semodule(8)

1SEMODULE(8)                           NSA                          SEMODULE(8)
2
3
4

NAME

6       semodule - Manage SELinux policy modules.
7
8

SYNOPSIS

10       semodule [option]... MODE...
11

DESCRIPTION

13       semodule  is  the tool used to manage SELinux policy modules, including
14       installing, upgrading, listing and removing modules.  semodule may also
15       be  used  to  force a rebuild of policy from the module store and/or to
16       force a reload of policy without performing any other transaction.  se‐
17       module  acts  on  module packages created by semodule_package.  Conven‐
18       tionally, these files have a .pp suffix (policy package), although this
19       is not mandated in any way.
20
21

MODES

23       -R, --reload
24              force a reload of policy
25
26       -B, --build
27              force a rebuild of policy (also reloads unless -n is used)
28
29       --refresh
30              Like --build, but reuses existing linked policy if no changes to
31              module files are detected (by comparing with checksum  from  the
32              last  transaction).   One  can  use this instead of -B to ensure
33              that any changes to the module store done by  an  external  tool
34              (e.g.  a package manager) are applied, while automatically skip‐
35              ping the module re-linking if there are no module changes.
36
37       -D, --disable_dontaudit
38              Temporarily remove dontaudits  from  policy.   Reverts  whenever
39              policy is rebuilt
40
41       -i,--install=MODULE_PKG
42              install/replace a module package
43
44       -u,--upgrade=MODULE_PKG
45              deprecated, alias for --install
46
47       -b,--base=MODULE_PKG
48              deprecated, alias for --install
49
50       -r,--remove=MODULE_NAME
51              remove existing module at desired priority (defaults to -X 400)
52
53       -l[KIND],--list-modules[=KIND]
54              display list of installed modules (other than base)
55
56       KIND:
57
58       standard
59              list highest priority, enabled, non-base modules
60
61       full   list all modules
62
63       -X,--priority=PRIORITY
64              set priority for following operations (1-999)
65
66       -e,--enable=MODULE_NAME
67              enable module
68
69       -d,--disable=MODULE_NAME
70              disable module
71
72       -E,--extract=MODULE_PKG
73              Extract  a  module  from  the store as an HLL or CIL file to the
74              current directory.  A module is extracted as HLL by default. The
75              name of the module written is <module-name>.<lang_ext>
76

OPTIONS

78       -s,--store
79              name of the store to operate on
80
81       -n,--noreload,-N
82              do not reload policy after commit
83
84       -h,--help
85              prints help message and quit
86
87       -P,--preserve_tunables
88              Preserve tunables in policy
89
90       -C,--ignore-module-cache
91              Recompile CIL modules built from HLL files
92
93       -p,--path
94              Use an alternate path for the policy root
95
96       -S,--store-path
97              Use an alternate path for the policy store root
98
99       -v,--verbose
100              be verbose
101
102       -c,--cil
103              Extract  module  as  a CIL file. This only affects the --extract
104              option and only modules listed in --extract after this option.
105
106       -H,--hll
107              Extract module as an HLL file. This only affects  the  --extract
108              option and only modules listed in --extract after this option.
109
110       -m,--checksum
111              Add SHA256 checksum of modules to the list output.
112
113

EXAMPLE

115       # Install or replace a base policy package.
116       $ semodule -b base.pp
117       # Install or replace a non-base policy package.
118       $ semodule -i httpd.pp
119       # Install or replace all non-base modules in the current directory.
120       # This syntax can be used with -i/u/r/E, but no other option can be entered after the module names
121       $ semodule -i *.pp
122       # Install or replace all modules in the current directory.
123       $ ls *.pp | grep -Ev "base.pp|enableaudit.pp" | xargs /usr/sbin/semodule -b base.pp -i
124       # List non-base modules.
125       $ semodule -l
126       # List all modules including priorities
127       $ semodule -lfull
128       # Remove a module at priority 100
129       $ semodule -X 100 -r wireshark
130       # Turn on all AVC Messages for which SELinux currently is "dontaudit"ing.
131       $ semodule -DB
132       # Turn "dontaudit" rules back on.
133       $ semodule -B
134       # Disable a module (all instances of given module across priorities will be disabled).
135       $ semodule -d alsa
136       # Install a module at a specific priority.
137       $ semodule -X 100 -i alsa.pp
138       # Set an alternate path for the policy root
139       $ semodule -B -p "/tmp"
140       # Set an alternate path for the policy store root
141       $ semodule -B -S "/tmp/var/lib/selinux"
142       # Write the HLL version of puppet and the CIL version of wireshark
143       # modules at priority 400 to the current working directory
144       $ semodule -X 400 --hll -E puppet --cil -E wireshark
145       # Check whether a module in "localmodule.pp" file is same as installed module "localmodule"
146       $ /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum
147       $ semodule -l -m | grep localmodule
148       # Translate binary module file into CIL (useful for debugging installation errors)
149       $ /usr/libexec/selinux/hll/pp alsa.pp > alsa.cil
150
151

AUTHORS

156       This manual page was written by Dan Walsh <dwalsh@redhat.com>.
157       The program was written by Karl MacMillan <kmacmillan@tresys.com>, Joshua Brindle <jbrindle@tresys.com>, Jason Tang <jtang@tresys.com>
158
159
160
161Security Enhanced Linux            Nov 2005                        SEMODULE(8)