1semanage.conf(5)          Linux System Administration         semanage.conf(5)
2
3
4

NAME

6       semanage.conf  -  global  configuration file for the SELinux Management
7       library
8

DESCRIPTION

10       The  semanage.conf  file  is  usually  located  under   the   directory
11       /etc/selinux  and it is used for run-time configuration of the behavior
12       of the SELinux Management library.
13
14
15       Each line should contain a  configuration  parameter  followed  by  the
16       equal  sign ("=") and then followed by the configuration value for that
17       parameter. Anything after the "#" symbol is ignored similarly to  empty
18       lines.
19
20
21       The following parameters are allowed:
22
23
24              module-store
25                     Specify  how the SELinux Management library should inter‐
26                     act with the SELinux policy store. When set to  "direct",
27                     the SELinux Management library writes to the SELinux pol‐
28                     icy module store directly (this is the default  setting).
29                     Otherwise  a socket path or a server name can be used for
30                     the argument.  If the argument begins  with  "/"  (as  in
31                     "/foo/bar"),  it  represents  the  path to a named socket
32                     that should be used  to  connect  the  policy  management
33                     server.  If the argument does not begin with a "/" (as in
34                     "foo.com:4242"), it should be interpreted as the name  of
35                     a  remote  policy  management server to be used through a
36                     TCP connection (default port is 4242 unless  a  different
37                     one is specified after the server name using the colon to
38                     separate the two fields).
39
40
41              root   Specify an alternative root path to use  for  the  store.
42                     The default is "/"
43
44
45              store-root
46                     Specify  an  alternative  store_root  path  to  use.  The
47                     default is "/var/lib/selinux"
48
49
50              compiler-directory
51                     Specify an alternative directory that contains HLL to CIL
52                     compilers.        The        default       value       is
53                     "/usr/libexec/selinux/hll".
54
55
56              ignore-module-cache
57                     Whether or not to ignore the cache of  CIL  modules  com‐
58                     piled from HLL. It can be set to either "true" or "false"
59                     and is set to  "false"  by  default.   If  the  cache  is
60                     ignored,  then  all CIL modules are recompiled from their
61                     HLL modules.
62
63
64              policy-version
65                     When generating the policy, by default semanage will  set
66                     the policy version to POLICYDB_VERSION_MAX, as defined in
67                     <sepol/policydb/policydb.h>. Change  this  setting  if  a
68                     different version needs to be set for the policy.
69
70
71              target-platform
72                     The  target platform to generate policies for. Valid val‐
73                     ues are "selinux" and "xen", and is set to  "selinux"  by
74                     default.
75
76
77              expand-check
78                     Whether or not to check "neverallow" rules when executing
79                     all semanage command. It can be set to either  "0"  (dis‐
80                     abled)  or  "1"  (enabled)  and by default it is enabled.
81                     There might be a large penalty in execution time if  this
82                     option is enabled.
83
84
85              file-mode
86                     By  default  the  permission mode for the run-time policy
87                     files is set to 0644.
88
89
90              save-previous
91                     It controls whether  the  previous  module  directory  is
92                     saved  after  a successful commit to the policy store and
93                     it can be set to either "true" or "false". By default  it
94                     is set to "false" (the previous version is deleted).
95
96
97              save-linked
98                     It controls whether the previously linked module is saved
99                     (with name "base.linked") after a  successful  commit  to
100                     the  policy  store.   It  can  be set to either "true" or
101                     "false" and by default it is set to "false" (the previous
102                     module is deleted).
103
104
105              ignoredirs
106                     List,  separated  by  ";",  of directories to ignore when
107                     setting up users homedirs.  Some distributions  use  this
108                     to stop labeling /root as a homedir.
109
110
111              usepasswd
112                     Whether  or  not to enable the use getpwent() to obtain a
113                     list of home directories to  label.  It  can  be  set  to
114                     either  "true"  or  "false".   By  default  it  is set to
115                     "true".
116
117
118              disable-genhomedircon
119                     It controls whether or not the genhomedircon function  is
120                     executed  when  using  the semanage command and it can be
121                     set to either "false" or "true". By default the  genhome‐
122                     dircon  functionality  is  enabled  (equivalent  to  this
123                     option set to "false").
124
125
126              handle-unknown
127                     This option controls the  kernel  behavior  for  handling
128                     permissions  defined  in  the kernel but missing from the
129                     actual policy.  It can be  set  to  "deny",  "reject"  or
130                     "allow".
131
132
133              bzip-blocksize
134                     It should be in the range 0-9. A value of 0 means no com‐
135                     pression. By default the bzip block  size  is  set  to  9
136                     (actual block size value is obtained after multiplication
137                     by 100000).
138
139
140              bzip-small
141                     When set to "true",  the  bzip  algorithm  shall  try  to
142                     reduce  its  system memory usage. It can be set to either
143                     "true" or "false" and by default it is set to "false".
144
145
146              remove-hll
147                     When set to "true", HLL files will be removed after  com‐
148                     pilation  into  CIL. In order to delete HLL files already
149                     compiled into CIL, modules will  need  to  be  recompiled
150                     with  the  ignore-module-cache  option  set  to 'true' or
151                     using the ignore-module-cache option with  semodule.  The
152                     remove-hll  option can be set to either "true" or "false"
153                     and by default it is set to "false".
154
155                     Please note that since this option deletes all HLL files,
156                     an updated HLL compiler will not be able to recompile the
157                     original HLL file into CIL.   In  order  to  compile  the
158                     original  HLL  file into CIL, the same HLL file will need
159                     to be reinstalled.
160
161

SEE ALSO

163       semanage(8)
164

AUTHOR

166       This manual page was written by  Guido  Trentalancia  <guido@trentalan‐
167       cia.com>.
168
169       The SELinux management library was written by Tresys Technology LLC and
170       Red Hat Inc.
171
172
173
174semanage.conf                   September 2011                semanage.conf(5)
Impressum