Section 8: administration and privileged commands
semanage-boolean – SELinux Policy Management boolean tool Synopsis semanage boolean [-h] [-n] [-N] [-S STORE] [ –extract | –deleteall | –list [-C] | –modify ( –on | –off ) boolean ] Description semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage boolean command controls…
selinuxexeccon – report SELinux context used for this executable Synopsis selinuxexeccon command [fromcon] Description selinuxexeccon reports the SELinux process context for the specified command from the specified context or the current context. Example # selinuxexeccon /usr/bin/passwd staff_u:staff_r:passwd_t:s0-s0:c0.c1023 # selinuxexeccon /usr/sbin/sendmail system_u:system_r:httpd_t:s0 system_u:system_r:system_mail_t:s0 Author This manual page was written by Dan Walsh <dwalsh [at] redhat.com>. See…
selinuxenabled – tool to be used within shell scripts to determine if selinux is enabled Synopsis selinuxenabled Description Indicates whether SELinux is enabled or disabled. Exit Status It exits with status 0 if SELinux is enabled and 1 if it is not enabled. Author Dan Walsh, <dwalsh [at] redhat.com> See Also selinux(8), setenforce(8), getenforce(8)
selinuxdefcon – report default SELinux context for user Synopsis selinuxdefcon [-l level] user fromcon Description selinuxdefcon reports the default context for the specified user from the specified context -l level mcs/mls level Example # selinuxdefcon jsmith system_u:system_r:sshd_t:s0 unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 AUTHOR This manual page was written by Dan Walsh <dwalsh [at] redhat.com>. See Also secon(8), selinuxconlist(8)
selinuxconlist – list all SELinux context reachable for user Synopsis selinuxconlist [-l level] user [context] Description selinuxconlist reports the list of context reachable for user from the current context or specified context -l level mcs/mls level AUTHOR This manual page was written by Dan Walsh <dwalsh [at] redhat.com>. See Also secon(8), selinuxdefcon(8)
selinux_selinux – Security Enhanced Linux Policy for the selinux processes Description Security-Enhanced Linux secures the selinux processes via flexible mandatory access control. Nsswitch Domain File Contexts SELinux requires files to have an extended attribute to define the file type. You can see the context of a file using the -Z option to lsP Policy governs…
selinux_munin_plugin_selinux – Security Enhanced Linux Policy for the selinux_munin_plugin processes Description Security-Enhanced Linux secures the selinux_munin_plugin processes via flexible mandatory access control. The selinux_munin_plugin processes execute with the selinux_munin_plugin_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
SELinux – NSA Security-Enhanced Linux (SELinux) Description NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system. The SELinux architecture provides general support for the enforcement of many kinds of mandatory access control policies, including those based on the concepts of Type Enforcement®, Role- Based Access…
selinux-polgengui – SELinux Policy Generation Tool Synopsis selinux-polgengui Description selinux-polgengui is a graphical tool, which can be used to create a framework for building SELinux Policy. Options None Files /usr/bin/selinux-polgengui Examples To run the program type: selinux-polgengui See Also selinux(1), sepolicy(8), sepolicy-generate(8) Reporting Bugs Report bugs to <http://bugzilla.redhat.com>. License And Authors selinux-polgengui is licensed under…
select-default-wordlist – select default wordlist Synopsis select-default-wordlist [options] Options (all long only options): –set-default=’regexp’ Try ‘regexp’ to get a single match and set it as default. Fail otherwise. –show-choices Show available choices to STDERR and exit. –debug Enable debug mode Description This program is responsible for selecting default wordlist. If –show-choices is used will just…
select-default-ispell – select default ispell dictionary Synopsis select-default-ispell [options] Options (all long only options): –set-default=’regexp’ Try ‘regexp’ to get a single match and set it as default. Fail otherwise. –show-choices Show available choices to STDERR and exit. –debug Enable debug mode Description This program is responsible for selecting default ispell dictionary. If –show-choices is used…
sefcontext_compile – compile file context regular expression files Synopsis sefcontext_compile [-o outputfile] [-p policyfile] inputfile Description sefcontext_compile is used to compile file context regular expressions into pcre(3) format. The compiled file is used by libselinux file labeling functions. By default sefcontext_compile writes the compiled pcre file with the .bin suffix appended (e.g. inputfile.bin). Options -o…
sedispatch – setroubleshoot audit dispatcher for SELinux Messages Synopsis sedispatch Description This manual page describes the sedispatch program. sedispatch is audit dispatcher. It scans audit messages for SELinux AVC messages, formats them into a dbus message and sends it to setroubleshootd Author This man page was written by Dan Walsh <dwalsh [at] redhat.com>. See Also…
sectoolm_selinux – Security Enhanced Linux Policy for the sectoolm processes Description Security-Enhanced Linux secures the sectoolm processes via flexible mandatory access control. The sectoolm processes execute with the sectoolm_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
secolor.conf – The SELinux color configuration file Description The /etc/selinux/{SELINUXTYPE}/secolor.conf configuation file controls the color to be associated to the context components associated to the raw context passed by selinux_raw_context_to_color(3), when context related information is to be displayed in color by an SELinux-aware application. selinux_raw_context_to_color(3) obtains this color information from the active policy secolor.conf file…
secadm_sudo_selinux – Security Enhanced Linux Policy for the secadm_sudo processes Description Security-Enhanced Linux secures the secadm_sudo processes via flexible mandatory access control. The secadm_sudo processes execute with the secadm_sudo_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
secadm_su_selinux – Security Enhanced Linux Policy for the secadm_su processes Description Security-Enhanced Linux secures the secadm_su processes via flexible mandatory access control. The secadm_su processes execute with the secadm_su_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
secadm_r – Security administrator role – Security Enhanced Linux Policy Description SELinux supports Roles Based Access Control (RBAC), some Linux roles are login roles, while other roles need to be transition into. Note: Examples in this man page will use the staff_u SELinux user. Non login roles are usually used for administrative tasks. For example,…
secadm_screen_selinux – Security Enhanced Linux Policy for the secadm_screen processes Description Security-Enhanced Linux secures the secadm_screen processes via flexible mandatory access control. The secadm_screen processes execute with the secadm_screen_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
seaudit – SELinux graphical audit log analysis tool Synopsis seaudit [OPTIONS] [POLICY …] Description seaudit allows the user to view and filter the contents of a log file. seaudit supports the syslog and auditd log formats and provides queries to inspect the SELinux policy based on log messages. Policy seaudit supports loading a SELinux policy…