Content-type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML><HEAD><TITLE>Man page of semanage.conf</TITLE>
</HEAD><BODY>
<H1>semanage.conf</H1>
Section: File Formats (5)<BR>Updated: September 2011<BR><A HREF="#index">Index</A>
<A HREF="index.html">Return to Main Contents</A><HR>

&quot;Linux System Administration&quot;
<A NAME="lbAB">&nbsp;</A>
<H2>NAME</H2>

semanage.conf - global configuration file for the SELinux Management library
<A NAME="lbAC">&nbsp;</A>
<H2>DESCRIPTION</H2>

The
<B>semanage.conf</B>

file is usually located under the directory /etc/selinux
and it is used for run-time configuration of the
behavior of the SELinux Management library.
<P>
<P>

Each line should contain a configuration parameter
followed by the equal sign (&quot;=&quot;)
and then followed by the configuration value for that parameter.
Anything after the &quot;#&quot; symbol is ignored similarly to empty lines.
<P>
<P>

The following parameters are allowed:
<P>
<DL COMPACT><DT><DD>
<DL COMPACT>
<DT><B>module-store</B>

<DD>
Specify how the SELinux Management library should interact with the
SELinux policy store.
When set to &quot;direct&quot;,
the SELinux Management library writes to the SELinux policy module store
directly
(this is the default setting).
Otherwise a socket path or a server name can be used for the argument.
If the argument begins with &quot;/&quot;
(as in &quot;/foo/bar&quot;),
it represents the path to a named socket
that should be used to connect the policy management server.
If the argument does not begin with a &quot;/&quot;
(as in &quot;example.com:4242&quot;),
it should be interpreted as the name of a remote policy management server
to be used through a TCP connection
(default port is 4242
unless a different one is specified after the server name using the colon
to separate the two fields).
<P>
<DT><B>root</B>

<DD>
Specify an alternative root path to use for the store.
The default is &quot;/&quot;
<P>
<DT><B>store-root</B>

<DD>
Specify an alternative store_root path to use.
The default is &quot;/var/lib/selinux&quot;
<P>
<DT><B>compiler-directory</B>

<DD>
Specify an alternative directory that contains HLL to CIL compilers.
The default value is &quot;/usr/libexec/selinux/hll&quot;.
<P>
<DT><B>ignore-module-cache</B>

<DD>
Whether or not to ignore the cache of CIL modules compiled from HLL.
It can be set to either &quot;true&quot; or &quot;false&quot;
and is set to &quot;false&quot; by default.
If the cache is ignored,
then all CIL modules are recompiled from their HLL modules.
<P>
<DT><B>policy-version</B>

<DD>
When generating the policy,
by default
<B>semanage</B>

will set the policy version to POLICYDB_VERSION_MAX,
as defined in &lt;<A HREF="file:///usr/include/sepol/policydb/policydb.h">sepol/policydb/policydb.h</A>&gt;.
Change this setting
if a different version needs to be set for the policy.
<P>
<DT><B>target-platform</B>

<DD>
The target platform to generate policies for.
Valid values are &quot;selinux&quot; and &quot;xen&quot;,
and is set to &quot;selinux&quot; by default.
<P>
<DT><B>expand-check</B>

<DD>
Whether or not to check &quot;neverallow&quot; rules when executing all
<B>semanage</B>

command. It can be set to either &quot;0&quot;
(disabled)
or &quot;1&quot;
(enabled)
and by default it is enabled.
There might be a large penalty in execution time
if this option is enabled.
<P>
<DT><B>file-mode</B>

<DD>
By default the permission mode for the run-time policy files is set to 0644.
<P>
<DT><B>save-previous</B>

<DD>
It controls
whether the previous module directory is saved after a successful commit
to the policy store
and it can be set to either &quot;true&quot; or &quot;false&quot;.
By default it is set to &quot;false&quot;
(the previous version is deleted).
<P>
<DT><B>save-linked</B>

<DD>
It controls
whether the previously linked module is saved
(with name &quot;base.linked&quot;)
after a successful commit to the policy store.
It can be set to either &quot;true&quot; or &quot;false&quot;
and by default
it is set to &quot;false&quot;
(the previous module is deleted).
<P>
<DT><B>ignoredirs</B>

<DD>
List,
separated by &quot;;&quot;,
of directories to ignore
when setting up users homedirs.
Some distributions use this to stop labeling /root as a homedir.
<P>
<DT><B>usepasswd</B>

<DD>
Whether or not to enable the use
<B>getpwent()</B>

to obtain a list of home directories to label.
It can be set to either &quot;true&quot; or &quot;false&quot;.
By default it is set to &quot;true&quot;.
<P>
<DT><B>disable-genhomedircon</B>

<DD>
It controls whether or not the genhomedircon function is executed when using the
<B>semanage</B>

command
and it can be set to either &quot;false&quot; or &quot;true&quot;.
By default the genhomedircon functionality is enabled
(equivalent to this option set to &quot;false&quot;).
<P>
<DT><B>handle-unknown</B>

