1SEMODULE(8) NSA SEMODULE(8)
2
3
4
6 semodule - Manage SELinux policy modules.
7
8
10 semodule [option]... MODE...
11
13 semodule is the tool used to manage SELinux policy modules, including
14 installing, upgrading, listing and removing modules. semodule may also
15 be used to force a rebuild of policy from the module store and/or to
16 force a reload of policy without performing any other transaction. se‐
17 module acts on module packages created by semodule_package. Conven‐
18 tionally, these files have a .pp suffix (policy package), although this
19 is not mandated in any way.
20
21
23 -R, --reload
24 force a reload of policy
25
26 -B, --build
27 force a rebuild of policy (also reloads unless -n is used)
28
29 --rebuild-if-modules-changed
30 Force a rebuild of the policy if any changes to module content
31 are detected (by comparing with checksum from the last transac‐
32 tion). One can use this instead of -B to ensure that any
33 changes to the module store done by an external tool (e.g. a
34 package manager) are applied, while automatically skipping the
35 rebuild if there are no new changes.
36
37 -D, --disable_dontaudit
38 Temporarily remove dontaudits from policy. Reverts whenever
39 policy is rebuilt
40
41 -i,--install=MODULE_PKG
42 install/replace a module package
43
44 -u,--upgrade=MODULE_PKG
45 deprecated, alias for --install
46
47 -b,--base=MODULE_PKG
48 deprecated, alias for --install
49
50 -r,--remove=MODULE_NAME
51 remove existing module at desired priority (defaults to -X 400)
52
53 -l[KIND],--list-modules[=KIND]
54 display list of installed modules (other than base)
55
56 KIND:
57
58 standard
59 list highest priority, enabled, non-base modules
60
61 full list all modules
62
63 -X,--priority=PRIORITY
64 set priority for following operations (1-999)
65
66 -e,--enable=MODULE_NAME
67 enable module
68
69 -d,--disable=MODULE_NAME
70 disable module
71
72 -E,--extract=MODULE_PKG
73 Extract a module from the store as an HLL or CIL file to the
74 current directory. A module is extracted as HLL by default. The
75 name of the module written is <module-name>.<lang_ext>
76
78 -s,--store
79 name of the store to operate on
80
81 -n,--noreload,-N
82 do not reload policy after commit
83
84 -h,--help
85 prints help message and quit
86
87 -P,--preserve_tunables
88 Preserve tunables in policy
89
90 -C,--ignore-module-cache
91 Recompile CIL modules built from HLL files
92
93 -p,--path
94 Use an alternate path for the policy root
95
96 -S,--store-path
97 Use an alternate path for the policy store root
98
99 -v,--verbose
100 be verbose
101
102 -c,--cil
103 Extract module as a CIL file. This only affects the --extract
104 option and only modules listed in --extract after this option.
105
106 -H,--hll
107 Extract module as an HLL file. This only affects the --extract
108 option and only modules listed in --extract after this option.
109
110 -m,--checksum
111 Add SHA256 checksum of modules to the list output.
112
113
115 # Install or replace a base policy package.
116 $ semodule -b base.pp
117 # Install or replace a non-base policy package.
118 $ semodule -i httpd.pp
119 # Install or replace all non-base modules in the current directory.
120 # This syntax can be used with -i/u/r/E, but no other option can be entered after the module names
121 $ semodule -i *.pp
122 # Install or replace all modules in the current directory.
123 $ ls *.pp | grep -Ev "base.pp|enableaudit.pp" | xargs /usr/sbin/semodule -b base.pp -i
124 # List non-base modules.
125 $ semodule -l
126 # List all modules including priorities
127 $ semodule -lfull
128 # Remove a module at priority 100
129 $ semodule -X 100 -r wireshark
130 # Turn on all AVC Messages for which SELinux currently is "dontaudit"ing.
131 $ semodule -DB
132 # Turn "dontaudit" rules back on.
133 $ semodule -B
134 # Disable a module (all instances of given module across priorities will be disabled).
135 $ semodule -d alsa
136 # Install a module at a specific priority.
137 $ semodule -X 100 -i alsa.pp
138 # List all modules.
139 $ semodule --list=full
140 # Set an alternate path for the policy root
141 $ semodule -B -p "/tmp"
142 # Set an alternate path for the policy store root
143 $ semodule -B -S "/tmp/var/lib/selinux"
144 # Write the HLL version of puppet and the CIL version of wireshark
145 # modules at priority 400 to the current working directory
146 $ semodule -X 400 --hll -E puppet --cil -E wireshark
147 # Check whether a module in "localmodule.pp" file is same as installed module "localmodule"
148 $ /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum
149 $ semodule -l -m | grep localmodule
150
151
153 checkmodule(8), semodule_package(8)
154
156 This manual page was written by Dan Walsh <dwalsh@redhat.com>.
157 The program was written by Karl MacMillan <kmacmillan@tresys.com>, Joshua Brindle <jbrindle@tresys.com>, Jason Tang <jtang@tresys.com>
158
159
160
161Security Enhanced Linux Nov 2005 SEMODULE(8)