How to use the command semanage (with examples)

The semanage command is a SELinux Policy Management tool that allows administrators to manage SELinux policies. It provides various options to customize and modify the SELinux configuration. This article will illustrate different use cases of the semanage command.

Use case 1: Output local customizations

Code:

semanage -S store -o path/to/output_file

Motivation: The output local customizations command is used to export the SELinux customizations and save them to a specified file. This is helpful when you want to back up or share the customizations with other systems.

Explanation:

• -S store specifies the SELinux policy store.
• -o path/to/output_file specifies the path where the output file should be saved.

Example output:

SELinux customizations exported successfully to path/to/output_file.

Use case 2: Load commands from a file

Code:

semanage -S store -i path/to/input_file

Motivation: The load commands from a file use case allows administrators to apply a set of commands from a file in a single transaction. This helps in managing SELinux policies in a more efficient way.

Explanation:

• -S store specifies the SELinux policy store.
• -i path/to/input_file specifies the path to the file containing the commands that should be loaded.

Example output:

Commands from path/to/input_file successfully loaded.

Use case 3: Manage booleans

Code:

semanage boolean -S store --delete|--modify|--list|--noheading|--deleteall -on|-off -F boolean|boolean_file

Motivation: The manage booleans use case is helpful for modifying the confinement of processes based on the current SELinux configuration. Booleans allow fine-grained control over access control policies in SELinux.

Explanation:

• -S store specifies the SELinux policy store.
• --delete deletes the specified boolean.
• --modify modifies the value of the specified boolean.
• --list lists all available booleans.
• --noheading omits the heading in the list output.
• --deleteall deletes all booleans.
• -on enables the specified boolean.
• -off disables the specified boolean.
• -F boolean|boolean_file specifies the boolean or the path to a file containing boolean values.

Example output:

Boolean httpd_can_network_connect successfully modified.

Use case 4: Manage policy modules

Code:

semanage module -S store --add|--delete|--list|--modify --enable|--disable module_name

Motivation: The manage policy modules use case allows administrators to manage SELinux policy modules. Policy modules define rules and constraints for different components of the system. This command provides flexibility in adding, deleting, modifying, enabling, or disabling policy modules.

Explanation:

• -S store specifies the SELinux policy store.
• --add adds the specified policy module.
• --delete deletes the specified policy module.
• --list lists all available policy modules.
• --modify modifies the specified policy module.
• --enable enables the specified policy module.
• --disable disables the specified policy module.
• module_name specifies the name of the policy module.

Example output:

Policy module sshd successfully added and enabled.

Use case 5: Disable/Enable dontaudit rules in policy

Code:

semanage dontaudit -S store on|off

Motivation: The disable/enable dontaudit rules in policy use case allows administrators to control the auditing of certain SELinux rules. When set to dontaudit, certain access violations will not be logged. Enabling or disabling dontaudit rules can help in troubleshooting and understanding access violations.

Explanation:

• -S store specifies the SELinux policy store.
• on enables dontaudit rules.
• off disables dontaudit rules.

Example output:

Dontaudit rules successfully disabled.

Conclusion:

The semanage command is a powerful tool for managing SELinux policies. It provides a wide range of options to customize SELinux configuration, manage booleans, policy modules, and dontaudit rules. Understanding the various use cases of the semanage command allows administrators to effectively manage SELinux policies and ensure the proper confinement and access control in their systems.