semodule(8)

1SEMODULE(8)                           NSA                          SEMODULE(8)
2
3
4

NAME

6       semodule - Manage SELinux policy modules.
7
8

SYNOPSIS

10       semodule [option]... MODE...
11

DESCRIPTION

13       semodule  is  the tool used to manage SELinux policy modules, including
14       installing, upgrading, listing and removing modules.  semodule may also
15       be  used  to  force a rebuild of policy from the module store and/or to
16       force a reload of policy  without  performing  any  other  transaction.
17       semodule  acts on module packages created by semodule_package.  Conven‐
18       tionally, these files have a .pp suffix (policy package), although this
19       is not mandated in any way.
20
21

MODES

23       -R, --reload
24              force a reload of policy
25
26       -B, --build
27              force a rebuild of policy (also reloads unless -n is used)
28
29       -D, --disable_dontaudit
30              Temporarily  remove  dontaudits  from  policy.  Reverts whenever
31              policy is rebuilt
32
33       -i,--install=MODULE_PKG
34              install/replace a module package
35
36       -u,--upgrade=MODULE_PKG
37              deprecated, alias for --install
38
39       -b,--base=MODULE_PKG
40              deprecated, alias for --install
41
42       -r,--remove=MODULE_NAME
43              remove existing module at desired priority (defaults to -X 400)
44
45       -l[KIND],--list-modules[=KIND]
46              display list of installed modules (other than base)
47
48       KIND:
49
50       standard
51              list highest priority, enabled, non-base modules
52
53       full   list all modules
54
55       -X,--priority=PRIORITY
56              set priority for following operations (1-999)
57
58       -e,--enable=MODULE_NAME
59              enable module
60
61       -d,--disable=MODULE_NAME
62              disable module
63
64       -E,--extract=MODULE_PKG
65              Extract a module from the store as an HLL or  CIL  file  to  the
66              current directory.  A module is extracted as HLL by default. The
67              name of the module written is <module-name>.<lang_ext>
68

OPTIONS

70       -s,--store
71              name of the store to operate on
72
73       -n,--noreload,-N
74              do not reload policy after commit
75
76       -h,--help
77              prints help message and quit
78
79       -P,--preserve_tunables
80              Preserve tunables in policy
81
82       -C,--ignore-module-cache
83              Recompile CIL modules built from HLL files
84
85       -p,--path
86              Use an alternate path for the policy root
87
88       -S,--store-path
89              Use an alternate path for the policy store root
90
91       -v,--verbose
92              be verbose
93
94       -c,--cil
95              Extract module as a CIL file. This only  affects  the  --extract
96              option and only modules listed in --extract after this option.
97
98       -H,--hll
99              Extract  module  as an HLL file. This only affects the --extract
100              option and only modules listed in --extract after this option.
101
102

EXAMPLE

104       # Install or replace a base policy package.
105       $ semodule -b base.pp
106       # Install or replace a non-base policy package.
107       $ semodule -i httpd.pp
108       # Install or replace all non-base modules in the current directory.
109       # This syntax can be used with -i/u/r/E, but no other option can be entered after the module names
110       $ semodule -i *.pp
111       # Install or replace all modules in the current directory.
112       $ ls *.pp | grep -Ev "base.pp|enableaudit.pp" | xargs /usr/sbin/semodule -b base.pp -i
113       # List non-base modules.
114       $ semodule -l
115       # List all modules including priorities
116       $ semodule -lfull
117       # Remove a module at priority 100
118       $ semodule -X 100 -r wireshark
119       # Turn on all AVC Messages for which SELinux currently is "dontaudit"ing.
120       $ semodule -DB
121       # Turn "dontaudit" rules back on.
122       $ semodule -B
123       # Disable a module (all instances of given module across priorities will be disabled).
124       $ semodule -d alsa
125       # Install a module at a specific priority.
126       $ semodule -X 100 -i alsa.pp
127       # List all modules.
128       $ semodule --list=full
129       # Set an alternate path for the policy root
130       $ semodule -B -p "/tmp"
131       # Set an alternate path for the policy store root
132       $ semodule -B -S "/tmp/var/lib/selinux"
133       # Write the HLL version of puppet and the CIL version of wireshark
134       # modules at priority 400 to the current working directory
135       $ semodule -X 400 --hll -E puppet --cil -E wireshark
136
137

AUTHORS

142       This manual page was written by Dan Walsh <dwalsh@redhat.com>.
143       The program was written by Karl MacMillan <kmacmillan@tresys.com>, Joshua Brindle <jbrindle@tresys.com>, Jason Tang <jtang@tresys.com>
144
145
146
147Security Enhanced Linux            Nov 2005                        SEMODULE(8)