<DD>
This option overrides the kernel behavior for handling permissions
defined in the kernel
but missing from the actual policy.
It can be set to &quot;deny&quot;,
&quot;reject&quot; or &quot;allow&quot;.
By default the setting from the policy is taken.
<P>
<DT><B>bzip-blocksize</B>

<DD>
It should be in the range 0-9.
A value of 0 means no compression.
By default the bzip block size is set to 9
(actual block size value is obtained after multiplication by 100,000).
<P>
<DT><B>bzip-small</B>

<DD>
When set to &quot;true&quot;,
the bzip algorithm shall try to reduce its system memory usage.
It can be set to either &quot;true&quot; or &quot;false&quot; and
by default it is set to &quot;false&quot;.
<P>
<DT><B>remove-hll</B>

<DD>
When set to &quot;true&quot;,
HLL files will be removed after compilation into CIL.
In order to delete HLL files already compiled into CIL,
modules will need to be recompiled with the
<B>ignore-module-cache</B>

option set to 'true' or using the
<B>ignore-module-cache</B>

option with semodule.
The remove-hll option can be set to either &quot;true&quot; or &quot;false&quot;
and by default it is set to &quot;false&quot;.
<P>
Please note
that since this option deletes all HLL files,
an updated HLL compiler will not be able to recompile the original HLL
file into CIL.
In order to compile the original HLL file into CIL,
the same HLL file will need to be reinstalled.
<P>
<DT><B>optimize-policy</B>

<DD>
When set to &quot;true&quot;,
the kernel policy will be optimized upon rebuilds.
It can be set to either &quot;true&quot; or &quot;false&quot; and by default it is set to &quot;true&quot;.
<P>
<DT><B>multiple-decls</B>

<DD>
When set to &quot;true&quot;, duplicate type, type attribute, and role declarations will be allowed.
It can be set to either &quot;true&quot; or &quot;false&quot; and by default it is set to &quot;true&quot;.
<P>
</DL>
</DL>

<P>

For certain tasks the SELinux Management library resorts to running
external commands.  For the following commands their path and arguments can
be overridden:
<P>
<DL COMPACT><DT><DD>
<DL COMPACT><DT><DD>
<DL COMPACT>
<DT><B>load_policy</B>

<DD>
Command to load a kernel policy.
Requires no argument.
Defaults to
<I>/sbin/load_policy</I>

with no arguments.
<P>
<DT><B>setfiles</B>

<DD>
Command to verify file context definitions.
Requires two arguments, the path to the kernel policy and the path to the
file context definition file.
Defaults to
<I>/sbin/setfiles</I>

with the arguments '-q -c $@ $&lt;'.
<P>
<DT><B>sefcontext_compile</B>

<DD>
Command to compile a file context definition file.
Requires one argument, the path to the to be compiled file context
definition file.
Defaults to
<I>/sbin/sefcontext_compile</I>

with the argument '$@'.
<P>
</DL>
</DL>

<P>

Either
<I>path</I>

or
<I>args</I>

can be omitted.
The argument string must contain '$@' for the first required argument,
and '$&lt;' for the second one.
The syntax for overriding an external command property is:
<P>
<DL COMPACT><DT><DD>
<P>
[<I>name</I>]
<P>
path = /path/to/command
<P>
args = --flag
<P>
[end]
<P>
</DL>

<P>
<DL COMPACT>
<DT>Example<DD>
<P>
<DL COMPACT><DT><DD>
<P>
[sefcontext_compile]
<P>
path = /usr/sbin/sefcontext_compile
<P>
args = -r $@
<P>
[end]
<P>
</DL>

</DL>
<P>

Optionally the SELinux Management library can invoke external commands to
verify source modules (<B>verify module</B>), linked modules
(<B>verify linked</B>), and kernel policies (<B>verify kernel</B>).
The syntax is identical to the above command overrides.
The program should exit with a value of 0 on success, and non zero on
failure.
<P>
</DL>
<A NAME="lbAD">&nbsp;</A>
<H2>SEE ALSO</H2>

<DL COMPACT>
<DT><B><A HREF="semanage.8.html">semanage</A>(8)</B>

<DD>
<P>
</DL>
<A NAME="lbAE">&nbsp;</A>
<H2>AUTHOR</H2>

This manual page was written by Guido Trentalancia &lt;<A HREF="mailto:guido@trentalancia.com">guido@trentalancia.com</A>&gt;.
<P>
The SELinux management library was written by Tresys Technology LLC
and Red Hat Inc.
<P>

<HR>
<A NAME="index">&nbsp;</A><H2>Index</H2>
<DL>
<DT><A HREF="#lbAB">NAME</A><DD>
<DT><A HREF="#lbAC">DESCRIPTION</A><DD>
<DT><A HREF="#lbAD">SEE ALSO</A><DD>
<DT><A HREF="#lbAE">AUTHOR</A><DD>
</DL>
<HR>
This document was created by
<A HREF="index.html">man2html</A>,
using the manual pages.<BR>
Time: 11:48:47 GMT, September 14, 2026
</BODY>
</HTML>