with sudo)
1Label a new web folder
semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?" restorecon -Rv /srv/webThe regex covers the folder and everything below it.
2Same labels as a known folder
semanage fcontext -a -e /var/www /srv/www/srv/www gets the labels of /var/www.
3List your own file rules
semanage fcontext -l -COnly local changes.
4Find the rule for a path
semanage fcontext -l | grep '^/var/www'Which types the policy gives there.
5Allow a new port
semanage port -a -t http_port_t -p tcp 82Apache may now listen on 82.
6Port already used by another type
semanage port -m -t http_port_t -p tcp 8080-m moves it (8080 is http_cache_port_t by default).
7Show port types
semanage port -l | grep -w ssh_port_t ssh_port_t tcp 22, 2222Which ports sshd may use.
8Booleans with descriptions
semanage boolean -l | grep httpd_can_networkCurrent state, default, and what it does.
9Make one domain permissive
semanage permissive -a httpd_t semanage permissive -d httpd_tDebug one service; the rest stays enforcing.
10Copy local changes to another server
semanage export > /root/selinux-local.txt semanage import < /root/selinux-local.txtSame rules on all web servers.
11See hidden denials
semanage dontaudit offShows denials that are normally not logged; turn it on again after debugging.
Nothing matches this filter.
Exit codes
0 | Done. |
1 | Error (like "already defined" or a bad regex). |